//go:build !windows

package main

import (
	"crypto/sha256"
	"encoding/hex"
	"os"
	"os/exec"
	"path/filepath"
	"regexp"
	"strings"
	"testing"
)

// installShFunc returns one shell function's text from deploy/install.sh.
func installShFunc(t *testing.T, name string) string {
	t.Helper()
	raw, err := os.ReadFile(filepath.Join("..", "deploy", "install.sh"))
	if err != nil {
		t.Fatal(err)
	}
	m := regexp.MustCompile(`(?ms)^` + regexp.QuoteMeta(name) + `\(\) \{\n.*?^\}\n`).Find(raw)
	if m == nil {
		t.Fatalf("install.sh defines no %s()", name)
	}
	return string(m)
}

// TestInstallShKeepsAPairedLocalMachineLocal: a root reinstall defaults to
// networked, except on a machine already paired in local mode, which keeps
// its mode (paired_local). Switched, its pairing would sit on an unanchored
// networked machine, which refuses every op until claim-anchor.
func TestInstallShKeepsAPairedLocalMachineLocal(t *testing.T) {
	fn := installShFunc(t, "paired_local")
	run := func(dirs ...string) bool {
		t.Helper()
		args := append([]string{"-c", fn + `paired_local "$@"`, "sh"}, dirs...)
		err := exec.Command("sh", args...).Run()
		if _, ok := err.(*exec.ExitError); err != nil && !ok {
			t.Fatal(err)
		}
		return err == nil
	}
	mk := func(t *testing.T, files map[string]string) string {
		t.Helper()
		d := t.TempDir()
		for name, body := range files {
			p := filepath.Join(d, name)
			if err := os.MkdirAll(filepath.Dir(p), 0o700); err != nil {
				t.Fatal(err)
			}
			if err := os.WriteFile(p, []byte(body), 0o600); err != nil {
				t.Fatal(err)
			}
		}
		return d
	}
	missing := filepath.Join(t.TempDir(), "none")

	if !run(mk(t, map[string]string{"pairings/a.host.example.json": "{}"}), missing) {
		t.Fatal("a paired machine with no mode file is local and must stay local")
	}
	if !run(mk(t, map[string]string{"pairings/a.json": "{}", "mode.json": `{"mode":"local"}`})) {
		t.Fatal("a paired machine in local mode must stay local")
	}
	if !run(mk(t, map[string]string{"config.json": "{}"})) {
		t.Fatal("a pre-0.10 single pairing (config.json) is a pairing")
	}
	if !run(missing, mk(t, map[string]string{"pairings/a.json": "{}"})) {
		t.Fatal("a pairing in the second folder counts")
	}
	if run(mk(t, map[string]string{"pairings/a.json": "{}", "mode.json": "{\n  \"mode\": \"networked\"\n}"})) {
		t.Fatal("a networked machine is not kept local")
	}
	if run(mk(t, map[string]string{"pairings/.keep": ""}), missing) {
		t.Fatal("a machine with no pairing gets the networked default")
	}
}

// installShPrivatePIDs is what a test that reaches install.sh's
// start_bastion runs under. start_bastion stops every copy of this user's
// bastion it can see in /proc, and on a machine that runs a real bastion as
// this user (root on a server) that would be the real one. So the test must
// see only its own processes: nil when it already runs in a PID namespace of
// its own (CI's container), the unshare prefix that makes one when it can,
// and a skip otherwise.
//
// The machine's own PID namespace is the kernel's initial one, whose number
// is fixed (PROC_PID_INIT_INO, 0xEFFFFFFC); any other is a namespace of its
// own. NSpid in /proc/self/status cannot tell: inside a container /proc is
// the container's, so it shows one level there too.
func installShPrivatePIDs(t *testing.T) []string {
	t.Helper()
	ns, err := os.Readlink("/proc/self/ns/pid")
	if err == nil && ns != "pid:[4026531836]" {
		return nil
	}
	if err == nil && os.Geteuid() == 0 {
		if u, err := exec.LookPath("unshare"); err == nil {
			wrap := []string{u, "--pid", "--fork", "--mount-proc"}
			if exec.Command(wrap[0], append(wrap[1:], "true")...).Run() == nil {
				return wrap
			}
		}
	}
	t.Skip("install.sh's start_bastion stops every copy of this user's bastion; run this test in a PID namespace of its own (unshare --pid --fork --mount-proc, as root)")
	return nil
}

// installShHere is a copy of deploy/install.sh whose machine_install_present
// looks in dir instead of the machine running the test, which may well have
// the bastion installed for the whole machine. machine says whether the copy
// finds one there.
func installShHere(t *testing.T, dir string, machine bool) string {
	t.Helper()
	raw, err := os.ReadFile(filepath.Join("..", "deploy", "install.sh"))
	if err != nil {
		t.Fatal(err)
	}
	fn := installShFunc(t, "machine_install_present")
	unit := filepath.Join(dir, "machine-unit")
	if machine {
		if err := os.WriteFile(unit, nil, 0o600); err != nil {
			t.Fatal(err)
		}
	}
	here := "machine_install_present() {\n  [ -f '" + unit + "' ]\n}\n"
	out := filepath.Join(dir, "install.sh")
	if err := os.WriteFile(out, []byte(strings.Replace(string(raw), fn, here, 1)), 0o600); err != nil {
		t.Fatal(err)
	}
	return out
}

