config_test.go

package main

import (
	"os"
	"path/filepath"
	"testing"

	"github.com/joewalnes/websocketd/internal/cliflags"
)

// TestDefaultMaxForksIsFinite guards the security intent: the fork limit must
// default to a finite value so an unconfigured, network-facing deployment
// cannot be fork-bombed. A revert to 0 (unlimited) should fail this test.
func TestDefaultMaxForksIsFinite(t *testing.T) {
	if cliflags.DefaultMaxForks <= 0 {
		t.Fatalf("cliflags.DefaultMaxForks = %d; must be finite (> 0) so the default is not a fork-bomb", cliflags.DefaultMaxForks)
	}
}

func TestSchemelessOriginWarnings(t *testing.T) {
	tests := []struct {
		name    string
		ssl     bool
		origins []string
		want    []string
	}{
		{"no ssl, no warning", false, []string{"trusted.com"}, nil},
		{"ssl, scheme-less warns", true, []string{"trusted.com"}, []string{"trusted.com"}},
		{"ssl, https scheme no warning", true, []string{"https://trusted.com"}, nil},
		{"ssl, http scheme no warning (explicit choice)", true, []string{"http://trusted.com"}, nil},
		{"ssl, mixed", true, []string{"https://a.com", "b.com", "c.com:8443"}, []string{"b.com", "c.com:8443"}},
		{"ssl, empty list", true, nil, nil},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			got := schemelessOriginWarnings(tt.ssl, tt.origins)
			if len(got) != len(tt.want) {
				t.Fatalf("got %v, want %v", got, tt.want)
			}
			for i := range got {
				if got[i] != tt.want[i] {
					t.Fatalf("got %v, want %v", got, tt.want)
				}
			}
		})
	}
}

func TestResolvePort(t *testing.T) {
	tests := []struct {
		name     string
		portFlag int
		ssl      bool
		want     int
	}{
		{"explicit port", 8080, false, 8080},
		{"explicit port with ssl", 8443, true, 8443},
		{"default http", 0, false, 80},
		{"default https", 0, true, 443},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			got := resolvePort(tt.portFlag, tt.ssl)
			if got != tt.want {
				t.Errorf("resolvePort(%d, %v) = %d, want %d", tt.portFlag, tt.ssl, got, tt.want)
			}
		})
	}
}

func TestResolveAddresses(t *testing.T) {
	tests := []struct {
		name     string
		addrlist []string
		port     int
		want     []string
	}{
		{"no addresses", nil, 8080, []string{":8080"}},
		{"empty list", []string{}, 8080, []string{":8080"}},
		{"single address", []string{"127.0.0.1"}, 8080, []string{"127.0.0.1:8080"}},
		{"multiple addresses", []string{"127.0.0.1", "192.168.1.1"}, 9090, []string{"127.0.0.1:9090", "192.168.1.1:9090"}},
		{"ipv6", []string{"[::1]"}, 8080, []string{"[::1]:8080"}},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			got := resolveAddresses(tt.addrlist, tt.port)
			if len(got) != len(tt.want) {
				t.Fatalf("resolveAddresses() returned %d addrs, want %d", len(got), len(tt.want))
			}
			for i, addr := range got {
				if addr != tt.want[i] {
					t.Errorf("addr[%d] = %q, want %q", i, addr, tt.want[i])
				}
			}
		})
	}
}

func TestWantsUnixSocketOnly(t *testing.T) {
	tests := []struct {
		name       string
		unixSocket string
		portFlag   int
		addrlist   []string
		redirPort  int
		want       bool
	}{
		{"no unixsocket flag", "", 0, nil, 0, false},
		{"unixsocket alone", "/tmp/w.sock", 0, nil, 0, true},
		{"unixsocket with explicit port", "/tmp/w.sock", 8080, nil, 0, false},
		{"unixsocket with address", "/tmp/w.sock", 0, []string{"127.0.0.1"}, 0, false},
		{"unixsocket with redirport", "/tmp/w.sock", 0, nil, 8081, false},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			got := wantsUnixSocketOnly(tt.unixSocket, tt.portFlag, tt.addrlist, tt.redirPort)
			if got != tt.want {
				t.Errorf("wantsUnixSocketOnly(%q, %d, %v, %d) = %v, want %v",
					tt.unixSocket, tt.portFlag, tt.addrlist, tt.redirPort, got, tt.want)
			}
		})
	}
}

func TestValidateBinaryPassStderr(t *testing.T) {
	tests := []struct {
		name       string
		binary     bool
		passStderr bool
		wantErr    bool
	}{
		{"neither set", false, false, false},
		{"binary only", true, false, false},
		{"passstderr only", false, true, false},
		{"both set", true, true, true},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			err := validateBinaryPassStderr(tt.binary, tt.passStderr)
			if (err != nil) != tt.wantErr {
				t.Errorf("validateBinaryPassStderr(%v, %v) error = %v, wantErr %v", tt.binary, tt.passStderr, err, tt.wantErr)
			}
		})
	}
}

