#!/usr/bin/env bash
# logwisp browser login test: an http sink in proxy mode behind a TLS-terminating
# reverse proxy that mounts it under /logs/; headless Chromium signs in through
# the shipped pages, with cookies and without (token mode); the CLI unbound; an
# open sink's viewer streams with no login on a page the browser holds insecure.
# Requires: bash 5+, go, openssl, curl; node with playwright and both builds
# `playwright install chromium` fetches, or the browser checks skip.

set -u
. "$(dirname -- "${BASH_SOURCE[0]}")/lib.sh"

RUN=$E2E_DIR/run-proxy
PKI=$RUN/pki
AUTH=$RUN/auth
PROXY_SRC=$RUN/proxy
USERS=$AUTH/users.toml
PORT_PROXY=15831 # the site: TLS ends here, logwisp is under /logs/
PORT_SINK=15832  # logwisp http sink, plaintext, only for 127.0.0.2
PORT_OPEN=15833  # logwisp http sink without auth
PROXY_ADDR=127.0.0.2
SITE="https://127.0.0.1:$PORT_PROXY"
e2e_init "$@"

section "Setup"
need go openssl curl
ports_free $PORT_PROXY $PORT_SINK $PORT_OPEN
# The launch each scenario makes: the module resolves without its browsers, and
# chromium.executablePath() names full Chromium, not the default headless shell
launches() { timeout 60 node -e 'require("playwright").chromium.launch(JSON.parse(process.argv[1])).then((b) => b.close())' "$1" >/dev/null 2>&1; }
BROWSER=0 FULL_CHROMIUM=0
if command -v node >/dev/null; then
	launches '{}' && BROWSER=1
	launches '{"channel": "chromium"}' && FULL_CHROMIUM=1
fi
rm -rf "$RUN"
mkdir -p "$CONF" "$LOG" "$PKI" "$AUTH" "$PROXY_SRC"

# The site's certificate; logwisp holds none
pki_ca
pki_leaf site site.internal serverAuth "IP:127.0.0.1"
info "site certificate in $(short "$PKI")/"

# The default 64 MiB Argon2 profile, as a deployment would have
add_users "$USERS" viewer-01
info "user viewer-01 in $(short "$USERS")"

# /logs/ forwards to logwisp from $PROXY_ADDR; /plain/ forwards the same way
# but says the site was reached over http, which logwisp must refuse.
cat >"$PROXY_SRC/main.go" <<'EOF'
package main

import (
	"log"
	"net"
	"net/http"
	"net/http/httputil"
	"net/url"
	"os"
	"strings"
)

func main() {
	listen, upstream, from, cert, key := os.Args[1], os.Args[2], os.Args[3], os.Args[4], os.Args[5]
	target, err := url.Parse(upstream)
	if err != nil {
		log.Fatal(err)
	}
	dialer := &net.Dialer{LocalAddr: &net.TCPAddr{IP: net.ParseIP(from)}}
	transport := &http.Transport{DialContext: dialer.DialContext}
	route := func(prefix, proto string) http.Handler {
		return &httputil.ReverseProxy{
			Rewrite: func(r *httputil.ProxyRequest) {
				r.SetURL(target)
				r.Out.URL.Path = "/" + strings.TrimPrefix(r.In.URL.Path, prefix)
				r.Out.URL.RawPath = ""
				r.SetXForwarded()
				r.Out.Header.Set("X-Forwarded-Proto", proto)
			},
			Transport:     transport,
			FlushInterval: -1, // server-sent events
		}
	}
	mux := http.NewServeMux()
	mux.Handle("/logs/", route("/logs/", "https"))
	mux.Handle("/plain/", route("/plain/", "http"))
	log.Fatal(http.ListenAndServeTLS(listen, cert, key, mux))
}
EOF
if ! (cd "$PROXY_SRC" && go build -o proxy main.go) >"$LOG/proxy-build.out" 2>&1; then
	tail -n 5 "$LOG/proxy-build.out" | sed 's/^/        /'
	abort "the reverse proxy did not build"
fi
info "reverse proxy built in $(short "$PROXY_SRC")/"

cat >"$CONF/logwisp.toml" <<EOF
status_reporter = false
[logging]
output = "stdout"
level = "info"

[[pipelines]]
name = "site"
[[pipelines.plugin_sources]]
id = "rand"
type = "random"
[pipelines.plugin_sources.config]
interval_ms = 200
format = "txt"
length = 24

