//! The apt repository (oxygenhub#85): a release's `.deb` assets indexed,
//! signed and served at `/apt`, as apt reads them.

use axum::body::Body;
use axum::http::{Request, StatusCode};
use http_body_util::BodyExt;
use oxygenhub::config::Config;
use oxygenhub::db;
use oxygenhub::repos::RepoName;
use oxygenhub::Shared;
use std::io::Read;
use std::path::Path;
use std::process::Command;
use tower::ServiceExt;

async fn get(app: &Shared, path: &str) -> (StatusCode, Vec<u8>) {
    let res = oxygenhub::router(app.clone()).oneshot(Request::get(path).body(Body::empty()).unwrap()).await.unwrap();
    let status = res.status();
    (status, res.into_body().collect().await.unwrap().to_bytes().to_vec())
}

/// A minimal `.deb` with this control file (gzip control archive).
fn deb(control: &str) -> Vec<u8> {
    let mut tar_bytes = Vec::new();
    {
        let mut t = tar::Builder::new(&mut tar_bytes);
        let mut h = tar::Header::new_gnu();
        h.set_size(control.len() as u64);
        h.set_mode(0o644);
        h.set_cksum();
        t.append_data(&mut h, "./control", control.as_bytes()).unwrap();
        t.finish().unwrap();
    }
    let mut gz = flate2::write::GzEncoder::new(Vec::new(), flate2::Compression::default());
    std::io::Write::write_all(&mut gz, &tar_bytes).unwrap();
    let packed = gz.finish().unwrap();
    let mut out = b"!<arch>\n".to_vec();
    for (name, data) in [("debian-binary", b"2.0\n".to_vec()), ("control.tar.gz", packed), ("data.tar.gz", vec![1u8, 2, 3])] {
        out.extend_from_slice(format!("{:<16}{:<12}{:<6}{:<6}{:<8}{:<10}`\n", name, 0, 0, 0, 100644, data.len()).as_bytes());
        out.extend_from_slice(&data);
        if data.len() % 2 == 1 {
            out.push(b'\n');
        }
    }
    out
}

fn have_gpg() -> bool {
    Command::new("gpg").arg("--version").output().is_ok_and(|o| o.status.success())
}

fn gpg(home: &Path, args: &[&str]) -> std::process::Output {
    Command::new("gpg")
        .arg("--homedir")
        .arg(home)
        .args(["--batch", "--quiet", "--pinentry-mode", "loopback", "--passphrase", ""])
        .args(args)
        .output()
        .unwrap()
}

#[tokio::test(flavor = "multi_thread")]
async fn releases_debs_are_an_apt_repository() {
    if !have_gpg() {
        eprintln!("gpg is not installed: the apt repository is not tested here");
        return;
    }
    let dir = tempfile::tempdir().unwrap();
    let mut config = Config::load(dir.path()).unwrap();
    // The first account's setup code (oxygenhub#245).
    config.registration.setup_code = "test-setup".into();
    config.apt.repos = vec!["andy/oxy".into(), "andy/hidden".into()];
    // The signing key, in the hub's data as on Earth.
    let home = dir.path().join("apt-gnupg");
    std::fs::create_dir_all(&home).unwrap();
    std::fs::set_permissions(&home, std::os::unix::fs::PermissionsExt::from_mode(0o700)).unwrap();
    let made = gpg(&home, &["--quick-gen-key", "Test archive key <apt@example.org>", "ed25519", "sign", "never"]);
    assert!(made.status.success(), "{}", String::from_utf8_lossy(&made.stderr));
    let app = oxygenhub::build(config).await.unwrap();

    // Off when no repository is configured is checked by the default
    // config elsewhere; here, a public repository with a release, and a
    // private one whose packages must not leak.
    db::accounts::create_account(&app.db, "andy", "a@example.org", "x", "salt", true).await.unwrap();
    for (name, vis) in [("oxy", hub_api::Visibility::Public), ("hidden", hub_api::Visibility::Private)] {
        app.repos.create(&RepoName::parse(&format!("andy/{name}")).unwrap(), None).unwrap();
        db::repos::create(&app.db, "andy", name, "", vis).await.unwrap();
    }
    let control = |pkg: &str, v: &str, arch: &str| {
        format!("Package: {pkg}\nVersion: {v}\nArchitecture: {arch}\nMaintainer: Andy <a@example.org>\nDescription: {pkg} for tests\n")
    };
    let oxy = db::repos::get(&app.db, "andy", "oxy").await.unwrap().unwrap();
    let rel = db::releases::create(&app.db, oxy.id, "v0.3.0", "0.3.0", "", true, None).await.unwrap();
    let amd = deb(&control("oxy", "0.3.0", "amd64"));
    oxygenhub::web::releases::store_asset(&app, rel.id, "oxy_0.3.0_amd64.deb", "", &amd).await.unwrap();
    oxygenhub::web::releases::store_asset(&app, rel.id, "oxy_0.3.0_riscv64.deb", "", &deb(&control("oxy", "0.3.0", "riscv64")))
        .await
        .unwrap();
    oxygenhub::web::releases::store_asset(&app, rel.id, "oxy-0.3.0-linux-x86_64.tar.gz", "", b"not a deb").await.unwrap();
    let hidden = db::repos::get(&app.db, "andy", "hidden").await.unwrap().unwrap();
    let hr = db::releases::create(&app.db, hidden.id, "v1", "1", "", false, None).await.unwrap();
    oxygenhub::web::releases::store_asset(&app, hr.id, "secret_1_amd64.deb", "", &deb(&control("secret", "1", "amd64"))).await.unwrap();

    let (st, how) = get(&app, "/apt").await;
    assert_eq!(st, StatusCode::OK);
    assert!(String::from_utf8_lossy(&how).contains("sources.list.d/oxygenhub.sources"));

