fs_mac/

resource_fork.rs

//! Resource fork serialization for HFS/HFS+ file extraction.
//!
//! Supports AppleDouble (._prefix sidecar), MacBinary III (.bin wrapper),
//! and separate .rsrc sidecar files.

use byteorder::{BigEndian, ByteOrder};

/// How to handle resource forks during extraction.
#[derive(Debug, Clone, Copy, PartialEq)]
pub enum ResourceForkMode {
    /// Write resource fork directly to the file's native resource fork
    /// (macOS only — uses `filename/..namedfork/rsrc`).
    Native,
    /// AppleDouble format: ._prefix sidecar files
    AppleDouble,
    /// MacBinary III: single .bin file containing both forks
    MacBinary,
    /// BinHex 4.0: single .hqx text file containing both forks + Finder info
    BinHex,
    /// Separate .rsrc sidecar files
    SeparateRsrc,
    /// Skip resource forks entirely
    DataForkOnly,
}

impl ResourceForkMode {
    pub fn label(&self) -> &'static str {
        match self {
            ResourceForkMode::Native => "Native resource fork",
            ResourceForkMode::AppleDouble => "AppleDouble (._file)",
            ResourceForkMode::MacBinary => "MacBinary III (.bin)",
            ResourceForkMode::BinHex => "BinHex 4.0 (.hqx)",
            ResourceForkMode::SeparateRsrc => "Separate (.rsrc)",
            ResourceForkMode::DataForkOnly => "Data fork only",
        }
    }

    pub const ALL: [ResourceForkMode; 6] = [
        ResourceForkMode::Native,
        ResourceForkMode::AppleDouble,
        ResourceForkMode::MacBinary,
        ResourceForkMode::BinHex,
        ResourceForkMode::SeparateRsrc,
        ResourceForkMode::DataForkOnly,
    ];
}

/// Mac file dates as raw seconds since the classic Mac epoch (1904-01-01) —
/// the exact encoding MacBinary stores in its header and HFS/HFS+ record on
/// disk. A field of `0` means "unknown": MacBinary writes a zero date and
/// AppleDouble omits the File Dates Info entry, so callers with no dates get
/// byte-identical output to the pre-dates behavior.
#[derive(Debug, Clone, Copy, Default)]
pub struct MacFileDates {
    /// Creation time, seconds since 1904-01-01.
    pub created: u32,
    /// Modification time, seconds since 1904-01-01.
    pub modified: u32,
}

/// Seconds between the classic Mac epoch (1904-01-01) and the Unix epoch.
const MAC_EPOCH_UNIX_OFFSET: i64 = 2_082_844_800;
/// Unix seconds at the AppleDouble "File Dates Info" epoch (2000-01-01 GMT).
const APPLEDOUBLE_EPOCH_UNIX: i64 = 946_684_800;
/// Apple's "unknown date" sentinel for AppleSingle/AppleDouble date fields.
const APPLEDOUBLE_DATE_UNKNOWN: i32 = i32::MIN;

/// Convert a Mac-epoch (1904) second count to the AppleDouble "File Dates Info"
/// encoding: signed seconds relative to 2000-01-01 GMT. `0` (unknown) maps to
/// Apple's `0x80000000` sentinel; out-of-range values clamp into `i32`.
fn mac1904_to_appledouble(mac_secs: u32) -> i32 {
    if mac_secs == 0 {
        return APPLEDOUBLE_DATE_UNKNOWN;
    }
    let secs_2000 = mac_secs as i64 - MAC_EPOCH_UNIX_OFFSET - APPLEDOUBLE_EPOCH_UNIX;
    // Keep off i32::MIN so a real date can't collide with the "unknown" sentinel.
    secs_2000.clamp(i32::MIN as i64 + 1, i32::MAX as i64) as i32
}

/// Build an AppleDouble (version 2) sidecar file.
///
/// Contains Finder info (type/creator codes), file dates (when known), and
/// resource fork data.
/// Format: magic(4) + version(4) + filler(16) + num_entries(2) + entries...
pub fn build_appledouble(
    type_code: &[u8; 4],
    creator_code: &[u8; 4],
    dates: MacFileDates,
    rsrc_data: &[u8],
) -> Vec<u8> {
    // Entries, in on-disk order: Finder Info (id 9, 32B), then — only when we
    // have real dates — File Dates Info (id 8, 16B), then Resource Fork
    // (id 2, variable). Omitting the dates entry when unknown keeps the output
    // byte-identical to the pre-dates two-entry layout.
    let has_dates = dates.created != 0 || dates.modified != 0;
    let num_entries: u16 = if has_dates { 3 } else { 2 };
    let header_len = 26 + num_entries as usize * 12; // 26-byte header + descriptors

    let finder_offset = header_len as u32;
    let finder_len: u32 = 32;
    let dates_offset = finder_offset + finder_len; // meaningful only when has_dates
    let dates_len: u32 = 16;
    let rsrc_offset = if has_dates {
        dates_offset + dates_len
    } else {
        finder_offset + finder_len
    };
    let rsrc_len: u32 = rsrc_data.len() as u32;

    let total = rsrc_offset as usize + rsrc_data.len();
    let mut buf = vec![0u8; total];

    // Magic number
    BigEndian::write_u32(&mut buf[0..4], APPLEDOUBLE_MAGIC);
    // Version 2
    BigEndian::write_u32(&mut buf[4..8], 0x00020000);
    // Filler: 16 bytes of zeros (already zero)
    // Number of entries
    BigEndian::write_u16(&mut buf[24..26], num_entries);

