/**
 * TASK-0134 — file-upload abuse (ASVS L2 §13; spec: "Upload abuse — magic
 * bytes, SVG attachment-only, quota, path traversal").
 *
 * The authoritative upload-security controls all live in the PURE
 * `@factory/storage` policy module (`mime.ts` / `keys.ts`), which the API
 * enforces at session-creation (claimed type + size) and at completion
 * (magic-byte sniff vs claim, SVG override on signed URLs). This suite:
 *
 *  1. **Closed MIME allow-list** (`isAllowedMime`) — executables, HTML/JS,
 *     wasm, apk, and every other type outside the closed set are rejected.
 *  2. **Magic-byte sniffing is authoritative** (`detectMimeType`,
 *     `sniffMagicBytes`, `sniffVerdict`) — the bytes win over the claim:
 *     a PNG masquerading as text → `mismatch` (the file is marked FAILED +
 *     deleted in the API, never "trust and warn"). Text-family claims have
 *     no magic signal (`no-signal`), ISO-BMFF family aliases resolve `ok`.
 *  3. **SVG is attachment-only** (`CONTENT_TYPE_OVERRIDES`) — a stored
 *     SVG is served as `text/plain` + `Content-Disposition: attachment`
 *     (the stored-XSS vector is closed at the signed-URL layer, not the
 *     client).
 *  4. **Quota / size policy** (`isAllowedUpload`, `effectiveStorageQuota`)
 *     — the plan ceilings (free 50 MB / paid 500 MB, 1 GB / 10 GB storage),
 *     the admin override can only TIGHTEN, executables are blocked by MIME
 *     or extension regardless of the claim.
 *  5. **Path traversal** (`sanitizeFilename`, `buildFileKey`) — traversal
 *     sequences, control chars, and forbidden chars never survive into the
 *     object key; the key is always `files/<ws>/<file>/<version>/<name>`.
 *  6. **Live API session-creation** — the 413 FILE_TOO_LARGE (free plan >
 *     50 MB) and the 400 mime_not_allowed are enforced on the wire before
 *     any object bytes leave the client (both checks are presign-free, so
 *     they run without MinIO; the sniff/completion path needs S3 and is
 *     covered by the pure-control tests above).
 *
 * Live tests skip (not fail) when the API is down; SEC_REQUIRE_LIVE=1 (CI)
 * makes a down API fail the suite.
 */
import { describe, expect, it } from "vitest";
import {
  detectMimeType,
  sniffMagicBytes,
  sniffVerdict,
  isAllowedMime,
  isAllowedUpload,
  sanitizeFilename,
  buildFileKey,
  UPLOAD_ALLOWED_MIMES,
  CONTENT_TYPE_OVERRIDES,
  MIME_SIGNATURES,
  type SniffVerdict
} from "@factory/storage";
import { readFileSync } from "node:fs";
import { fileURLToPath } from "node:url";
import { checkLiveApp, apiFetch } from "./helpers/app.js";

const REPO_ROOT = fileURLToPath(new URL("../..", import.meta.url));

const live = await checkLiveApp();
const itLive = it.skipIf(!live);

// ── byte fixtures (minimal-but-valid magic prefixes) ───────────────────────
const PNG = Uint8Array.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0, 0, 0, 0]);
const JPEG = Uint8Array.from([0xff, 0xd8, 0xff, 0xe0, 0, 0, 0, 0]);
const GIF = Uint8Array.from([0x47, 0x49, 0x46, 0x38, 0x39, 0x61]);
const PDF = Uint8Array.from([...Buffer.from("%PDF-1.7\n%eof")]);
const ZIP = Uint8Array.from([0x50, 0x4b, 0x03, 0x04, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]); // empty local header
const WEBP = new Uint8Array(16);
WEBP.set([0x52, 0x49, 0x46, 0x46], 0); // "RIFF"
WEBP[4] = 16; WEBP[5] = 0; WEBP[6] = 0; WEBP[7] = 0; // box size
WEBP.set([0x57, 0x45, 0x42, 0x50], 8); // "WEBP"
const TEXT = new TextEncoder().encode("hello world — this is plain text\nline two");
const SVG = new TextEncoder().encode('<?xml version="1.0"?><svg xmlns="http://www.w3.org/2000/svg"><script>alert(1)</script></svg>');

