// Copyright 2019 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#ifdef UNSAFE_BUFFERS_BUILD
// TODO(crbug.com/40285824): Remove this and convert code to safer constructs.
#pragma allow_unsafe_buffers
#endif

#include "chromeos/ash/components/dbus/kerberos/fake_kerberos_client.h"

#include <algorithm>
#include <utility>

#include "base/containers/contains.h"
#include "base/containers/span.h"
#include "base/files/file_util.h"
#include "base/functional/bind.h"
#include "base/location.h"
#include "base/strings/string_split.h"
#include "base/task/single_thread_task_runner.h"
#include "base/time/time.h"
#include "third_party/cros_system_api/dbus/kerberos/dbus-constants.h"

namespace ash {
namespace {

// Fake validity lifetime for TGTs.
constexpr base::TimeDelta kTgtValidity = base::Hours(10);

// Fake renewal lifetime for TGTs.
constexpr base::TimeDelta kTgtRenewal = base::Hours(24);

// Blocklist for fake config validation.
const char* const kBlocklistedConfigOptions[] = {
    "allow_weak_crypto",
    "ap_req_checksum_type",
    "ccache_type",
    "default_ccache_name ",
    "default_client_keytab_name",
    "default_keytab_name",
    "default_realm",
    "k5login_authoritative",
    "k5login_directory",
    "kdc_req_checksum_type",
    "plugin_base_dir",
    "realm_try_domains",
    "safe_checksum_type",
    "verify_ap_req_nofail",
    "default_domain",
    "v4_instance_convert",
    "v4_realm",
    "[appdefaults]",
    "[plugins]",
};

// Performs a fake validation of a config line by just checking for some
// non-allowlisted keywords. Returns true if no blocklisted items are contained.
bool ValidateConfigLine(const std::string& line) {
  for (const char* option : kBlocklistedConfigOptions) {
    if (base::Contains(line, option)) {
      return false;
    }
  }
  return true;
}

// Runs ValidateConfigLine() on every line of |krb5_config|. Returns a
// ConfigErrorInfo object that indicates the first line where validation fails,
// if any.
kerberos::ConfigErrorInfo ValidateConfigLines(const std::string& krb5_config) {
  std::vector<std::string> lines = base::SplitString(
      krb5_config, "\r\n", base::TRIM_WHITESPACE, base::SPLIT_WANT_ALL);
  for (size_t line_index = 0; line_index < lines.size(); ++line_index) {
    if (!ValidateConfigLine(lines[line_index])) {
      kerberos::ConfigErrorInfo error_info;
      error_info.set_code(kerberos::CONFIG_ERROR_KEY_NOT_SUPPORTED);
      error_info.set_line_index(static_cast<int>(line_index));
      return error_info;
    }
  }

  kerberos::ConfigErrorInfo error_info;
  error_info.set_code(kerberos::CONFIG_ERROR_NONE);
  return error_info;
}

// Posts |callback| on the current thread's task runner, passing it the
// |response| message.
template <class TProto>
void PostProtoResponse(base::OnceCallback<void(const TProto&)> callback,
                       const TProto& response,
                       base::TimeDelta delay) {
  base::SingleThreadTaskRunner::GetCurrentDefault()->PostDelayedTask(
      FROM_HERE, base::BindOnce(std::move(callback), response), delay);
}

// Similar to PostProtoResponse(), but posts |callback| with a proto containing
// only the given |error|.
template <class TProto>
void PostResponse(base::OnceCallback<void(const TProto&)> callback,
                  kerberos::ErrorType error,
                  base::TimeDelta delay) {
  TProto response;
  response.set_error(error);
  PostProtoResponse(std::move(callback), response, delay);
}

// Reads the password from the file descriptor |password_fd|.
// Not very efficient, but simple!
std::string ReadPassword(int password_fd) {
  std::string password;
  char c;
  while (base::ReadFromFD(password_fd, base::span_from_ref(c))) {
    password.push_back(c);
  }
  return password;
}

}  // namespace

FakeKerberosClient::FakeKerberosClient() = default;

FakeKerberosClient::~FakeKerberosClient() = default;

void FakeKerberosClient::AddAccount(const kerberos::AddAccountRequest& request,
                                    AddAccountCallback callback) {
  MaybeRecordFunctionCallForTesting(__FUNCTION__);
  auto it = std::ranges::find(accounts_, AccountData(request.principal_name()));
  if (it != accounts_.end()) {
    it->is_managed |= request.is_managed();
    PostResponse(std::move(callback), kerberos::ERROR_DUPLICATE_PRINCIPAL_NAME,
                 task_delay_);
    return;
  }

  AccountData data(request.principal_name());
  data.is_managed = request.is_managed();
  accounts_.push_back(data);
  PostResponse(std::move(callback), kerberos::ERROR_NONE, task_delay_);
}

void FakeKerberosClient::RemoveAccount(
    const kerberos::RemoveAccountRequest& request,
    RemoveAccountCallback callback) {
  MaybeRecordFunctionCallForTesting(__FUNCTION__);
  kerberos::RemoveAccountResponse response;
  auto it = std::ranges::find(accounts_, AccountData(request.principal_name()));
  if (it == accounts_.end()) {
    response.set_error(kerberos::ERROR_UNKNOWN_PRINCIPAL_NAME);
  } else {
    accounts_.erase(it);
    response.set_error(kerberos::ERROR_NONE);
  }

