#!/usr/bin/env python -tt

"""
unittests.test_authdb
"""

try:
    import unittest2 as unittest
except ImportError:
    import unittest

import logging
import mock
import os
import sys

import dbsign.logger as L
from dbsign.result import Failure, Success
import dbsign.shell as sh
import dbsign.security as S

log = L.get_logger(__name__)


@unittest.skipUnless(sys.platform == 'darwin',
                     "The authorizationdb is used only by macOS systems.")
class TestAuthDB(unittest.TestCase):
    def setUp(self):
        # Use system.privilege.taskport.debug since it can
        # be restored using the DevToolsSecurity tool
        self.invalid_priv = "foo.bar.baz"
        self.test_priv = "system.privilege.taskport.debug"

        # stash for later
        self.orig_unsafe_flag = os.getenv(S.UNSAFE_FLAG, None)

    def tearDown(self):
        if self.orig_unsafe_flag:
            os.environ[S.UNSAFE_FLAG] = self.orig_unsafe_flag

    def test_privilege_read(self):
        # assert read of valid privilege succeeds and matches
        priv = self.test_priv

        res_read = S.authdb_privilege_read(priv)
        self.assertTrue(res_read)
        rules = S.rules_from(res_read.value)

        cmd_read = sh.run(['security', 'authorizationdb', 'read', priv])
        self.assertTrue(cmd_read)

        for rule in rules:
            self.assertIn(rule, cmd_read.stdout)

    @unittest.skipUnless(os.getenv(S.UNSAFE_FLAG), "Requires --unsafe")
    def test_privilege_read_negative(self):
        """
        - assert read of invalid privilege fails

        Consecutive unsuccessful read operations can
        result in delayed or denied authdb calls.
        Require --unsafe to prevent inadvertent lockouts.
        """
        priv = self.invalid_priv
        log_level = L._root.level

        L.set_level(logging.CRITICAL)
        res_read = S.authdb_privilege_read(priv)
        L.set_level(log_level)
        self.assertFalse(res_read)

    def test_privilege_write_safe(self):
        # make sure we have a value backed up, then delete it
        if S.UNSAFE_FLAG in os.environ:
            del os.environ[S.UNSAFE_FLAG]

        res_write = S.authdb_privilege_write(self.test_priv, '42')
        self.assertFalse(res_write)
        self.assertIn('--unsafe', res_write.value)

    @unittest.skipUnless(os.getenv(S.UNSAFE_FLAG), "Requires --unsafe")
    def test_privilege_write(self):
        """
        - read current privilege value
        - write and verify new value
        - restore and verify original value
        - in case of failure, re-run DevToolsSecurity to ensure safe value
        """
        priv = self.test_priv
        test_rule = "is-admin"

        # read current value
        res_read = S.authdb_privilege_read(priv)
        self.assertTrue(res_read)
        # stash for later
        orig_value = res_read.value

        # write new value
        res_write = S.authdb_privilege_write(priv, "is-admin")
        self.assertTrue(res_write)

        # read new value
        res_verify = S.authdb_privilege_read(priv)
        self.assertTrue(res_verify)
        new_rules = S.rules_from(res_verify.value)
        self.assertEqual([test_rule], new_rules)

        # restore original value
        cmdline = ['security', 'authorizationdb', 'write', priv]
        res_restore = sh.sudo_run(cmdline, stdin=orig_value)
        self.assertTrue(res_restore)

        # verify restored value
        res_verify2 = S.authdb_privilege_read(priv)
        self.assertTrue(res_verify2)
        orig_rules = S.rules_from(orig_value)
        restored_rules = S.rules_from(res_verify2.value)
        restored_check = orig_rules == restored_rules
        self.assertEqual(orig_rules, restored_rules,
                         "There was an error restoring "+priv+". Falling back"
                         " to system defaults. You may need to re-run"
                         " DevToolsSecurity or re-init debugsign.")

