// Package caps: the deterministic drop-in renderer (spec §4a).
//
// RenderService and RenderSocket turn a manifest's Set, filtered through an
// operator's Grants, into the exact bytes of a systemd drop-in — nothing
// else touches disk here (that is Task 6's converge pass; this file is pure
// bytes-in-bytes-out). Directive order is FIXED and every list is sorted, so
// re-rendering an unchanged Set/Grants pair is byte-identical: the converge
// pass's "write only if it differs" check is what keeps an unchanged pass
// from triggering a daemon-reload or a restart.
package caps

import (
	"fmt"
	"sort"
	"strings"
)

// execStartPath is the literal ExecStart target, byte-identical to
// internal/host/units/carlos-app@.service's own `ExecStart=%s serve` line.
// The template is not parameterised by CARLOS_OPT_DIR either — a drop-in
// that disagreed with the template about the path would be a silent split
// brain (spec §4a).
const execStartPath = "/opt/carlos/live/%i"

// docEngineMemoryMax and docEngineMemoryHigh are the resource band a
// document-conversion orchestrator gets, in place of the template's 512M and
// the children tier's 1G. Chromium and LibreOffice are not small: one
// Chromium instance is dozens of processes and hundreds of megabytes before
// it has rendered anything, and a LibreOffice conversion of a large document
// is comparable. The default tier OOM-kills an engine mid-render, which is
// the failure mode that would make this capability useless.
//
// High is 90% of Max, the same throttle-and-reclaim-before-the-kill band the
// children tier uses (1G/920M) and internal/cgroup's highOf applies. (The
// exec-backed path has no engine tier — internal/host's memtier knows only the
// default and children bands — and doc_engine is unit-backed only: an exec
// child that declared it would get these directives from no one. The grant
// door's unit-backed rail is what makes that unreachable.)
const (
	docEngineMemoryMax  = "4G"
	docEngineMemoryHigh = "3680M"
	docEngineTasksMax   = "2048"
)

// docEngineEgressDeny is the private-network fence that pays for the
// resource headroom above, and the reason this capability is a trade rather
// than a gift.
//
// A conversion engine's entire job is fetching URLs a CALLER chose — every
// <img>, <iframe>, CSS @import and JS fetch() in an HTML document, every
// linked image in an Office file. That makes it an SSRF engine by
// construction: hand it a document and it will happily dial whatever the
// document names. The base template fences exactly two addresses
// (carlos-app@.service's IPAddressDeny of the IMDS pair), so without this
// list an engine reaches every other tenant's private-subnet upstream, the
// whole VPC, and cloud internal services in the CGNAT range.
//
// What this fence does NOT do, stated plainly because a comment that hid it
// would hide the real residual risk: LOOPBACK STAYS OPEN (see below), so
// anything listening on 127.0.0.1 on the engine's own box — a co-tenant
// console, a co-tenant's Addr-route upstream bound to loopback — remains
// reachable by an SSRF'd engine. That is why the deployment rule for this
// capability is a box with no NON-ENGINE co-tenants: several doc-engine
// routes sharing one sidecar box is the expected shape (they run the same
// hardened profile and hold nothing sensitive on loopback), but a mixed box
// is not. The fence is one layer, and co-tenancy policy is the other.
// Neither alone is the answer.
//
// Deliberately NOT fenced: 127.0.0.0/8 and ::1. Loopback is how Gotenberg
// talks to its own Chromium and LibreOffice, and — the load-bearing half —
// how it reaches a loopback DNS stub resolver. On AWS the VPC resolver lives
// at VPC-base+2 (10.0.0.2 in a 10.0.0.0/16), INSIDE the 10.0.0.0/8 this list
// denies, so an engine that resolved through it could not resolve anything
// and the product would be dead on arrival. The sidecar box must therefore
// run a loopback stub resolver (systemd-resolved on 127.0.0.53) and hand it
// to the tenant. That is a BOX property this drop-in cannot assume or check —
// it is a documented precondition of granting doc-engine (README's
// capabilities section), and an adopt-time advisory that could detect its
// absence is a known follow-up, not built here.
//
// The template's two IMDS addresses are repeated here even though
// 169.254.0.0/16 and fc00::/7 already cover them. That redundancy is the
// point: the security property is "this credential cannot reach the metadata
// service", and AGENTS.md's object-storage lesson is that a property enforced
// only by the absence of one thing cannot see the second door. Naming IMDS
// explicitly keeps it greppable in the rendered bytes and still denied if a
// future change narrows a range.
var docEngineEgressDeny = []string{
	// IPv4: this-host, RFC1918 (all three), IETF protocol assignments,
	// link-local (IMDS lives here), CGNAT (where cloud internal services
	// live), benchmarking (198.18.0.0/15 is also a common NAT/proxy
	// testing range an SSRF probe would try), multicast, and reserved.
	// Sorted, so the rendered line is deterministic.
	"0.0.0.0/8", "10.0.0.0/8", "100.64.0.0/10", "169.254.0.0/16",
	"169.254.169.254/32", "172.16.0.0/12", "192.0.0.0/24", "192.168.0.0/16",
	"198.18.0.0/15", "224.0.0.0/4", "240.0.0.0/4",
	// IPv6: NAT64's well-known prefix (it translates INTO private IPv4,
	// so an unfenced NAT64 route to 10.x would walk around the IPv4 half
	// of this list), ULA (fd00:ec2::254 — the IPv6 IMDS — lives here),
	// link-local, site-local (deprecated but routable on some VPCs), and
	// multicast. Sorted like the IPv4 half, so the rendered line is
	// deterministic.
	"64:ff9b::/96", "fc00::/7", "fd00:ec2::254/128", "fe80::/10",
	"fec0::/10", "ff00::/8",
}

