package server

import (
	"bytes"
	"context"
	"log/slog"
	"strings"
	"testing"

	"housecarl/internal/api"
	"housecarl/internal/model"
	"housecarl/internal/store"
)

// TestBans: a program with a token for one ban list bans addresses: of
// a service's ports, every port, or numbers; renewed when banned again;
// IPv6 by /64; never the inside, the firewall's own, or the list's
// never; times cut to the list's longest; the address's connections the
// ban drops are closed; and lifted by ID or address.
func TestBans(t *testing.T) {
	e := newEnv(t)
	e.call(e.token, "POST", "/zones", model.Zone{Name: "wan", Interfaces: []string{"wan"}, External: true}, nil)
	e.call(e.token, "POST", "/zones", model.Zone{Name: "lan", Interfaces: []string{"eth1"}}, nil)
	for _, b := range []model.BanList{
		{Name: "web", Scope: model.BanScopeHosts, Hosts: []string{"10.0.10.57"}, Never: []string{"198.51.100.0/24"}, MaxTime: 3600},
		{Name: "router", Scope: model.BanScopeFirewall},
	} {
		if code := e.call(e.token, "POST", "/banlists", b, nil); code != 201 {
			t.Fatalf("ban list %s: %d", b.Name, code)
		}
	}
	fc := &fakeConns{list: []api.Connection{
		{Family: "ipv4", Protocol: "tcp", Source: "203.0.113.9", SourcePort: 40000, Destination: "217.155.8.194", DestinationPort: 2222, DNATTo: "10.0.10.57", DNATPort: 22},
		{Family: "ipv4", Protocol: "tcp", Source: "203.0.113.9", SourcePort: 40001, Destination: "10.0.10.58", DestinationPort: 22},
		{Family: "ipv4", Protocol: "tcp", Source: "203.0.113.9", SourcePort: 40002, Destination: "217.155.8.194", DestinationPort: 22},
	}}
	e.srv.SetConntrack(fc)
	var tok api.Token
	if code := e.call(e.token, "POST", "/me/tokens", api.TokenInput{Name: "guard", Grants: []string{"bans:write:web"}}, &tok); code != 201 {
		t.Fatalf("token: %d", code)
	}
	ban := func(in api.BanInput, want int) api.BanResult {
		t.Helper()
		var out api.BanResult
		var eb api.ErrorBody
		code := e.call(tok.Secret, "POST", "/banlists/web/bans", in, &out)
		if code != want {
			e.call(tok.Secret, "POST", "/banlists/web/bans", in, &eb)
			t.Errorf("ban %+v: %d, want %d (%+v)", in, code, want, eb)
		}
		return out
	}
	out := ban(api.BanInput{Address: "203.0.113.9", Ports: []byte(`"ssh"`), Time: 600, Source: "guard/ssh", Reason: "Failed password"}, 201)
	if len(out.Bans) != 1 || out.Bans[0].Protocol != "tcp" || out.Bans[0].Port != 22 || out.Bans[0].Existing || out.Bans[0].Timeout != 600 {
		t.Errorf("ssh ban: %+v", out)
	}
	if out.Closed != 1 || len(fc.closed) != 1 || fc.closed[0].DNATTo != "10.0.10.57" {
		t.Errorf("closed %d: %+v (only the one to the list's host)", out.Closed, fc.closed)
	}
	if _, ok := e.fw.bans[`ban_`+itoa(out.Bans[0].ListID)+`_v4_svc 203.0.113.9 . tcp . 22`]; !ok {
		t.Errorf("not in force: %+v", e.fw.bans)
	}
	if again := ban(api.BanInput{Address: "203.0.113.9", Ports: []byte(`22`), Protocol: "tcp"}, 201); len(again.Bans) != 1 || !again.Bans[0].Existing {
		t.Errorf("banned again: %+v", again)
	}
	if v6 := ban(api.BanInput{Address: "2001:db8:1:2::77", Time: 99999}, 201); len(v6.Bans) != 1 || v6.Bans[0].Address != "2001:db8:1:2::/64" ||
		v6.Bans[0].Protocol != "" || v6.Bans[0].Timeout != 3600 {
		t.Errorf("IPv6, every port, cut to an hour: %+v", v6)
	}
	if n := ban(api.BanInput{Address: "::ffff:203.0.113.10", Ports: []byte(`53`)}, 201); len(n.Bans) != 2 || n.Bans[0].Address != "203.0.113.10" {
		t.Errorf("a number without a protocol is tcp and udp: %+v", n)
	}
	if n := ban(api.BanInput{Address: "203.0.113.11", Protocol: "tcp", Ports: []byte(`["http", "https"]`)}, 201); len(n.Bans) != 2 {
		t.Errorf("two services: %+v", n)
	}
	if n := ban(api.BanInput{Address: "203.0.113.12", Protocol: "tcp", Ports: []byte(`"0:65535"`)}, 201); len(n.Bans) != 1 || n.Bans[0].Protocol != "" {
		t.Errorf("fail2ban's every port: %+v", n)