// pairShSetup is a stand-in machine for install.sh: a log directory, a
// home, and a PATH directory of stand-ins for systemctl, loginctl and sleep,
// each logging what it was given. unit is how the stand-in systemd reports
// the user unit: "steady" (one process, running) or "flapping" (a new
// process on every look, auto-restarting).
type pairShSetup struct {
	dir, logs, bin, path, home string
}

func newPairShSetup(t *testing.T) *pairShSetup {
	t.Helper()
	d := t.TempDir()
	s := &pairShSetup{dir: d, logs: filepath.Join(d, "log"), bin: filepath.Join(d, "bin"), path: filepath.Join(d, "path"), home: filepath.Join(d, "home")}
	for _, p := range []string{s.logs, s.bin, s.path, s.home} {
		if err := os.MkdirAll(p, 0o700); err != nil {
			t.Fatal(err)
		}
	}
	s.write(t, filepath.Join(s.path, "systemctl"), `#!/bin/sh
echo "$*" >> "$LOGS/systemctl"
case "$*" in
  *"show -p MainPID --value"*)
    if [ "$UNIT" = flapping ]; then n=$(cat "$LOGS/n" 2>/dev/null || echo 100); n=$((n + 1)); echo "$n" > "$LOGS/n"; echo "$n"; else echo 4242; fi ;;
  *"show -p ActiveState --value"*) if [ "$UNIT" = flapping ]; then echo activating; else echo active; fi ;;
  *"show -p SubState --value"*) if [ "$UNIT" = flapping ]; then echo auto-restart; else echo running; fi ;;
esac
exit 0
`)
	s.write(t, filepath.Join(s.path, "loginctl"), "#!/bin/sh\necho \"$*\" >> \"$LOGS/loginctl\"\nexit \"$LINGER_RC\"\n")
	s.write(t, filepath.Join(s.path, "sleep"), "#!/bin/sh\nexit 0\n")
	// sudo is ALWAYS a stand-in. The suite runs as root, and the installer run
	// as a pretend ordinary account installs for the whole machine through
	// sudo: the real one would hand the published installer to root on the
	// machine running the test. This one refuses, as sudo does for an account
	// that may not use it, unless a test says otherwise (sudoStandIn).
	s.write(t, filepath.Join(s.path, "sudo"), sudoRefuses)
	return s
}

// sudoRefuses is sudo for an account that may not use it.
const sudoRefuses = "#!/bin/sh\necho \"sudo $*\" >> \"${LOGS:-/dev/null}\"/sudo 2>/dev/null\necho \"Sorry, user tester may not run sudo.\" >&2\nexit 1\n"

func (s *pairShSetup) write(t *testing.T, p, body string) {
	t.Helper()
	if err := os.WriteFile(p, []byte(body), 0o700); err != nil {
		t.Fatal(err)
	}
}

func (s *pairShSetup) env(extra ...string) []string {
	return append([]string{"PATH=" + s.path + ":/usr/bin:/bin", "HOME=" + s.home, "XDG_CONFIG_HOME=" + filepath.Join(s.home, ".config"),
		"LOGS=" + s.logs, "TMPDIR=" + s.dir}, extra...)
}

// standInCopy puts a copy of this test binary at dir/privatae-bastion: run
// with installShStandInRun it is a bastion that waits to be stopped, under
// the program name install.sh looks for.
func standInCopy(t *testing.T, dir string) string {
	t.Helper()
	self, err := os.Executable()
	if err != nil {
		t.Fatal(err)
	}
	b, err := os.ReadFile(self)
	if err != nil {
		t.Fatal(err)
	}
	p := filepath.Join(dir, "privatae-bastion")
	if err := os.WriteFile(p, b, 0o755); err != nil {
		t.Fatal(err)
	}
	return p
}

