"""Rsync remote receiver elevation — mirrors ``files_elevation`` for file push.

Policy (same as file manager): **root** SSH → no sudo; **non-root** with default
``auto_sudo`` (or ``always_sudo``) → ``sudo -n rsync`` on the receiver.
Only ``files_elevation=off`` disables elevation.
"""

from __future__ import annotations

from server.domain.models import Server
from server.utils.files_elevation import FilesElevation, get_files_elevation

# Fixed remote receiver command (no user input); requires NOPASSWD rsync in sudoers.
RSYNC_SUDO_RECEIVER_PATH = "sudo -n rsync"


def is_root_ssh_user(server: Server) -> bool:
    ssh_user = (server.username or "root").strip() or "root"
    return ssh_user == "root"


def rsync_receiver_path_for_push(server: Server) -> str | None:
    """Return ``--rsync-path`` for non-root servers when elevation is enabled."""
    if is_root_ssh_user(server):
        return None
    if get_files_elevation(server) == FilesElevation.OFF:
        return None
    return RSYNC_SUDO_RECEIVER_PATH


def rsync_elevation_log_hint(server: Server) -> str | None:
    """Short tag for sync_logs.push_permission."""
    if is_root_ssh_user(server):
        return None
    if get_files_elevation(server) == FilesElevation.OFF:
        return None
    return "rsync=sudo"