// Copyright 2015 The Vanadium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

package util_test

import (
	"fmt"
	"reflect"
	"strings"
	"testing"

	"v.io/v23/security/access"
	wire "v.io/v23/services/syncbase"
	"v.io/v23/syncbase/util"
	"v.io/v23/verror"
	tu "v.io/x/ref/services/syncbase/testutil"
)

func TestEncodeDecode(t *testing.T) {
	strs := []string{}
	copy(strs, tu.OkRowKeys)
	strs = append(strs, tu.NotOkRowKeys...)
	for _, s := range strs {
		enc := util.Encode(s)
		dec, err := util.Decode(enc)
		if err != nil {
			t.Fatalf("decode failed: %q, %v", s, err)
		}
		if strings.ContainsAny(enc, "/") {
			t.Errorf("%q was escaped to %q, which contains bad chars", s, enc)
		}
		if !strings.ContainsAny(s, "%/") && s != enc {
			t.Errorf("%q should equal %q", s, enc)
		}
		if s != dec {
			t.Errorf("%q should equal %q", s, dec)
		}
	}
}

func TestEncodeIdDecodeId(t *testing.T) {
	for _, blessing := range tu.OkAppUserBlessings {
		for _, name := range tu.OkDbCxNames {
			id := wire.Id{blessing, name}
			enc := util.EncodeId(id)
			dec, err := util.DecodeId(enc)
			if err != nil {
				t.Fatalf("decode failed: %v, %v", id, err)
			}
			if id != dec {
				t.Errorf("%v should equal %v", id, dec)
			}
		}
	}
}

func TestValidateNameFuncs(t *testing.T) {
	for _, a := range tu.OkAppUserBlessings {
		for _, d := range tu.OkDbCxNames {
			id := wire.Id{Blessing: a, Name: d}
			if util.ValidateId(id) != nil {
				t.Errorf("%v should be valid", id)
			}
		}
	}
	for _, a := range tu.NotOkAppUserBlessings {
		for _, d := range append(tu.OkDbCxNames, tu.NotOkDbCxNames...) {
			id := wire.Id{Blessing: a, Name: d}
			if util.ValidateId(id) == nil {
				t.Errorf("%v should be invalid", id)
			}
		}
	}
	for _, d := range tu.NotOkDbCxNames {
		for _, a := range append(tu.OkAppUserBlessings, tu.NotOkAppUserBlessings...) {
			id := wire.Id{Blessing: a, Name: d}
			if util.ValidateId(id) == nil {
				t.Errorf("%v should be invalid", id)
			}
		}
	}
	for _, s := range tu.OkRowKeys {
		if util.ValidateRowKey(s) != nil {
			t.Errorf("%q should be valid", s)
		}
	}
	for _, s := range tu.NotOkRowKeys {
		if util.ValidateRowKey(s) == nil {
			t.Errorf("%q should be invalid", s)
		}
	}
}

func TestPrefixRange(t *testing.T) {
	tests := []struct {
		prefix string
		start  string
		limit  string
	}{
		{"", "", ""},
		{"a", "a", "b"},
		{"aa", "aa", "ab"},
		{"\xfe", "\xfe", "\xff"},
		{"a\xfe", "a\xfe", "a\xff"},
		{"aa\xfe", "aa\xfe", "aa\xff"},
		{"a\xff", "a\xff", "b"},
		{"aa\xff", "aa\xff", "ab"},
		{"a\xff\xff", "a\xff\xff", "b"},
		{"aa\xff\xff", "aa\xff\xff", "ab"},
		{"\xff", "\xff", ""},
		{"\xff\xff", "\xff\xff", ""},
	}
	for _, test := range tests {
		start, limit := util.PrefixRangeStart(test.prefix), util.PrefixRangeLimit(test.prefix)
		if start != test.start || limit != test.limit {
			t.Errorf("%q: got {%q, %q}, want {%q, %q}", test.prefix, start, limit, test.start, test.limit)
		}
	}
}

func TestIsPrefix(t *testing.T) {
	tests := []struct {
		isPrefix bool
		start    string
		limit    string
	}{
		{true, "", ""},
		{true, "a", "b"},
		{true, "aa", "ab"},
		{true, "\xfe", "\xff"},
		{true, "a\xfe", "a\xff"},
		{true, "aa\xfe", "aa\xff"},
		{true, "a\xff", "b"},
		{true, "aa\xff", "ab"},
		{true, "a\xff\xff", "b"},
		{true, "aa\xff\xff", "ab"},
		{true, "\xff", ""},
		{true, "\xff\xff", ""},

