package host

import (
	"strings"
	"testing"

	"github.com/carlosframework/platform/internal/instancectl"
	"github.com/carlosframework/platform/internal/provision"
)

func TestPlan14BoundUnitDefinition(t *testing.T) {
	_, _, shape := plan14UnitBindingFixture(t, "console.service", "", "")
	shape.Program = strings.Repeat("a", 64)
	for _, tcp := range []bool{true, false} {
		if !tcp {
			shape.Addr, shape.Socket = "", provision.NestedSocket(shape.Host)
		}
		raw, err := claimBoundUnitDefinition(shape)
		if err != nil {
			t.Fatal(err)
		}
		body := string(raw)
		if !strings.Contains(body, "ExecStart=/usr/bin/false\n") || strings.Contains(body, "ExecStart=/opt/carlos/carlos instance-exec") || !strings.Contains(body, "Restart=no\n") || !strings.Contains(body, "Slice="+instancectl.SliceName(shape.Host)+"\n") || strings.Contains(body, "%I") || strings.Contains(body, "%i") {
			t.Fatal("definition permits unreserved execution or foreign placement")
		}
		if strings.Contains(body, "IPAddressAllow=localhost") {
			t.Fatal("broad loopback allowance")
		}
		if tcp && (!strings.Contains(body, "SocketBindDeny=any\n") || !strings.Contains(body, "SocketBindAllow=ipv4:tcp:8090\n")) {
			t.Fatal("missing exact listener bind restriction")
		}
		if strings.Contains(body, "BindsTo=carlos-edge.service") {
			t.Fatal("edge restart stops bound operator unit")
		}
		for _, setting := range []string{"ProtectControlGroups=yes", "PrivatePIDs=yes", "NoNewPrivileges=yes", "CapabilityBoundingSet=", "TemporaryFileSystem=/opt/carlos:ro"} {
			if !strings.Contains(body, setting+"\n") {
				t.Fatal("missing containment", setting)
			}
		}
	}
	shape.Host = "woodstar-media.example"
	shape.Socket = provision.NestedSocket(shape.Host)
	raw, err := claimBoundUnitDefinition(shape)
	if err != nil {
		t.Fatal(err)
	}
	if !strings.Contains(string(raw), "Slice="+instancectl.SliceName(shape.Host)+"\n") {
		t.Fatal("named unit used unescaped slice")
	}
}

func TestPlan14FlatBoundSocketDefinition(t *testing.T) {
	_, _, shape := plan14UnitBindingFixture(t, "woodstar-media.service", "", "/run/carlos/woodstar-media.sock")
	shape.Program = strings.Repeat("a", 64)
	raw, err := claimBoundUnitDefinition(shape)
	if err != nil {
		t.Fatal(err)
	}
	own := provision.InstanceRunDir(shape.Host)
	if !strings.Contains(string(raw), "BindPaths="+own+":/run/carlos\n") || !strings.Contains(string(raw), "ReadWritePaths=/run/carlos\n") {
		t.Fatal("flat path has no private run view")
	}
	if strings.Contains(string(raw), "BindPaths=/run/carlos:/run/carlos") || strings.Contains(string(raw), "TemporaryFileSystem=/run/carlos:ro") {
		t.Fatal("flat socket exposes siblings")
	}
	for _, socket := range []string{"/run/carlos/../other.sock", "/run/carlos/other/path.sock", "/run/carlos/space name.sock", "/run/carlos/percent%name.sock", "/elsewhere/app.sock"} {
		shape.Socket = socket
		if _, err := claimBoundUnitDefinition(shape); err == nil {
			t.Fatal("unsafe socket", socket)
		}
	}
}

func TestPlan14BoundTemplateNotBootstrapped(t *testing.T) {
	names, err := unitNames()
	if err != nil {
		t.Fatal(err)
	}
	for _, name := range names {
		if name == "carlos-claim-bound.service" {
			t.Fatal("claim template changes no-census bootstrap")
		}
	}
}

func TestPlan14MappedLoopbackDefinition(t *testing.T) {
	_, _, s := plan14UnitBindingFixture(t, "console.service", "", "")
	s.Program = strings.Repeat("a", 64)
	s.Addr = "[::ffff:127.0.0.1]:8090"
	raw, err := claimBoundUnitDefinition(s)
	if err != nil {
		t.Fatal(err)
	}
	if !strings.Contains(string(raw), "IPAddressAllow=127.0.0.1/32\n") || strings.Contains(string(raw), "IPAddressAllow=::ffff") {
		t.Fatal("mapped address broadened IPv6 allowance")
	}
}