package host

import (
	"context"
	"slices"
	"strings"
	"testing"

	"github.com/carlosframework/platform/internal/instancectl"
)

func TestPlan14EffectiveBoundUnit(t *testing.T) {
	_, _, shape := plan14UnitBindingFixture(t, "console.service", "", "")
	shape.Program = strings.Repeat("a", 64)
	definition, err := claimBoundUnitDefinition(shape)
	if err != nil {
		t.Fatal(err)
	}
	values := map[string]string{"FragmentPath": "/etc/systemd/system/console.service", "DropInPaths": "", "NeedDaemonReload": "no", "ExecStart": "{ path=/usr/bin/false ; argv[]=/usr/bin/false ; }", "IPAddressAllow": "", "IPAddressDeny": "", "Slice": instancectl.SliceName(shape.Host)}
	for _, line := range strings.Split(string(definition), "\n") {
		k, v, ok := strings.Cut(line, "=")
		if !ok {
			continue
		}
		if k == "ExecStart" {
			continue
		}
		values[k] = v
	}
	for _, attack := range []string{"none", "DropInPaths", "User", "Group", "NoNewPrivileges", "ProtectSystem", "PrivatePIDs", "IPAddressAllow", "ExecStart", "NeedDaemonReload", "FragmentPath", "SocketBindAllow", "SocketBindDeny", "BindsTo", "PartOf"} {
		t.Run(attack, func(t *testing.T) {
			ctl := func(_ context.Context, args ...string) (string, error) {
				var out strings.Builder
				for _, key := range strings.Split(args[2], ",") {
					value := values[key]
					if key == attack {
						value = "forged"
						if key == "BindsTo" || key == "PartOf" {
							value = "carlos-edge.service"
						}
					}
					out.WriteString(key + "=" + value + "\n")
				}
				return out.String(), nil
			}
			err := claimEffectiveUnit(t.Context(), shape, ctl)
			if attack == "none" && err != nil {
				t.Fatal(err)
			}
			if attack != "none" && err == nil {
				t.Fatal("effective override accepted", attack)
			}
		})
	}
}

func TestPlan14EffectiveNetworkReduction(t *testing.T) {
	a, err := claimIPSet("localhost 169.254.0.0/16 169.254.169.254/32 fc00::/7 fd00:ec2::254/128")
	if err != nil {
		t.Fatal(err)
	}
	b, err := claimIPSet("127.0.0.0/8 ::1/128 169.254.0.0/16 fc00::/7")
	if err != nil || !slices.Equal(a, b) {
		t.Fatal(a, b, err)
	}
	c, err := claimIPSet("127.0.0.0/8 ::1/128 169.254.0.0/15 fc00::/7")
	if err != nil || slices.Equal(a, c) {
		t.Fatal("broadened set accepted", a, c, err)
	}
}