  MapAccountData(response.mutable_accounts());
  PostProtoResponse(std::move(callback), response, task_delay_);
}

void FakeKerberosClient::ClearAccounts(
    const kerberos::ClearAccountsRequest& request,
    ClearAccountsCallback callback) {
  MaybeRecordFunctionCallForTesting(__FUNCTION__);
  std::unordered_set<std::string> keep_list(
      request.principal_names_to_ignore_size());
  for (int n = 0; n < request.principal_names_to_ignore_size(); ++n)
    keep_list.insert(request.principal_names_to_ignore(n));

  for (auto it = accounts_.begin(); it != accounts_.end(); /* empty */) {
    if (base::Contains(keep_list, it->principal_name)) {
      ++it;
      continue;
    }

    switch (DetermineWhatToRemove(request.mode(), *it)) {
      case WhatToRemove::kNothing:
        ++it;
        continue;

      case WhatToRemove::kPassword:
        it->password.clear();
        ++it;
        continue;

      case WhatToRemove::kAccount:
        it = accounts_.erase(it);
        continue;
    }
  }

  kerberos::ClearAccountsResponse response;
  MapAccountData(response.mutable_accounts());
  response.set_error(kerberos::ERROR_NONE);
  PostProtoResponse(std::move(callback), response, task_delay_);
}

void FakeKerberosClient::ListAccounts(
    const kerberos::ListAccountsRequest& request,
    ListAccountsCallback callback) {
  MaybeRecordFunctionCallForTesting(__FUNCTION__);
  kerberos::ListAccountsResponse response;
  MapAccountData(response.mutable_accounts());
  response.set_error(kerberos::ERROR_NONE);
  PostProtoResponse(std::move(callback), response, task_delay_);
}

void FakeKerberosClient::SetConfig(const kerberos::SetConfigRequest& request,
                                   SetConfigCallback callback) {
  MaybeRecordFunctionCallForTesting(__FUNCTION__);
  AccountData* data = GetAccountData(request.principal_name());
  if (!data) {
    PostResponse(std::move(callback), kerberos::ERROR_UNKNOWN_PRINCIPAL_NAME,
                 task_delay_);
    return;
  }

  kerberos::ConfigErrorInfo error_info =
      ValidateConfigLines(request.krb5conf());
  if (error_info.code() != kerberos::CONFIG_ERROR_NONE) {
    PostResponse(std::move(callback), kerberos::ERROR_BAD_CONFIG, task_delay_);
    return;
  }

  data->krb5conf = request.krb5conf();
  PostResponse(std::move(callback), kerberos::ERROR_NONE, task_delay_);
}

void FakeKerberosClient::ValidateConfig(
    const kerberos::ValidateConfigRequest& request,
    ValidateConfigCallback callback) {
  MaybeRecordFunctionCallForTesting(__FUNCTION__);

  kerberos::ConfigErrorInfo error_info =
      ValidateConfigLines(request.krb5conf());
  kerberos::ValidateConfigResponse response;
  response.set_error(error_info.code() != kerberos::CONFIG_ERROR_NONE
                         ? kerberos::ERROR_BAD_CONFIG
                         : kerberos::ERROR_NONE);
  *response.mutable_error_info() = std::move(error_info);
  PostProtoResponse(std::move(callback), response, task_delay_);
}

void FakeKerberosClient::AcquireKerberosTgt(
    const kerberos::AcquireKerberosTgtRequest& request,
    int password_fd,
    AcquireKerberosTgtCallback callback) {
  MaybeRecordFunctionCallForTesting(__FUNCTION__);
  AccountData* data = GetAccountData(request.principal_name());
  if (!data) {
    PostResponse(std::move(callback), kerberos::ERROR_UNKNOWN_PRINCIPAL_NAME,
                 task_delay_);
    return;
  }

  // Remember whether to use the login password.
  data->use_login_password = request.use_login_password();

  std::string password;
  if (request.use_login_password()) {
    // "Retrieve" login password.
    password = "fake_login_password";

    // Erase a previously remembered password.
    data->password.clear();
  } else {
    // Remember password.
    password = ReadPassword(password_fd);
    if (!password.empty() && request.remember_password())
      data->password = password;

    // Use remembered password.
    if (password.empty())
      password = data->password;

    // Erase a previously remembered password.
    if (!request.remember_password())
      data->password.clear();
  }

  // Reject empty passwords.
  if (password.empty()) {
    PostResponse(std::move(callback), kerberos::ERROR_BAD_PASSWORD,
                 task_delay_);
    return;
  }

  if (simulated_number_of_network_failures_ > 0) {
    simulated_number_of_network_failures_--;
    PostResponse(std::move(callback), kerberos::ERROR_NETWORK_PROBLEM,
                 task_delay_);
    return;
  }

