//! E2E enforcement tests for kernel-enforced profile `deny` paths.
//!
//! Drives the GENERIC path-deny primitive via a custom sandbox profile whose
//! `deny` list names concrete files. `SandboxManager::apply` is process-wide and
//! irreversible, so kernel enforcement is verified in an isolated subprocess.
//!
//! On Linux, read-deny requires bwrap bind-over; the subprocess re-execs inside
//! bwrap when `bwrap` is available. macOS uses Seatbelt platform rules directly
//! via `SandboxManager::apply`.

#![cfg(all(unix, feature = "enforce"))]

use std::fs;
use std::path::Path;
use std::process::Command;

const SCENARIO_ENV: &str = "SANDBOX_E2E_SCENARIO";
const WORKSPACE_ENV: &str = "SANDBOX_E2E_WORKSPACE";
/// Custom profile name, comma-joined deny targets, and comma-joined control
/// files, passed to the subprocess so one entry point drives every deny case
/// (exact paths and globs alike).
const PROFILE_ENV: &str = "SANDBOX_E2E_PROFILE";
const TARGETS_ENV: &str = "SANDBOX_E2E_TARGETS";
const CONTROLS_ENV: &str = "SANDBOX_E2E_CONTROLS";
/// Paths NOT present at apply time that match a deny glob; the macOS runtime
/// regex must deny creating them post-launch (the differentiator vs exact paths).
const POSTLAUNCH_ENV: &str = "SANDBOX_E2E_POSTLAUNCH";
const MARKER: &str = "deny-paths-e2e-marker-9f3c1a";

/// Re-invoke this test binary as a subprocess driving `profile` over `targets`
/// (denied) and `controls` (must stay readable). `postlaunch` paths are created
/// AFTER apply to exercise the macOS runtime-regex (post-launch) coverage.
fn run_scenario(
    workspace: &Path,
    profile: &str,
    targets: &[&str],
    controls: &[&str],
    postlaunch: &[&str],
) -> (std::process::ExitStatus, String) {
    let exe = std::env::current_exe().expect("current_exe");
    let output = Command::new(exe)
        .env(SCENARIO_ENV, "block_deny")
        .env(WORKSPACE_ENV, workspace.as_os_str())
        .env(PROFILE_ENV, profile)
        .env(TARGETS_ENV, targets.join(","))
        .env(CONTROLS_ENV, controls.join(","))
        .env(POSTLAUNCH_ENV, postlaunch.join(","))
        .arg("--ignored")
        .arg("--exact")
        .arg("--nocapture")
        .arg("subprocess_entry")
        .output()
        .expect("failed to spawn subprocess");
    // All assertions read stderr; the subprocess prints only diagnostics there.
    (
        output.status,
        String::from_utf8_lossy(&output.stderr).into_owned(),
    )
}

/// Decode a comma-joined env list (empty/missing -> empty vec).
fn list_from_env(key: &str) -> Vec<String> {
    std::env::var(key)
        .ok()
        .map(|v| {
            v.split(',')
                .filter(|s| !s.is_empty())
                .map(String::from)
                .collect()
        })
        .unwrap_or_default()
}

// EROFS too: a root writer on Linux bypasses the mode-000 DAC check via
// CAP_DAC_OVERRIDE and hits the read-only bind-mount instead — still a denial.
fn is_permission_denied(e: &std::io::Error) -> bool {
    matches!(
        e.raw_os_error(),
        Some(libc::EACCES) | Some(libc::EPERM) | Some(libc::EROFS)
    )
}

/// Spawn a child command and `exit(1)` if its stdout exposes the secret MARKER.
/// Asserts marker-absence rather than a non-zero exit: a root reader of the
/// mode-000 placeholder gets empty output, which still means the path is shadowed.
fn assert_child_cannot_read(label: &str, program: &str, args: &[&str]) {
    let out = Command::new(program)
        .args(args)
        .output()
        .unwrap_or_else(|e| panic!("failed to spawn {program}: {e}"));
    if String::from_utf8_lossy(&out.stdout).contains(MARKER) {
        eprintln!("FAIL: {label} exposed MARKER");
        std::process::exit(1);
    }
}

