package brainfs

import (
	"errors"
	"io"
	"io/fs"
	"os"
	"path/filepath"
	"sync"
	"sync/atomic"
	"syscall"
	"testing"
	"time"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

// The handle check is what stops a FIFO swapped in after the Lstat. A FIFO
// with no writer reads EOF at once, so a race test could not see the check
// missing; here a writer holds the FIFO open, as any local process can, and
// readOpened must refuse it promptly (PR #161 review).
func TestReadOpenedRefusesAFIFOHeldOpenByAWriter(t *testing.T) {
	dir := t.TempDir()
	fifo := filepath.Join(dir, "p.md")
	require.NoError(t, syscall.Mkfifo(fifo, 0o644))
	w, err := os.OpenFile(fifo, os.O_RDWR, 0)
	require.NoError(t, err)
	defer func() { _ = w.Close() }()

	b, err := Open(dir)
	require.NoError(t, err)
	defer func() { _ = b.Close() }()

	done := make(chan error, 1)
	go func() { _, err := b.readOpened("p.md"); done <- err }()
	select {
	case err := <-done:
		assert.True(t, errors.Is(err, ErrNotRegular), "got %v", err)
	case <-time.After(2 * time.Second):
		t.Fatal("readOpened blocked on a FIFO with a writer")
	}
}

func TestReadRegularRefusesSymlinksAndReadsRegularFiles(t *testing.T) {
	dir := t.TempDir()
	require.NoError(t, os.WriteFile(filepath.Join(dir, "ok.md"), []byte("ok"), 0o644))
	outside := filepath.Join(t.TempDir(), "s.md")
	require.NoError(t, os.WriteFile(outside, []byte("secret"), 0o644))
	require.NoError(t, os.Symlink(outside, filepath.Join(dir, "link.md")))
	b, err := Open(dir)
	require.NoError(t, err)
	defer func() { _ = b.Close() }()
	got, err := b.ReadRegular("ok.md")
	require.NoError(t, err)
	assert.Equal(t, "ok", string(got))
	_, err = b.ReadRegular("link.md")
	assert.True(t, errors.Is(err, ErrNotRegular), "got %v", err)
	_, err = b.ReadRegular("../" + filepath.Base(outside))
	assert.Error(t, err)
}

func TestRelAcceptsPathsInsideAndRefusesEscapes(t *testing.T) {
	dir := t.TempDir()
	b, err := Open(dir)
	require.NoError(t, err)
	defer func() { _ = b.Close() }()
	for in, want := range map[string]string{
		filepath.Join(dir, "wiki", "x.md"): "wiki/x.md",
		filepath.Join(dir, "..foo", "x"):   "..foo/x",
		dir:                                ".",
	} {
		got, err := b.Rel(in)
		require.NoError(t, err, in)
		assert.Equal(t, want, got, in)
	}
	for _, bad := range []string{filepath.Join(dir, "..", "x"), dir + "-evil/x", "/etc/passwd", filepath.Join(dir, "wiki", "..", "..", "x")} {
		_, err := b.Rel(bad)
		assert.Error(t, err, bad)
	}
}

func TestWalkRegularYieldsOnlyRegularFiles(t *testing.T) {
	dir := t.TempDir()
	require.NoError(t, os.MkdirAll(filepath.Join(dir, "a"), 0o755))
	require.NoError(t, os.WriteFile(filepath.Join(dir, "a", "n.md"), []byte("n"), 0o644))
	require.NoError(t, os.Symlink(t.TempDir(), filepath.Join(dir, "a", "dirlink")))
	require.NoError(t, os.Symlink(filepath.Join(dir, "a", "n.md"), filepath.Join(dir, "a", "filelink.md")))
	require.NoError(t, syscall.Mkfifo(filepath.Join(dir, "a", "p.md"), 0o644))
	b, err := Open(dir)
	require.NoError(t, err)
	defer func() { _ = b.Close() }()
	var got []string
	require.NoError(t, b.WalkRegular(".", func(rel string) error { got = append(got, rel); return nil }, nil))
	assert.Equal(t, []string{"a/n.md"}, got)
}

