AuthSpec.hs

-- SPDX-License-Identifier: Apache-2.0
--
-- Copyright (C) 2026 Bin Jin. All Rights Reserved.

module Network.HProx.AuthSpec
  ( spec
  ) where

import Control.Exception     (bracket)
import Data.ByteString       qualified as BS
import Data.ByteString.Char8 qualified as BS8
import Data.IORef
import System.Directory      (removeFile)
import System.IO             (hClose, openTempFile)
import System.Log.FastLogger qualified as FL

import Network.HProx.Auth
import Network.HProx.Util

import Test.Hspec

spec :: Spec
spec =
    describe "auth file handling" $ do
        it "does not require proxy auth when no auth file is configured" $ do
            verifier <- loadProxyAuth (\_ _ -> return ()) Nothing
            case verifier of
                Nothing -> return ()
                Just _  -> expectationFailure "expected no proxy auth verifier"

        it "hashes plaintext entries, ignores invalid lines, and rewrites salted entries" $
            withTempAuthFile "alice:secret\ninvalid-line\nbob:too:many:fields\n" $ \path -> do
                verifier <- loadProxyAuth (\_ _ -> return ()) (Just path)
                case verifier of
                    Just verify -> do
                        verify "alice:secret" `shouldBe` True
                        verify "alice:wrong" `shouldBe` False
                    Nothing -> expectationFailure "expected proxy auth verifier"
                rewritten <- BS8.lines <$> BS.readFile path
                case rewritten of
                    [line] -> case passwordReader line of
                        Just ("alice", Salted salt hash) -> do
                            line `shouldBe` passwordWriter "alice" (PasswordSalted salt hash)
                            verifyPassword (PasswordSalted salt hash) "secret" `shouldBe` True
                            verifyPassword (PasswordSalted salt hash) "wrong" `shouldBe` False
                        parsed -> expectationFailure $ "unexpected rewritten auth line: " <> show parsed
                    lines' -> expectationFailure $ "unexpected rewritten auth file line count: " <> show (length lines')

        it "keeps an already salted file unchanged" $ do
            salted <- hashPasswordWithRandomSalt (PlainText "secret")
            let line = passwordWriter "alice" salted
                original = line <> "\n"
            withTempAuthFile original $ \path -> do
                _ <- loadProxyAuth (\_ _ -> return ()) (Just path)
                rewritten <- BS.readFile path
                rewritten `shouldBe` original

        it "normalizes CRLF plaintext entries before hashing and verification" $
            withTempAuthFile "alice:secret\r\n" $ \path -> do
                Just verifier <- loadProxyAuth (\_ _ -> return ()) (Just path)
                verifier "alice:secret" `shouldBe` True
                verifier "alice:secret\r" `shouldBe` False
                [rewritten] <- BS8.lines <$> BS.readFile path
                case passwordReader rewritten of
                    Just ("alice", Salted salt hash) ->
                        verifyPassword (PasswordSalted salt hash) "secret" `shouldBe` True
                    parsed -> expectationFailure $ "unexpected rewritten auth line: " <> show parsed

        it "redacts malformed auth-file lines in logs" $
            withTempAuthFile "alice:secret:hash:extra\nraw-secret-without-separators\n" $ \path -> do
                logs <- newIORef []
                _ <- loadProxyAuth (\_ msg -> modifyIORef' logs (BS8.append (FL.fromLogStr msg) "\n" :)) (Just path)
                renderedLogs <- BS.concat . reverse <$> readIORef logs
                renderedLogs `shouldSatisfy` BS8.isInfixOf "line 1"
                renderedLogs `shouldSatisfy` BS8.isInfixOf "alice"
                renderedLogs `shouldSatisfy` BS8.isInfixOf "line 2"
                renderedLogs `shouldNotSatisfy` BS8.isInfixOf "secret"
                renderedLogs `shouldNotSatisfy` BS8.isInfixOf "hash"
                renderedLogs `shouldNotSatisfy` BS8.isInfixOf "extra"
                renderedLogs `shouldNotSatisfy` BS8.isInfixOf "raw-secret-without-separators"

withTempAuthFile :: BS.ByteString -> (FilePath -> IO a) -> IO a
withTempAuthFile contents action = bracket create cleanup (action . fst)
  where
    create = do
        (path, handle) <- openTempFile "." "hprox-auth-test"
        BS.hPut handle contents
        hClose handle
        return (path, ())

    cleanup (path, ()) = removeFile path