//go:build linux

package host

import (
	"bytes"
	"context"
	"crypto/ed25519"
	"crypto/sha256"
	"encoding/hex"
	"errors"
	"fmt"
	"io"
	"os"
	"path/filepath"
	"strings"
	"sync/atomic"

	"github.com/carlosframework/platform/internal/claimactivation"
	"github.com/carlosframework/platform/internal/hostfloor"
	"github.com/carlosframework/platform/internal/release"
	"github.com/carlosframework/platform/internal/safefile"
	"golang.org/x/sys/unix"
)

// activationOutput is a claims phase's --out file, reserved before the phase
// can write to the bucket (controller ruling F4): an exclusive create, mode
// 0600, in a checked root-owned directory, held open. A second invocation
// naming the same path fails its own reservation and publishes nothing. The
// phase's bytes are then written through the held descriptor, synced and
// read back. A dry run only checks the path is free.
//
// A reservation is never removed (controller ruling F5): on any failure the
// file stays, empty or partial, and the error names it and asks for a new
// --out path. Removing it safely would need its identity check and the
// unlink to be one step, which a directory another root writer can change
// does not offer.
type activationOutput struct {
	dir      *os.File
	ownDir   bool
	name     string
	path     string
	f        *os.File
	dev, ino uint64
}

// reserveActivationOutput reserves path: absolute and clean, in a directory
// activationDir accepts (root-owned, not writable by group or others).
func reserveActivationOutput(path string, dry bool) (*activationOutput, error) {
	if !filepath.IsAbs(path) || filepath.Clean(path) != path {
		return nil, errActivation
	}
	dir, err := activationDir(filepath.Dir(path), false)
	if err != nil {
		return nil, err
	}
	o, err := reserveOutput(dir, filepath.Base(path), path, dry)
	if err != nil {
		dir.Close()
		return nil, err
	}
	o.ownDir, o.path = true, path
	return o, nil
}

// reserveActivationOutputAt reserves name under an already checked
// directory. Any existing entry is refused without following it.
func reserveActivationOutputAt(dir *os.File, name string, dry bool) (*activationOutput, error) {
	return reserveOutput(dir, name, name, dry)
}

// reserveOutput is the reservation, naming path in its errors.
func reserveOutput(dir *os.File, name, path string, dry bool) (*activationOutput, error) {
	if name != filepath.Base(name) || name == "." || name == ".." || name == "/" {
		return nil, errActivation
	}
	var st unix.Stat_t
	err := unix.Fstatat(int(dir.Fd()), name, &st, unix.AT_SYMLINK_NOFOLLOW)
	if err == nil {
		return nil, errActivation
	}
	if err != unix.ENOENT {
		return nil, err
	}
	o := &activationOutput{dir: dir, name: name, path: path}
	if dry {
		return o, nil
	}
	f, err := safefile.OpenFileAt(int(dir.Fd()), name, os.O_CREATE|os.O_EXCL|os.O_RDWR, 0o600)
	if err != nil {
		return nil, err
	}
	err = f.Chmod(0o600)
	if err == nil {
		err = unix.Fstat(int(f.Fd()), &st)
	}
	if err == nil && st.Uid != uint32(os.Geteuid()) {
		err = errActivation
	}
	if err == nil {
		err = unix.Fsync(int(dir.Fd()))
	}
	o.f, o.dev, o.ino = f, uint64(st.Dev), st.Ino
	if err != nil {
		f.Close()
		return nil, outputKept(err, path, false)
	}
	return o, nil
}

// ours reports whether the directory entry is still the file this
// reservation created.
func (o *activationOutput) ours() bool {
	var st unix.Stat_t
	return unix.Fstatat(int(o.dir.Fd()), o.name, &st, unix.AT_SYMLINK_NOFOLLOW) == nil && uint64(st.Dev) == o.dev && st.Ino == o.ino
}

