//! Phase 18 (Track E.2) — macOS process backend hardening.
//!
//! macOS analogue of [`super::process_linux`].  Where the Linux backend
//! installs a `pre_exec` sequence (prctl + rlimits + unshare + chroot +
//! seccomp-bpf), the macOS backend wraps the harness command with
//! `sandbox-exec(1)` driven by a per-capability `.sb` policy file.
//!
//! Profile selection
//! -----------------
//! [`profile_for_caps`] maps the [`SandboxOptions::seccomp_caps`] bitset
//! (set by the verifier from `spec.expected_cap`) to a profile name in
//! `src/dynamic/sandbox_profiles/`:
//!
//! | Cap bit          | Profile          |
//! | ---------------- | ---------------- |
//! | `FILE_IO`        | `path_traversal` |
//! | `SSRF`           | `ssrf`           |
//! | `CODE_EXEC`      | `cmdi`           |
//! | `DESERIALIZE`    | `deserialize`    |
//! | everything else  | `base`           |
//!
//! Profiles are baked into the binary via `include_str!` and materialised
//! into a per-process tempdir on first use so `sandbox-exec -f` can read
//! them.
//!
//! Fallback
//! --------
//! `sandbox-exec` is shipped on every supported macOS release but the
//! binary path can be missing in stripped CI images.  When
//! [`sandbox_exec_available`] returns `false`, the wrapper is a no-op
//! and [`record_outcome`] tags the run as
//! [`HardeningLevel::Trusted`] — the verifier reads this back via
//! `VerifyOptions::refuse_filesystem_confirm` and downgrades filesystem-
//! oracle verdicts to
//! [`crate::evidence::InconclusiveReason::BackendInsufficient`].
//!
//! Tests
//! -----
//! See `tests/sandbox_hardening_macos.rs` for the per-primitive
//! acceptance suite; `cfg(target_os = "macos")` gates every test so the
//! Linux CI row sees only the skip placeholder.

use std::collections::BTreeMap;
use std::path::{Path, PathBuf};
use std::sync::{Mutex, OnceLock};

// ── HardeningLevel reporting ─────────────────────────────────────────────────

/// Coarse summary of the macOS sandbox-exec wrap outcome.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum HardeningLevel {
    /// `sandbox-exec` was unavailable on the host — the harness ran
    /// unconfined.  The verifier translates this into
    /// `refuse_filesystem_confirm = true` so filesystem-escape oracles
    /// degrade to `Inconclusive(BackendInsufficient)` rather than
    /// silently returning `Confirmed` against an unhardened backend.
    Trusted,
    /// The harness was wrapped with `sandbox-exec -f <profile>` and the
    /// profile selected matched [`profile_for_caps`].
    Sandboxed,
    /// `sandbox-exec` was available but the spawn returned a non-zero
    /// status before the harness could run.  Same downgrade as
    /// [`HardeningLevel::Trusted`] from the verifier's point of view.
    Failed,
}

/// Per-run summary read back by [`last_hardening_outcome`].
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct HardeningOutcome {
    pub level: HardeningLevel,
    /// Name of the matched profile (e.g. `"path_traversal"`).  Empty
    /// string when [`HardeningLevel::Trusted`].
    pub profile: String,
}

static LAST_OUTCOME: OnceLock<Mutex<Option<HardeningOutcome>>> = OnceLock::new();

fn outcome_cell() -> &'static Mutex<Option<HardeningOutcome>> {
    LAST_OUTCOME.get_or_init(|| Mutex::new(None))
}

pub(crate) fn record_outcome(outcome: HardeningOutcome) {
    if let Ok(mut g) = outcome_cell().lock() {
        *g = Some(outcome);
    }
}

/// Snapshot of the most-recent hardening outcome on macOS.  Tests +
/// telemetry read this after `sandbox::run` returns.  Returns `None`
/// until at least one wrap attempt has been recorded.
pub fn last_hardening_outcome() -> Option<HardeningOutcome> {
    outcome_cell().lock().ok().and_then(|g| g.clone())
}

/// Clear the last-outcome slot.  Tests use this between cases so a stale
/// value from a prior spawn cannot leak into the assertion under test.
pub fn reset_last_hardening_outcome() {
    if let Ok(mut g) = outcome_cell().lock() {
        *g = None;
    }
}

