/*
 * The contents of this file are subject to the terms of the Common Development and
 * Distribution License (the License). You may not use this file except in compliance with the
 * License.
 *
 * You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
 * specific language governing permission and limitations under the License.
 *
 * When distributing Covered Software, include this CDDL Header Notice in each file and include
 * the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
 * Header, with the fields enclosed by brackets [] replaced by your own identifying
 * information: "Portions copyright [year] [name of copyright owner]".
 *
 * Copyright 2026 3A Systems, LLC.
 */
package org.opends.dsml.protocol;

import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.nio.charset.StandardCharsets;
import java.nio.file.Files;
import java.nio.file.Path;
import java.util.Comparator;
import java.util.stream.Stream;

import javax.xml.XMLConstants;

import org.forgerock.testng.ForgeRockTestCase;
import org.testng.annotations.AfterClass;
import org.testng.annotations.BeforeClass;
import org.testng.annotations.DataProvider;
import org.testng.annotations.Test;
import org.xml.sax.Attributes;
import org.xml.sax.InputSource;
import org.xml.sax.SAXException;
import org.xml.sax.XMLReader;
import org.xml.sax.helpers.DefaultHandler;

import jakarta.xml.bind.JAXBElement;

import static org.testng.Assert.assertEquals;
import static org.testng.Assert.assertFalse;
import static org.testng.Assert.assertTrue;

/**
 * Tests the XML parsing the gateway configures itself, as opposed to the
 * parser SAAJ builds internally (which {@link SoapEntityExpansionTestCase}
 * covers).
 * <p>
 * {@code DSMLServlet.createSafeXMLReader()} hardens its reader through
 * {@code safeSetFeature}, which logs and carries on when a feature is not
 * supported by the parser in use - so a parser change, or a feature name
 * change, would disarm it without failing anything. That reader parses
 * untrusted input: when SAAJ refuses a request, the gateway hands the very same
 * body to it a second time to recover the requestID
 * ({@code createXMLParsingErrorResponse}).
 * <p>
 * The tests only ever reference {@code file:} URIs under a temporary
 * directory, so they perform no network or DNS I/O.
 */
@SuppressWarnings("javadoc")
@Test(groups = { "precommit", "dsml" })
public class DSMLXmlParsingTestCase extends ForgeRockTestCase
{
  private static final String CANARY = "s3cr3t-canary-value";
  private static final String DISALLOW_DOCTYPE = "http://apache.org/xml/features/disallow-doctype-decl";
  private static final String EXTERNAL_GENERAL_ENTITIES = "http://xml.org/sax/features/external-general-entities";
  private static final String EXTERNAL_PARAMETER_ENTITIES = "http://xml.org/sax/features/external-parameter-entities";

  private Path tempDir;
  private String canaryUri;
  private String externalDtdUri;

  @BeforeClass
  public void createPayloadFiles() throws IOException
  {
    tempDir = Files.createTempDirectory("dsml-parser-test");
    Path canary = Files.write(tempDir.resolve("canary.txt"), CANARY.getBytes(StandardCharsets.UTF_8));
    canaryUri = canary.toUri().toASCIIString();
    Path dtd = Files.write(tempDir.resolve("canary.dtd"),
        ("<!ENTITY xxe SYSTEM \"" + canaryUri + "\">").getBytes(StandardCharsets.UTF_8));
    externalDtdUri = dtd.toUri().toASCIIString();
  }

  @AfterClass
  public void deletePayloadFiles() throws IOException
  {
    if (tempDir != null)
    {
      try (Stream<Path> paths = Files.walk(tempDir))
      {
        paths.sorted(Comparator.reverseOrder()).forEach(path -> path.toFile().delete());
      }
    }
  }

  /**
   * The features the reader is hardened with must actually be in effect, not
   * merely have been requested.
   */
  @Test
  public void testSafeXmlReaderIsHardened() throws Exception
  {
    XMLReader xmlReader = new DSMLServlet().createSafeXMLReader();

    assertTrue(xmlReader.getFeature(XMLConstants.FEATURE_SECURE_PROCESSING),
        "secure processing is not in effect");
    assertTrue(xmlReader.getFeature(DISALLOW_DOCTYPE),
        "a DOCTYPE declaration would be accepted");
    assertFalse(xmlReader.getFeature(EXTERNAL_GENERAL_ENTITIES),
        "external general entities would be resolved");
    assertFalse(xmlReader.getFeature(EXTERNAL_PARAMETER_ENTITIES),
        "external parameter entities would be resolved");
  }