// ---------------------------------------------------------------------------
// 1. Closed MIME allow-list (claimed type, session-creation gate)
// ---------------------------------------------------------------------------
describe("upload-abuse / closed MIME allow-list", () => {
  it("the allow-list is exactly the documented set (closed, not open-by-exception)", () => {
    const expected = new Set([
      "image/png", "image/jpeg", "image/webp", "image/gif", "image/svg+xml",
      "application/pdf",
      "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
      "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
      "application/vnd.openxmlformats-officedocument.presentationml.presentation",
      "text/markdown", "text/plain", "text/csv",
      "application/zip",
      "video/mp4", "video/webm", "video/quicktime",
      "audio/mpeg", "audio/wav", "audio/mp4",
      "application/octet-stream"
    ]);
    expect(new Set(UPLOAD_ALLOWED_MIMES)).toEqual(expected);
  });

  it("executables / web-content / archive-danger types are NOT allowed", () => {
    for (const bad of [
      "application/x-msdownload", // .exe
      "application/vnd.microsoft.dll",
      "application/x-dosexec", // .bat
      "text/html", // XSS via HTML upload
      "text/javascript", // direct JS
      "application/javascript",
      "application/wasm",
      "application/vnd.android.package-archive", // .apk
      "application/x-msi-installer",
      "application/x-shockwave-flash",
      "application/hta",
      "image/vnd.microsoft.icon" // not on the allow-list (only image/x-icon… which is also absent — closed set)
    ]) {
      expect(isAllowedMime(bad), `${bad} must be rejected`).toBe(false);
    }
  });

  it("every documented allowed type is accepted", () => {
    for (const mime of UPLOAD_ALLOWED_MIMES) expect(isAllowedMime(mime), `${mime} must be allowed`).toBe(true);
  });
});

// ---------------------------------------------------------------------------
// 2. Magic-byte sniffing is AUTHORITATIVE over the claim
// ---------------------------------------------------------------------------
describe("upload-abuse / magic-byte sniffing (authoritative, never trust-and-warn)", () => {
  it("detects the real type from bytes for every signed format", () => {
    expect(detectMimeType(PNG).mime).toBe("image/png");
    expect(detectMimeType(JPEG).mime).toBe("image/jpeg");
    expect(detectMimeType(GIF).mime).toBe("image/gif");
    expect(detectMimeType(PDF).mime).toBe("application/pdf");
    expect(detectMimeType(WEBP).mime).toBe("image/webp");
    expect(detectMimeType(ZIP).mime).toBe("application/zip");
    expect(detectMimeType(TEXT).mime).toBe("text/plain"); // text heuristic
    expect(detectMimeType(SVG).confidence).toBe("text"); // SVG has no magic (text)
    expect(detectMimeType(SVG, "diagram.svg").mime).toBe("image/svg+xml"); // ext fallback
  });

  it("the sniff table covers every signature-bearing allow-listed image type", () => {
    const signed = new Set(MIME_SIGNATURES.map((s) => s.mime));
    for (const m of ["image/png", "image/jpeg", "image/gif", "image/webp"]) {
      expect(signed.has(m), `${m} must be magic-verifiable`).toBe(true);
    }
    // text-family types are intentionally magic-less (no-signal path).
    for (const m of ["text/plain", "text/markdown", "text/csv", "image/svg+xml", "application/octet-stream"]) {
      expect(signed.has(m), `${m} is magic-less by design`).toBe(false);
    }
  });

  it("a signature-bearing claim with mismatched bytes is a MISMATCH (the file is failed + deleted)", () => {
    // TEXT claiming image/png → the claim HAS a signature, the bytes match none:
    expect(sniffVerdict(TEXT, "image/png"), "text masquerading as png = mismatch").toBe("mismatch");
    // ZIP bytes claiming image/png:
    expect(sniffVerdict(ZIP, "image/png")).toBe("mismatch");
    // SVG bytes (text — no magic) claiming image/png: the claim is
    // signature-bearing, the bytes match NO signature → mismatch. (This is
    // the stored-SVG-as-png attack: it is failed + deleted, not trusted.)
    expect(sniffVerdict(SVG, "image/png")).toBe("mismatch");
    // A claim with NO signature (text/svg/octet) has nothing to disprove
    // the bytes → no-signal (the worker's metadata re-sniff is final).
    expect(sniffVerdict(PNG, "text/plain")).toBe("no-signal");
    expect(sniffVerdict(SVG, "image/svg+xml")).toBe("no-signal");
    expect(sniffVerdict(PNG, "application/octet-stream")).toBe("no-signal");
  });