// finish writes raw through the held descriptor, syncs it and the
// directory, and reads it back: the exact bytes, mode 0600, one link, and
// the entry still this file.
func (o *activationOutput) finish(raw []byte) error {
	if o.f == nil {
		return nil
	}
	if len(raw) == 0 {
		return errActivation
	}
	if _, err := o.f.WriteAt(raw, 0); err != nil {
		return err
	}
	if err := o.f.Sync(); err != nil {
		return err
	}
	got := make([]byte, len(raw)+1)
	n, err := o.f.ReadAt(got, 0)
	if err != nil && !errors.Is(err, io.EOF) {
		return err
	}
	var st unix.Stat_t
	if err = unix.Fstat(int(o.f.Fd()), &st); err != nil {
		return err
	}
	if n != len(raw) || !bytes.Equal(got[:n], raw) || st.Mode&0o7777 != 0o600 || st.Nlink != 1 || !o.ours() {
		return errActivation
	}
	return unix.Fsync(int(o.dir.Fd()))
}

// close releases the reservation and keeps whatever the file holds.
func (o *activationOutput) close() {
	if o.f != nil {
		o.f.Close()
		o.f = nil
	}
	if o.ownDir {
		o.dir.Close()
		o.ownDir = false
	}
}

// putAttempts wraps a phase's store and records whether any write was
// attempted. A write that failed may still have committed, so an attempt,
// not a success, is what the error after a failure reports.
type putAttempts struct {
	release.Store
	attempted atomic.Bool
}

func (s *putAttempts) Put(ctx context.Context, key string, raw []byte, etag string) (string, error) {
	s.attempted.Store(true)
	return s.Store.Put(ctx, key, raw, etag)
}

func (s *putAttempts) Delete(ctx context.Context, key string) error {
	s.attempted.Store(true)
	return s.Store.Delete(ctx, key)
}

// runProducingPhase runs sign-policy or publish-identity with its output
// already reserved (out), on a runner whose store is store. On success the
// output holds the phase's file. On any failure the reserved file is kept
// and the error names it, asks for a new --out path and says whether the
// phase wrote to the bucket first, because the bucket may then already hold
// what it published.
func runProducingPhase(ctx context.Context, r claimactivation.Runner, store *putAttempts, plan claimactivation.Plan, out *activationOutput, dry bool) (claimactivation.Result, error) {
	r.Directory.Store = store
	result, err := r.Run(ctx, plan, dry)
	if err == nil {
		err = out.finish(result.Output)
	}
	if err == nil {
		out.close()
		return result, nil
	}
	out.close()
	if dry {
		return result, err
	}
	return result, outputKept(err, out.path, store.attempted.Load())
}

// outputKept is a failed phase's error once its reserved --out file stays.
func outputKept(err error, path string, wrote bool) error {
	if wrote {
		return fmt.Errorf("%w; the phase wrote to the bucket before it failed, so %s was kept. run it again with a new --out path", err, path)
	}
	return fmt.Errorf("%w; %s was kept. run it again with a new --out path", err, path)
}

// consoleInstallDir is where install-console puts the protected console
// executable and its .prev: under root's /opt/carlos/system, beside the
// guard, outside system/router and every restore set.
const consoleInstallDir = "/opt/carlos/system/console"

// consoleMaxBytes bounds a console artefact, as Disk.VerifyFile bounds what
// it hashes.
const consoleMaxBytes = 512 << 20

// consoleInstallTarget checks the staged identity for install-console and
// returns its release tag and the console sha256 for platform. The staged
// bytes must verify under the deployment key, be exactly the identity
// published at control/system/router/releases/<tag>.json, and name this
// build: guard-arm compares the running build with the identity's version.
func consoleInstallTarget(identity, published []byte, pub ed25519.PublicKey, build, platform string) (string, string, error) {
	p, err := release.VerifySystemIdentity(pub, identity)
	if err != nil || !bytes.Equal(identity, published) || p.Current.Version != build {
		return "", "", errActivation
	}
	a, ok := p.Current.ConsoleArtifacts[platform]
	if !ok {
		return "", "", errActivation
	}
	return p.Current.ReleaseTag, a.SHA256, nil
}

// consoleInstalled is what one install-console run did. An upgrade also
// reports the build it replaced (From) and what console.prev holds after it
// (PreviousSHA).
type consoleInstalled struct {
	Path, Previous    string
	Already           bool
	From, PreviousSHA string
}