// ── sandbox-exec availability + binary path ──────────────────────────────────

/// Env override consulted by [`sandbox_exec_bin`]; tests set this to
/// `"/nonexistent/sandbox-exec"` to force the unavailable branch.
pub const SANDBOX_EXEC_BIN_ENV: &str = "NYX_SANDBOX_EXEC_BIN";

/// Resolve the `sandbox-exec` binary path.  Honours
/// [`SANDBOX_EXEC_BIN_ENV`] so tests can simulate a missing binary
/// without touching `/usr/bin/sandbox-exec`.
pub fn sandbox_exec_bin() -> PathBuf {
    if let Ok(p) = std::env::var(SANDBOX_EXEC_BIN_ENV) {
        return PathBuf::from(p);
    }
    PathBuf::from("/usr/bin/sandbox-exec")
}

/// `true` when [`sandbox_exec_bin`] points at an executable regular
/// file.  Result is *not* cached across calls so the
/// [`SANDBOX_EXEC_BIN_ENV`] override can be flipped per-test.
pub fn sandbox_exec_available() -> bool {
    let bin = sandbox_exec_bin();
    match std::fs::metadata(&bin) {
        Ok(m) => m.is_file(),
        Err(_) => false,
    }
}

// ── Profile selection + materialisation ──────────────────────────────────────

/// Baked-in `.sb` source.  Each entry is the contents of one file under
/// `src/dynamic/sandbox_profiles/`; the runtime materialises them into a
/// per-process tempdir on first use.
const PROFILE_SOURCES: &[(&str, &str)] = &[
    ("base", include_str!("../sandbox_profiles/base.sb")),
    ("cmdi", include_str!("../sandbox_profiles/cmdi.sb")),
    (
        "path_traversal",
        include_str!("../sandbox_profiles/path_traversal.sb"),
    ),
    ("ssrf", include_str!("../sandbox_profiles/ssrf.sb")),
    ("deserialize", include_str!("../sandbox_profiles/deserialize.sb")),
];

/// Cap → profile-name dispatch.  The most restrictive matching profile
/// wins: `FILE_IO` outranks `SSRF` outranks `CODE_EXEC` outranks
/// `DESERIALIZE`.  A cap bit with no matching profile falls back to the
/// `base` profile.
pub fn profile_for_caps(caps: u32) -> &'static str {
    // Mirror the bit positions declared in `src/labels/mod.rs`.
    const FILE_IO: u32 = 1 << 5;
    const DESERIALIZE: u32 = 1 << 8;
    const SSRF: u32 = 1 << 9;
    const CODE_EXEC: u32 = 1 << 10;

    if caps & FILE_IO != 0 {
        "path_traversal"
    } else if caps & SSRF != 0 {
        "ssrf"
    } else if caps & CODE_EXEC != 0 {
        "cmdi"
    } else if caps & DESERIALIZE != 0 {
        "deserialize"
    } else {
        "base"
    }
}

/// Lazy materialised tempdir holding the `.sb` files unpacked from the
/// binary.  Survives for the lifetime of the process — the system's
/// `tmp` reaper sweeps the dir on next boot.
static PROFILE_DIR: OnceLock<Option<PathBuf>> = OnceLock::new();
static PROFILE_PATHS: OnceLock<Mutex<BTreeMap<&'static str, PathBuf>>> = OnceLock::new();

fn profile_dir() -> Option<&'static Path> {
    PROFILE_DIR
        .get_or_init(|| {
            let dir = std::env::temp_dir().join("nyx-sandbox-profiles");
            std::fs::create_dir_all(&dir).ok()?;
            Some(dir)
        })
        .as_deref()
}

fn profile_paths() -> &'static Mutex<BTreeMap<&'static str, PathBuf>> {
    PROFILE_PATHS.get_or_init(|| Mutex::new(BTreeMap::new()))
}

