/*
Copyright 2017 The Kubernetes Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package policy

import (
	"strings"
	"testing"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"

	"k8s.io/apiserver/pkg/apis/audit"
	"k8s.io/apiserver/pkg/authentication/user"
	"k8s.io/apiserver/pkg/authorization/authorizer"
)

var (
	tim = &user.DefaultInfo{
		Name:   "tim@k8s.io",
		Groups: []string{"humans", "developers"},
	}
	attrs = map[string]authorizer.Attributes{
		"namespaced": &authorizer.AttributesRecord{
			User:            tim,
			Verb:            "get",
			Namespace:       "default",
			APIGroup:        "", // Core
			APIVersion:      "v1",
			Resource:        "pods",
			Name:            "busybox",
			ResourceRequest: true,
			Path:            "/api/v1/namespaces/default/pods/busybox",
		},
		"cluster": &authorizer.AttributesRecord{
			User:            tim,
			Verb:            "get",
			APIGroup:        "rbac.authorization.k8s.io", // Core
			APIVersion:      "v1beta1",
			Resource:        "clusterroles",
			Name:            "edit",
			ResourceRequest: true,
			Path:            "/apis/rbac.authorization.k8s.io/v1beta1/clusterroles/edit",
		},
		"nonResource": &authorizer.AttributesRecord{
			User:            tim,
			Verb:            "get",
			ResourceRequest: false,
			Path:            "/logs/kubelet.log",
		},
		"subresource": &authorizer.AttributesRecord{
			User:            tim,
			Verb:            "get",
			Namespace:       "default",
			APIGroup:        "", // Core
			APIVersion:      "v1",
			Resource:        "pods",
			Subresource:     "log",
			Name:            "busybox",
			ResourceRequest: true,
			Path:            "/api/v1/namespaces/default/pods/busybox",
		},
		"Unauthorized": &authorizer.AttributesRecord{
			Verb:            "get",
			Namespace:       "default",
			APIGroup:        "", // Core
			APIVersion:      "v1",
			Resource:        "pods",
			Name:            "busybox",
			ResourceRequest: true,
			Path:            "/api/v1/namespaces/default/pods/busybox",
		},
	}

	rules = map[string]audit.PolicyRule{
		"default": {
			Level: audit.LevelMetadata,
		},
		"create": {
			Level: audit.LevelRequest,
			Verbs: []string{"create"},
		},
		"tims": {
			Level: audit.LevelMetadata,
			Users: []string{"tim@k8s.io"},
		},
		"humans": {
			Level:      audit.LevelMetadata,
			UserGroups: []string{"humans"},
		},
		"serviceAccounts": {
			Level:      audit.LevelRequest,
			UserGroups: []string{"system:serviceaccounts"},
		},
		"getPods": {
			Level:     audit.LevelRequestResponse,
			Verbs:     []string{"get"},
			Resources: []audit.GroupResources{{Resources: []string{"pods"}}},
		},
		"getPodLogs": {
			Level:     audit.LevelRequest,
			Verbs:     []string{"get"},
			Resources: []audit.GroupResources{{Resources: []string{"pods/log"}}},
		},
		"getPodWildcardMatching": {
			Level:     audit.LevelRequest,
			Verbs:     []string{"get"},
			Resources: []audit.GroupResources{{Resources: []string{"*"}}},
		},
		"getPodResourceWildcardMatching": {
			Level:     audit.LevelRequest,
			Verbs:     []string{"get"},
			Resources: []audit.GroupResources{{Resources: []string{"*/log"}}},
		},
		"getPodSubResourceWildcardMatching": {
			Level:     audit.LevelRequest,
			Verbs:     []string{"get"},
			Resources: []audit.GroupResources{{Resources: []string{"pods/*"}}},
		},
		"getClusterRoles": {
			Level: audit.LevelRequestResponse,
			Verbs: []string{"get"},
			Resources: []audit.GroupResources{{
				Group:     "rbac.authorization.k8s.io",
				Resources: []string{"clusterroles"},
			}},
			Namespaces: []string{""},
		},
		"getLogs": {
			Level: audit.LevelRequestResponse,
			Verbs: []string{"get"},
			NonResourceURLs: []string{
				"/logs*",
			},
		},
		"getMetrics": {
			Level: audit.LevelRequest,
			Verbs: []string{"get"},
			NonResourceURLs: []string{
				"/metrics",
			},
		},
		"clusterRoleEdit": {
			Level: audit.LevelRequest,
			Resources: []audit.GroupResources{{
				Group:         "rbac.authorization.k8s.io",
				Resources:     []string{"clusterroles"},
				ResourceNames: []string{"edit"},
			}},
		},
		"omit RequestReceived": {
			Level: audit.LevelRequest,
			OmitStages: []audit.Stage{
				audit.StageRequestReceived,
			},
		},
		"only audit panic": {
			Level: audit.LevelRequest,
			OmitStages: []audit.Stage{
				audit.StageRequestReceived,
				audit.StageResponseStarted,
				audit.StageResponseComplete,
			},
		},
	}
)

