//! Git over SSH, driven by a real `git` and a real `ssh`.
//!
//! The server is the real binary, reached the way a developer reaches it: a
//! key is registered through the webui, a repository is created through the
//! webui, and then `git` itself is pointed at the SSH port with
//! `GIT_SSH_COMMAND`. Nothing here reimplements the git protocol, because the
//! thing worth checking is that the two sides agree - and the only honest way
//! to check that is to let the real client speak.

mod support;

use std::fs;
use std::path::{Path, PathBuf};
use std::process::{Command, Output};
use std::sync::atomic::{AtomicU64, Ordering};

use support::{Client, Server, free_port};

/// The password the tests register and log in with.
const PASSWORD: &str = "correct horse battery staple";

/// Names the scratch directories, so several tests can run at once.
static COUNTER: AtomicU64 = AtomicU64::new(0);

fn spawn() -> (Server, u16) {
    let port = free_port();
    let mut server = Server::spawn(&format!("127.0.0.1:{port}"));
    server.wait_for_connection(port);
    // The SSH listener is bound before the web server starts, but its thread
    // still has to reach `accept`; waiting here keeps `git` from racing it.
    let ssh_port = server.ssh_port();
    server.wait_for_connection(ssh_port);
    (server, port)
}

/// Whether the external tools these tests drive are on the machine.
fn tooling_present() -> bool {
    fn have(binary: &str, arg: &str) -> bool {
        Command::new(binary).arg(arg).output().is_ok()
    }

    have("git", "--version") && have("ssh", "-V") && have("ssh-keygen", "--version")
}

/// Leaves the test quietly if `git`, `ssh` or `ssh-keygen` is missing, rather
/// than failing for a reason that says nothing about the server.
macro_rules! skip_without_tooling {
    () => {
        if !tooling_present() {
            eprintln!("skipping: this test needs `git`, `ssh` and `ssh-keygen` on PATH");
            return Ok(());
        }
    };
}

/// A directory of the test's own, removed when it goes out of scope.
struct Scratch {
    dir: PathBuf,
}

impl Scratch {
    fn new(label: &str) -> Self {
        let count = COUNTER.fetch_add(1, Ordering::Relaxed);
        let dir =
            std::env::temp_dir().join(format!("frogue-{label}-{}-{count}", std::process::id()));
        fs::create_dir_all(&dir).expect("the scratch directory should be creatable");
        Scratch { dir }
    }

    fn path(&self, name: &str) -> PathBuf {
        self.dir.join(name)
    }
}

impl Drop for Scratch {
    fn drop(&mut self) {
        let _ = fs::remove_dir_all(&self.dir);
    }
}

/// Writes a fresh ed25519 keypair into `scratch`, and returns the private
/// half's path. The public half is left beside it as `<name>.pub`, where
/// `ssh-keygen` puts it.
fn keygen(scratch: &Scratch, name: &str) -> PathBuf {
    let key = scratch.path(name);

    let output = Command::new("ssh-keygen")
        .arg("-t")
        .arg("ed25519")
        .arg("-f")
        .arg(&key)
        .arg("-N")
        .arg("")
        .arg("-C")
        .arg(name)
        .output()
        .expect("ssh-keygen should run");

    assert!(
        output.status.success(),
        "ssh-keygen failed:\n{}",
        String::from_utf8_lossy(&output.stderr)
    );

    // The SSH client refuses a private key anyone else could read, so the
    // mode is set rather than left to the process umask.
    #[cfg(unix)]
    {
        use std::os::unix::fs::PermissionsExt as _;
        fs::set_permissions(&key, fs::Permissions::from_mode(0o600))
            .expect("the private key should be readable by its owner alone");
    }

    key
}

/// Registers `name` through the form, which logs them in.
fn register_and_login(client: &mut Client, name: &str, email: &str) {
    let response = client.post_form(
        "/register",
        &[("name", name), ("email", email), ("password", PASSWORD)],
    );

    assert_eq!(
        response.status, 303,
        "registering should log in\n{}",
        response.body
    );
}

/// Adds the public key at `public_key` to `owner`'s account.
fn add_key(client: &mut Client, owner: &str, public_key: &Path) {
    let key = fs::read_to_string(public_key).expect("the public key should be readable");

    let response = client.post_form(&format!("/~{owner}/ssh-keys"), &[("key", key.trim())]);

    assert_eq!(
        response.status, 303,
        "adding a key should redirect\n{}",
        response.body
    );
}

/// Creates `owner`'s repository `slug` with the given visibility.
fn create_repository(client: &mut Client, owner: &str, slug: &str, visibility: &str) {
    let response = client.post_form(
        &format!("/~{owner}/repositories"),
        &[
            ("slug", slug),
            ("description", "a repository from the SSH tests"),
            ("visibility", visibility),
        ],
    );

    assert_eq!(
        response.status, 303,
        "creating a repository should redirect\n{}",
        response.body
    );
    assert_eq!(
        response.location.as_deref(),
        Some(format!("/~{owner}/{slug}").as_str()),
        "creating a repository should lead to its page"
    );
}

