package hostbox

import (
	"context"
	"crypto"
	"crypto/rand"
	"crypto/rsa"
	"crypto/sha256"
	"crypto/x509"
	"encoding/base64"
	"encoding/json"
	"errors"
	"github.com/carlosframework/platform/internal/boxid"
	"testing"
)

func TestIdentitySeparatesPlacementAndCloudRegion(t *testing.T) {
	p := IdentityProvider{Account: "123", Box: "box", Region: "ie", AWSRegion: "eu-west-1", Bucket: "data", Namespace: "platform"}
	a := Actor{Box: "box", Enrollment: "en", Revision: 1, Binding: "binding", Region: "ie", Bucket: "data", Namespace: "platform", Eligible: true, Cloud: CloudIdentity{Provider: "aws", Account: "123", Region: "eu-west-1", InstanceID: "i-box"}}
	if !p.actorMatches(a) {
		t.Fatal("placement and AWS regions were conflated")
	}
	a.Cloud.Region = "us-east-1"
	if p.actorMatches(a) {
		t.Fatal("foreign cloud region admitted")
	}
}

type enrollmentRoster struct{ actor Actor }

func (r enrollmentRoster) Actor(context.Context, string) (Actor, error) { return r.actor, nil }

type enrollmentEvidence []byte

func (e enrollmentEvidence) Load(context.Context, string) ([]byte, error) { return e, nil }

func TestIdentityEnrollmentBindsSignedCloudAndPlacement(t *testing.T) {
	key, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		t.Fatal(err)
	}
	cert := &x509.Certificate{PublicKey: &key.PublicKey, PublicKeyAlgorithm: x509.RSA}
	actor := Actor{Box: "annie-welding", Enrollment: "en", Revision: 1, Binding: "binding", Region: "ie", Bucket: "data", Namespace: "platform", Eligible: true, Cloud: CloudIdentity{Provider: "aws", Account: "111122223333", Region: "eu-west-1", InstanceID: "i-0abc"}}
	p := IdentityProvider{Account: actor.Cloud.Account, Box: actor.Box, Region: actor.Region, AWSRegion: actor.Cloud.Region, Bucket: actor.Bucket, Namespace: actor.Namespace, Roster: enrollmentRoster{actor}, Certs: map[string]*x509.Certificate{"eu-west-1": cert}}
	record := func(box, account, region, instance string) []byte {
		t.Helper()
		doc, err := json.Marshal(map[string]string{"accountId": account, "region": region, "instanceId": instance})
		if err != nil {
			t.Fatal(err)
		}
		sum := sha256.Sum256(doc)
		sig, err := rsa.SignPKCS1v15(rand.Reader, key, crypto.SHA256, sum[:])
		if err != nil {
			t.Fatal(err)
		}
		raw, err := json.Marshal(boxid.Record{V: 1, Box: box, IdentityDocument: base64.StdEncoding.EncodeToString(doc), IdentitySignature: base64.StdEncoding.EncodeToString(sig)})
		if err != nil {
			t.Fatal(err)
		}
		return raw
	}
	good := record(actor.Box, actor.Cloud.Account, actor.Cloud.Region, actor.Cloud.InstanceID)
	p.Evidence = enrollmentEvidence(good)
	if got, err := p.Verify(t.Context()); err != nil || got != actor {
		t.Fatalf("enrollment: got=%+v err=%v", got, err)
	}
	for name, raw := range map[string][]byte{
		"other instance": record(actor.Box, actor.Cloud.Account, actor.Cloud.Region, "i-other"),
		"other box":      record("bert-sawing", actor.Cloud.Account, actor.Cloud.Region, actor.Cloud.InstanceID),
		"other account":  record(actor.Box, "999999999999", actor.Cloud.Region, actor.Cloud.InstanceID),
		"other region":   record(actor.Box, actor.Cloud.Account, "eu-west-2", actor.Cloud.InstanceID),
		"malformed":      []byte("{}"),
	} {
		t.Run(name, func(t *testing.T) {
			q := p
			q.Evidence = enrollmentEvidence(raw)
			if _, err := q.Verify(t.Context()); !errors.Is(err, boxid.ErrUnverified) {
				t.Fatalf("unbound evidence accepted: %v", err)
			}
		})
	}
	q := p
	q.AWSRegion = "eu-west-2"
	if _, err := q.Verify(t.Context()); !errors.Is(err, ErrChanged) {
		t.Fatalf("wrong cloud placement accepted: %v", err)
	}
}