    // Entry descriptors: 12 bytes each (id, offset, length), starting at 26.
    let mut d = 26;
    let mut write_desc = |buf: &mut [u8], id: u32, off: u32, len: u32| {
        BigEndian::write_u32(&mut buf[d..d + 4], id);
        BigEndian::write_u32(&mut buf[d + 4..d + 8], off);
        BigEndian::write_u32(&mut buf[d + 8..d + 12], len);
        d += 12;
    };
    write_desc(&mut buf, 9, finder_offset, finder_len); // Finder Info
    if has_dates {
        write_desc(&mut buf, 8, dates_offset, dates_len); // File Dates Info
    }
    write_desc(&mut buf, 2, rsrc_offset, rsrc_len); // Resource Fork

    // Finder Info data (32 bytes): fdType(4) + fdCreator(4) + fdFlags(2) + fdLocation(4) + fdFldr(2) + extended(16)
    let fi_start = finder_offset as usize;
    buf[fi_start..fi_start + 4].copy_from_slice(type_code);
    buf[fi_start + 4..fi_start + 8].copy_from_slice(creator_code);
    // Rest is zeros

    // File Dates Info (16 bytes): create/modify/backup/access, signed seconds
    // relative to 2000-01-01 GMT. We only know create/modify; the rest are the
    // "unknown" sentinel.
    if has_dates {
        let di = dates_offset as usize;
        BigEndian::write_i32(&mut buf[di..di + 4], mac1904_to_appledouble(dates.created));
        BigEndian::write_i32(
            &mut buf[di + 4..di + 8],
            mac1904_to_appledouble(dates.modified),
        );
        BigEndian::write_i32(&mut buf[di + 8..di + 12], APPLEDOUBLE_DATE_UNKNOWN);
        BigEndian::write_i32(&mut buf[di + 12..di + 16], APPLEDOUBLE_DATE_UNKNOWN);
    }

    // Resource fork data
    buf[rsrc_offset as usize..].copy_from_slice(rsrc_data);

    buf
}

/// Build a MacBinary III file containing both data and resource forks.
///
/// Format: 128-byte header + data fork (padded to 128) + resource fork (padded to 128).
/// The .bin file replaces the separate data fork file.
pub fn build_macbinary(
    filename: &str,
    type_code: &[u8; 4],
    creator_code: &[u8; 4],
    dates: MacFileDates,
    data_fork: &[u8],
    rsrc_data: &[u8],
) -> Vec<u8> {
    let data_padded = pad_to_128(data_fork.len());
    let rsrc_padded = pad_to_128(rsrc_data.len());
    let total = 128 + data_padded + rsrc_padded;
    let mut buf = vec![0u8; total];

    // Header byte 0: always 0
    // Header byte 1: filename length (max 63)
    let name_bytes = mac_name_bytes(filename);
    let name_len = name_bytes.len();
    buf[1] = name_len as u8;
    buf[2..2 + name_len].copy_from_slice(&name_bytes);

    // Type code at 65-68, creator at 69-72
    buf[65..69].copy_from_slice(type_code);
    buf[69..73].copy_from_slice(creator_code);

    // Data fork length at 83-86 (big-endian)
    BigEndian::write_u32(&mut buf[83..87], data_fork.len() as u32);
    // Resource fork length at 87-90
    BigEndian::write_u32(&mut buf[87..91], rsrc_data.len() as u32);

    // Creation date at 91-94, modification date at 95-98: u32 secs since 1904,
    // exactly what HFS/HFS+ record — so the raw on-disc timestamps drop in with
    // no conversion. Both stay zero ("unknown") when `dates` is defaulted. These
    // sit inside the CRC'd header region, so they must be written before the CRC.
    BigEndian::write_u32(&mut buf[91..95], dates.created);
    BigEndian::write_u32(&mut buf[95..99], dates.modified);

    // MacBinary version: byte 122 = 130 (MacBinary III)
    buf[122] = 130;
    // Minimum version: byte 123 = 129 (MacBinary II)
    buf[123] = 129;

    // CRC-16 of header bytes 0-123 at bytes 124-125
    let crc = macbinary_crc16(&buf[0..124]);
    BigEndian::write_u16(&mut buf[124..126], crc);

    // Data fork
    buf[128..128 + data_fork.len()].copy_from_slice(data_fork);
    // Resource fork
    let rsrc_start = 128 + data_padded;
    buf[rsrc_start..rsrc_start + rsrc_data.len()].copy_from_slice(rsrc_data);

    buf
}

/// Sanitize a filename for the host OS via the shared legalizer (Windows rules on Windows).
pub fn sanitize_filename(name: &str) -> String {
    let check = disk_core::name_legalize::validate_host_name;
    disk_core::name_legalize::legalize_name(&check, name).unwrap_or_else(|_| "_".to_string())
}

/// Round up to the next multiple of 128.
fn pad_to_128(len: usize) -> usize {
    (len + 127) & !127
}

/// CRC-16 used by MacBinary (CRC-16/XMODEM: CCITT polynomial 0x1021, init 0,
/// no reflection, no final XOR). Computed over header bytes 0..124. Shared
/// with `macarchive::macbinary`, the canonical full-fidelity parser.
pub fn macbinary_crc16(data: &[u8]) -> u16 {
    let mut crc: u16 = 0;
    for &byte in data {
        crc ^= (byte as u16) << 8;
        for _ in 0..8 {
            if crc & 0x8000 != 0 {
                crc = (crc << 1) ^ 0x1021;
            } else {
                crc <<= 1;
            }
        }
    }
    crc
}

pub use disk_core::filesystem::ImportedResourceFork;

