macltok

#![cfg(feature = "sqlite")]

mod support;

use std::{path::PathBuf, sync::Arc, time::SystemTime};

use macltok::{

    AccountError, Accounts, EncryptedSessionStore, EngineConfig, Event, OAuthApplicationType,

    OAuthLogin, PasswordLogin, Restore, Session, SessionRecord, SessionStore, StoreConfig,

};

use matrix_sdk::{ruma::api::client::sync::sync_events::v5, test_utils::mocks::MatrixMockServer};

#[tokio::test]

async fn password_session_round_trips_and_discards_with_its_store() {

    let server = MatrixMockServer::new().await;

    server

        .mock_versions()

        .with_simplified_sliding_sync()

        .ok()

        .mount()

        .await;

    server.mock_login().ok().mount().await;

    server

        .mock_sliding_sync()

        .ok(v5::Response::new("1".to_owned()))

        .mount()

        .await;

    let root = temporary_path();

    let store_path = root.join("store");

    let record_path = root.join("records").join("session");

    let sessions = || {

        EncryptedSessionStore::file(

            &record_path,

            StoreConfig::sqlite(&store_path, "test store passphrase"),

        )

    };

    let config = EngineConfig::default().with_initial_history_limit(0);

    let session = Session::login_password(

        PasswordLogin::new(server.uri(), "example", "wordpass")

            .allow_insecure_loopback(true)

            .with_device_display_name("macltok test"),

        Arc::new(sessions()),

    )

    .await

    .unwrap();

    let (engine, handle, mut events) = session.build(config.clone()).await.unwrap();

    let running = tokio::spawn(engine.run());

    support::receive_until(&mut events, |event| {

        matches!(event, Event::Authenticated { .. })

    })

    .await;

    support::shut_down(&handle, &mut events, running).await;

    drop(handle);

    let wrong = EncryptedSessionStore::file(

        &record_path,

        StoreConfig::sqlite(&store_path, "someone else's passphrase"),

    );

    assert!(wrong.load().await.is_err());

    let sessions = Arc::new(sessions());

    let Some(Restore::Resumed(session)) = Session::restore(sessions.clone()).await.unwrap() else {

        panic!("the saved login didn't resume");

    };

    let (engine, handle, mut events) = session.build(config).await.unwrap();

    let running = tokio::spawn(engine.run());

    support::receive_until(&mut events, |event| {

        matches!(event, Event::Authenticated { .. })

    })

    .await;

    support::shut_down(&handle, &mut events, running).await;

    drop(handle);

    sessions.discard().await.unwrap();

    assert!(!record_path.exists());

    assert!(!store_path.exists());

    assert!(Session::restore(sessions).await.unwrap().is_none());

    std::fs::remove_dir_all(root).unwrap();

}

#[tokio::test]

async fn a_restart_after_a_soft_logout_still_knows_the_device() {

    let server = MatrixMockServer::new().await;

    server.mock_versions().ok().mount().await;

    server.mock_login().ok().mount().await;

    let root = temporary_path();

    let sessions = || {

        EncryptedSessionStore::file(

            root.join("session"),

            StoreConfig::sqlite(root.join("store"), "test store passphrase"),

        )

    };

    Session::login_password(

        PasswordLogin::new(server.uri(), "example", "wordpass").allow_insecure_loopback(true),

        Arc::new(sessions()),

    )

    .await

    .unwrap();

    sessions().soft_log_out().await.unwrap();

    let Some(Restore::SoftLoggedOut(soft)) = Session::restore(Arc::new(sessions())).await.unwrap()

    else {

        panic!("a soft logged out record came back as something else");

    };

    // the device matrix-sdk-test's canned login response hands out

    assert_eq!(soft.device_id, "GHTYAJCE");

    Session::login_password(soft.password_login("wordpass"), Arc::new(sessions()))

        .await

        .unwrap();

    let requests = server.server().received_requests().await.unwrap();

    let relogin: serde_json::Value = requests

        .iter()

        .rfind(|request| request.url.path().ends_with("/login"))

        .unwrap()

        .body_json()

        .unwrap();

    assert_eq!(relogin["device_id"], "GHTYAJCE");

    assert!(matches!(

        Session::restore(Arc::new(sessions())).await.unwrap(),

        Some(Restore::Resumed(_))

