//go:build !windows

package main

import (
	"crypto/ed25519"
	"encoding/base64"
	"encoding/json"
	"os"
	"path/filepath"
	"strings"
	"testing"
	"time"
)

// opActionManifest is a valid action op; the tests change one thing at a time.
const opActionManifest = `name: web-roll
version: 1.0.0
summary: Move the web tree forward and restart it.
kind: action
target: machine
privilege: root
interpreter: /bin/sh
time_limit: 30
params:
  commit: {type: string, max_len: 64}
  digest: {type: string, max_len: 71}
  count: {type: integer, min: 1, max: 3}
destinations: ["forge.example.com:443", "[2001:db8::1]:5000"]
credentials: [forge-read, "registry:acme"]
verbs:
  - {verb: tree.checkout, path: /opt/acme, repo: "https://forge.example.com/acme/app.git", commit: "{{commit}}", credential: forge-read}
  - {verb: unit.restart, unit: acme-web.service}
  - {verb: k8s.set_image, namespace: ds, kind: deployment, name: web, container: web, image: forge.example.com/acme/web, digest: "{{digest}}", repo: "https://forge.example.com/acme/app.git"}
  - {verb: logs.check, unit: acme-web.service, must_not: "Traceback", lines: 200}
modes: [dry_run, apply, verify]
undo: none
`

func TestActionManifestParses(t *testing.T) {
	setupBox(t)
	m, err := parseOpManifest([]byte(opActionManifest))
	if err != nil {
		t.Fatal(err)
	}
	if !m.isAction() || len(m.Verbs) != 4 || len(m.Credentials) != 2 {
		t.Fatalf("parsed: %+v", m)
	}
	lines, err := opResolveVerbs(m, map[string]any{"commit": strings.Repeat("a", 40), "digest": "sha256:" + strings.Repeat("b", 64)})
	if err != nil {
		t.Fatal(err)
	}
	if lines[0].Args["commit"] != strings.Repeat("a", 40) || lines[2].Args["digest"] != "sha256:"+strings.Repeat("b", 64) {
		t.Fatalf("the params land in the lines that name them: %+v", lines)
	}
	if lines[2].target() != "ds/deployment/web:web" {
		t.Fatalf("target: %s", lines[2].target())
	}
	// A param resolved to something the argument may not be is refused.
	if _, err := opResolveVerbs(m, map[string]any{"commit": "main", "digest": "sha256:" + strings.Repeat("b", 64)}); err == nil ||
		!strings.Contains(err.Error(), "never a branch") {
		t.Fatalf("a branch name is not a commit: %v", err)
	}
	if opCredEnv("registry:acme") != "PRIVATAE_CRED_REGISTRY_ACME" {
		t.Fatal(opCredEnv("registry:acme"))
	}
}

