files

type ACE struct {
	Principal string
	// PrincipalSID if present contains the raw SID bytes to use when applying
	// the ACE on Windows. When non-nil, implementations should prefer the SID
	// form of TRUSTEE to avoid name-resolution ambiguity.
	PrincipalSID []byte
	Rights       string
	// PrincipalSIDStr contains the textual SID (S-1-5-...) when available.
	PrincipalSIDStr string
	Type            string // Allow or Deny
	Inherited       bool
}

type ACLReport struct {
	Path   string
	Exists bool
	Owner  string
	// OwnerSID contains the raw owner SID bytes on Windows when available.
	// On non-Windows platforms this will be nil.
	OwnerSID []byte
	// OwnerSIDStr is the textual SID value (S-1-5-...) when available.
	OwnerSIDStr string
	Mode        fs.FileMode
	ACEs        []ACE
	Problems    []string
}

type ACLVerifier interface {
	VerifyACL(path string, expected ExpectedACL) (ACLReport, error)
}

type ConfigLog struct {
	// contains filtered or unexported fields
}

type ConfigProblem struct {
	Filepath      string
	OffendingLine string
	ErrorMessage  string
	Source        string
}

type ExpectedACE struct {
	Principal string // e.g. "Administrators", "SYSTEM", "opksshuser"
	Rights    string // e.g. "GENERIC_ALL", "GENERIC_READ"
	Type      string // "allow"
}

type ExpectedACL struct {
	Owner string
	Mode  fs.FileMode // expected mode bits; 0 means ignore

	// RequiredACEs lists ACE expectations that must be present.
	// Used on Windows to verify that opksshuser has been granted read access.
	RequiredACEs []ExpectedACE
}

type FileLoader struct {
	Fs           afero.Fs
	RequiredPerm fs.FileMode
}

type FilePermsOps interface {
	MkdirAllWithPerm(path string, perm fs.FileMode) error
	CreateFileWithPerm(path string) (afero.File, error)
	WriteFileWithPerm(path string, data []byte, perm fs.FileMode) error
	Chmod(path string, perm fs.FileMode) error
	Stat(path string) (fs.FileInfo, error)
	Chown(path string, owner string, group string) error
	// ApplyACE applies a single ACE to the target path. On platforms that
	// don't support ACE modifications, this may be a no-op or return nil.
	ApplyACE(path string, ace ACE) error
}

type FileSystem interface {
	// Stat returns file info for the given path.
	Stat(path string) (fs.FileInfo, error)
	// Exists reports whether the path exists.
	Exists(path string) (bool, error)
	// Open opens a file for reading (e.g. directory listing via Readdir).
	Open(path string) (afero.File, error)
	// ReadFile reads the entire contents of a file.
	ReadFile(path string) ([]byte, error)

	// MkdirAll creates a directory and all parents with the given permission.
	MkdirAll(path string, perm fs.FileMode) error
	// CreateFile creates an empty file, creating parent directories as needed.
	CreateFile(path string) (afero.File, error)
	// WriteFile writes data to a file with the given permission.
	WriteFile(path string, data []byte, perm fs.FileMode) error

	// Chmod sets the permission mode bits on a path.
	Chmod(path string, perm fs.FileMode) error
	// Chown sets the owner and group on a path.
	Chown(path string, owner string, group string) error
	// ApplyACE applies a single access control entry to a path.
	ApplyACE(path string, ace ACE) error

	// CheckPerm verifies that the file at path has one of the required
	// permission modes and, optionally, the expected owner and group.
	CheckPerm(path string, requirePerm []fs.FileMode, requiredOwner string, requiredGroup string) error
	// VerifyACL checks ACLs and ownership against expectations.
	VerifyACL(path string, expected ExpectedACL) (ACLReport, error)
}

type FileSystemOption func(*defaultFileSystem)

type OsFilePermsOps struct {
	Fs afero.Fs
}

type PermInfo struct {
	// Mode is the expected Unix permission bits (e.g. 0o640, 0o600, 0o750).
	Mode fs.FileMode
	// Owner is the expected owner of the file/directory (e.g. "root" on
	// Linux, "Administrators" on Windows). An empty string means ownership
	// is not checked/enforced.
	Owner string
	// Group is the expected group owner (e.g. "opksshuser"). An empty
	// string means group ownership is not checked/enforced.
	Group string
	// MustExist indicates whether the resource is required to exist for the
	// system to function correctly.
	MustExist bool
}

type PermsChecker struct {
	Fs        afero.Fs
	CmdRunner func(string, ...string) ([]byte, error)
}

type RowDetails struct {
	Columns []string
	Content string
	Empty   bool
	Error   error
}

type Table struct {
	// contains filtered or unexported fields
}

type UnixACLVerifier struct {
	Fs afero.Fs
}