package profile

import (
	"os"
	"path/filepath"
	"runtime"
	"testing"
)

func TestRuntimeDirEnsureCreatesPrivateDirectory(t *testing.T) {
	isolateRuntimeDirConfig(t)
	testConfigDir := t.TempDir()
	t.Setenv(ConfigDirEnvKey, testConfigDir)

	want := filepath.Join(testConfigDir, "run")
	if got := RuntimeDir(); got != want {
		t.Fatalf("RuntimeDir() = %q, want %q", got, want)
	}

	got, err := EnsureRuntimeDir()
	if err != nil {
		t.Fatalf("EnsureRuntimeDir() error = %v", err)
	}
	if got != want {
		t.Fatalf("EnsureRuntimeDir() = %q, want %q", got, want)
	}
	info, err := os.Stat(got)
	if err != nil {
		t.Fatalf("stat runtime directory: %v", err)
	}
	if !info.IsDir() {
		t.Fatalf("runtime path is not a directory: %s", got)
	}
	if got := info.Mode().Perm(); runtime.GOOS != "windows" && got != 0o700 {
		t.Fatalf("runtime directory mode = %04o, want 0700", got)
	}
}

func TestEnsureRuntimeDirTightensExistingPermissions(t *testing.T) {
	if runtime.GOOS == "windows" {
		t.Skip("Windows runtime privacy is verified through its protected DACL")
	}
	isolateRuntimeDirConfig(t)
	testConfigDir := t.TempDir()
	t.Setenv(ConfigDirEnvKey, testConfigDir)
	runtimeDir := filepath.Join(testConfigDir, "run")
	if err := os.Mkdir(runtimeDir, 0o755); err != nil {
		t.Fatalf("create runtime directory: %v", err)
	}
	if err := os.Chmod(runtimeDir, 0o755); err != nil {
		t.Fatalf("set initial runtime directory mode: %v", err)
	}

	if _, err := EnsureRuntimeDir(); err != nil {
		t.Fatalf("EnsureRuntimeDir() error = %v", err)
	}
	info, err := os.Stat(runtimeDir)
	if err != nil {
		t.Fatalf("stat runtime directory: %v", err)
	}
	if got := info.Mode().Perm(); got != 0o700 {
		t.Fatalf("runtime directory mode = %04o, want 0700", got)
	}
}

func TestEnsureRuntimeDirRejectsRegularFile(t *testing.T) {
	isolateRuntimeDirConfig(t)
	testConfigDir := t.TempDir()
	t.Setenv(ConfigDirEnvKey, testConfigDir)
	runtimeDir := filepath.Join(testConfigDir, "run")
	if err := os.WriteFile(runtimeDir, []byte("not a directory"), 0o600); err != nil {
		t.Fatalf("create runtime regular file: %v", err)
	}

	if _, err := EnsureRuntimeDir(); err == nil {
		t.Fatal("EnsureRuntimeDir() error = nil, want regular-file error")
	}
}

func isolateRuntimeDirConfig(t *testing.T) {
	t.Helper()
	oldConfigDir, oldConfigPath := configDir, configPath
	configDir, configPath = "", ""
	t.Cleanup(func() {
		configDir, configPath = oldConfigDir, oldConfigPath
	})
}