  it("a matching signature is ok; the ISO-BMFF family alias is ok (not a false mismatch)", () => {
    expect(sniffVerdict(PNG, "image/png")).toBe("ok");
    expect(sniffVerdict(JPEG, "image/jpeg")).toBe("ok");
    // Build a real ftyp "M4A " (audio/mp4) buffer claiming the generic video/mp4:
    const m4a = new Uint8Array(16);
    m4a.set([0, 0, 0, 0x10], 0); // box size 16
    m4a.set([0x66, 0x74, 0x79, 0x70], 4); // "ftyp"
    m4a.set([0x4d, 0x34, 0x41, 0x20], 8); // brand "M4A "
    expect(sniffMagicBytes(m4a)).toBe("audio/mp4");
    expect(sniffVerdict(m4a, "video/mp4"), "same-artifact alias → ok").toBe("ok");
    // A mismatch is STILL a mismatch (png bytes ≠ ftyp):
    expect(sniffVerdict(PNG, "audio/mp4")).toBe("mismatch");
  });

  it("the verdict type is a closed 3-value union (no silent 'warn' path)", () => {
    const verdicts: SniffVerdict[] = ["ok", "no-signal", "mismatch"];
    for (const v of verdicts) expect(typeof v).toBe("string");
    // The API treats "mismatch" as terminal (FAILED MIME_MISMATCH + delete).
    // Recorded here so a future 4th verdict value is a compile break.
    expect(verdicts).toHaveLength(3);
  });
});

// ---------------------------------------------------------------------------
// 3. SVG is attachment-only (the stored-XSS vector is closed at the URL layer)
// ---------------------------------------------------------------------------
describe("upload-abuse / SVG attachment-only", () => {
  it("SVG is the ONLY content-type override and it is text/plain + attachment", () => {
    expect(Object.keys(CONTENT_TYPE_OVERRIDES)).toEqual(["image/svg+xml"]);
    const svg = CONTENT_TYPE_OVERRIDES["image/svg+xml"]!;
    expect(svg.contentType).toBe("text/plain"); // browser will NOT render it as XML/JS
    expect(svg.disposition).toBe("attachment"); // download, not inline
  });

  it("every NON-svg type is served with its true MIME, inline-capable", () => {
    for (const mime of UPLOAD_ALLOWED_MIMES) {
      if (mime === "image/svg+xml") continue;
      expect(CONTENT_TYPE_OVERRIDES[mime], `${mime} must have NO override`).toBeUndefined();
    }
  });

  it("a malicious SVG (with <script>) is detected as svg and would be served attachment-only", () => {
    const det = detectMimeType(SVG, "payload.svg");
    expect(det.mime).toBe("image/svg+xml");
    // The override that the signed-URL layer applies to THIS detected type:
    const override = CONTENT_TYPE_OVERRIDES[det.mime];
    expect(override).toBeDefined();
    expect(override!.disposition).toBe("attachment");
  });
});

// ---------------------------------------------------------------------------
// 4. Quota / size / executable policy
// ---------------------------------------------------------------------------
describe("upload-abuse / quota + size + executable policy", () => {
  it("plan ceilings: free 50 MB file / 1 GB storage; paid 500 MB / 10 GB (static: the API quota module)", () => {
    // The plan ceilings live in apps/api/src/modules/files/quota.ts
    // (PLAN_USAGE_LIMITS) — app code, so the DoD forbids importing it: the
    // values are pinned against the SOURCE (a drift breaks the build) and
    // enforced on the wire by the live 413 test below.
    const quotaSrc = readFileSync(REPO_ROOT + "/apps/api/src/modules/files/quota.ts", "utf8");
    expect(quotaSrc).toMatch(/free:.*maxFileSize:\s*50 \* 1024 \* 1024/);
    expect(quotaSrc).toMatch(/free:.*storageQuota:\s*1024 \* 1024 \* 1024/);
    expect(quotaSrc).toMatch(/paid:.*maxFileSize:\s*500 \* 1024 \* 1024/);
    expect(quotaSrc).toMatch(/paid:.*storageQuota:\s*10 \* 1024 \* 1024 \* 1024/);
    // The admin override can only tighten: the min-rule is in the same file.
    expect(quotaSrc).toMatch(/Math\.min\(/);
  });

