malice

use std::{

    net::TcpListener,

    path::PathBuf,

    process::{Child, Command, Stdio},

    sync::atomic::{AtomicBool, Ordering},

    time::Duration,

};

use matrix_sdk::test_utils::mocks::MatrixMockServer;

use reqwest::{Client, StatusCode, header};

use serde_json::{Value, json};

use tempfile::TempDir;

use wiremock::{

    Mock, ResponseTemplate,

    matchers::{method, path_regex},

};

struct Server(Child);

impl Drop for Server {

    fn drop(&mut self) {

        let _ = self.0.kill();

        let _ = self.0.wait();

    }

}

fn server_binary() -> PathBuf {

    option_env!("CARGO_BIN_EXE_malice")

        .map(PathBuf::from)

        .unwrap_or_else(|| {

            std::env::current_exe()

                .expect("integration test executable")

                .parent()

                .expect("cargo deps directory")

                .parent()

                .expect("cargo target directory")

                .join("malice")

        })

}

async fn start(port: u16, data_dir: &TempDir, client: &Client) -> Server {

    let child = Command::new(server_binary())

        .env("MALICE_BIND", format!("127.0.0.1:{port}"))

        .env("MALICE_DATA_DIR", data_dir.path())

        .env("MALICE_SESSION_COOKIE_SECURE", "false")

        .env("MALICE_ALLOW_HTTP_HOMESERVER", "true")

        .stdout(Stdio::null())

        .stderr(Stdio::inherit())

        .spawn()

        .expect("start Malice backend");

    let mut server = Server(child);

    tokio::time::timeout(Duration::from_secs(30), async {

        loop {

            if let Some(status) = server.0.try_wait().expect("poll backend") {

                panic!("Malice exited before health check: {status}");

            }

            if client

                .get(format!("http://127.0.0.1:{port}/api/health"))

                .send()

                .await

                .is_ok_and(|response| response.status().is_success())

            {

                break;

            }

            tokio::time::sleep(Duration::from_millis(100)).await;

        }

    })

    .await

    .expect("Malice did not start");

    server

}

fn unused_port() -> u16 {

    TcpListener::bind("127.0.0.1:0")

        .expect("bind ephemeral port")

        .local_addr()

        .expect("read ephemeral port")

        .port()

}

#[tokio::test]

async fn login_isolated_cookie_survives_restart_and_logout_revokes_it() {

    let matrix = MatrixMockServer::new().await;

    matrix.mock_versions().ok().mount().await;

    matrix.mock_login().ok().expect(1).mount().await;

    let first_room = AtomicBool::new(false);

    Mock::given(method("POST"))

        .and(path_regex("/sync$"))

        .respond_with(move |request: &wiremock::Request| {

            let body: Value = serde_json::from_slice(&request.body).unwrap();

            let rooms =

                if body["conn_id"] == "room-list" && !first_room.swap(true, Ordering::Relaxed) {

                    json!({"!malice:localhost": {

                        "initial": true,

                        "name": "Malice test room",

                        "joined_count": 1,

                        "required_state": [{

                            "type": "m.room.member",

                            "state_key": "@cheeky_monkey:matrix.org",

                            "sender": "@cheeky_monkey:matrix.org",

                            "event_id": "$join:localhost",

                            "origin_server_ts": 1,

                            "content": {"membership": "join"}

                        }],

                        "timeline": [{

                            "type": "m.room.message",

                            "sender": "@cheeky_monkey:matrix.org",

                            "event_id": "$recent:localhost",

                            "origin_server_ts": 2,

                            "content": {"msgtype":"m.text", "body":"recent channel message"}

                        },{

                            "type": "m.room.message",

                            "sender": "@cheeky_monkey:matrix.org",

                            "event_id": "$image:localhost",

                            "origin_server_ts": 3,

                            "content": {

                                "msgtype": "m.image",

                                "body": "image.png",

                                "url": "mxc://localhost/avatar",

                                "info": {"mimetype": "image/png", "size": 13}

                            }

                        }],

                        "prev_batch": "older-page"

                    }})

                } else {

                    json!({})

                };

            ResponseTemplate::new(200)

                .set_body_json(json!({"pos":"1","lists":{},"rooms":rooms,"extensions":{}}))

