//! Push protection (oxygenhub#268, hub spec §15.4): a push adding what

//! looks like a secret is refused with the file, line and fingerprint, and

//! nothing of it is stored; a maintainer's bypass, or the setting off, lets

//! it through; a large push is scanned only up to the budget.

//!

//! Every credential here is made up, in its documented example format, and

//! put together at run time so this file is not itself a finding.

use axum::body::Body;

use axum::http::{header, Request, StatusCode};

use http_body_util::BodyExt;

use oxy_core::hash::ChangeHash;

use oxy_core::repo::Repo;

use oxygenhub::auth::random_hex;

use oxygenhub::config::Config;

use oxygenhub::db;

use oxygenhub::push_protection::fingerprint;

use oxygenhub::repos::RepoName;

use oxygenhub::Shared;

use std::path::Path;

use tower::ServiceExt;

fn hermetic() {

    static ONCE: std::sync::Once = std::sync::Once::new();

    static DIR: std::sync::OnceLock<tempfile::TempDir> = std::sync::OnceLock::new();

    ONCE.call_once(|| {

        let d = tempfile::tempdir().unwrap();

        std::env::set_var("OXY_HOME", d.path());

        DIR.set(d).ok();

    });

}

fn write(root: &Path, rel: &str, content: &[u8]) {

    let p = root.join(rel);

    std::fs::create_dir_all(p.parent().unwrap()).unwrap();

    std::fs::write(p, content).unwrap();

}

struct Hub {

    app: Shared,

    base: String,

    _dir: tempfile::TempDir,

}

async fn hub(scan_limit: Option<u64>) -> Hub {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let mut config = Config::load(dir.path()).unwrap();

    config.registration.setup_code = "test-setup".into();

    config.registration.mode = "open".into();

    if let Some(n) = scan_limit {

        config.limits.scan_limit = oxygenhub::config::ByteSize(n);

    }

    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();

    let port = listener.local_addr().unwrap().port();

    config.server.base_url = format!("http://127.0.0.1:{port}");

    let app = oxygenhub::build(config).await.unwrap();

    let router = oxygenhub::router(app.clone());

    tokio::spawn(async move { axum::serve(listener, router).await.unwrap() });

    Hub { app, base: format!("http://127.0.0.1:{port}"), _dir: dir }

}

struct Res {

    status: StatusCode,

    body: String,

    cookie: Option<String>,

}

async fn send(app: &Shared, method: &str, path: &str, cookie: Option<&str>, form: Option<&str>) -> Res {

    let mut req = Request::builder().method(method).uri(path);

    if let Some(c) = cookie {

        req = req.header(header::COOKIE, format!("oxyhub={c}"));

    }

    let body = match form {

        Some(f) => {

            req = req.header(header::CONTENT_TYPE, "application/x-www-form-urlencoded");

            Body::from(f.to_string())

        }

        None => Body::empty(),

    };

    let res = oxygenhub::router(app.clone()).oneshot(req.body(body).unwrap()).await.unwrap();

    let status = res.status();

    let cookie = res

        .headers()

        .get(header::SET_COOKIE)

        .and_then(|v| v.to_str().ok())

        .and_then(|v| v.split(';').next())

        .and_then(|kv| kv.split_once('='))

        .map(|(_, v)| v.to_string());

    let bytes = res.into_body().collect().await.unwrap().to_bytes();

    Res { status, body: String::from_utf8_lossy(&bytes).into_owned(), cookie }

}

async fn get(app: &Shared, path: &str, cookie: Option<&str>) -> Res {

    send(app, "GET", path, cookie, None).await

}

async fn post(app: &Shared, path: &str, cookie: Option<&str>, form: &str) -> Res {

    send(app, "POST", path, cookie, Some(form)).await

}

async fn register(app: &Shared, user: &str) -> String {

    let r = post(

        app,

        "/register",

        None,

        &format!("username={user}&email={user}%40example.com&password=correct-horse-battery&setup=test-setup"),

    )

    .await;

    assert_eq!(r.status, StatusCode::SEE_OTHER, "{}", r.body);

    r.cookie.unwrap()

}

fn csrf_of(page: &str) -> String {

    let i = page.find("name=\"_csrf\" value=\"").expect("csrf field") + "name=\"_csrf\" value=\"".len();

    page[i..].split('"').next().unwrap().to_string()

}

/// A personal access token for `user`, marked as an agent's when `agent`

/// names one.

async fn token(app: &Shared, user: &str, agent: Option<&str>) -> String {

    let me = db::accounts::account_by_name(&app.db, user).await.unwrap().unwrap();

    let (secret, hash) = oxygenhub::auth::new_token();

    let t = db::accounts::create_token(&app.db, me.id, agent.unwrap_or("laptop"), &hash, "repo:read,repo:write", "", None).await.unwrap();

    if agent.is_some() {

        db::accounts::set_token_agent(&app.db, me.id, t.id, true).await.unwrap();

