onpath 0.2.0

// Windows-specific PATH management via the registry.
// This module is only compiled on Windows (gated by #[cfg(windows)] in lib.rs).

use std::path::Path;
use std::ptr;

use windows_sys::Win32::Foundation::{CloseHandle, HANDLE, LPARAM, WAIT_OBJECT_0};
use windows_sys::Win32::System::Threading::{CreateMutexW, ReleaseMutex, WaitForSingleObject};
use windows_sys::Win32::UI::WindowsAndMessaging::{
    SendMessageTimeoutA, HWND_BROADCAST, SMTO_ABORTIFHUNG, WM_SETTINGCHANGE,
};
use winreg::enums::{RegType, HKEY_CURRENT_USER, KEY_READ, KEY_WRITE};
use winreg::{RegKey, RegValue};

use crate::config::Position;
use crate::error::{RegistryError, Result};
use crate::report::Action;

/// Timeout in milliseconds for acquiring the registry lock.
const LOCK_TIMEOUT_MS: u32 = 10_000;

/// RAII guard for a cross-process named mutex that serializes registry
/// read-modify-write operations on `HKCU\Environment\PATH`.
struct RegistryLock {
    handle: HANDLE,
}

impl RegistryLock {
    /// Acquire the named mutex, blocking up to [`LOCK_TIMEOUT_MS`].
    #[allow(unsafe_code)]
    fn acquire() -> Result<Self> {
        // "Local\" prefix scopes the mutex to the current session.
        let name: Vec<u16> = "Local\\onpath-registry-lock\0".encode_utf16().collect();

        // SAFETY: CreateMutexW is a standard Windows API. We pass a valid
        // null-terminated UTF-16 string and no security attributes.
        let handle = unsafe { CreateMutexW(ptr::null(), 0, name.as_ptr()) };
        if handle.is_null() {
            return Err(RegistryError::LockFailed(std::io::Error::last_os_error()).into());
        }

        // SAFETY: handle is a valid mutex returned by CreateMutexW.
        let wait_result = unsafe { WaitForSingleObject(handle, LOCK_TIMEOUT_MS) };
        if wait_result != WAIT_OBJECT_0 {
            // Clean up the handle before returning an error.
            unsafe { CloseHandle(handle) };
            if wait_result == windows_sys::Win32::Foundation::WAIT_TIMEOUT {
                return Err(RegistryError::LockTimeout.into());
            }
            return Err(RegistryError::LockFailed(std::io::Error::last_os_error()).into());
        }

        Ok(Self { handle })
    }
}

impl Drop for RegistryLock {
    #[allow(unsafe_code)]
    fn drop(&mut self) {
        // SAFETY: handle is a valid mutex we successfully acquired.
        unsafe {
            ReleaseMutex(self.handle);
            CloseHandle(self.handle);
        }
    }
}

/// Add a directory to the Windows user PATH via the registry.
///
/// Acquires a cross-process named mutex to prevent concurrent modifications.
///
/// # Errors
///
/// Returns [`RegistryError`] if the registry cannot be read or written,
/// or if the cross-process lock cannot be acquired.
pub fn add_to_path(dir: &Path, position: Position) -> Result<Action> {
    let _lock = RegistryLock::acquire()?;
    let (current, vtype) = read_user_path()?;
    let dir_str = dir.to_string_lossy();
    let dir_normalized = crate::normalize::normalize_windows_path_str(&dir_str);

    // Case-insensitive duplicate check with path normalization
    // (trailing slashes, forward/backslashes, `.`/`..` are resolved before comparing)
    if current.split(';').any(|entry| {
        crate::normalize::normalize_windows_path_str(entry).eq_ignore_ascii_case(&dir_normalized)
    }) {
        return Ok(Action::RegistryAlreadyContains);
    }

    let new_path = match position {
        Position::Prepend => {
            if current.is_empty() {
                dir_str.to_string()
            } else {
                format!("{dir_str};{current}")
            }
        }
        Position::Append => {
            if current.is_empty() {
                dir_str.to_string()
            } else {
                format!("{current};{dir_str}")
            }
        }
    };

    write_user_path(&new_path, vtype)?;
    broadcast_settings_change();

    Ok(Action::RegistryModified {
        old_value: current,
        new_value: new_path,
    })
}

