//go:build linux || darwin

package checkpoint

import (
	"os"
	"path/filepath"
	"syscall"
	"testing"

	"gitea.maximumdirect.net/eric/notarius/internal/core/source"
)

func TestFilesystemCheckpointPermissionsFollowUmask(t *testing.T) {
	for _, test := range []struct {
		name     string
		umask    int
		dirMode  os.FileMode
		fileMode os.FileMode
	}{
		{name: "private", umask: 0o077, dirMode: 0o700, fileMode: 0o600},
		{name: "group", umask: 0o007, dirMode: 0o770, fileMode: 0o660},
	} {
		t.Run(test.name, func(t *testing.T) {
			previousUmask := syscall.Umask(test.umask)
			defer syscall.Umask(previousUmask)

			root := filepath.Join(t.TempDir(), "checkpoints")
			identity, err := NewIdentity(representativeIdentityInput())
			if err != nil {
				t.Fatal(err)
			}
			recorder, err := NewFilesystemRecorder(root, identity)
			if err != nil {
				t.Fatal(err)
			}
			if err := recorder.SourceSucceeded("source-module", sourceDocumentForPermissions()); err != nil {
				t.Fatal(err)
			}

			relative, err := identity.RelativePath()
			if err != nil {
				t.Fatal(err)
			}
			identityRoot := filepath.Join(root, filepath.FromSlash(relative))
			sourceRoot := filepath.Join(identityRoot, "source")
			for path, want := range map[string]os.FileMode{
				root:         test.dirMode,
				identityRoot: test.dirMode,
				sourceRoot:   test.dirMode,
				filepath.Join(sourceRoot, "manifest.json"):        test.fileMode,
				filepath.Join(sourceRoot, "source-document.json"): test.fileMode,
			} {
				assertCheckpointPermissions(t, path, want)
			}
		})
	}
}

func TestFilesystemCheckpointLeavesExistingRootUntouched(t *testing.T) {
	previousUmask := syscall.Umask(0o077)
	defer syscall.Umask(previousUmask)

	root := filepath.Join(t.TempDir(), "checkpoints")
	syscall.Umask(0)
	if err := os.Mkdir(root, 0o751); err != nil {
		t.Fatal(err)
	}
	syscall.Umask(0o077)
	identity, err := NewIdentity(representativeIdentityInput())
	if err != nil {
		t.Fatal(err)
	}
	recorder, err := NewFilesystemRecorder(root, identity)
	if err != nil {
		t.Fatal(err)
	}
	if err := recorder.SourceSucceeded("source-module", sourceDocumentForPermissions()); err != nil {
		t.Fatal(err)
	}
	assertCheckpointPermissions(t, root, 0o751)
}

func sourceDocumentForPermissions() *source.SourceDocument {
	document := checkpointDocument()
	return &document
}

func assertCheckpointPermissions(t *testing.T, path string, want os.FileMode) {
	t.Helper()
	info, err := os.Stat(path)
	if err != nil {
		t.Fatal(err)
	}
	if got := info.Mode().Perm(); got != want {
		t.Fatalf("%s mode = %#o, want %#o", path, got, want)
	}
}