    }

    secret

}

/// andy/demo, public, with a client checkout at `work` pushing as `tok`

/// and its first change pushed.

async fn demo(h: &Hub, work: &Path, tok: &str) -> (Repo, ChangeHash) {

    let repo = RepoName::parse("andy/demo").unwrap();

    h.app.repos.create(&repo, None).unwrap();

    db::repos::create(&h.app.db, "andy", "demo", "", hub_api::Visibility::Public).await.unwrap();

    let mut client = Repo::init(work).unwrap();

    client.create_identity("Andy McCall", "[email protected]", oxy_core::repo::IdentityScope::User).unwrap();

    client.config.set("remote.origin.url", &format!("{}/andy/demo", h.base)).unwrap();

    client.config.set("remote.origin.token", tok).unwrap();

    client.save_config().unwrap();

    write(work, "README.md", b"one\ntwo\nthree\n");

    client.snapshot("t").unwrap();

    let base = client.commit("base", &[]).unwrap();

    // A push without secrets is unaffected.

    assert!(client.push("origin", false).unwrap().iter().all(|r| r.ok));

    (client, base)

}

fn hosted_heads(app: &Shared) -> Vec<ChangeHash> {

    app.repos.open(&RepoName::parse("andy/demo").unwrap()).unwrap().bookmark_heads().unwrap()

}

/// A PEM private key made for this test and thrown away.

fn pem_key() -> String {

    rcgen::KeyPair::generate().unwrap().serialize_pem()

}

/// What a file should be refused for: (rule, secret, line).

type Expected = Vec<(&'static str, String, usize)>;

/// Each kind of secret: (file, content, what it is refused for).

fn samples() -> Vec<(String, String, Expected)> {

    let aws_id = format!("{}{}", "AKIA", "IOSFODNN7EXAMPLE");

    let aws_secret = format!("{}{}", "wJalrXUtnFEMI/K7MDENG/", "bPxRfiCYEXAMPLEKEY");

    let pem = pem_key();

    let gcp_key = pem.replace('\n', "\\n");

    let azure_key = format!("{}==", random_hex(43).chars().map(|c| if c == 'a' { 'Z' } else { c }).collect::<String>());

    let ghp = format!("{}_{}", "ghp", random_hex(18));

    let pat = format!("{}_{}_{}{}", "github_pat", random_hex(11), random_hex(29), "x");

    let glpat = format!("{}-{}", "glpat", random_hex(10));

    let oxyhub = format!("{}_{}", "oxyhub", random_hex(32));

    let grant = format!("{}_{}", "oxyagent", random_hex(32));

    let job = format!("{}_{}", "flowjob", random_hex(32));

    let slack = format!("{}-{}-{}-{}", "xoxb", "123456789012", "1234567890123", random_hex(12));

    let stripe = format!("{}_{}_{}", "sk", "live", random_hex(12));

    let ssh_body = (0..4).map(|_| random_hex(30)).collect::<Vec<_>>().join("\n");

    let ssh = format!("-----{} OPENSSH PRIVATE KEY-----\n{ssh_body}\n-----{} OPENSSH PRIVATE KEY-----", "BEGIN", "END");

    let head = "# settings\n\n";

    vec![

        (

            "aws/credentials".into(),

            format!("[default]\naws_access_key_id = {aws_id}\naws_secret_access_key = {aws_secret}\n"),

            vec![("aws-access-key-id", aws_id, 2), ("aws-secret-access-key", aws_secret, 3)],

        ),

        (

            "gcp/key.json".into(),

            format!(

                "{{\n  \"type\": \"service_account\",\n  \"project_id\": \"example\",\n  \"private_key\": \"{gcp_key}\",\n  \"client_email\": \"[email protected]\"\n}}\n"

            ),

            vec![("gcp-service-account", gcp_key, 4)],

        ),

        (

            "azure.env".into(),

            format!("{head}AZURE=DefaultEndpointsProtocol=https;AccountName=example;AccountKey={azure_key};EndpointSuffix=core.windows.net\n"),

            vec![("azure-storage-connection-string", azure_key, 3)],

        ),

        ("gh.env".into(), format!("{head}GH_TOKEN={ghp}\nGH_PAT={pat}\n"), vec![("github-token", ghp, 3), ("github-fine-grained-token", pat, 4)]),

        ("gl.env".into(), format!("{head}GITLAB_TOKEN={glpat}\n"), vec![("gitlab-token", glpat, 3)]),

