// Copyright 2023 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package sbomutil

import (
	"context"
	"io/ioutil"
	"testing"

	"cos.googlesource.com/cos/tools.git/src/pkg/config"
	"cos.googlesource.com/cos/tools.git/src/pkg/fakes"
	"github.com/google/go-cmp/cmp"
	spdx_common "github.com/spdx/tools-golang/spdx/v2/common"
	spdx2_2 "github.com/spdx/tools-golang/spdx/v2/v2_2"
)

func TestGenerateSBOM(t *testing.T) {
	timeNow = func() string { return "2023-04-27T16:08:32Z" }
	testData := []struct {
		testName  string
		sbomInput *SBOMInput
		want      *spdx2_2.Document
		wantErr   bool
	}{
		{
			testName: "ValidInput",
			sbomInput: &SBOMInput{
				OutputImageName:    "image1",
				OutputImageVersion: "123",
				Creators:           []string{"Organization: G"},
				Supplier:           "Organization: G",
				SPDXPackages: []*spdx2_2.Package{
					{
						PackageName:           "pkg1",
						PackageSPDXIdentifier: "SPDXRef-pkg1",
						PackageVersion:        "111",
						PackageSupplier: &spdx_common.Supplier{
							Supplier:     "K",
							SupplierType: "Organization",
						},
						FilesAnalyzed:           false,
						PackageLicenseDeclared:  "BSD-3-Clause AND Apache-2.0",
						PackageLicenseConcluded: "BSD-3-Clause AND Apache-2.0",
						PackageDownloadLocation: "test.com",
						PackageExternalReferences: []*spdx2_2.PackageExternalReference{
							{
								Category: "SECURITY",
								RefType:  "cpe23Type",
								Locator:  "cpe:/a:vendor:pkg-1:1.2.3",
							},
						},
						PackageChecksums: []spdx_common.Checksum{
							{
								Algorithm: spdx_common.ChecksumAlgorithm("SHA1"),
								Value:     "11d7774ac38f40e009dcee453a760750aea75bbd",
							},
						},
					},
				},
				SBOMPackages: []*SBOMPackage{
					{
						Name:          "pkg2",
						SpdxDocument:  "doc-url",
						Algorithm:     spdx_common.ChecksumAlgorithm("SHA1"),
						ChecksumValue: "11d7774ac38f40e009dcee453a760750aea11111",
					},
				},
				ExtractedLicensingInfos: []*spdx2_2.OtherLicense{
					{
						LicenseIdentifier:      "LicenseRef-license1",
						ExtractedText:          "test license",
						LicenseCrossReferences: []string{"license-url"},
					},
				},
			},
			want: &spdx2_2.Document{
				SPDXVersion:       "SPDX-2.2",
				DataLicense:       "CC0-1.0",
				SPDXIdentifier:    spdx_common.ElementID("SPDXRef-DOCUMENT"),
				DocumentName:      "image1-123_sbom.spdx.json",
				DocumentNamespace: "NOASSERTION",
				ExternalDocumentReferences: []spdx2_2.ExternalDocumentRef{
					{
						DocumentRefID: "DocumentRef-pkg2",
						URI:           "doc-url",
						Checksum: spdx_common.Checksum{
							Algorithm: spdx_common.ChecksumAlgorithm("SHA1"),
							Value:     "11d7774ac38f40e009dcee453a760750aea11111",
						},
					},
				},
				CreationInfo: &spdx2_2.CreationInfo{
					Creators: []spdx_common.Creator{
						{
							Creator:     "gcr.io/cos-cloud/cos-customizer",
							CreatorType: "Tool"},
						{
							Creator:     "G",
							CreatorType: "Organization",
						},
					},
					Created: "2023-04-27T16:08:32Z",
				},
				Packages: []*spdx2_2.Package{
					{
						PackageName:           "image1",
						PackageSPDXIdentifier: "SPDXRef-image1",
						PackageVersion:        "123",
						PackageSupplier: &spdx_common.Supplier{
							Supplier:     "G",
							SupplierType: "Organization",
						},
						FilesAnalyzed:           false,
						PackageLicenseDeclared:  "NOASSERTION",
						PackageLicenseConcluded: "NOASSERTION",
						PackageDownloadLocation: "NOASSERTION",
					},
					{
						PackageName:           "pkg1",
						PackageSPDXIdentifier: "SPDXRef-pkg1",
						PackageVersion:        "111",
						PackageSupplier: &spdx_common.Supplier{
							Supplier:     "K",
							SupplierType: "Organization",
						},
						FilesAnalyzed:           false,
						PackageLicenseDeclared:  "BSD-3-Clause AND Apache-2.0",
						PackageLicenseConcluded: "BSD-3-Clause AND Apache-2.0",
						PackageDownloadLocation: "test.com",
						PackageExternalReferences: []*spdx2_2.PackageExternalReference{
							{
								Category: "SECURITY",
								RefType:  "cpe23Type",
								Locator:  "cpe:/a:vendor:pkg-1:1.2.3",
							},
						},
						PackageChecksums: []spdx_common.Checksum{
							{
								Algorithm: spdx_common.ChecksumAlgorithm("SHA1"),
								Value:     "11d7774ac38f40e009dcee453a760750aea75bbd",
							},
						},
					},
				},
				OtherLicenses: []*spdx2_2.OtherLicense{
					{
						LicenseIdentifier:      "LicenseRef-license1",
						ExtractedText:          "test license",
						LicenseCrossReferences: []string{"license-url"},
					},
				},
				Relationships: []*spdx2_2.Relationship{
					{
						RefA:         spdx_common.DocElementID{ElementRefID: spdx_common.ElementID("SPDXRef-DOCUMENT")},
						RefB:         spdx_common.DocElementID{ElementRefID: spdx_common.ElementID("SPDXRef-image1")},
						Relationship: "DESCRIBES",
					},
					{
						RefA:         spdx_common.DocElementID{ElementRefID: spdx_common.ElementID("SPDXRef-image1")},
						RefB:         spdx_common.DocElementID{ElementRefID: spdx_common.ElementID("SPDXRef-pkg1")},
						Relationship: "CONTAINS",
					},
					{
						RefA:         spdx_common.DocElementID{ElementRefID: spdx_common.ElementID("SPDXRef-image1")},
						RefB:         spdx_common.DocElementID{ElementRefID: spdx_common.ElementID("DocumentRef-pkg2")},
						Relationship: "CONTAINS",
					},
				},
			},
		},
		{
			testName: "InvalidCreator",
			sbomInput: &SBOMInput{
				OutputImageName:    "image2",
				OutputImageVersion: "123",
				Creators:           []string{"OrganizationG"},
			},
			wantErr: true,
		},
		{
			testName: "InvalidSupplier",
			sbomInput: &SBOMInput{
				OutputImageName:    "image2",
				OutputImageVersion: "123",
				Creators:           []string{"Organization: G"},
				Supplier:           "OrganizationG",
			},
			wantErr: true,
		},
	}

