package server

import ( "io" "net/http" "net/http/httptest" "os" "os/exec" "path/filepath" "strings" "testing"

"gitweb/internal/store"

)

// newTestServer builds a Server over a LocalStore namespace containing a bare // repo at u@d.com/demo.git and a plain dir u@d.com/docs. func newTestServer(t *testing.T) (httptest.Server, func()) { t.Helper() if _, err := exec.LookPath("git"); err != nil { t.Skip("git not available") } ns := t.TempDir() if err := os.MkdirAll(filepath.Join(ns, "u@d.com", "docs"), 0o755); err != nil { t.Fatal(err) } os.WriteFile(filepath.Join(ns, "u@d.com", "docs", "note.txt"), []byte("hi"), 0o644) // Browsing is gated by Access files; make this whole namespace world-readable // so the anonymous browse tests below succeed. os.WriteFile(filepath.Join(ns, "u@d.com", "Access"), []byte("read,list: all\n: u@d.com\n"), 0o644)

work := t.TempDir()
git := func(dir string, a ...string) {
	t.Helper()
	c := exec.Command("git", a...)
	c.Dir = dir
	c.Env = append(os.Environ(),
		"GIT_AUTHOR_NAME=T", "GIT_AUTHOR_EMAIL=t@e.com",
		"GIT_COMMITTER_NAME=T", "GIT_COMMITTER_EMAIL=t@e.com")
	if out, err := c.CombinedOutput(); err != nil {
		t.Fatalf("git %v: %v\n%s", a, err, out)
	}
}
git(work, "init", "-q", "-b", "main")
os.WriteFile(filepath.Join(work, "README.md"), []byte("# Demo\n\nhello\n"), 0o644)
os.WriteFile(filepath.Join(work, "main.go"), []byte("package main\n\nfunc main() {}\n"), 0o644)
// An Access file committed into the repo tree, to prove it is hidden there too.
os.WriteFile(filepath.Join(work, "Access"), []byte("read,list: all\n*: secret@d.com\n"), 0o644)
git(work, "add", "-A")
git(work, "commit", "-qm", "initial")
git(work, "checkout", "-q", "-b", "feature/x")
os.WriteFile(filepath.Join(work, "main.go"), []byte("package main\n\nfunc main() { _ = 1 }\n"), 0o644)
git(work, "commit", "-qam", "tweak")
git(work, "tag", "v1.0.0")
git(work, "checkout", "-q", "main")
git(work, "clone", "-q", "--bare", work, filepath.Join(ns, "u@d.com", "demo.git"))

web := os.DirFS("../../web")
srv, err := New(Config{Store: store.NewLocalStore(ns), Web: http.FS(web), CacheDir: t.TempDir()})
if err != nil {
	t.Fatal(err)
}
ts := httptest.NewServer(srv.Handler())
return ts, ts.Close

}

// TestAccessFilesHidden verifies that upspin Access files are never listed or // rendered — neither in the plain namespace browse nor in a git repo tree — so // the set of users/groups with access is not exposed to browsers. func TestAccessFilesHidden(t *testing.T) { ts, done := newTestServer(t) defer done()

get := func(p string) (int, string) {
	resp, err := http.Get(ts.URL + p)
	if err != nil {
		t.Fatal(err)
	}
	defer resp.Body.Close()
	b, _ := io.ReadAll(resp.Body)
	return resp.StatusCode, string(b)
}

// Namespace listing must not link to the Access file...
if code, body := get("/u@d.com/"); code != 200 {
	t.Fatalf("namespace browse code %d", code)
} else if strings.Contains(body, `href="Access"`) {
	t.Error("namespace listing exposed the Access file")
}
// ...and its contents must not be servable directly.
if code, _ := get("/u@d.com/Access"); code != 404 {
	t.Errorf("GET /u@d.com/Access = %d, want 404", code)
}

// Git tree listing must not link to a committed Access file...
if code, body := get("/u@d.com/demo.git/tree/main/"); code != 200 {
	t.Fatalf("tree code %d", code)
} else if strings.Contains(body, "/blob/main/Access") {
	t.Error("git tree listing exposed a committed Access file")
}
// ...and neither blob nor raw view will render it.
if code, body := get("/u@d.com/demo.git/blob/main/Access"); code != 404 {
	t.Errorf("blob Access = %d, want 404", code)
} else if strings.Contains(body, "secret@d.com") {
	t.Error("blob view leaked Access contents")
}
if code, _ := get("/u@d.com/demo.git/raw/main/Access"); code != 404 {
	t.Errorf("raw Access = %d, want 404", code)
}

