// SPDX-License-Identifier: GPL-3.0-or-later

package system

import (
	"os"
	"path/filepath"
	"testing"
)

func TestScanSUIDBinariesFindsPrivilegedRegularFiles(t *testing.T) {
	root := t.TempDir()
	ordinary := filepath.Join(root, "ordinary")
	privileged := filepath.Join(root, "nested", "privileged")
	if err := os.MkdirAll(filepath.Dir(privileged), 0o700); err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(ordinary, []byte("x"), 0o755); err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(privileged, []byte("x"), 0o755); err != nil {
		t.Fatal(err)
	}
	if err := os.Chmod(privileged, 0o755|os.ModeSetuid); err != nil {
		t.Fatal(err)
	}
	got := ScanSUIDBinaries(root, nil)
	if len(got) != 1 || got[0] != privileged {
		t.Fatalf("unexpected scan: %#v", got)
	}
}

func TestScanSUIDBinariesIncludesExtraDirectories(t *testing.T) {
	root := t.TempDir()
	extra := t.TempDir()
	privileged := filepath.Join(extra, "sgid-tool")
	if err := os.WriteFile(privileged, []byte("x"), 0o755); err != nil {
		t.Fatal(err)
	}
	if err := os.Chmod(privileged, 0o755|os.ModeSetgid); err != nil {
		t.Fatal(err)
	}
	got := ScanSUIDBinaries(root, []string{extra})
	if len(got) != 1 || got[0] != privileged {
		t.Fatalf("unexpected extra-dir scan: %#v", got)
	}
}