package main

import (
	"encoding/json"
	"os"
	"path/filepath"
	"strings"
	"testing"
	"time"
)

const (
	testOwnerSID = "S-1-5-21-1111111111-2222222222-3333333333-1001"
	testOtherSID = "S-1-5-21-1111111111-2222222222-3333333333-1002"
)

// writeSIDOwner records sid as the machine's owner, as `approvals-owner --sid`
// writes it on Windows.
func writeSIDOwner(t *testing.T, dir, sid string) {
	t.Helper()
	if err := os.MkdirAll(dir, 0o700); err != nil {
		t.Fatal(err)
	}
	raw, _ := json.Marshal(approvalsOwnerRecord{SID: sid, SetAt: time.Now().UTC().Format(time.RFC3339)})
	if err := os.WriteFile(filepath.Join(dir, approvalsOwnerFile), raw, 0o600); err != nil {
		t.Fatal(err)
	}
}

// The Windows ask pipe answers the owner's reads, acts and console for the
// account whose SID the installer recorded, and refuses every other one, in
// Windows' own commands: no sudo anywhere.
//
// MUTATION: compare p.UID in laneOwnerMatch for a Windows peer. RESULT: red
// (the owner's SID is refused).
func TestTheAskPipeServesTheOwnersSIDOnly(t *testing.T) {
	dir := isolateConfigDir(t)
	owner := askPeer{SID: testOwnerSID, Name: `DESKTOP\owner (` + testOwnerSID + `)`}
	other := askPeer{SID: testOtherSID, Name: `DESKTOP\other (` + testOtherSID + `)`}

	why := readLaneRefusalFor(owner)
	if !strings.Contains(why, "approvals-owner --sid "+testOwnerSID) || !strings.Contains(why, "Administrator terminal") {
		t.Errorf("with no owner recorded, the refusal does not give Windows' command: %q", why)
	}
	writeSIDOwner(t, dir, testOwnerSID)
	if why := readLaneRefusalFor(owner); why != "" {
		t.Errorf("the owner's SID was refused a read: %s", why)
	}
	if why := consoleLaneRefusalFor(owner); why != "" {
		t.Errorf("the owner's SID was refused the console: %s", why)
	}
	// Case differs between a SID read from a token and one typed.
	if why := readLaneRefusalFor(askPeer{SID: strings.ToLower(testOwnerSID), Name: "owner"}); why != "" {
		t.Errorf("the owner's SID in other case was refused: %s", why)
	}
	for _, why := range []string{readLaneRefusalFor(other), consoleLaneRefusalFor(other)} {
		if why == "" || !strings.Contains(why, testOwnerSID) || !strings.Contains(why, other.Name) {
			t.Errorf("another account was not refused, naming both: %q", why)
		}
		if strings.Contains(why, "sudo") {
			t.Errorf("a Windows refusal names sudo: %q", why)
		}
	}
	if r := serveActFor(other, agentAskRequest{Act: "deny", ID: "abcd1234"}); r.OK || r.User != other.Name {
		t.Errorf("another account's act: %+v", r)
	}
	// A record of the other platform's kind is no owner here.
	uid := uint32(1000)
	raw, _ := json.Marshal(approvalsOwnerRecord{UID: &uid, Account: "someone"})
	if err := os.WriteFile(filepath.Join(dir, approvalsOwnerFile), raw, 0o600); err != nil {
		t.Fatal(err)
	}
	if why := readLaneRefusalFor(owner); why == "" {
		t.Error("a uid record let a Windows SID through")
	}
}