		{false, "", "\x00"},
		{false, "a", "aa"},
		{false, "aa", "aa"},
		{false, "\xfe", "\x00"},
		{false, "a\xfe", "b\xfe"},
		{false, "aa\xfe", "aa\x00"},
		{false, "a\xff", "b\x00"},
		{false, "aa\xff", "ab\x00"},
		{false, "a\xff\xff", "a\xff\xff\xff"},
		{false, "aa\xff\xff", "a"},
		{false, "\xff", "\x00"},
	}
	for _, test := range tests {
		result := util.IsPrefix(test.start, test.limit)
		if result != test.isPrefix {
			t.Errorf("%q, %q: got %v, want %v", test.start, test.limit, result, test.isPrefix)
		}
	}
}

func TestAppAndUserPatternFromBlessings(t *testing.T) {
	for _, test := range []struct {
		blessings []string
		wantApp   string
		wantUser  string
		wantErr   error
	}{
		{
			[]string{},
			"$",
			"$",
			util.NewErrFoundNoConventionalBlessings(nil),
		},
		{
			[]string{"foo", "bar:x:baz"},
			"$",
			"$",
			util.NewErrFoundNoConventionalBlessings(nil),
		},
		// non-conventional blessings are ignored if a conventional blessing is present
		{
			[]string{"foo", "root:o:angrybirds:alice", "bar:x:baz"},
			"root:o:angrybirds",
			"root:o:angrybirds:alice",
			nil,
		},
		// user blessings are ignored when an app:user blessing is present
		{
			[]string{"foo", "root:u:alice", "root:o:angrybirds:alice:device:phone", "bar:x:baz"},
			"root:o:angrybirds",
			"root:o:angrybirds:alice",
			nil,
		},
		// user blessings are ignored when an app:user blessing is present, even if multiple
		{
			[]string{"foo", "root:u:bob", "root:o:todos:dave:friend:alice", "root:u:carol", "bar:x:baz"},
			"root:o:todos",
			"root:o:todos:dave",
			nil,
		},
		// multiple blessings for the same app:user are allowed
		{
			[]string{"foo", "root:u:bob", "root:o:todos:dave:friend:alice", "root:u:carol", "root:o:todos:dave:device:phone", "bar:x:baz"},
			"root:o:todos",
			"root:o:todos:dave",
			nil,
		},
		// multiple blessings for different apps, users, or identity providers are not allowed
		{
			[]string{"foo", "root:u:bob", "root:o:todos:dave:friend:alice", "root:o:angrybirds:dave", "root:o:todos:dave:device:phone", "bar:x:baz"},
			"$",
			"$",
			util.NewErrFoundMultipleAppUserBlessings(nil, "root:o:todos:dave", "root:o:angrybirds:dave"),
		},
		{
			[]string{"foo", "root:u:bob", "root:o:todos:dave:friend:alice", "root:o:todos:fred"},
			"$",
			"$",
			util.NewErrFoundMultipleAppUserBlessings(nil, "root:o:todos:dave", "root:o:todos:fred"),
		},
		{
			[]string{"foo", "root:u:bob", "root:o:todos:dave:friend:alice", "google:o:todos:dave"},
			"$",
			"$",
			util.NewErrFoundMultipleAppUserBlessings(nil, "root:o:todos:dave", "google:o:todos:dave"),
		},
		// non-conventional blessings are ignored if a conventional blessing is present
		{
			[]string{"foo", "root:u:bob", "bar:x:baz"},
			"...",
			"root:u:bob",
			nil,
		},
		// multiple blessings for the same user are allowed
		{
			[]string{"foo", "root:u:bob:angrybirds", "root:u:bob:todos:phone", "bar:x:baz"},
			"...",
			"root:u:bob",
			nil,
		},
		// multiple blessings for different users or identity providers are not allowed
		{
			[]string{"foo", "root:u:bob:angrybirds", "root:u:bob:todos:phone", "root:u:carol", "root:u:dave", "bar:x:baz"},
			"$",
			"$",
			util.NewErrFoundMultipleUserBlessings(nil, "root:u:bob", "root:u:carol"),
		},
		{
			[]string{"foo", "root:u:bob:angrybirds", "google:u:bob:todos:phone", "bar:x:baz"},
			"$",
			"$",
			util.NewErrFoundMultipleUserBlessings(nil, "root:u:bob", "google:u:bob"),
		},
	} {
		app, user, err := util.AppAndUserPatternFromBlessings(test.blessings...)
		if verror.ErrorID(err) != verror.ErrorID(test.wantErr) || fmt.Sprint(err) != fmt.Sprint(test.wantErr) {
			t.Errorf("AppAndUserPatternFromBlessings(%v): got error %v, want %v", test.blessings, err, test.wantErr)
		}
		if string(app) != test.wantApp {
			t.Errorf("AppAndUserPatternFromBlessings(%v): got app %s, want %s", test.blessings, app, test.wantApp)
		}
		if string(user) != test.wantUser {
			t.Errorf("AppAndUserPatternFromBlessings(%v): got user %s, want %s", test.blessings, user, test.wantUser)
		}
	}
}

