//go:build !windows

package main

import (
	"crypto/sha256"
	"encoding/hex"
	"os"
	"os/exec"
	"path/filepath"
	"regexp"
	"strings"
	"testing"
)

// installShFunc returns one shell function's text from deploy/install.sh.
func installShFunc(t *testing.T, name string) string {
	t.Helper()
	raw, err := os.ReadFile(filepath.Join("..", "deploy", "install.sh"))
	if err != nil {
		t.Fatal(err)
	}
	m := regexp.MustCompile(`(?ms)^` + regexp.QuoteMeta(name) + `\(\) \{\n.*?^\}\n`).Find(raw)
	if m == nil {
		t.Fatalf("install.sh defines no %s()", name)
	}
	return string(m)
}

// TestInstallShKeepsAPairedLocalMachineLocal: a root reinstall defaults to
// networked, except on a machine already paired in local mode, which keeps
// its mode (paired_local). Switched, its pairing would sit on an unanchored
// networked machine, which refuses every op until claim-anchor.
func TestInstallShKeepsAPairedLocalMachineLocal(t *testing.T) {
	fn := installShFunc(t, "paired_local")
	run := func(dirs ...string) bool {
		t.Helper()
		args := append([]string{"-c", fn + `paired_local "$@"`, "sh"}, dirs...)
		err := exec.Command("sh", args...).Run()
		if _, ok := err.(*exec.ExitError); err != nil && !ok {
			t.Fatal(err)
		}
		return err == nil
	}
	mk := func(t *testing.T, files map[string]string) string {
		t.Helper()
		d := t.TempDir()
		for name, body := range files {
			p := filepath.Join(d, name)
			if err := os.MkdirAll(filepath.Dir(p), 0o700); err != nil {
				t.Fatal(err)
			}
			if err := os.WriteFile(p, []byte(body), 0o600); err != nil {
				t.Fatal(err)
			}
		}
		return d
	}
	missing := filepath.Join(t.TempDir(), "none")

	if !run(mk(t, map[string]string{"pairings/a.host.example.json": "{}"}), missing) {
		t.Fatal("a paired machine with no mode file is local and must stay local")
	}
	if !run(mk(t, map[string]string{"pairings/a.json": "{}", "mode.json": `{"mode":"local"}`})) {
		t.Fatal("a paired machine in local mode must stay local")
	}
	if !run(mk(t, map[string]string{"config.json": "{}"})) {
		t.Fatal("a pre-0.10 single pairing (config.json) is a pairing")
	}
	if !run(missing, mk(t, map[string]string{"pairings/a.json": "{}"})) {
		t.Fatal("a pairing in the second folder counts")
	}
	if run(mk(t, map[string]string{"pairings/a.json": "{}", "mode.json": "{\n  \"mode\": \"networked\"\n}"})) {
		t.Fatal("a networked machine is not kept local")
	}
	if run(mk(t, map[string]string{"pairings/.keep": ""}), missing) {
		t.Fatal("a machine with no pairing gets the networked default")
	}
}

// installShPrivatePIDs is what a test that reaches install.sh's
// start_bastion runs under. start_bastion stops every copy of this user's
// bastion it can see in /proc, and on a machine that runs a real bastion as
// this user (root on a server) that would be the real one. So the test must
// see only its own processes: nil when it already runs in a PID namespace of
// its own (CI's container), the unshare prefix that makes one when it can,
// and a skip otherwise.
//
// The machine's own PID namespace is the kernel's initial one, whose number
// is fixed (PROC_PID_INIT_INO, 0xEFFFFFFC); any other is a namespace of its
// own. NSpid in /proc/self/status cannot tell: inside a container /proc is
// the container's, so it shows one level there too.
func installShPrivatePIDs(t *testing.T) []string {
	t.Helper()
	ns, err := os.Readlink("/proc/self/ns/pid")
	if err == nil && ns != "pid:[4026531836]" {
		return nil
	}
	if err == nil && os.Geteuid() == 0 {
		if u, err := exec.LookPath("unshare"); err == nil {
			wrap := []string{u, "--pid", "--fork", "--mount-proc"}
			if exec.Command(wrap[0], append(wrap[1:], "true")...).Run() == nil {
				return wrap
			}
		}
	}
	t.Skip("install.sh's start_bastion stops every copy of this user's bastion; run this test in a PID namespace of its own (unshare --pid --fork --mount-proc, as root)")
	return nil
}

