use std::os::unix::fs::PermissionsExt;
use std::path::Path;
use std::process::Command;

use crate::SandboxConfig;
use crate::errors::SandboxError;

const PROC_CHILDREN: &str = "/proc/thread-self/children";

pub fn check(config: &SandboxConfig) -> Result<(), SandboxError> {
    check_bwrap()?;
    check_command(config)?;
    check_chdir(config)?;
    check_proc_children(Path::new(PROC_CHILDREN))?;
    Ok(())
}

fn check_chdir(config: &SandboxConfig) -> Result<(), SandboxError> {
    if !config.chdir.is_dir() {
        return Err(SandboxError::ChdirMissing(config.chdir.clone()));
    }
    Ok(())
}

fn check_bwrap() -> Result<(), SandboxError> {
    Command::new("bwrap")
        .arg("--version")
        .output()
        .map_err(|_| SandboxError::BwrapNotFound)?;
    Ok(())
}

fn check_command(config: &SandboxConfig) -> Result<(), SandboxError> {
    if !config.command.is_file() {
        return Err(SandboxError::CommandNotFound(config.command.clone()));
    }
    let metadata = std::fs::metadata(&config.command)?;
    if metadata.permissions().mode() & 0o111 == 0 {
        return Err(SandboxError::CommandNotExecutable(config.command.clone()));
    }
    Ok(())
}

fn check_proc_children(path: &Path) -> Result<(), SandboxError> {
    if !path.exists() {
        return Err(SandboxError::ProcChildrenMissing);
    }
    Ok(())
}

#[cfg(test)]
#[path = "../tests/unit/preflight.rs"]
mod tests;