//go:build !windows

// Uses setupBox / writePairingState / signTerms / grantTerms / driveOp from
// anchor_test.go, the session helpers from session_test.go and the service
// runtime stub from service_test.go, all unix-only.

package main

// The README's security model, driven through the code that enforces it:
// the tunnel forwards' accept path, the session lane's handler, the
// machine-authority gates and the management lane's allowlisted op. The
// tunnel here is an in-memory network stack and every upstream a loopback
// listener the test owns; nothing reaches the live machine's network, its
// services or its processes.

import (
	"context"
	"crypto/ed25519"
	"encoding/base64"
	"encoding/json"
	"fmt"
	"net"
	"net/http"
	"net/http/httptest"
	"net/netip"
	"os"
	"path/filepath"
	"runtime"
	"strings"
	"testing"
	"time"

	"github.com/gorilla/websocket"
	"golang.zx2c4.com/wireguard/tun/netstack"
)

// ── inside the tunnel ───────────────────────────────────────────────────────

// upstreamCounter is a listener standing in for the service a forward
// splices to. A connection arriving at it is the proof that the forward let
// a tunnel connection through.
type upstreamCounter struct {
	ln  net.Listener
	got chan struct{}
}

func newUpstream(t *testing.T, network, addr string) *upstreamCounter {
	t.Helper()
	ln, err := net.Listen(network, addr)
	if err != nil {
		t.Skipf("cannot listen on %s %s here: %v", network, addr, err)
	}
	u := &upstreamCounter{ln: ln, got: make(chan struct{}, 64)}
	go func() {
		for {
			c, err := ln.Accept()
			if err != nil {
				return
			}
			u.got <- struct{}{}
			_ = c.Close()
		}
	}()
	t.Cleanup(func() { _ = ln.Close() })
	return u
}

// reached reports whether a connection arrived within d.
func (u *upstreamCounter) reached(d time.Duration) bool {
	select {
	case <-u.got:
		return true
	case <-time.After(d):
		return false
	}
}

// tunnelDial connects to port on the in-memory stack, retrying while the
// forward under test is still coming up. The connection is closed at once:
// the accept is what the forward's wall acts on.
func tunnelDial(t *testing.T, tnet *netstack.Net, gw netip.Addr, port int) {
	t.Helper()
	addr := net.JoinHostPort(gw.String(), fmt.Sprint(port))
	deadline := time.Now().Add(5 * time.Second)
	for {
		ctx, cancel := context.WithTimeout(context.Background(), time.Second)
		c, err := tnet.DialContext(ctx, "tcp", addr)
		cancel()
		if err == nil {
			// Hold it open briefly so an allowed splice has a live peer.
			time.Sleep(50 * time.Millisecond)
			_ = c.Close()
			return
		}
		if time.Now().After(deadline) {
			t.Fatalf("nothing listens on %s in the tunnel: %v", addr, err)
		}
		time.Sleep(20 * time.Millisecond)
	}
}

func grantMemberCaps(t *testing.T, priv ed25519.PrivateKey, caps ...string) {
	t.Helper()
	future := time.Now().Add(time.Hour).UTC().Format(time.RFC3339)
	terms, sig := signTerms(t, priv, grantTerms(tMember, caps, future))
	if _, errOut, code := driveOp(t, tAnchor, "pairing_grant_sync", []string{terms, sig}); code != 0 {
		t.Fatalf("grant %v: %d %s", caps, code, errOut)
	}
}

// Inside the tunnel, only gated listeners: each inference forward, driven
// through its real accept loop on a tunnel stack, passes a connection to its
// upstream only while the pairing holds the `inference` family, re-read on
// every accept.
func TestEachInferenceForwardAdmitsOnlyThePairingThatHoldsInference(t *testing.T) {
	priv := setupBox(t)
	writePairingState(t, tMember, pairingPending)
	grantMemberCaps(t, priv, "observe")

	ollama := newUpstream(t, "tcp", "127.0.0.1:0")
	llm := newUpstream(t, "tcp", "127.0.0.1:0")
	pii := newUpstream(t, "tcp", "127.0.0.1:0")
	t.Setenv("OLLAMA_ADDR", ollama.ln.Addr().String())
	t.Setenv("PRIVATAE_LLM_ADDR", llm.ln.Addr().String())
	t.Setenv("PRIVATAE_PII_ADDR", pii.ln.Addr().String())