    ));

    std::fs::remove_dir_all(root).unwrap();

}

#[tokio::test]

async fn a_login_whose_first_save_fails_can_still_be_saved() {

    let server = MatrixMockServer::new().await;

    server.mock_versions().ok().mount().await;

    server.mock_login().ok().mount().await;

    let root = temporary_path();

    let records = root.join("records");

    std::fs::create_dir_all(&records).unwrap();

    let sessions = || {

        EncryptedSessionStore::file(

            records.join("session"),

            StoreConfig::sqlite(root.join("store"), "test store passphrase"),

        )

    };

    let writable = std::fs::metadata(&records).unwrap().permissions();

    let mut read_only = writable.clone();

    read_only.set_readonly(true);

    std::fs::set_permissions(&records, read_only).unwrap();

    let login = Session::login_password(

        PasswordLogin::new(server.uri(), "example", "wordpass").allow_insecure_loopback(true),

        Arc::new(sessions()),

    )

    .await;

    let Err(AccountError::Unsaved { session, .. }) = login else {

        panic!("a login that couldn't save its record didn't hand the session back");

    };

    std::fs::set_permissions(&records, writable).unwrap();

    drop(session.save().await.unwrap());

    assert!(matches!(

        Session::restore(Arc::new(sessions())).await.unwrap(),

        Some(Restore::Resumed(_))

    ));

    std::fs::remove_dir_all(root).unwrap();

}

#[tokio::test]

async fn a_store_takes_one_session_at_a_time() {

    let server = MatrixMockServer::new().await;

    server.mock_versions().ok().mount().await;

    server.mock_login().ok().mount().await;

    let root = temporary_path();

    let sessions = || {

        EncryptedSessionStore::file(

            root.join("session"),

            StoreConfig::sqlite(root.join("store"), "test store passphrase"),

        )

    };

    let (engine, handle, events) = Session::login_password(

        PasswordLogin::new(server.uri(), "example", "wordpass").allow_insecure_loopback(true),

        Arc::new(sessions()),

    )

    .await

    .unwrap()

    .build(EngineConfig::default())

    .await

    .unwrap();

    assert!(matches!(

        Session::restore(Arc::new(sessions())).await,

        Err(AccountError::StoreInUse)

    ));

    drop((engine, events));

    assert!(matches!(

        Session::restore(Arc::new(sessions())).await,

        Err(AccountError::StoreInUse)

    ));

    drop(handle);

    let resumed = Session::restore(Arc::new(sessions())).await.unwrap();

    assert!(matches!(resumed, Some(Restore::Resumed(_))));

    drop(resumed);

    sessions().discard().await.unwrap();

    assert!(!root.join("store").exists());

    std::fs::remove_dir_all(root).unwrap();

}

#[tokio::test]

async fn a_torn_or_failed_save_leaves_the_old_record() {

    let root = temporary_path();

    let record_path = root.join("session");

    let sessions = || {

        EncryptedSessionStore::file(

            &record_path,

            StoreConfig::sqlite(root.join("store"), "test store passphrase"),

        )

    };

    let temporary = root.join("session.1.0.tmp");

    sessions()

        .save(&record("https://old.example"))

        .await

        .unwrap();

    std::fs::write(&temporary, b"half a rec").unwrap();

    let loaded = sessions().load().await.unwrap().unwrap();

    assert_eq!(loaded.homeserver(), "https://old.example");

    let writable = std::fs::metadata(&root).unwrap().permissions();

    let mut read_only = writable.clone();

    read_only.set_readonly(true);

    std::fs::set_permissions(&root, read_only).unwrap();

    assert!(

        sessions()

            .save(&record("https://new.example"))

            .await

            .is_err()

    );

    let loaded = sessions().load().await.unwrap().unwrap();

    assert_eq!(loaded.homeserver(), "https://old.example");

    std::fs::set_permissions(&root, writable).unwrap();

    std::fs::remove_dir_all(root).unwrap();

}

#[tokio::test]

async fn a_refresh_is_saved_before_anyone_hears_of_it() {

    use matrix_sdk_test::test_json;

    use wiremock::{

        Mock, ResponseTemplate,

        matchers::{header, method, path, path_regex},

    };

    let server = MatrixMockServer::new().await;

    server.mock_versions().ok().mount().await;

    server

        .mock_login()

