package main

import (
	"net"
	"net/http/httptest"
	"strings"
	"testing"
)

func TestValidBranch(t *testing.T) {
	for _, ok := range []string{"main", "feature/x", "v1.2", "a_b-c"} {
		if !validBranch(ok) {
			t.Errorf("%q rejected", ok)
		}
	}
	for _, bad := range []string{"", "-x", "a..b", "a b", "a:b", "a~1", "a^", "x.lock", "a//b", "/a", "a/", ".a", "a/.b", "a@{1}", "@", "a\nb", "a\x00b", "a*", "a?", "a[", "a\\b"} {
		if validBranch(bad) {
			t.Errorf("%q accepted", bad)
		}
	}
}

func TestCleanPath(t *testing.T) {
	cases := map[string]bool{"a/b.txt": true, "": true, "../x": false, "a/../b": false, "-rf": false, "a\nb": false, "a\x00": false, "a\tb": false, "a//b": false}
	for in, want := range cases {
		if _, got := cleanPath(in); got != want {
			t.Errorf("cleanPath(%q) = %v", in, got)
		}
	}
}

func TestClientIP(t *testing.T) {
	r := httptest.NewRequest("GET", "/", nil)
	r.RemoteAddr = "203.0.113.9:4000"
	r.Header.Set("X-Forwarded-For", "1.1.1.1")
	if got := clientIP(r); got != "203.0.113.9" {
		t.Errorf("direct client spoofed its address as %s", got)
	}
	r.RemoteAddr = "127.0.0.1:4000"
	r.Header.Set("X-Forwarded-For", "6.6.6.6, 198.51.100.7")
	if got := clientIP(r); got != "198.51.100.7" {
		t.Errorf("proxied address %s, want the last hop", got)
	}
}

func TestParseQuery(t *testing.T) {
	text, quals := parseQuery(`kernel language:"Standard ML" user:~james tag:sel4`)
	if text != "kernel" || quals["language"] != "Standard ML" || quals["user"] != "james" || quals["tag"] != "sel4" {
		t.Errorf("got %q %v", text, quals)
	}
	if got := stripLanguage(`x lang:go tag:"a b"`); got != `x tag:"a b"` {
		t.Errorf("stripLanguage = %q", got)
	}
}

func TestBuckets(t *testing.T) {
	b := newBuckets(0.001, 3)
	for i := 0; i < 3; i++ {
		if !b.allow("k") {
			t.Fatal("burst refused early")
		}
	}
	if b.allow("k") {
		t.Error("bucket did not run dry")
	}
	if !b.allow("other") {
		t.Error("keys are not independent")
	}
}

func TestCappedBuffer(t *testing.T) {
	var b cappedBuffer
	if _, err := b.Write(make([]byte, maxOutput)); err != nil {
		t.Fatal(err)
	}
	if _, err := b.Write([]byte{1}); err == nil || !b.over {
		t.Error("cap not enforced")
	}
}

func TestMarkdownSanitised(t *testing.T) {
	s, _ := testServer(t)
	for _, in := range []string{
		`<script>alert(1)</script>`,
		`<img src=x onerror=alert(1)>`,
		`[x](javascript:alert(1))`,
		`<a href="javascript:alert(1)">x</a>`,
		`<video src="javascript:alert(1)"></video>`,
		`<iframe src="https://evil.example"></iframe>`,
		`<svg onload=alert(1)>`,
		`<div style="background:url(javascript:alert(1))">x</div>`,
	} {
		out := strings.ToLower(string(s.renderMarkdownAt([]byte(in), "/raw/", "/tree/")))
		for _, bad := range []string{"<script", "onerror", "javascript:", "<iframe", "onload", "style="} {
			if strings.Contains(out, bad) {
				t.Errorf("%q rendered %q", in, out)
			}
		}
	}
}

func TestSizes(t *testing.T) {
	for in, want := range map[string]int64{"2G": 2 << 30, "500M": 500 << 20, "2048 MiB": 2 << 30, "10KB": 10 << 10, "0": 0} {
		if got, err := parseSize(in); err != nil || got != want {
			t.Errorf("parseSize(%q) = %d %v", in, got, err)
		}
	}
	if got := compactSize(2 << 30); got != "2G" {
		t.Errorf("compactSize = %s", got)
	}
}

func TestHeaderInjection(t *testing.T) {
	if got := headerText("hi\r\nBcc: x@evil.example"); strings.ContainsAny(got, "\r\n") {
		t.Errorf("header kept a line break: %q", got)
	}
	for _, bad := range []string{"a@b.c\r\nBcc: x@y.z", "a@b.c, x@y.z", "<a@b.c>", "nope", "a b@c.d"} {
		if validEmail(bad) {
			t.Errorf("accepted %q", bad)
		}
	}
	if !validEmail("someone@example.org") {
		t.Error("rejected a plain address")
	}
}

func TestRelativeLinkBaseEscaped(t *testing.T) {
	s, _ := testServer(t)
	out := string(s.renderMarkdownAt([]byte("![x](pic.png) [y](doc.md)"), `/~a/r/raw/x"onmouseover="alert(1)/`, `/~a/r/tree/x"><script>/`))
	if strings.Contains(out, `"onmouseover`) || strings.Contains(out, "<script") {
		t.Errorf("base broke out of the attribute: %s", out)
	}
}

func TestTrustedProxy(t *testing.T) {
	_, n, _ := net.ParseCIDR("172.31.255.0/28")
	trustedProxies = []*net.IPNet{n}
	defer func() { trustedProxies = nil }()
	r := httptest.NewRequest("GET", "/", nil)
	r.Header.Set("X-Forwarded-For", "203.0.113.9, 198.51.100.7")
	r.RemoteAddr = "172.31.255.1:5000"
	if got := clientIP(r); got != "198.51.100.7" {
		t.Errorf("trusted proxy hop ignored: %s", got)
	}
	r.RemoteAddr = "192.0.2.4:5000"
	if got := clientIP(r); got != "192.0.2.4" {
		t.Errorf("untrusted peer could choose its address: %s", got)
	}
}