package rtsp

import (
	"bufio"
	"context"
	"net"
	"strings"
	"testing"
	"time"

	"git.ilapage.cn/ila/yovision/Sense/server/app/sense/onvif"
)

func TestVerifierUsesCredentialHeaderWithoutPuttingItInURI(t *testing.T) {
	listener, err := net.Listen("tcp", "127.0.0.1:0")
	if err != nil {
		t.Fatal(err)
	}
	defer listener.Close()
	requestChannel := make(chan string, 1)
	go func() {
		connection, _ := listener.Accept()
		if connection == nil {
			return
		}
		defer connection.Close()
		reader := bufio.NewReader(connection)
		request, _ := reader.ReadString('\n')
		headers := request
		for {
			line, _ := reader.ReadString('\n')
			headers += line
			if line == "\r\n" || line == "" {
				break
			}
		}
		requestChannel <- headers
		_, _ = connection.Write([]byte("RTSP/1.0 200 OK\r\nCSeq: 1\r\n\r\n"))
	}()
	policy, _ := onvif.ParsePolicy("127.0.0.0/8")
	result, err := (NetVerifier{Timeout: time.Second, Policy: policy}).Verify(context.Background(), "rtsp://"+listener.Addr().String()+"/live", Credential{Username: "synthetic", Password: "synthetic"})
	if err != nil || result.Status != "ready" {
		t.Fatalf("result=%#v err=%v", result, err)
	}
	request := <-requestChannel
	if strings.Contains(strings.Split(request, "\r\n")[0], "synthetic") {
		t.Fatal("credentials leaked into request URI")
	}
	if !strings.Contains(request, "Authorization: Basic ") {
		t.Fatal("authorization header missing")
	}
	if _, err = (NetVerifier{Policy: policy}).Verify(context.Background(), "rtsp://user:pass@"+listener.Addr().String()+"/live", Credential{}); err == nil {
		t.Fatal("credential-bearing URI accepted")
	}
}