func TestReadRegularMaxRefusesAFileOverTheLimit(t *testing.T) {
	dir := t.TempDir()
	require.NoError(t, os.WriteFile(filepath.Join(dir, "big.md"), make([]byte, 100), 0o644))
	b, err := Open(dir)
	require.NoError(t, err)
	defer func() { _ = b.Close() }()
	_, err = b.ReadRegularMax("big.md", 99)
	assert.True(t, errors.Is(err, ErrTooLarge), "got %v", err)
	got, err := b.ReadRegularMax("big.md", 100)
	require.NoError(t, err)
	assert.Len(t, got, 100)
}

func TestReadRegularMaxRefusesAndStopsReadingAFileThatGrowsPastTheLimit(t *testing.T) {
	dir := t.TempDir()
	p := filepath.Join(dir, "grow.md")
	require.NoError(t, os.WriteFile(p, make([]byte, 10), 0o644))
	consumed := &countingReader{}
	wrapAfterStat = func(r io.Reader) io.Reader {
		f, err := os.OpenFile(p, os.O_WRONLY|os.O_APPEND, 0)
		require.NoError(t, err)
		_, err = f.Write(make([]byte, 1000))
		require.NoError(t, err)
		require.NoError(t, f.Close())
		consumed.r = r
		return consumed
	}
	t.Cleanup(func() { wrapAfterStat = nil })
	b, err := Open(dir)
	require.NoError(t, err)
	defer func() { _ = b.Close() }()
	got, err := b.ReadRegularMax("grow.md", 100)
	assert.True(t, errors.Is(err, ErrTooLarge), "got %v", err)
	assert.Nil(t, got)
	assert.LessOrEqual(t, consumed.n, 101, "read past max+1 bytes")
}

type countingReader struct {
	r io.Reader
	n int
}

func (c *countingReader) Read(p []byte) (int, error) {
	n, err := c.r.Read(p)
	c.n += n
	return n, err
}

func TestLstatDoesNotFollowSymlinksAndRefusesEscapes(t *testing.T) {
	dir := t.TempDir()
	outside := filepath.Join(t.TempDir(), "o.md")
	require.NoError(t, os.WriteFile(outside, []byte("o"), 0o644))
	require.NoError(t, os.Symlink(outside, filepath.Join(dir, "l.md")))
	b, err := Open(dir)
	require.NoError(t, err)
	defer func() { _ = b.Close() }()
	fi, err := b.Lstat("l.md")
	require.NoError(t, err)
	assert.Equal(t, fs.ModeSymlink, fi.Mode().Type())
	_, err = b.Lstat("../" + filepath.Base(filepath.Dir(outside)) + "/o.md")
	assert.Error(t, err)
}

func TestWalkRegularReportsASymlinkedWalkRootAndYieldsNothing(t *testing.T) {
	dir := t.TempDir()
	require.NoError(t, os.MkdirAll(filepath.Join(dir, "real"), 0o755))
	require.NoError(t, os.WriteFile(filepath.Join(dir, "real", "n.md"), []byte("n"), 0o644))
	require.NoError(t, os.Symlink("real", filepath.Join(dir, "alias")))
	b, err := Open(dir)
	require.NoError(t, err)
	defer func() { _ = b.Close() }()
	var got []string
	var errs []error
	require.NoError(t, b.WalkRegular("alias", func(rel string) error { got = append(got, rel); return nil },
		func(_ string, err error) { errs = append(errs, err) }))
	assert.Empty(t, got)
	require.Len(t, errs, 1)
	assert.ErrorIs(t, errs[0], ErrNotRegular)
}

func TestWalkRegularReportsASymlinkedIntermediateComponentOfTheWalkRoot(t *testing.T) {
	dir := t.TempDir()
	require.NoError(t, os.MkdirAll(filepath.Join(dir, "real", "sub"), 0o755))
	require.NoError(t, os.WriteFile(filepath.Join(dir, "real", "sub", "n.md"), []byte("n"), 0o644))
	require.NoError(t, os.Symlink("real", filepath.Join(dir, "alias")))
	b, err := Open(dir)
	require.NoError(t, err)
	defer func() { _ = b.Close() }()
	var got []string
	var errs []error
	require.NoError(t, b.WalkRegular("alias/sub", func(rel string) error { got = append(got, rel); return nil },
		func(_ string, err error) { errs = append(errs, err) }))
	assert.Empty(t, got)
	require.Len(t, errs, 1)
	assert.ErrorIs(t, errs[0], ErrNotRegular)
}

