//go:build integration

package builder

import (
	"context"
	"errors"
	"io/fs"
	"net/url"
	"os"
	"os/exec"
	"path/filepath"
	"strings"
	"testing"
)

func TestACheckContainerSeesNoForgeCredential(t *testing.T) {
	repo, head := aCheckedRepository(t, map[string]string{CheckScript: "echo checked\n"})
	besideRepo, besideHead := aCheckedRepository(t, map[string]string{"README": "beside"})
	// A clone source that carries userinfo, as a forge's clone URL may: git records it as given in the
	// clone's .git/config, which the container reads.
	besideURL := "file://beside-user:" + besideSecret + "@" + besideRepo
	workspace := t.TempDir()

	var stores []string
	reached := false
	var leaks []string
	run := func(ctx context.Context, dir, name string, args ...string) (string, error) {
		switch name {
		case "git":
			for _, a := range args {
				if f, ok := strings.CutPrefix(a, "credential.helper=store --file="); ok {
					stores = append(stores, f)
					raw, err := os.ReadFile(f)
					if err != nil || strings.TrimSpace(string(raw)) != forgeURL {
						t.Errorf("git is offered a store that does not hold the credential as given: %q, %v", raw, err)
					}
					if info, err := os.Stat(f); err == nil && info.Mode().Perm() != 0o600 {
						t.Errorf("the credential store is readable beyond its owner: %v", info.Mode())
					}
				}
			}
			if len(args) >= 2 && args[len(args)-3] == "--quiet" && hasString(args, "clone") {
				source := args[len(args)-2]
				if u, err := url.Parse(source); err == nil && u.User != nil {
					// Git cannot reach a file:// URL with userinfo; clone it without, then record it as git
					// would have: as given.
					clone := append(append([]string{}, args[:len(args)-2]...), bareURL(t, source), args[len(args)-1])
					if out, err := Command(ctx, dir, "git", clone...); err != nil {
						return out, err
					}
					return Command(ctx, filepath.Join(dir, args[len(args)-1]), "git", "remote", "set-url", "origin", source)
				}
			}
			return Command(ctx, dir, name, args...)
		case "docker":
			if !reached {
				reached = true
				// The first container: everything the workspace holds is what the toolchain container sees.
				filepath.WalkDir(workspace, func(path string, d fs.DirEntry, err error) error {
					if err != nil || d.IsDir() {
						return nil
					}
					raw, _ := os.ReadFile(path)
					s := string(raw)
					if strings.Contains(s, forgeSecret) || strings.Contains(s, besideSecret) ||
						strings.Contains(s, npmSecret) || d.Name() == "git-credentials" || d.Name() == ".npmrc" ||
						strings.Contains(s, "credential.helper") {
						leaks = append(leaks, path)
					}
					return nil
				})
				for _, f := range stores {
					if _, err := os.Stat(f); !errors.Is(err, os.ErrNotExist) {
						leaks = append(leaks, f+" (still there when the first container runs)")
					}
					if rel, err := filepath.Rel(workspace, f); err == nil && !strings.HasPrefix(rel, "..") {
						leaks = append(leaks, f+" (inside the workspace the container mounts)")
					}
				}
			}
			if len(args) > 0 && args[0] == "ps" {
				return "", nil
			}
			return "", errors.New("no container runtime in this test")
		}
		return "", errors.New("unexpected command " + name)
	}
	// A credential an older builder left in the workspace is removed too: the forge's, and the .npmrc a
	// build wrote into the tree it cloned.
	if err := os.WriteFile(filepath.Join(workspace, "git-credentials"), []byte(forgeURL+"\n"), 0o600); err != nil {
		t.Fatal(err)
	}
	for _, dir := range []string{"source/x", "context-server"} {
		if err := os.MkdirAll(filepath.Join(workspace, dir), 0o755); err != nil {
			t.Fatal(err)
		}
		if err := os.WriteFile(filepath.Join(workspace, dir, ".npmrc"),
			[]byte("//forge.invalid/api/packages/novox/npm/:_authToken="+npmSecret+"\n"), 0o600); err != nil {
			t.Fatal(err)
		}
	}
	_, err := Check(t.Context(), run, CheckSpec{ID: "check-462", Repository: repo, Ref: head, Owner: "novox",
		Repo: "mesh-controller", Number: 1, Toolchain: "golang", Beside: map[string]Beside{
			"mesh-catalog": {Repository: besideURL, Ref: besideHead}}}, workspace, aFactsRegistry(t),
		GitCredential{URL: forgeURL}, nil)
	if err == nil {
		t.Fatal("the check ran past its first container in a test with none")
	}
	if !reached {
		t.Fatalf("the check never reached its first container: %v", err)
	}
	if len(stores) == 0 {
		t.Fatal("no clone was offered the forge credential")
	}
	if len(leaks) > 0 {
		t.Fatalf("the check's container sees the credential:\n%s", strings.Join(leaks, "\n"))
	}
}

