/**
 * Tests for src/network/wg-firewall.js (DC-151).
 * Coverage:
 *   - golden ruleset text: single resource single grant, group grant
 *     expansion, blocked person absent from ALL sets, default-deny tails,
 *     admin ports only from admin set
 *   - corrected baseline: WG UDP handshake rule NOT bound to dcnet0
 *     (externalInterface scoping + null → unscoped), peer-to-peer forward
 *     default-deny (oifname dcnet0 drop)
 *   - name sanitization: 'plex-2!' → net_dc_res_plex_2, collision guard
 *   - admin lockout guard; assertAdminIsolation (positive + adversarial)
 *   - transactional apply (mocked execFile + fs): check-failure → no apply
 *     + temp deleted; apply-failure → {applied:false} + rollback file
 *     unchanged; verify-mismatch → rollback attempted; rollback() re-applies
 *     previous; unique temp paths across applies
 */

'use strict';

const {
  compileRuleset,
  createWgFirewallApplier,
  assertAdminIsolation,
  resourceSetName,
  FirewallCheckError,
  FirewallApplyError,
} = require('../src/network/wg-firewall');

// --------------------------------------------------------------------------
// Fixtures
// --------------------------------------------------------------------------

const PEOPLE = [
  {
    id: 'admin1',
    displayName: 'Admin',
    groups: ['family'],
    status: 'active',
    devices: [{ keyId: 'k1', name: 'laptop', ip: '10.53.0.10' }],
  },
  {
    id: 'alice',
    displayName: 'Alice',
    groups: ['family'],
    status: 'active',
    devices: [{ keyId: 'k2', name: 'phone', ip: '10.53.1.20' }],
  },
  {
    id: 'bob',
    displayName: 'Bob',
    groups: [],
    status: 'active',
    devices: [{ keyId: 'k3', name: 'pc', ip: '10.53.2.30' }],
  },
  {
    id: 'mallory',
    displayName: 'Mallory',
    groups: ['family'],
    status: 'blocked',
    devices: [{ keyId: 'k4', name: 'tab', ip: '10.53.3.40' }],
  },
];

const PEERS = {
  'admin1/dev1': '10.53.0.10',
  'alice/dev1': '10.53.1.20',
  'bob/dev1': '10.53.2.30',
  'mallory/dev1': '10.53.3.40',
};

const RESOURCES = {
  plex: { ip: '10.53.0.1', port: 32400, protocol: 'tcp' },
  nas: { ip: '10.53.9.9', port: 445, protocol: 'tcp' },
};

const BASE = {
  accessMap: { grants: [] },
  people: PEOPLE,
  peerAddresses: PEERS,
  resources: RESOURCES,
  adminPeers: ['admin1'],
};

// --------------------------------------------------------------------------
// Compiler: golden ruleset text
// --------------------------------------------------------------------------

describe('wg-firewall: compileRuleset golden text', () => {
  test('single resource single grant — exact set element + accept rule', () => {
    const text = compileRuleset({
      ...BASE,
      accessMap: {
        grants: [{ principal: { type: 'person', id: 'alice' }, resource: 'plex', allowed: true }],
      },
      resources: { plex: RESOURCES.plex },
    });
    expect(text).toContain('set net_dc_res_plex {');
    expect(text).toContain('elements = { 10.53.1.20 }');
    expect(text).toContain(
      'ip saddr @net_dc_res_plex ip daddr 10.53.0.1 tcp dport 32400 accept comment "resource plex"'
    );
    // blocked + ungranted peers are NOT in the plex resource set
    const plexSet = text.split('set net_dc_res_plex {')[1].split('}')[0];
    expect(plexSet).not.toContain('10.53.3.40'); // mallory
    expect(plexSet).not.toContain('10.53.2.30'); // bob
    expect(plexSet).not.toContain('10.53.0.10'); // admin not granted plex → not in res set
    expect(plexSet).toContain('elements = { 10.53.1.20');
  });