/// Remove a directory from the Windows user PATH via the registry.
///
/// Acquires a cross-process named mutex to prevent concurrent modifications.
///
/// # Errors
///
/// Returns [`RegistryError`] if the registry cannot be read or written,
/// or if the cross-process lock cannot be acquired.
pub fn remove_from_path(dir: &Path) -> Result<Action> {
    let _lock = RegistryLock::acquire()?;
    let (current, vtype) = read_user_path()?;
    let dir_str = dir.to_string_lossy();
    let dir_normalized = crate::normalize::normalize_windows_path_str(&dir_str);

    let entries: Vec<&str> = current.split(';').collect();
    let filtered: Vec<&str> = entries
        .iter()
        .filter(|entry| {
            !crate::normalize::normalize_windows_path_str(entry)
                .eq_ignore_ascii_case(&dir_normalized)
        })
        .copied()
        .collect();

    if entries.len() == filtered.len() {
        // Not found — nothing to remove
        return Ok(Action::RegistryAlreadyContains);
    }

    let new_path = filtered.join(";");
    write_user_path(&new_path, vtype)?;
    broadcast_settings_change();

    Ok(Action::RegistryEntryRemoved {
        old_value: current,
        new_value: new_path,
    })
}

/// Read the raw PATH value and its registry type, preserving %VARIABLES%.
fn read_user_path() -> Result<(String, RegType)> {
    let hkcu = RegKey::predef(HKEY_CURRENT_USER);
    let env = hkcu
        .open_subkey_with_flags("Environment", KEY_READ)
        .map_err(RegistryError::OpenKey)?;

    // Use get_raw_value to guarantee we never expand %VARIABLES% like
    // %USERPROFILE% or %SystemRoot%. This preserves the registry value
    // byte-for-byte regardless of winreg version or Windows configuration.
    match env.get_raw_value("PATH") {
        Ok(raw) => {
            let vtype = raw.vtype;
            let utf16: Vec<u16> = raw
                .bytes
                .chunks_exact(2)
                .map(|c| u16::from_le_bytes([c[0], c[1]]))
                .collect();
            let value = String::from_utf16_lossy(&utf16)
                .trim_end_matches('\0')
                .to_owned();
            Ok((value, vtype))
        }
        Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
            Ok((String::new(), RegType::REG_EXPAND_SZ))
        }
        Err(e) => Err(RegistryError::ReadPath(e).into()),
    }
}

/// Write PATH back to the registry, preserving the original registry type.
fn write_user_path(value: &str, vtype: RegType) -> Result<()> {
    let hkcu = RegKey::predef(HKEY_CURRENT_USER);
    let (env, _) = hkcu
        .create_subkey_with_flags("Environment", KEY_WRITE)
        .map_err(RegistryError::OpenKey)?;

    let reg_value = RegValue {
        vtype,
        bytes: value
            .encode_utf16()
            .chain(std::iter::once(0))
            .flat_map(u16::to_le_bytes)
            .collect(),
    };

    env.set_raw_value("PATH", &reg_value)
        .map_err(RegistryError::WritePath)?;

    Ok(())
}

/// Broadcast `WM_SETTINGCHANGE` to notify other processes of the PATH change.
#[allow(unsafe_code)]
fn broadcast_settings_change() {
    // SAFETY: This is the standard Windows API call to notify running applications
    // that environment variables have changed. The string "Environment" is a
    // well-known constant. HWND_BROADCAST sends to all top-level windows.
    unsafe {
        SendMessageTimeoutA(
            HWND_BROADCAST,
            WM_SETTINGCHANGE,
            0,
            b"Environment\0".as_ptr() as LPARAM,
            SMTO_ABORTIFHUNG,
            5000,
            ptr::null_mut(),
        );
    }
}

#[cfg(test)]
mod tests {
    // Windows registry tests require a real Windows environment.
    // For safety, we do NOT test with the real HKCU\Environment\PATH.
    // Unit tests focus on the string manipulation logic.

    #[test]
    fn path_split_and_case_insensitive_check() {
        let current = r"C:\Windows\system32;C:\Users\test\.myapp\bin";
        let dir = r"c:\users\test\.myapp\bin"; // different case

        let found = current
            .split(';')
            .any(|entry| entry.eq_ignore_ascii_case(dir));
        assert!(found);
    }

    #[test]
    fn path_prepend_format() {
        let current = r"C:\Windows\system32";
        let dir = r"C:\Users\test\bin";
        let new_path = format!("{dir};{current}");
        assert_eq!(new_path, r"C:\Users\test\bin;C:\Windows\system32");
    }

    #[test]
    fn path_filter_removes_entry() {
        let current = r"C:\a;C:\b;C:\c";
        let filtered: Vec<&str> = current
            .split(';')
            .filter(|e| !e.eq_ignore_ascii_case(r"C:\b"))
            .collect();
        assert_eq!(filtered.join(";"), r"C:\a;C:\c");
    }

    #[test]
    fn path_with_trailing_semicolons() {
        let current = r"C:\a;C:\b;";
        let entries: Vec<&str> = current.split(';').collect();
        // Trailing semicolon creates an empty entry
        assert_eq!(entries, vec![r"C:\a", r"C:\b", ""]);

