// Copyright 2022 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

package govulncheck

import (
	"strings"
	"testing"

	"github.com/google/go-cmp/cmp"
	"golang.org/x/vuln/internal"
	"golang.org/x/vuln/internal/result"
	"golang.org/x/vuln/osv"
)

func TestPlatforms(t *testing.T) {
	for _, test := range []struct {
		entry *osv.Entry
		want  string
	}{
		{
			entry: &osv.Entry{ID: "All"},
			want:  "",
		},
		{
			entry: &osv.Entry{
				ID: "one-import",
				Affected: []osv.Affected{{
					Package: osv.Package{Name: "golang.org/vmod"},
					Ranges:  osv.Affects{{Type: osv.TypeSemver, Events: []osv.RangeEvent{{Introduced: "1.2.0"}}}},
					EcosystemSpecific: osv.EcosystemSpecific{
						Imports: []osv.EcosystemSpecificImport{{
							GOOS:   []string{"windows", "linux"},
							GOARCH: []string{"amd64", "wasm"},
						}},
					},
				}},
			},
			want: "linux/amd64, linux/wasm, windows/amd64, windows/wasm",
		},
		{
			entry: &osv.Entry{
				ID: "two-imports",
				Affected: []osv.Affected{{
					Package: osv.Package{Name: "golang.org/vmod"},
					Ranges:  osv.Affects{{Type: osv.TypeSemver, Events: []osv.RangeEvent{{Introduced: "1.2.0"}}}},
					EcosystemSpecific: osv.EcosystemSpecific{
						Imports: []osv.EcosystemSpecificImport{
							{
								GOOS:   []string{"windows"},
								GOARCH: []string{"amd64"},
							},
							{
								GOOS:   []string{"linux"},
								GOARCH: []string{"amd64"},
							},
						},
					},
				}},
			},
			want: "linux/amd64, windows/amd64",
		},
		{
			entry: &osv.Entry{
				ID: "two-os-only",
				Affected: []osv.Affected{{
					Package: osv.Package{Name: "golang.org/vmod"},
					Ranges:  osv.Affects{{Type: osv.TypeSemver, Events: []osv.RangeEvent{{Introduced: "1.2.0"}}}},
					EcosystemSpecific: osv.EcosystemSpecific{
						Imports: []osv.EcosystemSpecificImport{
							{
								GOOS: []string{"windows, linux"},
							},
						},
					},
				}},
			},
			want: "windows, linux",
		},
		{
			entry: &osv.Entry{
				ID: "one-arch-only",
				Affected: []osv.Affected{{
					Package: osv.Package{Name: "golang.org/vmod"},
					Ranges:  osv.Affects{{Type: osv.TypeSemver, Events: []osv.RangeEvent{{Introduced: "1.2.0"}}}},
					EcosystemSpecific: osv.EcosystemSpecific{
						Imports: []osv.EcosystemSpecificImport{
							{
								GOOS: []string{"amd64"},
							},
						},
					},
				}},
			},
			want: "amd64",
		},
	} {
		t.Run(test.entry.ID, func(t *testing.T) {
			got := platforms("golang.org/vmod", test.entry)
			if got != test.want {
				t.Errorf("got %q, want %q", got, test.want)
			}
		})
	}
}

// testVuln1 is a test third-party vulnerability.
var testVuln1 = &osv.Entry{
	ID:      "GO-0000-0001",
	Details: "Third-party vulnerability",
	Affected: []osv.Affected{{
		Package: osv.Package{Name: "golang.org/vmod"},
		EcosystemSpecific: osv.EcosystemSpecific{
			Imports: []osv.EcosystemSpecificImport{{
				GOOS: []string{"amd"},
			}},
		},
	}}}

// testVuln1 is a test stdlib vulnerability.
var testVuln2 = &osv.Entry{
	ID:      "GO-0000-0002",
	Details: "Stdlib vulnerability",
	Affected: []osv.Affected{{
		Package: osv.Package{Name: internal.GoStdModulePath},
	}}}

func TestPrintTextNoVulns(t *testing.T) {
	r := &result.Result{Vulns: []*result.Vuln{
		{
			OSV: testVuln1,
			Modules: []*result.Module{
				{
					Path:         "golang.org/vmod",
					FoundVersion: "v0.0.1",
					FixedVersion: "v0.1.3",
				},
			},
		},
	}}

	got := new(strings.Builder)
	output := readableOutput{to: got}
	if err := output.result(r, false, true); err != nil && err != ErrVulnerabilitiesFound {
		t.Fatal(err)
	}
	want := `No vulnerabilities found.

=== Informational ===

Found 1 vulnerability in packages that you import, but there are no call
stacks leading to the use of this vulnerability. You may not need to
take any action. See https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck
for details.

