package fileops

import (
	"os"
	"path/filepath"
	"runtime"
	"strings"
	"testing"
)

func TestOpenFileConfinedRejectsNonRegularLeaf(t *testing.T) {
	leaf := filepath.Join(t.TempDir(), "diagnostic.log")
	if err := os.Mkdir(leaf, 0o700); err != nil {
		t.Fatalf("Mkdir() error = %v", err)
	}
	file, err := OpenFileConfined(leaf, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, WorkspaceFileMode)
	if file != nil {
		_ = file.Close()
		t.Fatal("OpenFileConfined() returned a file for a directory")
	}
	if err == nil || !strings.Contains(err.Error(), "not a regular file") {
		t.Fatalf("OpenFileConfined() error = %v, want regular-file rejection", err)
	}
}

func TestOpenFileConfinedRejectsSymlinkWithoutTruncatingTarget(t *testing.T) {
	if runtime.GOOS == "windows" {
		t.Skip("creating symlinks requires privileges that are not available on every Windows runner")
	}
	dir := t.TempDir()
	target := filepath.Join(dir, "target.log")
	const original = "outside content"
	if err := os.WriteFile(target, []byte(original), 0o600); err != nil {
		t.Fatalf("WriteFile(target) error = %v", err)
	}
	leaf := filepath.Join(dir, "diagnostic.log")
	if err := os.Symlink(target, leaf); err != nil {
		t.Fatalf("Symlink() error = %v", err)
	}

	file, err := OpenFileConfined(leaf, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, WorkspaceFileMode)
	if file != nil {
		_ = file.Close()
		t.Fatal("OpenFileConfined() returned a file for a symbolic link")
	}
	if err == nil || !strings.Contains(err.Error(), "symbolic link") {
		t.Fatalf("OpenFileConfined() error = %v, want symbolic-link rejection", err)
	}
	data, readErr := os.ReadFile(target)
	if readErr != nil {
		t.Fatalf("ReadFile(target) error = %v", readErr)
	}
	if string(data) != original {
		t.Fatalf("target content = %q, want %q", data, original)
	}
}