// Copyright 2023 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "chrome/browser/ash/bruschetta/bruschetta_download.h"

#include "base/files/file_util.h"
#include "base/run_loop.h"
#include "base/strings/string_util.h"
#include "base/test/test_future.h"
#include "base/threading/thread_restrictions.h"
#include "chrome/browser/browser_process.h"
#include "chrome/browser/content_settings/host_content_settings_map_factory.h"
#include "chrome/browser/net/profile_network_context_service.h"
#include "chrome/browser/net/profile_network_context_service_factory.h"
#include "chrome/browser/profiles/profile.h"
#include "chrome/browser/ui/browser.h"
#include "chrome/test/base/in_process_browser_test.h"
#include "content/public/test/browser_test.h"
#include "net/dns/mock_host_resolver.h"
#include "net/ssl/client_cert_identity_test_util.h"
#include "net/ssl/client_cert_store.h"
#include "net/test/embedded_test_server/embedded_test_server.h"
#include "net/test/test_data_directory.h"
#include "testing/gtest/include/gtest/gtest.h"

namespace bruschetta {
namespace {

class BruschettaDownloadBrowserTest : public InProcessBrowserTest {};

class BruschettaHttpsDownloadBrowserTest
    : public BruschettaDownloadBrowserTest {
 public:
  BruschettaHttpsDownloadBrowserTest() = default;
  ~BruschettaHttpsDownloadBrowserTest() override = default;

  BruschettaHttpsDownloadBrowserTest(
      const BruschettaHttpsDownloadBrowserTest&) = delete;
  BruschettaHttpsDownloadBrowserTest& operator=(
      const BruschettaHttpsDownloadBrowserTest&) = delete;

 protected:
  void SetUpInProcessBrowserTestFixture() override {
    BruschettaDownloadBrowserTest::SetUpInProcessBrowserTestFixture();

    // Set up the test server, with the download URL and to require SSL cert.
    net::SSLServerConfig ssl_config;
    ssl_config.client_cert_type =
        net::SSLServerConfig::ClientCertType::REQUIRE_CLIENT_CERT;
    server_.SetSSLConfig(net::EmbeddedTestServer::CERT_OK, ssl_config);
    server_.ServeFilesFromSourceDirectory("chrome/test/data/bruschetta");
    server_handle_ = server_.StartAndReturnHandle();
    ASSERT_TRUE(server_handle_);
    url_ = server_.GetURL("/download_file.img");
  }

  void SetUpOnMainThread() override {
    host_resolver()->AddRule("*", "127.0.0.1");

    // Add an entry into AutoSelectCertificateForUrls policy for automatic
    // client cert selection.
    content::WebContents* tab =
        browser()->tab_strip_model()->GetActiveWebContents();
    Profile* profile = Profile::FromBrowserContext(tab->GetBrowserContext());
    DCHECK(profile);
    base::Value::List filters;
    filters.Append(base::Value::Dict());
    base::Value::Dict setting;
    setting.Set("filters", std::move(filters));
    HostContentSettingsMapFactory::GetForProfile(profile)
        ->SetWebsiteSettingDefaultScope(
            url_, GURL(), ContentSettingsType::AUTO_SELECT_CERTIFICATE,
            base::Value(std::move(setting)));
  }

  net::EmbeddedTestServer server_{net::EmbeddedTestServer::TYPE_HTTPS};
  net::test_server::EmbeddedTestServerHandle server_handle_;
  GURL url_;
};

bool PathExistsBlockingAllowed(const base::FilePath& path) {
  base::ScopedAllowBlockingForTesting allow_blocking;
  return base::PathExists(path);
}

// A stub ClientCertStore which returns the list of client certs it was
// initialised with.
class StubClientCertStore : public net::ClientCertStore {
 public:
  explicit StubClientCertStore(net::ClientCertIdentityList list)
      : list_(std::move(list)) {}

  ~StubClientCertStore() override = default;

  // net::ClientCertStore override.
  void GetClientCerts(
      scoped_refptr<const net::SSLCertRequestInfo> cert_request_info,
      ClientCertListCallback callback) override {
    std::move(callback).Run(std::move(list_));
  }

 private:
  net::ClientCertIdentityList list_;
};

