//go:build linux || darwin

package fileops

import (
	"os"
	"path/filepath"
	"syscall"
	"testing"
)

func TestWorkspaceModesOverrideRestrictiveUmask(t *testing.T) {
	restoreUmask := syscall.Umask(0o077)
	t.Cleanup(func() { syscall.Umask(restoreUmask) })

	root := t.TempDir()
	nested := filepath.Join(root, "campaign", "session", "artifacts")
	if err := EnsureWorkspaceDirectory(nested); err != nil {
		t.Fatalf("EnsureWorkspaceDirectory() error = %v", err)
	}
	for _, path := range []string{
		filepath.Join(root, "campaign"),
		filepath.Join(root, "campaign", "session"),
		nested,
	} {
		assertWorkspaceDirectoryMode(t, path)
	}

	file := filepath.Join(nested, "result.json")
	if err := WriteFileAtomic(file, []byte("first"), WorkspaceFileMode); err != nil {
		t.Fatalf("WriteFileAtomic(first) error = %v", err)
	}
	if err := WriteFileAtomic(file, []byte("replacement"), WorkspaceFileMode); err != nil {
		t.Fatalf("WriteFileAtomic(replacement) error = %v", err)
	}
	assertWorkspaceFileMode(t, file)
}

func assertWorkspaceDirectoryMode(t *testing.T, path string) {
	t.Helper()
	info, err := os.Stat(path)
	if err != nil {
		t.Fatalf("Stat(%q) error = %v", path, err)
	}
	if got, want := info.Mode().Perm(), WorkspaceDirectoryMode.Perm(); got != want {
		t.Fatalf("directory mode for %q = %o, want %o", path, got, want)
	}
	if info.Mode()&os.ModeSetgid == 0 {
		t.Fatalf("directory mode for %q does not include setgid: %v", path, info.Mode())
	}
}

func assertWorkspaceFileMode(t *testing.T, path string) {
	t.Helper()
	info, err := os.Stat(path)
	if err != nil {
		t.Fatalf("Stat(%q) error = %v", path, err)
	}
	if got, want := info.Mode().Perm(), WorkspaceFileMode.Perm(); got != want {
		t.Fatalf("file mode for %q = %o, want %o", path, got, want)
	}
}