package main

import (
	"os"
	"path/filepath"
	"strings"
	"syscall"
	"testing"
)

func TestWorkloadTokenRejectsUnsafeFilesAndContent(t *testing.T) {
	for _, tc := range []struct {
		name, contents string
		mode           os.FileMode
		want           bool
	}{
		{"private", "test-workload-token", 0600, true},
		{"readonly", "test-workload-token\n", 0400, true},
		{"crlf", "test-workload-token\r\n", 0600, true},
		{"group", "test-workload-token", 0640, false},
		{"public", "test-workload-token", 0644, false},
		{"empty", "", 0600, false},
		{"multiline", "test-workload-token\nsecond", 0600, false},
		{"blankline", "test-workload-token\n\n", 0600, false},
		{"whitespace", "test-workload-token other", 0600, false},
		{"leading", " test-workload-token", 0600, false},
		{"oversize", strings.Repeat("x", 64*1024+1), 0600, false},
	} {
		t.Run(tc.name, func(t *testing.T) {
			path := filepath.Join(t.TempDir(), "token")
			if err := os.WriteFile(path, []byte(tc.contents), tc.mode); err != nil {
				t.Fatal(err)
			}
			token, err := readWorkloadToken(path)
			if tc.want {
				if err != nil || token != "test-workload-token" {
					t.Fatal("valid private token rejected")
				}
				return
			}
			if err == nil || token != "" {
				t.Fatal("unsafe token accepted")
			}
			if strings.Contains(err.Error(), "test-workload-token") {
				t.Fatal("credential disclosed in error")
			}
		})
	}
	dir := t.TempDir()
	target := filepath.Join(dir, "target")
	if err := os.WriteFile(target, []byte("test-workload-token"), 0600); err != nil {
		t.Fatal(err)
	}
	link := filepath.Join(dir, "link")
	if err := os.Symlink(target, link); err != nil {
		t.Fatal(err)
	}
	fifo := filepath.Join(dir, "fifo")
	if err := syscall.Mkfifo(fifo, 0600); err != nil {
		t.Fatal(err)
	}
	for _, path := range []string{dir, link, fifo, filepath.Join(dir, "missing")} {
		if token, err := readWorkloadToken(path); err == nil || token != "" {
			t.Fatal("non-regular credential accepted")
		}
	}
}

func TestLoadConfigBindsPlainHTTPOnlyToLiteralLoopback(t *testing.T) {
	tokenFile := filepath.Join(t.TempDir(), "token")
	if err := os.WriteFile(tokenFile, []byte("fixture-token"), 0600); err != nil {
		t.Fatal(err)
	}
	for _, tc := range []struct {
		origin, address string
		allowed         bool
	}{
		{"http://localhost", "", true},
		{"http://localhost", "127.0.0.1:8092", true},
		{"http://[::1]", "[::1]:8092", true},
		{"http://localhost", "0.0.0.0:8092", false},
		{"http://localhost", ":8092", false},
		{"http://localhost", "[::]:8092", false},
		{"http://localhost", "192.0.2.1:8092", false},
		{"http://localhost", "localhost:8092", false},
		{"https://crm.example", "0.0.0.0:8092", true},
	} {
		t.Run(tc.origin+"/"+tc.address, func(t *testing.T) {
			env := map[string]string{"MCP_RUNTIME_TARGET": "runtime:443", "MCP_APP_INSTALLATION_ID": "installation", "MCP_PUBLIC_ORIGIN": tc.origin, "MCP_HTTP_ADDRESS": tc.address, "MCP_WORKLOAD_TOKEN_FILE": tokenFile}
			_, _, _, err := loadConfig(func(key string) string { return env[key] })
			if (err == nil) != tc.allowed {
				t.Fatalf("allowed=%t err=%v", tc.allowed, err)
			}
		})
	}
}