  test('group grant expands to every active member (person-override honored)', () => {
    const text = compileRuleset({
      ...BASE,
      accessMap: {
        grants: [
          { principal: { type: 'group', id: 'family' }, resource: 'nas', allowed: true },
          { principal: { type: 'person', id: 'alice' }, resource: 'nas', allowed: false },
        ],
      },
      resources: { nas: RESOURCES.nas },
    });
    // family = admin1, alice, mallory(blocked); alice overridden to false
    expect(text).toMatch(/set net_dc_res_nas \{\s*\n\s*type ipv4_addr\s*\n\s*elements = \{ 10\.53\.0\.10 \}/);
    expect(text).toContain('ip saddr @net_dc_res_nas ip daddr 10.53.9.9 tcp dport 445 accept');
  });

  test('blocked person absent from ALL sets (resource sets and admin set)', () => {
    const text = compileRuleset({
      ...BASE,
      accessMap: {
        grants: [{ principal: { type: 'group', id: 'family' }, resource: 'plex', allowed: true }],
      },
      adminPeers: ['admin1', 'mallory'], // mallory blocked → must NOT get admin
    });
    const adminSetMatch = text.match(/set net_dc_admins \{[^}]*elements = \{ ([^}]*) \}/);
    expect(adminSetMatch).toBeTruthy();
    const adminEls = adminSetMatch[1].split(', ');
    expect(adminEls).toEqual(['10.53.0.10']); // mallory's 10.53.3.40 excluded
    expect(adminEls).not.toContain('10.53.3.40');
  });

  test('default-deny tails present: hub input, peer egress, peer-to-peer', () => {
    const text = compileRuleset(BASE);
    expect(text).toContain('ct state new drop comment "default-deny: hub input"');
    expect(text).toContain('drop comment "default-deny: peer egress without grant"');
    expect(text).toContain('drop comment "default-deny: peer-to-peer / new hub-to-peer"');
  });

  test('admin ports only from admin set (3001 + 22)', () => {
    const text = compileRuleset(BASE);
    expect(text).toContain(
      'iifname "dcnet0" ip saddr @net_dc_admins tcp dport { 22, 3001 } accept comment "admin ports: admin peers only"'
    );
  });

  test('table declared as inet dcnet with destroy-first', () => {
    const text = compileRuleset(BASE);
    expect(text).toContain('destroy table inet dcnet');
    expect(text).toContain('table inet dcnet {');
  });
});

// --------------------------------------------------------------------------
// Compiler: corrected baseline (judge gate)
// --------------------------------------------------------------------------

describe('wg-firewall: WG UDP handshake + peer-to-peer baseline (corrected)', () => {
  test('UDP allow rule is NOT bound to dcnet0 — scoped to external interface', () => {
    const text = compileRuleset({ ...BASE, externalInterface: 'eth0' });
    const udpLines = text.split('\n').filter((l) => l.includes('udp dport 51820'));
    expect(udpLines).toHaveLength(1);
    expect(udpLines[0]).toContain('iifname "eth0"');
    expect(udpLines[0]).not.toContain('dcnet0');
  });

  test('externalInterface null → unscoped UDP rule with comment', () => {
    const text = compileRuleset(BASE);
    const udpLines = text.split('\n').filter((l) => l.includes('udp dport 51820'));
    expect(udpLines).toHaveLength(1);
    expect(udpLines[0]).not.toContain('iifname');
    expect(udpLines[0]).toContain('external iface unspecified');
  });

  test('custom listen port honored', () => {
    const text = compileRuleset({ ...BASE, wgListenPort: 51821, externalInterface: 'ens3' });
    expect(text).toContain('iifname "ens3" udp dport 51821 accept');
  });

  test('peer-to-peer forwarding default-deny: oifname dcnet0 drop tail', () => {
    const text = compileRuleset(BASE);
    expect(text).toContain('oifname "dcnet0" drop');
    // and no accept rule that would let peer→peer through ahead of it
    const forward = text.split('chain forward {')[1].split('}')[0];
    expect(forward).not.toMatch(/oifname "dcnet0".*accept/);
  });

  test('hub-local resource lands in input chain; peer resource in forward chain', () => {
    const text = compileRuleset({
      ...BASE,
      accessMap: {
        grants: [{ principal: { type: 'person', id: 'alice' }, resource: 'nas', allowed: true }],
      },
    });
    const input = text.split('chain input {')[1].split('chain forward')[0];
    const forward = text.split('chain forward {')[1];
    expect(input).toContain('@net_dc_res_plex');
    expect(input).not.toContain('@net_dc_res_nas');
    expect(forward).toContain('@net_dc_res_nas');
    expect(forward).not.toContain('@net_dc_res_plex');
  });
});