// pairShSetup is a stand-in machine for install.sh: a log directory, a
// home, and a PATH directory of stand-ins for systemctl, loginctl and sleep,
// each logging what it was given. unit is how the stand-in systemd reports
// the user unit: "steady" (one process, running) or "flapping" (a new
// process on every look, auto-restarting).
type pairShSetup struct {
	dir, logs, bin, path, home string
}

func newPairShSetup(t *testing.T) *pairShSetup {
	t.Helper()
	d := t.TempDir()
	s := &pairShSetup{dir: d, logs: filepath.Join(d, "log"), bin: filepath.Join(d, "bin"), path: filepath.Join(d, "path"), home: filepath.Join(d, "home")}
	for _, p := range []string{s.logs, s.bin, s.path, s.home} {
		if err := os.MkdirAll(p, 0o700); err != nil {
			t.Fatal(err)
		}
	}
	s.write(t, filepath.Join(s.path, "systemctl"), `#!/bin/sh
echo "$*" >> "$LOGS/systemctl"
case "$*" in
  *"show -p MainPID --value"*)
    if [ "$UNIT" = flapping ]; then n=$(cat "$LOGS/n" 2>/dev/null || echo 100); n=$((n + 1)); echo "$n" > "$LOGS/n"; echo "$n"; else echo 4242; fi ;;
  *"show -p ActiveState --value"*) if [ "$UNIT" = flapping ]; then echo activating; else echo active; fi ;;
  *"show -p SubState --value"*) if [ "$UNIT" = flapping ]; then echo auto-restart; else echo running; fi ;;
esac
exit 0
`)
	s.write(t, filepath.Join(s.path, "loginctl"), "#!/bin/sh\necho \"$*\" >> \"$LOGS/loginctl\"\nexit \"$LINGER_RC\"\n")
	s.write(t, filepath.Join(s.path, "sleep"), "#!/bin/sh\nexit 0\n")
	return s
}

func (s *pairShSetup) write(t *testing.T, p, body string) {
	t.Helper()
	if err := os.WriteFile(p, []byte(body), 0o700); err != nil {
		t.Fatal(err)
	}
}

func (s *pairShSetup) env(extra ...string) []string {
	return append([]string{"PATH=" + s.path + ":/usr/bin:/bin", "HOME=" + s.home, "XDG_CONFIG_HOME=" + filepath.Join(s.home, ".config"),
		"LOGS=" + s.logs, "TMPDIR=" + s.dir}, extra...)
}

// standInCopy puts a copy of this test binary at dir/privatae-bastion: run
// with installShStandInRun it is a bastion that waits to be stopped, under
// the program name install.sh looks for.
func standInCopy(t *testing.T, dir string) string {
	t.Helper()
	self, err := os.Executable()
	if err != nil {
		t.Fatal(err)
	}
	b, err := os.ReadFile(self)
	if err != nil {
		t.Fatal(err)
	}
	p := filepath.Join(dir, "privatae-bastion")
	if err := os.WriteFile(p, b, 0o755); err != nil {
		t.Fatal(err)
	}
	return p
}

// pairShHarness runs install.sh's pairing functions against a stand-in
// bastion, systemctl and loginctl. It returns the run's output, the log
// directory and its error. With copyRunning, a copy of the bastion from another
// path is running when the functions start, and log/copy says whether it
// still was when they ended.
func pairShHarness(t *testing.T, root, pairRC, lingerRC string) (string, string, error) {
	t.Helper()
	return pairShHarnessWith(t, root, pairRC, lingerRC, "steady", false)
}

func pairShHarnessWith(t *testing.T, root, pairRC, lingerRC, unit string, copyRunning bool) (string, string, error) {
	t.Helper()
	wrap := installShPrivatePIDs(t)
	s := newPairShSetup(t)
	fake := filepath.Join(s.bin, "privatae-bastion")
	s.write(t, fake, `#!/bin/sh
echo "HOME=$HOME $*" >> "$LOGS/argv"
case "$1" in
  pair) cat > "$LOGS/stdin"; exit "$PAIR_RC" ;;
  status) echo "status: paired" ;;
esac
exit 0
`)
	copyPath := ""
	if copyRunning {
		other := filepath.Join(s.dir, "other-install")
		if err := os.MkdirAll(other, 0o700); err != nil {
			t.Fatal(err)
		}
		copyPath = standInCopy(t, other)
	}
	fns := installShFunc(t, "pair_as") + installShFunc(t, "bastion_copy") + installShFunc(t, "stop_user_copies") +
		installShFunc(t, "user_unit_stays_up") + installShFunc(t, "start_bastion") + installShFunc(t, "pair_and_start")
	script := fns + `
if [ -n "$COPY" ]; then
  "$COPY" ` + installShStandInRun + ` >/dev/null 2>&1 &
  copy=$!
  i=0
  while ! bastion_copy "$copy" && [ "$i" -lt 100 ]; do i=$((i + 1)); /bin/sleep 0.05; done
  bastion_copy "$copy" || { echo "the stand-in copy never started" >&2; exit 97; }
fi
rc=0
pair_and_start "$1" "$2" "$3" linux || rc=$?
if [ -n "$COPY" ]; then
  if bastion_copy "$copy"; then echo alive > "$LOGS/copy"; kill -9 "$copy"; else echo gone > "$LOGS/copy"; fi
fi
exit "$rc"
`
	args := append(append([]string{}, wrap...), "sh", "-c", script, "sh", fake, "skp_INVENTEDCODE", root)
	cmd := exec.Command(args[0], args[1:]...)
	cmd.Env = s.env("PAIR_RC="+pairRC, "LINGER_RC="+lingerRC, "UNIT="+unit, "COPY="+copyPath)
	out, err := cmd.CombinedOutput()
	return string(out), s.logs, err
}