// One dispatcher answers both lanes, so the pipe answers what the socket does.
func TestAskAnswerIsTheSocketsAnswer(t *testing.T) {
	isolateConfigDir(t)
	peer := askPeer{SID: testOwnerSID, Name: "owner"}
	var extended []time.Duration
	extend := func(d time.Duration) { extended = append(extended, d) }
	if r, ok := askAnswer(peer, agentAskRequest{Op: "read", Read: "approvals"}, extend, func() int { return 0 }).(agentReadReply); !ok || r.OK {
		t.Errorf("a read with no owner recorded: %+v", r)
	}
	if r, ok := askAnswer(peer, agentAskRequest{Op: "console"}, extend, func() int { return 0 }).(agentAskReply); !ok || r.OK || r.Why == "" {
		t.Errorf("the console with no owner recorded: %+v", r)
	}
	pid := 0
	if r, ok := askAnswer(peer, agentAskRequest{Op: "stop", PID: 4242}, extend, func() int { pid = 7; return 7 }).(agentAskReply); !ok || r.OK {
		t.Errorf("a stop with no code set up: %+v", r)
	}
	if pid != 7 {
		t.Error("a stop was filed without asking which process asked")
	}
	if len(extended) != 1 || extended[0] != readDeadline {
		t.Errorf("deadlines given: %v", extended)
	}
}

func TestAdminCommandsAreEachPlatformsOwn(t *testing.T) {
	if got := adminCommandFor(true, "ui"); strings.Contains(got, "sudo") || !strings.Contains(got, "Administrator terminal") {
		t.Errorf("windows: %q", got)
	}
	if got := adminCommandFor(false, "ui"); got != "sudo -H privatae-bastion ui" {
		t.Errorf("unix: %q", got)
	}
	if !strings.Contains(askPipeSDDL, "0x12019b;;;AU") || strings.Contains(askPipeSDDL, "GW;;;AU") || strings.Contains(askPipeSDDL, "GA;;;AU") {
		t.Errorf("the ask pipe's ACL gives every account more than read and write: %s", askPipeSDDL)
	}
}

// A page with no session names the command that opens it on this machine.
// The machine's console is not opened by "privatae-bastion ui" from just any
// account, and telling a person only that sent them back to a 401.
func TestNotSignedInNamesTheCommandThatOpensThisConsole(t *testing.T) {
	if got := notSignedIn("ui", "windows", true); !strings.Contains(got, "Administrator terminal") ||
		!strings.Contains(got, "owns this machine") || strings.Contains(got, "sudo") {
		t.Errorf("the Windows service's console: %q", got)
	}
	if got := notSignedIn("ui", "linux", true); !strings.Contains(got, "sudo -H privatae-bastion ui") ||
		!strings.Contains(got, "owns this machine") {
		t.Errorf("the root bastion's console: %q", got)
	}
	if got := notSignedIn("ui", "windows", false); !strings.Contains(got, "`privatae-bastion ui`") || strings.Contains(got, "Administrator") {
		t.Errorf("an account's own bastion: %q", got)
	}
	err := uiKeyRefused("127.0.0.1:7880", "401 Unauthorized", "windows", true, false)
	if s := err.Error(); !strings.Contains(s, winServiceName) || strings.Contains(s, "sudo") || strings.Contains(s, "restart it") {
		t.Errorf("a 401 beside the Windows service: %q", s)
	}
}

// A second start says what is running and how to reach it, and never that it
// should be ended: ending it was what the old words sent a person to do.
//
// MUTATION: drop the PID from secondRunWords. RESULT: red.
func TestASecondStartNamesTheRunningBastion(t *testing.T) {
	task := runHolder{PID: 4242, Program: `C:\Users\someone\AppData\Local\Programs\privatae-bastion\privatae-bastion.exe`,
		Started: "2026-11-02T18:02:00Z"}
	console, dialog := secondRunWords(task, true)
	for _, want := range []string{"4242", task.Program, "privatae-bastion ui", "Stop-Process -Id 4242"} {
		if !strings.Contains(console, want) || !strings.Contains(dialog.Body, want) {
			t.Errorf("the refusal does not say %q:\n%s\n%s", want, console, dialog.Body)
		}
	}
	svc, _ := secondRunWords(runHolder{PID: 9, Service: true}, true)
	if !strings.Contains(svc, "as the "+winServiceName+" service") || !strings.Contains(svc, "Restart-Service "+winServiceName) {
		t.Errorf("the service: %s", svc)
	}
	old, _ := secondRunWords(runHolder{}, false)
	if !strings.Contains(old, "Get-Process privatae-bastion") {
		t.Errorf("an older bastion holding the lock: %s", old)
	}
	for _, s := range []string{console, svc, old, dialog.Body} {
		if strings.Contains(s, "Task Manager") || strings.Contains(s, "believe the running one is dead") {
			t.Errorf("the refusal sends the person to end the running bastion: %s", s)
		}
	}
	dir := t.TempDir()
	writeRunHolder(dir, true)
	if h, ok := readRunHolder(dir); !ok || h.PID != os.Getpid() || !h.Console {
		t.Errorf("the holder record: %+v, %v", h, ok)
	}
}