	for _, test := range testData {
		test := test
		t.Run(test.testName, func(t *testing.T) {
			t.Parallel()
			sbom := NewSBOMCreator(nil, nil, nil)
			sbom.sbomInput = test.sbomInput
			srcImage := &config.Image{}
			outImage := &config.Image{}
			if err := sbom.GenerateSBOM(srcImage, outImage); (err != nil) != test.wantErr {
				t.Fatalf("Unexpected error status, want err: %v, got err: %v", test.wantErr, err)
			}
			if !test.wantErr {
				if diff := cmp.Diff(sbom.sbomOutput, test.want, cmp.AllowUnexported(spdx2_2.Package{})); diff != "" {
					t.Fatalf("Mismatch in output SBOM Document. diff: %v", diff)
				}
			}
		})
	}
}

func TestUploadSBOMToGCS(t *testing.T) {
	ctx := context.Background()
	fakeGCS := fakes.GCSForTest(t)
	gcsClient := fakeGCS.Client
	defer fakeGCS.Close()
	sbom := NewSBOMCreator(ctx, gcsClient, nil)
	sbom.sbomOutput = &spdx2_2.Document{
		SPDXVersion:       "SPDX-2.2",
		DataLicense:       "CC0-1.0",
		SPDXIdentifier:    spdx_common.ElementID("SPDXRef-DOCUMENT"),
		DocumentName:      "image1_sbom.json",
		DocumentNamespace: "NOASSERTION",
		CreationInfo: &spdx2_2.CreationInfo{
			Creators: []spdx_common.Creator{
				{
					Creator:     "gcr.io/cos-cloud/cos-customizer",
					CreatorType: "Tool"},
				{
					Creator:     "G",
					CreatorType: "Organization",
				},
			},
			Created: "2023-04-27T16:08:32Z",
		},
	}
	wantSBOM := `{
  "spdxVersion": "SPDX-2.2",
  "dataLicense": "CC0-1.0",
  "SPDXID": "SPDXRef-DOCUMENT",
  "name": "image1_sbom.json",
  "documentNamespace": "NOASSERTION",
  "creationInfo": {
    "creators": [
      "Tool: gcr.io/cos-cloud/cos-customizer",
      "Organization: G"
    ],
    "created": "2023-04-27T16:08:32Z"
  }
}`
	sbom.UploadSBOMToGCS("gs://test-bucket/folder")
	r, err := gcsClient.Bucket("test-bucket").Object("folder/image1_sbom.json").NewReader(ctx)
	if err != nil {
		t.Fatal(err)
	}
	got, err := ioutil.ReadAll(r)
	if err != nil {
		t.Fatal(err)
	}
	if diff := cmp.Diff(string(got), wantSBOM); diff != "" {
		t.Errorf("unexpected SBOM content, diff: %v", diff)
	}
}