[[pipelines.plugin_sinks]]
id = "web"
type = "http"
[pipelines.plugin_sinks.config]
host = "127.0.0.1"
port = $PORT_SINK
login_page = true
viewer_page = true
[pipelines.plugin_sinks.config.auth]
type = "scram"
credentials_file = "$USERS"
trusted_proxies = ["$PROXY_ADDR"]

[[pipelines.plugin_sinks]]
id = "open"
type = "http"
[pipelines.plugin_sinks.config]
host = "127.0.0.1"
port = $PORT_OPEN
EOF

cat >"$RUN/browser.cjs" <<'EOF'
// Signs in through the shipped pages, as a person would; prints key=value lines.
// cookie: a fresh browser. dropped: the session cookie never arrives. blocked:
// a profile that refuses every cookie; it also reloads logwisp (pid) mid-stream.
const { chromium } = require("playwright");
const fs = require("fs");
const [mode, base, user, passFile, profile, pid] = process.argv.slice(2);
const password = fs.readFileSync(passFile, "utf8").replace(/\n+$/, "");
const out = { csp_violations: 0 };

const lines = (page) => page.evaluate(() => document.querySelectorAll("#log > div").length);
const linesAtLeast = (page, n) =>
  page.waitForFunction((n) => document.querySelectorAll("#log > div").length >= n, n, { timeout: 15000 });
const statusText = (page) => page.evaluate(() => document.getElementById("status").textContent);
const statusIs = (page, re) =>
  page.waitForFunction((re) => new RegExp(re).test(document.getElementById("status").textContent), re.source, { timeout: 30000 });
const signIn = async (page, pass) => {
  await page.fill('#login input[name="username"]', user);
  await page.fill('#login input[name="password"]', pass);
  await page.click('#login button[type="submit"]');
};
// The viewer's own form: the login page has a visible #login too, but no #log
const inlineLogin = (page) => page.waitForFunction(() =>
  document.getElementById("log") && !document.getElementById("login").hidden, null, { timeout: 30000 });

const scenarios = {
  async cookie(context, page) {
    await page.goto(base);
    await page.waitForURL(/\/auth\/login\?next=view%23signed-in$/, { timeout: 10000 });
    out.redirected_to_login = 1;
    await signIn(page, "not-the-password");
    await statusIs(page, /refused/);
    out.wrong_password_refused = 1;

    const started = Date.now();
    await signIn(page, password);
    await page.waitForURL(/\/auth\/view$/, { timeout: 30000 }).catch(async (e) => { throw new Error(`${e.message}: ${await statusText(page)}`); });
    out.login_ms = Date.now() - started;
    await linesAtLeast(page, 3);
    out.events = await lines(page);
    out.inline_login = await page.evaluate(() => !document.getElementById("login").hidden);

    const c = (await context.cookies()).find((c) => c.name === "logwisp_session");
    out.cookie = c ? `path=${c.path};httponly=${c.httpOnly};secure=${c.secure};samesite=${c.sameSite}` : "none";
    out.document_cookie = JSON.stringify(await page.evaluate(() => document.cookie));

    await page.click("#logout");
    await page.waitForURL(/\/auth\/login$/, { timeout: 10000 });
    out.cookie_after_logout = (await context.cookies()).some((c) => c.name === "logwisp_session") ? 1 : 0;
    out.status_after_logout = await page.evaluate(async (b) => (await fetch(b + "status")).status, base);
  },

  // As if the browser dropped the cookie silently: the viewer must not send
  // the person back to the login page in a loop
  async dropped(context, page) {
    await context.route(/\/auth$/, async (route) => {
      const response = await route.fetch();
      await context.clearCookies(); // route.fetch shares the context's cookie jar
      const headers = response.headers();
      delete headers["set-cookie"];
      await route.fulfill({ response, headers });
    });
    await page.goto(base + "auth/view");
    await page.waitForURL(/\/auth\/login\?next=/, { timeout: 10000 });
    await signIn(page, password);
    await page.waitForURL(/\/auth\/view$/, { timeout: 30000 });
    await inlineLogin(page);
    out.inline_login = 1;
    const streamed = page.waitForRequest(/\/stream$/, { timeout: 30000 });
    await signIn(page, password);
    const token = ((await streamed).headers().authorization ?? "").replace(/^Bearer /, "");
    await page.waitForFunction(() => document.getElementById("state").textContent === "live", null, { timeout: 30000 });
    out.token_in_page_only = await page.evaluate((t) => t !== "" && localStorage.length === 0 &&
      sessionStorage.length === 0 && !location.href.includes(t) && !document.cookie.includes(t), token) ? 1 : 0;
  },

