//go:build linux

package instanceexec

import (
	"encoding/json"
	"net"
	"os"
	"os/exec"
	"path/filepath"
	"testing"

	"github.com/carlosframework/platform/internal/instancectl"
)

func TestRev3ExecBoundaryHelper(t *testing.T) {
	if os.Getenv("REV3_EXEC_HELPER") != "1" {
		return
	}
	args := os.Args
	dir := args[len(args)-1]
	// Simulate setup consuming the lease. This uses runInit's production fork
	// path and a real socket; only the host clock and namespace scope are faked.
	clock := int64(100)
	err := runInitChecked("/bin/sh", []string{"sh", "-c", "echo tenant > \"$1\"", "sh", filepath.Join(dir, "tenant")}, os.Environ(), func() error { clock = 200; return nil }, func() error {
		return checkClaimExec(filepath.Join(dir, "permit"), filepath.Join(dir, "gate"), uint32(os.Geteuid()), func() (string, int64, error) { return "boot", clock, nil })
	})
	if err == nil {
		t.Fatal("expired execution accepted")
	}
}
func TestRev3TrampolineExpiresBeforeForkExec(t *testing.T) {
	dir, err := os.MkdirTemp("", "rx")
	if err != nil {
		t.Fatal(err)
	}
	defer os.RemoveAll(dir)
	p := instancectl.ClaimExecPermit{Reservation: "attempt:main", Inputs: "digest", BootID: "boot", SafeUntil: 200, Containment: 1}
	b, _ := json.Marshal(p)
	if err = os.WriteFile(filepath.Join(dir, "permit"), b, 0444); err != nil {
		t.Fatal(err)
	}
	ln, err := net.Listen("unix", filepath.Join(dir, "gate"))
	if err != nil {
		t.Fatal(err)
	}
	defer ln.Close()
	done := make(chan error, 1)
	go func() {
		c, e := ln.Accept()
		if e != nil {
			done <- e
			return
		}
		defer c.Close()
		var q instancectl.ClaimExecPermit
		e = json.NewDecoder(c).Decode(&q)
		if e == nil {
			e = json.NewEncoder(c).Encode(p)
		}
		done <- e
	}()
	cmd := exec.Command(os.Args[0], "-test.run=^TestRev3ExecBoundaryHelper$", "--", dir)
	cmd.Env = append(os.Environ(), "REV3_EXEC_HELPER=1")
	cmd.Dir = dir
	if out, err := cmd.CombinedOutput(); err != nil {
		t.Fatalf("helper: %v %s", err, out)
	}
	if err = <-done; err != nil {
		t.Fatal(err)
	}
	if _, err = os.Stat(filepath.Join(dir, "tenant")); !os.IsNotExist(err) {
		t.Fatalf("tenant executed after expiry: %v", err)
	}
}
func TestRev3BoundaryTrustAndPermit(t *testing.T) {
	for _, name := range []string{"valid", "expired", "wrong boot", "wrong reservation", "old containment", "old snapshot", "writable", "missing", "symlink"} {
		t.Run(name, func(t *testing.T) {
			dir, err := os.MkdirTemp("", "rp")
			if err != nil {
				t.Fatal(err)
			}
			defer os.RemoveAll(dir)
			p := instancectl.ClaimExecPermit{Reservation: "attempt:main", Inputs: "digest", BootID: "boot", SafeUntil: 200, Containment: 1}
			if name == "old snapshot" {
				p.Containment = 0
			}
			path := filepath.Join(dir, "permit")
			b, _ := json.Marshal(p)
			if err = os.WriteFile(path, b, 0444); err != nil {
				t.Fatal(err)
			}
			switch name {
			case "writable":
				os.Chmod(path, 0644)
			case "missing":
				os.Remove(path)
			case "symlink":
				os.Rename(path, path+".real")
				os.Symlink(path+".real", path)
			}
			ln, err := net.Listen("unix", filepath.Join(dir, "gate"))
			if err != nil {
				t.Fatal(err)
			}
			done := make(chan struct{})
			go func() {
				defer close(done)
				c, e := ln.Accept()
				if e != nil {
					return
				}
				defer c.Close()
				var q instancectl.ClaimExecPermit
				if json.NewDecoder(c).Decode(&q) != nil {
					return
				}
				if name == "old containment" {
					p.Containment = 0
				}
				if name == "wrong reservation" {
					p.Reservation = "other"
				}
				_ = json.NewEncoder(c).Encode(p)
			}()
			clock := func() (string, int64, error) {
				if name == "expired" {
					return "boot", 200, nil
				}
				if name == "wrong boot" {
					return "other", 100, nil
				}
				return "boot", 100, nil
			}
			err = checkClaimExec(path, filepath.Join(dir, "gate"), uint32(os.Geteuid()), clock)
			ln.Close()
			<-done
			if (err == nil) != (name == "valid") {
				t.Fatalf("%s: %v", name, err)
			}
		})
	}
}