"""Adversarial contracts for the Atlas-only draft pull-request client."""

from __future__ import annotations

import copy
import importlib.util
import json
import sys
import urllib.request
from pathlib import Path

import pytest

ROOT = Path(__file__).parents[2]
CLIENT_PATH = ROOT / "services/hermes/scripts/gitea_api.py"
HEAD_SHA = "465cf9146b05c174a2a8d310aff6c64be58277b6"
if str(CLIENT_PATH.parent) not in sys.path:
    sys.path.insert(0, str(CLIENT_PATH.parent))


def _load():
    spec = importlib.util.spec_from_file_location("safe_gitea_api", CLIENT_PATH)
    assert spec and spec.loader
    module = importlib.util.module_from_spec(spec)
    sys.modules[spec.name] = module
    spec.loader.exec_module(module)
    return module


def _draft_payload(**updates):
    payload = {
        "base": "main",
        "body": "Review evidence",
        "head": "hermes/review-fix",
        "title": "WIP: Repair review findings",
    }
    payload.update(updates)
    return payload


def _draft_response(**updates):
    response = {
        "number": 3,
        "state": "open",
        "draft": True,
        "merged": False,
        "html_url": "https://scm.bstein.dev/atlas/cassandra/pulls/3",
        "url": "https://scm.bstein.dev/atlas/cassandra/pulls/3",
        "title": "WIP: Focused fix",
        "body": "Review evidence",
        "base": {"ref": "main", "repo": {"full_name": "atlas/cassandra"}},
        "head": {
            "ref": "hermes/fix",
            "sha": HEAD_SHA,
            "repo": {"full_name": "atlas/cassandra"},
        },
    }
    response.update(updates)
    return response


class Response:
    def __init__(self, body: object):
        self.body = body if isinstance(body, bytes) else json.dumps(body).encode()

    def __enter__(self):
        return self

    def __exit__(self, *_args):
        return False

    def read(self, limit=-1):
        return self.body if limit < 0 else self.body[:limit]


def test_redirect_handler_rejects_cross_origin_with_sentinel_authorization():
    client = _load()
    source = urllib.request.Request(
        "https://scm.bstein.dev/api/v1/repos/atlas/cassandra",
        headers={"Authorization": "token redirect-sentinel"},
    )

    with pytest.raises(client.PolicyError, match="redirects are not allowed") as exc:
        client.RejectRedirectHandler().redirect_request(
            source,
            None,
            302,
            "Found",
            {},
            "https://evil.example/collect",
        )

    assert "redirect-sentinel" not in str(exc.value)
    assert any(
        isinstance(handler, client.RejectRedirectHandler)
        for handler in client._SAFE_OPENER.handlers
    )


@pytest.mark.parametrize(
    ("base_url", "path"),
    [
        ("https://evil.example", "/api/v1/repos/atlas/cassandra"),
        ("http://scm.bstein.dev", "/api/v1/repos/atlas/cassandra"),
        ("https://scm.bstein.dev:443", "/api/v1/repos/atlas/cassandra"),
        ("https://scm.bstein.dev", "https://evil.example/api/v1/repos/atlas/cassandra"),
        ("https://scm.bstein.dev", "/api/v1/repos/evil/cassandra"),
        ("https://scm.bstein.dev", "/api/v1/repos/%61tlas/cassandra"),
        ("https://scm.bstein.dev", "/api/v1/repos/atlas/../admin"),
    ],
)
def test_host_owner_and_path_escape_attempts_are_rejected(base_url: str, path: str):
    client = _load()

    with pytest.raises(client.PolicyError):
        client.build_request("GET", path, base_url=base_url, token="secret")


