//go:build windows

package safeio

import (
	"crypto/rand"
	"encoding/hex"
	"io/fs"
	"os"
	"path/filepath"
	"runtime"
	"strings"

	"unsafe"

	"golang.org/x/sys/windows"
)

const (
	// Retained input handles deny delete sharing while permitting ordinary reads
	// and writes by trusted callers.
	windowsRetainedHandleShareMode uint32 = windows.FILE_SHARE_READ | windows.FILE_SHARE_WRITE
	// Outputs are opened for exclusive publication: deny write/delete sharing,
	// but permit the exact-identity read recheck below.
	windowsOutputHandleShareMode uint32 = windows.FILE_SHARE_READ
)

// ReadCanonicalRegular opens each component with FILE_FLAG_OPEN_REPARSE_POINT and rejects a
// reparse point on the opened handle before opening the next component. Retained handles allow
// ordinary read/write sharing but deny delete sharing, which blocks rename or deletion after a
// component is opened and throughout the final read. Windows' Win32 API does not expose a
// portable descriptor-relative equivalent of POSIX openat, so a hostile local actor can still
// replace a not-yet-opened normal component between absolute-path opens. Installation directories
// therefore need trusted local filesystem/ACL ownership on Windows.
func ReadCanonicalRegular(path string, maximum int64) ([]byte, error) {
	if err := ValidateCanonicalPath(path); err != nil {
		return nil, err
	}
	volume := filepath.VolumeName(path)
	root := volume + string(filepath.Separator)
	components := strings.Split(strings.TrimPrefix(path, root), string(filepath.Separator))
	if volume == "" || len(components) == 0 || components[0] == "" {
		return nil, ErrUnsafeFile
	}

	current := root
	parents := make([]windows.Handle, 0, len(components)-1)
	defer func() { closeWindowsHandles(parents) }()
	for _, component := range components[:len(components)-1] {
		current = filepath.Join(current, component)
		handle, err := openWindowsComponent(current, true)
		if err != nil {
			return nil, ErrUnsafeFile
		}
		parents = append(parents, handle)
	}

	current = filepath.Join(current, components[len(components)-1])
	handle, err := openWindowsComponent(current, false)
	if err != nil {
		return nil, ErrUnsafeFile
	}
	file := os.NewFile(uintptr(handle), "thothctl-safeio")
	if file == nil {
		windows.CloseHandle(handle)
		return nil, ErrUnsafeFile
	}
	defer file.Close()
	var before, after windows.ByHandleFileInformation
	if windows.GetFileInformationByHandle(handle, &before) != nil || before.NumberOfLinks > 1 {
		return nil, ErrUnsafeFile
	}
	contents, err := readBoundedRegularFile(file, maximum)
	if err != nil {
		return nil, ErrUnsafeFile
	}
	if windows.GetFileInformationByHandle(handle, &after) != nil || after.NumberOfLinks > 1 || !sameWindowsFile(before, after) {
		return nil, ErrUnsafeFile
	}
	// Re-opened pathname identity is checked as well as the retained handle. This
	// catches replacement by an ordinary local actor where share/delete policy permits it.
	check, err := openWindowsComponent(current, false)
	if err != nil {
		return nil, ErrUnsafeFile
	}
	defer windows.CloseHandle(check)
	var named windows.ByHandleFileInformation
	if windows.GetFileInformationByHandle(check, &named) != nil || named.NumberOfLinks > 1 || !sameWindowsFile(before, named) {
		return nil, ErrUnsafeFile
	}
	return contents, nil
}

func openWindowsComponent(path string, directory bool) (windows.Handle, error) {
	flags := uint32(windows.FILE_FLAG_OPEN_REPARSE_POINT)
	if directory {
		flags |= windows.FILE_FLAG_BACKUP_SEMANTICS
	} else {
		flags |= windows.FILE_ATTRIBUTE_NORMAL
	}
	handle, err := windows.CreateFile(
		windows.StringToUTF16Ptr(path),
		windows.GENERIC_READ,
		windowsRetainedHandleShareMode,
		nil,
		windows.OPEN_EXISTING,
		flags,
		0,
	)
	if err != nil {
		return 0, err
	}
	var information windows.ByHandleFileInformation
	if err := windows.GetFileInformationByHandle(handle, &information); err != nil {
		windows.CloseHandle(handle)
		return 0, err
	}
	if information.NumberOfLinks > 1 || information.FileAttributes&windows.FILE_ATTRIBUTE_REPARSE_POINT != 0 ||
		(directory && information.FileAttributes&windows.FILE_ATTRIBUTE_DIRECTORY == 0) ||
		(!directory && information.FileAttributes&windows.FILE_ATTRIBUTE_DIRECTORY != 0) {
		windows.CloseHandle(handle)
		return 0, ErrUnsafeFile
	}
	return handle, nil
}

func closeWindowsHandles(handles []windows.Handle) {
	for _, handle := range handles {
		windows.CloseHandle(handle)
	}
}

