package rootstate

import (
	"context"
	"errors"
	"os"
	"path/filepath"
	"strings"
	"testing"
	"time"

	"golang.org/x/sys/unix"
)

func fixture(t *testing.T) (string, Store) {
	t.Helper()
	parent := t.TempDir()
	if err := os.Chmod(parent, 0700); err != nil {
		t.Fatal(err)
	}
	f, err := os.Open(parent)
	if err != nil {
		t.Fatal(err)
	}
	defer f.Close()
	d, err := descend(f, []string{"trusted"}, true, false, uint32(os.Geteuid()))
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { d.Close() })
	return filepath.Join(parent, "trusted"), d
}

func TestPlan14HostileOwnership(t *testing.T) {
	if os.Geteuid() == 0 {
		t.Skip("nonroot witness; root ownership substitution is covered separately")
	}
	path, _ := fixture(t)
	if _, err := Open(path, false, false); err == nil {
		t.Fatal("root trusted real non-root-owned ancestors")
	}
	f, err := os.Create(filepath.Join(path, "file"))
	if err != nil {
		t.Fatal(err)
	}
	defer f.Close()
	if err := trusted(int(f.Fd()), 0, unix.S_IFREG); !errors.Is(err, os.ErrPermission) {
		t.Fatalf("real non-root-owned leaf accepted: %v", err)
	}
}

func TestPlan14SymlinksHardlinksFIFOAndModes(t *testing.T) {
	for _, attack := range []string{"leaf-link", "hardlink", "fifo", "writable", "directory-writable", "ancestor-link"} {
		t.Run(attack, func(t *testing.T) {
			path, d := fixture(t)
			leaf := filepath.Join(path, "record")
			switch attack {
			case "leaf-link":
				if err := os.Symlink("missing", leaf); err != nil {
					t.Fatal(err)
				}
			case "hardlink":
				if err := d.Write("other", []byte("safe")); err != nil {
					t.Fatal(err)
				}
				if err := os.Link(filepath.Join(path, "other"), leaf); err != nil {
					t.Fatal(err)
				}
			case "fifo":
				if err := unix.Mkfifo(leaf, 0600); err != nil {
					t.Fatal(err)
				}
			case "writable":
				if err := os.WriteFile(leaf, []byte("false proof"), 0600); err != nil {
					t.Fatal(err)
				}
				if err := os.Chmod(leaf, 0666); err != nil {
					t.Fatal(err)
				}
			case "directory-writable":
				if err := d.Write("record", []byte("safe")); err != nil {
					t.Fatal(err)
				}
				if err := os.Chmod(path, 0777); err != nil {
					t.Fatal(err)
				}
			case "ancestor-link":
				parent, err := os.Open(filepath.Dir(path))
				if err != nil {
					t.Fatal(err)
				}
				defer parent.Close()
				if err := os.Symlink("trusted", filepath.Join(filepath.Dir(path), "alias")); err != nil {
					t.Fatal(err)
				}
				if got, err := descend(parent, []string{"alias"}, false, false, uint32(os.Geteuid())); err == nil {
					got.Close()
					t.Fatal("followed ancestor")
				}
				return
			}
			if _, err := d.Read("record"); err == nil {
				t.Fatal("read accepted hostile file")
			}
			if err := d.Write("record", []byte("replacement")); err == nil {
				t.Fatal("write repaired hostile file")
			}
		})
	}
}

func TestPlan14RenameKeepsDescriptor(t *testing.T) {
	path, d := fixture(t)
	if err := d.Write("record", []byte("original")); err != nil {
		t.Fatal(err)
	}
	moved := path + "-old"
	if err := os.Rename(path, moved); err != nil {
		t.Fatal(err)
	}
	if err := os.Mkdir(path, 0700); err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(filepath.Join(path, "record"), []byte("forged"), 0600); err != nil {
		t.Fatal(err)
	}
	b, err := d.Read("record")
	if err != nil || string(b) != "original" {
		t.Fatalf("%q %v", b, err)
	}
	if err := d.Write("record", []byte("updated")); err != nil {
		t.Fatal(err)
	}
	b, err = os.ReadFile(filepath.Join(path, "record"))
	if err != nil || string(b) != "forged" {
		t.Fatalf("touched replacement: %q %v", b, err)
	}
}