// pairShHarness runs install.sh's pairing functions against a stand-in
// bastion, systemctl and loginctl. It returns the run's output, the log
// directory and its error. With copyRunning, a copy of the bastion from another
// path is running when the functions start, and log/copy says whether it
// still was when they ended.
func pairShHarness(t *testing.T, root, pairRC, lingerRC string) (string, string, error) {
	t.Helper()
	return pairShHarnessWith(t, root, pairRC, lingerRC, "steady", false)
}

func pairShHarnessWith(t *testing.T, root, pairRC, lingerRC, unit string, copyRunning bool) (string, string, error) {
	t.Helper()
	wrap := installShPrivatePIDs(t)
	s := newPairShSetup(t)
	fake := filepath.Join(s.bin, "privatae-bastion")
	s.write(t, fake, `#!/bin/sh
echo "HOME=$HOME $*" >> "$LOGS/argv"
case "$1" in
  pair) cat > "$LOGS/stdin"; exit "$PAIR_RC" ;;
  status) echo "status: paired" ;;
esac
exit 0
`)
	copyPath := ""
	if copyRunning {
		other := filepath.Join(s.dir, "other-install")
		if err := os.MkdirAll(other, 0o700); err != nil {
			t.Fatal(err)
		}
		copyPath = standInCopy(t, other)
	}
	fns := installShFunc(t, "pair_as") + installShFunc(t, "bastion_copy") + installShFunc(t, "stop_user_copies") +
		installShFunc(t, "user_unit_stays_up") + installShFunc(t, "start_bastion") + installShFunc(t, "pair_and_start")
	script := fns + `
if [ -n "$COPY" ]; then
  "$COPY" ` + installShStandInRun + ` >/dev/null 2>&1 &
  copy=$!
  i=0
  while ! bastion_copy "$copy" && [ "$i" -lt 100 ]; do i=$((i + 1)); /bin/sleep 0.05; done
  bastion_copy "$copy" || { echo "the stand-in copy never started" >&2; exit 97; }
fi
rc=0
pair_and_start "$1" "$2" "$3" linux || rc=$?
if [ -n "$COPY" ]; then
  if bastion_copy "$copy"; then echo alive > "$LOGS/copy"; kill -9 "$copy"; else echo gone > "$LOGS/copy"; fi
fi
exit "$rc"
`
	args := append(append([]string{}, wrap...), "sh", "-c", script, "sh", fake, "skp_INVENTEDCODE", root)
	cmd := exec.Command(args[0], args[1:]...)
	cmd.Env = s.env("PAIR_RC="+pairRC, "LINGER_RC="+lingerRC, "UNIT="+unit, "COPY="+copyPath)
	out, err := cmd.CombinedOutput()
	return string(out), s.logs, err
}

func readPairShLog(t *testing.T, dir, name string) string {
	t.Helper()
	b, _ := os.ReadFile(filepath.Join(dir, name))
	return string(b)
}

// The pairing functions hand the code to `pair -` on standard input, never
// as an argument, then write and start a systemd user unit, ask for
// lingering, and end with one plain sentence. Exit 3 (already paired with
// this Host) is success.
func TestInstallShPairsOverStdinAndStartsAUserUnit(t *testing.T) {
	out, logs, err := pairShHarness(t, "0", "0", "0")
	if err != nil {
		t.Fatalf("%v\n%s", err, out)
	}
	argv := readPairShLog(t, logs, "argv")
	if !strings.Contains(argv, " pair -\n") || strings.Contains(argv, "skp_") {
		t.Fatalf("the code must reach `pair -` on stdin and never an argument: %q", argv)
	}
	if got := readPairShLog(t, logs, "stdin"); got != "skp_INVENTEDCODE\n" {
		t.Fatalf("pair's standard input: %q", got)
	}
	home := strings.TrimPrefix(strings.Fields(argv)[0], "HOME=")
	unit, err := os.ReadFile(filepath.Join(home, ".config", "systemd", "user", "privatae-bastion.service"))
	if err != nil || !regexp.MustCompile(`(?m)^ExecStart=\S+/privatae-bastion run$`).Match(unit) || !strings.Contains(string(unit), "WantedBy=default.target") {
		t.Fatalf("the user unit: %v\n%s", err, unit)
	}
	sc := readPairShLog(t, logs, "systemctl")
	for _, want := range []string{"--user daemon-reload", "--user enable privatae-bastion", "--user restart privatae-bastion"} {
		if !strings.Contains(sc, want+"\n") {
			t.Fatalf("systemctl was not asked to %q: %q", want, sc)
		}
	}
	if !strings.Contains(readPairShLog(t, logs, "loginctl"), "enable-linger ") {
		t.Fatal("lingering was not asked for")
	}
	if !strings.Contains(out, "status: paired") || !strings.HasSuffix(strings.TrimSpace(out),
		"This machine is paired. The bastion runs as your systemd user service privatae-bastion, and starts at boot.") {
		t.Fatalf("the ending: %s", out)
	}

	out, _, err = pairShHarness(t, "0", "3", "1")
	if err != nil || !strings.Contains(out, "already paired with this Host") || !strings.Contains(out, "sudo loginctl enable-linger") {
		t.Fatalf("exit 3 is success, and a refused linger says how to get it: %v\n%s", err, out)
	}

	out, logs, err = pairShHarness(t, "0", "1", "0")
	if err == nil || strings.Contains(readPairShLog(t, logs, "systemctl"), "restart") || !strings.Contains(out, "pairing did not finish") {
		t.Fatalf("a failed pair must stop before starting anything: %v\n%s", err, out)
	}

	out, logs, err = pairShHarness(t, "1", "0", "0")
	if err != nil || !strings.Contains(readPairShLog(t, logs, "argv"), "HOME=/root ") ||
		readPairShLog(t, logs, "systemctl") != "restart privatae-bastion\n" || strings.Contains(out, "user service") {
		t.Fatalf("as root it pairs as the service's state and restarts the system service: %v\n%s\n%s", err, out, readPairShLog(t, logs, "systemctl"))
	}
}

