package main

// delta_blind_class_test.go — a class one pass could not see.
//
// A failed process walk already leaves every clock and the machine store alone
// (the walkErr guard in deltaPass). The listener and identity classes can go
// blind one at a time: `ss` exits non-zero or reads short, an account file
// cannot be opened. Every consumer that reads "absent from this pass" as a
// fact about the machine must then leave that class alone too, or a flaky
// reader turns into findings that close and reopen, and absences that never
// mature. These drive the real deltaPass and the real store, with only the two
// class readers replaced.

import (
	"strings"
	"testing"
	"time"
)

// blindableListeners installs a listener reader that sees `socks` when
// *blind is false and reports a failed read when it is true.
func blindableListeners(t *testing.T, blind *bool, socks []listenSocket) {
	t.Helper()
	oI, oL := deltaIdentityReader, deltaListenerReader
	deltaIdentityReader = func() identityScanReport { return identityScanReport{Supported: true} }
	deltaListenerReader = func() ([]listenSocket, bool, string) {
		if *blind {
			return nil, false, "ss exited 1"
		}
		return socks, true, ""
	}
	t.Cleanup(func() { deltaIdentityReader, deltaListenerReader = oI, oL })
}

func saveFourClassAccounting(t *testing.T, entries []baselineEntry) {
	t.Helper()
	if err := baselineSave(baselineFile{
		Version:  baselineVersion,
		TakenAt:  stamp(time.Now()),
		Coverage: baselineCoverage(true, true, true, true),
		Entries:  entries,
	}); err != nil {
		t.Fatal(err)
	}
}

func findingOfKind(r deltaReport, kind string) *deltaEvent {
	for i := range r.Findings {
		if r.Findings[i].Kind == kind {
			return &r.Findings[i]
		}
	}
	return nil
}

// A listener finding on a box whose `ss` fails every other pass stays OPEN in
// the machine store. It closed and reopened on every flap: twelve times in 25
// passes for a listener on 0.0.0.0:4444.
func TestABlindListenerPassClosesNoListenerFinding(t *testing.T) {
	isolateConfigDir(t)
	if !processIsRoot() {
		t.Skip("the pass refuses without machine authority, which is its own test")
	}
	blind := false
	blindableListeners(t, &blind, []listenSocket{sock("tcp", "0.0.0.0", 4444, "nc", 1)})
	saveFourClassAccounting(t, nil)

	now := time.Date(2026, 9, 23, 3, 0, 0, 0, time.UTC)
	var fp string
	for i := 0; i < 6; i++ {
		blind = i%2 == 1
		at := now.Add(time.Duration(i) * time.Minute)
		r := deltaPass(&digestCache{}, at, deltaRoleOperator)
		if blind && (len(r.Skipped) != 1 || r.Skipped[0] != "listener") {
			t.Fatalf("pass %d could not read the socket table and did not say so: skipped=%v", i, r.Skipped)
		}
		// The heartbeat carries it too: the host reads the summary, and zero
		// counts on a blind pass must not reach it as a clean machine.
		if sum := r.summary(); blind && (len(sum.Skipped) != 1 || sum.Skipped[0] != "listener") {
			t.Fatalf("pass %d: the summary the heartbeat carries does not name the skipped class: %v", i, sum.Skipped)
		}
		if i == 0 {
			ev := findingOfKind(r, deltaListenerNew)
			if ev == nil {
				t.Fatalf("the listener on 0.0.0.0:4444 was not a finding: %v", kindsOf(r.Findings))
			}
			fp = ev.FP
			// The pass itself records the finding's class, which is what the
			// prune reads on a later blind pass.
			if st := deltaStateLoad(r.BaselineDigest); st.SeenKind[fp] != "listener" {
				t.Fatalf("the pass did not record the finding's class: seen_kind=%q", st.SeenKind[fp])
			}
		}
		if _, err := storeRecordPass(r, at); err != nil {
			t.Fatal(err)
		}
	}
	var transitions []string
	for _, l := range storeReadJournal(t, now) {
		if l.Event != nil && l.Event.FP == fp {
			transitions = append(transitions, l.Transition)
		}
	}
	if len(transitions) != 1 || transitions[0] != "opened" {
		t.Fatalf("a finding in a class the pass could not see must stay open; journal for it: %v", transitions)
	}

	// And a pass that DID look and found it gone still closes it.
	blind = false
	deltaListenerReader = func() ([]listenSocket, bool, string) { return nil, true, "" }
	at := now.Add(10 * time.Minute)
	if _, err := storeRecordPass(deltaPass(&digestCache{}, at, deltaRoleOperator), at); err != nil {
		t.Fatal(err)
	}
	transitions = nil
	for _, l := range storeReadJournal(t, now) {
		if l.Event != nil && l.Event.FP == fp {
			transitions = append(transitions, l.Transition)
		}
	}
	if len(transitions) != 2 || transitions[1] != "closed" {
		t.Fatalf("a pass that looked and found it gone must close it: %v", transitions)
	}
}