                .set_delay(Duration::from_millis(100))

        })

        .mount(matrix.server())

        .await;

    Mock::given(method("GET"))

        .and(path_regex("/rooms/.*/messages$"))

        .respond_with(ResponseTemplate::new(200).set_body_json(json!({

            "start": "older-page",

            "chunk": [{

                "type": "m.room.message",

                "room_id": "!malice:localhost",

                "sender": "@cheeky_monkey:matrix.org",

                "event_id": "$older:localhost",

                "origin_server_ts": 1,

                "content": {"msgtype":"m.text", "body":"older channel message"}

            }]

        })))

        .mount(matrix.server())

        .await;

    matrix

        .mock_room_state_encryption()

        .expect_access_token("abc123")

        .plain()

        .mount()

        .await;

    matrix

        .mock_room_send()

        .expect_access_token("abc123")

        .body_matches_partial_json(json!({"body":"backend room smoke"}))

        .ok(matrix_sdk::ruma::event_id!("$sent:localhost"))

        .expect(1)

        .mount()

        .await;

    Mock::given(method("GET"))

        .and(path_regex("/download/[^/]+/avatar$"))

        .respond_with(ResponseTemplate::new(200).set_body_bytes(b"\x89PNG\r\n\x1a\nimage".to_vec()))

        .mount(matrix.server())

        .await;

    Mock::given(method("GET"))

        .and(path_regex("/download/[^/]+/svg$"))

        .respond_with(

            ResponseTemplate::new(200).set_body_bytes(b"<svg onload='alert(1)'/>".to_vec()),

        )

        .mount(matrix.server())

        .await;

    let data_dir = tempfile::tempdir().expect("temporary user stores");

    let client = Client::new();

    let port = unused_port();

    let base = format!("http://127.0.0.1:{port}");

    let server = start(port, &data_dir, &client).await;

    let guest: Value = client

        .get(format!("{base}/api/session"))

        .send()

        .await

        .unwrap()

        .json()

        .await

        .unwrap();

    assert_eq!(guest["user_id"], Value::Null);

    assert_eq!(

        client

            .get(format!("{base}/api/rooms"))

            .send()

            .await

            .unwrap()

            .status(),

        StatusCode::UNAUTHORIZED

    );

    let cross_origin = client

        .post(format!("{base}/api/login"))

        .header(header::ORIGIN, "https://attacker.example")

        .json(&json!({

            "homeserver": matrix.uri(),

            "username": "alice",

            "password": "test-password"

        }))

        .send()

        .await

        .unwrap();

    assert_eq!(cross_origin.status(), StatusCode::FORBIDDEN);

    let cross_port = client

        .post(format!("{base}/api/login"))

        .header(header::ORIGIN, format!("http://127.0.0.1:{}", port + 1))

        .json(&json!({

            "homeserver": matrix.uri(),

            "username": "alice",

            "password": "test-password"

        }))

        .send()

        .await

        .unwrap();

    assert_eq!(cross_port.status(), StatusCode::FORBIDDEN);

    let login = client

        .post(format!("{base}/api/login"))

        .header(header::ORIGIN, &base)

        .json(&json!({

            "homeserver": matrix.uri(),

            "username": "alice",

            "password": "test-password"

        }))

        .send()

        .await

        .unwrap();

    assert!(

        login.status().is_success(),

        "login returned {}",

        login.status()

    );

    let cookie = login

        .headers()

        .get(header::SET_COOKIE)

        .expect("opaque session cookie")

        .to_str()

        .unwrap()

        .split(';')

        .next()

        .unwrap()

        .to_owned();

    let logged_in: Value = login.json().await.unwrap();

    assert!(logged_in["user_id"].as_str().is_some());

    #[cfg(unix)]

    {

        use std::os::unix::fs::PermissionsExt;

        let sid = cookie.split_once('=').unwrap().1;

        let mode = |path: std::path::PathBuf| {

            std::fs::metadata(path).unwrap().permissions().mode() & 0o777

        };

        assert_eq!(mode(data_dir.path().join("master.key")), 0o600);

        assert_eq!(mode(data_dir.path().join("sessions")), 0o700);

        assert_eq!(

            mode(data_dir.path().join("sessions").join(format!("{sid}.bin"))),

            0o600

        );