/// Detect and read a resource fork associated with `host_path` by probing
/// all supported formats in priority order:
///
/// 1. **Native** (macOS only): `host_path/..namedfork/rsrc`
/// 2. **AppleDouble**: `._<filename>` sidecar next to the file
/// 3. **MacBinary**: the file itself is a `.bin` MacBinary container
/// 4. **AppleSingle**: the file itself is an AppleSingle container
/// 5. **BinHex**: the file itself is a `.hqx` container
/// 6. **Separate .rsrc**: `<filename>.rsrc` sidecar next to the file
///
/// Returns `None` if no resource fork is found.
pub fn detect_resource_fork(host_path: &std::path::Path) -> Option<ImportedResourceFork> {
    // 1. Native macOS resource fork
    #[cfg(target_os = "macos")]
    {
        let rsrc_path = host_path.join("..namedfork/rsrc");
        if let Ok(data) = std::fs::read(&rsrc_path) {
            if !data.is_empty() {
                let (type_code, creator_code) = read_finder_info_xattr(host_path);
                return Some(ImportedResourceFork {
                    data,
                    data_fork: None,
                    type_code,
                    creator_code,
                    name: None,
                    finder_flags: None,
                });
            }
        }
    }

    let file_name = host_path.file_name()?.to_str()?;
    let parent = host_path.parent()?;

    // 2. AppleDouble sidecar
    let ad_path = parent.join(format!("._{file_name}"));
    if ad_path.is_file() {
        if let Ok(ad_data) = std::fs::read(&ad_path) {
            if let Some(parsed) = parse_appledouble(&ad_data) {
                return Some(parsed);
            }
        }
    }

    // 3. MacBinary — check if the file itself is a MacBinary container.
    //
    // Peek the 128-byte header before reading the whole thing. `host_path` is
    // whatever the user named, and that is not always a regular file:
    // `rb-cli inspect /dev/disk0` lands here, where an unguarded read pulls the
    // entire disk into RAM. On a 64-bit host that is "merely" a 238 GiB read;
    // on 32-bit PowerPC the Vec passes `isize::MAX` and the process aborts with
    // "capacity overflow" after minutes of I/O. Even for ordinary files the old
    // form read every byte of a multi-GB image only to reject it — an `inspect`
    // of a 1 GiB image peaked at 1 GiB RSS.
    if is_regular_file(host_path) {
        if let Some(head) = read_header_128(host_path) {
            if macbinary_header_ok(&head) {
                if let Ok(mb_data) = std::fs::read(host_path) {
                    if let Some(parsed) = parse_macbinary(&mb_data) {
                        return Some(parsed);
                    }
                }
            }
        }
    }

    // 3b. AppleSingle: peek only the magic, since a small one is under 128 bytes.
    if is_regular_file(host_path) {
        if let Some(magic) = read_magic(host_path) {
            if magic == APPLESINGLE_MAGIC {
                if let Ok(bytes) = std::fs::read(host_path) {
                    if let Some(parsed) = parse_applesingle(&bytes) {
                        return Some(parsed);
                    }
                }
            }
        }
    }

    // 4. BinHex — the file itself is a `.hqx` container.
    //
    // Same header peek as MacBinary, for the same reason: never read an
    // arbitrary path whole just to classify it.
    if is_regular_file(host_path) {
        if let Some(head) = read_header_128(host_path) {
            if looks_like_binhex(&head) {
                if let Ok(hqx) = std::fs::read(host_path) {
                    if let Some(parsed) = parse_binhex_fork(&hqx) {
                        return Some(parsed);
                    }
                }
            }
        }
    }

    // 5. Separate .rsrc sidecar
    let rsrc_path = parent.join(format!("{file_name}.rsrc"));
    if rsrc_path.is_file() {
        if let Ok(data) = std::fs::read(&rsrc_path) {
            if !data.is_empty() {
                return Some(ImportedResourceFork {
                    data,
                    data_fork: None,
                    type_code: None,
                    creator_code: None,
                    name: None,
                    finder_flags: None,
                });
            }
        }
    }

    None
}

/// Cheap gate for the BinHex banner, which `parse_binhex` searches for anyway.
/// Only the first 128 bytes are inspected, so a header peek decides whether the
/// whole file is worth reading.
fn looks_like_binhex(head: &[u8]) -> bool {
    head.windows(BINHEX_PREFIX.len())
        .any(|w| w == BINHEX_PREFIX)
}

/// The stable part of the BinHex 4.0 banner; the version digits after it vary.
const BINHEX_PREFIX: &[u8] = b"(This file must be converted with BinHex";

/// Decode a BinHex 4.0 (`.hqx`) container into both forks plus Finder info.
///
/// Unlike the sidecar formats this is a whole-file wrapper, so `data_fork` and
/// `name` are both carried and the caller writes those instead of the `.hqx`
/// text. Returns `None` when the document does not decode or carries neither a
/// resource fork nor Finder info, so a plain BinHexed text file still imports
/// as its own contents rather than as an empty-forked stub.
pub fn parse_binhex_fork(data: &[u8]) -> Option<ImportedResourceFork> {
    let bh = crate::binhex::parse_binhex(data).ok()?;
    let type_code = (bh.type_code != [0; 4]).then_some(bh.type_code);
    let creator_code = (bh.creator_code != [0; 4]).then_some(bh.creator_code);
    if bh.resource_fork.is_empty() && type_code.is_none() && creator_code.is_none() {
        return None;
    }
    Some(ImportedResourceFork {
        data: bh.resource_fork,
        data_fork: Some(bh.data_fork),
        type_code,
        creator_code,
        name: (!bh.name.is_empty()).then_some(bh.name),
        finder_flags: Some(bh.flags),
    })
}

