package host

import (
	"github.com/carlosframework/platform/internal/instancectl"
	"github.com/carlosframework/platform/internal/rootstate"
	"github.com/carlosframework/platform/internal/safefile"
	"golang.org/x/sys/unix"
	"os"
)

func openClaimUnitDropin(unit string) (*os.File, error) {
	role, _, ordinary := instancectl.ParseUnitName(unit)
	if !instancectl.ValidBoundClaimUnit(unit) && !(ordinary && role == instancectl.RoleRun) {
		return nil, os.ErrPermission
	}
	const base = "/run/systemd/system"
	checked, err := rootstate.Open(base, false, true)
	if err != nil {
		return nil, err
	}
	defer checked.Close()
	parent, err := safefile.OpenDir(base)
	if err != nil {
		return nil, err
	}
	defer parent.Close()
	fd, err := unix.Openat(int(parent.Fd()), unit+".d", unix.O_RDONLY|unix.O_DIRECTORY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
	if err != nil {
		return nil, err
	}
	defer unix.Close(fd)
	var st unix.Stat_t
	if err := unix.Fstat(fd, &st); err != nil {
		return nil, err
	}
	if st.Uid != 0 || st.Mode&0022 != 0 || st.Mode&unix.S_IFMT != unix.S_IFDIR {
		return nil, os.ErrPermission
	}
	f, err := safefile.OpenFileAt(fd, "60-claim-launch.conf", os.O_RDONLY, 0)
	if err != nil {
		return nil, err
	}
	if err = unix.Fstat(int(f.Fd()), &st); err != nil {
		f.Close()
		return nil, err
	}
	if st.Uid != 0 || st.Mode&0022 != 0 || st.Mode&unix.S_IFMT != unix.S_IFREG || st.Nlink != 1 {
		f.Close()
		return nil, os.ErrPermission
	}
	return f, nil
}