// RenderService returns the [Service] drop-in body for the capabilities
// that are BOTH declared by s and (for the operator-consented ones)
// granted by g, or (nil, nil) when the effective set writes no [Service]
// directive at all — that is the "remove the generated file" signal Task 6
// acts on, not "write an empty stanza": one generated file per unit.
//
// A nil s ALSO returns (nil, nil), but for an entirely different reason:
// there is nothing to render because no manifest resolved. That is NOT a
// removal signal — the converge pass (Task 6) must branch on p.Set == nil
// BEFORE calling this function and leave every drop-in exactly as it is,
// never treating this function's (nil, nil) as license to delete anything.
// The two states look identical from this function's return value on
// purpose; only the caller, which still has the original *Set, can tell
// them apart.
//
// A non-nil s is run through ValidCapabilities before anything is
// rendered, and that error is returned unchanged. This closes the
// direct-injection path: a *Set built by hand — never having passed
// through UnmarshalJSON's strict decode — could otherwise carry a Command
// like "relay\nUser=root", or an empty app that would render
// "User=carlos-". Ship and adopt already share this gate (spec §3b); the
// renderer is a third caller of the same one, not a second copy of the
// rules.
//
// Directive order is FIXED: command, then runtime_dir, then the resource
// band, then host_role. The resource band is ONE of two shapes, never both:
// a granted doc_engine's band (JIT enabled, raised memory/tasks, the egress
// fence) or the children band (KillMode plus the 1G tier). A conversion
// orchestrator declares both capabilities, and the engine band REPLACES the
// children band's scalars rather than stacking on top of them, so no scalar
// renders twice and the generated unit text never leans on systemd's
// last-assignment-wins rule. KillMode renders whenever children is declared,
// band or no band. `daemon` and `data` are self-service capabilities that
// emit no [Service] directive at all here — `daemon` is enable/start/restart
// behaviour (Task 6 owns it), and `data`'s path is already the template's own
// StateDirectory=carlos-app/%i. Ports are the socket unit's alone; see
// RenderSocket.
//
// host_role and doc_engine cannot both be declared: ValidCapabilities refuses
// the pair, so the host_role block below never coexists with an engine block
// in one drop-in.
func RenderService(app string, s *Set, g Grants) ([]byte, error) {
	if s == nil {
		return nil, nil
	}
	if err := ValidCapabilities(app, s); err != nil {
		return nil, err
	}

	var lines []string

	if s.Command != "" {
		// The empty ExecStart= reset FIRST — systemd's documented way to
		// reset a list-valued directive from a drop-in. Without it the
		// unit has two ExecStart lines and refuses to start.
		lines = append(lines,
			"ExecStart=",
			"ExecStart="+execStartPath+" "+s.Command,
		)
	}

	if s.RuntimeDir != "" {
		// RuntimeDirectory is list-valued exactly like ExecStart, but no
		// reset line is needed here because the template itself sets no
		// RuntimeDirectory= directive to override. A future template
		// revision that adds one would need to revisit this.
		lines = append(lines,
			"RuntimeDirectory="+s.RuntimeDir,
			"RuntimeDirectoryMode=0700",
			"RuntimeDirectoryPreserve=restart",
		)
	}

	if s.Children {
		// KillMode renders for children regardless of the resource band
		// below: it is the "stop kills the whole tree" promise (systemd's
		// default, stated because an orchestrator's orphans are exactly what
		// a hibernation stop must not leave behind), and it has nothing to
		// do with which tier the unit gets.
		lines = append(lines, "KillMode=control-group")
	}

	if s.DocEngine && g.DocEngine {
		// The engine band REPLACES the children band rather than overriding
		// it: every scalar renders exactly once, so the generated unit text
		// never depends on systemd's last-assignment-wins rule and a reader
		// sees the effective value directly.
		//
		// V8's JIT needs memory that is both writable and executable, so the
		// template's MemoryDenyWriteExecute=yes has to come off for Chromium
		// to run at all. (--jitless is the alternative and it keeps the
		// directive, but it is slow enough and incompatible enough with real
		// pages that it is not what a conversion service can offer.)
		//
		// RestrictNamespaces=yes is deliberately LEFT ON. It is what kills
		// Chromium's own namespace sandbox, so the engine must run
		// --no-sandbox — and once Chromium's sandbox is off, relaxing the
		// namespace restriction buys nothing but a wider attack surface for a
		// renderer exploit. Keep the restriction, accept the engine's own
		// sandbox is off, and let the egress fence below be the compensating
		// control. This is the honest ceiling for running untrusted-document
		// parsers, not a sandbox that holds.
		lines = append(lines,
			"MemoryDenyWriteExecute=no",
			"MemoryMax="+docEngineMemoryMax,
			"MemoryHigh="+docEngineMemoryHigh,
			"TasksMax="+docEngineTasksMax,
		)

