use cap_std::fs::{Dir, OpenOptions};
use pam::constants::{PamFlag, PamResultCode};
use pam::module::{PamHandle, PamHooks};
use std::ffi::CStr;
use std::io::{ErrorKind, Write};
use std::path::Path;
use std::process;

const CG_MOUNT: &str = "/sys/fs/cgroup";

struct PAMUserCG;
pam::pam_hooks!(PAMUserCG);

fn create_and_open_dir<P: AsRef<Path> + Copy>(
        d: &Dir, path: P,
    ) -> std::io::Result<Dir> {
    match d.create_dir(path) {
        Ok(()) => Ok(()),
        Err(e) => match e.kind() {
            ErrorKind::AlreadyExists => Ok(()),
            _ => Err(e),
        }
    }?;
    d.open_dir(path)
}

struct SessionError;

fn open_session(h: &mut PamHandle) -> Result<(), SessionError> {
    let user = h.get_user(None).or(Err(SessionError))?;
    let user = users::get_user_by_name(&user).ok_or(SessionError)?;
    let aa = cap_std::ambient_authority();
    let d = Dir::open_ambient_dir(CG_MOUNT, aa).or(Err(SessionError))?;
    let d = create_and_open_dir(&d, "user").or(Err(SessionError))?;
    let d = create_and_open_dir(&d, &user.uid().to_string())
        .or(Err(SessionError))?;
    let d = create_and_open_dir(&d, "leaf").or(Err(SessionError))?;
    let pid = process::id().to_string();
    let mut options = OpenOptions::new();
    options.write(true);
    let mut procs = d.open_with("cgroup.procs", &options).or(Err(SessionError))?;
    procs.write_all(pid.as_bytes()).or(Err(SessionError))?;
    Ok(())
}

impl PamHooks for PAMUserCG {
    fn sm_open_session(
        h: &mut PamHandle,
        _args: Vec<&CStr>,
        _flags: PamFlag
    ) -> PamResultCode {
        if open_session(h).is_ok() {
            PamResultCode::PAM_SUCCESS
        } else {
            PamResultCode::PAM_SESSION_ERR
        }
    }
}