  async blocked(context, page) {
    out.proofs = out.proofs_with_session = 0;
    page.on("request", (r) => {
      const body = r.method() === "POST" && /\/auth$/.test(r.url()) ? JSON.parse(r.postData() ?? "{}") : {};
      if (body.proof) out.proofs++;
      if (body.proof && "session" in body) out.proofs_with_session++;
    });
    await page.goto(base + "auth/login");
    out.cookie_enabled = await page.evaluate(() => navigator.cookieEnabled);
    out.document_cookie_kept = JSON.stringify(await page.evaluate(() => { document.cookie = "t=1"; return document.cookie; }));
    await page.waitForSelector('#status a[href="view"]', { timeout: 10000 });
    out.login_page_disabled = await page.evaluate(() => document.querySelector("#login button").disabled);
    await page.click('#status a[href="view"]');
    await inlineLogin(page);
    out.inline_login = 1;

    const streamed = page.waitForRequest(/\/stream$/, { timeout: 30000 });
    await signIn(page, password);
    const bearer = (await streamed).headers().authorization ?? "";
    out.stream_bearer = /^Bearer \S+$/.test(bearer) ? 1 : 0;
    await linesAtLeast(page, 3);
    out.events = await lines(page);
    const statusWith = () => page.evaluate(async ([b, h]) =>
      (await fetch(b + "status", { headers: { Authorization: h } })).status, [base, bearer]);
    out.token_status = await statusWith();

    await page.click("#logout");
    await statusIs(page, /^Signed out\.$/);
    await inlineLogin(page);
    out.token_status_after_logout = await statusWith();

    // A reload ends the open stream and every token; the reconnect's 401 asks again
    await signIn(page, password);
    await page.waitForFunction(() => document.getElementById("state").textContent === "live", null, { timeout: 30000 });
    process.kill(Number(pid), "SIGHUP");
    await statusIs(page, /session ended/);
    await inlineLogin(page);
    out.expired_asks_again = 1;
  },

  // base names 127.0.0.1 as viewer.test, which the browser holds insecure
  async open(context, page) {
    await page.goto(base);
    await page.waitForURL(/\/auth\/view$/, { timeout: 10000 });
    await linesAtLeast(page, 3);
    out.events = await lines(page);
    out.secure = await page.evaluate(() => isSecureContext);
    out.sign_in_ui = await page.evaluate(() => !document.getElementById("logout").hidden || !document.getElementById("login").hidden);
  },
};

(async () => {
  let context;
  try {
    if (mode === "blocked") {
      // Full Chromium: the headless shell ignores a profile's Preferences
      context = await chromium.launchPersistentContext(profile, { ignoreHTTPSErrors: true, channel: "chromium" });
    } else {
      const args = mode === "open" ? ["--host-resolver-rules=MAP viewer.test 127.0.0.1"] : [];
      context = await (await chromium.launch({ args })).newContext({ ignoreHTTPSErrors: true });
    }
    const page = await context.newPage();
    page.on("console", (m) => { if (/Content Security Policy/i.test(m.text())) out.csp_violations++; });
    await scenarios[mode](context, page);
  } catch (e) {
    out.error = JSON.stringify(e.message.split("\n")[0]);
  } finally {
    await (context?.browser() ?? context)?.close();
  }
  for (const [k, v] of Object.entries(out)) console.log(`${k}=${v}`);
})();
EOF
info "configuration in $(short "$CONF")/, browser driver $(short "$RUN/browser.cjs")"

section "Startup"
# logwisp stays PIDS[0]: the blocked-cookie scenario reloads it with SIGHUP
start_daemon logwisp logwisp.toml
spawn proxy "$PROXY_SRC/proxy" "127.0.0.1:$PORT_PROXY" "http://127.0.0.1:$PORT_SINK" "$PROXY_ADDR" \
	"$PKI/site.crt" "$PKI/site.key"
wait_port $PORT_SINK || abort "logwisp port $PORT_SINK is not listening" logwisp
wait_port $PORT_PROXY || abort "proxy port $PORT_PROXY is not listening" proxy
wait_port $PORT_OPEN || abort "logwisp port $PORT_OPEN is not listening" logwisp
daemons_up
write_env LW="$BIN" CA="$PKI/ca.crt" PW="$AUTH/viewer-01.pass" SITE="$SITE"

