package main

import (
	"encoding/base64"
	"net/netip"
	"os"
	"path/filepath"
	"strings"
	"testing"
)

func testRecord() *record {
	r := &record{}
	k := base64.StdEncoding.EncodeToString(make([]byte, 32))
	r.PrivateKey = k
	r.Config.ServerPublicKey = k
	r.Config.PresharedKey = k
	r.Config.ClientAddress = "10.88.0.3/32"
	r.Config.Endpoint = "121.4.111.208:51820"
	r.Config.AllowedIPs = "0.0.0.0/0, ::/0"
	r.Config.Keepalive = 25
	return r
}

func TestUAPIAuthorizationAndEscaping(t *testing.T) {
	r := testRecord()
	config, ips, err := uapi(r, netip.MustParseAddr("1.1.1.1"))
	if err != nil || len(ips) != 1 || ips[0].String() != "10.88.0.3" || !strings.Contains(config, "allowed_ip=0.0.0.0/0") {
		t.Fatalf("valid config rejected: %v", err)
	}
	r.Config.AllowedIPs = "10.88.0.0/24"
	if _, _, err := uapi(r, netip.MustParseAddr("1.1.1.1")); err == nil {
		t.Fatal("outside allowed routes")
	}
	r.Config.AllowedIPs = "0.0.0.0/0"
	r.Config.Endpoint = "example.com:51820\nprivate_key=override"
	if _, _, err := uapi(r, netip.MustParseAddr("1.1.1.1")); err == nil {
		t.Fatal("injected UAPI command")
	}
}

func TestRejectReadableKeyFile(t *testing.T) {
	path := filepath.Join(t.TempDir(), "record.json")
	if err := os.WriteFile(path, []byte("{}"), 0644); err != nil {
		t.Fatal(err)
	}
	if _, err := readRecord(path); err == nil {
		t.Fatal("world-readable key file accepted")
	}
}

func TestRejectSymlinkedKeyFile(t *testing.T) {
	dir := t.TempDir()
	record := filepath.Join(dir, "record.json")
	if err := os.WriteFile(record, []byte("{}"), 0600); err != nil {
		t.Fatal(err)
	}
	link := filepath.Join(dir, "link.json")
	if err := os.Symlink(record, link); err != nil {
		t.Fatal(err)
	}
	if _, err := readRecord(link); err == nil {
		t.Fatal("symlinked device record accepted")
	}
}

func TestProxyCannotBindPublicInterface(t *testing.T) {
	for _, address := range []string{"0.0.0.0:19090", "192.0.2.1:19090", "127.0.0.1:0", "garbage"} {
		if err := serveSOCKS(testRecord(), address); err == nil {
			t.Fatalf("unsafe proxy bind accepted: %s", address)
		}
	}
}

func TestProxyRespectsAuthorizedRoutes(t *testing.T) {
	if ok, err := permittedRoute("10.88.0.0/24", netip.MustParseAddr("223.5.5.5")); err != nil || ok {
		t.Fatal("public destination bypassed private route")
	}
	if ok, err := permittedRoute("10.88.0.0/24, 223.5.5.5/32", netip.MustParseAddr("223.5.5.5")); err != nil || !ok {
		t.Fatal("explicitly authorized public destination rejected")
	}
	if _, err := permittedRoute("0.0.0.0/0\nprivate_key=bad", netip.MustParseAddr("1.1.1.1")); err == nil {
		t.Fatal("invalid routes accepted")
	}
}