// --------------------------------------------------------------------------
// Compiler: sanitization + guards
// --------------------------------------------------------------------------

describe('wg-firewall: sanitization and guards', () => {
  test("resource 'plex-2!' sanitizes to a safe set name", () => {
    expect(resourceSetName('plex-2!')).toBe('net_dc_res_plex_2');
    const text = compileRuleset({
      ...BASE,
      resources: { 'plex-2!': { ip: '10.53.0.1', port: 32400 } },
      accessMap: {
        grants: [{ principal: { type: 'person', id: 'alice' }, resource: 'plex-2!', allowed: true }],
      },
    });
    expect(text).toContain('set net_dc_res_plex_2 {');
    expect(text).toContain('@net_dc_res_plex_2');
    expect(text).toContain('ip saddr @net_dc_res_plex_2 ip daddr 10.53.0.1 tcp dport 32400 accept');
  });

  test('set-name collision between distinct resources throws', () => {
    expect(() =>
      compileRuleset({ ...BASE, resources: { 'plex 1': { ip: '10.53.0.1', port: 1 }, 'plex!1': { ip: '10.53.0.2', port: 2 } } })
    ).toThrow(/collision/);
  });

  test('admin lockout guard: zero resolvable admin peers throws', () => {
    expect(() => compileRuleset({ ...BASE, adminPeers: ['ghost'] })).toThrow(/lockout/);
  });

  test('invalid resource (missing ip / bad port) throws', () => {
    expect(() => compileRuleset({ ...BASE, resources: { x: { port: 80 } } })).toThrow(/ip required/);
    expect(() => compileRuleset({ ...BASE, resources: { x: { ip: '10.53.0.1', port: 0 } } })).toThrow(/port/);
  });
});

// --------------------------------------------------------------------------
// assertAdminIsolation
// --------------------------------------------------------------------------

describe('wg-firewall: assertAdminIsolation', () => {
  test('passes on a correctly compiled ruleset', () => {
    const text = compileRuleset(BASE);
    expect(assertAdminIsolation(text, { adminPeers: ['admin1'] })).toBe(true);
  });

  test('rejects an admin port allowed without the admin set', () => {
    const bad = 'iifname "dcnet0" tcp dport 22 accept';
    expect(() => assertAdminIsolation(bad)).toThrow(/without @net_dc_admins/);
  });

  test('rejects an admin port allowed from a resource set', () => {
    const bad = 'iifname "dcnet0" ip saddr @net_dc_res_plex tcp dport 3001 accept';
    expect(() => assertAdminIsolation(bad)).toThrow(/resource set/);
  });

  test('rejects an admin port allowed from a literal peer IP', () => {
    const bad = 'iifname "dcnet0" ip saddr 10.53.4.4 tcp dport 22 accept';
    expect(() => assertAdminIsolation(bad)).toThrow(/literal peer saddr/);
  });
});

// --------------------------------------------------------------------------
// Transactional applier (hermetic: mocked execFile + fs)
// --------------------------------------------------------------------------

function mockFs() {
  const files = new Map();
  return {
    files,
    writeFileSync: jest.fn((p, c) => files.set(p, c)),
    readFileSync: jest.fn((p) => {
      if (!files.has(p)) { const e = new Error('ENOENT'); e.code = 'ENOENT'; throw e; }
      return files.get(p);
    }),
    existsSync: jest.fn((p) => files.has(p)),
    unlinkSync: jest.fn((p) => files.delete(p)),
  };
}