	gw := netip.MustParseAddr("2001:db8::a:1")
	_, tnet, err := netstack.CreateNetTUN([]netip.Addr{gw}, nil, 1420)
	if err != nil {
		t.Fatal(err)
	}
	ctx, cancel := context.WithCancel(context.Background())
	t.Cleanup(cancel)
	go serveOllamaForward(ctx, tMember, tnet, gw)
	go serveLLMForward(ctx, tMember, tnet, gw)
	go servePIIForward(ctx, tMember, tnet, gw)

	lanes := []struct {
		name string
		port int
		up   *upstreamCounter
	}{{"ollama", 11434, ollama}, {"llm", llmForwardPort, llm}, {"pii", piiForwardPort, pii}}

	for _, l := range lanes {
		tunnelDial(t, tnet, gw, l.port)
		if l.up.reached(300 * time.Millisecond) {
			t.Errorf("%s forward: a pairing without the inference family reached the upstream", l.name)
		}
	}
	grantMemberCaps(t, priv, "observe", "inference")
	for _, l := range lanes {
		tunnelDial(t, tnet, gw, l.port)
		if !l.up.reached(3 * time.Second) {
			t.Errorf("%s forward: a pairing granted inference must reach the upstream, with no restart", l.name)
		}
	}
}

// A service slot port admits a connection only when BOTH walls pass: the
// pairing holds the `services` family, and a reach grant for that server
// names that host. Driven through serveServiceForwards' accept loop; the
// server's socket counts what gets through.
func TestTheServiceSlotAdmitsOnlyWithTheFamilyAndAReachGrant(t *testing.T) {
	if runtime.GOOS != "linux" {
		t.Skip("the slot forward pins the server's socket through /proc and is linux-only")
	}
	priv := setupBox(t)
	writePairingState(t, tMember, pairingPending)
	grantMemberCaps(t, priv, "observe")

	f := stubServiceRuntime(t, "docker")
	if b, code := runService(forgeSpec("forge")); code != 0 {
		t.Fatalf("up: %s", b)
	}
	f.running["privatae-svc-forge"] = true
	rec, err := loadServiceRecord("forge")
	if err != nil {
		t.Fatal(err)
	}
	// The data dir's path is longer than a unix socket address may be, so the
	// server's socket is bound at a short path and moved into place: the
	// forward reaches it by inode through /proc (service_sock_linux.go), which
	// is exactly the path it takes on a real machine.
	data, _ := serviceDataDir("forge")
	short, err := os.MkdirTemp("", "svc")
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { _ = os.RemoveAll(short) })
	server := newUpstream(t, "unix", filepath.Join(short, "s"))
	if err := os.Rename(filepath.Join(short, "s"), filepath.Join(data, "gitea.sock")); err != nil {
		t.Skipf("cannot move the socket into the data dir here: %v", err)
	}

	// The reach grant, signed and on disk the way service_grant_sync leaves it.
	dir := t.TempDir()
	_, rpriv, _ := ed25519.GenerateKey(nil)
	tc, sig := signedTerms(t, rpriv, reachTermsFor(tMember, "forge", 30))
	withReach := &dcnGrantFile{VerifyPubkey: base64.StdEncoding.EncodeToString(rpriv.Public().(ed25519.PublicKey)),
		Stores: map[string]dcnGrantRec{}, Reach: map[string]dcnGrantRec{"1": {TermsCanonical: tc, Signature: sig}}}
	noReach := &dcnGrantFile{VerifyPubkey: withReach.VerifyPubkey, Stores: map[string]dcnGrantRec{}, Reach: map[string]dcnGrantRec{}}
	if err := dcnSaveFile(dir, withReach); err != nil {
		t.Fatal(err)
	}

	gw := netip.MustParseAddr("2001:db8::a:1")
	_, tnet, err := netstack.CreateNetTUN([]netip.Addr{gw}, nil, 1420)
	if err != nil {
		t.Fatal(err)
	}
	ctx, cancel := context.WithCancel(context.Background())
	t.Cleanup(cancel)
	go serveServiceForwards(ctx, tMember, dir, tnet, gw)