  // It worked! Magic!
  data->has_tgt = true;
  PostResponse(std::move(callback), kerberos::ERROR_NONE, task_delay_);
}

void FakeKerberosClient::GetKerberosFiles(
    const kerberos::GetKerberosFilesRequest& request,
    GetKerberosFilesCallback callback) {
  MaybeRecordFunctionCallForTesting(__FUNCTION__);
  AccountData* data = GetAccountData(request.principal_name());
  if (!data) {
    PostResponse(std::move(callback), kerberos::ERROR_UNKNOWN_PRINCIPAL_NAME,
                 task_delay_);
    return;
  }

  kerberos::GetKerberosFilesResponse response;
  if (data->has_tgt) {
    response.mutable_files()->set_krb5cc("Fake Kerberos credential cache");
    response.mutable_files()->set_krb5conf("Fake Kerberos configuration");
  }
  response.set_error(kerberos::ERROR_NONE);
  PostProtoResponse(std::move(callback), response, task_delay_);
}

base::CallbackListSubscription
FakeKerberosClient::SubscribeToKerberosFileChangedSignal(
    KerberosFilesChangedCallback callback) {
  MaybeRecordFunctionCallForTesting(__FUNCTION__);
  DCHECK(callback);
  return base::CallbackListSubscription();
}

base::CallbackListSubscription
FakeKerberosClient::SubscribeToKerberosTicketExpiringSignal(
    KerberosTicketExpiringCallback callback) {
  MaybeRecordFunctionCallForTesting(__FUNCTION__);
  DCHECK(callback);
  return base::CallbackListSubscription();
}

void FakeKerberosClient::SetTaskDelay(base::TimeDelta delay) {
  task_delay_ = delay;
}

void FakeKerberosClient::StartRecordingFunctionCalls() {
  DCHECK(!recorded_function_calls_);
  recorded_function_calls_ = std::string();
}

std::string FakeKerberosClient::StopRecordingAndGetRecordedFunctionCalls() {
  DCHECK(recorded_function_calls_);
  std::string result;
  recorded_function_calls_->swap(result);
  recorded_function_calls_.reset();
  return result;
}

std::size_t FakeKerberosClient::GetNumberOfAccounts() const {
  return accounts_.size();
}

void FakeKerberosClient::SetSimulatedNumberOfNetworkFailures(
    int number_of_failures) {
  simulated_number_of_network_failures_ = number_of_failures;
}

void FakeKerberosClient::MaybeRecordFunctionCallForTesting(
    const char* function_name) {
  if (!recorded_function_calls_)
    return;

  if (!recorded_function_calls_->empty())
    recorded_function_calls_->append(",");
  recorded_function_calls_->append(function_name);
}

KerberosClient::TestInterface* FakeKerberosClient::GetTestInterface() {
  return this;
}

FakeKerberosClient::AccountData* FakeKerberosClient::GetAccountData(
    const std::string& principal_name) {
  auto it = std::ranges::find(accounts_, AccountData(principal_name));
  return it != accounts_.end() ? &*it : nullptr;
}

FakeKerberosClient::AccountData::AccountData(const std::string& principal_name)
    : principal_name(principal_name) {}

FakeKerberosClient::AccountData::AccountData(const AccountData& other) =
    default;

FakeKerberosClient::AccountData& FakeKerberosClient::AccountData::operator=(
    const AccountData& other) = default;

bool FakeKerberosClient::AccountData::operator==(
    const AccountData& other) const {
  return principal_name == other.principal_name;
}

bool FakeKerberosClient::AccountData::operator!=(
    const AccountData& other) const {
  return !(*this == other);
}

void FakeKerberosClient::MapAccountData(RepeatedAccountField* accounts) {
  for (const AccountData& data : accounts_) {
    kerberos::Account* account = accounts->Add();
    account->set_principal_name(data.principal_name);
    account->set_krb5conf(data.krb5conf);
    account->set_tgt_validity_seconds(data.has_tgt ? kTgtValidity.InSeconds()
                                                   : 0);
    account->set_tgt_renewal_seconds(data.has_tgt ? kTgtRenewal.InSeconds()
                                                  : 0);
    account->set_is_managed(data.is_managed);
    account->set_password_was_remembered(!data.password.empty());
    account->set_use_login_password(data.use_login_password);
  }
}

// static
FakeKerberosClient::WhatToRemove FakeKerberosClient::DetermineWhatToRemove(
    kerberos::ClearMode mode,
    const AccountData& data) {
  switch (mode) {
    case kerberos::CLEAR_ALL:
      return WhatToRemove::kAccount;

    case kerberos::CLEAR_ONLY_MANAGED_ACCOUNTS:
      return data.is_managed ? WhatToRemove::kAccount : WhatToRemove::kNothing;

    case kerberos::CLEAR_ONLY_UNMANAGED_ACCOUNTS:
      return !data.is_managed ? WhatToRemove::kAccount : WhatToRemove::kNothing;

    case kerberos::CLEAR_ONLY_UNMANAGED_REMEMBERED_PASSWORDS:
      return !data.is_managed ? WhatToRemove::kPassword
                              : WhatToRemove::kNothing;
  }
  return WhatToRemove::kNothing;
}

}  // namespace ash