/// Assert a denied file's bytes are unreadable via an in-process read, a `cat`
/// child (the `bash`/`grep` tools), and a nested `sh -c "cat"` child (the shell a
/// subagent shells out through). The property is MARKER-absence (EACCES/EPERM, or
/// empty output under root, all satisfy it).
fn assert_read_blocked(label: &str, path: &Path) {
    if let Ok(content) = fs::read_to_string(path)
        && content.contains(MARKER)
    {
        eprintln!("FAIL: {label} in-process read exposed MARKER");
        std::process::exit(1);
    }
    let s = path.display().to_string();
    assert_child_cannot_read(label, "cat", &[s.as_str()]);
    let sh_cmd = format!("cat '{s}'");
    assert_child_cannot_read(label, "sh", &["-c", sh_cmd.as_str()]);
    eprintln!("OK: {label} read blocked");
}

/// Assert a denied file cannot be overwritten (write must EACCES/EPERM, not
/// succeed — a permitted write would enable the relocation bypass below).
fn assert_write_denied(label: &str, path: &Path) {
    match fs::write(path, "overwrite-attempt") {
        Err(e) if is_permission_denied(&e) => eprintln!("OK: {label} write denied"),
        Err(e) => {
            eprintln!("FAIL: unexpected {label} write error: {e}");
            std::process::exit(1);
        }
        Ok(()) => {
            eprintln!("FAIL: {label} write was permitted (relocation bypass possible)");
            std::process::exit(1);
        }
    }
}

/// Assert the `mv x y && cat y` relocation bypass does not expose the bytes:
/// the rename must fail (unlink of the source is denied) so the moved copy never
/// materializes with the secret.
fn assert_rename_bypass_blocked(label: &str, path: &Path, workspace: &Path) {
    let name = path.file_name().unwrap().to_string_lossy();
    let moved = workspace.join(format!("exfil-{name}"));
    let _ = fs::rename(path, &moved); // expected to fail; bytes must not leak
    match fs::read_to_string(&moved) {
        Ok(c) if c.contains(MARKER) => {
            eprintln!("FAIL: {label} rename bypass exposed MARKER");
            std::process::exit(1);
        }
        _ => eprintln!("OK: {label} rename bypass blocked"),
    }
}

#[cfg(target_os = "linux")]
fn bwrap_available() -> bool {
    // `--version` only checks the binary exists; remote CI may have bwrap but
    // deny user namespace creation ("Creating new namespace failed: Operation not permitted").
    Command::new("bwrap")
        .args(["--bind", "/", "/", "--", "true"])
        .output()
        .map(|o| o.status.success())
        .unwrap_or(false)
}

/// The custom profile under test, read from the env the parent set.
fn profile_from_env() -> xai_grok_sandbox::ProfileName {
    xai_grok_sandbox::ProfileName::Custom(std::env::var(PROFILE_ENV).expect(PROFILE_ENV))
}

// ── Subprocess entry point ──────────────────────────────────────────────

/// `#[ignore]`d — only runs when invoked by the parent test via `run_scenario`.
#[test]
#[ignore]
fn subprocess_entry() {
    let scenario = match std::env::var(SCENARIO_ENV) {
        Ok(s) => s,
        Err(_) => return,
    };
    let workspace = std::env::var(WORKSPACE_ENV).expect(WORKSPACE_ENV);
    let workspace = dunce::canonicalize(&workspace).expect("canonicalize workspace");
    let workspace = workspace.as_path();
    let targets = list_from_env(TARGETS_ENV);
    let controls = list_from_env(CONTROLS_ENV);

    #[cfg(target_os = "linux")]
    {
        if !xai_grok_sandbox::is_inside_bwrap() {
            // Drive the REAL routing the shell uses at startup — computing the
            // custom profile's deny set (exact paths AND launch-time glob
            // expansion), building placeholders, and failing closed on a partial
            // bind — rather than hand-rolling a single-path `bwrap_reexec_command`.
            match xai_grok_sandbox::bwrap_reexec_for_profile(&profile_from_env(), workspace) {
                Some(mut cmd) => {
                    use std::os::unix::process::CommandExt;
                    let err = cmd.exec(); // returns only if exec failed
                    eprintln!("bwrap re-exec failed: {err}");
                    std::process::exit(2);
                }
                // Outside bwrap with no command means the read-deny set could not
                // be secured. The shell fails closed here; mirror that.
                None => {
                    eprintln!("FAIL: bwrap_reexec_for_profile returned None outside bwrap");
                    std::process::exit(2);
                }
            }
        }
    }

    match scenario.as_str() {
        "block_deny" => {
            let mut sandbox = xai_grok_sandbox::SandboxManager::new(profile_from_env(), workspace);
            if let Err(e) = sandbox.apply(workspace) {
                eprintln!("sandbox apply failed: {e}");
                std::process::exit(3);
            }
            if !sandbox.is_applied() {
                eprintln!("sandbox was not applied (unsupported platform?)");
                std::process::exit(4);
            }