	// A reach grant, but no services family: refused.
	tunnelDial(t, tnet, gw, rec.TunnelPort)
	if server.reached(300 * time.Millisecond) {
		t.Fatal("a pairing without the services family reached the server, reach grant or not")
	}
	// The family, but no reach grant for this server: refused.
	grantMemberCaps(t, priv, "observe", "services")
	if err := dcnSaveFile(dir, noReach); err != nil {
		t.Fatal(err)
	}
	tunnelDial(t, tnet, gw, rec.TunnelPort)
	if server.reached(300 * time.Millisecond) {
		t.Fatal("a pairing with no reach grant for this server reached it")
	}
	// Both: the connection goes through to the server's socket.
	if err := dcnSaveFile(dir, withReach); err != nil {
		t.Fatal(err)
	}
	tunnelDial(t, tnet, gw, rec.TunnelPort)
	if !server.reached(3 * time.Second) {
		t.Fatal("with the family and a reach grant the connection must reach the server")
	}
}

// ── the session lane, through handleSessionConn ────────────────────────────

// openSession opens one session through the handler and returns what came
// back: the fake shell echoes "Iping" as O "ping" when the session opened. It
// returns only after the handler has finished, so nothing the session writes
// (its transcript, its audit line) lands after the test's dirs are removed.
func openSession(t *testing.T, env sessionEnv, self string, spec sessionSpec) map[byte][]byte {
	t.Helper()
	done := make(chan struct{})
	up := websocket.Upgrader{}
	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		defer close(done)
		c, err := up.Upgrade(w, r, nil)
		if err != nil {
			return
		}
		defer c.Close()
		_, first, err := c.ReadMessage()
		if err != nil {
			return
		}
		handleSessionConn(c, first, self, env)
	}))
	defer srv.Close()
	ws, _, err := websocket.DefaultDialer.Dial("ws"+strings.TrimPrefix(srv.URL, "http"), nil)
	if err != nil {
		t.Fatalf("dial: %v", err)
	}
	sendSpec(t, ws, spec)
	_ = ws.WriteMessage(websocket.BinaryMessage, []byte("Iping"))
	_ = ws.SetReadDeadline(time.Now().Add(3 * time.Second))
	got := map[byte][]byte{}
	for {
		_, data, err := ws.ReadMessage()
		if err != nil || len(data) == 0 {
			break
		}
		got[data[0]] = append(got[data[0]], data[1:]...)
		if data[0] == 'X' || (data[0] == 'O' && strings.Contains(string(got['O']), "ping")) {
			break
		}
	}
	// The host hanging up ends an open session; wait for the handler to
	// write its last line and return.
	_ = ws.Close()
	select {
	case <-done:
	case <-time.After(5 * time.Second):
		t.Fatal("the session handler did not finish after the host hung up")
	}
	return got
}

func opened(got map[byte][]byte) bool { return strings.Contains(string(got['O']), "ping") }

func refusedWith(got map[byte][]byte, words string) bool {
	return string(got['X']) == "126" && len(got['O']) == 0 && strings.Contains(string(got['E']), words)
}

// withSessionRoot makes the daemon read as root, or not, for the session
// lane's root wall only.
func withSessionRoot(t *testing.T, root bool) {
	t.Helper()
	old := sessionDaemonIsRoot
	sessionDaemonIsRoot = func() bool { return root }
	t.Cleanup(func() { sessionDaemonIsRoot = old })
}

// consoleApproval issues a one-use approval on this machine for purpose,
// with the factor enrolled here (the code a person types at the console).
func consoleApproval(t *testing.T, dcn, purpose string) string {
	t.Helper()
	raw, _ := b32decode(tSecret)
	code := hotp(raw, time.Now().Unix()/stepupPeriod)
	id, err := stepupIssueApproval(dcn, code, purpose)
	if err != nil {
		t.Fatal(err)
	}
	return id
}