// Linux, as yourself: a copy of the bastion already running outside the
// user unit (from a terminal, or another path) is stopped before the unit
// starts, so the unit's copy is the one that serves; and a unit that does not
// stay up is said plainly, with a failure, never reported as running.
func TestInstallShStopsAnOutsideCopyAndChecksTheUnitStaysUp(t *testing.T) {
	out, logs, err := pairShHarnessWith(t, "0", "0", "0", "steady", true)
	if err != nil {
		t.Fatalf("%v\n%s", err, out)
	}
	if got := strings.TrimSpace(readPairShLog(t, logs, "copy")); got != "gone" {
		t.Fatalf("the copy running outside the unit must be stopped, it is %q\n%s", got, out)
	}
	if !strings.Contains(out, "Stopped 1 copy(ies) of the bastion running outside its service") {
		t.Fatalf("the stop is said: %s", out)
	}
	sc := readPairShLog(t, logs, "systemctl")
	if i, j := strings.Index(sc, "--user stop privatae-bastion\n"), strings.Index(sc, "--user restart privatae-bastion\n"); i < 0 || j < i {
		t.Fatalf("the unit is stopped before the copies and started after: %q", sc)
	}
	if !strings.HasSuffix(strings.TrimSpace(out), "This machine is paired. The bastion runs as your systemd user service privatae-bastion, and starts at boot.") {
		t.Fatalf("the ending: %s", out)
	}

	out, _, err = pairShHarnessWith(t, "0", "0", "0", "flapping", false)
	if err == nil || !strings.Contains(out, "is not staying up") || !strings.Contains(out, "activating/auto-restart") ||
		!strings.Contains(out, "journalctl --user -u privatae-bastion") || strings.Contains(out, "The bastion runs as your systemd user service") {
		t.Fatalf("a unit that restarts must be reported as not running, and fail: %v\n%s", err, out)
	}
}

