//! The apt repository (oxygenhub#85): a release's `.deb` assets indexed,

//! signed and served at `/apt`, as apt reads them.

use axum::body::Body;

use axum::http::{Request, StatusCode};

use http_body_util::BodyExt;

use oxygenhub::config::Config;

use oxygenhub::db;

use oxygenhub::repos::RepoName;

use oxygenhub::Shared;

use std::io::Read;

use std::path::Path;

use std::process::Command;

use tower::ServiceExt;

async fn get(app: &Shared, path: &str) -> (StatusCode, Vec<u8>) {

    let res = oxygenhub::router(app.clone()).oneshot(Request::get(path).body(Body::empty()).unwrap()).await.unwrap();

    let status = res.status();

    (status, res.into_body().collect().await.unwrap().to_bytes().to_vec())

}

/// A minimal `.deb` with this control file (gzip control archive).

fn deb(control: &str) -> Vec<u8> {

    let mut tar_bytes = Vec::new();

    {

        let mut t = tar::Builder::new(&mut tar_bytes);

        let mut h = tar::Header::new_gnu();

        h.set_size(control.len() as u64);

        h.set_mode(0o644);

        h.set_cksum();

        t.append_data(&mut h, "./control", control.as_bytes()).unwrap();

        t.finish().unwrap();

    }

    let mut gz = flate2::write::GzEncoder::new(Vec::new(), flate2::Compression::default());

    std::io::Write::write_all(&mut gz, &tar_bytes).unwrap();

    let packed = gz.finish().unwrap();

    let mut out = b"!<arch>\n".to_vec();

    for (name, data) in [("debian-binary", b"2.0\n".to_vec()), ("control.tar.gz", packed), ("data.tar.gz", vec![1u8, 2, 3])] {

        out.extend_from_slice(format!("{:<16}{:<12}{:<6}{:<6}{:<8}{:<10}`\n", name, 0, 0, 0, 100644, data.len()).as_bytes());

        out.extend_from_slice(&data);

        if data.len() % 2 == 1 {

            out.push(b'\n');

        }

    }

    out

}

fn have_gpg() -> bool {

    Command::new("gpg").arg("--version").output().is_ok_and(|o| o.status.success())

}

fn gpg(home: &Path, args: &[&str]) -> std::process::Output {

    Command::new("gpg")

        .arg("--homedir")

        .arg(home)

        .args(["--batch", "--quiet", "--pinentry-mode", "loopback", "--passphrase", ""])

        .args(args)

        .output()

        .unwrap()

}

#[tokio::test(flavor = "multi_thread")]

async fn releases_debs_are_an_apt_repository() {

    if !have_gpg() {

        eprintln!("gpg is not installed: the apt repository is not tested here");

        return;

    }

    let dir = tempfile::tempdir().unwrap();

    let mut config = Config::load(dir.path()).unwrap();

    config.apt.repos = vec!["andy/oxy".into(), "andy/hidden".into()];

    // The signing key, in the hub's data as on Earth.

    let home = dir.path().join("apt-gnupg");

    std::fs::create_dir_all(&home).unwrap();

    std::fs::set_permissions(&home, std::os::unix::fs::PermissionsExt::from_mode(0o700)).unwrap();

    let made = gpg(&home, &["--quick-gen-key", "Test archive key <[email protected]>", "ed25519", "sign", "never"]);

    assert!(made.status.success(), "{}", String::from_utf8_lossy(&made.stderr));

    let app = oxygenhub::build(config).await.unwrap();

    // Off when no repository is configured is checked by the default

    // config elsewhere; here, a public repository with a release, and a

    // private one whose packages must not leak.

    db::accounts::create_account(&app.db, "andy", "[email protected]", "x", "salt", true).await.unwrap();

    for (name, vis) in [("oxy", hub_api::Visibility::Public), ("hidden", hub_api::Visibility::Private)] {

        app.repos.create(&RepoName::parse(&format!("andy/{name}")).unwrap(), None).unwrap();

        db::repos::create(&app.db, "andy", name, "", vis).await.unwrap();

    }

    let control = |pkg: &str, v: &str, arch: &str| {

        format!("Package: {pkg}\nVersion: {v}\nArchitecture: {arch}\nMaintainer: Andy <[email protected]>\nDescription: {pkg} for tests\n")

    };

    let oxy = db::repos::get(&app.db, "andy", "oxy").await.unwrap().unwrap();

    let rel = db::releases::create(&app.db, oxy.id, "v0.3.0", "0.3.0", "", true, None).await.unwrap();

    let amd = deb(&control("oxy", "0.3.0", "amd64"));

    oxygenhub::web::releases::store_asset(&app, rel.id, "oxy_0.3.0_amd64.deb", "", &amd).await.unwrap();

    oxygenhub::web::releases::store_asset(&app, rel.id, "oxy_0.3.0_riscv64.deb", "", &deb(&control("oxy", "0.3.0", "riscv64")))

