ThothII/tools/tht/internal/safeio/files_test.go

package safeio

import (
	"errors"
	"fmt"
	"io"
	"os"
	"path/filepath"
	"strings"
	"testing"
	"time"

	"github.com/aritmolab/thothii/tools/tht/internal/testsupport"
)

func TestReadCanonicalRegularRejectsFinalAndParentSymlinks(t *testing.T) {
	temporaryRoot, err := filepath.EvalSymlinks(os.TempDir())
	if err != nil {
		t.Fatal(err)
	}
	root, err := os.MkdirTemp(temporaryRoot, "tht-safeio-")
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { _ = os.RemoveAll(root) })

	realDirectory := filepath.Join(root, "real")
	if err := os.Mkdir(realDirectory, 0o700); err != nil {
		t.Fatal(err)
	}
	realFile := filepath.Join(realDirectory, "secret")
	if err := os.WriteFile(realFile, []byte("secret"), 0o600); err != nil {
		t.Fatal(err)
	}

	parentLink := filepath.Join(root, "parent-link")
	testsupport.SymlinkOrSkip(t, realDirectory, parentLink)
	if _, err := ReadCanonicalRegular(filepath.Join(parentLink, "secret"), 1024); !errors.Is(err, ErrUnsafeFile) {
		t.Fatalf("parent symlink error = %v, want ErrUnsafeFile", err)
	}

	finalLink := filepath.Join(root, "final-link")
	testsupport.SymlinkOrSkip(t, realFile, finalLink)
	if _, err := ReadCanonicalRegular(finalLink, 1024); !errors.Is(err, ErrUnsafeFile) {
		t.Fatalf("final symlink error = %v, want ErrUnsafeFile", err)
	}
}

func TestReadCanonicalUTF8RejectsNonUTF8AndHardlinks(t *testing.T) {
	temporaryRoot, err := filepath.EvalSymlinks(os.TempDir())
	if err != nil {
		t.Fatal(err)
	}
	root, err := os.MkdirTemp(temporaryRoot, "tht-safeio-")
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { _ = os.RemoveAll(root) })

	nonUTF8 := filepath.Join(root, "annotations.yaml")
	if err := os.WriteFile(nonUTF8, []byte{0xff, 0xfe, 0xfd}, 0o600); err != nil {
		t.Fatal(err)
	}
	if _, err := ReadCanonicalUTF8(nonUTF8, 1024); !errors.Is(err, ErrUnsafeFile) {
		t.Fatalf("ReadCanonicalUTF8(nonUTF8) error = %v, want ErrUnsafeFile", err)
	}

	target := filepath.Join(root, "regular.txt")
	if err := os.WriteFile(target, []byte("linked"), 0o600); err != nil {
		t.Fatal(err)
	}
	link := filepath.Join(root, "hardlink.txt")
	if err := os.Link(target, link); err != nil {
		t.Fatal(err)
	}
	if _, err := ReadCanonicalUTF8(link, 1024); !errors.Is(err, ErrUnsafeFile) {
		t.Fatalf("ReadCanonicalUTF8(hardlink) error = %v, want ErrUnsafeFile", err)
	}
}

func TestWriteCanonicalNewFileRejectsExistingTargets(t *testing.T) {
	temporaryRoot, err := filepath.EvalSymlinks(os.TempDir())
	if err != nil {
		t.Fatal(err)
	}
	root, err := os.MkdirTemp(temporaryRoot, "tht-safeio-")
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { _ = os.RemoveAll(root) })

	path := filepath.Join(root, "artifact.yaml")
	if err := os.WriteFile(path, []byte("existing"), 0o600); err != nil {
		t.Fatal(err)
	}
	if err := WriteCanonicalNewFile(path, []byte("new"), 0o600); !errors.Is(err, ErrUnsafeFile) {
		t.Fatalf("WriteCanonicalNewFile(existing) error = %v, want ErrUnsafeFile", err)
	}
}

func TestCreateCanonicalNewPrivateFileProvidesPrivateStreamingWriter(t *testing.T) {
	temporaryRoot, err := filepath.EvalSymlinks(os.TempDir())
	if err != nil {
		t.Fatal(err)
	}
	root, err := os.MkdirTemp(temporaryRoot, "tht-safeio-private-stream-")
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { _ = os.RemoveAll(root) })
	directory := filepath.Join(root, "private")
	if err := EnsurePrivateDirectory(directory); err != nil {
		t.Fatal(err)
	}