// The whole of install.sh, the card's way: the code in PRIVATAE_PAIR_CODE
// and no argument. Every program it starts (stand-ins for uname, id, curl,
// printf, systemctl, loginctl and sleep, and the downloaded bastion) records
// its own arguments, the command line of the shell that started it, and
// whether the code is in its environment. The code must reach `pair -` on
// standard input and appear in none of those. Nothing leaves this machine:
// curl is a stand-in serving a manifest and a stand-in bastion.
func TestInstallShTakesTheCodeOnlyFromTheEnvironment(t *testing.T) {
	wrap := installShPrivatePIDs(t)
	s := newPairShSetup(t)
	const code = "skp_eyJ2IjoxLCJ0IjoiSU5WRU5URUQtRU5WLUNPREUifQ"
	record := `echo "$(basename "$0") argv=[$*] parent=[$(tr '\0' ' ' < /proc/$PPID/cmdline)] env=[${PRIVATAE_PAIR_CODE+set}] envcode=[$(env | grep -c "` + code + `")]" >> "$LOGS/procs"
`
	bastion := "#!/bin/sh\n" + record + `case "$1" in
  pair) cat > "$LOGS/stdin" ;;
  status) echo "status: paired" ;;
esac
exit 0
`
	s.write(t, filepath.Join(s.dir, "bastion.bin"), bastion)
	sum := sha256.Sum256([]byte(bastion))
	s.write(t, filepath.Join(s.dir, "version.json"), "{\n  \"linux-amd64\": {\n    \"url\": \"https://dl.privatae.ai/dl/privatae-bastion-linux-amd64?v=0.0.0\",\n    \"sha256\": \""+hex.EncodeToString(sum[:])+"\"\n  }\n}\n")
	stand := map[string]string{
		"uname":  `case "$1" in -s) echo Linux ;; -m) echo x86_64 ;; *) echo Linux ;; esac`,
		"id":     `case "$1" in -u) echo 1000 ;; -un) echo tester ;; *) echo "uid=1000(tester)" ;; esac`,
		"curl":   `for a; do o=$a; done; case "$2" in */version.json) cp "$STAND/version.json" "$o" ;; *) cp "$STAND/bastion.bin" "$o" ;; esac`,
		"printf": `exec /usr/bin/printf "$@"`,
		// No openssl that does Ed25519 here, so the release signature is
		// noted as not checked (install_sig_sh_test.go tests the check): this
		// stand-in manifest is signed by no release key.
		"openssl": `exit 1`,
	}
	for name, body := range stand {
		s.write(t, filepath.Join(s.path, name), "#!/bin/sh\n"+record+body+"\n")
	}
	for _, name := range []string{"systemctl", "loginctl", "sleep"} {
		p := filepath.Join(s.path, name)
		b, _ := os.ReadFile(p)
		s.write(t, p, strings.Replace(string(b), "#!/bin/sh\n", "#!/bin/sh\n"+record, 1))
	}
	sh := installShHere(t, s.dir, false)
	args := append(append([]string{}, wrap...), "sh", sh)
	cmd := exec.Command(args[0], args[1:]...)
	cmd.Env = s.env("PRIVATAE_PAIR_CODE="+code, "STAND="+s.dir, "LINGER_RC=0", "UNIT=steady")
	out, err := cmd.CombinedOutput()
	if err != nil {
		t.Fatalf("%v\n%s", err, out)
	}
	if got := readPairShLog(t, s.logs, "stdin"); got != code+"\n" {
		t.Fatalf("pair's standard input: %q\n%s", got, out)
	}
	procs := readPairShLog(t, s.logs, "procs")
	for _, who := range []string{"uname argv=[-s]", "curl argv=[", "privatae-bastion argv=[pair -]", "privatae-bastion argv=[status]", "systemctl argv=[--user restart privatae-bastion]"} {
		if !strings.Contains(procs, who) {
			t.Fatalf("no record of %q: the stand-ins did not run as expected\n%s\n%s", who, procs, out)
		}
	}
	if strings.Contains(procs, code) || strings.Contains(procs, "INVENTED-ENV-CODE") {
		t.Fatalf("the code is in a program's arguments or its shell's command line:\n%s", procs)
	}
	if strings.Contains(procs, "env=[set]") || !strings.Contains(procs, "envcode=[0]") || strings.Contains(procs, "envcode=[1]") {
		t.Fatalf("a program the installer started inherited the code in its environment:\n%s", procs)
	}
	if strings.Contains(string(out), code) {
		t.Fatalf("the installer printed the code:\n%s", out)
	}
	if !strings.HasSuffix(strings.TrimSpace(string(out)), "https://privatae.ai/bastion/LICENSE.txt") || !strings.Contains(string(out), "This machine is paired.") {
		t.Fatalf("the ending: %s", out)
	}
	// sudo refused (the stand-in), so it is installed for this account, and
	// the installer says what that means.
	if !strings.Contains(readPairShLog(t, s.logs, "sudo"), " true") || !strings.Contains(string(out), "installed for your account only") ||
		!strings.Contains(string(out), "in a terminal, from an account that may use sudo") {
		t.Fatalf("the fall back to this account is not said:\n%s", out)
	}
}

// A PRIVATAE_PAIR_CODE that is empty or not a whole pairing code is refused
// before anything is downloaded, and never echoed; so is any argument, a
// code given as one (the removed --pair, or the code alone) included.
//
// The script runs with stand-ins for id (not root) and curl (records that it
// was reached, fetches nothing), so an installer whose refusal broke can
// neither reach the network nor install anything as root on the machine
// running the test: it fails here instead.
func TestInstallShRefusesABadPairCodeBeforeDownloading(t *testing.T) {
	const code = "skp_eyJ2IjoxfQ"
	stand := t.TempDir()
	for name, body := range map[string]string{
		"id":   `case "$1" in -u) echo 1000 ;; -un) echo tester ;; *) echo "uid=1000(tester)" ;; esac`,
		"curl": `echo "REACHED-THE-DOWNLOAD" >&2; exit 1`,
		"sudo": `echo "REACHED-SUDO" >&2; exit 1`,
	} {
		if err := os.WriteFile(filepath.Join(stand, name), []byte("#!/bin/sh\n"+body+"\n"), 0o700); err != nil {
			t.Fatal(err)
		}
	}
	for _, c := range []struct {
		env  []string
		args []string
	}{
		{[]string{"PRIVATAE_PAIR_CODE="}, nil},
		{[]string{"PRIVATAE_PAIR_CODE=skp_"}, nil},
		{[]string{"PRIVATAE_PAIR_CODE=skb_aG9tZS5zZWNyZXQteA"}, nil},
		{[]string{"PRIVATAE_PAIR_CODE=" + code + " trailing"}, nil},
		{[]string{"PRIVATAE_PAIR_CODE=" + code + "%3D"}, nil},
		{nil, []string{"--pair", code}},
		{nil, []string{"--pair=" + code}},
		{nil, []string{code}},
		{nil, []string{"--networkd"}},
	} {
		home := t.TempDir()
		cmd := exec.Command("sh", append([]string{filepath.Join("..", "deploy", "install.sh")}, c.args...)...)
		cmd.Env = append([]string{"PATH=" + stand + ":/usr/bin:/bin", "HOME=" + home, "TMPDIR=" + home}, c.env...)
		out, err := cmd.CombinedOutput()
		ee, ok := err.(*exec.ExitError)
		if !ok || ee.ExitCode() != 2 || strings.Contains(string(out), "Fetching manifest") || strings.Contains(string(out), "REACHED-THE-DOWNLOAD") ||
			strings.Contains(string(out), "REACHED-SUDO") {
			t.Fatalf("%v %v: want exit 2 before the download, got %v\n%s", c.env, c.args, err, out)
		}
		if strings.Contains(string(out), code) || strings.Contains(string(out), "skb_") || strings.Contains(string(out), "networkd") {
			t.Fatalf("%v %v: the refusal echoes what it was given: %s", c.env, c.args, out)
		}
	}
}

