//go:build !windows

package fileops

import (
	"os"
	"path/filepath"
	"syscall"
	"testing"
)

func TestWorkspaceModesOverrideRestrictiveUmask(t *testing.T) {
	restoreUmask := syscall.Umask(0o077)
	t.Cleanup(func() { syscall.Umask(restoreUmask) })

	root := t.TempDir()
	nested := filepath.Join(root, "campaign", "session", "artifacts")
	if err := EnsureWorkspaceDirectory(nested); err != nil {
		t.Fatalf("EnsureWorkspaceDirectory() error = %v", err)
	}
	for _, path := range []string{
		filepath.Join(root, "campaign"),
		filepath.Join(root, "campaign", "session"),
		nested,
	} {
		assertWorkspaceDirectoryMode(t, path)
	}

	file := filepath.Join(nested, "result.json")
	if err := WriteFileAtomic(file, []byte("first"), WorkspaceFileMode); err != nil {
		t.Fatalf("WriteFileAtomic(first) error = %v", err)
	}
	if err := WriteFileAtomic(file, []byte("replacement"), WorkspaceFileMode); err != nil {
		t.Fatalf("WriteFileAtomic(replacement) error = %v", err)
	}
	assertWorkspaceFileMode(t, file)
}

func TestPromoteDirectoryUsesWorkspaceModesUnderRestrictiveUmask(t *testing.T) {
	root := t.TempDir()
	src := filepath.Join(root, "source")
	if err := os.MkdirAll(filepath.Join(src, "nested"), 0o755); err != nil {
		t.Fatalf("MkdirAll(source) error = %v", err)
	}
	if err := os.WriteFile(filepath.Join(src, "nested", "result.json"), []byte("result"), 0o600); err != nil {
		t.Fatalf("WriteFile(source) error = %v", err)
	}

	destinationParent := filepath.Join(root, "workspace", "artifacts", "notarius")
	if err := EnsureWorkspaceDirectory(destinationParent); err != nil {
		t.Fatalf("EnsureWorkspaceDirectory(destination parent) error = %v", err)
	}
	restoreUmask := syscall.Umask(0o077)
	t.Cleanup(func() { syscall.Umask(restoreUmask) })
	destination := filepath.Join(destinationParent, "run-1")
	if err := PromoteDirectory(src, destination); err != nil {
		t.Fatalf("PromoteDirectory() error = %v", err)
	}
	assertWorkspaceDirectoryMode(t, destination)
	assertWorkspaceDirectoryMode(t, filepath.Join(destination, "nested"))
	assertWorkspaceFileMode(t, filepath.Join(destination, "nested", "result.json"))
}

func assertWorkspaceDirectoryMode(t *testing.T, path string) {
	t.Helper()
	info, err := os.Stat(path)
	if err != nil {
		t.Fatalf("Stat(%q) error = %v", path, err)
	}
	if got, want := info.Mode().Perm(), WorkspaceDirectoryMode.Perm(); got != want {
		t.Fatalf("directory mode for %q = %o, want %o", path, got, want)
	}
	if info.Mode()&os.ModeSetgid == 0 {
		t.Fatalf("directory mode for %q does not include setgid: %v", path, info.Mode())
	}
}

func assertWorkspaceFileMode(t *testing.T, path string) {
	t.Helper()
	info, err := os.Stat(path)
	if err != nil {
		t.Fatalf("Stat(%q) error = %v", path, err)
	}
	if got, want := info.Mode().Perm(), WorkspaceFileMode.Perm(); got != want {
		t.Fatalf("file mode for %q = %o, want %o", path, got, want)
	}
}