// Every way a manifest could reach past what its verbs and destinations
// declare is refused when the op arrives, with the sentence.
func TestActionManifestRefusesWhatIsNotDeclaredOrNotBounded(t *testing.T) {
	setupBox(t)
	sub := func(old, new string) string {
		if !strings.Contains(opActionManifest, old) {
			t.Fatalf("fixture has no %q", old)
		}
		return strings.Replace(opActionManifest, old, new, 1)
	}
	verbs := func(v string) string {
		i := strings.Index(opActionManifest, "verbs:\n")
		j := strings.Index(opActionManifest, "modes:")
		return opActionManifest[:i] + "verbs:\n" + v + opActionManifest[j:]
	}
	for name, c := range map[string]struct{ man, want string }{
		"an unknown verb":                       {verbs("  - {verb: shell.run, cmd: id}\n"), "not a verb"},
		"an argument the verb does not take":    {verbs("  - {verb: unit.restart, unit: a.service, signal: KILL}\n"), "takes no argument"},
		"a workload named by a param":           {sub("name: web,", `name: "{{commit}}",`), "fixed in the manifest"},
		"a container named by a param":          {sub("container: web,", `container: "{{commit}}",`), "fixed in the manifest"},
		"a unit named by a param":               {sub("unit: acme-web.service}", `unit: "{{commit}}"}`), "fixed in the manifest"},
		"a tree path named by a param":          {sub("path: /opt/acme,", `path: "{{commit}}",`), "fixed in the manifest"},
		"a param that is not a string":          {sub(`commit: "{{commit}}"`, `commit: "{{count}}"`), "not a string param"},
		"a param that does not exist":           {sub(`commit: "{{commit}}"`, `commit: "{{nope}}"`), "not a string param"},
		"a credential the op does not declare":  {sub("credential: forge-read}", "credential: other}"), "does not declare"},
		"verbs under privilege user":            {sub("privilege: root", "privilege: user"), "privilege root exactly when"},
		"root with no verbs":                    {verbs(""), "privilege root exactly when"},
		"file effects":                          {sub("kind: action", "kind: action\neffects:\n  files: [/srv/x/]"), "effects must be empty"},
		"an undo":                               {sub("modes: [dry_run, apply, verify]\nundo: none", "modes: [dry_run, apply, verify, undo]\nundo: run"), "undo: none"},
		"a destination on localhost":            {sub(`"forge.example.com:443"`, `"localhost:443"`), "never localhost"},
		"a destination on loopback":             {sub(`"forge.example.com:443"`, `"127.0.0.1:443"`), "loopback"},
		"a destination with no port":            {sub(`"forge.example.com:443"`, `"forge.example.com"`), "host:port"},
		"the metadata service":                  {sub(`"forge.example.com:443"`, `"169.254.169.254:80"`), "link-local"},
		"a link-local IPv6 address":             {sub(`"forge.example.com:443"`, `"[fe80::1]:80"`), "link-local"},
		"a metadata service outside link-local": {sub(`"forge.example.com:443"`, `"100.100.100.200:80"`), "metadata"},
		"AWS's IPv6 metadata service":           {sub(`"forge.example.com:443"`, `"[fd00:ec2::254]:80"`), "metadata"},
		"the metadata service through NAT64":    {sub(`"forge.example.com:443"`, `"[64:ff9b::a9fe:a9fe]:80"`), "link-local"},
		"loopback through IPv4-mapped IPv6":     {sub(`"forge.example.com:443"`, `"[::ffff:127.0.0.1]:80"`), "loopback"},
		"a roll with no repository":             {sub(`, repo: "https://forge.example.com/acme/app.git"}`, "}"), "needs repo"},
		"the bastion's own unit":                {sub("unit: acme-web.service}", "unit: privatae-bastion.service}"), "never restarts itself"},
		"a tree on a credential store":          {sub("path: /opt/acme,", "path: /etc/ssh,"), "sensitive"},
		"a tree at /":                           {sub("path: /opt/acme,", "path: /,"), "not /"},
		"an image with a tag":                   {sub("image: forge.example.com/acme/web,", "image: \"forge.example.com/acme/web:latest\","), "no tag or digest"},
		"a kind the verb does not roll":         {sub("kind: deployment,", "kind: cronjob,"), "deployment, statefulset or daemonset"},
		"a literal commit that is a branch":     {sub(`commit: "{{commit}}"`, `commit: main`), "never a branch"},
		"a repo that is not https":              {sub(`repo: "https://forge.example.com/acme/app.git"`, `repo: "ssh://forge.example.com/acme/app.git"`), "https"},
		"a log check on two things":             {sub("must_not: \"Traceback\"", "namespace: ds, kind: deployment, name: b, must_not: \"Traceback\""), "either one unit or one workload"},
		"a log check with nothing to look for":  {sub("must_not: \"Traceback\", ", ""), "must, must_not or both"},
		"a tree moved twice": {sub("  - {verb: tree.checkout, path: /opt/acme, repo: \"https://forge.example.com/acme/app.git\", commit: \"{{commit}}\", credential: forge-read}\n",
			"  - {verb: tree.checkout, path: /opt/acme, repo: \"https://forge.example.com/acme/app.git\", commit: \"{{commit}}\", credential: forge-read}\n  - {verb: tree.checkout, path: /opt/acme, repo: \"https://forge.example.com/acme/app.git\", commit: \"{{commit}}\", credential: forge-read}\n"), "moved twice"},
		"a container rolled twice": {sub("  - {verb: k8s.set_image, namespace: ds, kind: deployment, name: web, container: web, image: forge.example.com/acme/web, digest: \"{{digest}}\", repo: \"https://forge.example.com/acme/app.git\"}\n",
			"  - {verb: k8s.set_image, namespace: ds, kind: deployment, name: web, container: web, image: forge.example.com/acme/web, digest: \"{{digest}}\", repo: \"https://forge.example.com/acme/app.git\"}\n  - {verb: k8s.set_image, namespace: ds, kind: deployment, name: web, container: web, image: forge.example.com/acme/web, digest: \"{{digest}}\", repo: \"https://forge.example.com/acme/app.git\"}\n"), "moved twice"},
		"a log check with a bad pattern":  {sub(`must_not: "Traceback"`, `must_not: "("`), "not a valid pattern"},
		"a log check reading too much":    {sub("lines: 200", "lines: 999999"), "1..2000"},
		"two credentials in one variable": {sub(`credentials: [forge-read, "registry:acme"]`, `credentials: [forge-read, "registry:acme", "registry-acme"]`), "same variable"},
		"a verb missing its argument":     {verbs("  - {verb: unit.restart}\n"), "needs unit"},
		"a read of a credential store":    {sub("kind: action", "kind: action\nreads: [/root/.docker/config.json]"), "sensitive"},
	} {
		_, err := parseOpManifest([]byte(c.man))
		if err == nil || (c.want != "" && !strings.Contains(err.Error(), c.want)) {
			t.Errorf("%s: want a refusal saying %q, got %v", name, c.want, err)
		}
	}
	// A files op carrying an action op's fields is refused, not read as one.
	files := strings.Replace(opTestManifest, "modes:", "verbs:\n  - {verb: unit.restart, unit: a.service}\nmodes:", 1)
	if _, err := parseOpManifest([]byte(strings.Replace(files, "%s/", "/srv/work/optest/x/", 1))); err == nil || !strings.Contains(err.Error(), "belong to an action op") {
		t.Fatalf("a files op with verbs: %v", err)
	}
}

