//go:build windows

package version

import (
	"os"
	"path/filepath"
	"testing"

	"github.com/stretchr/testify/require"
	"golang.org/x/sys/windows"
)

func TestWindowsRecoveryRejectsOtherUsersWriteAccess(t *testing.T) {
	path := filepath.Join(t.TempDir(), "journal.json")
	require.NoError(t, os.WriteFile(path, []byte("{}"), 0600))
	user, err := windows.GetCurrentProcessToken().GetTokenUser()
	require.NoError(t, err)
	for _, access := range []struct {
		rights string
		safe   bool
	}{{"FR", true}, {"FW", false}, {"FA", false}} {
		t.Run(access.rights, func(t *testing.T) {
			sd, err := windows.SecurityDescriptorFromString("D:P(A;;FA;;;" + user.User.Sid.String() + ")(A;;" + access.rights + ";;;WD)")
			require.NoError(t, err)
			dacl, _, err := sd.DACL()
			require.NoError(t, err)
			require.NoError(t, windows.SetNamedSecurityInfo(path, windows.SE_FILE_OBJECT,
				windows.DACL_SECURITY_INFORMATION|windows.PROTECTED_DACL_SECURITY_INFORMATION,
				nil, nil, dacl, nil))
			err = validateUpdateRecoveryFile(path)
			if access.safe {
				require.NoError(t, err)
			} else {
				require.ErrorContains(t, err, "modify recovery state")
			}
			info, err := os.Stat(path)
			require.NoError(t, err)
			require.ErrorContains(t, validateJournalKeyPermissions(path, info), "private to its owner")
		})
	}
}