// SPDX-License-Identifier: GPL-2.0-or-later
// Copyright (C) 2026 Bryan Joshua Pedini

package main

import (
	"io"
	"log/slog"
	"os"
	"testing"
)

// TestDropPrivilegesNonRootSkipsDrop covers the non-root half (Phase 6): when
// the test binary is not running as root (the normal CI/dev case), dropPrivileges
// must take the skip path — log a warning and return — without calling exit
// or erroring. The root half (actual setuid/setgid) requires a root-owned
// process and is exercised at the container level (Phase 6), not here.
func TestDropPrivilegesNonRootSkipsDrop(t *testing.T) {
	if os.Getuid() == 0 {
		t.Skip("this test asserts the non-root skip path; running as root here")
	}

	logger := slog.New(slog.NewTextHandler(io.Discard, nil))

	// If dropPrivileges took the root path here, it would call
	// syscall.Setgid/Setuid as non-root, fail, and os.Exit(1) — which would
	// kill the test binary. Reaching this point at all proves the skip path
	// was taken, without erroring or exiting.
	dropPrivileges(logger, 1000, 1000)
}