// Creates a stub client cert store which returns a single test certificate.
std::unique_ptr<net::ClientCertStore> CreateStubClientCertStore() {
  base::FilePath certs_dir = net::GetTestCertsDirectory();

  net::ClientCertIdentityList cert_identity_list;
  base::ScopedAllowBlockingForTesting allow_blocking;
  std::unique_ptr<net::FakeClientCertIdentity> cert_identity =
      net::FakeClientCertIdentity::CreateFromCertAndKeyFiles(
          certs_dir, "client_1.pem", "client_1.pk8");
  EXPECT_TRUE(cert_identity.get());
  if (cert_identity) {
    cert_identity_list.push_back(std::move(cert_identity));
  }

  return std::unique_ptr<net::ClientCertStore>(
      new StubClientCertStore(std::move(cert_identity_list)));
}

std::unique_ptr<net::ClientCertStore> CreateEmptyClientCertStore() {
  return std::unique_ptr<net::ClientCertStore>(new StubClientCertStore({}));
}

// Tests that we get an empty path and hash for a network error (in this case
// a bad URL).
IN_PROC_BROWSER_TEST_F(BruschettaHttpsDownloadBrowserTest,
                       TestDownloadUrlNotFound) {
  base::test::TestFuture<base::FilePath, std::string> future;
  auto download = std::make_unique<SimpleURLLoaderDownload>(
      *g_browser_process->local_state());
  download->StartDownload(browser()->profile(), GURL("bad url"),
                          future.GetCallback());

  auto path = future.Get<base::FilePath>();
  auto hash = future.Get<std::string>();

  ASSERT_TRUE(path.empty());
  EXPECT_EQ(hash, "");
}

// Tests that the `url_` is downloaded successfully.
// Because the `server_` is configured to require a client certificate
// this involves selecting a client certificate using the auto-selection
// setting configured in `SetUpOnMainThread`
IN_PROC_BROWSER_TEST_F(BruschettaHttpsDownloadBrowserTest, TestHappyPath) {
  const auto kExpectedHash = base::ToUpperASCII(
      "f54d00e6d24844ee3b1d0d8c2b9d2ed80b967e94eb1055bb1fd43eb9522908cc");

  // Make the browser use the ClientCertStoreStub instead of the regular one.
  ProfileNetworkContextServiceFactory::GetForContext(browser()->profile())
      ->set_client_cert_store_factory_for_testing(
          base::BindRepeating(&CreateStubClientCertStore));

  base::test::TestFuture<base::FilePath, std::string> future;
  auto download = std::make_unique<SimpleURLLoaderDownload>(
      *g_browser_process->local_state());
  download->StartDownload(browser()->profile(), url_, future.GetCallback());

  auto path = future.Get<base::FilePath>();
  auto hash = future.Get<std::string>();

  ASSERT_FALSE(path.empty());
  EXPECT_EQ(hash, kExpectedHash);

  // Deleting the download should clean up downloaded files. I found
  // RunUntilIdle to be flaky hence we have an explicit callback for after
  // deletion completes.
  base::RunLoop run_loop;
  download->SetPostDeletionCallbackForTesting(run_loop.QuitClosure());
  download.reset();
  run_loop.Run();
  EXPECT_FALSE(PathExistsBlockingAllowed(path));
}

// Tests downloading from url_, which requires an SSL cert for auth, when the
// cert isn't available. This should fail and signal that by returning an empty
// path.
IN_PROC_BROWSER_TEST_F(BruschettaHttpsDownloadBrowserTest,
                       TestDownloadNoMatchingCert) {
  // Make the browser use an empty client cert store
  ProfileNetworkContextServiceFactory::GetForContext(browser()->profile())
      ->set_client_cert_store_factory_for_testing(
          base::BindRepeating(&CreateEmptyClientCertStore));

  base::test::TestFuture<base::FilePath, std::string> future;
  auto download = std::make_unique<SimpleURLLoaderDownload>(
      *g_browser_process->local_state());
  download->StartDownload(browser()->profile(), url_, future.GetCallback());

  auto path = future.Get<base::FilePath>();
  auto hash = future.Get<std::string>();

  ASSERT_TRUE(path.empty());
}

}  // namespace
}  // namespace bruschetta