func readPairShLog(t *testing.T, dir, name string) string {
	t.Helper()
	b, _ := os.ReadFile(filepath.Join(dir, name))
	return string(b)
}

// The pairing functions hand the code to `pair -` on standard input, never
// as an argument, then write and start a systemd user unit, ask for
// lingering, and end with one plain sentence. Exit 3 (already paired with
// this Host) is success.
func TestInstallShPairsOverStdinAndStartsAUserUnit(t *testing.T) {
	out, logs, err := pairShHarness(t, "0", "0", "0")
	if err != nil {
		t.Fatalf("%v\n%s", err, out)
	}
	argv := readPairShLog(t, logs, "argv")
	if !strings.Contains(argv, " pair -\n") || strings.Contains(argv, "skp_") {
		t.Fatalf("the code must reach `pair -` on stdin and never an argument: %q", argv)
	}
	if got := readPairShLog(t, logs, "stdin"); got != "skp_INVENTEDCODE\n" {
		t.Fatalf("pair's standard input: %q", got)
	}
	home := strings.TrimPrefix(strings.Fields(argv)[0], "HOME=")
	unit, err := os.ReadFile(filepath.Join(home, ".config", "systemd", "user", "privatae-bastion.service"))
	if err != nil || !regexp.MustCompile(`(?m)^ExecStart=\S+/privatae-bastion run$`).Match(unit) || !strings.Contains(string(unit), "WantedBy=default.target") {
		t.Fatalf("the user unit: %v\n%s", err, unit)
	}
	sc := readPairShLog(t, logs, "systemctl")
	for _, want := range []string{"--user daemon-reload", "--user enable privatae-bastion", "--user restart privatae-bastion"} {
		if !strings.Contains(sc, want+"\n") {
			t.Fatalf("systemctl was not asked to %q: %q", want, sc)
		}
	}
	if !strings.Contains(readPairShLog(t, logs, "loginctl"), "enable-linger ") {
		t.Fatal("lingering was not asked for")
	}
	if !strings.Contains(out, "status: paired") || !strings.HasSuffix(strings.TrimSpace(out),
		"This machine is paired. The bastion runs as your systemd user service privatae-bastion, and starts at boot.") {
		t.Fatalf("the ending: %s", out)
	}

	out, _, err = pairShHarness(t, "0", "3", "1")
	if err != nil || !strings.Contains(out, "already paired with this Host") || !strings.Contains(out, "sudo loginctl enable-linger") {
		t.Fatalf("exit 3 is success, and a refused linger says how to get it: %v\n%s", err, out)
	}

	out, logs, err = pairShHarness(t, "0", "1", "0")
	if err == nil || strings.Contains(readPairShLog(t, logs, "systemctl"), "restart") || !strings.Contains(out, "pairing did not finish") {
		t.Fatalf("a failed pair must stop before starting anything: %v\n%s", err, out)
	}

	out, logs, err = pairShHarness(t, "1", "0", "0")
	if err != nil || !strings.Contains(readPairShLog(t, logs, "argv"), "HOME=/root ") ||
		readPairShLog(t, logs, "systemctl") != "restart privatae-bastion\n" || strings.Contains(out, "user service") {
		t.Fatalf("as root it pairs as the service's state and restarts the system service: %v\n%s\n%s", err, out, readPairShLog(t, logs, "systemctl"))
	}
}