// A listener that disappears is reported once its absence has lasted the grace
// period, even when every other pass cannot read the socket table. A blind
// pass reset the clock, so it was never reported at all.
func TestABlindPassDoesNotResetTheGoneClock(t *testing.T) {
	isolateConfigDir(t)
	if !processIsRoot() {
		t.Skip("the pass refuses without machine authority, which is its own test")
	}
	ssh, _ := baselineFromListeners([]listenSocket{sock("tcp", "0.0.0.0", 22, "sshd", 1)})
	blind := false
	blindableListeners(t, &blind, nil) // :22 is gone whenever the table is read
	saveFourClassAccounting(t, ssh)

	now := time.Date(2026, 9, 23, 3, 0, 0, 0, time.UTC)
	reportedAt := -1
	for i := 0; i < 25 && reportedAt < 0; i++ {
		blind = i%2 == 1
		r := deltaPass(&digestCache{}, now.Add(time.Duration(i)*time.Minute), deltaRoleOperator)
		if findingOfKind(r, deltaListenerGone) != nil {
			reportedAt = i
		}
	}
	if reportedAt < 0 {
		t.Fatal("listener_gone for :22 was never reported across 25 passes with every other pass blind")
	}
	if reportedAt < int(deltaGoneGrace/time.Minute) {
		t.Fatalf("reported at pass %d, before the %v grace had passed", reportedAt, deltaGoneGrace)
	}
}

// The class check runs BEFORE the comparison. A socket table that can never be
// read must not turn the accounting's listeners into listener_gone findings,
// however long it stays unreadable. Run after the comparison instead, the
// events were already made and matured on the grace clock.
func TestAClassBlindOnEveryPassProducesNoGoneFindings(t *testing.T) {
	isolateConfigDir(t)
	if !processIsRoot() {
		t.Skip("the pass refuses without machine authority, which is its own test")
	}
	ssh, _ := baselineFromListeners([]listenSocket{sock("tcp", "0.0.0.0", 22, "sshd", 1)})
	blind := true
	blindableListeners(t, &blind, nil)
	saveFourClassAccounting(t, ssh)

	now := time.Date(2026, 9, 23, 3, 0, 0, 0, time.UTC)
	for _, after := range []time.Duration{0, deltaGoneGrace + time.Minute, 2*deltaGoneGrace + time.Minute} {
		r := deltaPass(&digestCache{}, now.Add(after), deltaRoleOperator)
		for _, ev := range append(append([]deltaEvent{}, r.Findings...), r.Filtered...) {
			if ev.Entry.Kind == "listener" {
				t.Fatalf("a class nobody could read produced %s at +%v", ev.Kind, after)
			}
		}
	}
}

// The prune forgets a first-seen stamp a week after its last sighting, unless
// its class was not looked at on this pass.
func TestThePruneKeepsAClassItCouldNotSee(t *testing.T) {
	now := time.Date(2026, 9, 30, 0, 0, 0, 0, time.UTC)
	old := stamp(now.Add(-deltaStateForget - time.Hour))
	mk := func() *deltaState {
		return &deltaState{
			FirstSeen: map[string]string{"lst": old, "prc": old},
			LastSeen:  map[string]string{"lst": old, "prc": old},
			SeenKind:  map[string]string{"lst": "listener", "prc": "process"},
		}
	}
	s := mk()
	s.setBlind([]string{"listener"}, nil)
	s.prune(now)
	if _, kept := s.FirstSeen["lst"]; !kept {
		t.Fatal("a listener's first-seen was forgotten on a pass that could not read listeners")
	}
	if _, kept := s.FirstSeen["prc"]; kept {
		t.Fatal("a process the pass could see was not pruned after a week")
	}
	s = mk()
	s.setBlind(nil, nil)
	s.prune(now)
	if _, kept := s.FirstSeen["lst"]; kept {
		t.Fatal("a listener seen by nobody for a week was kept on a pass that could see listeners")
	}
}

// A listener hold is not settled as short-lived by a pass that could not read
// the socket table. A process hold still is.
func TestAListenerHoldIsNotSettledByABlindPass(t *testing.T) {
	lst := deltaListenerHoldPrefix + "tcp\x00x"
	s := &deltaState{Held: map[string]string{lst: stamp(time.Now()), "prc": stamp(time.Now())}}
	s.setBlind([]string{"listener"}, nil)
	if n := s.settleHeld(map[string]bool{}); n != 1 {
		t.Fatalf("settled %d, want only the process hold", n)
	}
	if _, kept := s.Held[lst]; !kept {
		t.Fatal("a listener hold was counted short-lived on a pass that could not see listeners")
	}
	s.setBlind(nil, nil)
	if n := s.settleHeld(map[string]bool{}); n != 1 {
		t.Fatalf("a pass that could see listeners must settle the hold: settled %d", n)
	}
}