// installProtectedConsole copies the console at source into dir as console
// and console.prev, for guard-arm's --console. Both copies are the same
// bytes, the build the identity names: the identity carries one console
// sha256 per platform and guard-arm checks <path> and <path>.prev against
// it, so at arming .prev can only equal current. That is install-channel's
// A2-2 precedent for carlos and carlos.prev (controller ruling C3). A later
// guarded update can leave an older build in .prev, because guard-exec
// accepts any identity persisted beside the guard.
//
// dir and every ancestor are root-owned, not writable by group or others,
// and searchable by others (console.service runs guard-exec as the service
// user, which must open the file); missing components are created 0755 and
// no component may be a symlink. The source is opened with no symlink
// followed anywhere on its path and must be a regular file with one link.
// Its bytes must hash to sha before anything is created. Each slot is
// written through a private staging directory and renamed into place, mode
// 0755 and owned by root, .prev first, then read back as guard-arm reads it
// (hostfloor.OpenProtected) and hashed again. A slot that already holds
// other bytes, a symlink or anything but a regular file is refused and left
// as it is; slots that both hold the build are a no-op, after the source is
// verified again. console.service is
// not touched: guard-arm installs its drop-in. The dry run writes nothing.
func installProtectedConsole(dir, source, sha string, dry bool) (consoleInstalled, error) {
	got := consoleInstalled{Path: filepath.Join(dir, "console"), Previous: filepath.Join(dir, "console.prev")}
	if len(sha) != 64 || !filepath.IsAbs(source) || filepath.Clean(source) != source {
		return got, errActivation
	}
	if os.Geteuid() != 0 {
		return got, errActivation
	}
	// The source is verified before anything is created or locked.
	body, err := readConsoleSource(source, sha)
	if err != nil {
		return got, err
	}
	d, err := consoleDir(dir, !dry)
	if dry && errors.Is(err, unix.ENOENT) {
		return got, nil
	}
	if err != nil {
		return got, err
	}
	defer d.Close()
	if !dry {
		if err = unix.Flock(int(d.Fd()), unix.LOCK_EX|unix.LOCK_NB); err != nil {
			return got, err
		}
	}
	holds := map[string]bool{}
	for _, name := range []string{"console.prev", "console"} {
		h, err := consoleSlotHolds(d, name, sha)
		if err != nil {
			return got, err
		}
		holds[name] = h
	}
	if holds["console.prev"] && holds["console"] {
		got.Already = true
		return got, nil
	}
	if dry {
		return got, nil
	}
	for _, name := range []string{"console.prev", "console"} {
		if holds[name] {
			continue
		}
		if err = safefile.WriteAt(int(d.Fd()), name, body, 0o755); err != nil {
			return got, err
		}
	}
	for _, path := range []string{got.Previous, got.Path} {
		f, err := hostfloor.OpenProtected(path)
		if err != nil {
			return got, err
		}
		var st unix.Stat_t
		err = unix.Fstat(int(f.Fd()), &st)
		var hash string
		if err == nil {
			hash, err = hostfloor.DigestReader(io.LimitReader(f, consoleMaxBytes+1))
		}
		f.Close()
		if err != nil {
			return got, err
		}
		if hash != sha || st.Mode&0o7777 != 0o755 || st.Nlink != 1 || st.Uid != 0 || st.Gid != 0 {
			return got, errActivation
		}
	}
	return got, nil
}

// consoleSlotHolds reports whether name in d is absent (false) or a root
// owned regular file, one link, mode 0755, holding sha (true). Anything else
// is refused.
func consoleSlotHolds(d *os.File, name, sha string) (bool, error) {
	hash, err := consoleSlotSHA(d, name)
	if err != nil || hash == "" {
		return false, err
	}
	if hash != sha {
		return false, errActivation
	}
	return true, nil
}