/** execFile mock with a per-call script of behaviors keyed by args. */
function mockExec({ current = 'table inet dcnet { }', checkErr, applyErr, verifyOut } = {}) {
  const calls = [];
  const impl = async (cmd, args) => { // eslint-disable-line require-await -- scripted mock, no awaits by design
    calls.push({ cmd, args: [...args] });
    const joined = args.join(' ');
    if (joined.startsWith('-c -f')) {
      if (checkErr) {
        const e = new Error('check failed');
        e.stderr = 'syntax error near unexpected token';
        throw e;
      }
      return { stdout: '' };
    }
    if (joined.startsWith('-f')) {
      if (applyErr) {
        const e = new Error('apply failed');
        e.stderr = 'operation failed: Device or resource busy';
        throw e;
      }
      return { stdout: '' };
    }
    if (joined.startsWith('list table')) {
      if (verifyOut !== undefined) return { stdout: verifyOut };
      return { stdout: current };
    }
    return { stdout: '' };
  };
  return { impl, calls };
}

const RULESET = compileRuleset(BASE);
const RULESET2 = compileRuleset({
  ...BASE,
  accessMap: { grants: [{ principal: { type: 'person', id: 'bob' }, resource: 'plex', allowed: true }] },
});

describe('wg-firewall: transactional apply', () => {
  test('happy path: check → rollback write → apply → verify; temp cleaned up', async () => {
    const fs = mockFs();
    const { impl, calls } = mockExec();
    const applier = createWgFirewallApplier({
      execFileImpl: impl,
      fsImpl: fs,
      tempDir: '/tmp/x',
      rollbackPath: '/tmp/x/rollback.nft',
    });
    const res = await applier.apply(RULESET);
    expect(res.applied).toBe(true);
    expect(res.verified).toBe(true);
    // order: check(-c -f) before rollback write before apply(-f) before verify
    const checkIdx = calls.findIndex((c) => c.args[0] === '-c');
    const applyIdx = calls.findIndex((c) => c.args[0] === '-f');
    const listIdxs = calls.map((c, i) => (c.args[0] === 'list' ? i : -1)).filter((i) => i >= 0);
    expect(checkIdx).toBe(0);
    expect(applyIdx).toBeGreaterThan(checkIdx);
    // one `list` before apply (capture previous) + one after (verify)
    expect(listIdxs).toHaveLength(2);
    expect(listIdxs[0]).toBeLessThan(applyIdx);
    expect(listIdxs[1]).toBeGreaterThan(applyIdx);
    const writePaths = fs.writeFileSync.mock.calls.map((c) => c[0]);
    const tempWrites = writePaths.filter((p) => p !== '/tmp/x/rollback.nft');
    expect(tempWrites).toHaveLength(1);
    const tempPath = tempWrites[0];
    // write order: temp (for check) then rollback BEFORE the apply exec
    expect(writePaths).toEqual([tempPath, '/tmp/x/rollback.nft']);
    const applyCall = calls[applyIdx];
    expect(applyCall.args).toEqual(['-f', tempPath]);
    expect(applyCall.args[1]).not.toBe('/tmp/x/rollback.nft');
    // rollback file holds the PREVIOUS table dump
    expect(fs.readFileSync('/tmp/x/rollback.nft')).toBe('table inet dcnet { }');
    // temp file deleted at the end
    expect(fs.existsSync(tempPath)).toBe(false);
    expect(res.previousExisted).toBe(true);
  });

  test('check failure → no apply, temp deleted, FirewallCheckError with stderr', async () => {
    const fs = mockFs();
    const { impl, calls } = mockExec({ checkErr: true });
    const applier = createWgFirewallApplier({
      execFileImpl: impl, fsImpl: fs, tempDir: '/tmp/x', rollbackPath: '/tmp/x/rollback.nft',
    });
    await expect(applier.apply(RULESET)).rejects.toMatchObject({
      name: 'FirewallCheckError',
      code: 'check_failed',
      applied: false,
      stderr: expect.stringContaining('syntax error'),
    });
    // NOTHING applied: no bare `-f` run, no `nft list` verify, no rollback write
    expect(calls.filter((c) => c.args[0] === '-f')).toHaveLength(0);
    expect(calls.filter((c) => c.args[0] === 'list')).toHaveLength(0);
    expect(fs.writeFileSync).toHaveBeenCalledTimes(1); // only the temp file
    expect(fs.files.size).toBe(0); // temp deleted
  });