// Linux, as yourself: a copy of the bastion already running outside the
// user unit (from a terminal, or another path) is stopped before the unit
// starts, so the unit's copy is the one that serves; and a unit that does not
// stay up is said plainly, with a failure, never reported as running.
func TestInstallShStopsAnOutsideCopyAndChecksTheUnitStaysUp(t *testing.T) {
	out, logs, err := pairShHarnessWith(t, "0", "0", "0", "steady", true)
	if err != nil {
		t.Fatalf("%v\n%s", err, out)
	}
	if got := strings.TrimSpace(readPairShLog(t, logs, "copy")); got != "gone" {
		t.Fatalf("the copy running outside the unit must be stopped, it is %q\n%s", got, out)
	}
	if !strings.Contains(out, "Stopped 1 copy(ies) of the bastion running outside its service") {
		t.Fatalf("the stop is said: %s", out)
	}
	sc := readPairShLog(t, logs, "systemctl")
	if i, j := strings.Index(sc, "--user stop privatae-bastion\n"), strings.Index(sc, "--user restart privatae-bastion\n"); i < 0 || j < i {
		t.Fatalf("the unit is stopped before the copies and started after: %q", sc)
	}
	if !strings.HasSuffix(strings.TrimSpace(out), "This machine is paired. The bastion runs as your systemd user service privatae-bastion, and starts at boot.") {
		t.Fatalf("the ending: %s", out)
	}

	out, _, err = pairShHarnessWith(t, "0", "0", "0", "flapping", false)
	if err == nil || !strings.Contains(out, "is not staying up") || !strings.Contains(out, "activating/auto-restart") ||
		!strings.Contains(out, "journalctl --user -u privatae-bastion") || strings.Contains(out, "The bastion runs as your systemd user service") {
		t.Fatalf("a unit that restarts must be reported as not running, and fail: %v\n%s", err, out)
	}
}

// The whole of install.sh, the card's way: the code in PRIVATAE_PAIR_CODE
// and no argument. Every program it starts (stand-ins for uname, id, curl,
// printf, systemctl, loginctl and sleep, and the downloaded bastion) records
// its own arguments, the command line of the shell that started it, and
// whether the code is in its environment. The code must reach `pair -` on
// standard input and appear in none of those. Nothing leaves this machine:
// curl is a stand-in serving a manifest and a stand-in bastion.
func TestInstallShTakesTheCodeOnlyFromTheEnvironment(t *testing.T) {
	wrap := installShPrivatePIDs(t)
	s := newPairShSetup(t)
	const code = "skp_eyJ2IjoxLCJ0IjoiSU5WRU5URUQtRU5WLUNPREUifQ"
	record := `echo "$(basename "$0") argv=[$*] parent=[$(tr '\0' ' ' < /proc/$PPID/cmdline)] env=[${PRIVATAE_PAIR_CODE+set}] envcode=[$(env | grep -c "` + code + `")]" >> "$LOGS/procs"
`
	bastion := "#!/bin/sh\n" + record + `case "$1" in
  pair) cat > "$LOGS/stdin" ;;
  status) echo "status: paired" ;;
esac
exit 0
`
	s.write(t, filepath.Join(s.dir, "bastion.bin"), bastion)
	sum := sha256.Sum256([]byte(bastion))
	s.write(t, filepath.Join(s.dir, "version.json"), "{\n  \"linux-amd64\": {\n    \"url\": \"https://dl.privatae.ai/dl/privatae-bastion-linux-amd64?v=0.0.0\",\n    \"sha256\": \""+hex.EncodeToString(sum[:])+"\"\n  }\n}\n")
	stand := map[string]string{
		"uname":  `case "$1" in -s) echo Linux ;; -m) echo x86_64 ;; *) echo Linux ;; esac`,
		"id":     `case "$1" in -u) echo 1000 ;; -un) echo tester ;; *) echo "uid=1000(tester)" ;; esac`,
		"curl":   `for a; do o=$a; done; case "$2" in */version.json) cp "$STAND/version.json" "$o" ;; *) cp "$STAND/bastion.bin" "$o" ;; esac`,
		"printf": `exec /usr/bin/printf "$@"`,
	}
	for name, body := range stand {
		s.write(t, filepath.Join(s.path, name), "#!/bin/sh\n"+record+body+"\n")
	}
	for _, name := range []string{"systemctl", "loginctl", "sleep"} {
		p := filepath.Join(s.path, name)
		b, _ := os.ReadFile(p)
		s.write(t, p, strings.Replace(string(b), "#!/bin/sh\n", "#!/bin/sh\n"+record, 1))
	}
	sh, err := filepath.Abs(filepath.Join("..", "deploy", "install.sh"))
	if err != nil {
		t.Fatal(err)
	}
	args := append(append([]string{}, wrap...), "sh", sh)
	cmd := exec.Command(args[0], args[1:]...)
	cmd.Env = s.env("PRIVATAE_PAIR_CODE="+code, "STAND="+s.dir, "LINGER_RC=0", "UNIT=steady")
	out, err := cmd.CombinedOutput()
	if err != nil {
		t.Fatalf("%v\n%s", err, out)
	}
	if got := readPairShLog(t, s.logs, "stdin"); got != code+"\n" {
		t.Fatalf("pair's standard input: %q\n%s", got, out)
	}
	procs := readPairShLog(t, s.logs, "procs")
	for _, who := range []string{"uname argv=[-s]", "curl argv=[", "privatae-bastion argv=[pair -]", "privatae-bastion argv=[status]", "systemctl argv=[--user restart privatae-bastion]"} {
		if !strings.Contains(procs, who) {
			t.Fatalf("no record of %q: the stand-ins did not run as expected\n%s\n%s", who, procs, out)
		}
	}
	if strings.Contains(procs, code) || strings.Contains(procs, "INVENTED-ENV-CODE") {
		t.Fatalf("the code is in a program's arguments or its shell's command line:\n%s", procs)
	}
	if strings.Contains(procs, "env=[set]") || !strings.Contains(procs, "envcode=[0]") || strings.Contains(procs, "envcode=[1]") {
		t.Fatalf("a program the installer started inherited the code in its environment:\n%s", procs)
	}
	if strings.Contains(string(out), code) {
		t.Fatalf("the installer printed the code:\n%s", out)
	}
	if !strings.HasSuffix(strings.TrimSpace(string(out)), "https://privatae.ai/bastion/LICENSE.txt") || !strings.Contains(string(out), "This machine is paired.") {
		t.Fatalf("the ending: %s", out)
	}
}

