package unixdial

import (
	"context"
	"errors"
	"fmt"
	"net"
	"os"
	"path/filepath"
	"testing"
)

// short returns a socket path short enough for sockaddr_un under the
// session's long TMPDIR (SDD lessons: run with TMPDIR=/tmp/g).
func short(t *testing.T, name string) string {
	t.Helper()
	dir, err := os.MkdirTemp("", "ud")
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { os.RemoveAll(dir) })
	return filepath.Join(dir, name)
}

func listen(t *testing.T, path string) net.Listener {
	t.Helper()
	ln, err := net.Listen("unix", path)
	if err != nil {
		t.Skipf("cannot bind a unix socket here (%v); run with TMPDIR=/tmp/g outside the sandbox", err)
	}
	t.Cleanup(func() { ln.Close() })
	go func() {
		for {
			c, err := ln.Accept()
			if err != nil {
				return
			}
			c.Close()
		}
	}()
	return ln
}

// TestCheckedAcceptsAListenerBoundAtTheDialledPath pins acceptance across a
// few ordinary path shapes. It is not testing anything Checked branches on
// by file name: the only path-based refusal is the control directory
// (codex R5-1, covered by TestCheckedRefusesTheControlEndpointBeforeDialling
// and the package doc), and the peer check consults no credentials by
// construction — Checked never looks at SO_PEERCRED, so there is nothing
// about "who created the listener" for a test to exercise (codex R4-1,
// also covered by the package doc). These rows exist only to show the
// ordinary-acceptance path isn't an accident of one particular name.
func TestCheckedAcceptsAListenerBoundAtTheDialledPath(t *testing.T) {
	for _, name := range []string{"app.sock", "apps.sock", "example.sock"} {
		t.Run(name, func(t *testing.T) {
			path := short(t, name)
			listen(t, path)
			c, err := Checked(context.Background(), &net.Dialer{}, path)
			if err != nil {
				t.Fatalf("Checked: %v", err)
			}
			c.Close()
		})
	}
}

func TestCheckedRefusesASymlinkToAnotherListener(t *testing.T) {
	real := short(t, "other.sock")
	listen(t, real)
	link := short(t, "app.sock")
	if err := os.Symlink(real, link); err != nil {
		t.Fatal(err)
	}
	c, err := Checked(context.Background(), &net.Dialer{}, link)
	if c != nil {
		c.Close()
	}
	if !errors.Is(err, ErrPeerMismatch) {
		t.Fatalf("err = %v, want ErrPeerMismatch", err)
	}
}

func TestCheckedRefusesTheControlEndpointBeforeDialling(t *testing.T) {
	// No listener exists; the refusal must come from the path check, not
	// from a connect error.
	_, err := Checked(context.Background(), &net.Dialer{}, "/run/carlos-control/control.sock")
	if !errors.Is(err, ErrControlEndpoint) {
		t.Fatalf("err = %v, want ErrControlEndpoint", err)
	}
}

// TestCheckedRefusesAnAbstractPeer dials an abstract-namespace listener
// (name[0] == '@', no filesystem path, so no symlink attack even applies)
// directly by its abstract name. An abstract name never equals a cleaned
// filesystem path, and verifyPeer refuses any peer whose bound name is
// abstract outright rather than comparing it — abstract sockets carry no
// filesystem permissions, so an abstract peer is never an acceptable
// upstream.
func TestCheckedRefusesAnAbstractPeer(t *testing.T) {
	name := fmt.Sprintf("@carlos-unixdial-test-%d", os.Getpid())
	listen(t, name)
	c, err := Checked(context.Background(), &net.Dialer{}, name)
	if c != nil {
		c.Close()
	}
	if !errors.Is(err, ErrPeerMismatch) {
		t.Fatalf("err = %v, want ErrPeerMismatch", err)
	}
}

// nameOnlyConn implements just enough of net.Conn for verifyPeer, which
// only ever calls RemoteAddr on the connection it is checking.
type nameOnlyConn struct {
	net.Conn
	remote net.Addr
}

func (c nameOnlyConn) RemoteAddr() net.Addr { return c.remote }

// TestVerifyPeerRefusesAnEmptyNamePeer covers the unnamed-peer branch
// directly: an unnamed unix socket (as from socketpair, or a client's own
// unconnected end) reports an empty Name from getpeername, which must
// never be treated as matching any dialled path.
func TestVerifyPeerRefusesAnEmptyNamePeer(t *testing.T) {
	conn := nameOnlyConn{remote: &net.UnixAddr{Net: "unix", Name: ""}}
	if err := verifyPeer(conn, "/some/dialled/path.sock"); !errors.Is(err, ErrPeerMismatch) {
		t.Fatalf("verifyPeer = %v, want ErrPeerMismatch", err)
	}
}

// TestVerifyPeerRequiresByteEqualBoundPath pins the review fix: the peer
// name the kernel reports must equal the cleaned dialled path byte for
// byte, not merely after being cleaned itself, and a peer name with a ".."
// component is refused outright even when a naive clean-and-compare would
// have accepted it.
func TestVerifyPeerRequiresByteEqualBoundPath(t *testing.T) {
	conn := nameOnlyConn{remote: &net.UnixAddr{Net: "unix", Name: "/x/../app.sock"}}
	if err := verifyPeer(conn, "/app.sock"); !errors.Is(err, ErrPeerMismatch) {
		t.Fatalf("verifyPeer(%q) = %v, want ErrPeerMismatch: a peer name with a .. component must never be accepted", "/x/../app.sock", err)
	}

	conn = nameOnlyConn{remote: &net.UnixAddr{Net: "unix", Name: "/app.sock"}}
	if err := verifyPeer(conn, "/app.sock"); err != nil {
		t.Fatalf("verifyPeer(%q) = %v, want nil: an exact byte-for-byte match must be accepted", "/app.sock", err)
	}
}

func TestCheckedPassesConnectErrorsThrough(t *testing.T) {
	path := short(t, "absent.sock")
	_, err := Checked(context.Background(), &net.Dialer{}, path)
	if err == nil || errors.Is(err, ErrPeerMismatch) || errors.Is(err, ErrControlEndpoint) {
		t.Fatalf("err = %v, want the raw connect error (ENOENT) so retry logic still sees it", err)
	}
}