@pytest.mark.parametrize(
    "path",
    [
        "/api/v1/repos/atlas/cassandra",
        "/api/v1/repos/atlas/cassandra/pulls?state=open&limit=20&page=1",
        "/api/v1/repos/atlas/cassandra/pulls/7",
        "/api/v1/repos/atlas/cassandra/pulls/7/commits?limit=20",
        "/api/v1/repos/atlas/cassandra/pulls/7/files?page=1",
        "/api/v1/repos/atlas/cassandra/branches",
        "/api/v1/repos/atlas/cassandra/branches/main",
        "/api/v1/repos/atlas/cassandra/commits?limit=10",
        f"/api/v1/repos/atlas/cassandra/git/commits/{HEAD_SHA}",
        f"/api/v1/repos/atlas/cassandra/commits/{HEAD_SHA}/status",
        f"/api/v1/repos/atlas/cassandra/commits/{HEAD_SHA}/statuses?limit=10",
        f"/api/v1/repos/atlas/cassandra/statuses/{HEAD_SHA}?page=1",
    ],
)
def test_explicit_read_allowlist_accepts_only_engineering_metadata(path: str):
    client = _load()

    request = client.build_request(
        "GET", path, base_url=client.CANONICAL_BASE_URL, token="runtime"
    )
    assert request.method == "GET"


@pytest.mark.parametrize(
    "path",
    [
        "/api/v1/repos/atlas/cassandra/hooks",
        "/api/v1/repos/atlas/cassandra/actions/secrets",
        "/api/v1/repos/atlas/cassandra/actions/variables",
        "/api/v1/repos/atlas/cassandra/collaborators",
        "/api/v1/repos/atlas/cassandra/branch_protections",
        "/api/v1/repos/atlas/cassandra/keys",
        "/api/v1/repos/atlas/cassandra/pulls/7/reviews",
        "/api/v1/repos/atlas/cassandra/pulls/7/merge",
        "/api/v1/repos/atlas/cassandra/pulls/7.diff",
        "/api/v1/repos/atlas/cassandra/releases",
    ],
)
def test_privileged_or_content_routes_are_denied_even_for_get(path: str):
    client = _load()

    with pytest.raises(client.PolicyError, match="outside the metadata read allowlist"):
        client.authorize_request("GET", path, None)


@pytest.mark.parametrize(
    "path",
    [
        "/api/v1/repos/atlas/cassandra/pulls?limit=51",
        "/api/v1/repos/atlas/cassandra/pulls?state=merged",
        "/api/v1/repos/atlas/cassandra/pulls?private=true",
        "/api/v1/repos/atlas/cassandra/pulls?limit=1&limit=2",
        "/api/v1/repos/atlas/cassandra?p=1",
    ],
)
def test_read_query_is_bounded(path: str):
    client = _load()

    with pytest.raises(client.PolicyError):
        client.authorize_request("GET", path, None)


@pytest.mark.parametrize(
    "query",
    [
        "page=0",
        "page=10001",
        "page=01",
        "limit=0",
        "limit=51",
        "limit=01",
        "page=" + "9" * 4000,
        "page=０",
        "page=%EF%BC%90",
        "state=%6fpen",
        "p%61ge=1",
        "page=1&page=2",
        "page=1&" + "x" * 17 + "=1",
        "state=" + "x" * 17,
        "page=1&limit=2&state=open&extra=3",
    ],
)
def test_read_query_requires_canonical_bounded_ascii(query: str):
    client = _load()

    with pytest.raises(client.PolicyError):
        client.authorize_request(
            "GET", f"/api/v1/repos/atlas/cassandra/pulls?{query}", None
        )


@pytest.mark.parametrize(
    "suffix",
    [
        "pulls/{number}",
        "pulls/{number}.patch",
        "pulls/{number}.diff",
        "pulls/{number}/commits",
        "pulls/{number}/files",
        "commits/{number}/status",
        "commits/{number}/statuses",
        "statuses/{number}",
        "branches/{number}",
    ],
)
def test_oversized_numeric_or_captured_path_never_reaches_opener(suffix: str):
    client = _load()
    called = False

    def opener(*_args, **_kwargs):
        nonlocal called
        called = True
        return Response(b"{}")

    path = "/api/v1/repos/atlas/cassandra/" + suffix.format(number="9" * 4000)
    with pytest.raises(client.PolicyError):
        client.read(path, token="runtime", opener=opener)
    assert called is False


