/*
 * The contents of this file are subject to the terms of the Common Development and
 * Distribution License (the License). You may not use this file except in compliance with the
 * License.
 *
 * You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
 * specific language governing permission and limitations under the License.
 *
 * When distributing Covered Software, include this CDDL Header Notice in each file and include
 * the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
 * Header, with the fields enclosed by brackets [] replaced by your own identifying
 * information: "Portions Copyright [year] [name of copyright owner]".
 *
 * Copyright 2026 3A Systems, LLC.
 */
package org.opends.server.authorization.dseecompat;

import static com.forgerock.opendj.ldap.CoreMessages.ERR_ATTR_SYNTAX_DN_TRAILING_ESCAPE;
import static org.assertj.core.api.Assertions.*;

import org.forgerock.i18n.LocalizedIllegalArgumentException;
import org.forgerock.opendj.ldap.DN;
import org.forgerock.opendj.ldap.ResultCode;
import org.opends.server.DirectoryServerTestCase;
import org.opends.server.TestCaseUtils;
import org.opends.server.types.DirectoryException;
import org.testng.annotations.AfterClass;
import org.testng.annotations.BeforeClass;
import org.testng.annotations.DataProvider;
import org.testng.annotations.Test;

/**
 * Verifies that {@link PatternDN}, which parses the ACI target and userdn patterns and the DN criteria of
 * the access log filtering, reads a pattern the same way {@link DN#valueOf(String)} reads a DN (issue #1153).
 */
@SuppressWarnings("javadoc")
public class PatternDNTest extends DirectoryServerTestCase
{
  @BeforeClass
  public void setUp() throws Exception
  {
    TestCaseUtils.startFakeServer();
  }

  @AfterClass
  public void tearDown() throws DirectoryException
  {
    TestCaseUtils.shutdownFakeServer();
  }

  /** Patterns without a wildcard: each one must match the DN that DN.valueOf() reads from the same string. */
  @DataProvider
  public Object[][] patternsWithoutWildcard()
  {
    return new Object[][] {
      { "cn=a\\2Cb,dc=x" },
      { "cn=\"a\\,b\",dc=x" },
      // A hex pair inside quotes is decoded as it is outside quotes
      { "cn=\"a\\2Cb\",dc=x" },
      { "cn=\"J\\C3\\B6rg\",dc=x" },
      // Hex pairs that are still pending at the closing quote, or before an escaped character
      { "cn=\"ab\\2C\",dc=x" },
      { "cn=\"\\C3\\B6\\,\",dc=x" },
      // An empty value is followed by the next AVA or RDN, it does not swallow it
      { "cn=+sn=x,dc=y" },
      { "cn=x+sn=,dc=y" },
      { "cn=,dc=x" },
      { "cn= ,dc=x" },
      { "cn=;dc=x" },
      // A hex string may be followed directly by '+'
      { "cn=#04024869+sn=x,dc=y" },
      { "sn=x+cn=#04024869,dc=y" },
      // The RFC 2253 separator
      { "cn=a;dc=x" },
      // The AVAs of a multi-valued RDN match whatever their order
      { "sn=x+cn=y,dc=z" },
      { "cn=y+sn=x,dc=z" },
    };
  }

  @Test(dataProvider = "patternsWithoutWildcard")
  public void patternMatchesTheDNParsedFromTheSameString(String pattern) throws Exception
  {
    final DN dn = DN.valueOf(pattern);
    assertThat(PatternDN.decode(pattern).matchesDN(dn)).as("pattern %s against DN %s", pattern, dn).isTrue();
  }

  @DataProvider
  public Object[][] patternsAndOtherDNs()
  {
    return new Object[][] {
      { "cn=\"a\\2Cb\",dc=x", "cn=a2Cb,dc=x" },
      { "cn=+sn=x,dc=y", "cn=\\+sn\\=x,dc=y" },
      { "cn=,dc=x", "dc=x" },
      { "cn=,dc=x", "cn=\\,dc\\=x" },
      { "cn=#04024869+sn=x,dc=y", "cn=#04024869,dc=y" },
      { "sn=x+cn=y,dc=z", "sn=y+cn=x,dc=z" },
      { "sn=x+cn=y,dc=z", "sn=x+givenName=y,dc=z" },
    };
  }

  @Test(dataProvider = "patternsAndOtherDNs")
  public void patternDoesNotMatchADifferentDN(String pattern, String otherDN) throws Exception
  {
    assertThat(PatternDN.decode(pattern).matchesDN(DN.valueOf(otherDN))).isFalse();
  }

  /** Patterns that end in a lone backslash, which DN.valueOf() rejects too. */
  @DataProvider
  public Object[][] patternsWithATrailingBackslash()
  {
    return new Object[][] {
      { "cn=a\\" },
      { "cn=\\" },
      { "cn=a,dc=x\\" },
      { "cn=a*\\" },
    };
  }

  /** The pattern is rejected with the result code and the message of DN.valueOf(). */
  @Test(dataProvider = "patternsWithATrailingBackslash")
  public void patternWithATrailingBackslashIsRejected(String pattern) throws Exception
  {
    final Throwable patternError = catchThrowable(() -> PatternDN.decode(pattern));
    assertThat(patternError).isInstanceOf(DirectoryException.class);
    assertThat(((DirectoryException) patternError).getResultCode()).isEqualTo(ResultCode.INVALID_DN_SYNTAX);
    assertThat(((DirectoryException) patternError).getMessageObject().toString())
        .isEqualTo(ERR_ATTR_SYNTAX_DN_TRAILING_ESCAPE.get(pattern).toString());
    if (!pattern.contains("*"))
    {
      final Throwable dnError = catchThrowable(() -> DN.valueOf(pattern));
      assertThat(dnError).isInstanceOf(LocalizedIllegalArgumentException.class);
      assertThat(dnError.getMessage()).isEqualTo(patternError.getMessage());
    }
  }

  @DataProvider
  public Object[][] wildcardPatterns()
  {
    return new Object[][] {
      { "cn=#04024869+sn=*,dc=y", "cn=#04024869+sn=x,dc=y" },
      { "cn=a\\2Cb*,dc=x", "cn=a\\,bcd,dc=x" },
      { "cn=*,dc=x", "cn=a,dc=x" },
    };
  }

  @Test(dataProvider = "wildcardPatterns")
  public void wildcardPatternMatches(String pattern, String dn) throws Exception
  {
    assertThat(PatternDN.decode(pattern).matchesDN(DN.valueOf(dn))).isTrue();
  }
}