  test('apply failure → {applied:false} thrown, rollback file unchanged, old rules intact', async () => {
    const fs = mockFs();
    fs.files.set('/tmp/x/rollback.nft', 'PREVIOUS-ROLLBACK-CONTENT');
    const { impl, calls } = mockExec({ applyErr: true });
    const applier = createWgFirewallApplier({
      execFileImpl: impl, fsImpl: fs, tempDir: '/tmp/x', rollbackPath: '/tmp/x/rollback.nft',
    });
    await expect(applier.apply(RULESET)).rejects.toMatchObject({
      name: 'FirewallApplyError',
      applied: false,
    });
    // rollback file NOT overwritten by the failed apply (old rules intact)
    expect(fs.readFileSync('/tmp/x/rollback.nft')).toBe('PREVIOUS-ROLLBACK-CONTENT');
    // temp cleaned, only the rollback file remains
    expect(fs.files.size).toBe(1);
    // verify never reached: the only `nft -f` run is the failed apply —
    // no rollback re-apply, and exactly one `list` (the pre-apply capture)
    expect(calls.filter((c) => c.args[0] === '-f')).toHaveLength(1);
    expect(calls.filter((c) => c.args[0] === 'list')).toHaveLength(1);
  });

  test('verify mismatch → rollback attempted, verify error carries rolledBack', async () => {
    const fs = mockFs();
    const { impl, calls } = mockExec({ verifyOut: '' }); // list returns no table
    const applier = createWgFirewallApplier({
      execFileImpl: impl, fsImpl: fs, tempDir: '/tmp/x', rollbackPath: '/tmp/x/rollback.nft',
    });
    await expect(applier.apply(RULESET)).rejects.toMatchObject({
      name: 'FirewallVerifyError',
      code: 'verify_failed',
      rolledBack: true,
    });
    // last exec is the rollback `nft -f <rollbackFile>`
    const last = calls[calls.length - 1];
    expect(last.args).toEqual(['-f', '/tmp/x/rollback.nft']);
  });

  test('rollback() re-applies the previous ruleset file', async () => {
    const fs = mockFs();
    fs.files.set('/tmp/x/rollback.nft', 'table inet dcnet { OLD }');
    const { impl, calls } = mockExec();
    const applier = createWgFirewallApplier({
      execFileImpl: impl, fsImpl: fs, tempDir: '/tmp/x', rollbackPath: '/tmp/x/rollback.nft',
    });
    const res = await applier.rollback();
    expect(res.applied).toBe(true);
    expect(calls).toHaveLength(1);
    expect(calls[0].args).toEqual(['-f', '/tmp/x/rollback.nft']);
  });

  test('rollback() without a rollback file throws', async () => {
    const fs = mockFs();
    const { impl } = mockExec();
    const applier = createWgFirewallApplier({
      execFileImpl: impl, fsImpl: fs, tempDir: '/tmp/x', rollbackPath: '/tmp/x/rollback.nft',
    });
    await expect(applier.rollback()).rejects.toThrow(/no rollback file/);
  });

  test('two applies never share a temp path', async () => {
    const fs = mockFs();
    const { impl } = mockExec();
    const applier = createWgFirewallApplier({
      execFileImpl: impl, fsImpl: fs, tempDir: '/tmp/x', rollbackPath: '/tmp/x/rollback.nft',
    });
    const r1 = await applier.apply(RULESET);
    const r2 = await applier.apply(RULESET2);
    expect(r1.tempPath).not.toBe(r2.tempPath);
    expect(r1.tempPath).toMatch(/dcnet-nft-/);
    expect(r2.tempPath).toMatch(/dcnet-nft-/);
  });

  test('apply rejects empty/non-string ruleset before any I/O', async () => {
    const fs = mockFs();
    const { impl, calls } = mockExec();
    const applier = createWgFirewallApplier({ execFileImpl: impl, fsImpl: fs });
    await expect(applier.apply('')).rejects.toThrow(/non-empty/);
    expect(calls).toHaveLength(0);
    expect(fs.writeFileSync).not.toHaveBeenCalled();
  });

  test('FirewallCheckError is exported and distinguishable', () => {
    const e = new FirewallCheckError('x', { stderr: 's' });
    expect(e instanceof Error).toBe(true);
    expect(e.applied).toBe(false);
    expect(new FirewallApplyError('y').applied).toBe(false);
  });
});