<?php
/**
 * SeekQuarry/Yioop --
 * Open Source Pure PHP Search Engine, Crawler, and Indexer
 *
 * Copyright (C) 2009 - 2026  Chris Pollett chris@pollett.org
 *
 * LICENSE:
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see
 * <https://www.gnu.org/licenses/>.
 *
 * END LICENSE
 *
 * @author Chris Pollett chris@pollett.org
 * @license https://www.gnu.org/licenses/ GPL3
 * @link https://www.seekquarry.com/
 * @copyright 2009 - 2026
 * @filesource
 */
namespace seekquarry\yioop\tests;

use seekquarry\yioop\library\certificates\AcmeManager;
use seekquarry\yioop\library\certificates\AcmeClient;
use seekquarry\yioop\library\certificates\AcmeChallengeStore;
use seekquarry\yioop\library\certificates\AcmeKeyStore;
use seekquarry\yioop\library\certificates\CertInstaller;
use seekquarry\yioop\library\UnitTest;

/**
 * A stand-in AcmeClient that returns canned protocol responses so
 * the orchestration can be exercised without a network or a
 * certificate authority. Records the tokens it was told were ready
 * so a test can confirm the manager published and notified each
 * challenge. Its behavior is tuned by flags so failure paths can be
 * provoked.
 *
 * @author Chris Pollett
 */
class FakeAcmeClient extends AcmeClient
{
    /**
     * Whether each authorization should expose an http-01
     * challenge; false provokes the missing-challenge path.
     * @var bool
     */
    public $offer_http_challenge = true;
    /**
     * The status pollStatus reports for the order before finalize.
     * @var string
     */
    public $ready_status = "ready";
    /**
     * The status pollStatus reports for the order after finalize.
     * @var string
     */
    public $valid_status = "valid";
    /**
     * Tokens the manager notified ready, in order.
     * @var array
     */
    public $notified = [];
    /**
     * Tracks whether pollStatus has been called yet so the first
     * call returns the pre-finalize status and the second the
     * post-finalize status.
     * @var int
     */
    private $poll_count = 0;

    /**
     * No real key needed for the stand-in.
     */
    public function __construct()
    {
    }
    /**
     * Does nothing; there is no directory to fetch.
     */
    public function fetchDirectory()
    {
    }
    /**
     * Always reports the account registered.
     * @param string $contact_email ignored
     * @return bool true
     */
    public function registerAccount($contact_email)
    {
        return true;
    }
    /**
     * Returns a two-authorization order.
     * @param array $domains the requested domains
     * @return array the order
     */
    public function newOrder($domains)
    {
        return [
            "url" => "https://acme.test/order/1",
            "finalize" => "https://acme.test/order/1/finalize",
            "authorizations" => [
                "https://acme.test/authz/a",
                "https://acme.test/authz/b",
            ],
        ];
    }
    /**
     * Returns an authorization carrying an http-01 challenge whose
     * token is derived from the authorization URL, unless challenge
     * offering is switched off.
     * @param string $authz_url the authorization URL
     * @return array the authorization
     */
    public function authorization($authz_url)
    {
        if (!$this->offer_http_challenge) {
            return ["challenges" => []];
        }
        $token = "tok" . substr($authz_url, -1);
        return ["challenges" => [[
            "type" => "http-01",
            "token" => $token,
            "url" => $authz_url . "/chal",
        ]]];
    }
    /**
     * Returns the http-01 challenge from an authorization, matching
     * the real client.
     * @param array $authorization the authorization
     * @return array|null the challenge or null
     */
    public function httpChallenge($authorization)
    {
        foreach ($authorization["challenges"] ?? [] as $challenge) {
            if (($challenge["type"] ?? "") === "http-01") {
                return $challenge;
            }
        }
        return null;
    }
    /**
     * A deterministic key authorization for a token.
     * @param string $token the challenge token
     * @return string the key authorization
     */
    public function keyAuthorization($token)
    {
        return $token . ".THUMBPRINT";
    }
    /**
     * Records that a challenge was notified ready.
     * @param array $challenge the challenge
     * @return array a canned http result
     */
    public function notifyChallengeReady($challenge)
    {
        $this->notified[] = $challenge["token"];
        return ["status" => 200];
    }
    /**
     * Returns the pre-finalize status on the first call and the
     * post-finalize status afterward.
     * @param string $url ignored
     * @param int $attempts ignored
     * @param int $delay ignored
     * @return array the order status
     */
    public function pollStatus($url, $attempts = 20, $delay = 3)
    {
        $this->poll_count++;
        if ($this->poll_count === 1) {
            return ["status" => $this->ready_status];
        }
        return ["status" => $this->valid_status];
    }
    /**
     * Pretends to finalize.
     * @param array $order ignored
     * @param string $csr_der ignored
     * @return array a canned order
     */
    public function finalizeOrder($order, $csr_der)
    {
        return ["status" => "processing"];
    }
    /**
     * Returns a placeholder certificate chain.
     * @param array $order ignored
     * @return string a placeholder PEM chain
     */
    public function downloadCertificate($order)
    {
        return "-----BEGIN CERTIFICATE-----\nFAKE\n" .
            "-----END CERTIFICATE-----\n";
    }
}