// A terminal: on an anchored machine a host other than the anchor needs the
// `session` family in its pairing grant. The handler refuses it before any
// approval is looked at, and the approval it carried is still good after.
func TestAMemberWithoutTheSessionFamilyGetsNoTerminal(t *testing.T) {
	priv := setupBox(t)
	writePairingState(t, tMember, pairingPending)
	grantMemberCaps(t, priv, "observe")
	env, _, _ := sessionTestEnv(t, []string{sessionOpOpen}, nil)
	env.HostName = tMember
	withFake(t)
	pub, _ := deviceInit()
	_ = pinDeviceKey(pub)
	approval, err := deviceSign(mgmtOpPurpose(sessionOpOpen, env.Server, []string{"sess-member-1"}), time.Minute)
	if err != nil {
		t.Fatal(err)
	}
	got := openSession(t, env, tMember, sessionSpec{Op: sessionOpOpen, SessionID: "sess-member-1", Approval: approval})
	if !refusedWith(got, "family 'session', not in this pairing's caps") {
		t.Fatalf("a member without the session family must be refused by the family wall: X=%q E=%q O=%q", got['X'], got['E'], got['O'])
	}
	if _, err := os.Stat(filepath.Join(env.CtxRoot, "sessions", "sess-member-1.log")); err == nil {
		t.Fatal("a refused terminal must leave no transcript")
	}
	grantMemberCaps(t, priv, "observe", "session")
	if got := openSession(t, env, tMember, sessionSpec{Op: sessionOpOpen, SessionID: "sess-member-1", Approval: approval}); !opened(got) {
		t.Fatalf("with the family granted the same approval must open the terminal: X=%q E=%q", got['X'], got['E'])
	}
}

// On an anchored machine each terminal needs an approval bound to that one
// session and used once.
func TestAnAnchoredTerminalApprovalOpensOneSessionOnce(t *testing.T) {
	setupBox(t)
	env, _, _ := sessionTestEnv(t, []string{sessionOpOpen}, nil)
	env.HostName = tAnchor
	withFake(t)
	pub, _ := deviceInit()
	_ = pinDeviceKey(pub)
	approval, err := deviceSign(mgmtOpPurpose(sessionOpOpen, env.Server, []string{"sess-bound-A"}), time.Minute)
	if err != nil {
		t.Fatal(err)
	}
	if got := openSession(t, env, tAnchor, sessionSpec{Op: sessionOpOpen, SessionID: "sess-bound-B", Approval: approval}); !refusedWith(got, "purpose mismatch") {
		t.Fatalf("an approval for one session must not open another: X=%q E=%q O=%q", got['X'], got['E'], got['O'])
	}
	if got := openSession(t, env, tAnchor, sessionSpec{Op: sessionOpOpen, SessionID: "sess-bound-A", Approval: approval}); !opened(got) {
		t.Fatalf("the approval must open the session it names: X=%q E=%q", got['X'], got['E'])
	}
	if got := openSession(t, env, tAnchor, sessionSpec{Op: sessionOpOpen, SessionID: "sess-bound-A", Approval: approval}); !refusedWith(got, "already used") {
		t.Fatalf("a spent approval must not open the session a second time: X=%q E=%q O=%q", got['X'], got['E'], got['O'])
	}
}

// A root terminal needs the bastion to run as root. Everything else in
// order — the factor enrolled here and a code entered for this session — a
// daemon that is not root refuses, and spends nothing: the same approval
// opens the session once the daemon is root.
func TestARootTerminalNeedsTheBastionToRunAsRoot(t *testing.T) {
	env, _, _ := sessionTestEnv(t, []string{sessionOpOpen, sessionOpRoot}, nil)
	enrollFactor(t, env.DcnDir)
	withFake(t)
	p, _ := purposeForSessionRoot(env.Server, "sess-root-euid")
	approval := consoleApproval(t, env.DcnDir, p)

	withSessionRoot(t, false)
	got := openSession(t, env, "", sessionSpec{Op: sessionOpRoot, SessionID: "sess-root-euid", Approval: approval})
	if !refusedWith(got, "needs the bastion to run as root") {
		t.Fatalf("a root terminal on a daemon that is not root must be refused for that reason: X=%q E=%q O=%q", got['X'], got['E'], got['O'])
	}
	withSessionRoot(t, true)
	if got := openSession(t, env, "", sessionSpec{Op: sessionOpRoot, SessionID: "sess-root-euid", Approval: approval}); !opened(got) {
		t.Fatalf("the same approval must open the root terminal on a root daemon: X=%q E=%q", got['X'], got['E'])
	}
}