guide "logwisp browser login test" <<EOF
Ports:
  $PORT_PROXY  the site: TLS-terminating reverse proxy, logwisp under /logs/
  $PORT_SINK  logwisp http sink, plaintext, trusted_proxies = ["$PROXY_ADDR"]
  $PORT_OPEN  logwisp http sink without auth: its viewer at the root
In a browser trusting $(short "$PKI/ca.crt"), sign in as viewer-01 with the
password in $(short "$AUTH/viewer-01.pass"):
> $SITE/logs/auth/view
Shell setup (LW, CA, PW: viewer-01's password file, SITE):
> . $(short "$RUN")/env
The CLI, unbound through the proxy (bearer keeps the token off argv):
> token=\$(\$LW auth token --unbound --url \$SITE/logs --user viewer-01 --password-file \$PW --ca-file \$CA)
> curl -N --cacert \$CA -H @<(bearer) \$SITE/logs/stream
Logs: $(short "$LOG")/
EOF
manual_hold

code_of() { # url [token] -> http_code; the header goes through a pipe, never argv
	local args=(-s -o /dev/null -w '%{http_code}' --max-time 5 --noproxy '*' --cacert "$PKI/ca.crt")
	if [[ -n ${2:-} ]]; then
		curl "${args[@]}" -H @<(printf 'Authorization: Bearer %s\n' "$2") "$1" 2>/dev/null || true
	else
		curl "${args[@]}" "$1" 2>/dev/null || true
	fi
}

browser() { # mode [base]: runs browser.cjs, whose key=value lines val reads
	info "browser: $1 (output in $(short "$LOG")/browser-$1.out)"
	timeout 120 node "$RUN/browser.cjs" "$1" "${2:-$SITE/logs/}" viewer-01 "$AUTH/viewer-01.pass" \
		"$RUN/profile" "${PIDS[0]}" >"$LOG/browser-$1.out" 2>"$LOG/browser-$1.err"
	browser_out="$(cat "$LOG/browser-$1.out")"
	[[ -z $(val error) ]] || info "${C_RED}browser error ($1): $(val error)$C_OFF"
}
val() { sed -n "s/^$1=//p" <<<"$browser_out"; }
# The count covers the whole scenario only when it ran to its end without error
csp_clean() { echo $(($(is "$(val error)" "") && $(is "$(val csp_violations)" 0))); }

section "Scenario 1: a person in a browser"
if ((BROWSER)); then
	browser cookie
	check "browser: the mount sends an unauthenticated visitor to the viewer, then the login page" $(is "$(val redirected_to_login)" 1)
	check "browser: a wrong password is refused on the page" $(is "$(val wrong_password_refused)" 1)
	check "browser: login (Argon2 in the page, $(val login_ms) ms) opened the viewer" $(is_set "$(val login_ms)")
	n=$(val events)
	check "browser: the viewer showed events through EventSource (${n:-0} lines)" $((${n:-0} >= 3))
	check "browser: with the cookie working the viewer shows no sign-in form" $(is "$(val inline_login)" false)
	check "browser: session cookie $(val cookie)" \
		$(is "$(val cookie)" "path=/logs;httponly=true;secure=true;samesite=Strict")
	check "browser: page scripts cannot read the session (document.cookie $(val document_cookie))" \
		$(is "$(val document_cookie)" '""')
	check "browser: sign out cleared the cookie" $(is "$(val cookie_after_logout)" 0)
	check "browser: status refused after sign out (HTTP $(val status_after_logout))" $(is "$(val status_after_logout)" 401)
	check "browser: no CSP violations ($(val csp_violations))" $(csp_clean)
	n=$(grep 'Login accepted' "$LOG/logwisp.out" | grep -c 'remote_addr 127.0.0.1')
	check "logwisp logged the forwarded client, not the proxy ($n logins from 127.0.0.1)" $((n >= 1))
	browser dropped
	check "browser: a session cookie the browser dropped brings the viewer's own sign-in form, not a loop" \
		$(is "$(val inline_login)" 1)
	check "browser: its token stays out of storage, the URL and cookies" $(is "$(val token_in_page_only)" 1)
else
	skip "browser checks: node, playwright or its Chromium headless shell missing"
fi