/// Check if a host file is a resource fork sidecar that should be skipped
/// during import (because it will be consumed as part of its primary file).
pub fn is_resource_fork_sidecar(host_path: &std::path::Path) -> bool {
    let file_name = match host_path.file_name().and_then(|n| n.to_str()) {
        Some(n) => n,
        None => return false,
    };
    let parent = match host_path.parent() {
        Some(p) => p,
        None => return false,
    };

    // AppleDouble sidecar: ._<name> where <name> exists as a regular file
    if let Some(primary) = file_name.strip_prefix("._") {
        if parent.join(primary).is_file() {
            return true;
        }
    }

    // Separate .rsrc sidecar: <name>.rsrc where <name> exists as a regular file
    if let Some(stem) = file_name.strip_suffix(".rsrc") {
        if !stem.is_empty() && parent.join(stem).is_file() {
            return true;
        }
    }

    false
}

/// Magic of an AppleDouble sidecar (forks and Finder info, no data fork).
const APPLEDOUBLE_MAGIC: u32 = 0x00051607;
/// Magic of an AppleSingle file (the same entry table, plus the data fork and name).
const APPLESINGLE_MAGIC: u32 = 0x00051600;

/// The entries an AppleDouble / AppleSingle header points at.
#[derive(Default)]
struct AppleEntries {
    data_fork: Option<Vec<u8>>,
    rsrc: Option<Vec<u8>>,
    name: Option<String>,
    type_code: Option<[u8; 4]>,
    creator_code: Option<[u8; 4]>,
    finder_flags: Option<u16>,
}

/// Walk the entry table shared by both formats; `None` when the magic is not `magic`.
///
/// Layout: `[0..4]` magic, `[4..8]` version, `[8..24]` filler, `[24..26]` entry count (u16 BE),
/// then 12-byte descriptors (`id`, `offset`, `length`). Entry 1 is the data fork, 2 the
/// resource fork, 3 the real name, 9 Finder info (type, creator, fdFlags).
fn parse_apple_entries(data: &[u8], magic: u32) -> Option<AppleEntries> {
    if data.len() < 26 || BigEndian::read_u32(&data[0..4]) != magic {
        return None;
    }
    let num_entries = BigEndian::read_u16(&data[24..26]) as usize;
    let mut out = AppleEntries::default();
    for i in 0..num_entries {
        let desc_off = 26 + i * 12;
        if desc_off + 12 > data.len() {
            break;
        }
        let entry_id = BigEndian::read_u32(&data[desc_off..desc_off + 4]);
        let offset = BigEndian::read_u32(&data[desc_off + 4..desc_off + 8]) as usize;
        let length = BigEndian::read_u32(&data[desc_off + 8..desc_off + 12]) as usize;
        let Some(body) = offset
            .checked_add(length)
            .filter(|end| *end <= data.len())
            .map(|end| &data[offset..end])
        else {
            continue;
        };
        match entry_id {
            1 => out.data_fork = Some(body.to_vec()),
            2 => out.rsrc = Some(body.to_vec()),
            3 if !body.is_empty() => out.name = Some(crate::hfs::decode_mac_filename(body)),
            9 if length >= 8 => {
                let tc: [u8; 4] = body[0..4].try_into().ok()?;
                let cc: [u8; 4] = body[4..8].try_into().ok()?;
                out.type_code = (tc != [0; 4]).then_some(tc);
                out.creator_code = (cc != [0; 4]).then_some(cc);
                if length >= 10 {
                    out.finder_flags = Some(BigEndian::read_u16(&body[8..10]));
                }
            }
            _ => {}
        }
    }
    Some(out)
}

/// Parse an AppleDouble sidecar into its resource fork and Finder info.
///
/// `None` unless it carries a resource fork or Finder info: files with type / creator but no
/// fork (plain text, bookmark files) still need their FInfo to round-trip.
pub fn parse_appledouble(data: &[u8]) -> Option<ImportedResourceFork> {
    let e = parse_apple_entries(data, APPLEDOUBLE_MAGIC)?;
    let rsrc = e.rsrc.unwrap_or_default();
    if rsrc.is_empty() && e.type_code.is_none() && e.creator_code.is_none() {
        return None;
    }
    Some(ImportedResourceFork {
        data: rsrc,
        data_fork: None,
        type_code: e.type_code,
        creator_code: e.creator_code,
        name: None,
        finder_flags: e.finder_flags,
    })
}

/// Parse an AppleSingle file: both forks, the Finder info and the Mac name in one file.
///
/// Like MacBinary it is a whole-file wrapper, so `data_fork` is always set (empty when the
/// file has none) and the caller writes that instead of the wrapper's bytes.
pub fn parse_applesingle(data: &[u8]) -> Option<ImportedResourceFork> {
    let e = parse_apple_entries(data, APPLESINGLE_MAGIC)?;
    if e.data_fork.is_none() && e.rsrc.is_none() && e.type_code.is_none() {
        return None;
    }
    Some(ImportedResourceFork {
        data: e.rsrc.unwrap_or_default(),
        data_fork: Some(e.data_fork.unwrap_or_default()),
        type_code: e.type_code,
        creator_code: e.creator_code,
        name: e.name,
        finder_flags: e.finder_flags,
    })
}

/// Whether `path` is a regular file — i.e. something it is safe to read whole.
/// A device node, FIFO or directory is not: reading one is either unbounded or
/// meaningless, and [`detect_resource_fork`] is reached with raw device paths
/// (`rb-cli inspect /dev/disk0`).
fn is_regular_file(path: &std::path::Path) -> bool {
    std::fs::metadata(path)
        .map(|m| m.file_type().is_file())
        .unwrap_or(false)
}

