lean-ctx-engine 3.12.3

use std::path::{Path, PathBuf};

use crate::core::{events, pathjail, roles};

/// Reads a file without following symlinks (TOCTOU protection).
/// Falls back to regular read on non-Unix platforms.
#[cfg(unix)]
pub fn read_file_nofollow(path: &str) -> Result<String, std::io::Error> {
    use std::os::unix::fs::OpenOptionsExt;
    let file = std::fs::OpenOptions::new()
        .read(true)
        .custom_flags(libc::O_NOFOLLOW)
        .open(path);
    match file {
        Ok(mut f) => {
            use std::io::Read;
            let mut buf = Vec::new();
            f.read_to_end(&mut buf)?;
            Ok(crate::core::text_decode::decode(buf))
        }
        Err(e) if e.raw_os_error() == Some(libc::ELOOP) => Err(std::io::Error::other(format!(
            "Symlink detected at {path} — refusing to follow (TOCTOU protection)"
        ))),
        Err(e) => Err(e),
    }
}

/// Windows parity (GL#442): no O_NOFOLLOW exists, so lstat first and refuse
/// symlinks *and* NTFS junctions/reparse points before opening. Small TOCTOU
/// window remains between the check and the open (documented in SECURITY.md).
#[cfg(not(unix))]
pub fn read_file_nofollow(path: &str) -> Result<String, std::io::Error> {
    if let Ok(meta) = std::fs::symlink_metadata(path) {
        if crate::core::pathutil::is_symlink_or_reparse(&meta) {
            return Err(std::io::Error::other(format!(
                "Symlink detected at {path} — refusing to follow (TOCTOU protection)"
            )));
        }
    }
    std::fs::read(path).map(crate::core::text_decode::decode)
}

/// Reads a file as text in any encoding (`text_decode`: UTF-8 with or without
/// BOM, UTF-16 with BOM, Windows-1252), rejecting binary files. The BOM is
/// stripped — leaking it corrupts the first line of every downstream view
/// (limitations doc #11).
/// Uses O_NOFOLLOW on Unix to prevent TOCTOU symlink attacks.
pub fn read_file_lossy(path: &str) -> Result<String, std::io::Error> {
    if crate::core::binary_detect::is_binary_file(path) {
        let msg = crate::core::binary_detect::binary_file_message(path);
        return Err(std::io::Error::other(msg));
    }
    read_file_nofollow(path)
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum BoundaryMode {
    Warn,
    Enforce,
}

impl BoundaryMode {
    fn parse(s: &str) -> Self {
        match s.trim().to_lowercase().as_str() {
            "enforce" | "strict" => Self::Enforce,
            _ => Self::Warn,
        }
    }
}

pub fn boundary_mode_effective(role: &roles::Role) -> BoundaryMode {
    if let Ok(v) = std::env::var("LEAN_CTX_IO_BOUNDARY_MODE")
        && !v.trim().is_empty()
    {
        return BoundaryMode::parse(&v);
    }
    BoundaryMode::parse(&role.io.boundary_mode)
}

pub fn is_secret_like(path: &Path) -> Option<&'static str> {
    let file = path.file_name().and_then(|s| s.to_str()).unwrap_or("");
    let lower = file.to_lowercase();

    // Directory-level sensitive roots
    for comp in path.components() {
        if let std::path::Component::Normal(s) = comp {
            let c = s.to_string_lossy().to_lowercase();
            if c == ".ssh" {
                return Some(".ssh directory");
            }
            if c == ".aws" {
                return Some(".aws directory");
            }
            if c == ".gnupg" {
                return Some(".gnupg directory");
            }
        }
    }

    // Common secret-like files (deny-by-default unless explicitly allowed).
    if lower == ".env" {
        return Some(".env file");
    }
    if lower.starts_with(".env.") {
        let allow_suffixes = [".example", ".sample", ".template", ".dist", ".defaults"];
        if allow_suffixes.iter().any(|s| lower.ends_with(s)) {
            return None;
        }
        return Some(".env.* file");
    }

    if matches!(
        lower.as_str(),
        "id_rsa"
            | "id_ed25519"
            | "id_ecdsa"
            | "id_dsa"
            | "authorized_keys"
            | "known_hosts"
            | ".npmrc"
            | ".netrc"
            | ".pypirc"
            | ".dockerconfigjson"
            | "credentials.json"
            | "secrets.json"
            | "secrets.yaml"
            | "secrets.yml"
            | "keystore.jks"
            | "truststore.jks"
            | ".htpasswd"
            | "shadow"
            | "master.key"
    ) {
        return Some("credential file");
    }

    if lower.starts_with("service-account") {
        let p = std::path::Path::new(&lower);
        if p.extension()
            .is_some_and(|ext| ext.eq_ignore_ascii_case("json") || ext.eq_ignore_ascii_case("key"))
        {
            return Some("service account key");
        }
    }

    let ext = path.extension().and_then(|e| e.to_str()).unwrap_or("");
    let secret_exts = ["pem", "key", "p12", "pfx", "kdbx"];
    if secret_exts.iter().any(|e| ext.eq_ignore_ascii_case(e)) {
        return Some("secret key material");
    }