// consoleSlotSHA returns "" when name in d is absent, and otherwise the
// sha256 of a root:root regular file with one link and mode 0755, checked
// on the entry, not followed, and again on the descriptor it hashes.
// Anything else is refused.
func consoleSlotSHA(d *os.File, name string) (string, error) {
	var st unix.Stat_t
	err := unix.Fstatat(int(d.Fd()), name, &st, unix.AT_SYMLINK_NOFOLLOW)
	if err == unix.ENOENT {
		return "", nil
	}
	if err != nil {
		return "", err
	}
	shape := func(st *unix.Stat_t) bool {
		return st.Mode&unix.S_IFMT == unix.S_IFREG && st.Nlink == 1 && st.Uid == 0 && st.Gid == 0 && st.Mode&0o7777 == 0o755
	}
	if !shape(&st) {
		return "", errActivation
	}
	f, err := safefile.OpenFileAt(int(d.Fd()), name, os.O_RDONLY, 0)
	if err != nil {
		return "", err
	}
	defer f.Close()
	var held unix.Stat_t
	if err = unix.Fstat(int(f.Fd()), &held); err != nil {
		return "", err
	}
	if !shape(&held) || held.Dev != st.Dev || held.Ino != st.Ino {
		return "", errActivation
	}
	return consoleDigest(f)
}

// consoleDigest hashes a console slot through EOF. A file larger than
// consoleMaxBytes is refused, by its size and by the bytes read, never
// hashed by its prefix.
func consoleDigest(f *os.File) (string, error) {
	var st unix.Stat_t
	if err := unix.Fstat(int(f.Fd()), &st); err != nil {
		return "", err
	}
	if st.Size < 0 || st.Size > consoleMaxBytes {
		return "", errActivation
	}
	r := &consoleCounter{r: io.LimitReader(f, consoleMaxBytes+1)}
	hash, err := hostfloor.DigestReader(r)
	if err != nil {
		return "", err
	}
	if r.n > consoleMaxBytes {
		return "", errActivation
	}
	return hash, nil
}

// consoleCounter counts the bytes read through it.
type consoleCounter struct {
	r io.Reader
	n int64
}

func (c *consoleCounter) Read(p []byte) (int, error) {
	n, err := c.r.Read(p)
	c.n += int64(n)
	return n, err
}

// consoleUpgradeSync fsyncs the console directory at the end of an upgrade
// and before an Already result. Tests replace it to see that it ran.
var consoleUpgradeSync = func(fd int) error { return unix.Fsync(fd) }

// consoleUpgradeTemp is the one name an upgrade writes the new console to
// before renaming it into place. Only an upgrade creates it, under the
// directory's exclusive lock, and a rerun removes a leftover one.
const consoleUpgradeTemp = "console.next"