	}
	ban(api.BanInput{Address: "203.0.113.13", Ports: []byte(`"bogus"`)}, 400)
	ban(api.BanInput{Address: "203.0.113.13", Protocol: "tcp"}, 400)
	ban(api.BanInput{Address: "not-an-address"}, 400)
	for _, a := range []string{"198.51.100.4", "10.0.10.99", "217.155.8.194", "127.0.0.1", "fe80::1", "192.168.5.5"} {
		var eb api.ErrorBody
		if code := e.call(tok.Secret, "POST", "/banlists/web/bans", api.BanInput{Address: a}, &eb); code != 422 || eb.Error.Code != "never_ban" {
			t.Errorf("never ban %s: %d %+v", a, code, eb)
		}
	}
	if code := e.call(tok.Secret, "POST", "/banlists/router/bans", api.BanInput{Address: "203.0.113.9"}, nil); code != 403 {
		t.Errorf("another list: %d", code)
	}
	// The program may read its list, and only its list.
	var bl model.BanList
	if code := e.call(tok.Secret, "GET", "/banlists/web", nil, &bl); code != 200 || bl.V6Group() != 64 {
		t.Errorf("reading its list: %d %+v", code, bl)
	}
	var lists []model.BanList
	if e.call(tok.Secret, "GET", "/banlists", nil, &lists); len(lists) != 1 || lists[0].Name != "web" {
		t.Errorf("lists: %+v", lists)
	}
	if code := e.call(tok.Secret, "GET", "/banlists/router", nil, nil); code != 403 {
		t.Errorf("reading another list: %d", code)
	}
	var bans []model.Ban
	e.call(tok.Secret, "GET", "/banlists/web/bans", nil, &bans)
	if len(bans) != 7 || bans[0].List != "web" || bans[0].Who != "admin" || bans[0].Source != "guard/ssh" {
		t.Errorf("bans: %d %+v", len(bans), bans)
	}
	var removed map[string]int
	if code := e.call(tok.Secret, "DELETE", "/banlists/web/bans?address=2001:db8:1:2::5", nil, &removed); code != 200 || removed["removed"] != 1 {
		t.Errorf("lift by address: %d %+v", code, removed)
	}
	if code := e.call(tok.Secret, "DELETE", "/banlists/web/bans/"+itoa(bans[0].ID), nil, &removed); code != 200 || removed["removed"] != 1 {
		t.Errorf("lift by ID: %d %+v", code, removed)
	}
	if code := e.call(tok.Secret, "DELETE", "/banlists/web/bans?address=203.0.113.200", nil, nil); code != 404 {
		t.Errorf("lifting what isn't banned: %d", code)
	}
	if _, ok := e.fw.bans[`ban_`+itoa(bans[0].ListID)+`_v4_svc 203.0.113.9 . tcp . 22`]; ok {
		t.Errorf("still in force after lifting")
	}
	evs, _ := e.srv.store.ListAudit(context.Background(), store.AuditFilter{Action: "ban."})
	if len(evs) < 10 || !strings.Contains(evs[len(evs)-1].Detail, "guard/ssh: Failed password") {
		t.Errorf("audit: %d %+v", len(evs), evs[len(evs)-1])
	}
	// The list's name is what programs know it by.
	if code := e.call(e.token, "PATCH", "/banlists/web", map[string]any{"name": "web2"}, nil); code != 409 {
		t.Errorf("renaming a ban list: %d", code)
	}
	// Every apply puts the bans back; a deleted list's go.
	if got := ActiveBans(context.Background(), e.srv.store); len(got) != 5 {
		t.Errorf("active bans: %d", len(got))
	}
	if code := e.call(e.token, "DELETE", "/banlists/web", nil, nil); code != 200 {
		t.Errorf("deleting the list: %d", code)
	}
	if got := ActiveBans(context.Background(), e.srv.store); len(got) != 0 {
		t.Errorf("a deleted list's bans: %d", len(got))
	}
}

// TestFailedLoginLogged: a failed login and a refused token are logged
// with the address first, for Guard's and fail2ban's patterns.
func TestFailedLoginLogged(t *testing.T) {
	e := newEnv(t)
	var buf bytes.Buffer
	e.srv.log = slog.New(slog.NewTextHandler(&buf, nil))
	e.call("", "POST", "/auth/login", api.Login{Username: `x ip=8.8.8.8`, Password: "wrong"}, nil)
	e.call("housecarl_aaaaaaaaaaaaaaaa_bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", "GET", "/status", nil, nil)
	for _, want := range []string{`msg="login failed" ip=127.0.0.1 user="x ip=8.8.8.8"`, `msg="token refused" ip=127.0.0.1 reason=`} {
		if !strings.Contains(buf.String(), want) {
			t.Errorf("no %q in\n%s", want, buf.String())
		}
	}
}