        .respond_with(

            ResponseTemplate::new(200).set_body_json(&*test_json::LOGIN_WITH_REFRESH_TOKEN),

        )

        .mount()

        .await;

    Mock::given(method("POST"))

        .and(path_regex("sync"))

        .and(header("authorization", "Bearer abc123"))

        .respond_with(ResponseTemplate::new(401).set_body_json(serde_json::json!({

            "errcode": "M_UNKNOWN_TOKEN",

            "error": "expired",

            "soft_logout": false,

        })))

        .with_priority(1)

        .mount(server.server())

        .await;

    Mock::given(method("POST"))

        .and(path("/_matrix/client/v3/refresh"))

        .respond_with(

            ResponseTemplate::new(200).set_body_json(&*test_json::REFRESH_TOKEN_WITH_REFRESH_TOKEN),

        )

        .mount(server.server())

        .await;

    server

        .mock_sliding_sync()

        .ok(v5::Response::new("1".to_owned()))

        .mount()

        .await;

    let root = temporary_path();

    let sessions = Arc::new(EncryptedSessionStore::file(

        root.join("session"),

        StoreConfig::sqlite(root.join("store"), "test store passphrase"),

    ));

    let session = Session::login_password(

        PasswordLogin::new(server.uri(), "example", "wordpass").allow_insecure_loopback(true),

        sessions.clone(),

    )

    .await

    .unwrap();

    let (engine, handle, mut events) = session

        .build(EngineConfig::default().with_initial_history_limit(0))

        .await

        .unwrap();

    let running = tokio::spawn(engine.run());

    support::receive_until(&mut events, |event| {

        matches!(event, Event::SessionTokensChanged)

    })

    .await;

    let saved = serde_json::to_value(sessions.load().await.unwrap().unwrap()).unwrap();

    assert_eq!(saved["authentication"]["session"]["refresh_token"], "wxyz");

    support::shut_down(&handle, &mut events, running).await;

    drop(handle);

    std::fs::remove_dir_all(root).unwrap();

}

#[tokio::test]

async fn logging_in_again_after_a_soft_logout_keeps_the_device_and_its_store() {

    let server = MatrixMockServer::new().await;

    server.mock_versions().ok().mount().await;

    server.mock_login().ok().mount().await;

    let root = temporary_path();

    let accounts = Accounts::sqlite(&root, "test store passphrase");

    let login = |username: &str| {

        PasswordLogin::new(server.uri(), username, "wordpass").allow_insecure_loopback(true)

    };

    let device_ids = || async {

        let requests = server.server().received_requests().await.unwrap();

        requests

            .iter()

            .filter(|request| request.url.path().ends_with("/login"))

            .map(|request| request.body_json::<serde_json::Value>().unwrap()["device_id"].clone())

            .collect::<Vec<_>>()

    };

    let (first, session) = accounts

        .login_password(login("cheeky_monkey"))

        .await

        .unwrap();

    drop(session);

    assert!(matches!(

        accounts.login_password(login("cheeky_monkey")).await,

        Err(AccountError::AlreadyLoggedIn(_))

    ));

    first.sessions().soft_log_out().await.unwrap();

    let (resumed, session) = accounts

        .login_password(login(" Cheeky_Monkey "))

        .await

        .unwrap();

    drop(session);

    assert_eq!(resumed.id(), first.id());

    assert_eq!(device_ids().await.last().unwrap(), "GHTYAJCE");

    resumed.sessions().soft_log_out().await.unwrap();

    let (other, session) = accounts

        .login_password(login("someone_else"))

        .await

        .unwrap();

    drop(session);

    assert_ne!(other.id(), first.id());

    assert!(device_ids().await.last().unwrap().is_null());

    assert_eq!(accounts.list().await.unwrap().len(), 2);

    std::fs::remove_dir_all(root).unwrap();

}

#[tokio::test]

async fn a_refused_login_leaves_no_account_and_says_why() {

    use wiremock::ResponseTemplate;

    let server = MatrixMockServer::new().await;

    server.mock_versions().ok().mount().await;

    server

        .mock_login()

        .respond_with(ResponseTemplate::new(403).set_body_json(serde_json::json!({

            "errcode": "M_FORBIDDEN",

            "error": "Invalid username or password",

        })))

        .mount()

