//go:build linux && rootrunner

package host

import (
	"crypto/ed25519"
	"encoding/base64"
	"encoding/json"
	"github.com/carlosframework/platform/internal/hostfloor"
	"os"
	"os/exec"
	"path/filepath"
	"strings"
	"syscall"
	"testing"
)

func TestPlan14GuardExecEdgeRootRunner(t *testing.T) {
	if os.Getenv("PLAN14_P3_EDGE_CHILD") == "1" {
		RunSystemGuardExec([]string{"edge"})
		t.Fatal("exec returned")
	}
	if err := os.Mkdir("/var/lib/carlos-claims", 0700); err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { os.RemoveAll("/var/lib/carlos-claims") })
	dir := generationRootRunnerDir(t)
	self, err := os.ReadFile(os.Args[0])
	if err != nil {
		t.Fatal(err)
	}
	helper := filepath.Join(dir, "runner.test")
	if err := os.WriteFile(helper, self, 0755); err != nil {
		t.Fatal(err)
	}
	pub, _, err := ed25519.GenerateKey(nil)
	if err != nil {
		t.Fatal(err)
	}
	t.Setenv("CARLOS_OPT_DIR", dir)
	t.Setenv("CARLOS_DEPLOYMENT_BUCKET", "deploy")
	t.Setenv("CARLOS_RELEASE_PUBKEY", base64.StdEncoding.EncodeToString(pub))
	guard := filepath.Join(dir, "system", "guard")
	if err := os.MkdirAll(guard, 0755); err != nil {
		t.Fatal(err)
	}
	raw, _ := json.Marshal(hostfloor.Policy{Schema: 1, DeploymentBucket: "deploy", Mode: "unpublished"})
	if err := os.WriteFile(filepath.Join(guard, "policy.json"), raw, 0644); err != nil {
		t.Fatal(err)
	}
	entry, err := os.ReadFile("/usr/bin/echo")
	if err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(systemBinaryPath(dir), entry, 0755); err != nil {
		t.Fatal(err)
	}
	for _, floor := range []bool{false, true} {
		if floor {
			if err := os.MkdirAll(filepath.Join(guard, "moves", "private"), 0700); err != nil {
				t.Fatal(err)
			}
		}
		cmd := exec.CommandContext(t.Context(), helper, "-test.run=^TestPlan14GuardExecEdgeRootRunner$")
		cmd.Env = append(os.Environ(), "PLAN14_P3_EDGE_CHILD=1")
		cmd.SysProcAttr = &syscall.SysProcAttr{Credential: &syscall.Credential{Uid: 65534, Gid: 65534}}
		out, err := cmd.CombinedOutput()
		if err != nil || !strings.Contains(string(out), "agent") {
			t.Fatalf("floor=%v: %v %s", floor, err, out)
		}
	}
}