// On a person's own account the installer installs for the whole machine
// through sudo: sudo true first, then root (sudo -H) fetches the installer and
// runs it with --personal, the pairing code on its standard input. sudo's
// arguments never hold the code. What an earlier install for this account
// alone left (never paired) is removed, so it does not run a second bastion.
//
// Nothing here runs as root on the machine running the test: the installer
// root fetches is a stand-in that records what it was given, and sudo runs
// it as the test's own account, in a PID namespace of its own.
func TestInstallShInstallsForTheWholeMachineThroughSudo(t *testing.T) {
	wrap := installShPrivatePIDs(t)
	s := newPairShSetup(t)
	const code = "skp_eyJ2IjoxLCJ0IjoiSU5WRU5URUQtV0hPTEUifQ"
	s.write(t, filepath.Join(s.dir, "root-step.sh"), "echo \"$*\" > \"$LOGS/root-args\"\ncat > \"$LOGS/root-stdin\"\nexit 0\n")
	s.write(t, filepath.Join(s.path, "sudo"), "#!/bin/sh\necho \"$*\" >> \"$LOGS/sudo\"\ncase \"$1\" in -p) exit 0 ;; -H) shift ;; esac\nexec \"$@\"\n")
	for name, body := range map[string]string{
		"uname": `case "$1" in -s) echo Linux ;; -m) echo x86_64 ;; *) echo Linux ;; esac`,
		"id":    `case "$1" in -u) echo 1000 ;; -un) echo tester ;; *) echo "uid=1000(tester)" ;; esac`,
		"curl": `echo "$*" >> "$LOGS/curl"; for a; do o=$a; done; u=""; for a; do case "$a" in https://*) u=$a ;; esac; done
case "$u" in https://privatae.ai/bastion/install.sh) cp "$STAND/root-step.sh" "$o" ;; *) echo "REACHED-THE-DOWNLOAD" >&2; exit 1 ;; esac`,
	} {
		s.write(t, filepath.Join(s.path, name), "#!/bin/sh\n"+body+"\n")
	}
	unit := filepath.Join(s.home, ".config", "systemd", "user", "privatae-bastion.service")
	own := filepath.Join(s.home, ".local", "bin", "privatae-bastion")
	for _, p := range []string{unit, own} {
		if err := os.MkdirAll(filepath.Dir(p), 0o700); err != nil {
			t.Fatal(err)
		}
		s.write(t, p, "an earlier install for this account\n")
	}
	sh := installShHere(t, s.dir, false)
	args := append(append([]string{}, wrap...), "sh", sh)
	cmd := exec.Command(args[0], args[1:]...)
	cmd.Env = s.env("PRIVATAE_PAIR_CODE="+code, "STAND="+s.dir)
	out, err := cmd.CombinedOutput()
	if err != nil {
		t.Fatalf("%v\n%s", err, out)
	}
	if got := readPairShLog(t, s.logs, "root-args"); strings.TrimSpace(got) != "--personal --pair-code-on-stdin" {
		t.Fatalf("the root step was given %q\n%s", got, out)
	}
	if got := readPairShLog(t, s.logs, "root-stdin"); got != code+"\n" {
		t.Fatalf("the root step's standard input: %q", got)
	}
	sudo := readPairShLog(t, s.logs, "sudo")
	if !strings.HasPrefix(sudo, "-p [bastion] sudo password for %u:  true\n") || !strings.Contains(sudo, "/bin/sh -c ") {
		t.Fatalf("sudo was asked: %s\n%s", sudo, out)
	}
	if strings.Contains(sudo, code) || strings.Contains(string(out), code) {
		t.Fatalf("the code is in sudo's arguments or the output:\n%s\n%s", sudo, out)
	}
	// Root's step reads nothing from this account's home: sudo -H, so HOME is
	// root's, and curl -q, so no ~/.curlrc can point root's fetch elsewhere.
	if !strings.Contains(sudo, "\n-H /bin/sh -c ") {
		t.Errorf("the root step runs with this account's HOME (no sudo -H): %s", sudo)
	}
	if got := readPairShLog(t, s.logs, "curl"); !strings.HasPrefix(got, "-q ") {
		t.Errorf("root's fetch of the installer reads a curl config (no -q first): %q", got)
	}
	if strings.Contains(string(out), "Fetching manifest") || strings.Contains(string(out), "REACHED-THE-DOWNLOAD") {
		t.Fatalf("the installer also installed for this account:\n%s", out)
	}
	for _, p := range []string{unit, own} {
		if _, err := os.Stat(p); err == nil {
			t.Errorf("%s is still there", p)
		}
	}
	if !strings.Contains(readPairShLog(t, s.logs, "systemctl"), "--user disable --now privatae-bastion") {
		t.Error("this account's own unit was not stopped")
	}
}

