package main

import (
	"crypto/rand"
	"encoding/base64"
	"encoding/json"
	"os"
	"path/filepath"
	"strings"
	"testing"

	"golang.org/x/crypto/nacl/box"
)

const typedValue = "123456789:AAEhBP0av28P4XFQnIuR-o-7Xnz1kkUzW3g"

func aKey(t *testing.T) (string, *[32]byte, *[32]byte) {
	t.Helper()
	pub, priv, err := box.GenerateKey(rand.Reader)
	if err != nil {
		t.Fatal(err)
	}
	return base64.StdEncoding.EncodeToString(pub[:]), pub, priv
}

// novox/hq ADR 0259 §10: what the operator types in the hidden prompt is answered sealed to the asker's
// key, and never in the clear — not in the answer, not in an error.
func TestWhatIsTypedIsAnsweredSealedToTheAskersKeyAndNeverInTheClear(t *testing.T) {
	withSession(t)
	bin := fakeBinaries(t, map[string]string{"rofi": `echo "$*" > "$LOG"; echo "` + typedValue + `"`})
	t.Setenv("LOG", filepath.Join(bin, "log"))
	key, pub, priv := aKey(t)
	q, err := secretQuestion("unproven", map[string]any{"module": "telegram", "secret": "telegram-token", "node": "anchor", "seal_to": key})
	if err != nil {
		t.Fatal(err)
	}
	got, err := Secret(q)
	if err != nil || got.Cancelled || got.Sealed == "" {
		t.Fatalf("%+v %v", got, err)
	}
	raw, _ := json.Marshal(got)
	if strings.Contains(string(raw), typedValue) || strings.Contains(string(raw), "AAEhBP0") {
		t.Fatal("the answer carries what was typed in the clear")
	}
	blob, _ := base64.StdEncoding.DecodeString(got.Sealed)
	opened, ok := box.OpenAnonymous(nil, blob, pub, priv)
	if !ok || string(opened) != typedValue {
		t.Fatalf("the answer does not open to what was typed, its line ending taken off")
	}
	asked, _ := os.ReadFile(filepath.Join(bin, "log"))
	for _, want := range []string{"-dmenu", "-password", "-p telegram-token for telegram",
		"-mesg The mesh's controller asks for telegram-token, the own secret of telegram on anchor"} {
		if !strings.Contains(string(asked), want) {
			t.Errorf("rofi was not asked %q: %s", want, asked)
		}
	}
	if strings.Contains(string(asked), "-no-custom") {
		t.Error("the prompt takes no typed answer")
	}
}

func TestADismissedEmptyOrLatePromptIsACancelAndAFailureNeverSaysTheValue(t *testing.T) {
	withSession(t)
	key, _, _ := aKey(t)
	q, _ := secretQuestion("unproven", map[string]any{"module": "telegram", "secret": "telegram-token", "node": "anchor", "seal_to": key, "timeout_seconds": 1})
	for script, timedOut := range map[string]bool{`exit 1`: false, `echo ""`: false, `sleep 30`: true} {
		fakeBinaries(t, map[string]string{"rofi": script})
		got, err := Secret(q)
		if err != nil || !got.Cancelled || got.TimedOut != timedOut || got.Sealed != "" {
			t.Errorf("%s: %+v %v", script, got, err)
		}
	}
	fakeBinaries(t, map[string]string{"rofi": `echo "` + typedValue + `"; echo "rofi broke" >&2; exit 3`})
	if _, err := Secret(q); err == nil || strings.Contains(err.Error(), typedValue) || !strings.Contains(err.Error(), "rofi broke") {
		t.Errorf("a failure said %v", err)
	}
}

func TestASecretIsAskedOnlyWithAKeyToSealItTo(t *testing.T) {
	key := base64.StdEncoding.EncodeToString(make([]byte, 32))
	named := func(extra map[string]any) map[string]any {
		a := map[string]any{"module": "telegram", "secret": "telegram-token", "node": "anchor"}
		for k, v := range extra {
			a[k] = v
		}
		return a
	}
	for _, args := range []map[string]any{
		named(nil),
		named(map[string]any{"seal_to": "not a key"}),
		named(map[string]any{"seal_to": base64.StdEncoding.EncodeToString([]byte("short"))}),
		named(map[string]any{"seal_to": key, "timeout_seconds": 60}),
		{"seal_to": key},
	} {
		if _, err := secretQuestion("unproven", args); err == nil {
			t.Errorf("%v was taken", args)
		}
	}
}