Vulnerability #1: GO-0000-0001
  Third-party vulnerability
  More info: https://pkg.go.dev/vuln/GO-0000-0001
  Found in: golang.org/vmod@v0.0.1
  Fixed in: golang.org/vmod@v0.1.3
  Platforms: amd
`
	if diff := cmp.Diff(want, got.String()); diff != "" {
		t.Fatalf("mismatch (-want, +got):\n%s", diff)
	}
}

func TestPrintTextSource(t *testing.T) {
	r := &result.Result{Vulns: []*result.Vuln{
		{
			OSV: testVuln1,
			Modules: []*result.Module{
				{
					Path:         "golang.org/vmod",
					FoundVersion: "v0.0.1",
					FixedVersion: "v0.1.3",
					Packages: []*result.Package{
						{
							CallStacks: []result.CallStack{{Summary: "main calls vmod.Vuln"}},
						},
					},
				},
			},
		},
		{
			OSV: testVuln2,
			Modules: []*result.Module{
				{
					Path:         internal.GoStdModulePath,
					FoundVersion: "v0.0.1",
					Packages: []*result.Package{
						{
							Path: "net/http",
						},
					},
				},
			},
		}}}

	got := new(strings.Builder)
	output := readableOutput{to: got}
	if err := output.result(r, false, true); err != nil && err != ErrVulnerabilitiesFound {
		t.Fatal(err)
	}
	want := `Your code is affected by 1 vulnerability from 1 module.

Vulnerability #1: GO-0000-0001
  Third-party vulnerability

  More info: https://pkg.go.dev/vuln/GO-0000-0001

  Module: golang.org/vmod
    Found in: golang.org/vmod@v0.0.1
    Fixed in: golang.org/vmod@v0.1.3
    Platforms: amd

    Call stacks in your code:
      main calls vmod.Vuln

=== Informational ===

Found 1 vulnerability in packages that you import, but there are no call
stacks leading to the use of this vulnerability. You may not need to
take any action. See https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck
for details.

Vulnerability #1: GO-0000-0002
  Stdlib vulnerability
  More info: https://pkg.go.dev/vuln/GO-0000-0002
  Found in: net/http@v0.0.1
  Fixed in: N/A
`
	if diff := cmp.Diff(want, got.String()); diff != "" {
		t.Fatalf("mismatch (-want, +got):\n%s", diff)
	}
}

func TestPrintTextBinary(t *testing.T) {
	r := &result.Result{Vulns: []*result.Vuln{
		{
			OSV: testVuln1,
			Modules: []*result.Module{
				{
					Path:         "golang.org/vmod",
					FoundVersion: "v0.0.1",
					FixedVersion: "v0.1.3",
					// We can omit package info since in binary mode
					// there are no call stacks and we don't show symbols.
				},
			},
		},
		{
			OSV: testVuln2,
			Modules: []*result.Module{
				{
					Path:         internal.GoStdModulePath,
					FoundVersion: "v0.0.1",
					Packages: []*result.Package{
						{
							Path: "net/http",
						},
					},
				},
			},
		}}}

	got := new(strings.Builder)
	output := readableOutput{to: got}
	if err := output.result(r, false, false); err != nil && err != ErrVulnerabilitiesFound {
		t.Fatal(err)
	}
	want := `Your code is affected by 2 vulnerabilities from 1 module and the Go standard library.

Vulnerability #1: GO-0000-0001
  Third-party vulnerability

  More info: https://pkg.go.dev/vuln/GO-0000-0001

  Module: golang.org/vmod
    Found in: golang.org/vmod@v0.0.1
    Fixed in: golang.org/vmod@v0.1.3
    Platforms: amd

Vulnerability #2: GO-0000-0002
  Stdlib vulnerability

  More info: https://pkg.go.dev/vuln/GO-0000-0002

  Standard library
    Found in: net/http@v0.0.1
    Fixed in: N/A
`
	if diff := cmp.Diff(want, got.String()); diff != "" {
		t.Fatalf("mismatch (-want, +got):\n%s", diff)
	}
}

func TestPrintTextMultiModuleAndStacks(t *testing.T) {
	r := &result.Result{Vulns: []*result.Vuln{
		{
			OSV: testVuln1,
			Modules: []*result.Module{
				{
					Path:         "golang.org/vmod",
					FoundVersion: "v0.0.1",
					FixedVersion: "v0.1.3",
					Packages: []*result.Package{
						{
							CallStacks: []result.CallStack{{Summary: "main calls vmod.Vuln"}, {Summary: "main calls vmod.VulnFoo"}},
						},
					},
				},
				{
					Path:         "golang.org/vmod1",
					FoundVersion: "v0.0.3",
					FixedVersion: "v0.0.4",
					Packages: []*result.Package{
						{
							CallStacks: []result.CallStack{{Summary: "Foo calls vmod1.Vuln"}},
						},
						{
							CallStacks: []result.CallStack{{Summary: "Bar calls vmod1.VulnFoo"}},
						},
					},
				},
			},
		}}}

	got := new(strings.Builder)
	output := readableOutput{to: got}
	if err := output.result(r, false, true); err != nil && err != ErrVulnerabilitiesFound {
		t.Fatal(err)
	}
	want := `Your code is affected by 1 vulnerability from 2 modules.

Vulnerability #1: GO-0000-0001
  Third-party vulnerability

  More info: https://pkg.go.dev/vuln/GO-0000-0001

  Module: golang.org/vmod
    Found in: golang.org/vmod@v0.0.1
    Fixed in: golang.org/vmod@v0.1.3
    Platforms: amd

    Call stacks in your code:
      main calls vmod.Vuln
      main calls vmod.VulnFoo

  Module: golang.org/vmod1
    Found in: golang.org/vmod1@v0.0.3
    Fixed in: golang.org/vmod1@v0.0.4

    Call stacks in your code:
      Foo calls vmod1.Vuln

      Bar calls vmod1.VulnFoo
`
	if diff := cmp.Diff(want, got.String()); diff != "" {
		t.Fatalf("mismatch (-want, +got):\n%s", diff)
	}
}