/// Read just the 128-byte container header. `None` if the file is shorter than
/// that or unreadable — either way it cannot be a MacBinary container.
fn read_header_128(path: &std::path::Path) -> Option<[u8; 128]> {
    use std::io::Read as _;
    let mut head = [0u8; 128];
    let mut f = std::fs::File::open(path).ok()?;
    f.read_exact(&mut head).ok()?;
    Some(head)
}

/// The first four bytes as a big-endian `u32`, or `None` for a shorter file.
fn read_magic(path: &std::path::Path) -> Option<u32> {
    use std::io::Read as _;
    let mut head = [0u8; 4];
    std::fs::File::open(path).ok()?.read_exact(&mut head).ok()?;
    Some(u32::from_be_bytes(head))
}

/// Header-only precondition for [`parse_macbinary`]: every check that function
/// makes against the first 128 bytes, and nothing else.
///
/// Deliberately *not* rusty-backup's `macarchive::macbinary::is_macbinary`, which is a
/// different predicate — it accepts a MacBinary I on an exact whole-file size
/// match, which a header alone cannot establish, and it rejects some headers
/// `parse_macbinary` would take. Gating on it would silently change which files
/// yield a resource fork. Keep this in step with `parse_macbinary` if that
/// function's header checks ever change.
fn macbinary_header_ok(head: &[u8; 128]) -> bool {
    if head[0] != 0 {
        return false;
    }
    let name_len = head[1] as usize;
    if name_len == 0 || name_len > 63 {
        return false;
    }
    if head[122] != 129 && head[122] != 130 {
        return false;
    }
    BigEndian::read_u16(&head[124..126]) == macbinary_crc16(&head[0..124])
}

/// Parse a MacBinary (II/III) file and extract both forks and Finder info.
///
/// MacBinary header (128 bytes):
/// - `[0]` must be 0
/// - `[1]` filename length (1-63)
/// - `[65..69]` type code
/// - `[69..73]` creator code
/// - `[83..87]` data fork length (u32 BE)
/// - `[87..91]` resource fork length (u32 BE)
/// - `[122]` MacBinary version (129=II, 130=III)
/// - `[124..126]` CRC-16 of bytes 0-123 (MacBinary II+)
///
/// Returns `None` if the file doesn't look like a valid MacBinary container.
pub fn parse_macbinary(data: &[u8]) -> Option<ImportedResourceFork> {
    if data.len() < 128 {
        return None;
    }
    // Byte 0 must be 0
    if data[0] != 0 {
        return None;
    }
    // Filename length must be 1-63
    let name_len = data[1] as usize;
    if name_len == 0 || name_len > 63 {
        return None;
    }
    // Check version byte — must be MacBinary II (129) or III (130)
    let version = data[122];
    if version != 129 && version != 130 {
        return None;
    }
    // Verify CRC
    let stored_crc = BigEndian::read_u16(&data[124..126]);
    let computed_crc = macbinary_crc16(&data[0..124]);
    if stored_crc != computed_crc {
        return None;
    }

    let type_code: [u8; 4] = data[65..69].try_into().unwrap();
    let creator_code: [u8; 4] = data[69..73].try_into().unwrap();

    let data_len = BigEndian::read_u32(&data[83..87]) as usize;
    let rsrc_len = BigEndian::read_u32(&data[87..91]) as usize;

    let data_start = 128;
    let data_padded = pad_to_128(data_len);
    let rsrc_start = data_start + data_padded;

    // A data-fork-only file is still MacBinary: type, creator and the Mac
    // name ride in the header, and the 128 bytes are not file content.
    if rsrc_start + rsrc_len > data.len() || data_start + data_len > data.len() {
        return None;
    }

    Some(ImportedResourceFork {
        data: data[rsrc_start..rsrc_start + rsrc_len].to_vec(),
        data_fork: Some(data[data_start..data_start + data_len].to_vec()),
        type_code: if type_code != [0; 4] {
            Some(type_code)
        } else {
            None
        },
        creator_code: if creator_code != [0; 4] {
            Some(creator_code)
        } else {
            None
        },
        name: {
            let n = crate::hfs::decode_mac_filename(&data[2..2 + name_len]);
            (!n.is_empty()).then_some(n)
        },
        // MacBinary II splits fdFlags: the high byte at 73, the low byte at 101.
        finder_flags: Some(((data[73] as u16) << 8) | data[101] as u16),
    })
}

/// Read the macOS `com.apple.FinderInfo` extended attribute and extract
/// the 4-byte type and creator codes. Returns `(None, None)` if the xattr
/// is missing, too short, or both codes are zero.
#[cfg(target_os = "macos")]
fn read_finder_info_xattr(path: &std::path::Path) -> (Option<[u8; 4]>, Option<[u8; 4]>) {
    use std::ffi::CString;
    use std::os::unix::ffi::OsStrExt;

    let c_path = match CString::new(path.as_os_str().as_bytes()) {
        Ok(p) => p,
        Err(_) => return (None, None),
    };
    let c_name = match CString::new("com.apple.FinderInfo") {
        Ok(n) => n,
        Err(_) => return (None, None),
    };

    let mut buf = [0u8; 32];
    // getxattr(path, name, value, size, position, options)
    let n = unsafe {
        libc::getxattr(
            c_path.as_ptr(),
            c_name.as_ptr(),
            buf.as_mut_ptr() as *mut libc::c_void,
            buf.len(),
            0,
            0,
        )
    };
    if n < 8 {
        return (None, None);
    }

    let mut tc = [0u8; 4];
    let mut cc = [0u8; 4];
    tc.copy_from_slice(&buf[0..4]);
    cc.copy_from_slice(&buf[4..8]);

    let tc = if tc != [0; 4] { Some(tc) } else { None };
    let cc = if cc != [0; 4] { Some(cc) } else { None };
    (tc, cc)
}