func TestACheckLinePublishedToTheLogIsRedacted(t *testing.T) {
	var said []string
	say := func(step, format string, args ...any) {
		if step == "output" && len(args) > 0 {
			said = append(said, args[0].(string))
		}
	}
	var out tail
	layer := ownCheck(t.Context(), CheckSpec{Toolchain: "golang"}, []ScriptPart{{Toolchain: "go", Script: CheckScript}},
		t.TempDir(), &out, func() bool { return false }, func(string, string) *exec.Cmd {
			return exec.CommandContext(t.Context(), "sh", "-c", "echo cloning http://mesh_builder:t0ps3cret-forge@forge.invalid/novox/x.git; "+
				"echo token ghp_abcdefghijklmnopqrstuvwxyz0123456789")
		}, say)
	if layer == nil || layer.Verdict != "pass" {
		t.Fatalf("the check answered %+v\n%s", layer, out.String())
	}
	joined := strings.Join(said, "\n")
	if strings.Contains(joined, "t0ps3cret-forge") || strings.Contains(joined, "ghp_abcdef") {
		t.Fatalf("a secret the check printed is published to the build's log:\n%s", joined)
	}
	if !strings.Contains(joined, "http://mesh_builder:[redacted: a password in a URI]@forge.invalid/novox/x.git") {
		t.Fatalf("the line is not said with what was there named:\n%s", joined)
	}
}

func TestABuildsCloneRecordsNoUserinfo(t *testing.T) {
	repo, _ := aCheckedRepository(t, map[string]string{ManifestName: `{"module":"plain","version":"1"}`})
	source := "file://build-user:" + besideSecret + "@" + repo
	workspace := t.TempDir()
	tree := filepath.Join(workspace, "source")
	var configs []string
	run := func(ctx context.Context, dir, name string, args ...string) (string, error) {
		if name == "git" && hasString(args, "clone") && args[len(args)-2] == source {
			clone := append(append([]string{}, args[:len(args)-2]...), bareURL(t, source), args[len(args)-1])
			if out, err := Command(ctx, dir, "git", clone...); err != nil {
				return out, err
			}
			return Command(ctx, args[len(args)-1], "git", "remote", "set-url", "origin", source)
		}
		if name == "git" && len(args) > 0 && args[0] == "rev-parse" {
			raw, _ := os.ReadFile(filepath.Join(tree, ".git", "config"))
			configs = append(configs, string(raw))
		}
		return Command(ctx, dir, name, args...)
	}
	if _, err := Build(t.Context(), run, &recorded{}, source, "", "", workspace, nil, Npmrc{}, GitCredential{}, nil); err != nil {
		t.Fatal(err)
	}
	if len(configs) == 0 {
		t.Fatal("the build never read its clone")
	}
	for _, c := range configs {
		if strings.Contains(c, besideSecret) || strings.Contains(c, "build-user") {
			t.Fatalf("the build's clone records the credential it was cloned with:\n%s", c)
		}
	}
	if _, err := os.Stat(tree); !os.IsNotExist(err) {
		t.Fatalf("the build's tree outlives the build: %v", err)
	}
}