func writeCanonicalExclusive(path string, contents []byte, mode fs.FileMode) error {
	if err := ValidateCanonicalPath(path); err != nil || len(contents) > 16<<20 || mode.Perm() != 0o600 {
		return ErrUnsafeFile
	}
	parent, retainedParents, err := openWindowsParents(path)
	if err != nil {
		return ErrUnsafeFile
	}
	defer closeWindowsHandles(retainedParents)
	securityDescriptor, securityAttributes, err := ownerOnlySecurityAttributes()
	if err != nil {
		return ErrUnsafeFile
	}
	_ = securityDescriptor
	stageName, err := privateWindowsStageName()
	if err != nil {
		return ErrUnsafeFile
	}
	stagePath := filepath.Join(parent, stageName)
	stageHandle, err := windows.CreateFile(windows.StringToUTF16Ptr(stagePath), windows.GENERIC_WRITE, windowsOutputHandleShareMode, securityAttributes, windows.CREATE_NEW, windows.FILE_ATTRIBUTE_NORMAL|windows.FILE_FLAG_OPEN_REPARSE_POINT, 0)
	if err != nil {
		return ErrUnsafeFile
	}
	stageFile := os.NewFile(uintptr(stageHandle), "thothctl-safeio-stage")
	if stageFile == nil {
		windows.CloseHandle(stageHandle)
		_ = windows.DeleteFile(windows.StringToUTF16Ptr(stagePath))
		return ErrUnsafeFile
	}
	stageCreated := true
	published := false
	var staged, publishedIdentity windows.ByHandleFileInformation
	if err := windows.GetFileInformationByHandle(stageHandle, &staged); err != nil || staged.NumberOfLinks != 1 {
		_ = stageFile.Close()
		_ = windows.DeleteFile(windows.StringToUTF16Ptr(stagePath))
		return ErrUnsafeFile
	}
	cleanup := func() {
		if published {
			removeWindowsIfIdentity(filepath.Join(parent, filepath.Base(path)), publishedIdentity)
		}
		if stageCreated {
			removeWindowsIfIdentity(stagePath, staged)
		}
	}
	fail := func() error {
		_ = stageFile.Close()
		cleanup()
		return ErrUnsafeFile
	}
	if n, err := stageFile.Write(contents); err != nil || n != len(contents) {
		return fail()
	}
	if err := stageFile.Sync(); err != nil {
		return fail()
	}
	var afterWrite windows.ByHandleFileInformation
	if err := windows.GetFileInformationByHandle(stageHandle, &afterWrite); err != nil || afterWrite.NumberOfLinks != 1 || afterWrite.FileSizeHigh != uint32(uint64(len(contents))>>32) || afterWrite.FileSizeLow != uint32(len(contents)) {
		return fail()
	}
	if err := stageFile.Close(); err != nil {
		cleanup()
		return ErrUnsafeFile
	}
	// CreateHardLink is an atomic, same-volume, no-replace publication. The final
	// pathname can never refer to a partially written candidate.
	finalPath := filepath.Join(parent, filepath.Base(path))
	if err := windows.CreateHardLink(windows.StringToUTF16Ptr(finalPath), windows.StringToUTF16Ptr(stagePath), 0); err != nil {
		return fail()
	}
	published = true
	publishedIdentity = staged
	check, identityErr := windowsFileIdentity(finalPath)
	if identityErr != nil || check.NumberOfLinks != 2 || !sameWindowsFile(staged, check) {
		return fail()
	}
	publishedIdentity = check
	if err := windows.DeleteFile(windows.StringToUTF16Ptr(stagePath)); err != nil {
		return fail()
	}
	stageCreated = false
	finalIdentity, identityErr := windowsFileIdentity(finalPath)
	if identityErr != nil || finalIdentity.NumberOfLinks != 1 || !sameWindowsFile(staged, finalIdentity) {
		return fail()
	}
	return nil
}

func privateWindowsStageName() (string, error) {
	var random [16]byte
	if _, err := rand.Read(random[:]); err != nil {
		return "", err
	}
	return ".thothctl-candidate-" + hex.EncodeToString(random[:]), nil
}

func windowsFileIdentity(path string) (windows.ByHandleFileInformation, error) {
	h, err := windows.CreateFile(windows.StringToUTF16Ptr(path), windows.GENERIC_READ, windows.FILE_SHARE_READ|windows.FILE_SHARE_WRITE, nil, windows.OPEN_EXISTING, windows.FILE_ATTRIBUTE_NORMAL|windows.FILE_FLAG_OPEN_REPARSE_POINT, 0)
	if err != nil {
		return windows.ByHandleFileInformation{}, err
	}
	defer windows.CloseHandle(h)
	var information windows.ByHandleFileInformation
	if err := windows.GetFileInformationByHandle(h, &information); err != nil || information.NumberOfLinks == 0 || information.FileAttributes&windows.FILE_ATTRIBUTE_REPARSE_POINT != 0 || information.FileAttributes&windows.FILE_ATTRIBUTE_DIRECTORY != 0 {
		return windows.ByHandleFileInformation{}, ErrUnsafeFile
	}
	return information, nil
}

