//go:build linux && rootrunner

package host

import (
	"os"
	"os/exec"
	"path/filepath"
	"testing"

	"golang.org/x/sys/unix"
)

func TestPlan14GenerationKernelCensusRootRunner(t *testing.T) {
	if dir := os.Getenv("PLAN14_E24_KERNEL_CHILD"); dir != "" {
		t.Setenv("CARLOS_OPT_DIR", dir)
		path := filepath.Join(dir, "versions", "v1", "app")
		if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
			t.Fatal(err)
		}
		if err := os.WriteFile(path, []byte("root census reference"), 0644); err != nil {
			t.Fatal(err)
		}
		if boot, digest, err := productionGenerationKernelCensus(t.Context()); err != nil || boot == "" || len(digest) != 64 {
			t.Fatalf("quiescent census: %s %s %v", boot, digest, err)
		}
		file, err := os.Open(path)
		if err != nil {
			t.Fatal(err)
		}
		if _, _, err := productionGenerationKernelCensus(t.Context()); err == nil {
			file.Close()
			t.Fatal("open unreserved file certified")
		}
		if err := os.Remove(path); err != nil {
			file.Close()
			t.Fatal(err)
		}
		if _, _, err := productionGenerationKernelCensus(t.Context()); err == nil {
			file.Close()
			t.Fatal("deleted open file certified")
		}
		file.Close()
		if _, _, err := productionGenerationKernelCensus(t.Context()); err != nil {
			t.Fatal("closed file still retained", err)
		}
		if err := os.WriteFile(path, []byte("root census reference"), 0644); err != nil {
			t.Fatal(err)
		}
		alias := filepath.Join(dir, "alias")
		if err := os.Mkdir(alias, 0755); err != nil {
			t.Fatal(err)
		}
		if err := unix.Mount(filepath.Dir(path), alias, "", unix.MS_BIND, ""); err != nil {
			t.Fatal(err)
		}
		mounted := true
		t.Cleanup(func() {
			if mounted {
				if err := unix.Unmount(alias, 0); err != nil {
					t.Error(err)
				}
			}
		})
		if _, _, err := productionGenerationKernelCensus(t.Context()); err == nil {
			t.Fatal("bind alias certified")
		}
		if err := unix.Unmount(alias, 0); err != nil {
			t.Fatal(err)
		}
		mounted = false
		ns, err := os.Open("/proc/self/ns/mnt")
		if err != nil {
			t.Fatal(err)
		}
		if _, _, err := productionGenerationKernelCensus(t.Context()); err == nil {
			ns.Close()
			t.Fatal("retained namespace descriptor certified")
		}
		ns.Close()
		if _, _, err := productionGenerationKernelCensus(t.Context()); err != nil {
			t.Fatal("released references still retained", err)
		}
		return
	}
	dir := generationRootRunnerDir(t)
	// A private PID/mount namespace gives the scan a controlled all-root census.
	// No generated tenant unit or running-tenant containment is accepted here.
	cmd := exec.CommandContext(t.Context(), "unshare", "--mount", "--pid", "--fork", "--mount-proc", os.Args[0], "-test.run=^TestPlan14GenerationKernelCensusRootRunner$", "-test.count=1")
	cmd.Dir = dir
	cmd.Env = append(os.Environ(), "PLAN14_E24_KERNEL_CHILD="+dir)
	if out, err := cmd.CombinedOutput(); err != nil {
		t.Fatalf("isolated root census: %v %s", err, out)
	}
}