	path := filepath.Join(directory, "archive.zip")
	file, err := CreateCanonicalNewPrivateFile(path)
	if err != nil {
		t.Fatal(err)
	}
	if _, err := file.Write([]byte("streamed archive")); err != nil {
		_ = file.Close()
		t.Fatal(err)
	}
	if _, err := file.Seek(0, io.SeekStart); err != nil {
		_ = file.Close()
		t.Fatal(err)
	}
	streamed := make([]byte, len("streamed archive"))
	if _, err := io.ReadFull(file, streamed); err != nil {
		_ = file.Close()
		t.Fatal(err)
	}
	if string(streamed) != "streamed archive" {
		_ = file.Close()
		t.Fatalf("streamed contents through open file = %q, want %q", streamed, "streamed archive")
	}
	if err := file.Close(); err != nil {
		t.Fatal(err)
	}
	if err := ValidatePrivateRegular(path); err != nil {
		t.Fatalf("ValidatePrivateRegular() = %v, want owner-private streamed file", err)
	}
	contents, err := os.ReadFile(path)
	if err != nil {
		t.Fatal(err)
	}
	if string(contents) != "streamed archive" {
		t.Fatalf("streamed contents = %q, want %q", contents, "streamed archive")
	}
}

func TestPrivateDirectoryCreatesAndRemovesStreamingRegularFile(t *testing.T) {
	temporaryRoot, err := filepath.EvalSymlinks(os.TempDir())
	if err != nil {
		t.Fatal(err)
	}
	root, err := os.MkdirTemp(temporaryRoot, "tht-safeio-stream-")
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { _ = os.RemoveAll(root) })
	if err := ProtectPrivateDirectory(root); err != nil {
		t.Fatal(err)
	}
	directory, found, err := OpenPrivateDirectory(root, true)
	if err != nil || !found {
		t.Fatalf("OpenPrivateDirectory() = found %v, err %v", found, err)
	}
	defer directory.Close()

	file, created, err := directory.CreateRegularFile("archive-stream.zip")
	if err != nil || !created || file == nil {
		t.Fatalf("CreateRegularFile() = file %v, created %v, err %v", file, created, err)
	}
	if _, err := file.Write([]byte("private archive")); err != nil {
		t.Fatal(err)
	}
	if err := file.Sync(); err != nil {
		t.Fatal(err)
	}
	if _, err := file.Seek(0, io.SeekStart); err != nil {
		t.Fatal(err)
	}
	streamed := make([]byte, len("private archive"))
	if _, err := io.ReadFull(file, streamed); err != nil {
		t.Fatal(err)
	}
	if string(streamed) != "private archive" {
		t.Fatalf("streamed contents = %q, want %q", streamed, "private archive")
	}
	if err := file.Close(); err != nil {
		t.Fatal(err)
	}
	removed, err := directory.RemoveRegular("archive-stream.zip")
	if err != nil || !removed {
		t.Fatalf("RemoveRegular() = removed %v, err %v", removed, err)
	}

	if created, err := directory.CreateRegular("existing.zip", []byte("existing")); err != nil || !created {
		t.Fatalf("CreateRegular(existing.zip) = created %v, err %v", created, err)
	}
	if file, created, err := directory.CreateRegularFile("existing.zip"); err != nil || created || file != nil {
		t.Fatalf("CreateRegularFile(existing.zip) = file %v, created %v, err %v", file, created, err)
	}
	if created, err := directory.CreateRegular("target.zip", []byte("target")); err != nil || !created {
		t.Fatalf("CreateRegular(target.zip) = created %v, err %v", created, err)
	}
	testsupport.SymlinkOrSkip(t, filepath.Join(root, "target.zip"), filepath.Join(root, "linked.zip"))
	if file, created, err := directory.CreateRegularFile("linked.zip"); !errors.Is(err, ErrUnsafeFile) || created || file != nil {
		t.Fatalf("CreateRegularFile(linked.zip) = file %v, created %v, err %v", file, created, err)
	}
}

func TestPreflightPrivateDirectoryAllowsOnlyAMissingFinalComponentWithoutMutation(t *testing.T) {
	temporaryRoot, err := filepath.EvalSymlinks(os.TempDir())
	if err != nil {
		t.Fatal(err)
	}
	root, err := os.MkdirTemp(temporaryRoot, "tht-safeio-preflight-")
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { _ = os.RemoveAll(root) })

	missing := filepath.Join(root, "auth")
	exists, err := PreflightPrivateDirectory(missing)
	if err != nil || exists {
		t.Fatalf("missing final preflight exists=%v error=%v, want false/nil", exists, err)
	}
	if _, err := os.Lstat(missing); !errors.Is(err, os.ErrNotExist) {
		t.Fatalf("preflight created missing final: %v", err)
	}

	nested := filepath.Join(root, "missing-parent", "auth")
	if _, err := PreflightPrivateDirectory(nested); !errors.Is(err, ErrUnsafeFile) {
		t.Fatalf("missing intermediate preflight error=%v, want ErrUnsafeFile", err)
	}
	if _, err := os.Lstat(filepath.Join(root, "missing-parent")); !errors.Is(err, os.ErrNotExist) {
		t.Fatalf("preflight created missing intermediate: %v", err)
	}