        (

            "hub.env".into(),

            format!("{head}OXY_TOKEN={oxyhub}\nGRANT={grant}\nJOB={job}\n"),

            vec![("oxygenhub-token", oxyhub, 3), ("oxygenhub-agent-grant", grant, 4), ("oxygenflow-job-token", job, 5)],

        ),

        ("slack.env".into(), format!("{head}SLACK={slack}\n"), vec![("slack-token", slack, 3)]),

        ("stripe.env".into(), format!("{head}STRIPE={stripe}\n"), vec![("stripe-live-key", stripe, 3)]),

        ("keys/tls.key".into(), format!("{head}{pem}"), vec![("private-key", pem.trim_end().to_string(), 3)]),

        ("keys/id_ed25519".into(), format!("{head}{ssh}\n"), vec![("openssh-private-key", ssh, 3)]),

    ]

}

#[tokio::test(flavor = "multi_thread")]

async fn a_push_adding_a_secret_is_refused_until_allowed() {

    let h = hub(None).await;

    let app = &h.app;

    let andy = register(app, "andy").await;

    let tok = token(app, "andy", None).await;

    let work = tempfile::tempdir().unwrap();

    let (mut client, base) = demo(&h, work.path(), &tok).await;

    assert!(db::repos::get(&app.db, "andy", "demo").await.unwrap().unwrap().push_protection, "on by default");

    // Each kind, alone, is refused with where it is and its fingerprint,

    // the secret itself never shown; nothing is stored or moved.

    for (file, content, expect) in samples() {

        write(work.path(), &file, content.as_bytes());

        client.snapshot("t").unwrap();

        let h1 = client.commit(&format!("add {file}"), &[]).unwrap();

        let err = client.push("origin", false).err().unwrap_or_else(|| panic!("{file} was accepted")).to_string();

        assert!(err.contains("HTTP 422") && err.contains("push protection refused this push"), "{err}");

        assert!(err.contains("oxy amend") && err.contains(&format!("{}/andy/demo/settings#push-protection", h.base)), "{err}");

        assert!(!err.contains("hint:"), "no credential hint for a refusal: {err}");

        for (rule, secret, line) in &expect {

            let fp = fingerprint(rule, secret.as_bytes());

            assert!(err.contains(&format!("{file}:{line}: ")) && err.contains(&format!("(fingerprint {fp})")), "{rule} in {file}: {err}");

            assert!(!err.contains(secret.as_str()), "{rule}: the secret is shown: {err}");

        }

        assert_eq!(err.matches("(fingerprint ").count(), expect.len(), "{err}");

        assert_eq!(hosted_heads(app), vec![base], "nothing moved");

        let hosted = app.repos.open(&RepoName::parse("andy/demo").unwrap()).unwrap();

        assert!(hosted.store().get_change(&h1).is_err(), "nothing stored");

        client.abandon(&h1).unwrap();

        let _ = std::fs::remove_file(work.path().join(&file));

        client.snapshot("t").unwrap();

    }

    // A secret inserted into an existing file is placed at its line there.

    let ghp = format!("{}_{}", "ghp", random_hex(18));

    write(work.path(), "README.md", format!("one\ntwo\n{ghp}\nthree\n").as_bytes());

    client.snapshot("t").unwrap();

    let edit = client.commit("token in the readme", &[]).unwrap();

    let err = client.push("origin", false).err().unwrap().to_string();

    let fp = fingerprint("github-token", ghp.as_bytes());

    assert!(err.contains(&format!("README.md:3: GitHub token (fingerprint {fp})")), "{err}");

    // The refusal is in the push log and among the findings in Settings.

    let log = db::repos::pushes(&app.db, 1, 10).await.unwrap();

    assert!(

        log.iter().any(|p| !p.ok && p.reference == "main" && p.reason.contains("push protection") && p.reason.contains("README.md:3")),

        "{log:?}"

    );

    let settings = get(app, "/andy/demo/settings", Some(&andy)).await;

    assert!(settings.body.contains("id=\"push-protection\"") && settings.body.contains(&fp), "{}", settings.body);

    assert!(!settings.body.contains(&ghp), "the settings page shows no secret");

    // A writer cannot allow it.

    let bob = register(app, "bob").await;

    let csrf = csrf_of(&settings.body);

    let r = post(app, "/andy/demo/settings/collaborators", Some(&andy), &format!("_csrf={csrf}&username=bob&role=write")).await;

    assert_eq!(r.status, StatusCode::OK, "{}", r.body);

    let bob_page = get(app, "/andy/demo", Some(&bob)).await;

    let bob_csrf = csrf_of(&bob_page.body);

    let r = post(app, "/andy/demo/settings/secret-bypass", Some(&bob), &format!("_csrf={bob_csrf}&fingerprint={fp}&reason=mine")).await;

    assert_eq!(r.status, StatusCode::NOT_FOUND, "write is not maintain");

    assert!(db::push_protection::allowed(&app.db, 1).await.unwrap().is_empty());