// The prompt is this holder's words from names, never the caller's (the review of 2026-10-09, M4): it says the
// mesh's controller asks — the bus lets nobody else ask it — and for which secret of which module on which
// machine; words of the caller's, and a name that is not one, are refused.
func TestThePromptIsWrittenHereFromNamesAndSaysTheControllerAsks(t *testing.T) {
	key := base64.StdEncoding.EncodeToString(make([]byte, 32))
	base := map[string]any{"module": "telegram", "secret": "telegram-token", "node": "anchor", "seal_to": key}
	q, err := secretQuestion("unproven", base)
	if err != nil {
		t.Fatal(err)
	}
	if q.Prompt != "telegram-token for telegram" || !strings.HasPrefix(q.Message, "The mesh's controller asks for telegram-token") ||
		strings.Contains(q.Message, "asked for by") {
		t.Errorf("prompt %q, message %q", q.Prompt, q.Message)
	}
	// Asked by the vault's own account, as the runtime proved it (issue 723): the prompt says the vault asks.
	if q, err := secretQuestion("novox.mesh-vault", base); err != nil ||
		!strings.HasPrefix(q.Message, "The mesh's vault asks for telegram-token") {
		t.Errorf("asked by the vault: %q %v", q.Message, err)
	}
	if q, _ := secretQuestion("novox.mesh-vault-not", base); !strings.HasPrefix(q.Message, "The mesh's controller") {
		t.Errorf("a caller that is not the vault's account is said to be the vault: %q", q.Message)
	}
	// And who asked the controller, when it says so (novox/hq ADR 0277): a caller's name, in a name's characters.
	withAsker := map[string]any{}
	for k, v := range base {
		withAsker[k] = v
	}
	withAsker["asked_by"] = "g14/claude-code"
	q, err = secretQuestion("unproven", withAsker)
	if err != nil || !strings.Contains(q.Message, "It was asked for by g14/claude-code.") {
		t.Errorf("asked_by: %q %v", q.Message, err)
	}
	withAsker["asked_by"] = "jochen at a shell on novox"
	if q, err = secretQuestion("unproven", withAsker); err != nil || !strings.Contains(q.Message, "It was asked for by jochen at a shell on novox.") {
		t.Errorf("asked_by at a shell: %q %v", q.Message, err)
	}
	for key, value := range map[string]any{
		"prompt":   "Your bank's PIN",
		"message":  "Your bank asks",
		"module":   "telegram\nYour bank asks",
		"secret":   "a token",
		"node":     "<b>anchor</b>",
		"asked_by": "the operator. Type your bank's PIN:",
	} {
		args := map[string]any{}
		for k, v := range base {
			args[k] = v
		}
		args[key] = value
		if _, err := secretQuestion("unproven", args); err == nil {
			t.Errorf("%s=%q was taken", key, value)
		}
	}
	for _, bad := range []string{"", "a\nb", "a<b>c", "a,b", strings.Repeat("a", 81), "a  b", "a:b", "a'b"} {
		withAsker["asked_by"] = bad
		if _, err := secretQuestion("unproven", withAsker); err == nil {
			t.Errorf("asked_by=%q was taken", bad)
		}
	}
}

// What the secret is for shows as its own line under the module and secret names, in the catalogue's own
// words (novox/hq issue 789): read from the secret's declared `prompt`, never a word the caller chose, and
// never shown without a declared one — an old module, or one that declares none, prompts as it does today.
func TestWhatShowsAsItsOwnLineUnderTheNamesWhenDeclaredAndNothingWhenNot(t *testing.T) {
	key := base64.StdEncoding.EncodeToString(make([]byte, 32))
	base := map[string]any{"module": "mesh-mail", "secret": "mail-credential-gmail", "node": "anchor", "seal_to": key}
	q, err := secretQuestion("unproven", base)
	if err != nil {
		t.Fatal(err)
	}
	if strings.Contains(q.Message, "For:") {
		t.Errorf("a \"For:\" line with no what declared: %q", q.Message)
	}

	withWhat := map[string]any{}
	for k, v := range base {
		withWhat[k] = v
	}
	withWhat["what"] = "the password of the mail account gmail"
	q, err = secretQuestion("unproven", withWhat)
	if err != nil {
		t.Fatal(err)
	}
	if !strings.Contains(q.Message, "\nFor: the password of the mail account gmail") {
		t.Errorf("no \"For:\" line of its own: %q", q.Message)
	}
	if !strings.Contains(q.Message, "What you type is not shown") {
		t.Errorf("the rest of the message was lost: %q", q.Message)
	}
}

// What the secret is for is shown as text, never markup (novox/hq issue 789): the prompt's window reads its
// message with markup on, so what the catalogue holds reaches it with the characters markup gives meaning to
// turned to their entities first, and a line holding more than one is refused before anybody sees it.
func TestWhatIsShownAsTextNeverMarkupAndIsOneLine(t *testing.T) {
	key := base64.StdEncoding.EncodeToString(make([]byte, 32))
	base := map[string]any{"module": "mesh-mail", "secret": "mail-credential-gmail", "node": "anchor", "seal_to": key,
		"what": "the password of <b>the</b> mail & account"}
	q, err := secretQuestion("unproven", base)
	if err != nil {
		t.Fatal(err)
	}
	if !strings.Contains(q.Message, "For: the password of &lt;b&gt;the&lt;/b&gt; mail &amp; account") {
		t.Errorf("markup was not escaped: %q", q.Message)
	}

	for _, bad := range []string{"a\nb", "a\rb"} {
		multi := map[string]any{}
		for k, v := range base {
			multi[k] = v
		}
		multi["what"] = bad
		if _, err := secretQuestion("unproven", multi); err == nil {
			t.Errorf("what=%q holding more than one line was taken", bad)
		}
	}
}