/// Return the absolute path of the named profile, writing the
/// `include_str!`-baked source to the per-process tempdir on first
/// access.  Returns `None` when the profile name is unknown or the
/// tempdir could not be created / written.
pub fn profile_path(name: &str) -> Option<PathBuf> {
    // Resolve the static source first so we hold a `&'static str` key.
    let (key, source) = PROFILE_SOURCES.iter().find(|(k, _)| *k == name)?;
    {
        let cache = profile_paths().lock().ok()?;
        if let Some(p) = cache.get(key) {
            return Some(p.clone());
        }
    }
    let dir = profile_dir()?;
    let path = dir.join(format!("{key}.sb"));
    if !path.exists() {
        std::fs::write(&path, source).ok()?;
    }
    let mut cache = profile_paths().lock().ok()?;
    cache.insert(*key, path.clone());
    Some(path)
}

// ── Command wrapping ─────────────────────────────────────────────────────────

/// Inputs to [`wrap_plan`] — the original harness command split into
/// resolved-path + argv-tail form.  The caller is expected to have
/// already resolved `cmd_path` via `find_in_host_path` so the wrapped
/// `sandbox-exec` invocation receives an absolute target binary.
pub struct WrapInput<'a> {
    pub cmd_path: &'a Path,
    pub cmd_args: &'a [String],
    pub workdir: &'a Path,
    pub caps: u32,
    pub profile_override: Option<&'a str>,
}

/// Outputs of [`wrap_plan`] when sandbox-exec wrapping is in effect.
/// `binary` is the `sandbox-exec` path (or the env-override) and `args`
/// is the full argv (excluding `argv[0]`).
pub struct WrapPlan {
    pub binary: PathBuf,
    pub args: Vec<String>,
    pub profile: &'static str,
}

/// Build the `sandbox-exec -f <profile> -D WORKDIR=<workdir> -- <cmd>`
/// argv for `cmd_path + cmd_args`.  Returns `None` when:
///
/// - `sandbox-exec` is not on the host (records [`HardeningLevel::Trusted`]),
/// - the profile name is unknown (records [`HardeningLevel::Trusted`]), or
/// - the profile file could not be materialised in `/tmp`
///   (records [`HardeningLevel::Failed`]).
///
/// Callers use the returned `None` as a signal to fall back to the
/// unwrapped command; the verifier's `refuse_filesystem_confirm` flag
/// keeps the verdict honest in that case.
pub fn wrap_plan(input: &WrapInput<'_>) -> Option<WrapPlan> {
    if !sandbox_exec_available() {
        record_outcome(HardeningOutcome {
            level: HardeningLevel::Trusted,
            profile: String::new(),
        });
        return None;
    }
    let profile = input.profile_override.unwrap_or_else(|| profile_for_caps(input.caps));
    // Profile keys must be `&'static str` (from `PROFILE_SOURCES`); reject
    // unknown overrides up-front so we don't accidentally wrap with a
    // profile we have no source for.
    let resolved_key = PROFILE_SOURCES
        .iter()
        .find(|(k, _)| *k == profile)
        .map(|(k, _)| *k);
    let resolved_key = match resolved_key {
        Some(k) => k,
        None => {
            record_outcome(HardeningOutcome {
                level: HardeningLevel::Trusted,
                profile: String::new(),
            });
            return None;
        }
    };
    let profile_file = match profile_path(resolved_key) {
        Some(p) => p,
        None => {
            record_outcome(HardeningOutcome {
                level: HardeningLevel::Failed,
                profile: resolved_key.to_owned(),
            });
            return None;
        }
    };

    let workdir_abs = std::fs::canonicalize(input.workdir).unwrap_or_else(|_| input.workdir.to_path_buf());

    let mut args: Vec<String> = Vec::with_capacity(6 + input.cmd_args.len());
    args.push("-f".to_owned());
    args.push(profile_file.to_string_lossy().into_owned());
    args.push("-D".to_owned());
    args.push(format!("WORKDIR={}", workdir_abs.to_string_lossy()));
    args.push(input.cmd_path.to_string_lossy().into_owned());
    for a in input.cmd_args {
        args.push(a.clone());
    }

    record_outcome(HardeningOutcome {
        level: HardeningLevel::Sandboxed,
        profile: resolved_key.to_owned(),
    });

    Some(WrapPlan {
        binary: sandbox_exec_bin(),
        args,
        profile: resolved_key,
    })
}