/// The `GIT_SSH_COMMAND` that points `git` at our server using `key`.
///
/// `BatchMode` matters most: without it a refused key turns into an
/// interactive password prompt and the test hangs instead of failing.
fn ssh_command(key: &Path, port: u16) -> String {
    format!(
        "ssh -i {} -o IdentitiesOnly=yes -o BatchMode=yes \
         -o PreferredAuthentications=publickey \
         -o StrictHostKeyChecking=accept-new \
         -o UserKnownHostsFile=/dev/null -p {port}",
        key.display()
    )
}

/// Runs `git` in `dir`, pointed at the server, and returns what it said.
///
/// The global and system configuration are turned off so that a developer's
/// own `insteadOf` or `core.sshCommand` cannot change what is being tested.
fn git(dir: &Path, key: &Path, port: u16, args: &[&str]) -> Output {
    Command::new("git")
        .current_dir(dir)
        .arg("-c")
        .arg("user.name=Test")
        .arg("-c")
        .arg("user.email=test@example.org")
        .args(args)
        .env("GIT_SSH_COMMAND", ssh_command(key, port))
        .env("GIT_TERMINAL_PROMPT", "0")
        .env("GIT_CONFIG_GLOBAL", "/dev/null")
        .env("GIT_CONFIG_SYSTEM", "/dev/null")
        .output()
        .expect("git should run")
}

/// Fails with `git`'s own words when it did not succeed.
fn assert_ok(output: &Output, what: &str) {
    assert!(
        output.status.success(),
        "{what} should succeed, but git exited with {:?}\nstdout:\n{}\nstderr:\n{}",
        output.status.code(),
        String::from_utf8_lossy(&output.stdout),
        String::from_utf8_lossy(&output.stderr),
    );
}

/// The `ssh://` URL for a repository on the test server.
fn url(port: u16, owner: &str, slug: &str) -> String {
    format!("ssh://git@127.0.0.1:{port}/{owner}/{slug}.git")
}

#[tokio::test]
async fn a_repository_round_trips_over_ssh() -> miette::Result<()> {
    skip_without_tooling!();

    let (server, port) = spawn();
    let ssh_port = server.ssh_port();
    let scratch = Scratch::new("ssh-roundtrip");
    let key = keygen(&scratch, "id_ed25519");

    let mut client = Client::new(port);
    register_and_login(&mut client, "alice", "alice@example.org");
    add_key(&mut client, "alice", &scratch.path("id_ed25519.pub"));
    create_repository(&mut client, "alice", "test-repo", "public");

    let remote = url(ssh_port, "alice", "test-repo");

    // Cloning an empty repository: it comes down with nothing in it, which is
    // still a successful clone.
    let first = scratch.path("first");
    let output = git(
        &scratch.dir,
        &key,
        ssh_port,
        &["clone", &remote, first.to_str().unwrap()],
    );
    assert_ok(&output, "cloning an empty repository");

    // Commit something and push it back.
    fs::write(first.join("README.md"), "# Notes\n").expect("writing the file");
    assert_ok(
        &git(&first, &key, ssh_port, &["add", "README.md"]),
        "staging a file",
    );
    assert_ok(
        &git(&first, &key, ssh_port, &["commit", "-m", "Add a readme"]),
        "committing",
    );
    assert_ok(
        &git(&first, &key, ssh_port, &["push", "origin", "main"]),
        "pushing",
    );

    // Clone it again elsewhere, and find the commit there: the push has to
    // have reached the bare repository, not just the first working tree.
    let second = scratch.path("second");
    let output = git(
        &scratch.dir,
        &key,
        ssh_port,
        &["clone", &remote, second.to_str().unwrap()],
    );
    assert_ok(&output, "cloning a repository with content");
    assert_eq!(
        fs::read_to_string(second.join("README.md")).expect("the pushed file should be there"),
        "# Notes\n",
        "the pushed commit should be what a second clone sees"
    );

    Ok(())
}

#[tokio::test]
async fn a_private_repository_is_the_owners_alone_over_ssh() -> miette::Result<()> {
    skip_without_tooling!();

    let (server, port) = spawn();
    let ssh_port = server.ssh_port();
    let scratch = Scratch::new("ssh-visibility");

    let alice_key = keygen(&scratch, "alice_key");
    let bob_key = keygen(&scratch, "bob_key");

    let mut alice = Client::new(port);
    register_and_login(&mut alice, "alice", "alice@example.org");
    add_key(&mut alice, "alice", &scratch.path("alice_key.pub"));
    create_repository(&mut alice, "alice", "secret", "private");
    create_repository(&mut alice, "alice", "public", "public");

    // The owner reaches her own private repository.
    let destination = scratch.path("alice-clone");
    let output = git(
        &scratch.dir,
        &alice_key,
        ssh_port,
        &[
            "clone",
            &url(ssh_port, "alice", "secret"),
            destination.to_str().unwrap(),
        ],
    );
    assert_ok(&output, "the owner cloning a private repository");

    let mut bob = Client::new(port);
    register_and_login(&mut bob, "bob", "bob@example.org");
    add_key(&mut bob, "bob", &scratch.path("bob_key.pub"));