            // Each denied target must be read-, write-, and rename-denied — via the
            // read_file tool (in-process), `bash`/`grep` (cat child), and the shell
            // a subagent uses (sh -c child). Targets exercise nested glob matches
            // (`sub/dir/key.pem`) and the denied-directory (subpath) path alike.
            for rel in &targets {
                let path = workspace.join(rel);
                assert_read_blocked(rel, &path);
                assert_write_denied(rel, &path);
                assert_rename_bypass_blocked(rel, &path, workspace);
            }

            // Non-denied control files (incl. a sibling of a glob match) stay readable.
            for rel in &controls {
                match fs::read_to_string(workspace.join(rel)) {
                    Ok(c) if c.contains("hello") => eprintln!("OK: {rel} control readable"),
                    Ok(_) => {
                        eprintln!("FAIL: control {rel} readable but missing marker");
                        std::process::exit(1);
                    }
                    Err(e) => {
                        eprintln!("FAIL: control {rel} should stay readable: {e}");
                        std::process::exit(1);
                    }
                }
            }

            // macOS-only: the runtime regex denies paths that match a glob even
            // when created AFTER apply — the differentiator vs the exact-path flow
            // (and the macOS-airtight half of the documented asymmetry). On Linux
            // post-launch matches are best-effort and NOT covered, so skip there.
            #[cfg(target_os = "macos")]
            for rel in list_from_env(POSTLAUNCH_ENV) {
                match fs::write(workspace.join(&rel), MARKER) {
                    Err(e) if is_permission_denied(&e) => {
                        eprintln!("OK: {rel} post-launch write denied")
                    }
                    Err(e) => {
                        eprintln!("FAIL: unexpected {rel} post-launch write error: {e}");
                        std::process::exit(1);
                    }
                    Ok(()) => {
                        eprintln!("FAIL: {rel} post-launch matching path was writable");
                        std::process::exit(1);
                    }
                }
            }
            // A NON-matching post-launch path must still be writable — proves the
            // denial above is the glob, not a blanket workspace write-deny.
            #[cfg(target_os = "macos")]
            if !list_from_env(POSTLAUNCH_ENV).is_empty() {
                match fs::write(workspace.join("late-control.txt"), "hello") {
                    Ok(()) => eprintln!("OK: post-launch control writable"),
                    Err(e) => {
                        eprintln!("FAIL: non-matching post-launch path should be writable: {e}");
                        std::process::exit(1);
                    }
                }
            }

            std::process::exit(0);
        }
        other => {
            eprintln!("unknown scenario: {other}");
            std::process::exit(99);
        }
    }
}

// ── Parent test cases ───────────────────────────────────────────────────

/// Drive one deny case end-to-end: define a custom profile whose `deny` list is
/// `deny_entries` (exact paths and/or globs), create each `target` (with the
/// MARKER) and each `control` (readable), then assert in an isolated subprocess
/// that every target is read/write/rename-denied and every control stays
/// readable. Shared by the exact-path and glob cases.
fn run_deny_case(
    tag: &str,
    profile: &str,
    deny_entries: &[&str],
    targets: &[&str],
    controls: &[&str],
    postlaunch: &[&str],
) {
    // When set, missing prerequisites must FAIL loudly instead of skipping, so a
    // CI lane can guarantee the deny enforcement is actually exercised.
    let require = std::env::var("SANDBOX_E2E_REQUIRE_ENFORCEMENT").is_ok();

    let support = xai_grok_sandbox::SandboxManager::support_info();
    if !support.is_supported {
        if require {
            panic!(
                "SANDBOX_E2E_REQUIRE_ENFORCEMENT set but sandbox unsupported: {}",
                support.details
            );
        }
        eprintln!("skipping: sandbox not supported ({})", support.details);
        return;
    }

    #[cfg(target_os = "linux")]
    if !bwrap_available() {
        if require {
            panic!(
                "SANDBOX_E2E_REQUIRE_ENFORCEMENT set but bwrap unavailable (required for Linux read-deny)"
            );
        }
        eprintln!("skipping: bwrap not installed (required for Linux read-deny)");
        return;
    }

    let tmp = std::env::temp_dir().join(format!(
        "grok-sandbox-e2e-{tag}-{}-{}",
        std::process::id(),
        std::time::SystemTime::now()
            .duration_since(std::time::UNIX_EPOCH)
            .unwrap()
            .as_nanos()
    ));
    fs::create_dir_all(&tmp).expect("create temp workspace");
    let tmp = dunce::canonicalize(&tmp).expect("canonicalize temp workspace");
    let _cleanup = TempDirGuard(tmp.clone());