func test(t *testing.T, req string, expLevel audit.Level, policyStages, expOmitStages []audit.Stage, ruleNames ...string) {
	policy := audit.Policy{OmitStages: policyStages}
	for _, rule := range ruleNames {
		require.Contains(t, rules, rule)
		policy.Rules = append(policy.Rules, rules[rule])
	}
	require.Contains(t, attrs, req)
	actualLevel, actualOmitStages := NewChecker(&policy).LevelAndStages(attrs[req])
	assert.Equal(t, expLevel, actualLevel, "request:%s rules:%s", req, strings.Join(ruleNames, ","))
	assert.True(t, stageEqual(expOmitStages, actualOmitStages), "request:%s rules:%s, expected stages: %v, actual stages: %v",
		req, strings.Join(ruleNames, ","), expOmitStages, actualOmitStages)
}

func testAuditLevel(t *testing.T, stages []audit.Stage) {
	test(t, "namespaced", audit.LevelMetadata, stages, stages, "default")
	test(t, "namespaced", audit.LevelNone, stages, stages, "create")
	test(t, "namespaced", audit.LevelMetadata, stages, stages, "tims")
	test(t, "namespaced", audit.LevelMetadata, stages, stages, "humans")
	test(t, "namespaced", audit.LevelNone, stages, stages, "serviceAccounts")
	test(t, "namespaced", audit.LevelRequestResponse, stages, stages, "getPods")
	test(t, "namespaced", audit.LevelNone, stages, stages, "getClusterRoles")
	test(t, "namespaced", audit.LevelNone, stages, stages, "getLogs")
	test(t, "namespaced", audit.LevelNone, stages, stages, "getMetrics")
	test(t, "namespaced", audit.LevelMetadata, stages, stages, "getMetrics", "serviceAccounts", "default")
	test(t, "namespaced", audit.LevelRequestResponse, stages, stages, "getMetrics", "getPods", "default")
	test(t, "namespaced", audit.LevelRequestResponse, stages, stages, "getPodLogs", "getPods")

	test(t, "cluster", audit.LevelMetadata, stages, stages, "default")
	test(t, "cluster", audit.LevelNone, stages, stages, "create")
	test(t, "cluster", audit.LevelMetadata, stages, stages, "tims")
	test(t, "cluster", audit.LevelMetadata, stages, stages, "humans")
	test(t, "cluster", audit.LevelNone, stages, stages, "serviceAccounts")
	test(t, "cluster", audit.LevelNone, stages, stages, "getPods")
	test(t, "cluster", audit.LevelRequestResponse, stages, stages, "getClusterRoles")
	test(t, "cluster", audit.LevelRequest, stages, stages, "clusterRoleEdit", "getClusterRoles")
	test(t, "cluster", audit.LevelNone, stages, stages, "getLogs")
	test(t, "cluster", audit.LevelNone, stages, stages, "getMetrics")
	test(t, "cluster", audit.LevelMetadata, stages, stages, "getMetrics", "serviceAccounts", "default")
	test(t, "cluster", audit.LevelRequestResponse, stages, stages, "getMetrics", "getClusterRoles", "default")
	test(t, "cluster", audit.LevelNone, stages, stages, "getPodLogs", "getPods")

	test(t, "nonResource", audit.LevelMetadata, stages, stages, "default")
	test(t, "nonResource", audit.LevelNone, stages, stages, "create")
	test(t, "nonResource", audit.LevelMetadata, stages, stages, "tims")
	test(t, "nonResource", audit.LevelMetadata, stages, stages, "humans")
	test(t, "nonResource", audit.LevelNone, stages, stages, "serviceAccounts")
	test(t, "nonResource", audit.LevelNone, stages, stages, "getPods")
	test(t, "nonResource", audit.LevelNone, stages, stages, "getClusterRoles")
	test(t, "nonResource", audit.LevelRequestResponse, stages, stages, "getLogs")
	test(t, "nonResource", audit.LevelNone, stages, stages, "getMetrics")
	test(t, "nonResource", audit.LevelMetadata, stages, stages, "getMetrics", "serviceAccounts", "default")
	test(t, "nonResource", audit.LevelRequestResponse, stages, stages, "getLogs", "getClusterRoles", "default")
	test(t, "nonResource", audit.LevelNone, stages, stages, "getPodLogs", "getPods")

	test(t, "subresource", audit.LevelRequest, stages, stages, "getPodLogs", "getPods")
	test(t, "subresource", audit.LevelRequest, stages, stages, "getPodWildcardMatching")
	test(t, "subresource", audit.LevelRequest, stages, stages, "getPodResourceWildcardMatching")
	test(t, "subresource", audit.LevelRequest, stages, stages, "getPodSubResourceWildcardMatching")

	test(t, "Unauthorized", audit.LevelNone, stages, stages, "tims")
	test(t, "Unauthorized", audit.LevelMetadata, stages, stages, "tims", "default")
	test(t, "Unauthorized", audit.LevelNone, stages, stages, "humans")
	test(t, "Unauthorized", audit.LevelMetadata, stages, stages, "humans", "default")
}

func TestChecker(t *testing.T) {
	testAuditLevel(t, nil)