    // A stranger is refused the private one - the server refuses the command,
    // so this fails rather than handing back an empty clone.
    let destination = scratch.path("bob-private");
    let output = git(
        &scratch.dir,
        &bob_key,
        ssh_port,
        &[
            "clone",
            &url(ssh_port, "alice", "secret"),
            destination.to_str().unwrap(),
        ],
    );
    assert!(
        !output.status.success(),
        "a stranger should not clone a private repository\nstdout:\n{}\nstderr:\n{}",
        String::from_utf8_lossy(&output.stdout),
        String::from_utf8_lossy(&output.stderr),
    );

    // The public one, though, is his to read.
    let destination = scratch.path("bob-public");
    let output = git(
        &scratch.dir,
        &bob_key,
        ssh_port,
        &[
            "clone",
            &url(ssh_port, "alice", "public"),
            destination.to_str().unwrap(),
        ],
    );
    assert_ok(&output, "a stranger cloning a public repository");

    Ok(())
}

#[tokio::test]
async fn only_the_owner_pushes_over_ssh() -> miette::Result<()> {
    skip_without_tooling!();

    let (_server, port) = spawn();
    let ssh_port = _server.ssh_port();
    let scratch = Scratch::new("ssh-push");

    let alice_key = keygen(&scratch, "alice_key");
    let bob_key = keygen(&scratch, "bob_key");

    let mut alice = Client::new(port);
    register_and_login(&mut alice, "alice", "alice@example.org");
    add_key(&mut alice, "alice", &scratch.path("alice_key.pub"));

    let mut bob = Client::new(port);
    register_and_login(&mut bob, "bob", "bob@example.org");
    add_key(&mut bob, "bob", &scratch.path("bob_key.pub"));

    create_repository(&mut alice, "alice", "shared", "public");

    // The owner pushes, to show the refusal below is about who is pushing and
    // not about pushing being broken.
    let alice_clone = scratch.path("alice-clone");
    let output = git(
        &scratch.dir,
        &alice_key,
        ssh_port,
        &[
            "clone",
            &url(ssh_port, "alice", "shared"),
            alice_clone.to_str().unwrap(),
        ],
    );
    assert_ok(&output, "the owner cloning her repository");

    fs::write(alice_clone.join("README.md"), "# Shared\n").expect("writing the file");
    assert_ok(
        &git(&alice_clone, &alice_key, ssh_port, &["add", "README.md"]),
        "staging a file",
    );
    assert_ok(
        &git(
            &alice_clone,
            &alice_key,
            ssh_port,
            &["commit", "-m", "Start the repository"],
        ),
        "committing",
    );
    assert_ok(
        &git(
            &alice_clone,
            &alice_key,
            ssh_port,
            &["push", "origin", "main"],
        ),
        "the owner pushing",
    );

    // Bob may read the public repository...
    let bob_clone = scratch.path("bob-clone");
    let output = git(
        &scratch.dir,
        &bob_key,
        ssh_port,
        &[
            "clone",
            &url(ssh_port, "alice", "shared"),
            bob_clone.to_str().unwrap(),
        ],
    );
    assert_ok(&output, "a stranger cloning a public repository");

    fs::write(bob_clone.join("intrusion.txt"), "hello\n").expect("writing the file");
    assert_ok(
        &git(&bob_clone, &bob_key, ssh_port, &["add", "intrusion.txt"]),
        "staging a file",
    );
    assert_ok(
        &git(
            &bob_clone,
            &bob_key,
            ssh_port,
            &["commit", "-m", "Unsolicited"],
        ),
        "committing",
    );

    // ... but writing is the owner's alone, public or not.
    let output = git(&bob_clone, &bob_key, ssh_port, &["push", "origin", "main"]);
    assert!(
        !output.status.success(),
        "a stranger should not push, even to a public repository\nstdout:\n{}\nstderr:\n{}",
        String::from_utf8_lossy(&output.stdout),
        String::from_utf8_lossy(&output.stderr),
    );

    Ok(())
}

#[tokio::test]
async fn a_key_that_belongs_to_nobody_reaches_nothing() -> miette::Result<()> {
    skip_without_tooling!();

    let (_server, port) = spawn();
    let ssh_port = _server.ssh_port();
    let scratch = Scratch::new("ssh-unknown-key");

    let mut alice = Client::new(port);
    register_and_login(&mut alice, "alice", "alice@example.org");
    create_repository(&mut alice, "alice", "test-repo", "public");

    // A key nobody has registered. Nothing is anonymous here, so it is refused
    // before any repository is even looked at.
    let stranger_key = keygen(&scratch, "stranger_key");

    let destination = scratch.path("clone");
    let output = git(
        &scratch.dir,
        &stranger_key,
        ssh_port,
        &[
            "clone",
            &url(ssh_port, "alice", "test-repo"),
            destination.to_str().unwrap(),
        ],
    );

    assert!(
        !output.status.success(),
        "an unregistered key should be refused\nstdout:\n{}\nstderr:\n{}",
        String::from_utf8_lossy(&output.stdout),
        String::from_utf8_lossy(&output.stderr),
    );

    Ok(())
}