//go:build windows

package backup

import (
	"context"
	"os"
	"path/filepath"
	"testing"

	"github.com/aritmolab/thothii/tools/tht/internal/safeio"
)

func TestStageArchiveProtectsWindowsStagingArtifactsWithOwnerOnlyACLs(t *testing.T) {
	installation := preflightTestInstallation(t)
	if err := os.MkdirAll(installation.ControlDirectory(), 0o700); err != nil {
		t.Fatal(err)
	}
	archive := filepath.Join(t.TempDir(), "valid.zip")
	writePreflightArchive(t, archive, preflightArchiveSpec{
		entries: []preflightArchiveEntry{{path: "configuration/operator.env", body: []byte("safe")}},
	})
	result, err := Preflight(context.Background(), installation, PreflightRequest{Archive: archive, Confirm: true}, permissivePreflightDependencies())
	if err != nil {
		t.Fatal(err)
	}
	defer result.CloseArchive()

	staged, err := result.StageArchive(context.Background())
	if err != nil {
		t.Fatal(err)
	}
	defer staged.Close()
	if err := safeio.ValidatePrivateDirectory(result.stagingRoot); err != nil {
		t.Fatalf("staging root ACL = %v, want owner-only", err)
	}
	if err := safeio.ValidatePrivateDirectory(staged.directory); err != nil {
		t.Fatalf("staged archive directory ACL = %v, want owner-only", err)
	}
	if err := safeio.ValidatePrivateRegular(staged.path); err != nil {
		t.Fatalf("staged archive ACL = %v, want owner-only", err)
	}
}