/// A Mac file name as the classic containers store it: Mac Roman, at most 63
/// bytes. One byte per character, so the cut never splits a character.
pub fn mac_name_bytes(name: &str) -> Vec<u8> {
    let mut out = Vec::with_capacity(name.len());
    for ch in name.chars() {
        let mut one = [0u8; 4];
        let bytes =
            crate::hfs::utf8_to_mac_roman(ch.encode_utf8(&mut one)).unwrap_or_else(|_| vec![b'?']);
        if out.len() + bytes.len() > 63 {
            break;
        }
        out.extend_from_slice(&bytes);
    }
    out
}

#[cfg(test)]
mod tests {
    use super::*;

    /// X13: names went out as UTF-8 and were cut at 63 bytes mid-character;
    /// a classic Mac reads the header as Mac Roman.
    /// H14: fdFlags rode in both containers and were dropped on import.
    #[test]
    fn container_parsers_carry_the_finder_flags() {
        let mut mb = build_macbinary("Flag", b"APPL", b"ttxt", MacFileDates::default(), b"x", b"");
        mb[73] = 0x01; // fdFlags high byte
        mb[101] = 0x40; // fdFlags low byte
        let crc = macbinary_crc16(&mb[0..124]);
        BigEndian::write_u16(&mut mb[124..126], crc);
        assert_eq!(parse_macbinary(&mb).unwrap().finder_flags, Some(0x0140));

        let mut ad = build_appledouble(b"APPL", b"ttxt", MacFileDates::default(), b"RSRC");
        // First entry descriptor at 26: id, offset, length; Finder Info is first.
        assert_eq!(BigEndian::read_u32(&ad[26..30]), 9);
        let off = BigEndian::read_u32(&ad[30..34]) as usize;
        BigEndian::write_u16(&mut ad[off + 8..off + 10], 0x4000);
        assert_eq!(parse_appledouble(&ad).unwrap().finder_flags, Some(0x4000));
    }

    #[test]
    fn macbinary_names_are_mac_roman_and_cut_on_a_character() {
        let mb = build_macbinary(
            "Caf\u{e9}",
            b"TEXT",
            b"ttxt",
            MacFileDates::default(),
            b"x",
            b"",
        );
        assert_eq!(mb[1], 4);
        assert_eq!(&mb[2..6], &[b'C', b'a', b'f', 0x8E]);
        let long = "\u{e9}".repeat(70);
        let bytes = mac_name_bytes(&long);
        assert_eq!(bytes.len(), 63);
        assert!(bytes.iter().all(|&b| b == 0x8E));
        assert_eq!(mac_name_bytes("\u{65e5}"), b"?");
    }

    #[test]
    fn test_sanitize_filename() {
        assert_eq!(sanitize_filename("hello:world"), "hello_world");
        assert_eq!(sanitize_filename("file/name"), "file_name");
        assert_eq!(sanitize_filename("normal.txt"), "normal.txt");
        assert_eq!(sanitize_filename("a<b>c"), "a_b_c");
        assert_eq!(sanitize_filename(".."), "_");
        assert_eq!(sanitize_filename(""), "_");
    }

    #[test]
    fn test_build_appledouble_header() {
        let ad = build_appledouble(b"TEXT", b"ttxt", MacFileDates::default(), &[0xDE, 0xAD]);
        // Magic
        assert_eq!(BigEndian::read_u32(&ad[0..4]), 0x00051607);
        // Version 2
        assert_eq!(BigEndian::read_u32(&ad[4..8]), 0x00020000);
        // 2 entries
        assert_eq!(BigEndian::read_u16(&ad[24..26]), 2);
        // Finder info entry has type/creator
        let fi_offset = BigEndian::read_u32(&ad[30..34]) as usize;
        assert_eq!(&ad[fi_offset..fi_offset + 4], b"TEXT");
        assert_eq!(&ad[fi_offset + 4..fi_offset + 8], b"ttxt");
        // Resource fork data at end
        let rsrc_offset = BigEndian::read_u32(&ad[42..46]) as usize;
        let rsrc_len = BigEndian::read_u32(&ad[46..50]) as usize;
        assert_eq!(rsrc_len, 2);
        assert_eq!(&ad[rsrc_offset..rsrc_offset + 2], &[0xDE, 0xAD]);
    }

    #[test]
    fn test_build_macbinary() {
        let mb = build_macbinary(
            "test.txt",
            b"TEXT",
            b"ttxt",
            MacFileDates::default(),
            b"hello",
            &[1, 2, 3],
        );
        // Filename length
        assert_eq!(mb[1], 8);
        assert_eq!(&mb[2..10], b"test.txt");
        // Type/creator
        assert_eq!(&mb[65..69], b"TEXT");
        assert_eq!(&mb[69..73], b"ttxt");
        // Data fork length
        assert_eq!(BigEndian::read_u32(&mb[83..87]), 5);
        // Resource fork length
        assert_eq!(BigEndian::read_u32(&mb[87..91]), 3);
        // MacBinary III version
        assert_eq!(mb[122], 130);
        // Data fork content
        assert_eq!(&mb[128..133], b"hello");
        // Resource fork content (after data padded to 128)
        assert_eq!(&mb[256..259], &[1, 2, 3]);
    }

    #[test]
    fn test_macbinary_crc() {
        // Known test: CRC of all zeros should be 0
        let zeros = [0u8; 124];
        assert_eq!(macbinary_crc16(&zeros), 0);
    }

