package engine

import (
	"io/fs"
	"os"
	"path/filepath"
	"syscall"
	"testing"
)

// Under systemd's RestrictSUIDSGID a chmod that sets the setgid bit fails
// with EPERM; EnsureDir must still create a group-writable directory.
func TestEnsureDirSetgidRestricted(t *testing.T) {
	old := chmod
	defer func() { chmod = old }()
	chmod = func(name string, mode fs.FileMode) error {
		if mode&fs.ModeSetgid != 0 {
			return &fs.PathError{Op: "chmod", Path: name, Err: syscall.EPERM}
		}
		return os.Chmod(name, mode)
	}
	oldMask := syscall.Umask(0o027)
	defer syscall.Umask(oldMask)

	root := t.TempDir()
	d := &Deployer{NamedWritable: []string{root}}
	dir := filepath.Join(root, "internal")
	if err := d.EnsureDir(dir, d.dirMode(dir)); err != nil {
		t.Fatal(err)
	}
	fi, err := os.Stat(dir)
	if err != nil {
		t.Fatal(err)
	}
	if fi.Mode().Perm() != 0o770 {
		t.Errorf("mode = %v, want group-writable 0770", fi.Mode())
	}
	// Unrestricted, the setgid bit is set too.
	chmod = os.Chmod
	dir2 := filepath.Join(root, "external")
	if err := d.EnsureDir(dir2, d.dirMode(dir2)); err != nil {
		t.Fatal(err)
	}
	if fi, _ := os.Stat(dir2); fi.Mode()&(fs.ModePerm|fs.ModeSetgid) != 0o770|fs.ModeSetgid {
		t.Errorf("mode = %v, want 2770", fi.Mode())
	}
}