  @DataProvider
  public Object[][] entityPayloads()
  {
    return new Object[][] {
      { "external general entity",
        "<?xml version=\"1.0\"?>"
        + "<!DOCTYPE batchRequest [<!ENTITY xxe SYSTEM \"" + canaryUri + "\">]>"
        + batchRequest("&xxe;") },
      { "external DTD subset",
        "<?xml version=\"1.0\"?>"
        + "<!DOCTYPE batchRequest SYSTEM \"" + externalDtdUri + "\">"
        + batchRequest("&xxe;") },
    };
  }

  /**
   * A DOCTYPE is refused outright; should a future parser accept one, the file
   * contents must still not reach the parsed document.
   */
  @Test(dataProvider = "entityPayloads")
  public void testSafeXmlReaderNeverExpandsAnExternalEntity(String label, String request) throws Exception
  {
    XMLReader xmlReader = new DSMLServlet().createSafeXMLReader();
    TextCollector collector = new TextCollector();
    xmlReader.setContentHandler(collector);
    try
    {
      xmlReader.parse(new InputSource(asStream(request)));
    }
    catch (SAXException e)
    {
      // Refused, which is what disallow-doctype-decl is there for.
      return;
    }
    assertFalse(collector.text.toString().contains(CANARY),
        label + ": the external entity was expanded: " + collector.text);
  }

  /** A well-formed request must still parse, otherwise the test above is empty. */
  @Test
  public void testSafeXmlReaderParsesAPlainRequest() throws Exception
  {
    XMLReader xmlReader = new DSMLServlet().createSafeXMLReader();
    TextCollector collector = new TextCollector();
    xmlReader.setContentHandler(collector);
    xmlReader.parse(new InputSource(asStream(batchRequest("a plain attribute value"))));

    assertEquals(collector.requestID, "42");
    assertTrue(collector.text.toString().contains("a plain attribute value"),
        "unexpected content: " + collector.text);
  }

  /**
   * The recovery path the servlet takes when SAAJ has refused the request: the
   * body is parsed a second time, and that second parse must go through the
   * hardened reader rather than reintroduce the entity expansion.
   */
  @Test(dataProvider = "entityPayloads")
  public void testXmlParsingErrorResponseDoesNotExpandEntities(String label, String request) throws Exception
  {
    ObjectFactory objFactory = new ObjectFactory();
    BatchResponse batchResponse = objFactory.createBatchResponse();
    InputStream is = asStream(request);

    JAXBElement<ErrorResponse> response = new DSMLServlet()
        .createXMLParsingErrorResponse(is, objFactory, batchResponse, "parser error");

    assertFalse(String.valueOf(response.getValue().getMessage()).contains(CANARY),
        label + ": the error response carries the file contents");
    assertFalse(String.valueOf(batchResponse.getRequestID()).contains(CANARY),
        label + ": the requestID carries the file contents");
  }

  /** The same path, on a request the parser accepts: the requestID is recovered. */
  @Test
  public void testXmlParsingErrorResponseRecoversTheRequestID() throws Exception
  {
    ObjectFactory objFactory = new ObjectFactory();
    BatchResponse batchResponse = objFactory.createBatchResponse();

    JAXBElement<ErrorResponse> response = new DSMLServlet().createXMLParsingErrorResponse(
        asStream(batchRequest("a plain attribute value")), objFactory, batchResponse, "parser error");

    assertEquals(batchResponse.getRequestID(), "42");
    assertEquals(response.getValue().getMessage(), "parser error");
  }

  /** {@code createXMLParsingErrorResponse} rewinds the stream, so it must support it. */
  private InputStream asStream(String request)
  {
    return new ByteArrayInputStream(request.getBytes(StandardCharsets.UTF_8));
  }

  private static String batchRequest(String value)
  {
    return "<batchRequest xmlns=\"urn:oasis:names:tc:DSML:2:0:core\" requestID=\"42\">"
        + "<addRequest dn=\"cn=probe,dc=example,dc=com\">"
        + "<attr name=\"description\"><value>" + value + "</value></attr>"
        + "</addRequest></batchRequest>";
  }

  /** Collects the character data of a parsed document, and the requestID. */
  private static final class TextCollector extends DefaultHandler
  {
    private final StringBuilder text = new StringBuilder();
    private String requestID;

    @Override
    public void startElement(String uri, String localName, String qName, Attributes attributes)
    {
      if (requestID == null && "batchRequest".equals(localName))
      {
        requestID = attributes.getValue("requestID");
      }
    }

    @Override
    public void characters(char[] ch, int start, int length)
    {
      text.append(ch, start, length);
    }
  }
}