// SPDX-License-Identifier: AGPL-3.0-only

//go:build linux

package deploy

import (
	"archive/tar"
	"compress/gzip"
	"os"
	"path/filepath"
	"syscall"
	"testing"
)

func TestExtractArtifactAppliesReleaseModesUnderRestrictiveUmask(t *testing.T) {
	dir := t.TempDir()
	artifact := filepath.Join(dir, "release.tar.gz")
	file, err := os.OpenFile(artifact, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0o600)
	if err != nil {
		t.Fatal(err)
	}
	gz := gzip.NewWriter(file)
	tw := tar.NewWriter(gz)
	entries := map[string][]byte{
		"bundle/app":            []byte("executable"),
		"bundle/BUILDINFO.json": []byte("{}"),
		"bundle/RELEASE.json":   []byte("{}"),
		"bundle/SBOM.spdx.json": []byte("{}"),
		"bundle/SHA256SUMS":     []byte("checksums"),
	}
	for name, body := range entries {
		if err := tw.WriteHeader(&tar.Header{Name: name, Typeflag: tar.TypeReg, Mode: 0o600, Size: int64(len(body))}); err != nil {
			t.Fatal(err)
		}
		if _, err := tw.Write(body); err != nil {
			t.Fatal(err)
		}
	}
	if err := tw.Close(); err != nil {
		t.Fatal(err)
	}
	if err := gz.Close(); err != nil {
		t.Fatal(err)
	}
	if err := file.Close(); err != nil {
		t.Fatal(err)
	}

	oldUmask := syscall.Umask(0o077)
	t.Cleanup(func() { syscall.Umask(oldUmask) })
	stage := filepath.Join(dir, "stage")
	if err := os.Mkdir(stage, 0o700); err != nil {
		t.Fatal(err)
	}
	if err := extractArtifact(artifact, stage); err != nil {
		t.Fatal(err)
	}

	for name, want := range map[string]os.FileMode{
		"app":            0o755,
		"BUILDINFO.json": 0o644,
		"RELEASE.json":   0o644,
		"SBOM.spdx.json": 0o644,
		"SHA256SUMS":     0o644,
	} {
		info, err := os.Stat(filepath.Join(stage, name))
		if err != nil {
			t.Fatal(err)
		}
		if got := info.Mode().Perm(); got != want {
			t.Fatalf("%s mode=%#o want=%#o", name, got, want)
		}
	}
}