#[path = "../dever-tests/tests/support/process.rs"]
mod process;
#[path = "../dever-tests/tests/support/temp.rs"]
mod temp;

use std::fs;
use std::process::Command;

#[test]
fn runtime_assets_have_no_sandbox_executables() {
    assert!(dever_process::asset_executable("lib/ld-linux-x86-64.so.2"));
    assert!(dever_process::asset_executable("lib/ld-linux-aarch64.so.1"));
    assert!(!dever_process::asset_executable("bin/bwrap"));
    assert!(!dever_process::asset_executable("bin/guard"));
    assert!(!dever_process::asset_executable("lib/libc.so.6"));
}

#[cfg(target_os = "linux")]
#[test]
fn direct_child_keeps_the_container_namespace_and_explicit_paths() {
    let directory = temp::TemporaryDirectory::new();
    let input = directory.path().join("input");
    fs::write(&input, "trusted input").unwrap();
    let mut command = Command::new(std::env::current_exe().unwrap());
    command.env("DEVER_TEST_AMBIENT", "must not reach the child");
    dever_process::configure(&mut command);
    command
        .args(["--ignored", "--exact", "direct_child_probe"])
        .env("DEVER_TEST_INPUT", &input)
        .env(
            "DEVER_TEST_MOUNT",
            fs::read_link("/proc/self/ns/mnt").unwrap(),
        );
    assert!(
        process::status(&mut command, std::time::Duration::from_secs(5))
            .unwrap()
            .success()
    );
    assert_eq!(fs::read(input).unwrap(), b"trusted output");
}

#[cfg(target_os = "linux")]
#[test]
fn process_group_observes_exit_before_reaping_the_leader() {
    let mut command = Command::new(std::env::current_exe().unwrap());
    dever_process::configure(&mut command);
    let mut child = command
        .args(["--ignored", "--exact", "direct_child_probe"])
        .env("DEVER_TEST_WAIT", "1")
        .spawn()
        .unwrap();
    let group = dever_process::ProcessGroup::pin(child.id()).unwrap();
    assert!(!group.exited().unwrap());
    group.terminate().unwrap();
    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(2);
    while !group.exited().unwrap() && std::time::Instant::now() < deadline {
        std::thread::sleep(std::time::Duration::from_millis(5));
    }
    let exited = group.exited().unwrap();
    drop(group);
    assert!(
        !process::wait(&mut child, std::time::Duration::from_secs(2))
            .unwrap()
            .success()
    );
    assert!(exited);
}

#[cfg(target_os = "linux")]
#[test]
#[ignore = "internal direct-process probe"]
fn direct_child_probe() {
    if std::env::var_os("DEVER_TEST_WAIT").is_some() {
        std::thread::sleep(std::time::Duration::from_secs(2));
        return;
    }
    assert!(std::env::var_os("DEVER_TEST_AMBIENT").is_none());
    assert_eq!(
        fs::read_link("/proc/self/ns/mnt").unwrap().as_os_str(),
        std::env::var_os("DEVER_TEST_MOUNT").unwrap()
    );
    let path = std::env::var_os("DEVER_TEST_INPUT").unwrap();
    assert_eq!(fs::read(&path).unwrap(), b"trusted input");
    fs::write(path, "trusted output").unwrap();
}