//! Path-identity primitives shared by the sandbox enforcement layers.
//!
//! [`CanonicalPathBuf`] is the low-level primitive: a symlink-free canonical
//! path that, on Linux, additionally pins the exact inode it names via a live
//! `O_PATH` handle. [`HostFilesystemLocation`] wraps it into the opaque
//! host-location handle the policy layer traffics in, pairing the trusted
//! canonical identity with the untrusted, as-requested path (for display and
//! provenance).

mod canonical_path;
mod host_filesystem_location;

pub(crate) use canonical_path::CanonicalPathBuf;
#[cfg(target_os = "linux")]
pub(crate) use canonical_path::linux_fd_identity;
pub use host_filesystem_location::{
    HostFilesystemLocation, HostFilesystemLocationDisplay, normalize_host_filesystem_locations,
};

use std::path::{Path, PathBuf};

/// Resolve `path` to its canonical, symlink-free form, for recording as the
/// `resolved` half of a persisted write grant (and for showing the user the true
/// target at approval time).
///
/// This **follows** symlinks: it discovers the real target so it can be shown
/// and persisted. Protection against a *later* swap comes from rebuilding the
/// grant with [`HostFilesystemLocation::reopen`], which verifies this value.
/// Mirrors what [`HostFilesystemLocation::capture`] computes internally.
#[cfg(any(target_os = "linux", target_os = "macos"))]
pub fn resolve_canonical(path: impl AsRef<Path>) -> std::io::Result<PathBuf> {
    Ok(CanonicalPathBuf::resolve(path)?.into_path())
}

/// Non-Linux/macOS platforms capture no canonical identity of their own (the
/// real resolution happens WSL-side), so the requested path is returned as-is.
#[cfg(not(any(target_os = "linux", target_os = "macos")))]
pub fn resolve_canonical(path: impl AsRef<Path>) -> std::io::Result<PathBuf> {
    Ok(path.as_ref().to_path_buf())
}

/// Lexically normalize an absolute path (collapsing `.` and `..` and redundant
/// separators) without touching the filesystem. Returns `None` for a relative
/// path, which can't be compared to an absolute canonical path without a base.
#[cfg(any(target_os = "linux", target_os = "macos"))]
pub(crate) fn lexically_normalized_absolute(path: &Path) -> Option<PathBuf> {
    use std::path::Component;
    if !path.is_absolute() {
        return None;
    }
    let mut normalized = PathBuf::new();
    for component in path.components() {
        match component {
            Component::CurDir => {}
            Component::ParentDir => {
                // Never pop past the root: `normalized.pop()` is a no-op at root.
                normalized.pop();
            }
            other => normalized.push(other),
        }
    }
    Some(normalized)
}

/// Canonicalize `path`, resolving symlinks, even when its final component
/// doesn't exist yet.
///
/// `std::fs::canonicalize` fails if any component is missing, which would leave
/// a not-yet-created path in a non-canonical form. The sandbox layers
/// canonicalize the writable parent
/// (the worktree root) but, with a plain `canonicalize`, fall back to the raw
/// path for a missing child; the two then disagree when a component is a
/// symlink (`/tmp` -> `/private/tmp` on macOS), and the protection rule for the
/// child misses the real path the command ends up writing. Canonicalizing the
/// existing parent and re-appending the final component keeps the child
/// consistent with its parent. If neither the path nor its parent can be
/// canonicalized, the path is returned unchanged.
//
// Only the macOS Seatbelt layer uses this (Linux skips not-yet-existing
// protected paths rather than emitting a rule for them), so it's gated to macOS
// to avoid a dead-code warning elsewhere.
#[cfg(target_os = "macos")]
pub(crate) fn canonicalize_allowing_missing_leaf(path: &std::path::Path) -> std::path::PathBuf {
    if let Ok(canonical) = path.canonicalize() {
        return canonical;
    }
    if let (Some(parent), Some(file_name)) = (path.parent(), path.file_name())
        && let Ok(canonical_parent) = parent.canonicalize()
    {
        return canonical_parent.join(file_name);
    }
    path.to_path_buf()
}

#[cfg(all(test, target_os = "macos"))]
mod macos_tests {
    use super::canonicalize_allowing_missing_leaf;

    #[test]
    fn canonicalize_allowing_missing_leaf_resolves_existing_parent() {
        let dir = tempfile::tempdir().unwrap();
        let canonical_dir = dir.path().canonicalize().unwrap();

        // A fully existing path is canonicalized outright.
        assert_eq!(
            canonicalize_allowing_missing_leaf(dir.path()),
            canonical_dir
        );

        // A path whose leaf doesn't exist yet still resolves through its parent,
        // so it stays consistent with how the parent directory canonicalizes
        // (for example, when protecting a not-yet-created child path).
        let missing = dir.path().join("not-created-yet");
        assert_eq!(
            canonicalize_allowing_missing_leaf(&missing),
            canonical_dir.join("not-created-yet"),
        );

        // A path whose parent also doesn't exist is returned unchanged.
        let deeper = missing.join(".git");
        assert_eq!(canonicalize_allowing_missing_leaf(&deeper), deeper);
    }
}