#    Licensed under the Apache License, Version 2.0 (the "License"); you may
#    not use this file except in compliance with the License. You may obtain
#    a copy of the License at
#
#         http://www.apache.org/licenses/LICENSE-2.0
#
#    Unless required by applicable law or agreed to in writing, software
#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
#    License for the specific language governing permissions and limitations
#    under the License.

import errno
import os
import subprocess

import mock
import testresources
from testtools import matchers

from keystoneclient.common import cms
from keystoneclient import exceptions
from keystoneclient.tests.unit import client_fixtures
from keystoneclient.tests.unit import utils


class CMSTest(utils.TestCase, testresources.ResourcedTestCase):
    """Unit tests for the keystoneclient.common.cms module."""

    resources = [('examples', client_fixtures.EXAMPLES_RESOURCE)]

    def __init__(self, *args, **kwargs):
        super(CMSTest, self).__init__(*args, **kwargs)
        process = subprocess.Popen(['openssl', 'version'],
                                   stdout=subprocess.PIPE)
        out, err = process.communicate()
        # Example output: 'OpenSSL 0.9.8za 5 Jun 2014'
        openssl_version = out.split()[1]

        if err or openssl_version.startswith(b'0'):
            raise Exception('Your version of OpenSSL is not supported. '
                            'You will need to update it to 1.0 or later.')

    def _raise_OSError(*args):
        e = OSError()
        e.errno = errno.EPIPE
        raise e

    def test_cms_verify(self):
        self.assertRaises(exceptions.CertificateConfigError,
                          cms.cms_verify,
                          'data',
                          'no_exist_cert_file',
                          'no_exist_ca_file')

    def test_token_tocms_to_token(self):
        with open(os.path.join(client_fixtures.CMSDIR,
                               'auth_token_scoped.pem')) as f:
            AUTH_TOKEN_SCOPED_CMS = f.read()

        self.assertEqual(cms.token_to_cms(self.examples.SIGNED_TOKEN_SCOPED),
                         AUTH_TOKEN_SCOPED_CMS)

        tok = cms.cms_to_token(cms.token_to_cms(
            self.examples.SIGNED_TOKEN_SCOPED))
        self.assertEqual(tok, self.examples.SIGNED_TOKEN_SCOPED)

    def test_asn1_token(self):
        self.assertTrue(cms.is_asn1_token(self.examples.SIGNED_TOKEN_SCOPED))
        self.assertFalse(cms.is_asn1_token('FOOBAR'))

    def test_cms_sign_token_no_files(self):
        self.assertRaises(subprocess.CalledProcessError,
                          cms.cms_sign_token,
                          self.examples.TOKEN_SCOPED_DATA,
                          '/no/such/file', '/no/such/key')

    def test_cms_sign_token_no_files_pkiz(self):
        self.assertRaises(subprocess.CalledProcessError,
                          cms.pkiz_sign,
                          self.examples.TOKEN_SCOPED_DATA,
                          '/no/such/file', '/no/such/key')

    def test_cms_sign_token_success(self):
        self.assertTrue(
            cms.pkiz_sign(self.examples.TOKEN_SCOPED_DATA,
                          self.examples.SIGNING_CERT_FILE,
                          self.examples.SIGNING_KEY_FILE))

    def test_cms_verify_token_no_files(self):
        self.assertRaises(exceptions.CertificateConfigError,
                          cms.cms_verify,
                          self.examples.SIGNED_TOKEN_SCOPED,
                          '/no/such/file', '/no/such/key')

    def test_cms_verify_token_no_oserror(self):
        with mock.patch('subprocess.Popen.communicate',
                        new=self._raise_OSError):
            try:
                cms.cms_verify("x", '/no/such/file', '/no/such/key')
            except exceptions.CertificateConfigError as e:
                self.assertIn('/no/such/file', e.output)
                self.assertIn('Hit OSError ', e.output)
            else:
                self.fail('Expected exceptions.CertificateConfigError')

    def test_cms_verify_token_scoped(self):
        cms_content = cms.token_to_cms(self.examples.SIGNED_TOKEN_SCOPED)
        self.assertTrue(cms.cms_verify(cms_content,
                                       self.examples.SIGNING_CERT_FILE,
                                       self.examples.SIGNING_CA_FILE))