        if not restored_check:
            cmd_dts = sh.sudo_run(['/usr/sbin/DevToolsSecurity', '-disable'])
            self.assertTrue(cmd_dts, "Failed to re-run DevToolsSecurity")

    @unittest.skipUnless(os.getenv(S.UNSAFE_FLAG), "Requires --unsafe")
    def test_privilege_write_negative(self):
        """
        - assert write of invalid privilege fails

        Consecutive unsuccessful write operations can
        result in delayed or denied authdb calls.
        Require --unsafe to prevent inadvertent lockouts.
        """
        priv = self.invalid_priv
        log_level = L._root.level

        L.set_level(logging.CRITICAL)
        res_write = S.authdb_privilege_write(priv, priv)
        L.set_level(log_level)
        self.assertFalse(res_write)

    def test_rules_from(self):
        for test_name in test_xml:
            with self.subTest(name=test_name):
                expected_rules, xml = test_xml[test_name]
                rules = S.rules_from(xml)
                self.assertEqual(expected_rules, rules)

    @mock.patch('plistlib.readPlistFromString')
    @mock.patch('dbsign.security.authdb_privilege_read')
    def test_verify_privilege(self, mock_auth_priv_read, mock_plist_read):
        mock_auth_priv_read.return_value = Failure('error1')
        res1 = S.verify_privilege('test1')
        self.assertFalse(res1)
        self.assertEqual('error1', res1.value)

        mock_auth_priv_read.return_value = Success('succ1')
        mock_plist_read.return_value = {'rule': ['allow']}
        res2 = S.verify_privilege('test2')
        self.assertTrue(res2)
        self.assertEqual('test2', res2.value)

    @mock.patch('dbsign.security.verify_privilege')
    def test_verify_privileges(self, mock_verify_priv):
        mock_verify_priv.side_effect = [
                Failure('1'),
                Success('2'), Failure('3'),
                Success('4'), Success('5')]

        res1 = S.verify_privileges('one')
        self.assertFalse(res1)
        self.assertEqual('1', res1.value)

        res2 = S.verify_privileges(['two', 'three'])
        self.assertFalse(res2)
        self.assertEqual('3', res2.value)

        privs = ['four', 'five']
        res3 = S.verify_privileges(list(privs))
        self.assertTrue(res3)
        self.assertEqual(privs, res3.value)


test_xml = {
    # Default value of system.privilege.taskport circa 10.13
    'sample1': ([],
        """<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict><key>allow-root</key><false/><key>authenticate-user</key><true/><key>class</key><string>user</string><key>comment</key><string>Used by task_for_pid(...).  Task_for_pid is called by programs requesting full control over another program for things like debugging or performance analysis. This authorization only applies if the requesting and target programs are run by the same user; it will never authorize access to the program of another user.  WARNING: administrators are advised not to modify this right.</string><key>created</key><real>529441603.70259798</real><key>group</key><string>_developer</string><key>modified</key><real>529441603.70259798</real><key>session-owner</key><false/><key>shared</key><true/><key>timeout</key><integer>36000</integer><key>tries</key><integer>10000</integer><key>version</key><integer>0</integer></dict></plist>"""),  # noqa: E501
    # Default value of system.privilege.taskport.debug
    'sample2': (['is-admin', 'is-developer', 'authenticate-developer'],
                """<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict><key>class</key><string>rule</string><key>created</key><real>505914196.93768197</real><key>k-of-n</key><integer>1</integer><key>modified</key><real>531881084.83930701</real><key>rule</key><array><string>is-admin</string><string>is-developer</string><string>authenticate-developer</string></array><key>version</key><integer>0</integer></dict></plist>"""),  # noqa: E501
    # Example of plist after running debugsign
    'sample3': (['allow'],
                """<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict><key>class</key><string>rule</string><key>created</key><real>505914196.93768197</real><key>modified</key><real>531785828.17900801</real><key>rule</key><array><string>allow</string></array><key>version</key><integer>0</integer></dict></plist>"""),  # noqa: E501
}