@pytest.mark.parametrize(
    "number",
    ["0", "01", "2147483648", "１２", "%31", "12345678901"],
)
@pytest.mark.parametrize("tail", ["", ".patch", ".diff", "/commits", "/files"])
def test_noncanonical_or_out_of_range_pr_number_never_reaches_opener(
    number: str, tail: str
):
    client = _load()
    called = False

    def opener(*_args, **_kwargs):
        nonlocal called
        called = True
        return Response(b"{}")

    with pytest.raises(client.PolicyError):
        client.read(
            f"/api/v1/repos/atlas/cassandra/pulls/{number}{tail}",
            token="runtime",
            opener=opener,
        )
    assert called is False


def test_maximum_bounded_pr_number_is_readable():
    client = _load()
    called = False

    def opener(*_args, **_kwargs):
        nonlocal called
        called = True
        return Response(b"{}")

    assert (
        client.read(
            "/api/v1/repos/atlas/cassandra/pulls/2147483647",
            token="runtime",
            opener=opener,
        )
        == b"{}"
    )
    assert called is True


@pytest.mark.parametrize(
    ("method", "path", "data"),
    [
        ("DELETE", "/api/v1/repos/atlas/cassandra/pulls/4", None),
        ("POST", "/api/v1/repos/atlas/cassandra/pulls/4/merge", {}),
        (
            "POST",
            "/api/v1/repos/atlas/cassandra/pulls/4/reviews",
            {"event": "APPROVED"},
        ),
        ("PATCH", "/api/v1/repos/atlas/cassandra/pulls/4", {"title": "WIP: x"}),
        ("PUT", "/api/v1/repos/atlas/cassandra/branches/main", {}),
    ],
)
def test_merge_approve_close_delete_update_and_other_mutations_are_rejected(
    method: str, path: str, data: object
):
    client = _load()

    with pytest.raises(client.PolicyError):
        client.build_request(
            method, path, base_url=client.CANONICAL_BASE_URL, token="secret", data=data
        )


@pytest.mark.parametrize(
    "ref",
    [
        "foo/.bar",
        "foo/bar.lock/baz",
        "foo..bar",
        "foo@{bar",
        "foo//bar",
        "-danger",
        "danger.",
        "danger~one",
        "danger^one",
        "danger:one",
        "danger one",
    ],
)
def test_complete_git_ref_validation_rejects_invalid_names(ref: str):
    client = _load()

    with pytest.raises(client.PolicyError):
        client._validate_ref(ref, "head")


def test_git_ref_validation_uses_fixed_trusted_binary():
    client = _load()

    assert client._validate_ref.__globals__["GIT_BIN"] == "/usr/bin/git"
    assert client._validate_ref("hermes/valid-fix", "head") == "hermes/valid-fix"


def test_create_forces_draft_title_and_same_repository_branch_names():
    client = _load()
    assert (
        client.authorize_request(
            "POST", "/api/v1/repos/atlas/cassandra/pulls", _draft_payload()
        )
        == "create-draft"
    )
    with pytest.raises(client.PolicyError, match="draft-title prefix"):
        client.authorize_request(
            "POST",
            "/api/v1/repos/atlas/cassandra/pulls",
            _draft_payload(title="Not a draft"),
        )
    with pytest.raises(client.PolicyError):
        client.authorize_request(
            "POST",
            "/api/v1/repos/atlas/cassandra/pulls",
            _draft_payload(head="someone:branch"),
        )


def test_runtime_token_is_only_an_authorization_header():
    client = _load()
    request = client.build_request(
        "POST",
        "/api/v1/repos/atlas/cassandra/pulls",
        base_url=client.CANONICAL_BASE_URL,
        token="do-not-leak",
        data=_draft_payload(),
    )

    assert "do-not-leak" not in request.full_url
    assert b"do-not-leak" not in request.data
    assert request.get_header("Authorization") == "token do-not-leak"


