using System.IO.Pipes;
using System.Runtime.Versioning;
using System.Security.AccessControl;
using System.Security.Principal;

namespace ZB.MOM.WW.OtOpcUa.Core.Scripting.OutOfProcess;

/// <summary>
///     The ScriptWorker pipe's explicit ACL on Windows (lmxopcua#780 design §6, "an explicit ACL when the worker runs as a
///     different account"): a protected DACL that admits the host account and — when <c>Scripting:Worker:Identity</c> is
///     set — the worker identity, each with read/write, and nobody else (no SYSTEM, no Administrators, no Everyone). The
///     owner is the host token's owner, as .NET's <c>PipeOptions.CurrentUserOnly</c> sets it, so the worker's
///     <c>CurrentUserOnly</c> client check (pipe owner == its token owner, which a restricted token keeps) still
///     authenticates the server end.
/// </summary>
[SupportedOSPlatform("windows")]
internal static class WorkerPipeSecurity
{
    /// <summary>The rights each admitted principal gets: read/write data, attributes and the security descriptor (read).</summary>
    internal const PipeAccessRights GrantedRights = PipeAccessRights.ReadWrite;

    /// <summary>Builds the pipe ACL for this host process.</summary>
    /// <param name="workerSid">The worker identity's SID string, or null when the worker keeps the host's token.</param>
    /// <returns>The pipe security.</returns>
    public static PipeSecurity ForCurrentHost(string? workerSid)
    {
        using var identity = WindowsIdentity.GetCurrent();
        var owner = identity.Owner ?? identity.User ?? throw new InvalidOperationException("the host token has no owner");
        var user = identity.User ?? owner;
        return Create(owner, user, workerSid is null ? null : new SecurityIdentifier(workerSid));
    }

    /// <summary>Builds the pipe ACL.</summary>
    /// <param name="owner">The pipe owner (the host token's owner).</param>
    /// <param name="hostUser">The host account (its token's user SID).</param>
    /// <param name="worker">The worker identity, or null.</param>
    /// <returns>The pipe security: protected, allow-only, one ACE for the host account and one for the worker identity.</returns>
    public static PipeSecurity Create(SecurityIdentifier owner, SecurityIdentifier hostUser, SecurityIdentifier? worker)
    {
        var security = new PipeSecurity();
        security.SetAccessRuleProtection(isProtected: true, preserveInheritance: false);
        security.SetOwner(owner);
        // The host account and the worker identity, nothing else: not the owner when it differs (an elevated host's
        // owner is BUILTIN\Administrators — .NET's CurrentUserOnly would grant it; the owner keeps only its implicit
        // READ_CONTROL / WRITE_DAC).
        var principals = new List<SecurityIdentifier> { hostUser };
        if (worker is not null && !principals.Contains(worker)) principals.Add(worker);
        foreach (var principal in principals)
            security.AddAccessRule(new PipeAccessRule(principal, GrantedRights, AccessControlType.Allow));
        return security;
    }

    /// <summary>Creates the single-instance server end of a worker pipe with <paramref name="security"/>.</summary>
    /// <param name="pipeName">The random pipe name.</param>
    /// <param name="security">The ACL (<see cref="ForCurrentHost"/>).</param>
    /// <returns>The server stream.</returns>
    public static NamedPipeServerStream CreateServer(string pipeName, PipeSecurity security)
        => NamedPipeServerStreamAcl.Create(pipeName, PipeDirection.InOut, maxNumberOfServerInstances: 1,
            PipeTransmissionMode.Byte, PipeOptions.Asynchronous, inBufferSize: 0, outBufferSize: 0, security);
}