#
# Copyright (C) 2016 The Android Open Source Project
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.


"""This file provides all ACL related parsing and behavior."""


import os
import re
import struct


from project import common
from selinux import file_context


class FileAcl(object):
    DEFAULTS = {
        'USER': '1000',
        'GROUP': '1000',
        'SELABEL': '',
        'PERMISSIONS': '0400',
        'CAPABILITIES': '0'
    }

    def __init__(self, copy):
        self._origin = common.Origin()
        self._copy = copy
        # For now, we default to system.
        self._user = self.DEFAULTS['USER']
        self._group = self.DEFAULTS['GROUP']
        self._selabel = self.DEFAULTS['SELABEL']
        self._perms = self.DEFAULTS['PERMISSIONS']
        self._fcaps = self.DEFAULTS['CAPABILITIES']
        # For packs which wrap a Android build, we will often
        # want to just use the build systems default values.
        # When this is False, fs_config and file_context will
        # return empty.
        self._override_build = True
        # TODO(wad): add more types (b/27848879).
        self._file_type = file_context.FILE_TYPE_FILE
        default_acl = None
        if (copy is not None and
                copy.pack is not None and
                copy.pack.defaults is not None):
            default_acl = copy.pack.defaults.acl
        if default_acl is not None:
            self._user = default_acl.user
            self._group = default_acl.group
            self._selabel = default_acl.selabel
            self._perms = default_acl.perms
            self._fcaps = default_acl.fcaps

    def load(self, ele):
        """Loads the FileAcl from a XML element node (set-acl)."""
        self._origin = ele.origin.copy()
        ele.limit_attribs(['user', 'group', 'selabel', 'perms', 'fcaps'])
        # Since all attributes are optional, we can just pull from the
        # element attrib.
        for key in ele.attrib:
            if ele.attrib[key] not in (None, ''):
                self.__dict__['_{}'.format(key)] = ele.attrib[key]
        if self._perms is not None:
            if not re.match('^0[0-7][0-7][0-7]$', self._perms):
                raise common.LoadErrorWithOrigin(
                    self._origin,
                    '@perms must match ^0[0-7][0-7][0-7]$: {}'.format(
                        self._perms))
        # TODO(wad) Add fcaps content validation.
        if self._fcaps != self.DEFAULTS['CAPABILITIES']:
            raise common.LoadErrorWithOrigin(
                self._origin, '@fcaps support is not yet implemented.')

    @property
    def override_build(self):
        return self._override_build

    @override_build.setter
    def override_build(self, build_def):
        self._override_build = build_def

    @property
    def user(self):
        return self._user

    @user.setter
    def user(self, user):
        # TODO(wad) http://b/27564772
        try:
            self._user = int(user)
        except TypeError:
            raise ValueError('user must be numeric: {}'.format(user))

    @property
    def group(self):
        return self._group

    @group.setter
    def group(self, group):
        # TODO(wad) http://b/27564772
        try:
            self._group = int(group)
        except TypeError:
            raise ValueError('group must be numeric: {}'.format(group))

    @property
    def perms(self):
        return self._perms

    @perms.setter
    def perms(self, perms):
        try:
            self._perms = oct(int(perms, 8))
        except TypeError:
            raise ValueError('perms must be octal: {}'.format(perms))

    @property
    def selabel(self):
        return self._selabel

    @selabel.setter
    def selabel(self, selabel):
        self._selabel = selabel

    @property
    def fcaps(self):
        return self._fcaps

    @fcaps.setter
    def fcaps(self, fcaps):
        self._fcaps = fcaps

    @property
    def copy(self):
        return self._copy

    @copy.setter
    def copy(self, cpy):
        self._copy = cpy

    @property
    def file_type(self):
        return self._file_type

    @file_type.setter
    def file_type(self, ftype):
        if ftype not in file_context.FILE_TYPE.keys():
            raise ValueError('ftype must be one of {}: {}'.format(
                file_context.FILE_TYPE.keys(), ftype))
        self._file_type = ftype

    def file_context(self, path=None, ftype=None):
        """Builds a ASCII SELinux file context entry for the given ACL.

        If the ACL is applied to a GLOB, then path and ftype
        should be applied or the glob will be written into the
        file_context.
        """
        if self.override_build == False:
            return ''
        path = path or self._copy.dst
        if not os.path.isabs(path):
            path = os.path.sep + path
        ftype = ftype or file_context.FILE_TYPE[self._file_type]
        return '{} {} {}'.format(path, ftype, self._selabel)

    def fs_config(self, path=None, binary=False):
        """Returns the fs_config entry in ASCII or binary format.

        Args:
            path: Optionally override the copy destination.
            binary: If True, returns the binary fs_config format.
                If False, returns the ASCII fs_config format.

        Note for callers: binary fs_config files will be evaluated
        in first match order so it is important to use more specific
        paths first.
        """
        if self.override_build == False:
            return ''
        path = path or self._copy.dst
        if path.startswith(os.path.sep):
            path = path.lstrip('/')
        if binary:
            # https://android.googlesource.com/platform/system/core/+/master/libcutils/fs_config.c#45
            # struct fs_path_config_from_file {
            #     uint16_t length; /* header plus prefix */
            #     uint16_t mode;
            #     uint16_t uid;
            #     uint16_t gid
            #     uint64_t capabilities;
            #     char prefix[];
            # }   __attribute__((__aligned__(sizeof(uint64_t))));
            path_len = len(path) + 1  # Terminating NUL is required.
            total_len = 16 + path_len
            # The on-disk format is little endian byte order.
            entry = struct.pack(
                '<HHHHQ{}s'.format(path_len), total_len,
                int(self._perms, 8), int(self._user),
                int(self._group), int(self._fcaps), path)
            return entry
        return '{} {} {} {} capabilities={}'.format(
            path, self._user, self._group, self._perms, self._fcaps)

    def __repr__(self):
        return ('<set-acl user="{}" group="{}" selabel="{}" '
                'perms="{}" fcaps="{}"/>'.format(
                    self._user or '', self._group or '', self._selabel or '',
                    self._perms or '', self._fcaps or ''))