func TestSealedCredentialsOpenOnlyForThisRunAndThisOp(t *testing.T) {
	setupBox(t)
	m, err := parseOpManifest([]byte(opActionManifest))
	if err != nil {
		t.Fatal(err)
	}
	pub, _, err := opEncKey()
	if err != nil {
		t.Fatal(err)
	}
	exp := time.Now().Add(time.Hour).UTC().Format(time.RFC3339)
	seal := func(name, value, nonce, expires string) string {
		b, err := opSealCredFor(pub, opSealedCred{Name: name, Value: value, Nonce: nonce, Expires: expires})
		if err != nil {
			t.Fatal(err)
		}
		return b
	}
	nonce := "n-0123456789abcdef"
	good := []string{seal("forge-read", "tok-1", nonce, exp), seal("registry:acme", "tok-2", nonce, exp)}
	got, err := opOpenCreds(good, m, nonce, false)
	if err != nil || got["forge-read"] != "tok-1" || got["registry:acme"] != "tok-2" {
		t.Fatalf("both open: %v %v", got, err)
	}
	other, _, _ := opEncKeyPairForTest()
	for name, c := range map[string]struct {
		blobs []string
		want  string
	}{
		"sealed for another run":         {[]string{seal("forge-read", "t", "n-other-run-000000", exp), good[1]}, "another run"},
		"a name the op does not declare": {[]string{good[0], seal("root-ssh", "t", nonce, exp)}, "not one this op declares"},
		"expired":                        {[]string{seal("forge-read", "t", nonce, time.Now().Add(-time.Minute).UTC().Format(time.RFC3339)), good[1]}, "expired"},
		"one missing":                    {good[:1], "was not handed it"},
		"twice":                          {[]string{good[0], good[0]}, "arrived twice"},
		"too many":                       {append(append([]string{}, good...), good[0]), "more credentials"},
		"sealed to another machine":      {[]string{sealTo(t, other, opSealedCred{Name: "forge-read", Value: "t", Nonce: nonce, Expires: exp}), good[1]}, "does not open"},
		"tampered":                       {[]string{flipB64(good[0]), good[1]}, "does not open"},
	} {
		if _, err := opOpenCreds(c.blobs, m, nonce, false); err == nil || !strings.Contains(err.Error(), c.want) {
			t.Errorf("%s: want %q, got %v", name, c.want, err)
		}
	}
	if _, err := opOpenCreds(good, m, nonce, true); err == nil || !strings.Contains(err.Error(), "never handed") {
		t.Fatalf("a dry run is handed nothing: %v", err)
	}
}

