// Copyright 2025 Chainguard, Inc.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package linters

import (
	"context"
	"fmt"
	"io/fs"
	"strings"

	"chainguard.dev/melange/pkg/config"
)

func TempDirLinter(ctx context.Context, _ *config.Configuration, pkgname string, fsys fs.FS) error {
	hasTmpFilesSnippet := false
	err := fs.WalkDir(fsys, ".", func(path string, d fs.DirEntry, err error) error {
		if err := ctx.Err(); err != nil {
			return err
		}
		if err != nil {
			return err
		}
		if strings.HasPrefix(path, "usr/lib/tmpfiles.d/") {
			hasTmpFilesSnippet = true
			return fs.SkipAll
		}
		return nil
	})
	if err != nil {
		return err
	}

	return AllPaths(ctx, pkgname, fsys,
		func(path string, d fs.DirEntry) bool {
			// Non-directories in /tmp/ or /var/tmp/ are errors.
			if !d.IsDir() && IsTempDirRegex.MatchString(path) {
				return true
			}
			// Anything in /var/run/ is an error.
			if strings.HasPrefix(path, "var/run/") {
				return true
			}
			if strings.HasPrefix(path, "run/") {
				// Non-directories in /run/ are an error.
				if !d.IsDir() {
					return true
				}
				// Directories in /run/ are an error if there are no tmpfiles.d snippets.
				return !hasTmpFilesSnippet
			}
			return false
		},
		func(pkgname string, paths []string) string { return fmt.Sprintf("%s writes to a temp dir", pkgname) },
	)
}