    def test_cms_verify_token_scoped_expired(self):
        cms_content = cms.token_to_cms(
            self.examples.SIGNED_TOKEN_SCOPED_EXPIRED)
        self.assertTrue(cms.cms_verify(cms_content,
                                       self.examples.SIGNING_CERT_FILE,
                                       self.examples.SIGNING_CA_FILE))

    def test_cms_verify_token_unscoped(self):
        cms_content = cms.token_to_cms(self.examples.SIGNED_TOKEN_UNSCOPED)
        self.assertTrue(cms.cms_verify(cms_content,
                                       self.examples.SIGNING_CERT_FILE,
                                       self.examples.SIGNING_CA_FILE))

    def test_cms_verify_token_v3_scoped(self):
        cms_content = cms.token_to_cms(self.examples.SIGNED_v3_TOKEN_SCOPED)
        self.assertTrue(cms.cms_verify(cms_content,
                                       self.examples.SIGNING_CERT_FILE,
                                       self.examples.SIGNING_CA_FILE))

    def test_cms_hash_token_no_token_id(self):
        token_id = None
        self.assertThat(cms.cms_hash_token(token_id), matchers.Is(None))

    def test_cms_hash_token_not_pki(self):
        """If the token_id is not a PKI token then it returns the token_id."""
        token = 'something'
        self.assertFalse(cms.is_asn1_token(token))
        self.assertThat(cms.cms_hash_token(token), matchers.Is(token))

    def test_cms_hash_token_default_md5(self):
        """The default hash method is md5."""
        token = self.examples.SIGNED_TOKEN_SCOPED
        token_id_default = cms.cms_hash_token(token)
        token_id_md5 = cms.cms_hash_token(token, mode='md5')
        self.assertThat(token_id_default, matchers.Equals(token_id_md5))
        # md5 hash is 32 chars.
        self.assertThat(token_id_default, matchers.HasLength(32))

    def test_cms_hash_token_sha256(self):
        """Can also hash with sha256."""
        token = self.examples.SIGNED_TOKEN_SCOPED
        token_id = cms.cms_hash_token(token, mode='sha256')
        # sha256 hash is 64 chars.
        self.assertThat(token_id, matchers.HasLength(64))

    @mock.patch('keystoneclient.common.cms._check_files_accessible')
    def test_process_communicate_handle_oserror_epipe(self, files_acc_mock):
        process_mock = mock.Mock()
        process_mock.communicate = self._raise_OSError
        process_mock.stderr = mock.Mock()
        process_mock.stderr.read = mock.Mock(return_value='proc stderr')
        files_acc_mock.return_value = 1, ('file_path', 'fileerror')
        output, err, retcode = cms._process_communicate_handle_oserror(
            process_mock, '', [])

        self.assertEqual((output, retcode), ('', 1))
        self.assertIn('file_path', err)
        self.assertIn('fileerror', err)
        self.assertIn('proc stderr', err)

    @mock.patch('keystoneclient.common.cms._check_files_accessible')
    def test_process_communicate_handle_oserror_epipe_files_ok(
            self, files_acc_mock):
        process_mock = mock.Mock()
        process_mock.communicate = self._raise_OSError
        process_mock.stderr = mock.Mock()
        process_mock.stderr.read = mock.Mock(return_value='proc stderr')
        files_acc_mock.return_value = -1, None
        output, err, retcode = cms._process_communicate_handle_oserror(
            process_mock, '', [])

        self.assertEqual((output, retcode), ('', -1))
        self.assertIn('proc stderr', err)

    def test_process_communicate_handle_oserror_no_exception(self):
        process_mock = mock.Mock()
        process_mock.communicate.return_value = 'out', 'err'
        process_mock.poll.return_value = 0

        output, err, retcode = cms._process_communicate_handle_oserror(
            process_mock, '', [])

        self.assertEqual(output, 'out')
        self.assertEqual(err, 'err')
        self.assertEqual(retcode, 0)


def load_tests(loader, tests, pattern):
    return testresources.OptimisingTestSuite(tests)