        .await;

    let root = temporary_path();

    let accounts = Accounts::sqlite(&root, "test store passphrase");

    let Err(refused) = accounts

        .login_password(

            PasswordLogin::new(server.uri(), "example", "wrong").allow_insecure_loopback(true),

        )

        .await

    else {

        panic!("a refused login went through");

    };

    let server_error = refused.server().unwrap();

    assert_eq!(server_error.errcode, "M_FORBIDDEN");

    assert_eq!(server_error.message, "Invalid username or password");

    assert!(accounts.list().await.unwrap().is_empty());

    assert_eq!(std::fs::read_dir(&root).unwrap().count(), 0);

    std::fs::remove_dir_all(root).unwrap();

}

#[tokio::test]

async fn a_homeserver_that_cant_be_one_is_refused_before_anything_is_sent() {

    let root = temporary_path();

    let sessions: Arc<dyn SessionStore> = Arc::new(EncryptedSessionStore::file(

        root.join("session"),

        StoreConfig::sqlite(root.join("store"), "test store passphrase"),

    ));

    for (homeserver, loopback) in [

        ("", true),

        ("  ", true),

        ("example .org", true),

        ("ftp://example.org", true),

        ("https://user@example.org", true),

        ("https://", true),

        ("example.org/path", true),

        ("http://example.org", false),

        ("http://example.org", true),

        ("http://localhost:8008", false),

    ] {

        let login =

            PasswordLogin::new(homeserver, "example", "wordpass").allow_insecure_loopback(loopback);

        let refused = Session::login_password(login, sessions.clone()).await;

        assert!(

            matches!(refused, Err(AccountError::InvalidHomeserver(_))),

            "{homeserver:?} got through"

        );

    }

    assert!(!root.exists());

}

fn record(homeserver: &str) -> SessionRecord {

    serde_json::from_value(serde_json::json!({

        "homeserver": homeserver,

        "authentication": {

            "type": "matrix",

            "session": {

                "user_id": "@example:example.org",

                "device_id": "DEVICE",

                "access_token": "secret",

            },

        },

    }))

    .unwrap()

}

fn temporary_path() -> PathBuf {

    let nonce = SystemTime::now()

        .duration_since(SystemTime::UNIX_EPOCH)

        .unwrap()

        .as_nanos();

    PathBuf::from(env!("CARGO_TARGET_TMPDIR")).join(format!("macltok-account-{nonce}"))

}

#[tokio::test]

async fn an_oauth_login_survives_the_page_going_away_for_its_redirect() {

    let server = MatrixMockServer::new().await;

    server

        .mock_versions()

        .with_simplified_sliding_sync()

        .ok()

        .mount()

        .await;

    server.mock_who_am_i().ok().mount().await;

    let oauth = server.oauth();

    oauth.mock_server_metadata().ok().mount().await;

    oauth.mock_registration().ok().mount().await;

    oauth.mock_token().ok().mount().await;

    let root = temporary_path();

    let accounts = Accounts::sqlite(&root, "test store passphrase");

    let redirect_uri = "http://127.0.0.1/callback";

    let (account, pending) = accounts

        .begin_oauth(

            OAuthLogin::new(

                server.uri(),

                redirect_uri,

                "http://127.0.0.1/",

                OAuthApplicationType::Native,

            )

            .allow_insecure_loopback(true),

        )

        .await

        .unwrap();

    let state = url::Url::parse(pending.authorization_url())

        .unwrap()

        .query_pairs()

        .find(|(key, _)| key == "state")

        .map(|(_, state)| state.into_owned())

        .unwrap();

    drop(pending);

    assert!(matches!(

        account.restore().await.unwrap(),

        Some(Restore::OAuthPending)

    ));

    assert_eq!(

        accounts.list().await.unwrap().len(),

        1,

        "the redirect's store was swept"

    );

    assert!(matches!(

        accounts

            .finish_oauth(&format!("{redirect_uri}?code=42&state=someone-else"))

            .await,

        Err(AccountError::NoPendingOAuth)

    ));

    let (finished, session) = accounts

        .finish_oauth(&format!("{redirect_uri}?code=42&state={state}"))

        .await

        .unwrap();

    assert_eq!(finished.id(), account.id());

    drop(session);

    assert!(matches!(

        account.restore().await.unwrap(),

        Some(Restore::Resumed(_))

    ));

}