// ── Tests ────────────────────────────────────────────────────────────────────

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn profile_for_caps_prefers_file_io() {
        const FILE_IO: u32 = 1 << 5;
        const SSRF: u32 = 1 << 9;
        const CODE_EXEC: u32 = 1 << 10;
        assert_eq!(profile_for_caps(FILE_IO), "path_traversal");
        assert_eq!(profile_for_caps(FILE_IO | SSRF), "path_traversal");
        assert_eq!(profile_for_caps(SSRF | CODE_EXEC), "ssrf");
        assert_eq!(profile_for_caps(CODE_EXEC), "cmdi");
        assert_eq!(profile_for_caps(0), "base");
    }

    #[test]
    fn profile_path_materialises_baked_source() {
        let path = profile_path("base").expect("base profile");
        let contents = std::fs::read_to_string(&path).expect("read .sb");
        assert!(contents.contains("(version 1)"));
        assert!(contents.contains("/etc/passwd"));

        // The path_traversal profile substitutes WORKDIR at spawn time,
        // so its baked source contains the param reference.
        let trav = profile_path("path_traversal").expect("path_traversal profile");
        let trav_src = std::fs::read_to_string(&trav).expect("read .sb");
        assert!(trav_src.contains("(param \"WORKDIR\")"));
    }

    #[test]
    fn profile_path_unknown_name_is_none() {
        assert!(profile_path("does_not_exist").is_none());
    }

    #[test]
    fn sandbox_exec_bin_honours_env_override() {
        // SAFETY: tests are run serially with the macOS hardening suite;
        // resetting the env var below restores the default for subsequent
        // tests in the same process.
        unsafe { std::env::set_var(SANDBOX_EXEC_BIN_ENV, "/nonexistent/sandbox-exec") };
        assert_eq!(sandbox_exec_bin(), PathBuf::from("/nonexistent/sandbox-exec"));
        assert!(!sandbox_exec_available());
        unsafe { std::env::remove_var(SANDBOX_EXEC_BIN_ENV) };
    }

    #[test]
    fn wrap_plan_returns_none_when_sandbox_exec_missing() {
        unsafe { std::env::set_var(SANDBOX_EXEC_BIN_ENV, "/nonexistent/sandbox-exec") };
        reset_last_hardening_outcome();
        let input = WrapInput {
            cmd_path: Path::new("/usr/bin/true"),
            cmd_args: &[],
            workdir: Path::new("/tmp"),
            caps: 0,
            profile_override: None,
        };
        assert!(wrap_plan(&input).is_none());
        let outcome = last_hardening_outcome().expect("outcome recorded");
        assert_eq!(outcome.level, HardeningLevel::Trusted);
        unsafe { std::env::remove_var(SANDBOX_EXEC_BIN_ENV) };
    }

    #[test]
    #[cfg(target_os = "macos")]
    fn wrap_plan_returns_sandboxed_when_sandbox_exec_present() {
        // Skip when the host doesn't actually have /usr/bin/sandbox-exec
        // (e.g. someone reading SANDBOX_EXEC_BIN_ENV from a parent shell).
        unsafe { std::env::remove_var(SANDBOX_EXEC_BIN_ENV) };
        if !sandbox_exec_available() {
            eprintln!("SKIP: /usr/bin/sandbox-exec missing on this host");
            return;
        }
        reset_last_hardening_outcome();
        let input = WrapInput {
            cmd_path: Path::new("/usr/bin/true"),
            cmd_args: &[],
            workdir: Path::new("/tmp"),
            caps: 1 << 5, // FILE_IO
            profile_override: None,
        };
        let plan = wrap_plan(&input).expect("plan");
        assert_eq!(plan.profile, "path_traversal");
        assert_eq!(plan.binary, PathBuf::from("/usr/bin/sandbox-exec"));
        assert!(plan.args.iter().any(|a| a == "-f"));
        assert!(plan.args.iter().any(|a| a.starts_with("WORKDIR=")));
        let outcome = last_hardening_outcome().expect("outcome");
        assert_eq!(outcome.level, HardeningLevel::Sandboxed);
        assert_eq!(outcome.profile, "path_traversal");
    }
}