// Copyright 2012 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#ifndef REMOTING_HOST_WIN_UNPRIVILEGED_PROCESS_DELEGATE_H_
#define REMOTING_HOST_WIN_UNPRIVILEGED_PROCESS_DELEGATE_H_

#include <stdint.h>

#include <memory>
#include <optional>
#include <string>
#include <vector>

#include "base/compiler_specific.h"
#include "base/memory/raw_ptr.h"
#include "base/memory/scoped_refptr.h"
#include "base/sequence_checker.h"
#include "base/win/scoped_handle.h"
#include "base/win/sid.h"
#include "ipc/ipc_listener.h"
#include "mojo/public/cpp/bindings/associated_remote.h"
#include "mojo/public/cpp/bindings/generic_pending_associated_receiver.h"
#include "mojo/public/cpp/bindings/scoped_interface_endpoint_handle.h"
#include "remoting/host/mojom/desktop_session.mojom.h"
#include "remoting/host/win/security_descriptor.h"
#include "remoting/host/win/windows_process_delegate.h"

namespace base {
class CommandLine;
class SingleThreadTaskRunner;
}  // namespace base

namespace IPC {
class ChannelProxy;
}  // namespace IPC

namespace remoting {

// Implements logic for launching and monitoring a worker process under a less
// privileged user account.
class UnprivilegedProcessDelegate : public IPC::Listener,
                                    public WindowsProcessDelegate {
 public:
  enum class IntegrityLevel {
    kLow,
    kUntrusted,
  };

  UnprivilegedProcessDelegate(
      scoped_refptr<base::SingleThreadTaskRunner> io_task_runner,
      std::unique_ptr<base::CommandLine> target_command,
      IntegrityLevel integrity_level);

  UnprivilegedProcessDelegate(const UnprivilegedProcessDelegate&) = delete;
  UnprivilegedProcessDelegate& operator=(const UnprivilegedProcessDelegate&) =
      delete;

  ~UnprivilegedProcessDelegate() override;

  // If non-empty, the worker process will be launched inside an AppContainer
  // with the specified profile name.
  void UseAppContainer(const std::wstring& profile_name);

  // WorkerProcessLauncher::Delegate implementation.
  void LaunchProcess(WorkerProcessLauncher* event_handler) override;
  void GetRemoteAssociatedInterface(
      mojo::GenericPendingAssociatedReceiver receiver) override;
  void CloseChannel() override;
  void CrashProcess(const base::Location& location) override;
  void KillProcess() override;

 protected:
  virtual void ReportProcessLaunched(base::win::ScopedHandle worker_process);

 private:
  friend class UnprivilegedProcessDelegateTest;

  struct AppContainer {
    AppContainer();
    AppContainer(AppContainer&&);
    AppContainer& operator=(AppContainer&&);
    ~AppContainer();

    SECURITY_CAPABILITIES GetSecurityCapabilities();

    ScopedSid package_sid;
    std::vector<base::win::Sid> capability_sids;
    std::vector<SID_AND_ATTRIBUTES> capabilities;
    std::wstring profile_name;
  };

  static std::optional<AppContainer> CreateAppContainer(
      const std::wstring& profile_name);

  // IPC::Listener implementation.
  void OnChannelConnected(int32_t peer_pid) override;
  void OnChannelError() override;
  void OnAssociatedInterfaceRequest(
      const std::string& interface_name,
      mojo::ScopedInterfaceEndpointHandle handle) override;

  void ReportFatalError();

  // The task runner serving job object notifications.
  scoped_refptr<base::SingleThreadTaskRunner> io_task_runner_;

  // Command line of the launched process.
  std::unique_ptr<base::CommandLine> target_command_;

  // The server end of the IPC channel used to communicate to the worker
  // process.
  std::unique_ptr<IPC::ChannelProxy> channel_;

  mojo::AssociatedRemote<mojom::WorkerProcessControl> worker_process_control_;

  IntegrityLevel integrity_level_;
  std::wstring app_container_profile_name_;
  std::optional<AppContainer> app_container_;

  SEQUENCE_CHECKER(sequence_checker_);
};

}  // namespace remoting

#endif  // REMOTING_HOST_WIN_UNPRIVILEGED_PROCESS_DELEGATE_H_