		// The fence that pays for all of the above. Empty assignment first
		// resets the list — same documented systemd pattern the ExecStart
		// reset uses — so these bytes are self-contained and do not depend on
		// what the template or another drop-in already denied.
		//
		// Safe to reset despite the operator escape hatch: drop-ins are read
		// in lexicographic order, and this file is 10-carlos-capabilities.conf,
		// so an operator's 90-operator.conf is applied AFTER this reset and
		// its own IPAddressDeny entries survive.
		lines = append(lines, "IPAddressDeny=")
		lines = append(lines, "IPAddressDeny="+strings.Join(docEngineEgressDeny, " "))
	} else if s.Children {
		// A platform-chosen tier, not a manifest-chosen number: `infinity`
		// is unsayable and no number comes from a manifest.
		lines = append(lines,
			"TasksMax=1024",
			"MemoryMax=1G",
			// Throttle-and-reclaim before the kill, like the exec path's
			// memory.high (internal/cgroup applyLimit): the same declared
			// capability behaves the same on both backings.
			"MemoryHigh=920M",
		)
	}

	if s.HostRole && g.HostRole {
		user := AppUser(app)
		lines = append(lines,
			"DynamicUser=no",
			// DynamicUser=yes implies RestrictSUIDSGID=yes; dropping
			// DynamicUser silently drops that hardening along with it, so
			// this drop-in restores it explicitly — a host_role app has
			// no business persisting setuid/setgid files in its own
			// state or runtime directory (spec §4a, §4b).
			"RestrictSUIDSGID=yes",
			"User="+user,
			"Group="+user,
			// The template denies IMDS unit-wide (issue #351); a matching
			// IPAddressAllow re-opens it for exactly the tenant that holds
			// the grant — in systemd's BPF firewall an allow-list match
			// wins over the deny list. The nftables skuid gate stays the
			// operator-owned authority on which uids reach the role
			// (spec §4b); this only lifts the unit-level fence the
			// template put in everyone's way.
			"IPAddressAllow=169.254.169.254/32 fd00:ec2::254/128",
		)
	}

	if len(lines) == 0 {
		return nil, nil
	}
	return dropIn("[Service]", lines), nil
}

// RenderSocket returns the [Socket] drop-in body, or (nil, nil) when no
// declared port is also granted. keymail with no `port:25` grant serves
// HTTP and does not bind the MX — it does not refuse to start (spec §2).
//
// The same nil-vs-nil-input caveat RenderService documents applies here: a
// nil s returns (nil, nil) meaning "nothing to render" (leave-alone), and a
// non-nil s rendering (nil, nil) means "remove the generated file" — the
// converge pass must branch on p.Set == nil before calling, never after.
//
// A non-nil s has its ports validated through validPorts — the same
// function ValidCapabilities uses — before anything is rendered, closing
// the same direct-injection path RenderService closes (a hand-built Set
// naming a non-privileged or reserved port). This intentionally does not
// call the full ValidCapabilities, which needs an app name for the
// host_role check that has nothing to do with sockets; validPorts is
// already the one place that rule lives, and reusing it keeps a single
// source of truth instead of a second copy of the ports rules.
func RenderSocket(s *Set, g Grants) ([]byte, error) {
	if s == nil {
		return nil, nil
	}
	if err := validPorts(s.Ports); err != nil {
		return nil, err
	}

	var ports []int
	for _, p := range s.Ports {
		if g.Ports[p.Port] {
			ports = append(ports, p.Port)
		}
	}
	if len(ports) == 0 {
		return nil, nil
	}
	sort.Ints(ports)

	// Belt-and-braces de-dup: validPorts above already refuses a
	// duplicate declared port, so two adjacent-equal entries can't reach
	// here from a validated Set — kept anyway so this function does not
	// quietly assume validation happened somewhere else.
	out := ports[:1]
	for _, p := range ports[1:] {
		if p != out[len(out)-1] {
			out = append(out, p)
		}
	}
	ports = out

	lines := make([]string, len(ports))
	for i, p := range ports {
		lines[i] = fmt.Sprintf("ListenStream=%d", p)
	}
	return dropIn("[Socket]", lines), nil
}

// dropIn assembles the marker line, the section header, and the directive
// lines, each newline-terminated — so the body ends with exactly one
// trailing newline and no blank line separates the marker from the header.
func dropIn(section string, lines []string) []byte {
	var b strings.Builder
	b.WriteString(Marker)
	b.WriteByte('\n')
	b.WriteString(section)
	b.WriteByte('\n')
	for _, l := range lines {
		b.WriteString(l)
		b.WriteByte('\n')
	}
	return []byte(b.String())
}