# Copyright © Cloud Linux GmbH & Cloud Linux Software, Inc 2010-2024 All Rights Reserved
#
# Licensed under CLOUD LINUX LICENSE AGREEMENT
# http://cloudlinux.com/docs/LICENSE.TXT
import errno
import functools
import logging
import os
import pwd
import sys
import tempfile

import secureio
from clcommon import clcaptain
from clcommon.utils import ExternalProgramFailed


logger = logging.getLogger(__name__)


def read_file(filename, exit_on_error=True):
    """
    Helper for read file, process errors and make backup before read
    :param: filename `str` name of file for read
    :param: exit_on_error `bool` use sys.exit on error or raise exception
    """
    try:
        with open(filename, "r") as _file:
            return _file.readlines()

    except (OSError, IOError):
        secureio.logging("Error: failed to read " + filename, secureio.SILENT_FLAG, 1)
        if not exit_on_error:
            raise
        sys.exit(1)


@functools.cache
def read_file_cached(path):
    return read_file(path)


# Returns True if error has occured
def make_userdir(path, perm, uid, gid, parent_path):
    # Create directory if it does not exist, and set permissions/owner
    fd = secureio.create_dir_secure(
        path, perm, uid, gid, parent_path, logger=secureio.logging
    )
    secureio.closefd(fd)
    return fd is None


def home_owned_by_other_user(home_path, target_uid):
    """
    CLOS-4545 guard against stealing a shared home's ``.cagefs``.

    Return ``True`` when ``home_path`` is owned by a user *other than*
    ``target_uid`` and that owner is a real ``/etc/passwd`` user whose home
    directory is ``home_path`` itself.

    On every panel CageFS supports, the home directory is owned by the real
    subscription/account user, so its owner is the authoritative answer to
    "who does this home belong to".  When several ``/etc/passwd`` entries share
    one home -- e.g. an orphan ``sys_user`` left behind by a reverted Plesk
    migration, which merely has the home as its ``pw_dir`` but does not own it
    -- an operation aimed at a uid that is *not* the home owner must not chown
    ``<home>/.cagefs`` to it: that would strip the real owner of its own
    ``.cagefs`` and break the subscription (the next HTTP request fails with
    503).  Callers must skip the chown when this returns ``True``.

    Keying on the home owner (rather than the current ``.cagefs`` owner) means
    the legitimate owner -- and automated repair such as
    ``update_status(fix_owner=True)`` -- can always (re)claim ``.cagefs``, even
    after it was previously flipped to an orphan.  ``False`` is also returned
    when ``target_uid`` owns the home, when the home cannot be stat'd, or when
    it is owned by an unrelated uid (e.g. root) that does not live in this home,
    so normal provisioning, brand-new subscriptions and ownership repair keep
    working.
    """
    try:
        home_uid = os.stat(home_path).st_uid
    except OSError:
        return False
    if home_uid == target_uid:
        # target_uid is the real owner of the home -> always allowed (this is
        # also what lets the owner / fix_owner reclaim a flipped .cagefs).
        return False
    try:
        home_owner = pwd.getpwuid(home_uid)
    except KeyError:
        return False
    # Only protect when the home owner is a real user that actually lives here,
    # i.e. a genuine shared-home situation -- not a root-owned or unrelated home.
    return os.path.realpath(home_owner.pw_dir) == os.path.realpath(home_path)


def switch_symlink(dest_path, link_name, write_log=True, force=True, silent=False):
    if force or not os.path.islink(link_name):
        try:
            os.unlink(link_name)
        except OSError as e:
            if e.errno == errno.ENOENT:  # No such file error
                logger.info(f"Symlink {link_name} does not exist")
            else:
                logger.error(f"Error: Unable to remove symlink {link_name}", exc_info=e)
        try:
            clcaptain.symlink(dest_path, link_name)
        except (OSError, ExternalProgramFailed) as e:
            msg = f"Error: failed to create symlink {link_name} to {dest_path} : {str(e).replace('Errno', 'Err code')}"
            logger.error(msg, exc_info=e)
            if write_log:
                secureio.logging(msg, silent, True)
            else:
                print(msg, file=sys.stderr)
            return True
    return False


def write_via_tmp(directory, filename, content):
    temp_path = None
    try:
        with tempfile.NamedTemporaryFile("w", dir=directory, delete=False) as tmp_file:
            temp_path = tmp_file.name
            tmp_file.write(content)
            tmp_file.flush()
            os.fsync(tmp_file.fileno())
        os.replace(temp_path, filename)
    finally:
        if temp_path and os.path.exists(temp_path):
            try:
                os.remove(temp_path)
            except OSError:
                pass


def apply_metadata_nofollow(path, mode, uid, gid):
    # Open with O_NOFOLLOW so a symlink planted at `path` between, e.g.,
    # write_via_tmp's os.replace and this call raises ELOOP rather than
    # being followed; fchmod/fchown then act on the inode via the fd.
    fd = os.open(path, os.O_RDONLY | os.O_NOFOLLOW | os.O_CLOEXEC)
    try:
        os.fchmod(fd, mode)
        os.fchown(fd, uid, gid)
    finally:
        os.close(fd)