//! Durable file updates (spec §13.6): every write that must survive a

//! crash goes through here.

//!

//! A file is replaced by writing a uniquely named temporary file in the

//! same directory, syncing it, renaming it over the target, and syncing

//! the directory so the rename itself is on disk. A crash at any point

//! leaves either the old file or the new one, never a torn one; at worst

//! a stray temporary file, which nothing reads.

//!

//! In tests, `crash_after(n)` makes the n-th durable step on the current

//! thread fail as if the process had died there, so a test can stop an

//! operation at every step and check what is left behind.

use rand::RngCore;

use std::fs;

use std::io::{self, Write};

use std::path::Path;

/// Replace `path` with `data`, atomically and durably.

pub fn write_atomic(path: &Path, data: &[u8]) -> io::Result<()> {

    write_atomic_mode(path, data, false)

}

/// [`write_atomic`] for a secret: on Unix the file is created readable by

/// its owner only, so the secret is never on disk with wider permissions.

pub fn write_atomic_private(path: &Path, data: &[u8]) -> io::Result<()> {

    write_atomic_mode(path, data, true)

}

fn write_atomic_mode(path: &Path, data: &[u8], private: bool) -> io::Result<()> {

    let dir = path.parent().unwrap_or(Path::new("."));

    let name = path

        .file_name()

        .map(|n| n.to_string_lossy().into_owned())

        .unwrap_or_default();

    let mut nonce = [0u8; 6];

    rand::rngs::OsRng.fill_bytes(&mut nonce);

    let tmp = dir.join(format!(".{name}.tmp-{}", hex::encode(nonce)));

    step("create temporary file")?;

    let written = (|| {

        let mut open = fs::OpenOptions::new();

        open.write(true).create_new(true);

        #[cfg(unix)]

        if private {

            use std::os::unix::fs::OpenOptionsExt;

            open.mode(0o600);

        }

        #[cfg(not(unix))]

        let _ = private;

        let mut f = open.open(&tmp)?;

        f.write_all(data)?;

        f.sync_all()?;

        step("rename into place")?;

        fs::rename(&tmp, path)

    })();

    if let Err(e) = written {

        if !is_injected(&e) {

            let _ = fs::remove_file(&tmp);

        }

        return Err(at("write", path, e));

    }

    sync_dir(dir).map_err(|e| at("sync the directory of", path, e))

}

/// `e`, naming what failed and on which file, so a failure deep in a

/// command says where it happened (an injected test crash stays as is).

/// The kind is kept for callers that test it.

fn at(what: &str, path: &Path, e: io::Error) -> io::Error {

    if is_injected(&e) {

        return e;

    }

    io::Error::new(e.kind(), format!("{what} {}: {e}", path.display()))

}

/// Rename `from` to `to` and make the rename durable.

pub fn rename(from: &Path, to: &Path) -> io::Result<()> {

    step("rename")?;

    fs::rename(from, to).map_err(|e| at(&format!("rename {} to", from.display()), to, e))?;

    sync_dir(to.parent().unwrap_or(Path::new("."))).map_err(|e| at("sync the directory of", to, e))

}

/// Flush a directory's entries (new, renamed or removed files) to disk.

/// A no-op where directories cannot be opened for syncing.

pub fn sync_dir(dir: &Path) -> io::Result<()> {

    #[cfg(unix)]

    {

        fs::File::open(dir)?.sync_all()

    }

    #[cfg(not(unix))]

    {

        let _ = dir;

        Ok(())

    }

}

/// A point where a crash may happen. Outside tests it does nothing.

pub fn step(what: &str) -> io::Result<()> {

    #[cfg(test)]

    {

        failpoint::hit(what)

    }

    #[cfg(not(test))]

    {

        let _ = what;

        Ok(())

    }

}

const INJECTED: &str = "injected crash";

fn is_injected(e: &io::Error) -> bool {

    e.to_string().starts_with(INJECTED)

}

#[cfg(test)]

pub(crate) mod failpoint {

    use std::cell::Cell;

    use std::io;

    thread_local! {

        static COUNTDOWN: Cell<Option<usize>> = const { Cell::new(None) };

        static FIRED: Cell<bool> = const { Cell::new(false) };

    }

    /// Fail the `n`-th durable step from now (1-based) on this thread,

    /// and every step after it, as a dead process would.

    pub fn crash_after(n: usize) {

        COUNTDOWN.with(|c| c.set(Some(n)));

        FIRED.with(|f| f.set(false));

    }

    /// Stop injecting; returns whether a crash was injected.

    pub fn disarm() -> bool {

        COUNTDOWN.with(|c| c.set(None));

        FIRED.with(|f| f.replace(false))

    }

    pub(super) fn hit(what: &str) -> io::Result<()> {

        if FIRED.with(|f| f.get()) {

            return Err(io::Error::other(format!(

                "{} (after) at {what}",

                super::INJECTED

            )));

        }

        COUNTDOWN.with(|c| match c.get() {

            Some(1) => {

                c.set(None);

                FIRED.with(|f| f.set(true));

                Err(io::Error::other(format!("{} at {what}", super::INJECTED)))

            }

            Some(n) => {

                c.set(Some(n - 1));

                Ok(())

            }

            None => Ok(()),

        })

    }

}

#[cfg(test)]

mod tests {

    use super::*;

    #[test]

    fn a_failed_write_names_the_file_and_keeps_its_kind() {

        let dir = tempfile::tempdir().unwrap();

        let path = dir.path().join("attest").join("feature").join("x");

        let e = write_atomic(&path, b"state").unwrap_err();

        assert_eq!(e.kind(), io::ErrorKind::NotFound);

        let msg = e.to_string();

        assert!(

            msg.starts_with("write ") && msg.contains("attest/feature/x"),

            "{msg}"

        );

        write_atomic(&dir.path().join("ok"), b"state").unwrap();

        let e = rename(&dir.path().join("missing"), &dir.path().join("to")).unwrap_err();

        assert!(

            e.to_string().contains("missing") && e.to_string().contains("to"),

            "{e}"

        );

    }

}