package state_test

import (
	"fmt"
	"testing"

	"veyron/services/store/memstore/state"
	"veyron2/security"
	"veyron2/storage"
)

// Simple DAG based on teams and players.
func TestPathMatchDAG(t *testing.T) {
	st := state.New(rootPublicID)
	sn := st.MutableSnapshot()
	johnID := mkdir(t, sn, rootPublicID, "/teamsapp/players/john")
	janeID := mkdir(t, sn, rootPublicID, "/teamsapp/players/jane")
	joanID := mkdir(t, sn, rootPublicID, "/teamsapp/players/joan")
	link(t, sn, rootPublicID, "/teamsapp/teams/rockets/players/john", johnID)
	link(t, sn, rootPublicID, "/teamsapp/teams/rockets/players/jane", janeID)
	link(t, sn, rootPublicID, "/teamsapp/teams/hornets/players/jane", janeID)
	link(t, sn, rootPublicID, "/teamsapp/teams/hornets/players/joan", joanID)

	rJohn, _ := state.CompilePathRegex(".../john")
	if !sn.PathMatch(rootPublicID, johnID, rJohn) {
		t.Errorf("Expected match")
	}

	rTRockets, _ := state.CompilePathRegex(".../teams/rockets/...")
	if !sn.PathMatch(rootPublicID, johnID, rTRockets) {
		t.Errorf("Expected match")
	}
	if !sn.PathMatch(rootPublicID, janeID, rTRockets) {
		t.Errorf("Expected match")
	}
	if sn.PathMatch(rootPublicID, joanID, rTRockets) {
		t.Errorf("Unexpected match")
	}

	rTHornets, _ := state.CompilePathRegex(".../teams/hornets/...")
	if sn.PathMatch(rootPublicID, johnID, rTHornets) {
		t.Errorf("Unexpected match")
	}
	if !sn.PathMatch(rootPublicID, janeID, rTHornets) {
		t.Errorf("Expected match")
	}
	if !sn.PathMatch(rootPublicID, joanID, rTHornets) {
		t.Errorf("Expected match")
	}

	rTRocketsOrHornets, _ := state.CompilePathRegex(".../teams/{rockets,hornets}/...")
	if !sn.PathMatch(rootPublicID, johnID, rTRocketsOrHornets) {
		t.Errorf("Expected match")
	}
	if !sn.PathMatch(rootPublicID, janeID, rTRocketsOrHornets) {
		t.Errorf("Expected match")
	}
	if !sn.PathMatch(rootPublicID, joanID, rTRocketsOrHornets) {
		t.Errorf("Expected match")
	}

	rTJoanOrRockets, _ := state.CompilePathRegex(".../{players/joan,teams/rockets}/...")
	if !sn.PathMatch(rootPublicID, johnID, rTJoanOrRockets) {
		t.Errorf("Expected match")
	}
	if !sn.PathMatch(rootPublicID, janeID, rTJoanOrRockets) {
		t.Errorf("Expected match")
	}
	if !sn.PathMatch(rootPublicID, joanID, rTJoanOrRockets) {
		t.Errorf("Expected match")
	}
}

// Similar to above, but introduce loops by adding a teams directory to each of
// the players, looping back to their teams.
func TestPathMatchLoop(t *testing.T) {
	st := state.New(rootPublicID)
	sn := st.MutableSnapshot()
	johnID := mkdir(t, sn, rootPublicID, "/teamsapp/players/john")
	janeID := mkdir(t, sn, rootPublicID, "/teamsapp/players/jane")
	joanID := mkdir(t, sn, rootPublicID, "/teamsapp/players/joan")
	rocketsID := mkdir(t, sn, rootPublicID, "/teamsapp/teams/rockets")
	hornetsID := mkdir(t, sn, rootPublicID, "/teamsapp/teams/hornets")
	link(t, sn, rootPublicID, "/teamsapp/teams/rockets/players/john", johnID)
	link(t, sn, rootPublicID, "/teamsapp/teams/rockets/players/jane", janeID)
	link(t, sn, rootPublicID, "/teamsapp/teams/hornets/players/jane", janeID)
	link(t, sn, rootPublicID, "/teamsapp/teams/hornets/players/joan", joanID)
	link(t, sn, rootPublicID, "/teamsapp/players/john/teams/rockets", rocketsID)
	link(t, sn, rootPublicID, "/teamsapp/players/jane/teams/rockets", rocketsID)
	link(t, sn, rootPublicID, "/teamsapp/players/jane/teams/hornets", hornetsID)
	link(t, sn, rootPublicID, "/teamsapp/players/joan/teams/hornets", hornetsID)
	if err := st.ApplyMutations(sn.Mutations()); err != nil {
		t.Errorf("ApplyMutations failed: %s", err)
	}