        // Filter should preserve empty entries when removing a different one
        let filtered: Vec<&str> = entries
            .iter()
            .filter(|e| !e.eq_ignore_ascii_case(r"C:\a"))
            .copied()
            .collect();
        assert_eq!(filtered.join(";"), r"C:\b;");
    }

    #[test]
    fn path_with_empty_segments() {
        let current = r"C:\a;;C:\b";
        let entries: Vec<&str> = current.split(';').collect();
        assert_eq!(entries, vec![r"C:\a", "", r"C:\b"]);

        // Filter preserves empty segments
        let filtered: Vec<&str> = entries
            .iter()
            .filter(|e| !e.eq_ignore_ascii_case(r"C:\a"))
            .copied()
            .collect();
        assert_eq!(filtered.join(";"), r";C:\b");
    }

    #[test]
    fn path_entry_with_spaces() {
        let current = r"C:\Program Files\bin;C:\a";
        let dir = r"C:\Program Files\bin";
        let found = current
            .split(';')
            .any(|entry| entry.eq_ignore_ascii_case(dir));
        assert!(found);
    }

    #[test]
    fn path_with_trailing_backslash_now_matches() {
        // With path normalization, `C:\foo\` and `C:\foo` now match.
        let current = r"C:\foo\";
        let dir = r"C:\foo";
        let norm_current = crate::normalize::normalize_windows_path_str(current);
        let norm_dir = crate::normalize::normalize_windows_path_str(dir);
        assert_eq!(
            norm_current, norm_dir,
            "trailing backslash should normalize away"
        );
    }

    #[test]
    fn path_with_forward_slashes_now_matches() {
        // With path normalization, `C:/foo` and `C:\foo` now match.
        let current = r"C:\foo";
        let dir = "C:/foo";
        let norm_current = crate::normalize::normalize_windows_path_str(current);
        let norm_dir = crate::normalize::normalize_windows_path_str(dir);
        assert_eq!(
            norm_current, norm_dir,
            "forward vs backslash should normalize to same"
        );
    }

    #[test]
    fn path_dedup_exact_match() {
        let current = r"C:\a;C:\b;C:\c";
        let dir = r"C:\b";
        let found = current
            .split(';')
            .any(|entry| entry.eq_ignore_ascii_case(dir));
        assert!(found);
    }

    #[test]
    fn path_dedup_case_only_differs() {
        let current = r"C:\Users\Test\.myapp\bin";
        let dir = r"c:\users\test\.myapp\bin";
        let found = current
            .split(';')
            .any(|entry| entry.eq_ignore_ascii_case(dir));
        assert!(found);
    }

    #[test]
    fn path_no_substring_match() {
        // `C:\foo` must NOT match `C:\foobar` — we split on `;` so this is exact.
        let current = r"C:\foobar;C:\baz";
        let dir = r"C:\foo";
        let found = current
            .split(';')
            .any(|entry| entry.eq_ignore_ascii_case(dir));
        assert!(!found);
    }

    #[test]
    fn path_single_entry_add_and_remove() {
        // Add to a single-entry PATH
        let current = r"C:\existing";
        let dir = r"C:\new";
        let new_path = format!("{dir};{current}");
        assert_eq!(new_path, r"C:\new;C:\existing");

        // Remove from a two-entry PATH, leaving one
        let filtered: Vec<&str> = new_path
            .split(';')
            .filter(|e| !e.eq_ignore_ascii_case(dir))
            .collect();
        assert_eq!(filtered.join(";"), r"C:\existing");
    }

    #[test]
    fn path_empty_string_entries_not_matched() {
        // `;;` creates empty entries — they should not match a real directory
        let current = r"C:\a;;C:\b";
        // Empty string matches empty segments, but no real caller passes ""
        let entries: Vec<&str> = current.split(';').collect();
        assert_eq!(entries, vec![r"C:\a", "", r"C:\b"]);

        // A non-empty dir should not match empty segments
        let dir2 = r"C:\nonexistent";
        let found = current
            .split(';')
            .any(|entry| entry.eq_ignore_ascii_case(dir2));
        assert!(!found);
    }

    #[test]
    fn remove_nonexistent_is_noop() {
        let current = r"C:\a;C:\b;C:\c";
        let dir = r"C:\nonexistent";
        let entries: Vec<&str> = current.split(';').collect();
        let filtered: Vec<&str> = entries
            .iter()
            .filter(|e| !e.eq_ignore_ascii_case(dir))
            .copied()
            .collect();
        assert_eq!(entries.len(), filtered.len());
        assert_eq!(filtered.join(";"), current);
    }
}