    #[test]
    fn test_pad_to_128() {
        assert_eq!(pad_to_128(0), 0);
        assert_eq!(pad_to_128(1), 128);
        assert_eq!(pad_to_128(128), 128);
        assert_eq!(pad_to_128(129), 256);
    }

    #[test]
    fn test_resource_fork_mode_labels() {
        assert_eq!(
            ResourceForkMode::AppleDouble.label(),
            "AppleDouble (._file)"
        );
        assert_eq!(ResourceForkMode::DataForkOnly.label(), "Data fork only");
    }

    #[test]
    fn test_parse_appledouble_roundtrip() {
        let rsrc = vec![0xCA, 0xFE, 0xBA, 0xBE];
        let ad = build_appledouble(b"TEXT", b"ttxt", MacFileDates::default(), &rsrc);
        let parsed = parse_appledouble(&ad).expect("should parse");
        assert_eq!(parsed.data, rsrc);
        assert_eq!(parsed.type_code, Some(*b"TEXT"));
        assert_eq!(parsed.creator_code, Some(*b"ttxt"));
        assert!(parsed.data_fork.is_none());
    }

    #[test]
    fn test_parse_appledouble_bad_magic() {
        assert!(parse_appledouble(&[0; 30]).is_none());
    }

    #[test]
    fn test_parse_macbinary_roundtrip() {
        let data_fork = b"hello world";
        let rsrc = vec![1, 2, 3, 4, 5];
        let mb = build_macbinary(
            "test.txt",
            b"TEXT",
            b"ttxt",
            MacFileDates::default(),
            data_fork,
            &rsrc,
        );
        let parsed = parse_macbinary(&mb).expect("should parse");
        assert_eq!(parsed.data, rsrc);
        assert_eq!(parsed.data_fork.as_deref(), Some(data_fork.as_slice()));
        assert_eq!(parsed.type_code, Some(*b"TEXT"));
        assert_eq!(parsed.creator_code, Some(*b"ttxt"));
    }

    #[test]
    fn test_parse_macbinary_bad_header() {
        // Too short
        assert!(parse_macbinary(&[0; 50]).is_none());
        // Wrong byte 0
        let mut bad = vec![0; 256];
        bad[0] = 1;
        assert!(parse_macbinary(&bad).is_none());
    }

    #[test]
    fn test_parse_appledouble_finfo_only() {
        // Sidecar built for a file with type/creator but no resource fork
        // (e.g. a classic Mac bookmark or .txt file). Must round-trip.
        let ad = build_appledouble(b"MOSS", b"sigl", MacFileDates::default(), &[]);
        let parsed = parse_appledouble(&ad).expect("FInfo-only sidecar should parse");
        assert!(parsed.data.is_empty());
        assert_eq!(parsed.type_code, Some(*b"MOSS"));
        assert_eq!(parsed.creator_code, Some(*b"sigl"));
    }

    #[test]
    fn test_parse_appledouble_empty_finder_info_rejected() {
        // Sidecar with no rsrc and no FInfo carries no information.
        let ad = build_appledouble(&[0; 4], &[0; 4], MacFileDates::default(), &[]);
        assert!(parse_appledouble(&ad).is_none());
    }

    /// Rejecting a data-fork-only MacBinary made `put` copy its 128-byte
    /// header in as file content under the wrapper's host name.
    #[test]
    fn test_parse_macbinary_no_rsrc_still_unwraps() {
        let mb = build_macbinary(
            "test.txt",
            b"TEXT",
            b"ttxt",
            MacFileDates::default(),
            b"data",
            &[],
        );
        let parsed = parse_macbinary(&mb).expect("a MacBinary with an empty resource fork");
        assert!(parsed.data.is_empty());
        assert_eq!(parsed.data_fork.as_deref(), Some(b"data".as_slice()));
        assert_eq!(parsed.type_code, Some(*b"TEXT"));
        assert_eq!(parsed.name.as_deref(), Some("test.txt"));
    }

    #[test]
    fn test_build_macbinary_dates() {
        let dates = MacFileDates {
            created: 0x1234_5678,
            modified: 0x2345_6789,
        };
        let mb = build_macbinary("f", b"TEXT", b"ttxt", dates, b"x", &[9]);
        // Raw Mac-1904 seconds land at header offsets 91 (create) and 95 (modify).
        assert_eq!(BigEndian::read_u32(&mb[91..95]), 0x1234_5678);
        assert_eq!(BigEndian::read_u32(&mb[95..99]), 0x2345_6789);
        // Dates are inside the CRC'd header region, so the container still parses.
        assert!(parse_macbinary(&mb).is_some());
    }

    #[test]
    fn test_build_appledouble_dates() {
        // `created` maps to 100s after the 2000 epoch; `modified` stays unknown.
        let created = (MAC_EPOCH_UNIX_OFFSET + APPLEDOUBLE_EPOCH_UNIX + 100) as u32;
        let dates = MacFileDates {
            created,
            modified: 0,
        };
        let ad = build_appledouble(b"TEXT", b"ttxt", dates, &[0xAA]);
        // Real dates add a third entry (Finder Info, File Dates Info, Resource Fork).
        assert_eq!(BigEndian::read_u16(&ad[24..26]), 3);
        // Second descriptor is the File Dates Info entry (id 8).
        assert_eq!(BigEndian::read_u32(&ad[38..42]), 8);
        let dates_off = BigEndian::read_u32(&ad[42..46]) as usize;
        assert_eq!(BigEndian::read_i32(&ad[dates_off..dates_off + 4]), 100);
        // Unknown modify/backup/access all become the sentinel.
        assert_eq!(
            BigEndian::read_i32(&ad[dates_off + 4..dates_off + 8]),
            i32::MIN
        );
        // Finder info + resource fork still round-trip through the parser.
        let parsed = parse_appledouble(&ad).expect("parse");
        assert_eq!(parsed.type_code, Some(*b"TEXT"));
        assert_eq!(parsed.data, vec![0xAA]);
    }