    // AWS credentials file (often inside .aws/)
    if lower == "credentials" && path.to_string_lossy().to_lowercase().contains("/.aws/") {
        return Some("aws credentials");
    }

    None
}

/// The project whose Hive I/O rules apply when the caller names none: the
/// request's bound project, else the configured or detected project of the
/// working directory ([`crate::core::protocol::detect_project_root_or_cwd`]).
fn current_project() -> PathBuf {
    if let Some(project) = crate::core::policy::diagnostics::request_project() {
        return project;
    }
    let cwd = std::env::current_dir().unwrap_or_else(|_| PathBuf::from("."));
    PathBuf::from(crate::core::protocol::detect_project_root_or_cwd(
        &cwd.to_string_lossy(),
    ))
}

/// The Hive I/O rules (`security.readable_roots`, `security.never_send`) in
/// force for `project` (default: `current_project`). `Err` when the
/// installed Hive policy cannot be applied: callers fail closed.
pub fn hive_io_rules(
    project: Option<&Path>,
) -> Result<Option<crate::core::policy::hive_io::IoRules>, String> {
    let project = project.map_or_else(current_project, Path::to_path_buf);
    crate::core::policy::hive_io::rules_for(&project)
}

/// Refuse reading `path` when the Hive policy keeps it out of context: outside
/// the readable roots, matching `never_send`, or (fail closed) the installed
/// policy cannot be applied. Always enforced: neither the role nor the warn
/// boundary mode loosens a Hive rule.
pub fn check_hive_io_for_tool(
    tool: &str,
    path: &Path,
    project: Option<&Path>,
) -> Result<(), String> {
    let refusal = match hive_io_rules(project) {
        Ok(None) => return Ok(()),
        Ok(Some(rules)) => match rules.refusal(path) {
            None => return Ok(()),
            Some(refusal) => format!(
                "[I/O BOUNDARY] {} is {}.",
                path.display(),
                refusal.describe()
            ),
        },
        Err(e) => format!(
            "[I/O BOUNDARY] {} refused: {e}; reads stay refused until a valid Hive policy is installed.",
            path.display()
        ),
    };
    events::emit_policy_violation(&roles::active_role_name(), tool, &refusal);
    Err(format!("ERROR: {refusal}"))
}

/// The Hive I/O rules ([`check_hive_io_for_tool`]) and then the role's
/// secret-path rule, for a path read in the current project.
pub fn check_secret_path_for_tool(tool: &str, path: &Path) -> Result<Option<String>, String> {
    check_hive_io_for_tool(tool, path, None)?;
    secret_path_rule(tool, path)
}

fn secret_path_rule(tool: &str, path: &Path) -> Result<Option<String>, String> {
    let role_name = roles::active_role_name();
    let role = roles::active_role();
    let mode = boundary_mode_effective(&role);

    let Some(reason) = is_secret_like(path) else {
        return Ok(None);
    };

    if role.io.allow_secret_paths {
        return Ok(None);
    }

    let msg = format!(
        "[I/O BOUNDARY] Secret-like path detected ({reason}): {}.\n\
Role: {role_name}. To allow: switch role to 'admin' or set io.allow_secret_paths=true in the active role.",
        path.display()
    );
    events::emit_policy_violation(&role_name, tool, &msg);
    // K12: the secret-path rule refused (enforce) or would have (warn).
    crate::core::hive_signals::refused(
        &crate::core::hive_signals::secrets_rule(),
        matches!(mode, BoundaryMode::Enforce),
    );

    match mode {
        BoundaryMode::Enforce => Err(format!("ERROR: {msg}")),
        BoundaryMode::Warn => {
            if crate::core::protocol::meta_visible() {
                Ok(Some(format!("[BOUNDARY WARNING] {msg}")))
            } else {
                Ok(None)
            }
        }
    }
}

pub fn jail_and_check_path(
    tool: &str,
    candidate: &Path,
    jail_root: &Path,
) -> Result<(PathBuf, Option<String>), String> {
    let (jailed, warning) = jail_and_check_with(tool, candidate, jail_root, pathjail::jail_path)?;
    check_hive_io_for_tool(tool, &jailed, Some(jail_root))?;
    Ok((jailed, warning))
}

