import { randomUUID } from 'node:crypto'
import {
  closeSync,
  fchmodSync,
  fsyncSync,
  mkdirSync,
  openSync,
  renameSync,
  rmSync,
  writeFileSync,
} from 'node:fs'
import { dirname } from 'node:path'

export function writeSecureJsonAtomic(filepath: string, value: unknown): void {
  mkdirSync(dirname(filepath), { recursive: true })
  const temporary = `${filepath}.tmp-${process.pid}-${randomUUID()}`
  let descriptor: number | null = null
  try {
    descriptor = openSync(temporary, 'wx', 0o600)
    fchmodSync(descriptor, 0o600)
    writeFileSync(descriptor, `${JSON.stringify(value, null, 2)}\n`)
    fsyncSync(descriptor)
    closeSync(descriptor)
    descriptor = null
    renameSync(temporary, filepath)
  } catch (error) {
    if (descriptor !== null) closeSync(descriptor)
    rmSync(temporary, { force: true })
    throw error
  }
}