using System.Runtime.InteropServices;
using System.Security.Principal;

namespace Agent.Windows.Security;

public sealed partial class AppContainerProfile
{
    public const string FixedName = "AgentSandboxMcp.V1";
    private const int AlreadyExists = unchecked((int)0x800700B7);

    private AppContainerProfile(string name, SecurityIdentifier sid) { Name = name; Sid = sid; }
    public string Name { get; }
    public SecurityIdentifier Sid { get; }

    public static AppContainerProfile EnsureFixed()
    {
        int result = Native.CreateAppContainerProfile(FixedName, "Agent Sandbox MCP v1", "Fixed sandbox profile for Agent Sandbox MCP", 0, 0, out nint sidPointer);
        if (result == AlreadyExists) result = Native.DeriveAppContainerSidFromAppContainerName(FixedName, out sidPointer);
        if (result < 0) Marshal.ThrowExceptionForHR(result);
        try
        {
            return new(FixedName, new SecurityIdentifier(sidPointer));
        }
        finally
        {
            if (sidPointer != 0) _ = Native.FreeSid(sidPointer);
        }
    }

    public static AppContainerProfile DeriveFixed()
    {
        int result = Native.DeriveAppContainerSidFromAppContainerName(FixedName, out nint sidPointer);
        if (result < 0) Marshal.ThrowExceptionForHR(result);
        try { return new(FixedName, new SecurityIdentifier(sidPointer)); }
        finally { if (sidPointer != 0) _ = Native.FreeSid(sidPointer); }
    }

    private static partial class Native
    {
        [LibraryImport("userenv.dll", StringMarshalling = StringMarshalling.Utf16)]
        internal static partial int CreateAppContainerProfile(string name, string displayName, string description, nint capabilities, uint capabilityCount, out nint sid);

        [LibraryImport("userenv.dll", StringMarshalling = StringMarshalling.Utf16)]
        internal static partial int DeriveAppContainerSidFromAppContainerName(string name, out nint sid);

        [LibraryImport("advapi32.dll")]
        internal static partial nint FreeSid(nint sid);
    }
}