    }

    assert_eq!(

        client

            .get(format!("{base}/api/rooms"))

            .send()

            .await

            .unwrap()

            .status(),

        StatusCode::UNAUTHORIZED,

        "one browser must not inherit another browser's Matrix session"

    );

    assert_eq!(

        client

            .get(format!("{base}/api/media"))

            .query(&[("mxc", "mxc://localhost/avatar")])

            .send()

            .await

            .unwrap()

            .status(),

        StatusCode::UNAUTHORIZED,

    );

    assert_eq!(

        client

            .get(format!("{base}/api/media"))

            .header(header::COOKIE, &cookie)

            .query(&[("mxc", "not-a-mxc")])

            .send()

            .await

            .unwrap()

            .status(),

        StatusCode::BAD_REQUEST,

    );

    let avatar = client

        .get(format!("{base}/api/media"))

        .header(header::COOKIE, &cookie)

        .query(&[("mxc", "mxc://localhost/avatar")])

        .send()

        .await

        .unwrap();

    assert_eq!(avatar.status(), StatusCode::OK);

    assert_eq!(

        avatar.headers().get(header::CONTENT_TYPE).unwrap(),

        "image/png"

    );

    assert_eq!(

        avatar.bytes().await.unwrap().as_ref(),

        b"\x89PNG\r\n\x1a\nimage"

    );

    assert_eq!(

        client

            .get(format!("{base}/api/media"))

            .header(header::COOKIE, &cookie)

            .query(&[("mxc", "mxc://localhost/svg")])

            .send()

            .await

            .unwrap()

            .status(),

        StatusCode::UNSUPPORTED_MEDIA_TYPE,

    );

    let rooms = client

        .get(format!("{base}/api/rooms"))

        .header(header::COOKIE, &cookie)

        .send()

        .await

        .unwrap();

    assert!(rooms.status().is_success());

    let rooms: Value = rooms.json().await.unwrap();

    assert!(rooms["rooms"].is_array());

    tokio::time::timeout(Duration::from_secs(5), async {

        loop {

            let response: Value = client

                .get(format!("{base}/api/rooms"))

                .header(header::COOKIE, &cookie)

                .send()

                .await

                .unwrap()

                .json()

                .await

                .unwrap();

            if response["rooms"]

                .as_array()

                .unwrap()

                .iter()

                .any(|room| room["room_id"] == "!malice:localhost")

            {

                break;

            }

            tokio::time::sleep(Duration::from_millis(50)).await;

        }

    })

    .await

    .expect("joined room appeared in live room list");

    let open = client

        .post(format!("{base}/api/rooms/open"))

        .header(header::ORIGIN, &base)

        .header(header::COOKIE, &cookie)

        .json(&json!({"room_id":"!malice:localhost"}))

        .send()

        .await

        .unwrap();

    assert_eq!(open.status(), StatusCode::NO_CONTENT);

    let media_id = tokio::time::timeout(Duration::from_secs(10), async {

        loop {

            let mut stream = client

                .get(format!("{base}/api/events"))

                .header(header::COOKIE, &cookie)

                .send()

                .await

                .unwrap();

            let frame = stream.chunk().await.unwrap().expect("SSE snapshot");

            let text = std::str::from_utf8(&frame).unwrap();

            let payload = text

                .lines()

                .find_map(|line| line.strip_prefix("data: "))

                .unwrap();

            let snapshot: Value = serde_json::from_str(payload).unwrap();

            if let Some(id) = snapshot["timelines"]["!malice:localhost"]

                .as_array()

                .and_then(|items| {

                    items.iter().find_map(|item| {

                        item["Event"]["content"]["Message"]["media"]["id"].as_str()

                    })

                })

            {

                break id.to_owned();

            }

            tokio::time::sleep(Duration::from_millis(50)).await;

        }

    })

    .await

    .expect("opened room registered image attachment");

    assert_eq!(

        client

            .get(format!("{base}/api/message-media"))

            .query(&[("media_id", media_id.as_str()), ("size", "Full")])

            .send()

            .await

            .unwrap()

            .status(),

        StatusCode::UNAUTHORIZED,

    );

    let attachment = client

        .get(format!("{base}/api/message-media"))