}

func TestGitVerbs(t *testing.T) { ts, done := newTestServer(t) defer done()

get := func(p string) (int, string) {
	resp, err := http.Get(ts.URL + p)
	if err != nil {
		t.Fatal(err)
	}
	defer resp.Body.Close()
	b, _ := io.ReadAll(resp.Body)
	return resp.StatusCode, string(b)
}

cases := []struct {
	path     string
	wantCode int
	contains []string
}{
	{"/u@d.com/docs/", 200, []string{"Index of", "note.txt"}},
	{"/u@d.com/demo.git/", 200, []string{"feature/x", "v1.0.0", "README", "Demo"}},
	{"/u@d.com/demo.git/refs", 200, []string{"Branches", "Tags", "feature/x", "v1.0.0"}},
	{"/u@d.com/demo.git/tree/main/", 200, []string{"main.go", "README.md"}},
	{"/u@d.com/demo.git/blob/main/main.go", 200, []string{"chroma", "func"}},
	{"/u@d.com/demo.git/blob/feature/x/main.go", 200, []string{"chroma"}},
	{"/u@d.com/demo.git/log/feature/x", 200, []string{"tweak", "/commit/"}},
	{"/u@d.com/demo.git/bogus", 404, nil},
}
for _, c := range cases {
	t.Run(c.path, func(t *testing.T) {
		code, body := get(c.path)
		if code != c.wantCode {
			t.Fatalf("code = %d, want %d", code, c.wantCode)
		}
		for _, want := range c.contains {
			if !strings.Contains(body, want) {
				t.Fatalf("body missing %q", want)
			}
		}
	})
}

// Renderer switch: default README.md is highlighted source, with a
// Markdown switch offered; ?render=markdown renders the markdown.
{
	_, src := get("/u@d.com/demo.git/blob/main/README.md")
	if !strings.Contains(src, "chroma") {
		t.Fatal("README.md default view should be highlighted source")
	}
	if !strings.Contains(src, `href="/u@d.com/demo.git/blob/main/README.md?render=markdown"`) {
		t.Fatal("README.md should offer a Markdown switch link")
	}
	_, md := get("/u@d.com/demo.git/blob/main/README.md?render=markdown")
	if !strings.Contains(md, "<h1") {
		t.Fatal("?render=markdown should render markdown (expected <h1>)")
	}
}

// Non-markdown file offers only the default; force exposes & runs markdown.
{
	_, src := get("/u@d.com/demo.git/blob/main/main.go")
	if strings.Contains(src, "?render=markdown\"") {
		t.Fatal("main.go should not offer markdown without force")
	}
	if !strings.Contains(src, "force=1") {
		t.Fatal("main.go should offer a force toggle")
	}
	code, _ := get("/u@d.com/demo.git/blob/main/main.go?render=markdown&force=1")
	if code != 200 {
		t.Fatalf("forced markdown on main.go: code %d", code)
	}
}

// CSP header is present on git pages. Scripts are restricted to same-origin
// with no 'unsafe-inline', so markdown-injected inline script cannot run
// (mermaid is served as a same-origin file).
resp, _ := http.Get(ts.URL + "/u@d.com/demo.git/")
resp.Body.Close()
csp := resp.Header.Get("Content-Security-Policy")
if !strings.Contains(csp, "script-src 'self'") || strings.Contains(csp, "script-src 'self' 'unsafe-inline'") {
	t.Fatalf("missing/weak script CSP on git page: %q", csp)
}

// Commit page renders a diff.
_, logBody := get("/u@d.com/demo.git/log/feature/x")
i := strings.Index(logBody, "/u@d.com/demo.git/commit/")
if i < 0 {
	t.Fatal("no commit link in log")
}
url := logBody[i : i+len("/u@d.com/demo.git/commit/")+40]
code, body := get(url)
if code != 200 || !strings.Contains(body, "diff-add") || !strings.Contains(body, "diff-del") {
	t.Fatalf("commit page: code %d, diff classes present=%v", code,
		strings.Contains(body, "diff-add"))
}

}