malice

use aws_lc_rs::agreement::{ECDH_P256, PrivateKey};

use base64::{Engine, engine::general_purpose::URL_SAFE_NO_PAD};

use malice_push::{Allowlist, Message, Outcome, Sender, Subscription, Urgency, Vapid, ece};

use wiremock::{

    Mock, MockServer, ResponseTemplate,

    matchers::{header, method, path},

};

struct Browser {

    private: PrivateKey,

    auth: [u8; 16],

}

impl Browser {

    fn new() -> Self {

        Self {

            private: PrivateKey::generate(&ECDH_P256).unwrap(),

            auth: [3; 16],

        }

    }

    fn subscription(&self, endpoint: String) -> Subscription {

        Subscription {

            endpoint,

            p256dh: URL_SAFE_NO_PAD.encode(self.private.compute_public_key().unwrap().as_ref()),

            auth: URL_SAFE_NO_PAD.encode(self.auth),

        }

    }

}

async fn sender(server: &MockServer, dir: &tempfile::TempDir) -> Sender {

    let authority = server.address().to_string();

    Sender::new(

        Vapid::load_or_create(&dir.path().join("vapid.pk8")).unwrap(),

        "mailto:test@example.org".to_owned(),

        Allowlist::with_extra([authority]),

    )

    .unwrap()

}

#[tokio::test]

async fn delivers_encrypted_and_reports_gone_retry_and_refusal() {

    let server = MockServer::start().await;

    Mock::given(method("POST"))

        .and(path("/push/ok"))

        .and(header("content-encoding", "aes128gcm"))

        .and(header("urgency", "high"))

        .and(header("ttl", "43200"))

        .respond_with(ResponseTemplate::new(201))

        .expect(1)

        .mount(&server)

        .await;

    Mock::given(method("POST"))

        .and(path("/push/gone"))

        .respond_with(ResponseTemplate::new(410))

        .mount(&server)

        .await;

    Mock::given(method("POST"))

        .and(path("/push/flaky"))

        .respond_with(ResponseTemplate::new(503))

        .up_to_n_times(1)

        .with_priority(1)

        .mount(&server)

        .await;

    Mock::given(method("POST"))

        .and(path("/push/flaky"))

        .respond_with(ResponseTemplate::new(201))

        .with_priority(2)

        .mount(&server)

        .await;

    let dir = tempfile::tempdir().unwrap();

    let sender = sender(&server, &dir).await;

    let browser = Browser::new();

    let message = Message {

        payload: br#"{"web_push":8030}"#,

        urgency: Urgency::High,

        topic: "!room:example.org",

    };

    let ok = browser.subscription(format!("{}/push/ok", server.uri()));

    assert_eq!(sender.send(&ok, &message).await, Outcome::Delivered);

    let requests = server.received_requests().await.unwrap();

    let request = &requests[0];

    let authorization = request.headers["authorization"].to_str().unwrap();

    assert!(authorization.starts_with("vapid t="));

    assert!(authorization.ends_with(&format!("k={}", sender.vapid_public_key())));

    assert_eq!(request.headers["topic"].to_str().unwrap().len(), 32);

    let plain = ece::decrypt(&browser.private, &browser.auth, &request.body).unwrap();

    assert_eq!(plain, message.payload);

    let gone = browser.subscription(format!("{}/push/gone", server.uri()));

    let outcome = sender.send(&gone, &message).await;

    assert_eq!(outcome, Outcome::Gone);

    assert!(outcome.drops_subscription());

    let flaky = browser.subscription(format!("{}/push/flaky", server.uri()));

    assert_eq!(sender.send(&flaky, &message).await, Outcome::Delivered);

    let elsewhere = browser.subscription("https://example.org/push".to_owned());

    assert_eq!(sender.send(&elsewhere, &message).await, Outcome::Refused);

    let bad_keys = Subscription {

        p256dh: "AAAA".to_owned(),

        ..ok

    };

    assert_eq!(sender.send(&bad_keys, &message).await, Outcome::Refused);

}