        .header(header::COOKIE, &cookie)

        .query(&[("media_id", media_id.as_str()), ("size", "Full")])

        .send()

        .await

        .unwrap();

    assert_eq!(attachment.status(), StatusCode::OK);

    assert_eq!(

        attachment.headers().get(header::CONTENT_TYPE).unwrap(),

        "image/png"

    );

    assert_eq!(

        attachment.bytes().await.unwrap().as_ref(),

        b"\x89PNG\r\n\x1a\nimage"

    );

    let sent = client

        .post(format!("{base}/api/rooms/send"))

        .header(header::ORIGIN, &base)

        .header(header::COOKIE, &cookie)

        .json(&json!({"room_id":"!malice:localhost", "body":"backend room smoke"}))

        .send()

        .await

        .unwrap();

    assert_eq!(sent.status(), StatusCode::NO_CONTENT);

    tokio::time::timeout(Duration::from_secs(5), async {

        loop {

            if matrix

                .received_requests()

                .await

                .unwrap()

                .iter()

                .any(|request| request.url.path().contains("/send/m.room.message/"))

            {

                break;

            }

            tokio::time::sleep(Duration::from_millis(50)).await;

        }

    })

    .await

    .expect("message reached Matrix send endpoint");

    tokio::time::timeout(Duration::from_secs(15), async {

        loop {

            let mut stream = client

                .get(format!("{base}/api/events"))

                .header(header::COOKIE, &cookie)

                .send()

                .await

                .unwrap();

            let frame = stream.chunk().await.unwrap().expect("SSE snapshot");

            let text = std::str::from_utf8(&frame).unwrap();

            let payload = text

                .lines()

                .find_map(|line| line.strip_prefix("data: "))

                .unwrap();

            let snapshot: Value = serde_json::from_str(payload).unwrap();

            if snapshot["connection"] == "online"

                && snapshot["timelines"]["!malice:localhost"]

                    .as_array()

                    .is_some_and(|items| {

                        items.iter().any(|item| {

                            item["Event"]["content"]["Message"]["body"] == "older channel message"

                                && item["Event"]["event_id"] == "$older:localhost"

                        }) && items.iter().any(|item| {

                            item["Event"]["content"]["Message"]["body"] == "backend room smoke"

                                && item["Event"]["event_id"] == "$sent:localhost"

                                && item["Event"]["send_state"] == "Sent"

                        })

                    })

            {

                break;

            }

            tokio::time::sleep(Duration::from_millis(50)).await;

        }

    })

    .await

    .expect("server-confirmed message appeared in online timeline SSE snapshot");

    drop(server);

    let _restored = start(port, &data_dir, &client).await;

    let session: Value = client

        .get(format!("{base}/api/session"))

        .header(header::COOKIE, &cookie)

        .send()

        .await

        .unwrap()

        .json()

        .await

        .unwrap();

    assert_eq!(session["user_id"], logged_in["user_id"]);

    let mut events = client

        .get(format!("{base}/api/events"))

        .header(header::COOKIE, &cookie)

        .send()

        .await

        .unwrap();

    assert_eq!(events.status(), StatusCode::OK);

    let initial = events.chunk().await.unwrap().expect("initial SSE frame");

    assert!(String::from_utf8_lossy(&initial).contains("\"type\":\"snapshot\""));

    matrix

        .mock_logout()

        .expect_access_token("abc123")

        .ok()

        .expect(1)

        .mount()

        .await;

    let logout = client

        .post(format!("{base}/api/logout"))

        .header(header::ORIGIN, &base)

        .header(header::COOKIE, &cookie)

        .send()

        .await

        .unwrap();

    assert_eq!(logout.status(), StatusCode::NO_CONTENT);

    tokio::time::timeout(Duration::from_secs(2), async {

        while events.chunk().await.unwrap().is_some() {}

    })

    .await

    .expect("logout must close the authenticated event stream");

    let after_logout: Value = client

        .get(format!("{base}/api/session"))

        .header(header::COOKIE, &cookie)

        .send()

        .await

        .unwrap()

        .json()

        .await

        .unwrap();

    assert_eq!(after_logout["user_id"], Value::Null);

}