#!/usr/bin/env bash
# Smoke-test: hardening must not chmod system dirs like /var/log.
set -euo pipefail
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
# shellcheck source=/dev/null
source "$ROOT/ssh-monitor-perms.sh"

fail=0
assert_true() {
	if "$@"; then
		return 0
	fi
	printf 'FAIL: expected true: %s\n' "$*" >&2
	fail=1
}
assert_false() {
	if "$@"; then
		printf 'FAIL: expected false: %s\n' "$*" >&2
		fail=1
		return 0
	fi
	return 0
}

assert_true ssh_monitor_is_system_dir /var/log
assert_true ssh_monitor_is_system_dir /var/log/
assert_true ssh_monitor_is_system_dir /etc
assert_true ssh_monitor_is_system_dir /var
assert_true ssh_monitor_is_system_dir /
assert_false ssh_monitor_is_system_dir /var/lib/ssh-monitor
assert_false ssh_monitor_is_system_dir /var/lib/ssh-monitor/sac-spool

tmpdir="$(mktemp -d)"
trap 'rm -rf "$tmpdir"' EXIT
# Private dir still gets 700 (на настоящем Linux; в Git Bash/Windows mode может не примениться)
ssh_monitor_secure_dir "$tmpdir/owned"
mode="$(stat -c '%a' "$tmpdir/owned" 2>/dev/null || stat -f '%OLp' "$tmpdir/owned" 2>/dev/null || echo "")"
if [ -n "$mode" ] && [ "$mode" != "700" ] && [ "$mode" != "0700" ]; then
	if [[ "$(uname -s 2>/dev/null || true)" == Linux ]]; then
		printf 'FAIL: owned dir mode=%s (want 700)\n' "$mode" >&2
		fail=1
	else
		printf 'WARN: skip mode assert on non-Linux (mode=%s)\n' "$mode" >&2
	fi
fi

if [ "$fail" -ne 0 ]; then
	exit 1
fi
printf 'OK: system-dir hardening guards\n'