//go:build !windows

package safeio

import (
	"errors"
	"os"
	"path/filepath"
)

func createPrivateDirectory(path string) error {
	if err := os.Mkdir(path, 0o700); err != nil {
		if errors.Is(err, os.ErrExist) {
			return os.ErrExist
		}
		return err
	}
	return ProtectPrivateDirectory(path)
}

// ProtectPrivateDirectory sets the private directory mode used for local authentication state.
func ProtectPrivateDirectory(path string) error {
	if err := ValidateCanonicalPath(path); err != nil {
		return err
	}
	if err := os.Chmod(path, 0o700); err != nil {
		return ErrUnsafeFile
	}
	return ValidatePrivateDirectory(path)
}

// ValidatePrivateDirectory requires a canonical, non-symlinked directory with no group or world access.
func ValidatePrivateDirectory(path string) error {
	if err := requireCanonicalDirectory(path); err != nil {
		return err
	}
	info, err := os.Lstat(path)
	if err != nil || !info.IsDir() || info.Mode()&os.ModeSymlink != 0 || !isExactPrivateMode(info.Mode(), 0o700) {
		return ErrUnsafeFile
	}
	return nil
}

// ProtectPrivateRegular sets the private file mode used for local authentication files.
func ProtectPrivateRegular(path string) error {
	if err := ValidateCanonicalPath(path); err != nil {
		return err
	}
	if err := os.Chmod(path, 0o600); err != nil {
		return ErrUnsafeFile
	}
	return ValidatePrivateRegular(path)
}

func createCanonicalNewPrivateFile(path string, mode os.FileMode) (*os.File, error) {
	file, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_EXCL, mode)
	if err != nil {
		return nil, err
	}
	if err := ProtectPrivateRegular(path); err != nil {
		_ = file.Close()
		_ = os.Remove(path)
		return nil, ErrUnsafeFile
	}
	return file, nil
}

// ValidatePrivateRegular requires a canonical, single-link private regular file.
func ValidatePrivateRegular(path string) error {
	if err := ValidateCanonicalPath(path); err != nil {
		return err
	}
	if err := requireCanonicalDirectory(filepath.Dir(path)); err != nil {
		return err
	}
	info, err := os.Lstat(path)
	if err != nil || !info.Mode().IsRegular() || info.Mode()&os.ModeSymlink != 0 || !hasSingleLink(info) || !isExactPrivateMode(info.Mode(), 0o600) {
		return ErrUnsafeFile
	}
	return nil
}

func isExactPrivateMode(mode os.FileMode, permissions os.FileMode) bool {
	return mode.Perm() == permissions && mode&(os.ModeSetuid|os.ModeSetgid|os.ModeSticky) == 0
}