func TestFilterTags(t *testing.T) {
	for _, test := range []struct {
		input     access.Permissions
		allowTags []access.Tag
		want      access.Permissions
	}{
		{
			access.Permissions{}.
				Add("root", access.TagStrings(access.Read, access.Write, access.Admin)...).
				Add("root:alice", access.TagStrings(access.Read, access.Write)...),
			[]access.Tag{},
			access.Permissions{},
		},
		{
			access.Permissions{}.
				Add("root", access.TagStrings(access.Read, access.Write, access.Admin)...).
				Add("root:alice", access.TagStrings(access.Read, access.Write)...),
			[]access.Tag{access.Admin, access.Read},
			access.Permissions{}.
				Add("root", access.TagStrings(access.Read, access.Admin)...).
				Add("root:alice", access.TagStrings(access.Read)...),
		},
		{
			access.Permissions{}.
				Add("alice", access.TagStrings(access.Admin)...).
				Add("bob", access.TagStrings(access.Read, access.Write)...).
				Add("carol", access.TagStrings(access.Write, access.Admin)...),
			[]access.Tag{access.Read, access.Write},
			access.Permissions{}.
				Add("bob", access.TagStrings(access.Read, access.Write)...).
				Add("carol", access.TagStrings(access.Write)...),
		},
		{
			access.Permissions{},
			[]access.Tag{access.Read, access.Write, access.Admin},
			access.Permissions{},
		},
		{
			access.Permissions{}.
				Add("alice", access.TagStrings(access.Admin)...).
				Add("bob", access.TagStrings(access.Read, access.Write, access.Admin)...).
				Blacklist("bob:tablet", access.TagStrings(access.Write, access.Admin)...),
			[]access.Tag{access.Read, access.Write},
			access.Permissions{}.
				Add("bob", access.TagStrings(access.Read, access.Write)...).
				Blacklist("bob:tablet", access.TagStrings(access.Write)...),
		},
		{
			access.Permissions{}.
				Add("alice", access.TagStrings(access.Admin)...).
				Add("bob", access.TagStrings(access.Read, access.Write)...).
				Blacklist("bob:tablet", access.TagStrings(access.Write)...),
			[]access.Tag{access.Admin, access.Read},
			access.Permissions{}.
				Add("alice", access.TagStrings(access.Admin)...).
				Add("bob", access.TagStrings(access.Read)...),
		},
	} {
		inputCopy := test.input.Copy()
		filtered := util.FilterTags(inputCopy, test.allowTags...)
		// Modify the input perms to ensure the filtered copy is unaffected.
		if adminAcl, ok := inputCopy[string(access.Admin)]; ok && len(adminAcl.In) > 0 {
			adminAcl.In[0] = "mallory"
		}
		if got, want := filtered, test.want.Normalize(); !reflect.DeepEqual(got, want) {
			t.Errorf("FilterTags(%v, %v): got %v, want %v", test.input, test.allowTags, got, want)
		}
	}
}