    // The index lists both architectures' packages, not the tarball, not
    // the private repository's.
    let (st, packages) = get(&app, "/apt/dists/stable/main/binary-amd64/Packages").await;
    assert_eq!(st, StatusCode::OK);
    let packages = String::from_utf8(packages).unwrap();
    assert!(packages.contains("Package: oxy\nVersion: 0.3.0\nArchitecture: amd64"), "{packages}");
    assert!(packages.contains("Filename: pool/main/o/oxy/oxy_0.3.0_amd64.deb"), "{packages}");
    assert!(packages.contains(&format!("Size: {}", amd.len())));
    assert!(!packages.contains("secret"), "a private repository's packages are not served");
    let (_, riscv) = get(&app, "/apt/dists/stable/main/binary-riscv64/Packages").await;
    assert!(String::from_utf8_lossy(&riscv).contains("oxy_0.3.0_riscv64.deb"));
    let (st, gz) = get(&app, "/apt/dists/stable/main/binary-amd64/Packages.gz").await;
    assert_eq!(st, StatusCode::OK);
    let mut unzipped = String::new();
    flate2::read::GzDecoder::new(gz.as_slice()).read_to_string(&mut unzipped).unwrap();
    assert_eq!(unzipped, packages);

    // Release names every index with its hash; InRelease and Release.gpg
    // verify against the published key.
    let (_, release) = get(&app, "/apt/dists/stable/Release").await;
    let release = String::from_utf8(release).unwrap();
    use sha2::Digest;
    let sum = hex::encode(sha2::Sha256::digest(packages.as_bytes()));
    assert!(release.contains(&format!("{sum} {:>8} main/binary-amd64/Packages\n", packages.len())), "{release}");
    assert!(release.contains("Architectures: amd64 arm64 riscv64"));
    let (st, key) = get(&app, "/apt/oxygenhub.gpg").await;
    assert_eq!(st, StatusCode::OK);
    let keyring = dir.path().join("keyring.gpg");
    std::fs::write(&keyring, &key).unwrap();
    let (_, in_release) = get(&app, "/apt/dists/stable/InRelease").await;
    assert!(String::from_utf8_lossy(&in_release).starts_with("-----BEGIN PGP SIGNED MESSAGE-----"));
    let signed = dir.path().join("InRelease");
    std::fs::write(&signed, &in_release).unwrap();
    let v = Command::new("gpgv").arg("--keyring").arg(&keyring).arg(&signed).output().unwrap();
    assert!(v.status.success(), "InRelease verifies: {}", String::from_utf8_lossy(&v.stderr));
    let (_, detached) = get(&app, "/apt/dists/stable/Release.gpg").await;
    std::fs::write(dir.path().join("Release.gpg"), &detached).unwrap();
    std::fs::write(dir.path().join("Release"), &release).unwrap();
    let v = Command::new("gpgv")
        .arg("--keyring")
        .arg(&keyring)
        .arg(dir.path().join("Release.gpg"))
        .arg(dir.path().join("Release"))
        .output()
        .unwrap();
    assert!(v.status.success(), "Release.gpg verifies: {}", String::from_utf8_lossy(&v.stderr));

    // The pool serves the package's own bytes; nothing else.
    let (st, bytes) = get(&app, "/apt/pool/main/o/oxy/oxy_0.3.0_amd64.deb").await;
    assert_eq!((st, bytes.len()), (StatusCode::OK, amd.len()));
    assert_eq!(get(&app, "/apt/pool/main/s/secret/secret_1_amd64.deb").await.0, StatusCode::NOT_FOUND);
    assert_eq!(get(&app, "/apt/dists/unstable/Release").await.0, StatusCode::NOT_FOUND);

    // A new release is in the index at once.
    let rel2 = db::releases::create(&app.db, oxy.id, "v0.3.1", "0.3.1", "", true, None).await.unwrap();
    oxygenhub::web::releases::store_asset(&app, rel2.id, "oxy_0.3.1_amd64.deb", "", &deb(&control("oxy", "0.3.1", "amd64"))).await.unwrap();
    let (_, packages) = get(&app, "/apt/dists/stable/main/binary-amd64/Packages").await;
    assert!(String::from_utf8_lossy(&packages).contains("Version: 0.3.1"));
    Command::new("gpgconf").arg("--homedir").arg(&home).args(["--kill", "gpg-agent"]).output().ok();
}

#[tokio::test(flavor = "multi_thread")]
async fn apt_is_off_unless_configured() {
    let dir = tempfile::tempdir().unwrap();
    let app = oxygenhub::build(Config::load(dir.path()).unwrap()).await.unwrap();
    assert_eq!(get(&app, "/apt").await.0, StatusCode::NOT_FOUND);
    assert_eq!(get(&app, "/apt/dists/stable/InRelease").await.0, StatusCode::NOT_FOUND);
}