//go:build linux

package host

import (
	"context"
	"encoding/hex"
	"errors"
	"os"

	"github.com/carlosframework/platform/internal/hostbox"
	"golang.org/x/sys/unix"
)

type servingParkTopology struct {
	Parent, Root servingParkPersistentDirectory
}

// This only obtains a handle for an already-open directory. It never opens a
// supplied handle, follows a request path or changes mount permissions.
func servingParkPersistentDir(d *os.File) (servingParkPersistentDirectory, error) {
	var out servingParkPersistentDirectory
	if d == nil {
		return out, hostbox.ErrUnsupported
	}
	id, err := servingParkDirID(d)
	if err != nil {
		return out, err
	}
	var st unix.Stat_t
	if err = unix.Fstat(int(d.Fd()), &st); err != nil {
		return out, err
	}
	var fs unix.Statfs_t
	if err = unix.Fstatfs(int(d.Fd()), &fs); err != nil {
		return out, err
	}
	h, mount, err := unix.NameToHandleAt(int(d.Fd()), "", unix.AT_EMPTY_PATH)
	if err != nil {
		return out, err
	}
	if mount <= 0 || uint64(mount) != id.Mount {
		return out, hostbox.ErrChanged
	}
	out = servingParkPersistentDirectory{Filesystem: fs.Fsid.Val, Type: h.Type(), Handle: hex.EncodeToString(h.Bytes()), Owner: st.Uid, Mode: st.Mode}
	if !out.valid() {
		return servingParkPersistentDirectory{}, hostbox.ErrChanged
	}
	return out, nil
}

// Capture only while the recorded boot and both descriptor identities still
// match. Old namespaces are never upgraded by looking at their current paths.
func (f *servingParkFS) captureTopology(parent, root *os.File, n servingParkNamespace) (*servingParkTopology, error) {
	if f.handle == nil {
		return nil, hostbox.ErrUnsupported
	}
	if err := f.checkBoot(n.BootID); err != nil {
		return nil, err
	}
	p, err := servingParkDirID(parent)
	if err != nil || p != n.Parent {
		return nil, hostbox.ErrChanged
	}
	r, err := servingParkDirID(root)
	if err != nil || r != n.Root || r.Device != p.Device || r.Mount != p.Mount {
		return nil, hostbox.ErrChanged
	}
	ph, err := f.handle(parent)
	if err != nil {
		return nil, err
	}
	rh, err := f.handle(root)
	if err != nil {
		return nil, err
	}
	if !ph.valid() || !rh.valid() || ph.Filesystem != rh.Filesystem || rh.Owner != f.owner || rh.Mode&0077 != 0 {
		return nil, hostbox.ErrChanged
	}
	p, err = servingParkDirID(parent)
	if err != nil || p != n.Parent {
		return nil, hostbox.ErrChanged
	}
	r, err = servingParkDirID(root)
	if err != nil || r != n.Root || f.checkBoot(n.BootID) != nil {
		return nil, hostbox.ErrChanged
	}
	return &servingParkTopology{Parent: ph, Root: rh}, nil
}

// This observation cannot be used by the park filesystem or sent to an agent.
// A later recovery transaction must preserve retirement history and validate
// every affected source/event before it can publish current mount authority.
type servingParkRebootObservation struct {
	Volume                     string `json:",omitempty"`
	Previous                   servingParkNamespace
	Parent                     servingParkParent
	BootID                     string
	CurrentParent, CurrentRoot servingArtifactDirectory
}

// Called under the namespace lock. This is a read-only prerequisite for reboot
// recovery, not permission to rewrite mount IDs or resume deletion. Quarantines
// require a separate transition covering the displaced root and retained data.
func (f *servingParkFS) inspectRebootTopology(ctx context.Context) (servingParkRebootObservation, error) {
	var zero servingParkRebootObservation
	if ctx == nil || f == nil || f.state == nil || f.handle == nil {
		return zero, hostbox.ErrUnsupported
	}
	if err := ctx.Err(); err != nil {
		return zero, err
	}
	boot, err := f.currentBoot()
	if err != nil {
		return zero, err
	}
	p, err := f.historicalNamespaceParent()
	if err != nil {
		return zero, err
	}
	var n servingParkNamespace
	body, err := f.state.Read("namespace.json")
	if err != nil {
		return zero, err
	}
	if servingParkDecode(body, &n) != nil || n.Version != 1 || !validServingParkBootID(n.BootID) || n.BootID != p.BootID || n.Parent != p.Parent || n.Topology == nil || !n.Topology.Parent.valid() || !n.Topology.Root.valid() || n.Root.Device != n.Parent.Device || n.Root.Mount != n.Parent.Mount || n.Root.Inode == 0 {
		return zero, hostbox.ErrChanged
	}
	if _, err := f.state.Read("namespace-quarantine.json"); !errors.Is(err, os.ErrNotExist) {
		if err == nil {
			err = hostbox.ErrChanged
		}
		return zero, err
	}
	parent, pid, err := f.parent()
	if err != nil {
		return zero, err
	}
	defer parent.Close()
	root, rid, err := f.privateDir(parent, ".serving-parked")
	if err != nil {
		return zero, err
	}
	defer root.Close()
	// Device and mount numbers are boot-local. Across boots, require the same
	// filesystem and persistent handles below, plus unchanged inode numbers.
	// Both directories must still share the current device and mount.
	if n.BootID == boot && pid.Device != n.Parent.Device {
		return zero, hostbox.ErrChanged
	}
	if n.BootID == boot && pid.Mount == n.Parent.Mount {
		prior, err := servingParkReadBinding(f.state, "namespace")
		if err != nil || prior == nil || prior.BeforeBoot != n.BootID || prior.BeforeParent != n.Parent {
			return zero, hostbox.ErrChanged
		}
	}
	if pid.Inode != n.Parent.Inode || rid.Device != pid.Device || rid.Inode != n.Root.Inode || rid.Mount != pid.Mount {
		return zero, hostbox.ErrChanged
	}
	current := servingParkNamespace{Version: 1, Parent: pid, Root: rid, BootID: boot}
	volume := ""
	if f.volume != nil {
		volume = f.volume(pid.Device)
	}
	topology, err := f.captureTopology(parent, root, current)
	if err != nil {
		return zero, err
	}
	if *topology != *n.Topology {
		return zero, hostbox.ErrChanged
	}
	// The service user owns the mount parent. Reopen both names after reading
	// the persistent handles; a detached original descriptor proves no path.
	again, nextParent, err := f.parent()
	if err != nil {
		return zero, err
	}
	defer again.Close()
	next, nextRoot, err := f.privateDir(again, ".serving-parked")
	if err != nil {
		return zero, err
	}
	defer next.Close()
	if nextParent != pid || nextRoot != rid || f.checkBoot(boot) != nil {
		return zero, hostbox.ErrChanged
	}
	againTopology, err := f.captureTopology(again, next, current)
	if err != nil {
		return zero, err
	}
	if *againTopology != *topology || f.volume != nil && f.volume(nextParent.Device) != volume {
		return zero, hostbox.ErrChanged
	}
	if err := ctx.Err(); err != nil {
		return zero, err
	}
	return servingParkRebootObservation{Volume: volume, Previous: n, Parent: p, BootID: boot, CurrentParent: pid, CurrentRoot: rid}, nil
}