// upgradeProtectedConsole replaces a guarded box's protected console with
// the build at source, which must hash to sha, for claims install-console
// --upgrade. The source and root checks are installProtectedConsole's, and
// the directory must already exist: an upgrade never creates it.
//
// Under the directory's exclusive lock, console and console.prev must each
// be absent or a root:root regular file, mode 0755, one link; anything else
// refuses. console.prev's bytes are not checked, because they are replaced.
//   - console holding sha: Already, and nothing changes, so a rerun after
//     success is a no-op.
//   - console holding from: the upgrade.
//   - console absent and console.prev holding from: a run cut off between
//     its two renames; this run completes it.
//   - anything else refuses and changes nothing.
//
// A source that is, or is inside, the console directory refuses, by its
// path and by the device and inode of the descriptor it was read from
// against console, console.prev and console.next: an upgrade must never
// consume its own source.
//
// A non-dry Already fsyncs the directory first, so a rerun after a run cut
// off before its final fsync makes that run's renames durable.
//
// The upgrade writes the build to console.next (exclusive create, 0755,
// fsync), renames console to console.prev, replacing the old .prev,
// renames console.next to console, and fsyncs the directory. A console.next
// left by a run cut off before its renames is removed first: only this
// function creates that name, under the lock, in a directory only root can
// write, and its bytes are never used. A console.next that is not a regular
// file refuses. Both slots are then read back as guard-arm reads them
// (hostfloor.OpenProtected): console must hash to sha and console.prev to
// from. The dry run makes every check and writes nothing.
func upgradeProtectedConsole(dir, source, sha, from string, dry bool) (consoleInstalled, error) {
	got := consoleInstalled{Path: filepath.Join(dir, "console"), Previous: filepath.Join(dir, "console.prev"), From: from}
	if len(sha) != 64 || !isLowerHex(from, 64) || !filepath.IsAbs(source) || filepath.Clean(source) != source {
		return got, errActivation
	}
	if source == dir || strings.HasPrefix(source, dir+"/") {
		return got, errActivation
	}
	if os.Geteuid() != 0 {
		return got, errActivation
	}
	body, src, err := readConsoleSourceFile(source, sha)
	if err != nil {
		return got, err
	}
	d, err := consoleDir(dir, false)
	if err != nil {
		return got, err
	}
	defer d.Close()
	if !dry {
		if err = unix.Flock(int(d.Fd()), unix.LOCK_EX|unix.LOCK_NB); err != nil {
			return got, err
		}
	}
	for _, name := range []string{"console", "console.prev", consoleUpgradeTemp} {
		var st unix.Stat_t
		err = unix.Fstatat(int(d.Fd()), name, &st, unix.AT_SYMLINK_NOFOLLOW)
		if err == nil && st.Dev == src.Dev && st.Ino == src.Ino {
			return got, errActivation
		}
		if err != nil && err != unix.ENOENT {
			return got, err
		}
	}
	current, err := consoleSlotSHA(d, "console")
	if err != nil {
		return got, err
	}
	previous, err := consoleSlotSHA(d, "console.prev")
	if err != nil {
		return got, err
	}
	if current == sha {
		got.Already, got.PreviousSHA = true, previous
		if !dry {
			if err = consoleUpgradeSync(int(d.Fd())); err != nil {
				return got, err
			}
		}
		return got, nil
	}
	if current != from && (current != "" || previous != from) {
		return got, errActivation
	}
	got.PreviousSHA = from
	var st unix.Stat_t
	switch err = unix.Fstatat(int(d.Fd()), consoleUpgradeTemp, &st, unix.AT_SYMLINK_NOFOLLOW); {
	case err == unix.ENOENT:
	case err != nil:
		return got, err
	case st.Mode&unix.S_IFMT != unix.S_IFREG:
		return got, errActivation
	case !dry:
		if err = unix.Unlinkat(int(d.Fd()), consoleUpgradeTemp, 0); err != nil {
			return got, err
		}
	}
	if dry {
		return got, nil
	}
	if err = writeConsoleTemp(d, body); err != nil {
		unix.Unlinkat(int(d.Fd()), consoleUpgradeTemp, 0)
		return got, err
	}
	if current != "" {
		if err = unix.Renameat(int(d.Fd()), "console", int(d.Fd()), "console.prev"); err != nil {
			return got, err
		}
	}
	if err = unix.Renameat(int(d.Fd()), consoleUpgradeTemp, int(d.Fd()), "console"); err != nil {
		return got, err
	}
	if err = consoleUpgradeSync(int(d.Fd())); err != nil {
		return got, err
	}
	for path, want := range map[string]string{got.Path: sha, got.Previous: from} {
		f, err := hostfloor.OpenProtected(path)
		if err != nil {
			return got, err
		}
		err = unix.Fstat(int(f.Fd()), &st)
		var hash string
		if err == nil {
			hash, err = consoleDigest(f)
		}
		f.Close()
		if err != nil {
			return got, err
		}
		if hash != want || st.Mode&0o7777 != 0o755 || st.Nlink != 1 || st.Uid != 0 || st.Gid != 0 {
			return got, errActivation
		}
	}
	return got, nil
}

// writeConsoleTemp creates consoleUpgradeTemp in d exclusively, never
// following a link, writes body, sets mode 0755 whatever the umask, checks
// it is root's and fsyncs it.
func writeConsoleTemp(d *os.File, body []byte) error {
	f, err := safefile.OpenFileAt(int(d.Fd()), consoleUpgradeTemp, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0o755)
	if err != nil {
		return err
	}
	defer f.Close()
	if _, err = f.Write(body); err != nil {
		return err
	}
	if err = f.Chmod(0o755); err != nil {
		return err
	}
	var st unix.Stat_t
	if err = unix.Fstat(int(f.Fd()), &st); err != nil {
		return err
	}
	if st.Uid != 0 || st.Gid != 0 || st.Nlink != 1 {
		return errActivation
	}
	if err = f.Sync(); err != nil {
		return err
	}
	return f.Close()
}

