//go:build !windows

package recoverytrust

import (
	"fmt"
	"os"
	"syscall"

	"gitgud.io/mike/mpv-manager/internal/fileops"
)

func validateRecoveryPermissions(path string, info os.FileInfo, ancestor bool) error {
	stat, ok := info.Sys().(*syscall.Stat_t)
	if !ok || (stat.Uid != uint32(os.Geteuid()) && stat.Uid != 0) {
		return fmt.Errorf("%s is not owned by the current user or root", path)
	}
	if info.Mode().Perm()&0022 != 0 && !(ancestor && info.IsDir() && info.Mode()&os.ModeSticky != 0) {
		return fmt.Errorf("%s is writable by another user; recovery evidence was retained", path)
	}
	return nil
}

// CreatePrivateFile reserves a file private to its owner before any bytes are written.
func CreatePrivateFile(path string) (*os.File, error) {
	return fileops.CreatePrivateFile(path)
}

func validatePrivatePermissions(path string, info os.FileInfo) error {
	if info.Mode().Perm()&0077 != 0 {
		return fmt.Errorf("private recovery file %s must be private to its owner", path)
	}
	return nil
}