<?php
declare(strict_types=1);

test('mx helper conditionally passes user ip binding to da login-url', function (): void {
    $bin = TEST_TMP . '/fake-da';
    $log = TEST_TMP . '/fake-da.log';
    $audit = TEST_TMP . '/audit.log';
    $state = TEST_TMP . '/state';

    test_write($bin, "#!/bin/sh\nprintf '%s\\n' \"$@\" >> " . escapeshellarg($log) . "\necho 'URL: https://mx1.domena.pl:2222/api/login/url?key=SECRET'\n");
    chmod($bin, 0755);

    $script = PLUGIN_ROOT . '/mx-helper/mail-login-authorized-command.sh';
    $cmd = sprintf(
        'MAIL_LOGIN_DA_BIN=%s MAIL_LOGIN_AUDIT_LOG=%s MAIL_LOGIN_STATE_DIR=%s MAIL_LOGIN_ALLOWED_SOURCE_HOSTS=%s %s %s',
        escapeshellarg($bin),
        escapeshellarg($audit),
        escapeshellarg($state),
        escapeshellarg('h4.domena.pl'),
        escapeshellarg($script),
        'mail-login-create-url mxtest h4.domena.pl h4 30 1 198.51.100.10 / 1782810000'
    );
    exec($cmd, $out, $code);
    assert_same(0, $code, implode("\n", $out));
    assert_contains('--ip=198.51.100.10', file_get_contents($log) ?: '');
    assert_contains('autologin-h4-mxtest-', file_get_contents($audit) ?: '');

    file_put_contents($log, '');
    $cmdNoIp = sprintf(
        'MAIL_LOGIN_DA_BIN=%s MAIL_LOGIN_AUDIT_LOG=%s MAIL_LOGIN_STATE_DIR=%s MAIL_LOGIN_ALLOWED_SOURCE_HOSTS=%s %s %s',
        escapeshellarg($bin),
        escapeshellarg($audit),
        escapeshellarg($state),
        escapeshellarg('h4.domena.pl'),
        escapeshellarg($script),
        'mail-login-create-url mxtest h4.domena.pl h4 30 0 198.51.100.10 / 1782810001'
    );
    exec($cmdNoIp, $outNoIp, $codeNoIp);
    assert_same(0, $codeNoIp, implode("\n", $outNoIp));
    assert_not_contains('--ip=', file_get_contents($log) ?: '');
    assert_contains('ip_bound_disabled', file_get_contents($audit) ?: '');
});

test('mx helper accepts forced command arguments from ssh original command', function (): void {
    $bin = TEST_TMP . '/fake-da-original';
    $log = TEST_TMP . '/fake-da-original.log';
    $audit = TEST_TMP . '/audit-original.log';
    $state = TEST_TMP . '/state-original';

    test_write($bin, "#!/bin/sh\nprintf '%s\\n' \"$@\" >> " . escapeshellarg($log) . "\necho 'URL: https://mx1.domena.pl:2222/api/login/url?key=SECRET'\n");
    chmod($bin, 0755);

    $script = PLUGIN_ROOT . '/mx-helper/mail-login-authorized-command.sh';
    $cmd = sprintf(
        'MAIL_LOGIN_DA_BIN=%s MAIL_LOGIN_AUDIT_LOG=%s MAIL_LOGIN_STATE_DIR=%s MAIL_LOGIN_ALLOWED_SOURCE_HOSTS=%s SSH_ORIGINAL_COMMAND=%s %s',
        escapeshellarg($bin),
        escapeshellarg($audit),
        escapeshellarg($state),
        escapeshellarg('h4.domena.pl'),
        escapeshellarg('mail-login-create-url mxtest h4.domena.pl evil 30 1 198.51.100.10 / 1782810002'),
        escapeshellarg($script)
    );
    exec($cmd, $out, $code);

    assert_same(0, $code, implode("\n", $out));
    assert_contains('--user=mxtest', file_get_contents($log) ?: '');
    assert_contains('autologin-h4-mxtest-', file_get_contents($audit) ?: '');
    assert_not_contains('autologin-evil-mxtest-', file_get_contents($audit) ?: '');
});

test('mx helper rejects disallowed source hosts and invalid client ips', function (): void {
    $bin = TEST_TMP . '/fake-da-reject';
    $audit = TEST_TMP . '/audit-reject.log';
    $state = TEST_TMP . '/state-reject';
    test_write($bin, "#!/bin/sh\necho 'URL: https://mx1.domena.pl:2222/api/login/url?key=SECRET'\n");
    chmod($bin, 0755);
    $script = PLUGIN_ROOT . '/mx-helper/mail-login-authorized-command.sh';

    $badHost = sprintf(
        'MAIL_LOGIN_DA_BIN=%s MAIL_LOGIN_AUDIT_LOG=%s MAIL_LOGIN_STATE_DIR=%s MAIL_LOGIN_ALLOWED_SOURCE_HOSTS=%s %s %s 2>/dev/null',
        escapeshellarg($bin),
        escapeshellarg($audit),
        escapeshellarg($state),
        escapeshellarg('h4.domena.pl'),
        escapeshellarg($script),
        'mail-login-create-url mxtest evil.domena.pl evil 30 1 198.51.100.10 / 1782810003'
    );
    exec($badHost, $outHost, $codeHost);
    assert_same(1, $codeHost);

    $badIp = sprintf(
        'MAIL_LOGIN_DA_BIN=%s MAIL_LOGIN_AUDIT_LOG=%s MAIL_LOGIN_STATE_DIR=%s MAIL_LOGIN_ALLOWED_SOURCE_HOSTS=%s %s %s 2>/dev/null',
        escapeshellarg($bin),
        escapeshellarg($audit),
        escapeshellarg($state),
        escapeshellarg('h4.domena.pl'),
        escapeshellarg($script),
        'mail-login-create-url mxtest h4.domena.pl h4 30 1 999.999.999.999 / 1782810004'
    );
    exec($badIp, $outIp, $codeIp);
    assert_same(1, $codeIp);
    assert_not_contains("\nBROKEN", file_get_contents($audit) ?: '');
});