# -*- coding: utf-8 -*-
"""只操作本程序创建的临时对象；全部数据为合成样本。"""
import os, sys, json, sqlite3, tempfile, pathlib, subprocess, time, socket, stat
from pathlib import Path
def emit(**kw):
    print(json.dumps(kw, ensure_ascii=False, sort_keys=True))
tree=[{'name':'/demo','mode':0o755,'owner':1000},{'name':'/demo/private','mode':0o700,'owner':1000},{'name':'/demo/private/config','mode':0o644,'owner':1000}]
uid=2000
def permitted(entry,directory):
    bits=(entry['mode']>>6)&7 if uid==entry['owner'] else entry['mode']&7
    return bool(bits & (1 if directory else 4))
blocked=[x['name'] for x in tree[:-1] if not permitted(x,True)]
assert blocked==['/demo/private'] and permitted(tree[-1],False)
native=None
if os.name=='posix' and os.getuid()==0:
    with tempfile.TemporaryDirectory(prefix='ywebs-next132-b2-perm-') as d:
        p=Path(d); os.chmod(d,0o755); private=p/'private'; private.mkdir(); os.chmod(str(private),0o700); f=private/'demo.conf'; f.write_text('demo'); os.chmod(str(f),0o644)
        code='import os,sys; os.setgroups([]); os.setgid(65534); os.setuid(65534); print(open(sys.argv[1]).read())'
        before=subprocess.run([sys.executable,'-c',code,str(f)],stdout=subprocess.PIPE,stderr=subprocess.PIPE)
        os.chmod(str(private),0o711)
        after=subprocess.run([sys.executable,'-c',code,str(f)],stdout=subprocess.PIPE,stderr=subprocess.PIPE)
        assert before.returncode!=0 and after.returncode==0 and after.stdout.strip()==b'demo'
        native={'before_returncode':before.returncode,'after_returncode':after.returncode}
emit(blocking_directories=blocked,file_read_bit=True,native=native,scope='传统mode位；ACL和安全模块另查')