// A bastion relaunched by its predecessor's update waits for it to exit and
// then takes the lock, where it used to refuse as a second copy and leave the
// machine with none.
func TestARelaunchedBastionWaitsForThePredecessorsLock(t *testing.T) {
	clock := time.Unix(0, 0)
	now := func() time.Time { return clock }
	sleep := func(d time.Duration) { clock = clock.Add(d) }
	held := 3
	try := func() error {
		if held > 0 {
			held--
			return os.ErrExist
		}
		return nil
	}
	waited := 0
	waitExit := func(pid int, d time.Duration) { waited = pid }
	if err := takeRunLock(try, 4242, waitExit, 30*time.Second, now, sleep); err != nil {
		t.Fatalf("the lock was not taken once the predecessor let go: %v", err)
	}
	if waited != 4242 {
		t.Errorf("waited on process %d", waited)
	}
	held = 1 << 30
	if err := takeRunLock(try, 4242, waitExit, 30*time.Second, now, sleep); err == nil {
		t.Fatal("a lock held for ever was taken")
	}
	held, waited = 1, 0
	if err := takeRunLock(try, 0, waitExit, 30*time.Second, now, sleep); err == nil || waited != 0 {
		t.Errorf("a start that replaces nothing waited, or retried: %v, %d", err, waited)
	}
	t.Setenv(relaunchOfEnv, "4242")
	if got := relaunchOf(); got != 4242 {
		t.Errorf("relaunchOf = %d", got)
	}
	if _, set := os.LookupEnv(relaunchOfEnv); set {
		t.Error("the predecessor's pid would pass on to what this bastion starts")
	}
}

// The Windows files wire it together: they are not built on Linux, so this
// reads them, as TestServiceModeOpensNothingOnTheDesktop does.
func TestTheWindowsFilesWireTheLaneTheCarryAndTheRelaunchWait(t *testing.T) {
	for file, wants := range map[string][]string{
		"relaunch_windows.go":   {`relaunchOfEnv+"="+strconv.Itoa(os.Getpid())`},
		"runguard_windows.go":   {"takeRunLock(", "relaunchOf()", "writeRunHolder(d,", "secondRunWords("},
		"sysservice_windows.go": {"carryStateInto(from, to)", "serviceCarrySource(serviceCarryFromSID)"},
		"asklane_windows.go":    {"askAnswer(peer, req", "pipeServerIsService(c.h)", "askPipeSDDL"},
		"agentask.go":           {"startAskPipe(done)"},
		"../deploy/install.ps1": {"service install --from-account $owner"},
	} {
		src, err := os.ReadFile(file)
		if err != nil {
			t.Fatal(err)
		}
		for _, w := range wants {
			if !strings.Contains(string(src), w) {
				t.Errorf("%s no longer has %s", file, w)
			}
		}
	}
	// The carry runs before the service's first start, not after it.
	src, _ := os.ReadFile("sysservice_windows.go")
	s := string(src)
	if c, st := strings.Index(s, "carryStateInto(from, to)"), strings.Index(s, "s.Start()"); c < 0 || st < 0 || c > st {
		t.Error("the carry is not before the service starts, so the service would start with no pairing")
	}
}

// A process that started after the connection was made is not the one that
// made it: its id was freed and reused, and answering it would answer a
// stranger as whoever holds that id now.
func TestAPipeClientStartedAfterItsConnectionIsNotTheCaller(t *testing.T) {
	connected := time.Unix(1000, 0)
	if !pipeClientNewer(connected.Add(time.Millisecond), connected) {
		t.Error("a process created after the connection was taken for the caller")
	}
	if pipeClientNewer(connected.Add(-time.Hour), connected) {
		t.Error("the process that connected was refused")
	}
}