//! Tier 1 conformance (docs/m0.md §3): a pipeline on a busybox rootfs in

//! the syscall sandbox. Runs where `flow tiers` offers the syscall tier

//! (user namespaces, Landlock, seccomp and a delegated cgroup: each `flow`

//! runs in a delegated systemd user scope when one can be made) and a static

//! busybox is at /usr/bin/busybox; skipped otherwise.

use std::path::Path;

use std::process::Command;

const APPLETS: &[&str] = &[

    "sh", "echo", "cat", "id", "touch", "wget", "tail", "cut", "tr", "true", "false", "ls", "grep", "wc", "mount", "hostname", "head",

    "sed",

];

/// `flow`, in a delegated cgroup scope of its own when systemd's user

/// manager can make one (the test itself shares cargo's).

fn flow(home: &Path) -> Command {

    static SCOPE: std::sync::OnceLock<bool> = std::sync::OnceLock::new();

    let scope = *SCOPE

        .get_or_init(|| Command::new("systemd-run").args(["--user", "--scope", "-q", "true"]).output().is_ok_and(|o| o.status.success()));

    let mut c = if scope {

        let mut c = Command::new("systemd-run");

        c.args(["--user", "--scope", "-q", "-p", "Delegate=yes", env!("CARGO_BIN_EXE_flow")]);

        c

    } else {

        Command::new(env!("CARGO_BIN_EXE_flow"))

    };

    c.arg("--home").arg(home);

    c

}

#[test]

fn a_pipeline_runs_confined_in_the_syscall_sandbox() {

    let busybox = Path::new("/usr/bin/busybox");

    let dir = tempfile::tempdir().unwrap();

    let home = dir.path().join("home");

    let tiers = flow(&home).arg("tiers").output().unwrap();

    let tiers = String::from_utf8_lossy(&tiers.stdout).into_owned();

    if !tiers.contains("syscall: available") || !busybox.is_file() {

        eprintln!("skipped: the syscall tier is not available here or there is no static busybox\n{tiers}");

        return;

    }

    // A rootfs of busybox and its applets.

    let tree = dir.path().join("tree");

    for d in ["bin", "src", "tmp", "proc", "dev", "etc", "run"] {

        std::fs::create_dir_all(tree.join(d)).unwrap();

    }

    std::fs::copy(busybox, tree.join("bin/busybox")).unwrap();

    for a in APPLETS {

        std::os::unix::fs::symlink("busybox", tree.join("bin").join(a)).unwrap();

    }

    let tarball = dir.path().join("rootfs.tar");

    assert!(Command::new("tar").arg("-cf").arg(&tarball).arg("-C").arg(&tree).arg(".").status().unwrap().success());

    let import = flow(&home).args(["rootfs", "import"]).arg(&tarball).output().unwrap();

    let said = String::from_utf8_lossy(&import.stdout).to_string() + &String::from_utf8_lossy(&import.stderr);

    assert!(import.status.success(), "{said}");

    let rootfs = said.split(|c: char| !c.is_ascii_hexdigit()).find(|w| w.len() == 64).expect("the import names the hash").to_string();

    let work = dir.path().join("work");

    std::fs::create_dir_all(work.join(".flow")).unwrap();

    std::fs::write(

        work.join(".flow/pipeline.kdl"),

        format!(

            r#"schema-version 1

sandbox "bb" {{

    runtime "syscall"

    rootfs "cas://blob/{rootfs}"

    memory-limit "256MiB"

}}

job "literal" {{

    sandbox "bb"

    exec "echo" "a; touch /src/pwned && $(id) | `id`"

}}

job "isolated" {{

    sandbox "bb"

    exec "sh" "-c" "cat /proc/net/dev | tail -n +3 | cut -d: -f1 | tr -d ' '; wget -q -T 2 -O /dev/null http://1.1.1.1 && echo NETWORK || echo no-network"

}}

job "readonly" {{

    sandbox "bb"

    exec "sh" "-c" "touch /etc/x 2>/dev/null && echo ROOTFS-WRITABLE; touch /run/x 2>/dev/null && echo RUN-WRITABLE; echo ok > /src/w && cat /src/w; id -u; hostname"

}}

job "walls" {{

    sandbox "bb"

    exec "sh" "-c" "mount -t tmpfs t /tmp 2>/dev/null && echo MOUNTED; ls /proc | grep -c '^[0-9]' | sed 's/^/procs /'; ls / | tr '\n' ' '; echo; echo done"

}}

job "greedy" {{

    sandbox "bb"

    exec "sh" "-c" "x=$(head -c 400000000 /dev/zero | tr '\\0' a); echo SURVIVED"

}}

job "fails" {{

    sandbox "bb"

    exec "false"

}}

job "after-failure" {{

    sandbox "bb"

    depends-on "fails"

    exec "echo" "SHOULD-NOT-RUN"

}}

"#

        ),

    )

    .unwrap();

    let out = flow(&home).arg("run").current_dir(&work).output().unwrap();

    let stdout = String::from_utf8_lossy(&out.stdout);

    let stderr = String::from_utf8_lossy(&out.stderr);

    let all = format!("{stdout}\n{stderr}");

    assert!(!out.status.success(), "a failed job fails the run: {all}");

    assert!(stdout.contains("   a; touch /src/pwned && $(id) | `id`\n"), "argv is literal: {all}");

    assert!(!work.join("pwned").exists());

    assert!(stdout.contains("   lo\n") && stdout.contains("no-network") && !stdout.contains("   NETWORK\n"), "only loopback: {all}");

    assert!(stdout.contains("   ok\n") && !stdout.contains("   ROOTFS-WRITABLE\n"), "rootfs read-only, workspace writable: {all}");

    assert!(stdout.contains("   1000\n") && !stdout.contains("   0\n"), "the job never runs as root: {all}");

    assert!(stdout.contains("   flow\n"), "its own host name: {all}");

    assert!(!stdout.contains("   MOUNTED\n") && stdout.contains("   done\n"), "no mounts: {all}");

    assert!(stderr.contains("Address family not supported"), "sockets other than AF_UNIX are refused: {all}");

    assert!(!work.join("w").exists(), "jobs write to their own copy: {all}");

    let procs: u32 = stdout.lines().find_map(|l| l.trim().strip_prefix("procs ")).and_then(|n| n.parse().ok()).expect(&all);

    assert!(procs < 10, "only the sandbox's processes are visible: {all}");

    assert!(!stdout.contains("home "), "none of the host's files: {all}");

    assert!(!stdout.contains("   RUN-WRITABLE\n"), "Landlock keeps a writable mount outside /src and /tmp read-only: {all}");

    assert!(stdout.contains("── greedy failed") && !stdout.contains("   SURVIVED\n"), "{all}");

    assert!(stderr.contains("the job ran out of memory: the sandbox allows 256 MiB"), "{all}");

    assert!(stdout.contains("── fails failed (exit 1)"), "{all}");

    assert!(stdout.contains("── after-failure skipped: fails failed") && !stdout.contains("   SHOULD-NOT-RUN\n"), "{all}");

}