//go:build linux

package instanceexec

import (
	"encoding/json"
	"errors"
	"io"
	"net"
	"os"
	"strings"
	"time"

	"github.com/carlosframework/platform/internal/instancectl"
	"golang.org/x/sys/unix"
)

func scopedClaimInit(argv0 string, argv, env []string, snapshot string) error {
	return runInitChecked(argv0, argv, env, func() error {
		if err := ScopeAbstractUnix(); err != nil {
			return err
		}
		return ScopeClaimGeneration()
	}, func() error {
		return checkClaimExec(snapshot, instancectl.ClaimExecSocket, 0, claimBootTime)
	})
}
func claimBootTime() (string, int64, error) {
	b, err := os.ReadFile(instancectl.ClaimExecBootID)
	if err != nil {
		return "", 0, err
	}
	var ts unix.Timespec
	if err = unix.ClockGettime(unix.CLOCK_BOOTTIME, &ts); err != nil {
		return "", 0, err
	}
	return strings.TrimSpace(string(b)), ts.Nano(), nil
}

// The path is a root-controlled ExecStart argument, never tenant environment
// or a field of launch.run.json. Its read-only bind cannot be opted out of.
func checkClaimExec(snapshot, socket string, owner uint32, now func() (string, int64, error)) error {
	fd, err := unix.Open(snapshot, unix.O_RDONLY|unix.O_CLOEXEC|unix.O_NOFOLLOW, 0)
	if err != nil {
		return err
	}
	f := os.NewFile(uintptr(fd), snapshot)
	defer f.Close()
	var st unix.Stat_t
	if err = unix.Fstat(fd, &st); err != nil {
		return err
	}
	if st.Uid != owner || st.Mode&unix.S_IFMT != unix.S_IFREG || st.Mode&0222 != 0 {
		return instancectl.ErrClaimUnit
	}
	var want instancectl.ClaimExecPermit
	if err = json.NewDecoder(io.LimitReader(f, 4096)).Decode(&want); err != nil {
		return err
	}
	if !want.Valid() || want.Containment != 1 {
		return instancectl.ErrClaimUnit
	}
	conn, err := net.DialTimeout("unix", socket, 5*time.Second)
	if err != nil {
		return err
	}
	defer conn.Close()
	if err = conn.SetDeadline(time.Now().Add(5 * time.Second)); err != nil {
		return err
	}
	raw, err := conn.(*net.UnixConn).SyscallConn()
	if err != nil {
		return err
	}
	var cred *unix.Ucred
	var peerErr error
	if err = raw.Control(func(fd uintptr) { cred, peerErr = unix.GetsockoptUcred(int(fd), unix.SOL_SOCKET, unix.SO_PEERCRED) }); err != nil {
		return err
	}
	if peerErr != nil {
		return peerErr
	}
	if cred.Uid != owner {
		return instancectl.ErrClaimUnit
	}
	if err = json.NewEncoder(conn).Encode(want); err != nil {
		return err
	}
	var got instancectl.ClaimExecPermit
	if err = json.NewDecoder(io.LimitReader(conn, 4096)).Decode(&got); err != nil {
		return err
	}
	if got != want {
		return instancectl.ErrClaimUnit
	}
	// Explicit close precedes the final time sample. No IO or namespace setup
	// follows this sample before runInitChecked calls ForkExec.
	if err = conn.Close(); err != nil && !errors.Is(err, net.ErrClosed) {
		return err
	}
	boot, n, err := now()
	if err != nil {
		return err
	}
	if boot != want.BootID || n >= want.SafeUntil {
		return instancectl.ErrClaimUnit
	}
	return nil
}