package inject

import (
	"os"
	"path/filepath"
	"testing"
)

func TestWriteTargetsBootAndRootMounts(t *testing.T) {
	dir := t.TempDir()
	boot := filepath.Join(dir, "boot")
	root := filepath.Join(dir, "root")
	inj := Injector{BootPath: boot, RootPath: root}

	files := []FileSpec{
		{Path: "boot.txt", Content: []byte("boot"), Mode: 0o644, RootFS: false},
		{Path: "root.txt", Content: []byte("root"), Mode: 0o600, RootFS: true},
	}
	if err := inj.Write(files); err != nil {
		t.Fatalf("Write: %v", err)
	}
	if got, err := os.ReadFile(filepath.Join(boot, "boot.txt")); err != nil || string(got) != "boot" {
		t.Fatalf("boot file = %q, err=%v", string(got), err)
	}
	if got, err := os.ReadFile(filepath.Join(root, "root.txt")); err != nil || string(got) != "root" {
		t.Fatalf("root file = %q, err=%v", string(got), err)
	}
}

func TestWriteReturnsFilesystemErrors(t *testing.T) {
	dir := t.TempDir()
	boot := filepath.Join(dir, "boot")
	rootFile := filepath.Join(dir, "root-file")
	if err := os.WriteFile(rootFile, []byte("not a dir"), 0o644); err != nil {
		t.Fatal(err)
	}
	inj := Injector{BootPath: boot, RootPath: rootFile}
	if err := inj.Write([]FileSpec{{Path: "root.txt", Content: []byte("root"), RootFS: true}}); err == nil {
		t.Fatal("expected write error for root path file")
	}
}

func TestWriteSystemdEnablementAndSecretPermissions(t *testing.T) {
	root := t.TempDir()
	target := filepath.Join(root, "secret")
	if err := os.WriteFile(target, []byte("old"), 0644); err != nil {
		t.Fatal(err)
	}
	files := []FileSpec{
		{Path: "secret", Content: []byte("synthetic"), Mode: 0600, RootFS: true},
		{Path: "system/wants/unit", Symlink: "../unit", RootFS: true},
	}
	inj := Injector{RootPath: root}
	for n := 0; n < 2; n++ {
		if err := inj.Write(files); err != nil {
			t.Fatal(err)
		}
	}
	info, err := os.Stat(target)
	if err != nil {
		t.Fatal(err)
	}
	if info.Mode().Perm() != 0600 {
		t.Fatal("old loose permissions retained")
	}
	link, err := os.Readlink(filepath.Join(root, "system/wants/unit"))
	if err != nil || link != "../unit" {
		t.Fatal(link, err)
	}
	if err := inj.Write([]FileSpec{{Path: "secret", Symlink: "../unit", RootFS: true}}); err == nil {
		t.Fatal("overwrote existing regular file")
	}
}

func TestSecretPermissionFailureIsReported(t *testing.T) {
	previous := setFileMode
	setFileMode = func(string, os.FileMode) error { return os.ErrPermission }
	defer func() { setFileMode = previous }()
	inj := Injector{RootPath: t.TempDir()}
	err := inj.Write([]FileSpec{{Path: "secret", Content: []byte("synthetic"), Mode: 0600, RootFS: true}})
	if err == nil {
		t.Fatal("secret permission failure was ignored")
	}
}