	rJohn, _ := state.CompilePathRegex(".../john")
	if !sn.PathMatch(rootPublicID, johnID, rJohn) {
		t.Errorf("Expected match")
	}

	rTRockets, _ := state.CompilePathRegex(".../teams/rockets/players/*")
	if !sn.PathMatch(rootPublicID, johnID, rTRockets) {
		t.Errorf("Expected match")
	}
	if !sn.PathMatch(rootPublicID, janeID, rTRockets) {
		t.Errorf("Expected match")
	}
	if sn.PathMatch(rootPublicID, joanID, rTRockets) {
		t.Errorf("Unexpected match")
	}

	rTHornets, _ := state.CompilePathRegex(".../teams/hornets/players/*")
	if sn.PathMatch(rootPublicID, johnID, rTHornets) {
		t.Errorf("Unexpected match")
	}
	if !sn.PathMatch(rootPublicID, janeID, rTHornets) {
		t.Errorf("Expected match")
	}
	if !sn.PathMatch(rootPublicID, joanID, rTHornets) {
		t.Errorf("Expected match")
	}

	rTFancyPath, _ := state.CompilePathRegex(".../teams/rockets/players/*/teams/hornets/players/*")
	if sn.PathMatch(rootPublicID, johnID, rTFancyPath) {
		t.Errorf("Unexpected match")
	}
	if !sn.PathMatch(rootPublicID, janeID, rTFancyPath) {
		t.Errorf("Expected match")
	}
	if !sn.PathMatch(rootPublicID, joanID, rTFancyPath) {
		t.Errorf("Expected match")
	}
}

// Similar to above, but use the explicit E field rather than the implicit
// directory.
func TestPathMatchFieldDAG(t *testing.T) {
	st := state.New(rootPublicID)
	sn := st.MutableSnapshot()
	johnID := mkdir(t, sn, rootPublicID, "/E/teamsapp/E/players/E/john")
	janeID := mkdir(t, sn, rootPublicID, "/E/teamsapp/E/players/E/jane")
	joanID := mkdir(t, sn, rootPublicID, "/E/teamsapp/E/players/E/joan")
	link(t, sn, rootPublicID, "/E/teamsapp/E/teams/E/rockets/E/players/E/john", johnID)
	link(t, sn, rootPublicID, "/E/teamsapp/E/teams/E/rockets/E/players/E/jane", janeID)
	link(t, sn, rootPublicID, "/E/teamsapp/E/teams/E/hornets/E/players/E/jane", janeID)
	link(t, sn, rootPublicID, "/E/teamsapp/E/teams/E/hornets/E/players/E/joan", joanID)
	if err := st.ApplyMutations(sn.Mutations()); err != nil {
		t.Errorf("ApplyMutations failed: %s", err)
	}

	rJohn, _ := state.CompilePathRegex(".../E/john")
	if !sn.PathMatch(rootPublicID, johnID, rJohn) {
		t.Errorf("Expected match")
	}

	rTRockets, _ := state.CompilePathRegex(".../E/teams/E/rockets/E/...")
	if !sn.PathMatch(rootPublicID, johnID, rTRockets) {
		t.Errorf("Expected match")
	}
	if !sn.PathMatch(rootPublicID, janeID, rTRockets) {
		t.Errorf("Expected match")
	}
	if sn.PathMatch(rootPublicID, joanID, rTRockets) {
		t.Errorf("Unexpected match")
	}

	rTHornets, _ := state.CompilePathRegex(".../E/teams/E/hornets/E/...")
	if sn.PathMatch(rootPublicID, johnID, rTHornets) {
		t.Errorf("Unexpected match")
	}
	if !sn.PathMatch(rootPublicID, janeID, rTHornets) {
		t.Errorf("Expected match")
	}
	if !sn.PathMatch(rootPublicID, joanID, rTHornets) {
		t.Errorf("Expected match")
	}

	rTRocketsOrHornets, _ := state.CompilePathRegex(".../E/teams/E/{rockets,hornets}/E/...")
	if !sn.PathMatch(rootPublicID, johnID, rTRocketsOrHornets) {
		t.Errorf("Expected match")
	}
	if !sn.PathMatch(rootPublicID, janeID, rTRocketsOrHornets) {
		t.Errorf("Expected match")
	}
	if !sn.PathMatch(rootPublicID, joanID, rTRocketsOrHornets) {
		t.Errorf("Expected match")
	}

	rTJoanOrRockets, _ := state.CompilePathRegex(".../E/{players/E/joan,teams/E/rockets}/...")
	if !sn.PathMatch(rootPublicID, johnID, rTJoanOrRockets) {
		t.Errorf("Expected match")
	}
	if !sn.PathMatch(rootPublicID, janeID, rTJoanOrRockets) {
		t.Errorf("Expected match")
	}
	if !sn.PathMatch(rootPublicID, joanID, rTJoanOrRockets) {
		t.Errorf("Expected match")
	}
}