func TestPlan14LockAndLimits(t *testing.T) {
	_, d := fixture(t)
	unlock, err := d.Lock(t.Context(), "host.lock")
	if err != nil {
		t.Fatal(err)
	}
	ctx, cancel := context.WithTimeout(t.Context(), 20*time.Millisecond)
	defer cancel()
	if release, err := d.Lock(ctx, "host.lock"); err == nil {
		release()
		t.Fatal("split lock")
	} else if !errors.Is(err, context.DeadlineExceeded) {
		t.Fatal(err)
	}
	unlock()
	unlock, err = d.Lock(t.Context(), "host.lock")
	if err != nil {
		t.Fatal(err)
	}
	unlock()
	if err := d.Write("large", []byte(strings.Repeat("x", MaxRecord+1))); err == nil {
		t.Fatal("unbounded write")
	}
	if err := d.Write("../escape", []byte("x")); err == nil {
		t.Fatal("escaped store")
	}
	for i := 0; i < 2; i++ {
		names, err := d.Names()
		if err != nil || len(names) != 1 {
			t.Fatalf("scan %d: %v %v", i, names, err)
		}
	}
}

func TestPlan14RootOwnedParentRejectsServiceLeaf(t *testing.T) {
	if os.Geteuid() != 0 {
		t.Skip("requires uid 0 and chown; run in disposable root-owned test root")
	}
	path, d := fixture(t)
	if err := d.Write("record", []byte("forged")); err != nil {
		t.Fatal(err)
	}
	if err := os.Chown(filepath.Join(path, "record"), 65534, 65534); err != nil {
		t.Fatal(err)
	}
	if _, err := d.Read("record"); !errors.Is(err, os.ErrPermission) {
		t.Fatalf("%v", err)
	}
	if err := d.Write("record", []byte("replacement")); !errors.Is(err, os.ErrPermission) {
		t.Fatalf("%v", err)
	}
}

func TestPlan14DescendRetriesEveryAncestorSync(t *testing.T) {
	for failAt := 1; failAt <= 3; failAt++ {
		t.Run(string(rune('0'+failAt)), func(t *testing.T) {
			base := t.TempDir()
			if err := os.Chmod(base, 0700); err != nil {
				t.Fatal(err)
			}
			parent, err := os.Open(base)
			if err != nil {
				t.Fatal(err)
			}
			defer parent.Close()
			parts := []string{"a", "b", "c"}
			calls := 0
			injected := errors.New("parent fsync")
			_, err = descendSync(parent, parts, true, false, uint32(os.Geteuid()), func(fd int) error {
				calls++
				if calls == failAt {
					return injected
				}
				return unix.Fsync(fd)
			})
			if !errors.Is(err, injected) {
				t.Fatalf("first traversal: %v", err)
			}
			if _, err := os.Stat(filepath.Join(append([]string{base}, parts[:failAt]...)...)); err != nil {
				t.Fatal(err)
			}
			calls = 0
			d, err := descendSync(parent, parts, true, false, uint32(os.Geteuid()), func(fd int) error {
				calls++
				return unix.Fsync(fd)
			})
			if err != nil {
				t.Fatal(err)
			}
			defer d.Close()
			if calls != len(parts) {
				t.Fatalf("retry synced %d parents, want %d", calls, len(parts))
			}
			if err := d.Write("record", []byte("durable")); err != nil {
				t.Fatal(err)
			}
			// Even an all-existing path must still propagate a sync failure.
			_, err = descendSync(parent, parts, true, false, uint32(os.Geteuid()), func(int) error { return injected })
			if !errors.Is(err, injected) {
				t.Fatalf("existing traversal: %v", err)
			}
		})
	}
}

func TestPlan14RemoveCapability(t *testing.T) {
	path, s := fixture(t)
	if err := s.Write("capability", []byte("secret")); err != nil {
		t.Fatal(err)
	}
	if err := s.Remove("capability"); err != nil {
		t.Fatal(err)
	}
	if _, err := s.Read("capability"); !errors.Is(err, os.ErrNotExist) {
		t.Fatal(err)
	}
	if err := s.Remove("capability"); err != nil {
		t.Fatal(err)
	}
	if err := s.Remove("../escape"); err == nil {
		t.Fatal("escaped")
	}
	if err := os.Symlink("outside", filepath.Join(path, "capability")); err != nil {
		t.Fatal(err)
	}
	if err := s.Remove("capability"); err == nil {
		t.Fatal("removed untrusted entry")
	}
}