package apply

import (
	"fmt"
	"os"
	"path/filepath"
	"testing"
)

// An account's .ssh below its own home, as that account's, is still placed (the ssh-client module's); as an
// access or a mount it is refused there too (novox/hq issue 339).
func TestAnAccountsOwnSSHIsPlacedAndNeverMounted(t *testing.T) {
	dir := t.TempDir()
	home := filepath.Join(dir, "home", "alice")
	passwd := filepath.Join(dir, "passwd")
	if err := os.WriteFile(passwd, fmt.Appendf(nil, "alice:x:4242:4242::%s:/bin/sh\n", home), 0o644); err != nil {
		t.Fatal(err)
	}
	before := passwdFile
	passwdFile = passwd
	t.Cleanup(func() { passwdFile = before })
	if err := refusePath(home+"/.ssh", placingDirectory, "ssh-client", "alice"); err != nil {
		t.Fatalf("alice's own .ssh: %v", err)
	}
	if err := refusePath(home+"/.ssh/config.d", placingDirectory, "ssh-client", "alice"); err != nil {
		t.Fatalf("alice's own .ssh/config.d: %v", err)
	}
	for _, kind := range []placing{placingAccess, placingMount} {
		if err := refusePath(home+"/.ssh", kind, "notes", ""); err == nil {
			t.Errorf("%v of alice's .ssh was taken", kind)
		}
	}
	if err := refusePath(home+"/.ssh", placingDirectory, "notes", "4243"); err == nil {
		t.Error("another account's directory at alice's .ssh was taken")
	}
}