@pytest.mark.parametrize(
    "sensitive",
    [
        "client_" + "secret=not-a-real-value",
        "ACCESS_" + "TOKEN = 'not-a-real-value'",
        '{"refresh_' + 'token": "not-a-real-value"}',
        "private_" + "key: not-a-real-value",
        "AWS_SECRET_ACCESS_" + "KEY=not-a-real-value",
        "aws_access_key_" + "id: not-a-real-value",
        "AWS_SESSION_" + "TOKEN = 'not-a-real-value'",
        '{"AccessKey' + 'Id":"not-a-real-value"}',
        '{"SecretAccess' + 'Key":"not-a-real-value"}',
        '{"Session' + 'Token":"not-a-real-value"}',
        "aws-security-" + "token: not-a-real-value",
        "Account" + "Key=not-a-real-value",
        "SharedAccess" + "Signature: not-a-real-value",
        "AZURE_STORAGE_CONNECTION_" + "STRING='not-a-real-value'",
        "DefaultEndpointsProtocol=https;AccountName=fake;Account"
        + "Key=not-a-real-value;EndpointSuffix=example",
        "?sv=2024-11-04&ss=b&srt=sco&sp=rwdlac&se=2099-01-01&sig=" + "not-a-real-value",
        "DOCKER_AUTH_" + "CONFIG='not-a-real-value'",
        '{"auths":{"registry.example":{"auth":"bm90LXJlYWw="}}}',
        '{"identity' + 'token":"not-a-real-value"}',
        '{"type":"service_' + 'account","client_email":"fake@example.test"}',
        '{"private_key_' + 'id":"not-a-real-value"}',
        '{"client_' + 'email":"fake@example.test"}',
        "GOOGLE_CREDENTIALS" + "=not-a-real-value",
        "personal_access_" + "token: not-a-real-value",
        "GITEA_" + "TOKEN=not-a-real-value",
        "gitlab-token" + ": not-a-real-value",
        "pat" + "=not-a-real-value",
        "Authorization: " + "Bearer not-a-real-credential-value",
        "authorization = " + '"Basic not-a-real-credential-value"',
        "Bearer" + "=not-a-real-credential-value",
        "Basic" + ": not-a-real-credential-value",
        "pass" + "word=not-a-real-credential",
        "ghp_" + "notarealcredentialvalue123456",
        "github_pat_" + "notarealcredentialvalue123456",
        "glpat-" + "notarealcredentialvalue123456",
        "xoxb-" + "not-a-real-credential-value-123456",
        "sk-ant-" + "notarealcredentialvalue123456",
        "sk-proj-" + "notarealcredentialvalue123456",
        "sk_live_" + "notarealcredentialvalue123456",
        "ya29." + "notarealcredentialvalue123456",
        "gta_" + "notarealcredentialvalue123456",
        "whsec_" + "notarealcredentialvalue123456",
        "npm_" + "notarealcredentialvalue123456",
        "pypi-" + "notarealcredentialvalue123456789012345",
        "hf_" + "notarealcredentialvalue123456",
        "SG." + "notarealvalue1234" + ".notarealcredentialvalue123456",
        "SK" + "a" * 32,
        "https://hooks.slack.com/services/" + "T000/B000/notarealvalue123456",
        "https://discord.com/api/webhooks/123456789/" + "notarealcredentialvalue123456",
        "https://fake.webhook.office.com/" + "notarealcredentialvalue123456",
        "webhook_" + "url=https://example.test/not-real",
        "AKIA" + "A" * 16,
        "AIza" + "a" * 35,
        "-----BEGIN OPENSSH " + "PRIVATE KEY-----",
        "ssh-ed25519 " + "bm90YXJlYWxjcmVkZW50aWFsdmFsdWU=",
        "eyJnotarealheader." + "notarealpayloadvalue." + "notarealsignature",
    ],
)
@pytest.mark.parametrize("field", ["title", "body"])
def test_create_rejects_expanded_credential_shapes_before_network(
    sensitive: str, field: str
):
    client = _load()
    called = False
    request_built = False

    original_build_request = client.build_request

    def build_request(*args, **kwargs):
        nonlocal request_built
        request_built = True
        return original_build_request(*args, **kwargs)

    def opener(*_args, **_kwargs):
        nonlocal called
        called = True
        return Response(_draft_response())

    client.build_request = build_request
    values = {"title": "Focused fix", "body": "Review evidence"}
    values[field] = sensitive

    with pytest.raises(client.PolicyError, match="credential material"):
        client.create_draft(
            "cassandra",
            base="main",
            head="hermes/fix",
            head_sha=HEAD_SHA,
            title=values["title"],
            body=values["body"],
            token="runtime-sentinel",
            opener=opener,
        )
    assert request_built is False
    assert called is False


