//go:build linux

package host

import (
	"context"
	"errors"
	"os"
	"path/filepath"

	"github.com/carlosframework/platform/internal/hostbox"
	"golang.org/x/sys/unix"
)

// Physical identities only restrict the root inventory. Missing or intended
// payloads remain unresolved; this reader never settles or rewrites them.
func generationPayloadFiles(ctx context.Context, root string, payloads []hostbox.GenerationPayload) error {
	count := 0
	for _, p := range payloads {
		for _, e := range p.Inventory.Entries {
			if err := ctx.Err(); err != nil {
				return err
			}
			count++
			if count > 8192 {
				return os.ErrPermission
			}
			if e.Kind == "route" || e.Kind == "timer" {
				continue
			}
			if e.Kind != "path" || e.ManagedRoot != "data" || e.Materialization != "materialized" || !filepath.IsLocal(e.RelativePath) || filepath.Clean(e.RelativePath) != e.RelativePath || e.RelativePath == "." || e.Device == 0 || e.Inode == 0 || (e.Type != unix.S_IFDIR && e.Type != unix.S_IFREG) {
				return os.ErrPermission
			}
			err := hostbox.VerifyInventoryIdentity(root, e)
			if errors.Is(err, os.ErrPermission) {
				if uid, ok := lookupUID(serviceUser); ok && uid > 0 {
					err = hostbox.VerifyInventoryIdentityForOwner(root, e, uint32(uid))
				}
			}
			if err != nil {
				return err
			}

		}
	}
	return ctx.Err()
}