// TestValidateMaxFrameSize verifies that negative --maxframesize values are
// rejected. NewWebSocketEndpoint only applies a read limit when the value is
// positive, so a negative value silently meant "unlimited" — exactly the
// operator error most likely to remove a DoS protection (issue #472).
func TestValidateMaxFrameSize(t *testing.T) {
	tests := []struct {
		name         string
		maxFrameSize int64
		wantErr      bool
	}{
		{"zero means unlimited", 0, false},
		{"positive limit", 1 << 20, false},
		{"negative value", -1, true},
		{"very negative value", -1048576, true},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			err := validateMaxFrameSize(tt.maxFrameSize)
			if (err != nil) != tt.wantErr {
				t.Errorf("validateMaxFrameSize(%d) error = %v, wantErr %v", tt.maxFrameSize, err, tt.wantErr)
			}
		})
	}
}

func TestValidateSSL(t *testing.T) {
	tests := []struct {
		name    string
		ssl     bool
		cert    string
		key     string
		caFile  string
		wantErr bool
	}{
		{"no ssl, no certs", false, "", "", "", false},
		{"ssl with both certs", true, "cert.pem", "key.pem", "", false},
		{"ssl missing cert", true, "", "key.pem", "", true},
		{"ssl missing key", true, "cert.pem", "", "", true},
		{"ssl missing both", true, "", "", "", true},
		{"certs without ssl", false, "cert.pem", "key.pem", "", true},
		{"cert without ssl", false, "cert.pem", "", "", true},
		// issue #477: --sslca without --ssl used to start a plain HTTP
		// server that neither encrypted the connection nor verified any
		// client certificate, despite the operator asking for mutual TLS.
		{"sslca without ssl", false, "", "", "ca.pem", true},
		{"sslca without ssl or certs either", false, "", "", "ca.pem", true},
		{"mutual tls: ssl with cert, key, and ca", true, "cert.pem", "key.pem", "ca.pem", false},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			err := validateSSL(tt.ssl, tt.cert, tt.key, tt.caFile)
			if (err != nil) != tt.wantErr {
				t.Errorf("validateSSL(%v, %q, %q, %q) error = %v, wantErr %v", tt.ssl, tt.cert, tt.key, tt.caFile, err, tt.wantErr)
			}
		})
	}
}

func TestBuildParentEnv(t *testing.T) {
	// Set some env vars for testing (t.Setenv restores them automatically)
	t.Setenv("TEST_WSD_VAR1", "value1")
	t.Setenv("TEST_WSD_VAR2", "value2")

	t.Run("passes specified vars", func(t *testing.T) {
		env := buildParentEnv("TEST_WSD_VAR1,TEST_WSD_VAR2")
		found1, found2 := false, false
		for _, e := range env {
			if e == "TEST_WSD_VAR1=value1" {
				found1 = true
			}
			if e == "TEST_WSD_VAR2=value2" {
				found2 = true
			}
		}
		if !found1 || !found2 {
			t.Errorf("expected both vars, got %v", env)
		}
	})

	t.Run("skips HTTPS", func(t *testing.T) {
		t.Setenv("HTTPS", "on")
		env := buildParentEnv("HTTPS,TEST_WSD_VAR1")
		for _, e := range env {
			if e == "HTTPS=on" {
				t.Error("HTTPS should be filtered out")
			}
		}
	})

	t.Run("skips nonexistent vars", func(t *testing.T) {
		env := buildParentEnv("NONEXISTENT_WSD_VAR")
		if len(env) != 0 {
			t.Errorf("expected empty env, got %v", env)
		}
	})

	t.Run("strips newlines from values", func(t *testing.T) {
		t.Setenv("TEST_WSD_NEWLINE", "value\nwith\nnewlines")
		env := buildParentEnv("TEST_WSD_NEWLINE")
		if len(env) != 1 {
			t.Fatalf("expected 1 env, got %d", len(env))
		}
		if env[0] != "TEST_WSD_NEWLINE=value with newlines" {
			t.Errorf("newlines not cleaned: %q", env[0])
		}
	})
}

func TestResolveCommand(t *testing.T) {
	t.Run("valid command", func(t *testing.T) {
		// "echo" should be in PATH on all platforms
		name, args, err := resolveCommand([]string{"echo", "hello"}, "")
		if err != nil {
			t.Fatalf("unexpected error: %v", err)
		}
		if name == "" {
			t.Error("command name should not be empty")
		}
		if len(args) != 1 || args[0] != "hello" {
			t.Errorf("args = %v, want [hello]", args)
		}
	})

	t.Run("nonexistent command", func(t *testing.T) {
		_, _, err := resolveCommand([]string{"nonexistent_wsd_command_xyz"}, "")
		if err == nil {
			t.Error("expected error for nonexistent command")
		}
	})