func TestReadDirRegularListsOnlyRegularFilesAndRefusesSymlinkedComponents(t *testing.T) {
	dir := t.TempDir()
	require.NoError(t, os.MkdirAll(filepath.Join(dir, "a", "b", "sub"), 0o755))
	require.NoError(t, os.WriteFile(filepath.Join(dir, "a", "b", "n.md"), []byte("n"), 0o644))
	require.NoError(t, os.WriteFile(filepath.Join(dir, "other.md"), []byte("o"), 0o644))
	require.NoError(t, os.Symlink(filepath.Join("..", "..", "other.md"), filepath.Join(dir, "a", "b", "l.md")))
	require.NoError(t, syscall.Mkfifo(filepath.Join(dir, "a", "b", "f.md"), 0o644))
	require.NoError(t, os.Symlink("a", filepath.Join(dir, "alias")))
	require.NoError(t, os.MkdirAll(filepath.Join(dir, "x"), 0o755))
	require.NoError(t, os.Symlink(filepath.Join("..", "a"), filepath.Join(dir, "x", "mid")))
	b, err := Open(dir)
	require.NoError(t, err)
	defer func() { _ = b.Close() }()

	names, err := b.ReadDirRegular("a/b")
	require.NoError(t, err)
	assert.Equal(t, []string{"n.md"}, names)
	for _, rel := range []string{"alias/b", "x/mid/b"} {
		_, err := b.ReadDirRegular(rel)
		assert.ErrorIs(t, err, ErrNotRegular, rel)
	}
}

// A final component swapped for a symlink to another regular file in the
// brain between the Lstat and the open: os.Root follows in-root links, so
// only comparing the two (os.SameFile) refuses it.
func TestReadRegularNeverReturnsAnInBrainFileSwappedInBehindASymlink(t *testing.T) {
	dir := t.TempDir()
	require.NoError(t, os.WriteFile(filepath.Join(dir, "s.md"), []byte("zqsamefilesentinel"), 0o644))
	p := filepath.Join(dir, "r.md")
	require.NoError(t, os.WriteFile(p, []byte("inside"), 0o644))
	b, err := Open(dir)
	require.NoError(t, err)
	defer func() { _ = b.Close() }()

	var stop atomic.Bool
	var wg sync.WaitGroup
	wg.Add(1)
	go func() {
		defer wg.Done()
		tmp := p + ".swap"
		for i := 0; !stop.Load(); i++ {
			_ = os.Remove(tmp)
			if i%2 == 0 {
				_ = os.WriteFile(tmp, []byte("inside"), 0o644)
			} else {
				_ = os.Symlink("s.md", tmp)
			}
			_ = os.Rename(tmp, p)
		}
	}()
	leaks, ok := 0, 0
	for deadline := time.Now().Add(1500 * time.Millisecond); time.Now().Before(deadline); {
		got, err := b.ReadRegular("r.md")
		if err == nil {
			ok++
		}
		if string(got) == "zqsamefilesentinel" {
			leaks++
		}
		got, _ = b.ReadRegularMax("r.md", 1<<20)
		if string(got) == "zqsamefilesentinel" {
			leaks++
		}
	}
	stop.Store(true)
	wg.Wait()
	assert.Zero(t, leaks)
	assert.Positive(t, ok, "positive control: the regular file is read")
}

func TestWriteRegularRefusesFinalSymlinksFIFOsEscapesAndMissingFilesAndRewritesRegularFiles(t *testing.T) {
	dir := t.TempDir()
	outside := filepath.Join(t.TempDir(), "o.md")
	require.NoError(t, os.WriteFile(outside, []byte("untouched"), 0o644))
	require.NoError(t, os.Symlink(outside, filepath.Join(dir, "l.md")))
	require.NoError(t, syscall.Mkfifo(filepath.Join(dir, "f.md"), 0o644))
	require.NoError(t, os.WriteFile(filepath.Join(dir, "n.md"), []byte("old content"), 0o644))
	b, err := Open(dir)
	require.NoError(t, err)
	defer func() { _ = b.Close() }()

	assert.Error(t, b.WriteRegular("l.md", []byte("x")))
	got, _ := os.ReadFile(outside)
	assert.Equal(t, "untouched", string(got))