// The class maps are bookkeeping for what is still open or still remembered;
// neither may outlive the entry it describes.
func TestTheClassMapsDoNotOutliveTheirEntries(t *testing.T) {
	now := time.Date(2026, 9, 30, 0, 0, 0, 0, time.UTC)
	old := stamp(now.Add(-deltaStateForget - time.Hour))
	s := &deltaState{
		FirstSeen: map[string]string{"prc": old},
		LastSeen:  map[string]string{"prc": old},
		SeenKind:  map[string]string{"prc": "process"},
	}
	s.setBlind(nil, nil)
	s.prune(now)
	if _, left := s.SeenKind["prc"]; left {
		t.Fatal("the prune forgot a fingerprint but kept its class")
	}

	isolateConfigDir(t)
	at := time.Date(2026, 9, 23, 3, 0, 0, 0, time.UTC)
	ev := storeFinding("aaa", deltaHigh)
	if _, err := storeRecordPass(storeReport("base-a", ev), at); err != nil {
		t.Fatal(err)
	}
	if k := storeStateLoadRaw().OpenKind["aaa"]; k != "process" {
		t.Fatalf("an open finding's class was not recorded: %q", k)
	}
	if _, err := storeRecordPass(storeReport("base-a"), at.Add(time.Minute)); err != nil {
		t.Fatal(err)
	}
	st := storeStateLoadRaw()
	if _, open := st.Open["aaa"]; open {
		t.Fatal("a pass that looked and did not find it left it open")
	}
	if _, left := st.OpenKind["aaa"]; left {
		t.Fatal("a closed finding's class stayed in the open-class map")
	}
}

// An accounting taken while a reader failed on a platform that CAN read the
// class says `unread`, not `unsupported`: the second means a platform that
// never compares the class, and whoever reads the line (the host, a person)
// would be told a retake changes nothing when a retake is exactly the fix.
func TestAnAccountingTakenWithAFailedReaderSaysUnread(t *testing.T) {
	isolateConfigDir(t)
	if !processIsRoot() {
		t.Skip("the accounting refuses without machine authority, which is its own test")
	}
	oI, oL := deltaIdentityReader, deltaListenerReader
	t.Cleanup(func() { deltaIdentityReader, deltaListenerReader = oI, oL })
	deltaListenerReader = func() ([]listenSocket, bool, string) { return nil, false, "ss exited 1" }
	deltaIdentityReader = func() identityScanReport {
		return identityScanReport{Reason: "the account database could not be read"}
	}
	f, _, _, _, err := collectBaseline()
	if err != nil {
		t.Fatal(err)
	}
	want := map[bool]string{true: "unread", false: "unsupported"}
	for class, readable := range map[string]bool{"listeners": listenersReadableHere, "identities": identitiesReadableHere} {
		if !strings.Contains(f.Coverage, class+"="+want[readable]) {
			t.Fatalf("%s: a failed reader on a platform that %s read it wrote %q",
				class, map[bool]string{true: "can", false: "cannot"}[readable], f.Coverage)
		}
		if baselineHasClass(f.Coverage, class) {
			t.Fatalf("%s is counted as held by an accounting that could not read it: %q", class, f.Coverage)
		}
	}

	// The same readers working: the classes are held.
	deltaListenerReader = func() ([]listenSocket, bool, string) { return nil, true, "" }
	deltaIdentityReader = func() identityScanReport { return identityScanReport{Supported: true} }
	f, _, _, _, err = collectBaseline()
	if err != nil {
		t.Fatal(err)
	}
	if listenersReadableHere && (!baselineHasClass(f.Coverage, "listeners") || strings.Contains(f.Coverage, "unread")) {
		t.Fatalf("working readers must hold the classes: %q", f.Coverage)
	}
}

// The noise filter's "started by something the accounting holds" evidence comes
// from accounted PROCESSES only. An accounted listener held by a replaced
// program must not vouch for that program's children.
func TestAnAccountedListenerIsNotABaselineParent(t *testing.T) {
	sshd := baselineEntry{FP: "sshd-real", Kind: "process", User: "root", Unit: "ssh.service",
		ArgvShape: "sshd -D", ExeDigest: "real"}
	port, _ := baselineFromListeners([]listenSocket{sock("tcp", "0.0.0.0", 22, "sshd", 1)})
	trojan := sshd
	trojan.FP, trojan.ExeDigest = "sshd-trojan", "trojan"
	holder, _ := baselineFromListeners([]listenSocket{sock("tcp", "0.0.0.0", 22, "sshd", 4242)})
	cron := baselineEntry{FP: "cron", Kind: "process", User: "root", Unit: "cron.service",
		ArgvShape: "cron -f", ExeDigest: "c"}
	base := &baselineFile{Entries: append([]baselineEntry{sshd, cron}, port...)}
	live := []deltaLiveEntry{
		{Entry: trojan, PIDs: []int{4242}},
		{Entry: holder[0], PIDs: []int{4242}},
		{Entry: cron, PIDs: []int{77}},
	}
	n := deltaNoiseFor(deltaCompare(base.Entries, live), base, live)
	if n.BaselinePIDs[4242] {
		t.Fatal("an accounted listener made the replaced program holding it a baseline parent")
	}
	if !n.BaselinePIDs[77] {
		t.Fatal("an accounted process running now must still be a baseline parent")
	}
}