package rootstate

import (
	"os"
	"path/filepath"

	"golang.org/x/sys/unix"
)

func EnsurePublicDir(path string) error {
	if !filepath.IsAbs(path) || filepath.Clean(path) != path || os.Geteuid() != 0 {
		return os.ErrPermission
	}
	parent, err := Open(filepath.Dir(path), true, true)
	if err != nil {
		return err
	}
	defer parent.Close()
	return ensurePublicChild(parent.(*directory), filepath.Base(path))
}

func ensurePublicChild(parent *directory, name string) error {
	if !component(name) || parent.check() != nil {
		return os.ErrPermission
	}
	fd := int(parent.file.Fd())
	if err := unix.Mkdirat(fd, name, 0755); err != nil && err != unix.EEXIST {
		return err
	}
	child, err := unix.Openat(fd, name, unix.O_RDONLY|unix.O_DIRECTORY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
	if err != nil {
		return err
	}
	defer unix.Close(child)
	if err := trusted(child, parent.owner, unix.S_IFDIR); err != nil {
		return err
	}
	var st unix.Stat_t
	if err := unix.Fstat(child, &st); err != nil {
		return err
	}
	if st.Gid != 0 || st.Mode&07777 != 0700 && st.Mode&07777 != 0755 {
		return os.ErrPermission
	}
	if st.Mode&07777 == 0700 {
		if err := unix.Fchmod(child, 0755); err != nil {
			return err
		}
	}
	if err := unix.Fsync(child); err != nil {
		return err
	}
	return unix.Fsync(fd)
}