// SPDX-License-Identifier: GPL-2.0-or-later
// Copyright (C) 2026 Bryan Joshua Pedini

package main

import (
	"log/slog"
	"os"
	"syscall"
)

// dropPrivileges irrevocably drops from root to PUID/PGID before any
// listener, goroutine, or DB connection is created. If already unprivileged
// (dev runs), it skips the drop and logs a warning. Any failure to drop or
// verify the drop is fatal — this process must never serve traffic as root.
func dropPrivileges(logger *slog.Logger, puid, pgid int) {
	if os.Getuid() != 0 {
		logger.Warn("already running unprivileged, skipping privilege drop", "uid", os.Getuid(), "gid", os.Getgid())
		return
	}

	if err := syscall.Setgroups([]int{}); err != nil {
		logger.Error("failed to clear supplementary groups", "error", err)
		os.Exit(1)
	}
	if err := syscall.Setgid(pgid); err != nil {
		logger.Error("failed to setgid", "gid", pgid, "error", err)
		os.Exit(1)
	}
	if err := syscall.Setuid(puid); err != nil {
		logger.Error("failed to setuid", "uid", puid, "error", err)
		os.Exit(1)
	}

	if os.Getuid() != puid || os.Getgid() != pgid {
		logger.Error("privilege drop verification failed", "want_uid", puid, "got_uid", os.Getuid(), "want_gid", pgid, "got_gid", os.Getgid())
		os.Exit(1)
	}

	if err := syscall.Setuid(0); err == nil {
		logger.Error("re-escalation to root succeeded, this must never happen")
		os.Exit(1)
	}

	logger.Info("privileges dropped", "uid", os.Getuid(), "gid", os.Getgid())
}