func TestPathMatchFieldLoop(t *testing.T) {
	st := state.New(rootPublicID)
	sn := st.MutableSnapshot()
	johnID := mkdir(t, sn, rootPublicID, "/E/teamsapp/E/players/E/john")
	janeID := mkdir(t, sn, rootPublicID, "/E/teamsapp/E/players/E/jane")
	joanID := mkdir(t, sn, rootPublicID, "/E/teamsapp/E/players/E/joan")
	rocketsID := mkdir(t, sn, rootPublicID, "/E/teamsapp/E/teams/E/rockets")
	hornetsID := mkdir(t, sn, rootPublicID, "/E/teamsapp/E/teams/E/hornets")
	link(t, sn, rootPublicID, "/E/teamsapp/E/teams/E/rockets/E/players/E/john", johnID)
	link(t, sn, rootPublicID, "/E/teamsapp/E/teams/E/rockets/E/players/E/jane", janeID)
	link(t, sn, rootPublicID, "/E/teamsapp/E/teams/E/hornets/E/players/E/jane", janeID)
	link(t, sn, rootPublicID, "/E/teamsapp/E/teams/E/hornets/E/players/E/joan", joanID)
	link(t, sn, rootPublicID, "/E/teamsapp/E/players/E/john/E/teams/E/rockets", rocketsID)
	link(t, sn, rootPublicID, "/E/teamsapp/E/players/E/jane/E/teams/E/rockets", rocketsID)
	link(t, sn, rootPublicID, "/E/teamsapp/E/players/E/jane/E/teams/E/hornets", hornetsID)
	link(t, sn, rootPublicID, "/E/teamsapp/E/players/E/joan/E/teams/E/hornets", hornetsID)
	if err := st.ApplyMutations(sn.Mutations()); err != nil {
		t.Errorf("ApplyMutations failed: %s", err)
	}

	rJohn, _ := state.CompilePathRegex(".../E/john")
	if !sn.PathMatch(rootPublicID, johnID, rJohn) {
		t.Errorf("Expected match")
	}

	rTRockets, _ := state.CompilePathRegex(".../E/teams/E/rockets/E/players/E/*")
	if !sn.PathMatch(rootPublicID, johnID, rTRockets) {
		t.Errorf("Expected match")
	}
	if !sn.PathMatch(rootPublicID, janeID, rTRockets) {
		t.Errorf("Expected match")
	}
	if sn.PathMatch(rootPublicID, joanID, rTRockets) {
		t.Errorf("Unexpected match")
	}

	rTHornets, _ := state.CompilePathRegex(".../E/teams/E/hornets/E/players/E/*")
	if sn.PathMatch(rootPublicID, johnID, rTHornets) {
		t.Errorf("Unexpected match")
	}
	if !sn.PathMatch(rootPublicID, janeID, rTHornets) {
		t.Errorf("Expected match")
	}
	if !sn.PathMatch(rootPublicID, joanID, rTHornets) {
		t.Errorf("Expected match")
	}

	rTFancyPath, _ := state.CompilePathRegex(".../E/teams/E/rockets/E/players/E/*/E/teams/E/hornets/E/players/E/*")
	if sn.PathMatch(rootPublicID, johnID, rTFancyPath) {
		t.Errorf("Unexpected match")
	}
	if !sn.PathMatch(rootPublicID, janeID, rTFancyPath) {
		t.Errorf("Expected match")
	}
	if !sn.PathMatch(rootPublicID, joanID, rTFancyPath) {
		t.Errorf("Expected match")
	}
}

// Create a player, and add security restrictions.
func mkSecureHome(t *testing.T, sn *state.MutableSnapshot, pid security.PublicID, name string, user security.PrincipalPattern) (storage.ID, storage.TagList) {
	id := mkdir(t, sn, rootPublicID, fmt.Sprintf("/teamsapp/home/%s", name))
	aclID := putPath(t, sn, rootPublicID, fmt.Sprintf("/teamsapp/home/%s/acls/rwa", name), &storage.ACL{
		Name: name,
		Contents: security.ACL{
			user: security.LabelSet(security.ReadLabel | security.WriteLabel | security.AdminLabel),
		},
	})
	tags := storage.TagList{
		storage.Tag{Op: storage.RemoveACL, ACL: state.EveryoneACLID},
		storage.Tag{Op: storage.AddInheritedACL, ACL: aclID},
	}
	put(t, sn, rootPublicID, fmt.Sprintf("/teamsapp/home/%s/.tags", name), tags)
	return id, tags
}

// Check security restrictions.
func TestPathMatchSecurity(t *testing.T) {
	st := state.New(rootPublicID)
	sn := st.MutableSnapshot()

