#!/usr/bin/env bash
set -Eeuo pipefail
cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.."
source <(awk '/^\[\[ "\$EUID"/{exit} {print}' ochenstarik-server-user-3.sh)
test_dir="$(mktemp -d)"
trap 'rm -rf -- "$test_dir"' EXIT

# Relocate just the privileged filesystem boundary; use the real install
# binary to check first creation, idempotency and repair of unsafe modes.
install() {
  [[ "$*" == '-d -o root -g root -m 755 /run/sshd' ]]
  /usr/bin/install -d -m 755 "$test_dir/sshd"
}
prepare_sshd_runtime_directory
[[ -d "$test_dir/sshd" && "$(stat -c %a "$test_dir/sshd")" == 755 ]]
chmod 777 "$test_dir/sshd"
prepare_sshd_runtime_directory
[[ "$(stat -c %a "$test_dir/sshd")" == 755 ]]

# The runtime prerequisite must run before standalone configuration validation.
prepare_line="$(grep -n '^prepare_sshd_runtime_directory$' ochenstarik-server-user-3.sh | cut -d: -f1)"
validate_line="$(grep -n '^sshd -t ' ochenstarik-server-user-3.sh | cut -d: -f1)"
((prepare_line < validate_line))
printf 'Step 3 socket-activation runtime directory tests passed.\n'