	t.Run("command with scriptdir is ambiguous", func(t *testing.T) {
		_, _, err := resolveCommand([]string{"echo"}, "/some/dir")
		if err == nil {
			t.Error("expected error for ambiguous command + dir")
		}
	})

	t.Run("no args returns empty", func(t *testing.T) {
		name, _, err := resolveCommand(nil, "")
		if err != nil {
			t.Fatalf("unexpected error: %v", err)
		}
		if name != "" {
			t.Errorf("expected empty command, got %q", name)
		}
	})
}

func TestResolveScriptDir(t *testing.T) {
	t.Run("empty dir", func(t *testing.T) {
		dir, err := resolveScriptDir("")
		if err != nil || dir != "" {
			t.Errorf("expected empty result, got %q, %v", dir, err)
		}
	})

	t.Run("valid directory", func(t *testing.T) {
		tmpDir := t.TempDir()
		dir, err := resolveScriptDir(tmpDir)
		if err != nil {
			t.Fatalf("unexpected error: %v", err)
		}
		abs, _ := filepath.Abs(tmpDir)
		if dir != abs {
			t.Errorf("dir = %q, want %q", dir, abs)
		}
	})

	t.Run("nonexistent directory", func(t *testing.T) {
		_, err := resolveScriptDir("/nonexistent/wsd/dir")
		if err == nil {
			t.Error("expected error for nonexistent dir")
		}
	})

	t.Run("file instead of directory", func(t *testing.T) {
		tmpDir := t.TempDir()
		f := filepath.Join(tmpDir, "file.txt")
		os.WriteFile(f, []byte("test"), 0644)
		_, err := resolveScriptDir(f)
		if err == nil {
			t.Error("expected error for file (not dir)")
		}
	})
}

func TestValidateDir(t *testing.T) {
	t.Run("empty dir is ok", func(t *testing.T) {
		if err := validateDir("", "test"); err != nil {
			t.Errorf("empty dir should be ok: %v", err)
		}
	})

	t.Run("valid directory", func(t *testing.T) {
		if err := validateDir(t.TempDir(), "test"); err != nil {
			t.Errorf("valid dir should be ok: %v", err)
		}
	})

	t.Run("nonexistent directory", func(t *testing.T) {
		if err := validateDir("/nonexistent/wsd/dir", "CGI dir"); err == nil {
			t.Error("expected error for nonexistent dir")
		}
	})

	t.Run("file instead of directory", func(t *testing.T) {
		tmpDir := t.TempDir()
		f := filepath.Join(tmpDir, "file.txt")
		os.WriteFile(f, []byte("test"), 0644)
		if err := validateDir(f, "static dir"); err == nil {
			t.Error("expected error for file (not dir)")
		}
	})
}

// TestParseSocketMode covers --socketmode parsing (issue #474): octal modes
// only, within permission bits, and no explicit zero (which would make the
// socket unusable even for its owner).
func TestParseSocketMode(t *testing.T) {
	tests := []struct {
		in      string
		want    os.FileMode
		wantErr bool
	}{
		{"", 0, false}, // unset: follow umask
		{"0700", 0o700, false},
		{"754", 0o754, false},
		{"0007", 0o007, false},
		{"777", 0o777, false},
		{"0", 0, true},    // would make the socket unusable
		{"0000", 0, true}, // ditto, zero-padded
		{"0999", 0, true}, // 9 is not an octal digit
		{"abc", 0, true},
		{"1000", 0, true}, // setuid/sticky bits are not permission bits
		{"1777", 0, true},
	}
	for _, tt := range tests {
		got, err := parseSocketMode(tt.in)
		if (err != nil) != tt.wantErr {
			t.Errorf("parseSocketMode(%q) error = %v, wantErr %v", tt.in, err, tt.wantErr)
			continue
		}
		if err == nil && got != tt.want {
			t.Errorf("parseSocketMode(%q) = %o, want %o", tt.in, got, tt.want)
		}
	}
}

// TestValidateAnyOrigin covers the --anyorigin conflict rules: it is an
// explicit opt-in to permissive behavior and cannot be combined with flags
// that restrict origins.
func TestValidateAnyOrigin(t *testing.T) {
	tests := []struct {
		name        string
		anyOrigin   bool
		sameOrigin  bool
		allowOrigin []string
		wantErr     bool
	}{
		{"anyorigin alone", true, false, nil, false},
		{"anyorigin with sameorigin", true, true, nil, true},
		{"anyorigin with origin list", true, false, []string{"a.com"}, true},
		{"no flags at all", false, false, nil, false},
		{"sameorigin alone", false, true, nil, false},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			err := validateAnyOrigin(tt.anyOrigin, tt.sameOrigin, tt.allowOrigin)
			if (err != nil) != tt.wantErr {
				t.Errorf("validateAnyOrigin(%v, %v, %v) error = %v, wantErr %v",
					tt.anyOrigin, tt.sameOrigin, tt.allowOrigin, err, tt.wantErr)
			}
		})
	}
}