// An approval device cannot approve a root terminal, with or without a
// factor enrolled here: root is approved with a code entered on this machine.
func TestADeviceCannotApproveARootTerminal(t *testing.T) {
	withSessionRoot(t, true)
	env, _, _ := sessionTestEnv(t, []string{sessionOpOpen, sessionOpRoot}, nil)
	withFake(t)
	uiTestConfigDir(t)
	pub, _ := deviceInit()
	_ = pinDeviceKey(pub)
	p, _ := purposeForSessionRoot(env.Server, "sess-root-dev1")
	dev, err := deviceSign(p, time.Minute)
	if err != nil {
		t.Fatal(err)
	}
	if got := openSession(t, env, "", sessionSpec{Op: sessionOpRoot, SessionID: "sess-root-dev1", Approval: dev}); !refusedWith(got, "second factor enrolled on this machine") {
		t.Fatalf("with only a device pinned, root must be refused: X=%q E=%q O=%q", got['X'], got['E'], got['O'])
	}
	enrollFactor(t, env.DcnDir)
	if got := openSession(t, env, "", sessionSpec{Op: sessionOpRoot, SessionID: "sess-root-dev1", Approval: dev}); !refusedWith(got, "not from a device") {
		t.Fatalf("with a factor enrolled, a device approval must still not open root: X=%q E=%q O=%q", got['X'], got['E'], got['O'])
	}
}

// A root approval opens the one session it was entered for, once.
func TestARootApprovalOpensOneSessionOnce(t *testing.T) {
	withSessionRoot(t, true)
	env, _, _ := sessionTestEnv(t, []string{sessionOpOpen, sessionOpRoot}, nil)
	enrollFactor(t, env.DcnDir)
	withFake(t)
	p, _ := purposeForSessionRoot(env.Server, "sess-root-one")
	approval := consoleApproval(t, env.DcnDir, p)
	if got := openSession(t, env, "", sessionSpec{Op: sessionOpRoot, SessionID: "sess-root-two", Approval: approval}); !refusedWith(got, "purpose mismatch") {
		t.Fatalf("a root approval must not open another session: X=%q E=%q O=%q", got['X'], got['E'], got['O'])
	}
	if got := openSession(t, env, "", sessionSpec{Op: sessionOpRoot, SessionID: "sess-root-one", Approval: approval}); !opened(got) {
		t.Fatalf("the root approval must open its own session: X=%q E=%q", got['X'], got['E'])
	}
	if got := openSession(t, env, "", sessionSpec{Op: sessionOpRoot, SessionID: "sess-root-one", Approval: approval}); !refusedWith(got, "already used") {
		t.Fatalf("a spent root approval must not open anything again: X=%q E=%q O=%q", got['X'], got['E'], got['O'])
	}
}

// Grants are verified here: the key a session frame offers is pinned by the
// handler the first time, and a later frame offering another key is refused
// with the pin kept.
func TestTheSessionHandlerPinsTheOfferedKey(t *testing.T) {
	env, _, _ := sessionTestEnv(t, []string{sessionOpOpen}, nil)
	env.DcnDir = t.TempDir() // no key pinned yet
	withFake(t)
	pub1, _, _ := ed25519.GenerateKey(nil)
	k1 := base64.StdEncoding.EncodeToString(pub1)
	if got := openSession(t, env, "", sessionSpec{Op: sessionOpOpen, SessionID: "sess-pin-one", VerifyPubkey: k1}); !opened(got) {
		t.Fatalf("the first key offered must open and pin: X=%q E=%q", got['X'], got['E'])
	}
	if f, err := dcnLoadFile(env.DcnDir); err != nil || f.VerifyPubkey != k1 {
		t.Fatalf("the handler must pin the offered key: %v %+v", err, f)
	}
	pub2, _, _ := ed25519.GenerateKey(nil)
	k2 := base64.StdEncoding.EncodeToString(pub2)
	if got := openSession(t, env, "", sessionSpec{Op: sessionOpOpen, SessionID: "sess-pin-two", VerifyPubkey: k2}); !refusedWith(got, "mismatch") {
		t.Fatalf("a different key must be refused: X=%q E=%q O=%q", got['X'], got['E'], got['O'])
	}
	if f, _ := dcnLoadFile(env.DcnDir); f.VerifyPubkey != k1 {
		t.Fatalf("a refused key must not replace the pin: %q", f.VerifyPubkey)
	}
}