	// test omitStages pre rule
	test(t, "namespaced", audit.LevelRequest, nil, []audit.Stage{audit.StageRequestReceived}, "omit RequestReceived", "getPods", "default")
	test(t, "namespaced", audit.LevelRequest, nil, []audit.Stage{audit.StageRequestReceived, audit.StageResponseStarted, audit.StageResponseComplete}, "only audit panic", "getPods", "default")
	test(t, "cluster", audit.LevelRequest, nil, []audit.Stage{audit.StageRequestReceived}, "omit RequestReceived", "getPods", "default")
	test(t, "cluster", audit.LevelRequest, nil, []audit.Stage{audit.StageRequestReceived, audit.StageResponseStarted, audit.StageResponseComplete}, "only audit panic", "getPods", "default")
	test(t, "nonResource", audit.LevelRequest, nil, []audit.Stage{audit.StageRequestReceived}, "omit RequestReceived", "getPods", "default")
	test(t, "nonResource", audit.LevelRequest, nil, []audit.Stage{audit.StageRequestReceived, audit.StageResponseStarted, audit.StageResponseComplete}, "only audit panic", "getPods", "default")
}

func TestCheckerPolicyOmitStages(t *testing.T) {
	policyStages := []audit.Stage{audit.StageRequestReceived, audit.StageResponseStarted}
	testAuditLevel(t, policyStages)

	// test omitStages policy wide
	test(t, "namespaced", audit.LevelRequest, policyStages, []audit.Stage{audit.StageRequestReceived, audit.StageResponseStarted}, "omit RequestReceived", "getPods", "default")
	test(t, "namespaced", audit.LevelRequest, policyStages, []audit.Stage{audit.StageRequestReceived, audit.StageResponseStarted, audit.StageResponseComplete}, "only audit panic", "getPods", "default")
	test(t, "cluster", audit.LevelRequest, policyStages, []audit.Stage{audit.StageRequestReceived, audit.StageResponseStarted}, "omit RequestReceived", "getPods", "default")
	test(t, "cluster", audit.LevelRequest, policyStages, []audit.Stage{audit.StageRequestReceived, audit.StageResponseStarted, audit.StageResponseComplete}, "only audit panic", "getPods", "default")
	test(t, "nonResource", audit.LevelMetadata, policyStages, []audit.Stage{audit.StageRequestReceived, audit.StageResponseStarted}, "default", "omit RequestReceived", "getPods")
	test(t, "nonResource", audit.LevelRequest, policyStages, []audit.Stage{audit.StageRequestReceived, audit.StageResponseStarted, audit.StageResponseComplete}, "only audit panic", "getPods", "default")
}

// stageEqual returns true if s1 and s2 are super set of each other
func stageEqual(s1, s2 []audit.Stage) bool {
	m1 := make(map[audit.Stage]bool)
	m2 := make(map[audit.Stage]bool)
	for _, s := range s1 {
		m1[s] = true
	}
	for _, s := range s2 {
		m2[s] = true
	}
	if len(m1) != len(m2) {
		return false
	}
	for key, value := range m1 {
		if m2[key] != value {
			return false
		}
	}
	return true
}

func TestUnionStages(t *testing.T) {
	var testCases = []struct {
		s1, s2, exp []audit.Stage
	}{
		{
			[]audit.Stage{},
			[]audit.Stage{},
			[]audit.Stage{},
		},
		{
			[]audit.Stage{audit.StageRequestReceived},
			[]audit.Stage{},
			[]audit.Stage{audit.StageRequestReceived},
		},
		{
			[]audit.Stage{audit.StageRequestReceived},
			[]audit.Stage{audit.StageRequestReceived},
			[]audit.Stage{audit.StageRequestReceived},
		},
		{
			[]audit.Stage{audit.StageRequestReceived},
			[]audit.Stage{audit.StageResponseStarted},
			[]audit.Stage{audit.StageRequestReceived, audit.StageResponseStarted},
		},
		{
			[]audit.Stage{audit.StageRequestReceived, audit.StageRequestReceived},
			[]audit.Stage{audit.StageRequestReceived, audit.StageRequestReceived},
			[]audit.Stage{audit.StageRequestReceived},
		},
		{
			[]audit.Stage{audit.StageRequestReceived, audit.StageResponseStarted},
			[]audit.Stage{audit.StagePanic, audit.StageRequestReceived},
			[]audit.Stage{audit.StageRequestReceived, audit.StageResponseStarted, audit.StagePanic},
		},
		{
			nil,
			[]audit.Stage{audit.StageRequestReceived},
			[]audit.Stage{audit.StageRequestReceived},
		},
	}

	for _, tc := range testCases {
		result := unionStages(tc.s1, tc.s2)
		assert.Len(t, result, len(tc.exp))
		for _, expStage := range tc.exp {
			ok := false
			for _, resultStage := range result {
				if resultStage == expStage {
					ok = true
					break
				}
			}
			assert.True(t, ok)
		}
	}
}