    // A maintainer allows it, with a reason, audited; the push then lands.

    let r = post(app, "/andy/demo/settings/secret-bypass", Some(&andy), &format!("_csrf={csrf}&fingerprint={fp}&reason=")).await;

    assert!(r.body.contains("Say why"), "a reason is needed");

    let r =

        post(app, "/andy/demo/settings/secret-bypass", Some(&andy), &format!("_csrf={csrf}&fingerprint={fp}&reason=a+revoked+test+token"))

            .await;

    assert_eq!(r.status, StatusCode::OK, "{}", r.body);

    assert!(r.body.contains(&format!("Fingerprint {fp} is allowed")) && r.body.contains("a revoked test token"), "{}", r.body);

    let audit = db::accounts::audit_rows(&app.db, 20).await.unwrap();

    assert!(audit.iter().any(|a| a.action == "secret.bypass" && a.detail.contains(&fp) && a.detail.contains("github-token")), "{audit:?}");

    assert!(client.push("origin", false).unwrap().iter().all(|r| r.ok));

    assert_eq!(hosted_heads(app), vec![edit]);

    // An agent's push is told what an agent should do.

    let agent_tok = token(app, "andy", Some("Claude")).await;

    client.config.set("remote.origin.token", &agent_tok).unwrap();

    client.save_config().unwrap();

    let stripe = format!("{}_{}_{}", "sk", "live", random_hex(12));

    write(work.path(), "pay.env", format!("STRIPE={stripe}\n").as_bytes());

    client.snapshot("t").unwrap();

    client.commit("pay", &[]).unwrap();

    let err = client.push("origin", false).err().unwrap().to_string();

    assert!(err.contains("an agent's token (Claude)") && err.contains("do not try to get around the refusal"), "{err}");

    let settings = get(app, "/andy/demo/settings", Some(&andy)).await;

    assert!(settings.body.contains("via Claude"), "the finding names the agent");

    // With push protection off, the same push lands; the change is audited.

    let csrf = csrf_of(&settings.body);

    let r = post(app, "/andy/demo/settings/push-protection", Some(&andy), &format!("_csrf={csrf}")).await;

    assert_eq!(r.status, StatusCode::OK, "{}", r.body);

    assert!(!db::repos::get(&app.db, "andy", "demo").await.unwrap().unwrap().push_protection);

    let audit = db::accounts::audit_rows(&app.db, 20).await.unwrap();

    assert!(audit.iter().any(|a| a.action == "repo.push_protection" && a.detail == "off"), "{audit:?}");

    assert!(client.push("origin", false).unwrap().iter().all(|r| r.ok));

    let r = post(app, "/andy/demo/settings/push-protection", Some(&andy), &format!("_csrf={csrf}&protect=on")).await;

    assert_eq!(r.status, StatusCode::OK, "{}", r.body);

    assert!(db::repos::get(&app.db, "andy", "demo").await.unwrap().unwrap().push_protection);

}

/// Past the scan budget the rest of a push goes unscanned: it is accepted,

/// and its push log entry says how much was not scanned.

#[tokio::test(flavor = "multi_thread")]

async fn a_push_past_the_scan_budget_is_accepted_and_says_so() {

    let h = hub(Some(1024)).await;

    let app = &h.app;

    register(app, "andy").await;

    let tok = token(app, "andy", None).await;

    let work = tempfile::tempdir().unwrap();

    let (client, _) = demo(&h, work.path(), &tok).await;

    let filler: String = (0..64).map(|i| format!("line {i} of a long generated file\n")).collect();

    let stripe = format!("{}_{}_{}", "sk", "live", random_hex(12));

    write(work.path(), "big.txt", format!("{filler}STRIPE={stripe}\n").as_bytes());

    client.snapshot("t").unwrap();

    let big = client.commit("big", &[]).unwrap();

    assert!(client.push("origin", false).unwrap().iter().all(|r| r.ok));

    assert!(hosted_heads(app).contains(&big));

    let log = db::repos::pushes(&app.db, 1, 10).await.unwrap();

    let mut said = false;

    for _ in 0..50 {

        said = db::repos::pushes(&app.db, 1, 10)

            .await

            .unwrap()

            .iter()

            .any(|p| p.ok && p.reason.contains("stopped at its size budget") && p.reason.contains("not scanned"));

        if said {

            break;

        }

        tokio::time::sleep(std::time::Duration::from_millis(50)).await;

    }

    assert!(said, "{log:?}");

}