/* Copyright (C) CJ Affiliate
  *
  * You may use, distribute and modify this code under  the
  * terms of the  GNU General Public License  version 2  or
  * later.
  *
  * You should have received a copy of the license with this
  * file. If not, you will find a copy in the "LICENSE" file
  * at https://github.com/cjdev/dual-control.
  */
 

 #include <string>
 #include <vector>
 

 #include "validator.h"

 #include "user.h"

 #include "test_util.h"

 #include "token.h"

 #include "sys_unistd.h"
 
 template<class T>
 std::shared_ptr<T> share (T *t)
 {
     return std::shared_ptr<T> (t);
 }
 
 class mock_unistd : public unistd_ifc
 {
 private:
     uid_t expected_euid_;
 public:
     mutable std::vector<uid_t> actual_uids;
     mock_unistd (uid_t expected_euid)
         : expected_euid_ (expected_euid)
     {}
 
     int seteuid (uid_t euid) const override
     {

         actual_uids.push_back (euid);

         return (euid == expected_euid_ || euid == 0) ? 0 : -1;
     }
 };
 
 class fake_user : public user_ifc
 {
 private:
     uid_t uid_;
 public:
     fake_user (uid_t uid) : uid_ (uid)
     {}
     uid_t uid() const override
     {
         return uid_;
     }
 };

 class fake_directory : public directory_ifc

 {
 private:
     std::string user_name_;

     uid_t uid_;

 public:

     fake_directory (const std::string &user_name,
                     const uid_t uid = -1) : user_name_ (user_name), uid_ (uid)

     {
     }

     fake_directory() : user_name_ ("_NOT_A_USER") {}

     std::vector<user> find_user (const std::string &user_name) const override

     {

         std::vector<user> result;

         if (user_name == user_name_) {

             result.push_back (user (share (new fake_user (uid_))));

         }

         return result;
     }

 };
 

 class fake_tokens : public tokens_ifc

 {
 private:
     std::string token_;
 public:

     fake_tokens (const std::string &token) : token_ (token) {}
     fake_tokens() : token_ ("_NOT_A_TOKEN") {}

     std::string token (const user &user) const override

     {
         return token_;
     }

 };
 

 bool validator_validates()
 {

     // given
     std::string token = "token";

     tokens tokens (share (new

                           fake_tokens (token)));

     std::string user_name = "msmith";

 
     uid_t expected_uid = 1000;
     directory directory (share (new fake_directory (user_name, expected_uid)));

     std::shared_ptr<mock_unistd> mock_unistd = share (new class mock_unistd (
                 expected_uid));

     class unistd unistd (mock_unistd);
     validator validator = validator::create (directory, tokens, unistd);
     std::vector<uid_t> expected_uids {expected_uid, 0};

     // when

     bool actual = validator.validate ("requester", user_name, token, "reason");

     // then

     check (actual, "should be valid");

     check (mock_unistd->actual_uids == expected_uids,
            "should drop permissions");

     succeed();

 }
 

 bool validator_fails_unknown_user()
 {

     // given
     std::string token = "token";

     tokens tokens (share (new

                           fake_tokens));

     directory directory (share (new fake_directory));

     class unistd unistd (share (new unistd_ifc()));
     validator validator = validator::create (directory, tokens, unistd);

     // when

     bool actual = validator.validate ("requester", "notuser", token, "reason");

     // then

     check (!actual, "should not be valid");

     succeed();

 }
 

 bool validator_fails_incorrect_token()
 {

     // given

     tokens tokens (share (new

                           fake_tokens));

     std::string user_name = "msmith";

     directory directory (share (new fake_directory (user_name)));

     class unistd unistd (share (new unistd_ifc()));
     validator validator = validator::create (directory, tokens, unistd);

     // when

     bool actual = validator.validate ("requester", user_name, "token",
                                       "reason");

     // then

     check (!actual, "should not be valid");

     succeed();

 }
 

 bool validator_fails_with_own_token()
 {

     // given

     std::string requester_user_name ("requester");
     std::string authorizer_user_name (requester_user_name);
     std::string authorizer_token ("token");

     directory directory (share (new fake_directory (authorizer_user_name)));

     tokens tokens (share (new

                           fake_tokens (authorizer_token)));

     class unistd unistd (share (new unistd_ifc()));
     validator validator = validator::create (directory, tokens, unistd);

 
     // when

     bool actual = validator.validate (requester_user_name, authorizer_user_name,

                                       authorizer_token, "reason");

 
     // then

     check (!actual, "should not be valid");

     succeed();
 
 }
 

 bool validator_fails_with_unknown_requester()
 {

     // given

     std::string requester_user_name ("");
     std::string authorizer_user_name ("authorizer");
     std::string authorizer_token ("token");

     directory directory (share (new fake_directory (authorizer_user_name)));

     tokens tokens (share (new

                           fake_tokens (authorizer_token)));

     class unistd unistd (share (new unistd_ifc()));
     validator validator = validator::create (directory, tokens, unistd);

 
     // when

     bool actual = validator.validate (requester_user_name, authorizer_user_name,

                                       authorizer_token, "reason");

 
     // then

     check (!actual, "should not be valid");

     succeed();

 }
 

 bool validator_fails_on_empty_reason()
 {

     //given
     std::string requester_user_name ("");
     std::string authorizer_user_name ("authorizer");
     std::string authorizer_token ("token");
     std::string reason;
     directory directory (share (new fake_directory (authorizer_user_name)));
     tokens tokens (share (new
                           fake_tokens (authorizer_token)));

     class unistd unistd (share (new unistd_ifc()));
     validator validator = validator::create (directory, tokens, unistd);

     //when
     bool actual = validator.validate (requester_user_name, authorizer_user_name,
                                       authorizer_token, reason);
 
     //then

     check (!actual, "should not be valid");

     succeed();

 }
 

 bool run_tests()
 {

     test (validator_validates);
     test (validator_fails_unknown_user);
     test (validator_fails_incorrect_token);

     test (validator_fails_with_own_token);

     test (validator_fails_with_unknown_requester);

     test (validator_fails_on_empty_reason);

     succeed();
 }
 

 int main (int argc, char *argv[])

 {

     return !run_tests();
 }