@pytest.mark.parametrize(
    "safe_text",
    [
        "AWS_SECRET_ACCESS_KEY is injected at runtime",
        "Review the Authorization header behavior",
        "Bearer authentication is required for this route",
        "Document Docker auths payload rejection",
        "The client_email field belongs to service accounts",
        "AccountKey assignments must be blocked",
        "This patch changes token validation without including a value",
    ],
)
def test_credential_policy_keeps_normal_engineering_prose_usable(safe_text: str):
    client = _load()

    assert client._validate_body(safe_text) == safe_text
    assert client._draft_title(safe_text) == f"WIP: {safe_text}"


@pytest.mark.parametrize("field", ["title", "body"])
def test_create_rejects_exact_runtime_token_before_network(field: str):
    client = _load()
    called = False
    request_built = False

    original_build_request = client.build_request

    def build_request(*args, **kwargs):
        nonlocal request_built
        request_built = True
        return original_build_request(*args, **kwargs)

    def opener(*_args, **_kwargs):
        nonlocal called
        called = True
        return Response(_draft_response())

    client.build_request = build_request
    runtime_token = "exact-random-runtime-sentinel-7b73ac61"
    values = {"title": "Focused fix", "body": "Review evidence"}
    values[field] = f"Accidental {runtime_token} value"
    with pytest.raises(client.PolicyError, match="runtime credential"):
        client.create_draft(
            "cassandra",
            base="main",
            head="hermes/fix",
            head_sha=HEAD_SHA,
            title=values["title"],
            body=values["body"],
            token=runtime_token,
            opener=opener,
        )
    assert request_built is False
    assert called is False


def test_create_verifies_every_server_postcondition():
    client = _load()
    calls = []

    def opener(request, timeout):
        calls.append((request, timeout))
        return Response(_draft_response())

    result = client.create_draft(
        "cassandra",
        base="main",
        head="hermes/fix",
        head_sha=HEAD_SHA,
        title="Focused fix",
        body="Review evidence",
        token="runtime",
        opener=opener,
    )

    assert json.loads(result) == _draft_response()
    payload = json.loads(calls[0][0].data)
    assert payload == {
        "base": "main",
        "body": "Review evidence",
        "head": "hermes/fix",
        "title": "WIP: Focused fix",
    }
    assert calls[0][1] == 30


def test_create_postcondition_rejects_every_material_mismatch():
    client = _load()
    mutations = [
        ("number", 0),
        ("number", 2_147_483_648),
        ("state", "closed"),
        ("draft", False),
        ("merged", True),
        ("html_url", "https://evil.example/pulls/3"),
        ("url", "https://evil.example/api/pulls/3"),
        ("title", "Focused fix"),
        ("body", "different"),
    ]
    documents = []
    for key, value in mutations:
        document = _draft_response()
        document[key] = value
        documents.append(document)
    for path, value in [
        (("base", "ref"), "master"),
        (("base", "repo", "full_name"), "evil/cassandra"),
        (("head", "ref"), "other"),
        (("head", "sha"), "0" * 40),
        (("head", "repo", "full_name"), "evil/cassandra"),
    ]:
        document = copy.deepcopy(_draft_response())
        target = document
        for key in path[:-1]:
            target = target[key]
        target[path[-1]] = value
        documents.append(document)

    for document in documents:
        with pytest.raises(client.PolicyError):
            client._require_create_response(
                json.dumps(document).encode(),
                repo="cassandra",
                base="main",
                head="hermes/fix",
                head_sha=HEAD_SHA,
                title="WIP: Focused fix",
                body="Review evidence",
            )


def test_read_response_is_bounded():
    client = _load()

    with pytest.raises(client.PolicyError, match="safe size limit"):
        client.read(
            "/api/v1/repos/atlas/cassandra",
            token="runtime",
            opener=lambda *_a, **_k: Response(b"x" * (client.MAX_RESPONSE_BYTES + 1)),
        )


def test_output_redaction_covers_exact_token_and_authorization_header():
    client = _load()
    raw = b'{"message":"do-not-leak","debug":"Authorization: token do-not-leak"}'
    redacted = client.redact_bytes(raw, "do-not-leak")

    assert b"do-not-leak" not in redacted
    assert redacted.count(b"[REDACTED]") >= 1