  it("executables are blocked by MIME or by extension, regardless of the claim", () => {
    expect(isAllowedUpload("application/x-msdownload", { size: 1000 }).allowed).toBe(false);
    expect(isAllowedUpload("application/x-msdownload", { size: 1000 }).reason).toBe("executable");
    // A .exe extension with an ALLOWED claimed mime is still blocked:
    expect(isAllowedUpload("application/octet-stream", { filename: "malware.exe", size: 1000 }).allowed).toBe(false);
    expect(isAllowedUpload("application/octet-stream", { filename: "setup.msi", size: 1000 }).reason).toBe("executable");
    // Backslash traversal in the filename is also an extension trap:
    expect(isAllowedUpload("application/octet-stream", { filename: "..\\evil\\a.exe", size: 1000 }).allowed).toBe(false);
    // A harmless file passes:
    expect(isAllowedUpload("image/png", { filename: "photo.png", size: 1000 }).allowed).toBe(true);
  });

  it("oversized files are rejected with reason too_large (against the given ceiling)", () => {
    expect(isAllowedUpload("image/png", { maxBytes: 10, size: 11 }).allowed).toBe(false);
    expect(isAllowedUpload("image/png", { maxBytes: 10, size: 11 }).reason).toBe("too_large");
    expect(isAllowedUpload("image/png", { maxBytes: 10, size: 10 }).allowed).toBe(true);
    expect(isAllowedUpload("image/png", {})).toEqual({ allowed: true }); // no size given
  });
});

// ---------------------------------------------------------------------------
// 5. Path traversal in object keys
// ---------------------------------------------------------------------------
describe("upload-abuse / path traversal (object keys are traversal-proof)", () => {
  const parts = { workspaceId: "ws1", fileId: "f1", version: 1 };

  it("forward-backslash traversal never survives into the key", () => {
    for (const evil of [
      "../../etc/passwd",
      "a/b/../../../etc/shadow",
      "..\\..\\windows\\system32",
      "....//....//etc/passwd",
      "/etc/passwd",
      "a\\..\\..\\b"
    ]) {
      const key = buildFileKey({ ...parts, name: evil });
      expect(key, `key for ${evil}`).toMatch(/^files\/ws1\/f1\/1\/[^/]+$/); // exactly one final segment
      expect(key, `no traversal in key for ${evil}`).not.toMatch(/(\.\.|\/\.\.)/);
    }
  });

  it("control chars, forbidden chars, and NUL are sanitized to underscores", () => {
    for (const evil of ["a\nb.png", "a\x00b.exe", "a<col>on.png", "a:pipe|d.png", "a*star?.png", "a\"quote\".png"]) {
      const key = buildFileKey({ ...parts, name: evil });
      expect(key).toMatch(/^files\/ws1\/f1\/1\/[^/]+$/);
      const base = key.split("/").pop()!; // the NAME segment only
      for (const ch of ["\n", "\x00", "<", ">", ":", "|", "*", "?", '"', "/", "\\"]) {
        expect(base, `no ${JSON.stringify(ch)} in the name segment for ${JSON.stringify(evil)}`).not.toContain(ch);
      }
    }
  });

  it("dots-only / empty / hidden names become the safe default 'file'", () => {
    expect(sanitizeFilename("")).toBe("file");
    expect(sanitizeFilename("...")).toBe("file");
    expect(sanitizeFilename(".")).toBe("file");
    expect(sanitizeFilename("..")).toBe("file");
    expect(sanitizeFilename("a/b/../../")).toBe("file");
  });

  it("long names are capped (180) with the extension preserved", () => {
    const long = "x".repeat(400) + ".png";
    const key = buildFileKey({ ...parts, name: long });
    const base = key.split("/").pop()!;
    expect(base.length).toBeLessThanOrEqual(180);
    expect(base.endsWith(".png")).toBe(true);
  });

  it("a traversal attempt with a double extension still cannot escape the key prefix", () => {
    // The name is inside the key AFTER the version segment; even a
    // double-extension (evil.png.exe) stays a single path segment because
    // sanitizeFilename strips every "/" and "\\".
    const key = buildFileKey({ ...parts, name: "evil.png.exe" });
    expect(key).toBe(`files/ws1/f1/1/evil.png.exe`);
    // …and the .exe extension would be rejected by isAllowedUpload on the
    // claimed type (the closed allow-list has no exe mime; the ext is a
    // second independent gate at request time).
    expect(isAllowedUpload("application/octet-stream", { filename: "evil.png.exe", size: 1 }).allowed).toBe(false);
  });
});