section "Scenario 2: a browser that keeps no cookies"
if ((FULL_CHROMIUM)); then
	mkdir -p "$RUN/profile/Default"
	echo '{"profile": {"default_content_setting_values": {"cookies": 2}}}' >"$RUN/profile/Default/Preferences"
	browser blocked
	check "no cookies: the profile blocks cookies (document.cookie kept $(val document_cookie_kept); navigator.cookieEnabled $(val cookie_enabled))" \
		$(is "$(val document_cookie_kept)" '""')
	check "no cookies: the login page says so, links to the viewer and stays disabled" \
		$(is "$(val login_page_disabled)" true)
	check "no cookies: the viewer shows its own sign-in form" $(is "$(val inline_login)" 1)
	n=$(val events)
	check "no cookies: the viewer streamed events with a bearer token (${n:-0} lines)" \
		$((${n:-0} >= 3 && $(is "$(val stream_bearer)" 1)))
	n=$(val proofs)
	check "no cookies: the viewer's proofs asked for no cookie (${n:-0} sent, $(val proofs_with_session) with a session)" \
		$((${n:-0} >= 1 && $(is "$(val proofs_with_session)" 0)))
	check "no cookies: the page's token opened status (HTTP $(val token_status))" $(is "$(val token_status)" 200)
	check "no cookies: sign out revoked it (HTTP $(val token_status_after_logout))" \
		$(is "$(val token_status_after_logout)" 401)
	check "no cookies: a reload ended the session and the viewer asked to sign in again" \
		$(is "$(val expired_asks_again)" 1)
	check "no cookies: no CSP violations ($(val csp_violations))" $(csp_clean)
else
	skip "browser checks: node, playwright or its full Chromium missing"
fi

section "Scenario 3: the CLI through the proxy"
token="$("$BIN" auth token -unbound -url "$SITE/logs" -user viewer-01 -password-file "$AUTH/viewer-01.pass" \
	-ca-file "$PKI/ca.crt" 2>>"$LOG/auth-cli.out")"
check "cli: lw auth token --unbound logged in through the proxy" $(is_set "$token")
code="$(code_of "$SITE/logs/status" "$token")"
check "cli: /logs/status served with the token (HTTP $code)" $(is "$code" 200)
sse="$(timeout 3 curl -sN --noproxy '*' --cacert "$PKI/ca.crt" \
	-H @<(printf 'Authorization: Bearer %s\n' "$token") "$SITE/logs/stream" 2>/dev/null || true)"
n=$(grep -c '^data:' <<<"$sse")
check "cli: /logs/stream delivered SSE events with the token ($n events)" $((n >= 1))
code="$(code_of "$SITE/logs/status")"
check "cli: /logs/status refused without a token (HTTP $code)" $(is "$code" 401)
"$BIN" auth token -url "$SITE/logs" -user viewer-01 -password-file "$AUTH/viewer-01.pass" \
	-ca-file "$PKI/ca.crt" >/dev/null 2>>"$LOG/auth-cli.out"
rc=$?
check "cli: a path without --unbound is a usage error (exit $rc)" $((rc == 2))

section "Scenario 4: an open sink"
if ((BROWSER)); then
	browser open "http://viewer.test:$PORT_OPEN/"
	n=$(val events)
	check "open: the root led to the viewer, which streamed with no login on an insecure page (${n:-0} lines, secure $(val secure))" \
		$((${n:-0} >= 3 && $(is "$(val secure)" false) && $(is "$(val sign_in_ui)" false)))
	check "open: no CSP violations ($(val csp_violations))" $(csp_clean)
else
	skip "browser checks: node, playwright or its Chromium headless shell missing"
fi

section "Scenario 5: around the proxy"
code="$(code_of "http://127.0.0.1:$PORT_SINK/auth/login")"
check "direct: the login page refuses a peer that is not the proxy (HTTP $code)" $(is "$code" 403)
code="$(code_of "http://127.0.0.1:$PORT_SINK/status" "$token")"
check "direct: a valid token does not open the sink around the proxy (HTTP $code)" $(is "$code" 403)
code="$(code_of "$SITE/plain/status" "$token")"
check "plaintext site: a request the proxy received over http is refused (HTTP $code)" $(is "$code" 403)

summary