// A PRIVATAE_PAIR_CODE that is empty or not a whole pairing code is refused
// before anything is downloaded, and never echoed; so is any argument, a
// code given as one (the removed --pair, or the code alone) included.
//
// The script runs with stand-ins for id (not root) and curl (records that it
// was reached, fetches nothing), so an installer whose refusal broke can
// neither reach the network nor install anything as root on the machine
// running the test: it fails here instead.
func TestInstallShRefusesABadPairCodeBeforeDownloading(t *testing.T) {
	const code = "skp_eyJ2IjoxfQ"
	stand := t.TempDir()
	for name, body := range map[string]string{
		"id":   `case "$1" in -u) echo 1000 ;; -un) echo tester ;; *) echo "uid=1000(tester)" ;; esac`,
		"curl": `echo "REACHED-THE-DOWNLOAD" >&2; exit 1`,
	} {
		if err := os.WriteFile(filepath.Join(stand, name), []byte("#!/bin/sh\n"+body+"\n"), 0o700); err != nil {
			t.Fatal(err)
		}
	}
	for _, c := range []struct {
		env  []string
		args []string
	}{
		{[]string{"PRIVATAE_PAIR_CODE="}, nil},
		{[]string{"PRIVATAE_PAIR_CODE=skp_"}, nil},
		{[]string{"PRIVATAE_PAIR_CODE=skb_aG9tZS5zZWNyZXQteA"}, nil},
		{[]string{"PRIVATAE_PAIR_CODE=" + code + " trailing"}, nil},
		{[]string{"PRIVATAE_PAIR_CODE=" + code + "%3D"}, nil},
		{nil, []string{"--pair", code}},
		{nil, []string{"--pair=" + code}},
		{nil, []string{code}},
		{nil, []string{"--networkd"}},
	} {
		home := t.TempDir()
		cmd := exec.Command("sh", append([]string{filepath.Join("..", "deploy", "install.sh")}, c.args...)...)
		cmd.Env = append([]string{"PATH=" + stand + ":/usr/bin:/bin", "HOME=" + home, "TMPDIR=" + home}, c.env...)
		out, err := cmd.CombinedOutput()
		ee, ok := err.(*exec.ExitError)
		if !ok || ee.ExitCode() != 2 || strings.Contains(string(out), "Fetching manifest") || strings.Contains(string(out), "REACHED-THE-DOWNLOAD") {
			t.Fatalf("%v %v: want exit 2 before the download, got %v\n%s", c.env, c.args, err, out)
		}
		if strings.Contains(string(out), code) || strings.Contains(string(out), "skb_") || strings.Contains(string(out), "networkd") {
			t.Fatalf("%v %v: the refusal echoes what it was given: %s", c.env, c.args, out)
		}
	}
}