//go:build linux

package activator

import (
	"context"
	"crypto/sha256"
	"encoding/hex"
	"os"
	"os/exec"
	"path"

	"github.com/carlosframework/platform/internal/cgroup"
	"github.com/carlosframework/platform/internal/hostbox"
	"github.com/carlosframework/platform/internal/hostclaim"
	"github.com/carlosframework/platform/internal/hostwrite"
	"golang.org/x/sys/unix"
)

// prepareRoleReservation preserves the recoverable reservation primitive for
// the future root integration. It grants no execution capability and Start
// never calls it while the isolated root protocol is unavailable.
func (l RoleLaunch) prepareRoleReservation(ctx context.Context, role string, attempt hostclaim.WakeRetryAttempt, build func() *exec.Cmd) (*exec.Cmd, *cgroup.Prepared, hostbox.LaunchReservation, error) {
	if l.Journal.Remote() || l.Parent == nil || l.ParentPath == "" || l.Work == nil || l.Journal == nil || l.Executable == nil || build == nil || attempt.ID == "" || attempt.InvocationID == "" || attempt.LaunchInputs == "" || attempt.Session != l.Target.Session || attempt.Box != l.Target.Box || attempt.Enrollment != l.Target.Enrollment || attempt.BootID != l.Target.BootID || attempt.ControllerID != l.Target.ControllerID {
		return nil, nil, hostbox.LaunchReservation{}, hostwrite.ErrUnavailable
	}
	var cmd *exec.Cmd
	var executable *os.File
	defer func() {
		if executable != nil {
			executable.Close()
		}
	}()
	var child *cgroup.Prepared
	var reservation hostbox.LaunchReservation
	err := l.Work.With(ctx, l.Identity, func() error {
		if l.Initialize != nil {
			if err := l.Initialize(ctx); err != nil {
				return err
			}
		}
		var err error
		cmd = build()
		if cmd == nil {
			return hostwrite.ErrUnavailable
		}
		executable, err = l.Executable(ctx, cmd)
		if err != nil {
			return err
		}
		if executable == nil {
			return hostwrite.ErrUnavailable
		}
		var stat unix.Stat_t
		if err = unix.Fstat(int(executable.Fd()), &stat); err != nil {
			return err
		}
		if stat.Mode&unix.S_IFMT != unix.S_IFREG || stat.Mode&0111 == 0 {
			return hostwrite.ErrUnavailable
		}
		digest := sha256.Sum256([]byte(role + "\x00" + attempt.ID))
		name := hex.EncodeToString(digest[:16])
		reservation = hostbox.LaunchReservation{ID: attempt.ID + ":" + role, Role: role, InvocationID: attempt.InvocationID, Inputs: attempt.LaunchInputs, Target: l.Target, Group: hostbox.LaunchGroup{RelativePath: path.Join(l.ParentPath, "role-"+name), InvocationID: attempt.InvocationID}, Executable: hostbox.LaunchFile{Device: uint64(stat.Dev), Inode: stat.Ino}}
		child, err = l.Parent.PrepareRoleChildWithIntent(name, func(parent cgroup.ContainmentIdentity) error {
			reservation.Parent = hostbox.LaunchGroup{RelativePath: l.ParentPath, Device: parent.Device, Inode: parent.Inode}
			return l.Journal.IntendRole(ctx, reservation)
		})
		if err != nil {
			return err
		}
		id, err := child.Identity()
		if err != nil {
			return err
		}
		reservation.Group.Device, reservation.Group.Inode = id.Device, id.Inode
		if err = l.Journal.Reserve(ctx, reservation); err != nil {
			return err
		}
		return nil
	})
	return cmd, child, reservation, err
}