	realParent := filepath.Join(root, "real-parent")
	if err := os.Mkdir(realParent, 0o700); err != nil {
		t.Fatal(err)
	}
	linkedParent := filepath.Join(root, "linked-parent")
	testsupport.SymlinkOrSkip(t, realParent, linkedParent)
	if _, err := PreflightPrivateDirectory(filepath.Join(linkedParent, "auth")); !errors.Is(err, ErrUnsafeFile) {
		t.Fatalf("symlink ancestor preflight error=%v, want ErrUnsafeFile", err)
	}
	if _, err := os.Lstat(filepath.Join(realParent, "auth")); !errors.Is(err, os.ErrNotExist) {
		t.Fatalf("preflight mutated symlink target: %v", err)
	}
}

func TestListCanonicalPrivateDirectoryBoundsAndSortsValidatedEntries(t *testing.T) {
	temporaryRoot, err := filepath.EvalSymlinks(os.TempDir())
	if err != nil {
		t.Fatal(err)
	}
	root, err := os.MkdirTemp(temporaryRoot, "tht-safeio-list-")
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { _ = os.RemoveAll(root) })
	if err := ProtectPrivateDirectory(root); err != nil {
		t.Fatal(err)
	}
	for index := 255; index >= 0; index-- {
		path := filepath.Join(root, fmt.Sprintf("%064x.json", index))
		if err := WriteCanonicalNewFile(path, []byte("record"), 0o600); err != nil {
			t.Fatalf("WriteCanonicalNewFile(%d) error = %v", index, err)
		}
	}
	entries, err := ListCanonicalPrivateDirectory(root, 256)
	if err != nil || len(entries) != 256 || entries[0].Name != fmt.Sprintf("%064x.json", 0) || entries[255].Name != fmt.Sprintf("%064x.json", 255) {
		t.Fatalf("bounded ordered entries = %#v error = %v", entries, err)
	}
	if err := WriteCanonicalNewFile(filepath.Join(root, fmt.Sprintf("%064x.json", 256)), []byte("record"), 0o600); err != nil {
		t.Fatal(err)
	}
	if _, err := ListCanonicalPrivateDirectory(root, 256); !errors.Is(err, ErrUnsafeFile) {
		t.Fatalf("257-entry listing error = %v, want ErrUnsafeFile", err)
	}
}

func TestListCanonicalPrivateDirectoryPageContinuesPastOneBoundedPage(t *testing.T) {
	temporaryRoot, err := filepath.EvalSymlinks(os.TempDir())
	if err != nil {
		t.Fatal(err)
	}
	root, err := os.MkdirTemp(temporaryRoot, "tht-safeio-page-")
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { _ = os.RemoveAll(root) })
	if err := ProtectPrivateDirectory(root); err != nil {
		t.Fatal(err)
	}
	validName := func(name string) bool {
		return len(name) == len(fmt.Sprintf("%064x.json", 0)) && strings.HasSuffix(name, ".json")
	}
	for index := 0; index < 513; index++ {
		path := filepath.Join(root, fmt.Sprintf("%064x.json", index))
		if err := WriteCanonicalNewFile(path, []byte("record"), 0o600); err != nil {
			t.Fatalf("WriteCanonicalNewFile(%d) error = %v", index, err)
		}
	}

	first, err := ListCanonicalPrivateDirectoryPage(root, 512, "", validName)
	if err != nil || len(first.Entries) != 512 || !first.More || first.Entries[0].Name != fmt.Sprintf("%064x.json", 0) || first.Entries[511].Name != fmt.Sprintf("%064x.json", 511) {
		t.Fatalf("first page = %#v error = %v", first, err)
	}
	second, err := ListCanonicalPrivateDirectoryPage(root, 512, first.Entries[511].Name, validName)
	if err != nil || len(second.Entries) != 1 || second.More || second.Entries[0].Name != fmt.Sprintf("%064x.json", 512) {
		t.Fatalf("second page = %#v error = %v", second, err)
	}
}

func TestListCanonicalPrivateDirectoryPageRejectsInPlaceDirectoryMutation(t *testing.T) {
	temporaryRoot, err := filepath.EvalSymlinks(os.TempDir())
	if err != nil {
		t.Fatal(err)
	}
	root, err := os.MkdirTemp(temporaryRoot, "tht-safeio-page-")
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { _ = os.RemoveAll(root) })
	if err := ProtectPrivateDirectory(root); err != nil {
		t.Fatal(err)
	}
	filename := fmt.Sprintf("%064x.json", 0)
	if err := WriteCanonicalNewFile(filepath.Join(root, filename), []byte("record"), 0o600); err != nil {
		t.Fatal(err)
	}
	changed := false
	_, err = ListCanonicalPrivateDirectoryPage(root, 1, "", func(name string) bool {
		if !changed {
			changed = true
			at := time.Unix(1_893_456_245, 0)
			if changeErr := os.Chtimes(root, at, at); changeErr != nil {
				t.Fatalf("Chtimes() error = %v", changeErr)
			}
		}
		return name == filename
	})
	if !errors.Is(err, ErrUnsafeFile) {
		t.Fatalf("unstable page error = %v, want ErrUnsafeFile", err)
	}
}