//go:build windows

package safeio

import (
	"io"
	"os"

	"golang.org/x/sys/windows"
)

func readCanonicalPrivateRegular(path string, maximum int64) ([]byte, error) {
	if maximum < 0 || maximum == int64(^uint64(0)>>1) {
		return nil, ErrUnsafeFile
	}
	value, err := openWindowsPrivateRegular(path, 1)
	if err != nil {
		return nil, ErrUnsafeFile
	}
	defer value.Close()
	file := os.NewFile(uintptr(value.handle), "tht-safeio-private-read")
	if file == nil {
		return nil, ErrUnsafeFile
	}
	before := value.info
	contents, readErr := io.ReadAll(io.LimitReader(file, maximum+1))
	var after = value.info
	identityErr := windows.GetFileInformationByHandle(value.handle, &after)
	daclErr := validateOwnerOnlyDACL(value.handle)
	closeErr := file.Close()
	value.handle = 0
	if readErr != nil || identityErr != nil || daclErr != nil || !sameWindowsPrivateFile(before, after) || after.NumberOfLinks != 1 || closeErr != nil || int64(len(contents)) > maximum {
		return nil, ErrUnsafeFile
	}
	current, err := openWindowsPrivateRegular(path, 1)
	if err != nil {
		return nil, ErrUnsafeFile
	}
	current.Close()
	if !sameWindowsPrivateFile(before, current.info) {
		return nil, ErrUnsafeFile
	}
	return contents, nil
}