func opEncKeyPairForTest() (*[32]byte, *[32]byte, error) {
	d := os.Getenv("XDG_CONFIG_HOME")
	os.Setenv("XDG_CONFIG_HOME", d+"-other")
	defer os.Setenv("XDG_CONFIG_HOME", d)
	return opEncKey()
}

func sealTo(t *testing.T, pub *[32]byte, c opSealedCred) string {
	b, err := opSealCredFor(pub, c)
	if err != nil {
		t.Fatal(err)
	}
	return b
}

func flipB64(s string) string {
	raw, _ := base64.StdEncoding.DecodeString(s)
	raw[len(raw)-1] ^= 1
	return base64.StdEncoding.EncodeToString(raw)
}

// The encryption key is stable, travels signed by the machine's own key, and
// a key file that does not read is never quietly replaced.
func TestEncryptionKeyIsStableSignedAndNeverSilentlyReplaced(t *testing.T) {
	setupBox(t)
	c1, c2 := opEncKeyClaim(), opEncKeyClaim()
	if c1 == nil || c1["public_key"] != c2["public_key"] {
		t.Fatalf("stable: %v %v", c1, c2)
	}
	mk, _ := base64.StdEncoding.DecodeString(c1["machine_key"].(string))
	sig, _ := base64.StdEncoding.DecodeString(c1["signature"].(string))
	if !ed25519.Verify(mk, opEncKeySigningInput(c1["public_key"].(string)), sig) {
		t.Fatal("the claim verifies under the machine's key")
	}
	if ed25519.Verify(mk, []byte(c1["public_key"].(string)), sig) {
		t.Fatal("the signature is over the tagged input only")
	}
	d, _ := configDir()
	_ = os.WriteFile(filepath.Join(d, opEncKeyFile), []byte("{broken"), 0o600)
	if _, _, err := opEncKey(); err == nil {
		t.Fatal("a broken key file is refused, not replaced")
	}
}