/// [`jail_and_check_path`] for a destination that stays contained when the
/// jail is compiled out (`no-jail`) or disabled (`path_jail = false`); see
/// [`pathjail::jail_path_enforced`].
pub fn jail_and_check_export_path(
    tool: &str,
    candidate: &Path,
    jail_root: &Path,
) -> Result<(PathBuf, Option<String>), String> {
    jail_and_check_with(tool, candidate, jail_root, pathjail::jail_path_enforced)
}

fn jail_and_check_with(
    tool: &str,
    candidate: &Path,
    jail_root: &Path,
    jail: fn(&Path, &Path) -> Result<PathBuf, crate::core::error::PathJailError>,
) -> Result<(PathBuf, Option<String>), String> {
    let role_name = roles::active_role_name();
    let jailed = jail(candidate, jail_root).map_err(|e| {
        // Only a real jail escape is a security event. A path that simply doesn't exist
        // (stale graph entry, removed file) is benign — emitting a policy violation for it
        // spams the event feed and mislabels missing files as denials.
        if !matches!(
            e,
            crate::core::error::PathJailError::NoExistingAncestor { .. }
        ) {
            let msg = format!("pathjail denied: {} ({e})", candidate.display());
            events::emit_policy_violation(&role_name, tool, &msg);
        }
        e.to_string()
    })?;
    let warning = secret_path_rule(tool, &jailed)?;
    Ok((jailed, warning))
}

pub fn ensure_ignore_gitignore_allowed(tool: &str) -> Result<(), String> {
    let role_name = roles::active_role_name();
    let role = roles::active_role();
    if role.io.allow_ignore_gitignore {
        return Ok(());
    }
    let msg = format!(
        "[I/O BOUNDARY] ignore_gitignore requires explicit policy.\n\
Role '{role_name}' does not allow scanning .gitignore'd paths. \
An agent cannot escalate to a privileged role at runtime, so configure this where lean-ctx starts:\n\
- set LEAN_CTX_ROLE=admin, or\n\
- add `io.allow_ignore_gitignore = true` to a role file (~/.lean-ctx/roles/<name>.toml), then select it via LEAN_CTX_ROLE.\n\
Docs: https://leanctx.com/docs/security/#ignore-gitignore"
    );
    events::emit_policy_violation(&role_name, tool, &msg);
    Err(format!("ERROR: {msg}"))
}

#[cfg(test)]
pub mod tests {
    use super::*;

    #[cfg(unix)]
    #[test]
    fn nofollow_rejects_symlink() {
        let dir = tempfile::tempdir().unwrap();
        let real = dir.path().join("real.txt");
        std::fs::write(&real, "secret").unwrap();
        let link = dir.path().join("link.txt");
        std::os::unix::fs::symlink(&real, &link).unwrap();
        let result = read_file_nofollow(&link.to_string_lossy());
        assert!(result.is_err());
    }

    #[test]
    fn nofollow_reads_regular_file() {
        let dir = tempfile::tempdir().unwrap();
        let file = dir.path().join("regular.txt");
        std::fs::write(&file, "hello").unwrap();
        let content = read_file_nofollow(&file.to_string_lossy()).unwrap();
        assert_eq!(content, "hello");
    }

    #[test]
    fn env_is_secret_like() {
        assert_eq!(is_secret_like(Path::new(".env")), Some(".env file"));
        assert_eq!(is_secret_like(Path::new(".env.local")), Some(".env.* file"));
        assert_eq!(is_secret_like(Path::new(".env.example")), None);
    }

    #[test]
    fn key_is_secret_like() {
        assert_eq!(
            is_secret_like(Path::new("key.pem")),
            Some("secret key material")
        );
        assert_eq!(
            is_secret_like(Path::new("cert.KEY")),
            Some("secret key material")
        );
    }

    #[test]
    fn credentials_json_is_secret_like() {
        assert_eq!(
            is_secret_like(Path::new("credentials.json")),
            Some("credential file")
        );
        assert_eq!(
            is_secret_like(Path::new("secrets.yaml")),
            Some("credential file")
        );
    }

    #[test]
    fn service_account_is_secret_like() {
        assert_eq!(
            is_secret_like(Path::new("service-account.json")),
            Some("service account key")
        );
        assert_eq!(
            is_secret_like(Path::new("service-account-prod.key")),
            Some("service account key")
        );
    }

    #[test]
    fn htpasswd_and_shadow_are_secret_like() {
        assert_eq!(
            is_secret_like(Path::new(".htpasswd")),
            Some("credential file")
        );
        assert_eq!(is_secret_like(Path::new("shadow")), Some("credential file"));
    }

    // The CLI full-read path (`cli_cache::check_and_read`) reads through THIS
    // `read_file_lossy`, not the ctx_read one — both must strip the UTF-8 BOM
    // or the CLI leaks it while the MCP path doesn't (limitations doc #11).
    #[test]
    fn read_file_lossy_strips_utf8_bom() {
        let p = std::env::temp_dir().join("lean_ctx_io_bom_test.txt");
        std::fs::write(&p, b"\xEF\xBB\xBFhello\n").unwrap();
        let s = read_file_lossy(p.to_str().unwrap()).unwrap();
        let _ = std::fs::remove_file(&p);
        assert!(!s.starts_with('\u{feff}'), "BOM must be stripped");
        assert!(s.starts_with("hello"));
    }
}