//go:build linux

package host

import (
	"os"
	"path/filepath"
	"testing"
)

func TestClaimMaskFilesystemCreateRefusesSymlinkParent(t *testing.T) {
	var calls []string
	plan9Fix2Systemctl(t, "enabled", &calls)
	plan9Fix2MaskOwner(t)
	root := t.TempDir()
	victim := filepath.Join(root, "victim")
	if err := os.Mkdir(victim, 0700); err != nil {
		t.Fatal(err)
	}
	link := filepath.Join(root, "link")
	if err := os.Symlink(victim, link); err != nil {
		t.Fatal(err)
	}
	claimEdgeRuntimeMask = filepath.Join(link, "carlos-edge.service")
	if _, err := createClaimEdgeMask(t.Context(), plan9Fix2Boot(t)); err == nil {
		t.Error("created mask through symlink parent")
	}
	entries, err := os.ReadDir(victim)
	if err != nil || len(entries) != 0 {
		t.Fatalf("changed victim directory: %v, %v", entries, err)
	}
}

func TestClaimMaskFilesystemDiscardRefusesSymlinkParent(t *testing.T) {
	old := claimEdgeMaskOwner
	t.Cleanup(func() { claimEdgeMaskOwner = old })
	root := t.TempDir()
	victim := filepath.Join(root, "victim")
	if err := os.Mkdir(victim, 0700); err != nil {
		t.Fatal(err)
	}
	path := filepath.Join(victim, "edge-mask")
	if err := os.WriteFile(path, []byte("victim"), 0600); err != nil {
		t.Fatal(err)
	}
	link := filepath.Join(root, "link")
	if err := os.Symlink(victim, link); err != nil {
		t.Fatal(err)
	}
	claimEdgeMaskOwner = filepath.Join(link, "edge-mask")
	if err := discardClaimEdgeMaskRecord(claimEdgeMaskRecord{}, false); err == nil {
		t.Error("discard accepted symlink parent")
	}
	raw, err := os.ReadFile(path)
	if err != nil || string(raw) != "victim" {
		t.Fatalf("changed victim record: %q, %v", raw, err)
	}
}