    // Define the custom profile whose `deny` list holds the entries under test.
    let deny_list = deny_entries
        .iter()
        .map(|p| format!("\"{p}\""))
        .collect::<Vec<_>>()
        .join(", ");
    fs::create_dir_all(tmp.join(".grok")).expect("mkdir .grok");
    fs::write(
        tmp.join(".grok").join("sandbox.toml"),
        format!("[profiles.{profile}]\nextends = \"workspace\"\ndeny = [{deny_list}]\n"),
    )
    .expect("write sandbox.toml");

    // Create each denied target with the MARKER (parents created as needed, e.g.
    // `sub/dir/` for a nested glob match, `secretdir/` for a denied directory)
    // plus each readable control.
    for rel in targets {
        let path = tmp.join(rel);
        if let Some(parent) = path.parent() {
            fs::create_dir_all(parent).expect("mkdir denied parent");
        }
        fs::write(&path, format!("SECRET={MARKER}")).expect("write denied file");
    }
    for rel in controls {
        let path = tmp.join(rel);
        if let Some(parent) = path.parent() {
            fs::create_dir_all(parent).expect("mkdir control parent");
        }
        fs::write(&path, "hello workspace").expect("write control");
    }

    let (status, stderr) = run_scenario(&tmp, profile, targets, controls, postlaunch);
    assert!(
        status.success(),
        "[{tag}] custom-profile deny should block read/write/rename\nstderr: {stderr}"
    );
    for rel in targets {
        assert!(
            stderr.contains(&format!("OK: {rel} read blocked")),
            "[{tag}] expected '{rel}' read block confirmation\nstderr: {stderr}"
        );
        assert!(
            stderr.contains(&format!("OK: {rel} write denied")),
            "[{tag}] expected '{rel}' write to be denied\nstderr: {stderr}"
        );
        assert!(
            stderr.contains(&format!("OK: {rel} rename bypass blocked")),
            "[{tag}] expected '{rel}' rename bypass to be blocked\nstderr: {stderr}"
        );
    }
    for rel in controls {
        assert!(
            stderr.contains(&format!("OK: {rel} control readable")),
            "[{tag}] expected non-denied control '{rel}' to stay readable\nstderr: {stderr}"
        );
    }
    // The post-launch (runtime-regex) coverage is macOS-only; Linux best-effort
    // expansion does not cover files created after launch.
    #[cfg(target_os = "macos")]
    for rel in postlaunch {
        assert!(
            stderr.contains(&format!("OK: {rel} post-launch write denied")),
            "[{tag}] expected post-launch matching '{rel}' to be write-denied\nstderr: {stderr}"
        );
    }
    #[cfg(target_os = "macos")]
    if !postlaunch.is_empty() {
        assert!(
            stderr.contains("OK: post-launch control writable"),
            "[{tag}] expected non-matching post-launch path to stay writable\nstderr: {stderr}"
        );
    }
}

#[test]
fn deny_exact_paths_block_read_write_rename() {
    // Exact-path entries: two files plus a directory (exercised via a file inside
    // it), covering the literal-file and the subpath / Linux dir-placeholder paths.
    run_deny_case(
        "exact",
        "denytest",
        &[".env", "src/server.pem", "secretdir"],
        &[".env", "src/server.pem", "secretdir/inner.pem"],
        &["readable.txt"],
        &[], // exact paths have no runtime/post-launch coverage to assert
    );
}

#[test]
fn deny_globs_block_read_write_rename() {
    // Glob entries exercising: nested `*.pem`, a `.env` at root AND nested, and a
    // trailing-`**` prefix dir. The control inside a matched directory
    // (`sub/dir/keep.txt`) proves the glob denies only matches, not the whole tree.
    // `postlaunch` (`late.pem`) pins the macOS runtime-regex post-launch coverage.
    run_deny_case(
        "glob",
        "denyglob",
        &["**/*.pem", "**/.env", "secrets/**"],
        &["sub/dir/key.pem", ".env", "sub/.env", "secrets/inner.key"],
        &["readable.txt", "sub/dir/keep.txt"],
        &["late.pem"],
    );
}

struct TempDirGuard(std::path::PathBuf);

impl Drop for TempDirGuard {
    fn drop(&mut self) {
        let _ = fs::remove_dir_all(&self.0);
    }
}