//go:build linux

package host

import (
	"errors"
	"fmt"
	"io"
	"os"

	"github.com/carlosframework/platform/internal/moves"
	"github.com/carlosframework/platform/internal/safefile"
)

// heldRenderJournalMax bounds the render journal root reads: a move's
// journal holds step values (digests, ids, one install manifest), well
// under this.
const heldRenderJournalMax = 1 << 20

// readHeldRenderHash is root's read of the held render's journalled hash
// for (host, op): moves.JournalFile under the agent's data directory. The
// journal is agent-written, so root never opens it by name (#267,
// platform-1e): safefile.OpenFile walks every directory from / with
// O_NOFOLLOW, pins the leaf with O_PATH|O_NOFOLLOW and fstats it before
// opening it for reading (with O_NONBLOCK), so a symlink at any component
// fails, and a FIFO, a device or a file with more than one link is refused
// without being opened for reading; the bytes are read from that one
// descriptor, bounded. A journal, or a directory on its path, that does not
// exist is os.ErrNotExist (not yet); anything else unsafe is
// errHeldReleaseUnsafe. A journal with no rendered step is "".
func readHeldRenderHash(dataDir, host, op string) (string, error) {
	f, err := safefile.OpenFile(moves.JournalFile(dataDir, host, op), os.O_RDONLY, 0)
	if errors.Is(err, os.ErrNotExist) {
		return "", os.ErrNotExist
	}
	if err != nil {
		return "", fmt.Errorf("%w: %v", errHeldReleaseUnsafe, err)
	}
	defer f.Close()
	st, err := f.Stat()
	if err != nil {
		return "", fmt.Errorf("%w: %v", errHeldReleaseUnsafe, err)
	}
	if !st.Mode().IsRegular() || st.Size() > heldRenderJournalMax {
		return "", errHeldReleaseUnsafe
	}
	raw, err := io.ReadAll(io.LimitReader(f, heldRenderJournalMax+1))
	if err != nil {
		return "", fmt.Errorf("%w: %v", errHeldReleaseUnsafe, err)
	}
	if len(raw) > heldRenderJournalMax {
		return "", errHeldReleaseUnsafe
	}
	j, err := moves.DecodeJournal(raw, host, op)
	if err != nil {
		return "", fmt.Errorf("%w: %v", errHeldReleaseUnsafe, err)
	}
	return j.Steps[landStepRendered], nil
}