// An account whose own bastion is already paired keeps it on an upgrade:
// sudo is never asked, and the installer goes on for this account.
func TestInstallShKeepsAPairedAccountInstallWhereItIs(t *testing.T) {
	s := newPairShSetup(t)
	for name, body := range map[string]string{
		"uname": `case "$1" in -s) echo Linux ;; -m) echo x86_64 ;; *) echo Linux ;; esac`,
		"id":    `case "$1" in -u) echo 1000 ;; -un) echo tester ;; *) echo "uid=1000(tester)" ;; esac`,
		"curl":  `echo "REACHED-THE-DOWNLOAD" >&2; exit 1`,
	} {
		s.write(t, filepath.Join(s.path, name), "#!/bin/sh\n"+body+"\n")
	}
	pd := filepath.Join(s.home, ".config", "privatae-bastion", "pairings")
	if err := os.MkdirAll(pd, 0o700); err != nil {
		t.Fatal(err)
	}
	s.write(t, filepath.Join(pd, "member.host.privatae.ai.json"), "{}")
	cmd := exec.Command("sh", installShHere(t, s.dir, false))
	cmd.Env = s.env()
	out, _ := cmd.CombinedOutput()
	if got := readPairShLog(t, s.logs, "sudo"); got != "" {
		t.Fatalf("sudo was asked for a paired account install: %s", got)
	}
	if !strings.Contains(string(out), "Fetching manifest") {
		t.Fatalf("the installer did not go on for this account:\n%s", out)
	}
}

// Beside a bastion installed for the whole machine, an account that cannot
// use sudo gets no second bastion of its own (the machine's would refuse it),
// asked for with --just-me or fallen back to.
func TestInstallShInstallsNoSecondBastionBesideTheMachines(t *testing.T) {
	for _, args := range [][]string{nil, {"--just-me"}} {
		s := newPairShSetup(t)
		for name, body := range map[string]string{
			"uname": `case "$1" in -s) echo Linux ;; -m) echo x86_64 ;; *) echo Linux ;; esac`,
			"id":    `case "$1" in -u) echo 1000 ;; -un) echo tester ;; *) echo "uid=1000(tester)" ;; esac`,
			"curl":  `echo "REACHED-THE-DOWNLOAD" >&2; exit 1`,
		} {
			s.write(t, filepath.Join(s.path, name), "#!/bin/sh\n"+body+"\n")
		}
		cmd := exec.Command("sh", append([]string{installShHere(t, s.dir, true)}, args...)...)
		cmd.Env = s.env()
		out, err := cmd.CombinedOutput()
		if ee, ok := err.(*exec.ExitError); !ok || ee.ExitCode() != 1 || strings.Contains(string(out), "REACHED-THE-DOWNLOAD") ||
			!strings.Contains(string(out), "installed for the whole machine") {
			t.Fatalf("%v: want a refusal before the download, got %v\n%s", args, err, out)
		}
	}
}

