// Copyright (C) 2023  Tomasz Kramkowski <tomasz@kramkow.ski>
// SPDX-License-Identifier: MIT

use cap_std::fs::{Dir, OpenOptions};
use pam::constants::{PamFlag, PamResultCode};
use pam::module::{PamHandle, PamHooks};
use std::ffi::CStr;
use std::fmt::{Display, Write as _};
use std::io::{ErrorKind, Write};
use std::panic;
use std::path::Path;
use std::process;

fn create_and_open_dir<P: AsRef<Path> + Copy>(
    d: &Dir,
    path: P,
) -> std::io::Result<Dir> {
    if let Err(e) = d.create_dir(path) {
        if e.kind() != ErrorKind::AlreadyExists {
            return Err(e);
        }
    }
    d.open_dir(path)
}

struct SessionError;

impl From<std::io::Error> for SessionError {
    fn from(_: std::io::Error) -> Self {
        SessionError
    }
}

fn open_session(h: &PamHandle, mountpoint: &str) -> Result<(), SessionError> {
    let user = h.get_user(None).or(Err(SessionError))?;
    let user = users::get_user_by_name(&user).ok_or(SessionError)?;
    let uid = user.uid().to_string();
    let d = Dir::open_ambient_dir(mountpoint, cap_std::ambient_authority())?;
    let d = create_and_open_dir(&d, "user")?;
    let d = create_and_open_dir(&d, &uid)?;
    let d = create_and_open_dir(&d, "leaf")?;
    let pid = process::id().to_string();
    let mut options = OpenOptions::new();
    options.write(true);
    let mut procs = d.open_with("cgroup.procs", &options)?;
    procs.write_all(pid.as_bytes())?;
    Ok(())
}

const CG_MOUNT: &str = "/sys/fs/cgroup";

struct PAMUserCG;
pam::pam_hooks!(PAMUserCG);

impl PamHooks for PAMUserCG {
    fn sm_open_session(
        h: &mut PamHandle,
        _args: Vec<&CStr>,
        _flags: PamFlag,
    ) -> PamResultCode {
        match panic::catch_unwind(|| open_session(h, CG_MOUNT)) {
            Ok(Ok(())) => PamResultCode::PAM_SUCCESS,
            _ => PamResultCode::PAM_SESSION_ERR,
        }
    }
}