/**
 * An AcmeManager whose protocol client is the fake above, so the
 * orchestration runs offline.
 *
 * @author Chris Pollett
 */
class TestableAcmeManager extends AcmeManager
{
    /**
     * The fake client to hand back from makeClient.
     * @var FakeAcmeClient
     */
    public $fake_client;
    /**
     * Returns the injected fake client instead of a real one.
     * @param string $account_key ignored
     * @return FakeAcmeClient the fake client
     */
    protected function makeClient($account_key)
    {
        return $this->fake_client;
    }
}

/**
 * Tests for AcmeManager: the obtainCertificate orchestration over a
 * fake protocol client, with real on-disk challenge, key, and
 * installer stores pointed at a per-test scratch directory. Cases
 * cover the happy path (issue and install, tokens published and
 * notified then cleared), an authorization missing its http-01
 * challenge, and an order that never reaches the ready state, with
 * token cleanup verified on the failure paths.
 *
 * @author Chris Pollett
 */
class AcmeManagerTest extends UnitTest
{
    /**
     * Per-test scratch directory.
     * @var string
     */
    private $dir;
    /**
     * The challenge store shared with the manager under test.
     * @var AcmeChallengeStore
     */
    private $challenge_store;
    /**
     * Makes a fresh scratch directory and the stores rooted in it.
     */
    public function setUp()
    {
        $this->dir = sys_get_temp_dir() . "/acme_mgr_test_" .
            getmypid() . "_" . uniqid();
        @mkdir($this->dir, 0700, true);
        $this->challenge_store = new AcmeChallengeStore(
            $this->dir . "/challenges");
    }
    /**
     * Removes the scratch directory and its contents.
     */
    public function tearDown()
    {
        $this->removeTree($this->dir);
    }
    /**
     * Recursively removes a directory tree.
     * @param string $path file or directory to remove
     */
    private function removeTree($path)
    {
        if (is_dir($path)) {
            foreach (glob($path . "/*") as $child) {
                $this->removeTree($child);
            }
            @rmdir($path);
        } else if (is_file($path)) {
            @unlink($path);
        }
    }
    /**
     * Builds a manager wired to the fake client and the scratch
     * stores.
     * @param FakeAcmeClient $client the fake protocol client
     * @return TestableAcmeManager the manager under test
     */
    private function makeManager($client)
    {
        $key_store = new AcmeKeyStore($this->dir . "/acme");
        $installer = new CertInstaller(
            $this->dir . "/server.fullchain.pem",
            $this->dir . "/server.key");
        $manager = new TestableAcmeManager(
            "https://acme.test/dir", "admin@example.test",
            $key_store, $this->challenge_store, $installer, null);
        $manager->fake_client = $client;
        return $manager;
    }
    /**
     * The happy path issues and installs a certificate, notifies
     * both challenges, and leaves no tokens behind.
     */
    public function happyPathIssuesAndInstallsTestCase()
    {
        $client = new FakeAcmeClient();
        $manager = $this->makeManager($client);
        $ok = $manager->obtainCertificate(
            ["pollett.org", "www.pollett.org"]);
        $this->assertTrue($ok,
            "obtainCertificate succeeds on the happy path");
        $this->assertEqual(2, count($client->notified),
            "both challenges were notified ready");
        $this->assertTrue(
            is_file($this->dir . "/server.fullchain.pem"),
            "the certificate chain was installed");
        $this->assertTrue(is_file($this->dir . "/server.key"),
            "the private key was installed");
    }
    /**
     * After a successful run the published challenge tokens are
     * cleared from the store.
     */
    public function tokensClearedAfterSuccessTestCase()
    {
        $client = new FakeAcmeClient();
        $manager = $this->makeManager($client);
        $manager->obtainCertificate(["pollett.org"]);
        $this->assertTrue(
            $this->challenge_store->get("toka") === null &&
            $this->challenge_store->get("tokb") === null,
            "published tokens are cleared after success");
    }
    /**
     * An authorization with no http-01 challenge fails the run and
     * leaves no tokens served.
     */
    public function missingChallengeFailsTestCase()
    {
        $client = new FakeAcmeClient();
        $client->offer_http_challenge = false;
        $manager = $this->makeManager($client);
        $ok = $manager->obtainCertificate(["pollett.org"]);
        $this->assertFalse($ok,
            "a missing http-01 challenge fails the run");
        $this->assertTrue($this->challenge_store->get("toka") === null,
            "no token is left served after the failure");
    }
    /**
     * An order that never becomes ready fails the run, and the
     * tokens published while trying are cleared.
     */
    public function orderNotReadyFailsAndClearsTestCase()
    {
        $client = new FakeAcmeClient();
        $client->ready_status = "pending";
        $manager = $this->makeManager($client);
        $ok = $manager->obtainCertificate(["pollett.org"]);
        $this->assertFalse($ok,
            "an order that never readies fails the run");
        $this->assertTrue(
            $this->challenge_store->get("toka") === null &&
            $this->challenge_store->get("tokb") === null,
            "tokens published during the attempt are cleared");
    }
    /**
     * An empty domain list is rejected before any protocol work.
     */
    public function emptyDomainsRejectedTestCase()
    {
        $client = new FakeAcmeClient();
        $manager = $this->makeManager($client);
        $this->assertFalse($manager->obtainCertificate([]),
            "an empty domain list is rejected");
    }
}