        .await

        .unwrap();

    oxygenhub::web::releases::store_asset(&app, rel.id, "oxy-0.3.0-linux-x86_64.tar.gz", "", b"not a deb").await.unwrap();

    let hidden = db::repos::get(&app.db, "andy", "hidden").await.unwrap().unwrap();

    let hr = db::releases::create(&app.db, hidden.id, "v1", "1", "", false, None).await.unwrap();

    oxygenhub::web::releases::store_asset(&app, hr.id, "secret_1_amd64.deb", "", &deb(&control("secret", "1", "amd64"))).await.unwrap();

    let (st, how) = get(&app, "/apt").await;

    assert_eq!(st, StatusCode::OK);

    assert!(String::from_utf8_lossy(&how).contains("sources.list.d/oxygenhub.sources"));

    // The index lists both architectures' packages, not the tarball, not

    // the private repository's.

    let (st, packages) = get(&app, "/apt/dists/stable/main/binary-amd64/Packages").await;

    assert_eq!(st, StatusCode::OK);

    let packages = String::from_utf8(packages).unwrap();

    assert!(packages.contains("Package: oxy\nVersion: 0.3.0\nArchitecture: amd64"), "{packages}");

    assert!(packages.contains("Filename: pool/main/o/oxy/oxy_0.3.0_amd64.deb"), "{packages}");

    assert!(packages.contains(&format!("Size: {}", amd.len())));

    assert!(!packages.contains("secret"), "a private repository's packages are not served");

    let (_, riscv) = get(&app, "/apt/dists/stable/main/binary-riscv64/Packages").await;

    assert!(String::from_utf8_lossy(&riscv).contains("oxy_0.3.0_riscv64.deb"));

    let (st, gz) = get(&app, "/apt/dists/stable/main/binary-amd64/Packages.gz").await;

    assert_eq!(st, StatusCode::OK);

    let mut unzipped = String::new();

    flate2::read::GzDecoder::new(gz.as_slice()).read_to_string(&mut unzipped).unwrap();

    assert_eq!(unzipped, packages);

    // Release names every index with its hash; InRelease and Release.gpg

    // verify against the published key.

    let (_, release) = get(&app, "/apt/dists/stable/Release").await;

    let release = String::from_utf8(release).unwrap();

    use sha2::Digest;

    let sum = hex::encode(sha2::Sha256::digest(packages.as_bytes()));

    assert!(release.contains(&format!("{sum} {:>8} main/binary-amd64/Packages\n", packages.len())), "{release}");

    assert!(release.contains("Architectures: amd64 arm64 riscv64"));

    let (st, key) = get(&app, "/apt/oxygenhub.gpg").await;

    assert_eq!(st, StatusCode::OK);

    let keyring = dir.path().join("keyring.gpg");

    std::fs::write(&keyring, &key).unwrap();

    let (_, in_release) = get(&app, "/apt/dists/stable/InRelease").await;

    assert!(String::from_utf8_lossy(&in_release).starts_with("-----BEGIN PGP SIGNED MESSAGE-----"));

    let signed = dir.path().join("InRelease");

    std::fs::write(&signed, &in_release).unwrap();

    let v = Command::new("gpgv").arg("--keyring").arg(&keyring).arg(&signed).output().unwrap();

    assert!(v.status.success(), "InRelease verifies: {}", String::from_utf8_lossy(&v.stderr));

    let (_, detached) = get(&app, "/apt/dists/stable/Release.gpg").await;

    std::fs::write(dir.path().join("Release.gpg"), &detached).unwrap();

    std::fs::write(dir.path().join("Release"), &release).unwrap();

    let v = Command::new("gpgv")

        .arg("--keyring")

        .arg(&keyring)

        .arg(dir.path().join("Release.gpg"))

        .arg(dir.path().join("Release"))

        .output()

        .unwrap();

    assert!(v.status.success(), "Release.gpg verifies: {}", String::from_utf8_lossy(&v.stderr));

    // The pool serves the package's own bytes; nothing else.

    let (st, bytes) = get(&app, "/apt/pool/main/o/oxy/oxy_0.3.0_amd64.deb").await;

    assert_eq!((st, bytes.len()), (StatusCode::OK, amd.len()));

    assert_eq!(get(&app, "/apt/pool/main/s/secret/secret_1_amd64.deb").await.0, StatusCode::NOT_FOUND);

    assert_eq!(get(&app, "/apt/dists/unstable/Release").await.0, StatusCode::NOT_FOUND);

    // A new release is in the index at once.

    let rel2 = db::releases::create(&app.db, oxy.id, "v0.3.1", "0.3.1", "", true, None).await.unwrap();

    oxygenhub::web::releases::store_asset(&app, rel2.id, "oxy_0.3.1_amd64.deb", "", &deb(&control("oxy", "0.3.1", "amd64"))).await.unwrap();

    let (_, packages) = get(&app, "/apt/dists/stable/main/binary-amd64/Packages").await;

    assert!(String::from_utf8_lossy(&packages).contains("Version: 0.3.1"));

    Command::new("gpgconf").arg("--homedir").arg(&home).args(["--kill", "gpg-agent"]).output().ok();

}

#[tokio::test(flavor = "multi_thread")]

async fn apt_is_off_unless_configured() {

    let dir = tempfile::tempdir().unwrap();

    let app = oxygenhub::build(Config::load(dir.path()).unwrap()).await.unwrap();

    assert_eq!(get(&app, "/apt").await.0, StatusCode::NOT_FOUND);

    assert_eq!(get(&app, "/apt/dists/stable/InRelease").await.0, StatusCode::NOT_FOUND);

}