//go:build linux || darwin

package rootaws

import (
	"fmt"
	"io"

	"github.com/aws/aws-sdk-go-v2/aws"
	"golang.org/x/sys/unix"
)

func readStaticCredentials(path string) (aws.Credentials, error) {
	f, err := openCredentials(path)
	if err != nil {
		return aws.Credentials{}, err
	}
	defer f.Close()
	var st unix.Stat_t
	if err := unix.Fstat(int(f.Fd()), &st); err != nil {
		return aws.Credentials{}, err
	}
	if st.Mode&unix.S_IFMT != unix.S_IFREG || st.Nlink != 1 || st.Uid != 0 || st.Mode&0o022 != 0 {
		return aws.Credentials{}, fmt.Errorf("credentials must be root-owned, single-link regular and not group- or other-writable")
	}
	body, err := io.ReadAll(io.LimitReader(f, MaxCredentialsSize+1))
	if err != nil {
		return aws.Credentials{}, err
	}
	return ParseStaticCredentials(body)
}