#!/usr/bin/env bash

# Regression test for the NTFS mask used by the recovery volume. The 0177
# file mask removes owner execute plus every group/other permission, producing
# mode 0600 for the KeePass database and LUKS container.
set -Eeuo pipefail

readonly REPOSITORY_ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd -P)"
readonly VALIDATOR_PATH="${REPOSITORY_ROOT}/scripts/validate/k3s-local-recovery.sh"

# shellcheck source=/dev/null
source "$VALIDATOR_PATH"

readonly LIVE_SAFE_OPTIONS='rw,nosuid,nodev,noexec,relatime,uid=1000,gid=1000,dmask=0077,fmask=0177,iocharset=utf8'

if ! _k3slrv_outer_masks_secure "$LIVE_SAFE_OPTIONS"; then
  printf '%s\n' \
    'TEST FAILURE: recovery validator rejected secure fmask=0177' >&2
  exit 1
fi

printf '%s\n' 'PASS: recovery validator accepts secure fmask=0177'