	// Create the players and set their ACLs.
	johnID, johnTags := mkSecureHome(t, sn, rootPublicID, "john", johnUser)
	janeID, janeTags := mkSecureHome(t, sn, rootPublicID, "jane", janeUser)
	joanID, _ := mkSecureHome(t, sn, rootPublicID, "joan", joanUser)
	rocketsID := mkdir(t, sn, rootPublicID, "/teamsapp/teams/rockets")
	hornetsID := mkdir(t, sn, rootPublicID, "/teamsapp/teams/hornets")
	link(t, sn, rootPublicID, "/teamsapp/teams/rockets/players/john", johnID)
	link(t, sn, rootPublicID, "/teamsapp/teams/rockets/players/jane", janeID)
	link(t, sn, rootPublicID, "/teamsapp/teams/hornets/players/jane", janeID)
	link(t, sn, rootPublicID, "/teamsapp/teams/hornets/players/joan", joanID)
	link(t, sn, rootPublicID, "/teamsapp/home/john/teams/rockets", rocketsID)
	link(t, sn, rootPublicID, "/teamsapp/home/jane/teams/rockets", rocketsID)
	link(t, sn, rootPublicID, "/teamsapp/home/jane/teams/hornets", hornetsID)
	link(t, sn, rootPublicID, "/teamsapp/home/joan/teams/hornets", hornetsID)
	if err := st.ApplyMutations(sn.Mutations()); err != nil {
		t.Errorf("ApplyMutations failed: %s", err)
	}

	sn = st.MutableSnapshot()
	rJohn, _ := state.CompilePathRegex(".../john")
	if !sn.PathMatch(rootPublicID, johnID, rJohn) {
		t.Errorf("Expected match")
	}
	if !sn.PathMatch(johnPublicID, johnID, rJohn) {
		t.Errorf("Expected match")
	}
	if !sn.PathMatch(janePublicID, johnID, rJohn) {
		t.Errorf("Expected match")
	}

	rTRockets, _ := state.CompilePathRegex(".../teams/rockets/players/*")
	if !sn.PathMatch(janePublicID, johnID, rTRockets) {
		t.Errorf("Expected match")
	}
	if !sn.PathMatch(janePublicID, janeID, rTRockets) {
		t.Errorf("Expected match")
	}
	if sn.PathMatch(janePublicID, joanID, rTRockets) {
		t.Errorf("Unexpected match")
	}

	rHomeJane, _ := state.CompilePathRegex(".../home/jane")
	if _, err := sn.Get(johnPublicID, storage.ParsePath("/teamsapp/home/jane")); err == nil {
		t.Errorf("Security error")
	}
	// John can't see Jane's home path.
	if sn.PathMatch(johnPublicID, janeID, rHomeJane) {
		t.Errorf("Unexpected match")
	}
	// Jane can see it.
	if !sn.PathMatch(janePublicID, janeID, rHomeJane) {
		t.Errorf("Expected match")
	}

	// Both can see Jane through the teams directory.
	rPlayersJane, _ := state.CompilePathRegex(".../players/jane")
	if !sn.PathMatch(johnPublicID, janeID, rPlayersJane) {
		t.Errorf("Expected match")
	}
	if !sn.PathMatch(janePublicID, janeID, rPlayersJane) {
		t.Errorf("Expected match")
	}

	// Restrict /teamsapp/teams to Jane.
	put(t, sn, rootPublicID, "/teamsapp/teams/.tags", janeTags)
	// John can still see through /teamsapp/home/john/teams/rockets/players/jane.
	if !sn.PathMatch(johnPublicID, janeID, rPlayersJane) {
		t.Errorf("Expected match")
	}
	if !sn.PathMatch(janePublicID, janeID, rPlayersJane) {
		t.Errorf("Expected match")
	}

	// Restrict /teamsapp/teams/rockets.
	put(t, sn, rootPublicID, "/teamsapp/teams/rockets/.tags", janeTags)
	// We took away EveryoneACLID, but John is still inherited.
	if !sn.PathMatch(johnPublicID, janeID, rPlayersJane) {
		t.Errorf("Expected match")
	}
	if !sn.PathMatch(janePublicID, janeID, rPlayersJane) {
		t.Errorf("Expected match")
	}

	// Take away John from the rockets too.
	tag := storage.Tag{Op: storage.RemoveACL, ACL: johnTags[1].ACL}
	put(t, sn, rootPublicID, "/teamsapp/teams/rockets/.tags/@", tag)
	// John is now locked out.
	if sn.PathMatch(johnPublicID, janeID, rPlayersJane) {
		t.Errorf("Unexpected match")
	}
	if !sn.PathMatch(janePublicID, janeID, rPlayersJane) {
		t.Errorf("Expected match")
	}
}