func removeWindowsIfIdentity(path string, expected windows.ByHandleFileInformation) {
	got, err := windowsFileIdentity(path)
	if err == nil && sameWindowsFile(got, expected) {
		_ = windows.DeleteFile(windows.StringToUTF16Ptr(path))
	}
}

func openWindowsParents(path string) (string, []windows.Handle, error) {
	volume := filepath.VolumeName(path)
	root := volume + string(filepath.Separator)
	components := strings.Split(strings.TrimPrefix(path, root), string(filepath.Separator))
	if volume == "" || len(components) < 2 || components[0] == "" {
		return "", nil, ErrUnsafeFile
	}
	current := root
	parents := make([]windows.Handle, 0, len(components)-1)
	for _, component := range components[:len(components)-1] {
		current = filepath.Join(current, component)
		h, err := openWindowsComponent(current, true)
		if err != nil {
			closeWindowsHandles(parents)
			return "", nil, ErrUnsafeFile
		}
		parents = append(parents, h)
	}
	return current, parents, nil
}

func validateCanonicalOutputPath(path string) error {
	if err := ValidateCanonicalPath(path); err != nil {
		return err
	}
	current, parents, err := openWindowsParents(path)
	if err != nil {
		return ErrUnsafeFile
	}
	defer closeWindowsHandles(parents)
	if _, err := os.Lstat(filepath.Join(current, filepath.Base(path))); err == nil || !os.IsNotExist(err) {
		return ErrUnsafeFile
	}
	return nil
}

func validatePlatformPathSyntax(path string) error {
	// Win32 device namespaces and alternate data streams do not represent an
	// independent regular file with owner-only output permissions.
	lower := strings.ToLower(path)
	if strings.HasPrefix(lower, `\\?\`) || strings.HasPrefix(lower, `\\.\`) ||
		strings.HasPrefix(lower, `\device\`) || strings.HasPrefix(lower, `\??\`) || strings.HasPrefix(path, `\\`) {
		return ErrUnsafeFile
	}
	volume := filepath.VolumeName(path)
	for _, component := range strings.Split(strings.TrimPrefix(path, volume+string(filepath.Separator)), string(filepath.Separator)) {
		if strings.Contains(component, ":") {
			return ErrUnsafeFile
		}
	}
	return nil
}

func sameWindowsFile(a, b windows.ByHandleFileInformation) bool {
	return a.VolumeSerialNumber == b.VolumeSerialNumber && a.FileIndexHigh == b.FileIndexHigh && a.FileIndexLow == b.FileIndexLow
}

// ownerOnlySecurityAttributes builds a non-inheriting DACL granting the current
// token's user read/write access and no access to inherited or other trustees.
// The descriptor is retained by the returned Go value for the duration of CreateFile.
func ownerOnlySecurityAttributes() (*windows.SECURITY_DESCRIPTOR, *windows.SecurityAttributes, error) {
	user, err := windows.GetCurrentProcessToken().GetTokenUser()
	if err != nil || user == nil || user.User.Sid == nil {
		return nil, nil, ErrUnsafeFile
	}
	var pinner runtime.Pinner
	pinner.Pin(user.User.Sid)
	defer pinner.Unpin()
	trustee := windows.TRUSTEE{
		TrusteeForm:  windows.TRUSTEE_IS_SID,
		TrusteeType:  windows.TRUSTEE_IS_USER,
		TrusteeValue: windows.TrusteeValueFromSID(user.User.Sid),
	}
	entries := []windows.EXPLICIT_ACCESS{{
		AccessPermissions: windows.FILE_GENERIC_READ | windows.FILE_GENERIC_WRITE,
		AccessMode:        windows.SET_ACCESS,
		Inheritance:       windows.NO_INHERITANCE,
		Trustee:           trustee,
	}}
	descriptor, err := windows.BuildSecurityDescriptor(nil, nil, entries, nil, nil)
	if err != nil || descriptor == nil {
		return nil, nil, ErrUnsafeFile
	}
	acl, _, err := descriptor.DACL()
	if err != nil || acl == nil {
		return nil, nil, ErrUnsafeFile
	}
	if err := descriptor.SetControl(windows.SE_DACL_PROTECTED, windows.SE_DACL_PROTECTED); err != nil {
		return nil, nil, ErrUnsafeFile
	}
	// BuildSecurityDescriptor returns a self-relative descriptor. Re-using its
	// DACL as the creation descriptor is valid, and the explicit DACL has no
	// inheritable ACEs; the protected flag is applied by the kernel on creation.
	_ = acl
	attrs := &windows.SecurityAttributes{
		Length:             uint32(unsafe.Sizeof(windows.SecurityAttributes{})),
		SecurityDescriptor: descriptor,
	}
	return descriptor, attrs, nil
}