    #[test]
    fn test_build_appledouble_no_dates_layout_unchanged() {
        // Default (unknown) dates keep the classic two-entry layout so callers
        // without timestamps emit byte-identical sidecars.
        let ad = build_appledouble(b"TEXT", b"ttxt", MacFileDates::default(), &[0xAA]);
        assert_eq!(BigEndian::read_u16(&ad[24..26]), 2);
        // Second descriptor is the resource fork (id 2), not a dates entry.
        assert_eq!(BigEndian::read_u32(&ad[38..42]), 2);
    }

    /// The 128-byte gate must accept exactly what `parse_macbinary` accepts —
    /// it exists to avoid reading a whole file to reach the same verdict, not
    /// to change it.
    #[test]
    fn macbinary_header_gate_agrees_with_the_parser() {
        let mb = build_macbinary(
            "note.txt",
            b"TEXT",
            b"ttxt",
            MacFileDates::default(),
            b"data",
            &[0xAA, 0xBB],
        );
        let head: [u8; 128] = mb[..128].try_into().unwrap();
        assert!(macbinary_header_ok(&head));
        assert!(parse_macbinary(&mb).is_some());

        // An APM Driver Descriptor Record — byte 0 is 'E' of "ER", the first
        // thing `rb-cli inspect /dev/disk0` reads. Rejected on the header.
        let mut ddr = [0u8; 128];
        ddr[0] = b'E';
        ddr[1] = b'R';
        assert!(!macbinary_header_ok(&ddr));
        assert!(parse_macbinary(&ddr).is_none());
    }

    /// `detect_resource_fork` probes whether the path *itself* is a MacBinary
    /// container, and it is reached with paths the user typed — including raw
    /// devices (`rb-cli inspect /dev/disk0`). Reading one of those is
    /// unbounded: on 32-bit PowerPC it aborts with "capacity overflow" once the
    /// Vec passes `isize::MAX`, after minutes of I/O.
    ///
    /// A FIFO stands in for the device here: before the `is_regular_file` guard
    /// this call blocked forever on a reader with no writer.
    #[test]
    #[cfg(any(target_os = "linux", target_os = "macos"))]
    fn non_regular_paths_are_not_read_whole() {
        use std::ffi::CString;
        use std::os::unix::ffi::OsStrExt;

        let dir = tempfile::tempdir().unwrap();
        let fifo = dir.path().join("pipe");
        let c_path = CString::new(fifo.as_os_str().as_bytes()).unwrap();
        assert_eq!(unsafe { libc::mkfifo(c_path.as_ptr(), 0o644) }, 0);

        assert!(!is_regular_file(&fifo));
        assert!(detect_resource_fork(&fifo).is_none());
    }

    /// An AppleSingle file the way `macutil` / A/UX write one: data, resource, name, FInfo.
    fn applesingle(data: &[u8], rsrc: &[u8], name: &[u8]) -> Vec<u8> {
        let mut finfo = [0u8; 16];
        finfo[0..4].copy_from_slice(b"TEXT");
        finfo[4..8].copy_from_slice(b"ttxt");
        finfo[8..10].copy_from_slice(&0x0100u16.to_be_bytes());
        let entries: [(u32, &[u8]); 4] = [(1, data), (2, rsrc), (3, name), (9, &finfo)];
        let mut out = Vec::new();
        out.extend_from_slice(&APPLESINGLE_MAGIC.to_be_bytes());
        out.extend_from_slice(&0x0002_0000u32.to_be_bytes());
        out.extend_from_slice(&[0u8; 16]);
        out.extend_from_slice(&(entries.len() as u16).to_be_bytes());
        let mut offset = 26 + 12 * entries.len();
        for (id, body) in entries {
            out.extend_from_slice(&id.to_be_bytes());
            out.extend_from_slice(&(offset as u32).to_be_bytes());
            out.extend_from_slice(&(body.len() as u32).to_be_bytes());
            offset += body.len();
        }
        for (_, body) in entries {
            out.extend_from_slice(body);
        }
        out
    }

    #[test]
    fn applesingle_unwraps_to_both_forks_and_its_mac_name() {
        let bytes = applesingle(b"hello", b"RSRC", b"Read Me");
        let f = parse_applesingle(&bytes).expect("parses");
        assert_eq!(f.data_fork.as_deref(), Some(&b"hello"[..]));
        assert_eq!(f.data, b"RSRC");
        assert_eq!(f.name.as_deref(), Some("Read Me"));
        assert_eq!(
            (f.type_code, f.creator_code),
            (Some(*b"TEXT"), Some(*b"ttxt"))
        );
        assert_eq!(f.finder_flags, Some(0x0100));
        // The sidecar parser does not take a single file, nor the other way round.
        assert!(parse_appledouble(&bytes).is_none());
        let ad = build_appledouble(b"TEXT", b"ttxt", MacFileDates::default(), b"R");
        assert!(parse_applesingle(&ad).is_none());
    }

    #[test]
    fn a_host_applesingle_file_is_detected_as_its_own_wrapper() {
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("readme.as");
        std::fs::write(&path, applesingle(b"hello", b"", b"Read Me")).unwrap();
        let f = detect_resource_fork(&path).expect("detected");
        assert_eq!(f.data_fork.as_deref(), Some(&b"hello"[..]));
        assert_eq!(f.name.as_deref(), Some("Read Me"));
        assert!(f.data.is_empty());
    }
}