// ---------------------------------------------------------------------------
// 6. Live API: session-creation gates (presign-free → no MinIO needed)
// ---------------------------------------------------------------------------
describe("upload-abuse / live API session-creation gates", () => {
  async function freshUser(): Promise<{ token: string; workspaceId: string }> {
    const email = `secupl_${Date.now()}_${Math.floor(Math.random() * 1e6)}@example.com`;
    const reg = await apiFetch("/auth/register", {
      method: "POST",
      body: JSON.stringify({ name: "Sec Upload", email, password: "Str0ngPass!x9" })
    });
    if (reg.status !== 201) throw new Error(`register ${reg.status}: ${await reg.text()}`);
    const login = await apiFetch("/auth/login", {
      method: "POST",
      body: JSON.stringify({ email, password: "Str0ngPass!x9" })
    });
    if (login.status !== 200) throw new Error(`login ${login.status}: ${await login.text()}`);
    const lb = (await login.json()) as { accessToken: string };
    const wl = await apiFetch("/workspaces", { headers: { authorization: `Bearer ${lb.accessToken}` } });
    const wlb = (await wl.json()) as { data: { id: string; billingPlan: string }[] };
    const ws = wlb.data[0];
    if (!ws) throw new Error("no personal workspace");
    return { token: lb.accessToken, workspaceId: ws.id };
  }

  itLive(
    "a file over the free-plan 50 MB ceiling is 413 FILE_TOO_LARGE (before any presign)",
    async () => {
      const { token, workspaceId } = await freshUser();
      const res = await apiFetch("/files/uploads", {
        method: "POST",
        headers: { authorization: `Bearer ${token}`, "x-factory-workspace": workspaceId },
        body: JSON.stringify({ name: "big.png", size: 51 * 1024 * 1024, mimeType: "image/png" })
      });
      expect(res.status, "51 MB on the free plan must be 413").toBe(413);
      const body = (await res.json()) as { error?: { code?: string; details?: { maxBytes?: number }[] } };
      expect(body.error?.code).toBe("FILE_TOO_LARGE");
      expect(body.error?.details?.[0]?.maxBytes).toBe(50 * 1024 * 1024);
    },
    { timeout: 90_000 }
  );

  itLive(
    "a disallowed claimed MIME is 400 mime_not_allowed (the closed allow-list on the wire)",
    async () => {
      const { token, workspaceId } = await freshUser();
      for (const mime of ["application/x-msdownload", "text/html", "application/wasm"]) {
        const res = await apiFetch("/files/uploads", {
          method: "POST",
          headers: { authorization: `Bearer ${token}`, "x-factory-workspace": workspaceId },
          body: JSON.stringify({ name: "f.bin", size: 1000, mimeType: mime })
        });
        expect(res.status, `${mime} must be 400`).toBe(400);
        const body = (await res.json()) as {
          error?: { code?: string; details?: { field?: string; issue?: string; received?: string }[] };
        };
        expect(body.error?.code).toBe("VALIDATION_ERROR");
        expect(body.error?.details?.[0]?.issue).toBe("mime_not_allowed");
        expect(body.error?.details?.[0]?.received).toBe(mime);
      }
    },
    { timeout: 90_000 }
  );

  itLive(
    "a valid small image is accepted (201) — the allow path still works",
    async () => {
      const { token, workspaceId } = await freshUser();
      const res = await apiFetch("/files/uploads", {
        method: "POST",
        headers: { authorization: `Bearer ${token}`, "x-factory-workspace": workspaceId },
        body: JSON.stringify({ name: "photo.png", size: 2048, mimeType: "image/png" })
      });
      // 201 (or a MinIO-presign failure — the ALLOW decisions are upstream of
      // the presign, so a non-400/413 proves the gates passed).
      expect(res.status, `valid image should pass the gates (got ${res.status})`).not.toBe(400);
      expect(res.status).not.toBe(413);
      const raw = await res.text();
      if (res.status === 201) {
        const body = JSON.parse(raw) as {
          upload?: { uploadUrl?: string; method?: string; headers?: Record<string, string> };
        };
        expect(body.upload?.method).toBe("PUT");
        expect(body.upload?.headers?.["Content-Type"]).toBe("image/png"); // signed into the URL
        expect(body.upload?.uploadUrl ?? "").toContain("X-Amz-Signature");
      }
    },
    { timeout: 90_000 }
  );
});