//go:build linux && rootrunner

package host

import (
	"errors"
	"maps"
	"os"
	"path/filepath"
	"slices"
	"syscall"
	"testing"

	"golang.org/x/sys/unix"
)

// TestRootFloorDirsUntrustedAncestry is fix round 2's witness as real root,
// through production's prepareRootFloorDirs (the walk from /, owner root):
// the floor repair checks every directory from / to guard/ before it makes
// or changes anything. An ancestor symlink with the floor directory missing
// behind it, and an ancestor owned by someone else holding a root-owned
// floor directory (or none), each refuse with both trees as they were. A
// floor directory of another owner under a trusted path refuses too. A
// trusted path under umask 077 is repaired to 0755 root:root.
func TestRootFloorDirsUntrustedAncestry(t *testing.T) {
	if os.Geteuid() != 0 {
		t.Fatal("designated runner must execute as root")
	}
	const nobody = 65534
	mkopt := func(t *testing.T) (string, string) {
		t.Helper()
		scratch := generationRootRunnerDir(t)
		opt := filepath.Join(scratch, "opt")
		for _, dir := range []string{opt, filepath.Join(opt, "system"), systemGuardDir(opt)} {
			if err := os.Mkdir(dir, 0o755); err != nil {
				t.Fatal(err)
			}
			if err := os.Chmod(dir, 0o755); err != nil {
				t.Fatal(err)
			}
		}
		return scratch, opt
	}
	mkdir := func(t *testing.T, dir string, mode os.FileMode, uid int) {
		t.Helper()
		if err := os.Mkdir(dir, mode); err != nil {
			t.Fatal(err)
		}
		if err := os.Chmod(dir, mode); err != nil {
			t.Fatal(err)
		}
		if err := os.Lchown(dir, uid, uid); err != nil {
			t.Fatal(err)
		}
	}
	for name, c := range map[string]struct {
		setup func(t *testing.T, scratch, opt string) []string // trees outside opt that must not change
		want  []error
	}{
		"symlinked guard, moves missing": {setup: func(t *testing.T, scratch, opt string) []string {
			target := filepath.Join(scratch, "realguard")
			mkdir(t, target, 0o755, 0)
			if err := os.Remove(systemGuardDir(opt)); err != nil {
				t.Fatal(err)
			}
			if err := os.Symlink(target, systemGuardDir(opt)); err != nil {
				t.Fatal(err)
			}
			return []string{target}
		}, want: []error{unix.ELOOP, unix.ENOTDIR}},
		"nobody's system, root's moves 0700": {setup: func(t *testing.T, scratch, opt string) []string {
			mkdir(t, rootFloorDir(opt), 0o700, 0)
			if err := os.Lchown(filepath.Join(opt, "system"), nobody, nobody); err != nil {
				t.Fatal(err)
			}
			return nil
		}, want: []error{os.ErrPermission}},
		"nobody's guard, moves missing": {setup: func(t *testing.T, scratch, opt string) []string {
			if err := os.Lchown(systemGuardDir(opt), nobody, nobody); err != nil {
				t.Fatal(err)
			}
			return nil
		}, want: []error{os.ErrPermission}},
		"nobody's moves 0700": {setup: func(t *testing.T, scratch, opt string) []string {
			mkdir(t, rootFloorDir(opt), 0o700, nobody)
			return nil
		}, want: []error{os.ErrPermission}},
	} {
		t.Run(name, func(t *testing.T) {
			scratch, opt := mkopt(t)
			roots := append([]string{opt}, c.setup(t, scratch, opt)...)
			before := floorTree(t, roots...)
			err := prepareRootFloorDirs(opt)
			if !slices.ContainsFunc(c.want, func(w error) bool { return errors.Is(err, w) }) {
				t.Fatalf("prepareRootFloorDirs = %v, want a refusal with one of %v", err, c.want)
			}
			if after := floorTree(t, roots...); !maps.Equal(before, after) {
				t.Fatalf("the refused repair changed the tree:\nbefore %v\nafter  %v", before, after)
			}
			for _, root := range roots[1:] {
				if _, err := os.Lstat(filepath.Join(root, "moves")); !errors.Is(err, os.ErrNotExist) {
					t.Fatal("moves made through the symlink", err)
				}
			}
			t.Logf("refused with both trees unchanged: %v", err)
		})
	}

	// The trusted path, guard/moves left 0700 and guard/seeds missing, under
	// the window shell's umask 077: both come out 0755 root:root, and a
	// second run changes nothing.
	t.Run("trusted, umask 077", func(t *testing.T) {
		_, opt := mkopt(t)
		mkdir(t, rootFloorDir(opt), 0o700, 0)
		old := syscall.Umask(0o077)
		err := prepareRootFloorDirs(opt)
		syscall.Umask(old)
		if err != nil {
			t.Fatal(err)
		}
		for _, dir := range []string{rootFloorDir(opt), rootSeedsFloorDir(opt)} {
			st, err := os.Lstat(dir)
			if err != nil || !st.IsDir() || st.Mode().Perm() != 0o755 || st.Sys().(*syscall.Stat_t).Uid != 0 || st.Sys().(*syscall.Stat_t).Gid != 0 {
				t.Fatalf("%s is not a 0755 root:root directory: %v %v", dir, st, err)
			}
		}
		before := floorTree(t, opt)
		if err := prepareRootFloorDirs(opt); err != nil {
			t.Fatal("second run", err)
		}
		if after := floorTree(t, opt); !maps.Equal(before, after) {
			t.Fatalf("the second run changed the tree:\nbefore %v\nafter  %v", before, after)
		}
	})
}