//go:build unix

package host

import (
	"errors"
	"os"
	"path/filepath"
	"testing"
)

// Root chowns the registry files in the service user's /data. A planted
// symlink or hard link must be refused, never followed, so it cannot hand a
// root-owned file to the service user.
func TestOwnRegistryFileRefusesPlantedLinks(t *testing.T) {
	dir := t.TempDir()
	uid, gid := os.Getuid(), os.Getgid()
	victim := filepath.Join(dir, "victim")
	if err := os.WriteFile(victim, []byte("root's"), 0600); err != nil {
		t.Fatal(err)
	}
	link := filepath.Join(dir, "registry.db-wal")
	if err := os.Symlink(victim, link); err != nil {
		t.Fatal(err)
	}
	if _, err := ownRegistryFile(link, uid, gid); !errors.Is(err, errRegistryFileShape) {
		t.Fatalf("symlink followed or wrongly accepted: %v", err)
	}
	hard := filepath.Join(dir, "registry.db-shm")
	if err := os.Link(victim, hard); err != nil {
		t.Fatal(err)
	}
	if _, err := ownRegistryFile(hard, uid, gid); !errors.Is(err, errRegistryFileShape) {
		t.Fatalf("hard link accepted: %v", err)
	}
	sub := filepath.Join(dir, "registry.db")
	if err := os.Mkdir(sub, 0700); err != nil {
		t.Fatal(err)
	}
	if _, err := ownRegistryFile(sub, uid, gid); !errors.Is(err, errRegistryFileShape) {
		t.Fatalf("directory accepted: %v", err)
	}
	if _, err := ownRegistryFile(filepath.Join(dir, "absent"), uid, gid); !errors.Is(err, os.ErrNotExist) {
		t.Fatalf("missing file: %v", err)
	}
	plain := filepath.Join(dir, "plain.db")
	if err := os.WriteFile(plain, nil, 0600); err != nil {
		t.Fatal(err)
	}
	if changed, err := ownRegistryFile(plain, uid, gid); err != nil || changed {
		t.Fatalf("plain file already owned: changed=%v err=%v", changed, err)
	}
}