package rootstate

import (
	"os"
	"path/filepath"

	"github.com/carlosframework/platform/internal/safefile"
	"golang.org/x/sys/unix"
)

func OpenTrustedFile(path string) (*os.File, error) {
	if !filepath.IsAbs(path) || filepath.Clean(path) != path || path == "/" {
		return nil, os.ErrPermission
	}
	s, err := Open(filepath.Dir(path), false, true)
	if err != nil {
		return nil, err
	}
	defer s.Close()
	d := s.(*directory)
	f, err := safefile.OpenFileAt(int(d.file.Fd()), filepath.Base(path), os.O_RDONLY, 0)
	if err != nil {
		return nil, err
	}
	if err := trusted(int(f.Fd()), 0, unix.S_IFREG); err != nil {
		f.Close()
		return nil, err
	}
	return f, nil
}

func Identity(f *os.File) (FileIdentity, error) {
	var st unix.Stat_t
	if err := unix.Fstat(int(f.Fd()), &st); err != nil {
		return FileIdentity{}, err
	}
	return FileIdentity{Device: uint64(st.Dev), Inode: st.Ino}, nil
}

func CheckPublicConfig(f *os.File) error {
	var st unix.Stat_t
	if err := unix.Fstat(int(f.Fd()), &st); err != nil {
		return err
	}
	if st.Uid != 0 || st.Gid != 0 || st.Mode&07777 != 0644 || st.Mode&unix.S_IFMT != unix.S_IFREG || st.Nlink != 1 {
		return os.ErrPermission
	}
	return nil
}