// ── root only where there is no one else to ask ────────────────────────────

func withMachineAuthority(t *testing.T, held bool) {
	t.Helper()
	old := machineAuthorityHeld
	machineAuthorityHeld = func() bool { return held }
	t.Cleanup(func() { machineAuthorityHeld = old })
}

// Claiming ownership or the anchor, and turning a box networked, are
// refused without machine authority and write nothing; with it, each gets
// past that wall. Both halves run whatever euid the suite runs under.
func TestMachineWideFactsNeedMachineAuthority(t *testing.T) {
	freshBox := func(t *testing.T) {
		t.Helper()
		t.Setenv("XDG_CONFIG_HOME", t.TempDir())
		withMarkerAt(t, filepath.Join(t.TempDir(), "machine.json"))
	}
	t.Run("claim-owner", func(t *testing.T) {
		freshBox(t)
		withMachineAuthority(t, false)
		if err := cmdClaimOwner("Acme IT"); err == nil || !strings.Contains(err.Error(), "machine authority") {
			t.Fatalf("claim-owner without machine authority must be refused: %v", err)
		}
		if currentOwnerClaim() != nil {
			t.Fatal("a refused claim-owner wrote a claim")
		}
		withMachineAuthority(t, true)
		if err := cmdClaimOwner("Acme IT"); err != nil {
			t.Fatalf("claim-owner with machine authority: %v", err)
		}
		if c := currentOwnerClaim(); c == nil || c.Owner != "Acme IT" {
			t.Fatalf("the claim was not written: %+v", c)
		}
	})
	t.Run("set-mode networked", func(t *testing.T) {
		freshBox(t)
		withMachineAuthority(t, false)
		if err := setBoxMode(modeNetworked); err == nil || !strings.Contains(err.Error(), "machine authority") {
			t.Fatalf("set-mode networked without machine authority must be refused: %v", err)
		}
		if boxMode() != modeLocal {
			t.Fatal("a refused set-mode changed the mode")
		}
		withMachineAuthority(t, true)
		if err := setBoxMode(modeNetworked); err != nil || boxMode() != modeNetworked {
			t.Fatalf("set-mode networked with machine authority: %v, mode %s", err, boxMode())
		}
	})
	t.Run("claim-anchor", func(t *testing.T) {
		freshBox(t)
		withMachineAuthority(t, true)
		if err := setBoxMode(modeNetworked); err != nil {
			t.Fatal(err)
		}
		writePairingState(t, tMember, pairingPending)
		withMachineAuthority(t, false)
		if err := cmdClaimAnchor("", false, "Acme IT", ""); err == nil || !strings.Contains(err.Error(), "machine authority") {
			t.Fatalf("claim-anchor without machine authority must be refused: %v", err)
		}
		if currentAnchor() != nil || currentOwnerClaim() != nil {
			t.Fatal("a refused claim-anchor wrote an anchor or an owner claim")
		}
		if err := cmdRepinAnchor(); err == nil || !strings.Contains(err.Error(), "machine authority") {
			t.Fatalf("claim-anchor --repin without machine authority must be refused: %v", err)
		}
		withMachineAuthority(t, true)
		if err := cmdClaimAnchor("", false, "Acme IT", ""); err != nil {
			t.Fatalf("claim-anchor with machine authority: %v", err)
		}
		if a := currentAnchor(); a == nil || a.AnchorHost != tMember {
			t.Fatalf("the anchor was not written: %+v", a)
		}
		// --repin with machine authority gets past that wall and completes: on
		// this box it re-pins the anchor to the pairing that already holds it.
		if err := cmdRepinAnchor(); err != nil {
			t.Fatalf("claim-anchor --repin with machine authority: %v", err)
		}
		if a := currentAnchor(); a == nil || a.AnchorHost != tMember {
			t.Fatalf("--repin moved the anchor: %+v", a)
		}
	})
}