// The root step takes the pairing code on standard input only when told to,
// checks it before anything is downloaded, and never echoes it. --just-me is
// refused as root and beside --shared.
//
// "Root" here is a stand-in id; curl fails every download, so nothing past
// the checks can run.
func TestInstallShRootStepTakesTheCodeOnStdin(t *testing.T) {
	stand := t.TempDir()
	write := func(name, body string) {
		if err := os.WriteFile(filepath.Join(stand, name), []byte("#!/bin/sh\n"+body+"\n"), 0o700); err != nil {
			t.Fatal(err)
		}
	}
	write("curl", `echo "REACHED-THE-DOWNLOAD" >&2; exit 1`)
	write("sudo", `echo "REACHED-SUDO" >&2; exit 1`)
	write("uname", `case "$1" in -s) echo Linux ;; -m) echo x86_64 ;; *) echo Linux ;; esac`)
	run := func(uid, stdin string, args ...string) (string, int) {
		write("id", `case "$1" in -u) echo `+uid+` ;; -un) echo tester ;; *) echo "uid=`+uid+`" ;; esac`)
		home := t.TempDir()
		cmd := exec.Command("sh", append([]string{filepath.Join("..", "deploy", "install.sh")}, args...)...)
		cmd.Env = []string{"PATH=" + stand + ":/usr/bin:/bin", "HOME=" + home, "TMPDIR=" + home}
		cmd.Stdin = strings.NewReader(stdin)
		out, err := cmd.CombinedOutput()
		if ee, ok := err.(*exec.ExitError); ok {
			return string(out), ee.ExitCode()
		}
		return string(out), 0
	}
	const code = "skp_eyJ2IjoxLCJ0IjoiU1RESU4ifQ"
	out, rc := run("0", code+"\n", "--personal", "--pair-code-on-stdin")
	if rc != 1 || !strings.Contains(out, "REACHED-THE-DOWNLOAD") || strings.Contains(out, code) {
		t.Fatalf("a good code on stdin did not reach the download, or was echoed (%d):\n%s", rc, out)
	}
	for _, bad := range []string{"", "skp_\n", "skb_aG9tZQ\n", code + " x\n"} {
		out, rc := run("0", bad, "--personal", "--pair-code-on-stdin")
		if rc != 2 || strings.Contains(out, "REACHED") || (bad != "" && strings.Contains(out, strings.TrimSpace(bad))) {
			t.Fatalf("stdin %q: want exit 2 before the download, unechoed (%d):\n%s", bad, rc, out)
		}
	}
	if out, rc := run("1000", code+"\n", "--pair-code-on-stdin"); rc != 2 || strings.Contains(out, "REACHED") {
		t.Fatalf("an ordinary account's --pair-code-on-stdin was taken (%d):\n%s", rc, out)
	}
	if out, rc := run("0", "", "--just-me"); rc != 2 || !strings.Contains(out, "without sudo") {
		t.Fatalf("--just-me as root (%d):\n%s", rc, out)
	}
	if out, rc := run("1000", "", "--just-me", "--shared"); rc != 2 || strings.Contains(out, "REACHED") {
		t.Fatalf("--just-me --shared (%d):\n%s", rc, out)
	}
}

// The owner's account is recorded on a person's own computer only. On a
// shared machine the console stays the administrator's.
func TestInstallShRecordsTheOwnerOnAPersonalInstallOnly(t *testing.T) {
	d := t.TempDir()
	bin := filepath.Join(d, "privatae-bastion")
	if err := os.WriteFile(bin, []byte("#!/bin/sh\necho \"$*\" >> \""+filepath.Join(d, "log")+"\"\n"), 0o700); err != nil {
		t.Fatal(err)
	}
	fns := installShFunc(t, "pair_as") + installShFunc(t, "record_owner")
	for _, c := range []struct {
		networked, sudoUID, want string
	}{{"0", "1000", "approvals-owner --account 1000\n"}, {"1", "1000", ""}, {"0", "0", ""}, {"0", "", ""}} {
		os.Remove(filepath.Join(d, "log"))
		cmd := exec.Command("sh", "-c", fns+`networked=$1; record_owner "$2" 1 linux`, "sh", c.networked, bin)
		cmd.Env = []string{"PATH=/usr/bin:/bin", "SUDO_UID=" + c.sudoUID}
		if out, err := cmd.CombinedOutput(); err != nil {
			t.Fatalf("%+v: %v %s", c, err, out)
		}
		got, _ := os.ReadFile(filepath.Join(d, "log"))
		if string(got) != c.want {
			t.Errorf("networked=%s SUDO_UID=%q: recorded %q, want %q", c.networked, c.sudoUID, got, c.want)
		}
	}
}

// The root step's own failure, whatever its exit code, is never read as sudo
// refusing: the installer stops, and installs nothing for the account.
func TestInstallShRootStepFailureIsNotAFallBack(t *testing.T) {
	s := newPairShSetup(t)
	s.write(t, filepath.Join(s.dir, "root-step.sh"), "exit 3\n")
	s.write(t, filepath.Join(s.path, "sudo"), "#!/bin/sh\nwhile [ \"$1\" = -H ]; do shift; done\ncase \"$1\" in -p) exit 0 ;; esac\nexec \"$@\"\n")
	for name, body := range map[string]string{
		"uname": `case "$1" in -s) echo Linux ;; -m) echo x86_64 ;; *) echo Linux ;; esac`,
		"id":    `case "$1" in -u) echo 1000 ;; -un) echo tester ;; *) echo "uid=1000(tester)" ;; esac`,
		"curl":  `for a; do o=$a; done; for a; do case "$a" in https://privatae.ai/bastion/install.sh) cp "$STAND/root-step.sh" "$o"; exit 0 ;; esac; done; echo "REACHED-THE-DOWNLOAD" >&2; exit 1`,
	} {
		s.write(t, filepath.Join(s.path, name), "#!/bin/sh\n"+body+"\n")
	}
	cmd := exec.Command("sh", installShHere(t, s.dir, false))
	cmd.Env = s.env("STAND=" + s.dir)
	out, err := cmd.CombinedOutput()
	ee, ok := err.(*exec.ExitError)
	if !ok || ee.ExitCode() != 1 || strings.Contains(string(out), "your account only") || strings.Contains(string(out), "REACHED-THE-DOWNLOAD") {
		t.Fatalf("want exit 1 and no install for the account, got %v\n%s", err, out)
	}
}