func TestReceiptsAreThisMachinesAndBindTheCommit(t *testing.T) {
	setupBox(t)
	digest := "sha256:" + strings.Repeat("c", 64)
	images := []opResultImage{{Image: "forge.example.com/acme/web", Digest: digest,
		Source: "https://forge.example.com/acme/app.git", Commit: strings.Repeat("d", 40)}}
	rs, err := opIssueReceipts("run1", "web-build", strings.Repeat("e", 64), `{"commit":"x"}`, images)
	if err != nil || len(rs) != 1 {
		t.Fatal(rs, err)
	}
	r, err := opReceiptFor(digest)
	if err != nil || r == nil || r.Commit != strings.Repeat("d", 40) || r.Op != "web-build" {
		t.Fatalf("held: %+v %v", r, err)
	}
	// A receipt alone is never a record of what is live: only a roll is.
	if _, _, _, ok := opRolledCommit(digest); ok {
		t.Fatal("a receipt made the digest look rolled")
	}
	// The first receipt for a digest stands: the same again is fine, another
	// commit for it is refused and changes nothing.
	if _, err := opIssueReceipts("run2", "web-build", strings.Repeat("e", 64), `{}`, images); err != nil {
		t.Fatalf("the same receipt again: %v", err)
	}
	conflict := []opResultImage{{Image: images[0].Image, Digest: digest, Source: images[0].Source, Commit: strings.Repeat("0", 40)}}
	if _, err := opIssueReceipts("run3", "web-build", strings.Repeat("e", 64), `{}`, conflict); err == nil || !strings.Contains(err.Error(), "already holds a receipt") {
		t.Fatalf("a conflicting receipt: %v", err)
	}
	if r, _ := opReceiptFor(digest); r == nil || r.Commit != strings.Repeat("d", 40) {
		t.Fatal("the first receipt was rewritten")
	}
	if r, _ := opReceiptFor("sha256:" + strings.Repeat("0", 64)); r != nil {
		t.Fatal("no receipt for a digest never built here")
	}
	// A receipt whose bytes changed does not verify.
	var raw map[string]any
	body, _ := base64.StdEncoding.DecodeString(rs[0].Payload)
	_ = json.Unmarshal(body, &raw)
	raw["commit"] = strings.Repeat("f", 40)
	forged, _ := json.Marshal(raw)
	if _, err := opVerifyReceipt(opSignedReceipt{PayloadType: opReceiptPayloadType, Payload: base64.StdEncoding.EncodeToString(forged), Signature: rs[0].Signature}); err == nil {
		t.Fatal("a changed receipt is refused")
	}
	// Nor one relabelled as another type.
	if _, err := opVerifyReceipt(opSignedReceipt{PayloadType: "application/json", Payload: rs[0].Payload, Signature: rs[0].Signature}); err == nil {
		t.Fatal("the payload type is part of what is signed")
	}
	// Nor one another machine signed.
	pub, priv, _ := ed25519.GenerateKey(nil)
	raw["key"] = base64.StdEncoding.EncodeToString(pub)
	other, _ := json.Marshal(raw)
	s := opSignedReceipt{PayloadType: opReceiptPayloadType, Payload: base64.StdEncoding.EncodeToString(other),
		Signature: base64.StdEncoding.EncodeToString(ed25519.Sign(priv, opReceiptSigningInput(other)))}
	if _, err := opVerifyReceipt(s); err == nil || !strings.Contains(err.Error(), "another machine") {
		t.Fatalf("a foreign receipt is refused here: %v", err)
	}
	// What a roll recorded is known too.
	d2 := "sha256:" + strings.Repeat("9", 64)
	_ = opRecordRoll(d2, opRollRec{Image: "forge.example.com/acme/web", Source: "s", Commit: strings.Repeat("8", 40)})
	if _, _, c, ok := opRolledCommit(d2); !ok || c != strings.Repeat("8", 40) {
		t.Fatal("a rolled digest's commit is known")
	}
}

func TestProgramResultIsJudged(t *testing.T) {
	good := `{"images":[{"image":"forge.example.com/acme/web","digest":"sha256:` + strings.Repeat("a", 64) +
		`","source":"https://forge.example.com/acme/app.git","commit":"` + strings.Repeat("b", 40) + `"}]}`
	if im, err := opParseResult([]byte(good)); err != nil || len(im) != 1 {
		t.Fatal(im, err)
	}
	for _, bad := range []string{
		`{"images":[{"image":"forge.example.com/acme/web:latest","digest":"sha256:` + strings.Repeat("a", 64) + `","source":"https://forge.example.com/a/b.git","commit":"` + strings.Repeat("b", 40) + `"}]}`,
		`{"images":[{"image":"forge.example.com/acme/web","digest":"sha256:short","source":"https://forge.example.com/a/b.git","commit":"` + strings.Repeat("b", 40) + `"}]}`,
		`{"images":[{"image":"forge.example.com/acme/web","digest":"sha256:` + strings.Repeat("a", 64) + `","source":"file:///etc","commit":"` + strings.Repeat("b", 40) + `"}]}`,
		`not json`,
	} {
		if _, err := opParseResult([]byte(bad)); err == nil {
			t.Errorf("refused: %s", bad)
		}
	}
}