// ── fixed argv ──────────────────────────────────────────────────────────────

// The allowlisted op ignores what the caller sends: the program it runs is
// given no argument, whatever the job carries. The program is a stand-in on
// a PATH the test owns, which writes down the argv it was given.
func TestTheAllowlistedOpIgnoresTheCallersArguments(t *testing.T) {
	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
	bin := t.TempDir()
	record := filepath.Join(t.TempDir(), "argv")
	script := "#!/bin/sh\nprintf '%s\\n' \"$#\" \"$@\" > '" + record + "'\necho up 1 day\n"
	if err := os.WriteFile(filepath.Join(bin, "uptime"), []byte(script), 0o755); err != nil {
		t.Fatal(err)
	}
	t.Setenv("PATH", bin)
	hostile := []string{"-p", "; touch /tmp/owned", "$(id)", "--help"}
	out, errOut, code := driveOp(t, tMember, "uptime", hostile)
	if code != 0 || !strings.Contains(out, "up 1 day") {
		t.Fatalf("uptime did not run the stand-in: %d %q %q", code, out, errOut)
	}
	got, err := os.ReadFile(record)
	if err != nil {
		t.Fatal(err)
	}
	if strings.TrimSpace(string(got)) != "0" {
		t.Fatalf("the allowlisted op passed arguments to its program: %q", got)
	}
}

// ── scoped tunnel, at pairing and at start ─────────────────────────────────

// A pairing response whose host_tunnel_ip is not one host's address is
// refused, and no pairing is saved; the same response with a bare address
// pairs. The redeem is served on loopback in place of the platform's ingress.
func TestAPairingResponseWithAWideTunnelAddressSavesNothing(t *testing.T) {
	cfgHome := uiTestConfigDir(t)
	withMarkerAt(t, filepath.Join(t.TempDir(), "machine.json"))
	hostIP := ""
	redeem := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		_ = json.NewEncoder(w).Encode(map[string]any{
			"operator_crt": "CERT", "ca_crt": "CA", "bearer": "b", "endpoint": "203.0.113.7:51820",
			"endpoint_pubkey": testWGKey(t), "bastion_tunnel_ip": "2001:db8::a:1",
			"host_tunnel_ip": hostIP, "host_name": "acme.host.privatae.ai",
		})
	}))
	defer redeem.Close()
	old := redeemURLBase
	redeemURLBase = redeem.URL
	t.Cleanup(func() { redeemURLBase = old })
	token := "skb_" + base64.RawURLEncoding.EncodeToString([]byte("acme.secret"))

	for _, bad := range []string{"2001:db8::e:3/64", "::/0", "2001:db8::e:3/128", "::"} {
		hostIP = bad
		if _, _, err := pairWithToken(token, false, false); err == nil || !strings.Contains(err.Error(), "not a single host address") {
			t.Fatalf("%q: the pairing must be refused for its tunnel address, got %v", bad, err)
		}
		// Nothing at all: not a pairing, not a grant file, not a key. The
		// walk covers what loadPairings would skip.
		_ = filepath.Walk(cfgHome, func(path string, fi os.FileInfo, err error) error {
			if err == nil && !fi.IsDir() {
				t.Errorf("%q: a refused pairing left a file behind: %s", bad, path)
			}
			return nil
		})
	}
	hostIP = "2001:db8::e:3"
	cfg, _, err := pairWithToken(token, false, false)
	if err != nil {
		t.Fatalf("a bare address must pair: %v", err)
	}
	if cfg.HostTunnelIP != "2001:db8::e:3" {
		t.Fatalf("saved %q", cfg.HostTunnelIP)
	}
}

// A pairing file that already holds a wide address (written by an older
// build, or by hand) brings no tunnel up: runPairing refuses before the
// device is raised.
func TestRunPairingRefusesAWideTunnelAddress(t *testing.T) {
	uiTestConfigDir(t)
	for _, bad := range []string{"2001:db8::e:3/64", "::/0"} {
		cfg := &Config{HostName: "acme.host.privatae.ai", WGPrivateKey: testWGKey(t), EndpointPubKey: testWGKey(t),
			Endpoint: "203.0.113.7:51820", BastionTunnelIP: "2001:db8::a:1", HostTunnelIP: bad}
		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
		err := runPairing(ctx, cfg)
		cancel()
		if err == nil || !strings.Contains(err.Error(), "not a single host address") {
			t.Fatalf("%q: runPairing must refuse the tunnel address, got %v", bad, err)
		}
	}
}