// isLowerHex reports whether s is exactly n lower-case hex digits.
func isLowerHex(s string, n int) bool {
	if len(s) != n {
		return false
	}
	for _, c := range s {
		if !(c >= '0' && c <= '9' || c >= 'a' && c <= 'f') {
			return false
		}
	}
	return true
}

// readConsoleSource reads the source console, no symlink followed on its
// path, a regular file with one link, at most consoleMaxBytes, and refuses
// it unless it hashes to sha.
func readConsoleSource(source, sha string) ([]byte, error) {
	body, _, err := readConsoleSourceFile(source, sha)
	return body, err
}

// readConsoleSourceFile is readConsoleSource, also returning the stat of
// the descriptor the bytes were read from, so an upgrade can refuse a
// source that is one of its own slots.
func readConsoleSourceFile(source, sha string) ([]byte, unix.Stat_t, error) {
	var st unix.Stat_t
	f, err := safefile.OpenFile(source, os.O_RDONLY, 0)
	if err != nil {
		return nil, st, err
	}
	defer f.Close()
	if err = unix.Fstat(int(f.Fd()), &st); err != nil {
		return nil, st, err
	}
	body, err := io.ReadAll(io.LimitReader(f, consoleMaxBytes+1))
	if err != nil {
		return nil, st, err
	}
	sum := sha256.Sum256(body)
	if len(body) > consoleMaxBytes || hex.EncodeToString(sum[:]) != sha {
		return nil, st, errActivation
	}
	return body, st, nil
}

// consoleDir opens dir component by component from /, never following a
// symlink. Every component must be root-owned, not writable by group or
// others and searchable by others; missing ones are created 0755 when
// create is set, and the parent is synced. The last must be exactly 0755.
// The walk is walkNoFollowDir's, shared with the root migration's floor
// repair.
func consoleDir(dir string, create bool) (*os.File, error) {
	if os.Geteuid() != 0 || !filepath.IsAbs(dir) || filepath.Clean(dir) != dir || dir == "/" {
		return nil, errActivation
	}
	check := func(fd int, last bool) error {
		var st unix.Stat_t
		if err := unix.Fstat(fd, &st); err != nil {
			return err
		}
		if st.Uid != 0 || st.Mode&0o022 != 0 || st.Mode&0o001 == 0 || last && (st.Mode&0o7777 != 0o755 || st.Gid != 0) {
			return errActivation
		}
		return nil
	}
	fd, err := walkNoFollowDir("/", strings.Split(strings.TrimPrefix(dir, "/"), "/"), func(bool) bool { return create }, check)
	if err != nil {
		return nil, err
	}
	return os.NewFile(uintptr(fd), dir), nil
}

// runInstallConsole is install-console's work after its flags: the staged
// identity checked against the published one in store, then the protected
// copies. A non-empty from is --upgrade --from: the installed console must
// hash to it, and it is replaced.
func runInstallConsole(ctx context.Context, store release.Store, pub ed25519.PublicKey, identityPath, source, dir, build, platform, from string, dry bool) (string, string, consoleInstalled, error) {
	identity, err := activationRead(identityPath, false)
	if err != nil {
		return "", "", consoleInstalled{}, err
	}
	p, err := release.VerifySystemIdentity(pub, identity)
	if err != nil {
		return "", "", consoleInstalled{}, errActivation
	}
	key, err := release.IdentityKey(p.Current.ReleaseTag)
	if err != nil {
		return "", "", consoleInstalled{}, errActivation
	}
	published, _, err := store.Get(ctx, key)
	if err != nil {
		return "", "", consoleInstalled{}, err
	}
	tag, sha, err := consoleInstallTarget(identity, published, pub, build, platform)
	if err != nil {
		return "", "", consoleInstalled{}, err
	}
	if from != "" {
		got, err := upgradeProtectedConsole(dir, source, sha, from, dry)
		return tag, sha, got, err
	}
	got, err := installProtectedConsole(dir, source, sha, dry)
	return tag, sha, got, err
}