	// A symlink to another file inside the brain: os.Root would allow it,
	// only O_NOFOLLOW refuses it.
	require.NoError(t, os.WriteFile(filepath.Join(dir, "in.md"), []byte("inside"), 0o644))
	require.NoError(t, os.Symlink("in.md", filepath.Join(dir, "il.md")))
	assert.Error(t, b.WriteRegular("il.md", []byte("x")))
	got, _ = os.ReadFile(filepath.Join(dir, "in.md"))
	assert.Equal(t, "inside", string(got))

	// A reader held open, so a non-blocking write open would succeed. The
	// Lstat type check refuses the FIFO first; the handle check and
	// O_NONBLOCK matter only if it is swapped in after the Lstat.
	r, err := os.OpenFile(filepath.Join(dir, "f.md"), os.O_RDONLY|syscall.O_NONBLOCK, 0)
	require.NoError(t, err)
	defer func() { _ = r.Close() }()
	done := make(chan error, 1)
	go func() { done <- b.WriteRegular("f.md", []byte("x")) }()
	select {
	case err := <-done:
		assert.Error(t, err)
	case <-time.After(3 * time.Second):
		t.Fatal("WriteRegular hung on a FIFO")
	}

	assert.Error(t, b.WriteRegular("../"+filepath.Base(filepath.Dir(outside))+"/o.md", []byte("x")))
	assert.Error(t, b.WriteRegular("missing.md", []byte("x")), "does not create files")

	require.NoError(t, b.WriteRegular("n.md", []byte("new")))
	got, _ = os.ReadFile(filepath.Join(dir, "n.md"))
	assert.Equal(t, "new", string(got), "truncated and rewritten")
}

func TestReadDirDirsListsOnlyRealSubdirsAndRefusesSymlinkedComponents(t *testing.T) {
	dir := t.TempDir()
	require.NoError(t, os.MkdirAll(filepath.Join(dir, "a", "real"), 0o755))
	require.NoError(t, os.MkdirAll(filepath.Join(dir, "other"), 0o755))
	require.NoError(t, os.Symlink(filepath.Join("..", "other"), filepath.Join(dir, "a", "linked")))
	require.NoError(t, os.WriteFile(filepath.Join(dir, "a", "f.md"), []byte("f"), 0o644))
	require.NoError(t, os.Symlink("a", filepath.Join(dir, "alias")))
	b, err := Open(dir)
	require.NoError(t, err)
	defer func() { _ = b.Close() }()

	names, err := b.ReadDirDirs("a")
	require.NoError(t, err)
	assert.Equal(t, []string{"real"}, names)
	_, err = b.ReadDirDirs("alias")
	assert.ErrorIs(t, err, ErrNotRegular)
}

// hyperguild#173: a file reached through a symlinked directory inside the
// brain is refused for reads and writes, so a caller-supplied path cannot be
// redirected to another part of the brain.
func TestReadAndWriteRegularRefuseAFileBehindASymlinkedDirectory(t *testing.T) {
	dir := t.TempDir()
	require.NoError(t, os.MkdirAll(filepath.Join(dir, "raw"), 0o755))
	require.NoError(t, os.WriteFile(filepath.Join(dir, "raw", "v.md"), []byte("untouched"), 0o644))
	require.NoError(t, os.MkdirAll(filepath.Join(dir, "wiki"), 0o755))
	require.NoError(t, os.Symlink(filepath.Join("..", "raw"), filepath.Join(dir, "wiki", "alias")))
	b, err := Open(dir)
	require.NoError(t, err)
	defer func() { _ = b.Close() }()

	_, err = b.ReadRegular("wiki/alias/v.md")
	assert.ErrorIs(t, err, ErrNotRegular)
	_, err = b.ReadRegularMax("wiki/alias/v.md", 100)
	assert.ErrorIs(t, err, ErrNotRegular)
	assert.ErrorIs(t, b.WriteRegular("wiki/alias/v.md", []byte("x")), ErrNotRegular)
	got, _ := os.ReadFile(filepath.Join(dir, "raw", "v.md"))
	assert.Equal(t, "untouched", string(got))
	got, err = b.ReadRegular("raw/v.md")
	require.NoError(t, err, "positive control: the real path still reads")
	assert.Equal(t, "untouched", string(got))
}