eoka 0.6.0

//! Chrome launch preparation, profile ownership and identity selection.

use crate::cdp::transport::{launch_chrome_with_profile_dir, stop_child};
use crate::stealth::{find_chrome, fingerprint::Fingerprint, ChromePatcher};
use crate::{Error, Result, StealthConfig};
use std::{
    path::{Path, PathBuf},
    process::{Child, Command},
    sync::{
        atomic::{AtomicU64, Ordering},
        Arc,
    },
    time::Duration,
};

static BROWSER_COUNTER: AtomicU64 = AtomicU64::new(0);

pub(super) fn remove_dir_if_exists(path: &Path) -> std::io::Result<()> {
    const ATTEMPTS: usize = 10;

    for attempt in 0..ATTEMPTS {
        match std::fs::remove_dir_all(path) {
            Ok(()) => return Ok(()),
            Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(()),
            Err(error) if is_directory_not_empty(&error) && attempt + 1 < ATTEMPTS => {
                std::thread::sleep(Duration::from_millis(50));
            }
            Err(error) => return Err(error),
        }
    }

    Ok(())
}

fn is_directory_not_empty(error: &std::io::Error) -> bool {
    matches!(error.raw_os_error(), Some(39) | Some(66) | Some(145))
}

/// Restrict a profile directory to its owner (0700). Profiles contain the
/// cookie store; a default-umask /tmp directory would be world-readable.
#[cfg(unix)]
fn restrict_profile_perms(path: &Path) {
    use std::os::unix::fs::PermissionsExt;
    let perms = std::fs::Permissions::from_mode(0o700);
    if let Err(error) = std::fs::set_permissions(path, perms) {
        tracing::warn!(
            "Failed to restrict profile dir {}: {}",
            path.display(),
            error
        );
    }
}

#[cfg(not(unix))]
fn restrict_profile_perms(_path: &Path) {}

pub(super) async fn discover_browser_ws(port: u16) -> Result<String> {
    tokio::task::spawn_blocking(move || {
        crate::cdp::discover::discover_browser_ws("127.0.0.1", port)
    })
    .await
    .map_err(|error| Error::transport(format!("Browser discovery worker failed: {}", error)))?
}

/// Stealth browser arguments (pre-built for zero allocation).
fn stealth_args(config: &StealthConfig, fingerprint: &Fingerprint) -> Vec<String> {
    let mut args = vec![
        // Core automation hiding
        "--disable-blink-features=AutomationControlled".into(),
        "--disable-features=IsolateOrigins,site-per-process,AutomationControlled,EnableAutomation"
            .into(),
        "--enable-features=NetworkService,NetworkServiceInProcess".into(),
        // Additional flags to hide automation
        "--disable-infobars".into(),
        "--disable-dev-shm-usage".into(),
        "--disable-ipc-flooding-protection".into(),
        "--disable-renderer-backgrounding".into(),
        "--disable-background-timer-throttling".into(),
        "--disable-backgrounding-occluded-windows".into(),
        // Make browser look natural
        "--no-first-run".into(),
        "--no-default-browser-check".into(),
        "--no-sandbox".into(),
        "--disable-default-apps".into(),
        "--disable-component-extensions-with-background-pages".into(),
        "--disable-hang-monitor".into(),
        "--disable-popup-blocking".into(),
        "--disable-prompt-on-repost".into(),
        "--disable-sync".into(),
        "--disable-translate".into(),
        "--metrics-recording-only".into(),
        "--safebrowsing-disable-auto-update".into(),
        "--disable-client-side-phishing-detection".into(),
        "--password-store=basic".into(),
        "--use-mock-keychain".into(),
        "--lang=en-US".into(),
        // Don't apply field-trial variations: they feed the `X-Client-Data`
        // header Google properties use to profile installs (see
        // `strip_x_client_data`).
        "--disable-field-trial-config".into(),
        // Window size
        format!(
            "--window-size={},{}",
            config.viewport_width, config.viewport_height
        ),
        // Keep Chromium's virtual screen aligned with the viewport in new
        // headless mode; otherwise it reports a fixed 800x600 screen.
        format!(
            "--ozone-override-screen-size={},{}",
            config.viewport_width, config.viewport_height
        ),
    ];

    // User agent
    args.push(format!("--user-agent={}", fingerprint.user_agent));

    // Headless mode
    if config.headless {
        args.push("--headless=new".into());
    }

    // Named profile within user_data_dir
    if let Some(ref profile_dir) = config.profile_dir {
        args.push(format!("--profile-directory={}", profile_dir));
    }

    // Proxy
    if let Some(ref proxy) = config.proxy {
        args.push(format!("--proxy-server={}", proxy));
    }

    // Extra user-supplied args (e.g. --use-fake-ui-for-media-stream)
    for arg in &config.extra_args {
        args.push(arg.clone());
    }

    args
}

/// Own a browser profile until launch fully succeeds. This makes cancellation
/// of `launch_with_config` clean up ephemeral profiles automatically.
pub(super) struct BrowserProfileGuard {
    path: PathBuf,
    owned: bool,
}

impl BrowserProfileGuard {
    fn create(config: &StealthConfig) -> Result<Self> {
        match config.user_data_dir.as_deref() {
            Some(path) => {
                let path = PathBuf::from(path);
                std::fs::create_dir_all(&path)?;
                restrict_profile_perms(&path);
                Ok(Self { path, owned: false })
            }
            None => {
                let instance_id = BROWSER_COUNTER.fetch_add(1, Ordering::Relaxed);
                let path = std::env::temp_dir().join(format!(
                    "eoka-browser-{}-{}",
                    std::process::id(),
                    instance_id
                ));
                remove_dir_if_exists(&path)?;
                std::fs::create_dir_all(&path)?;
                restrict_profile_perms(&path);
                Ok(Self { path, owned: true })
            }
        }
    }

    pub(super) fn browser_owned_path(&mut self) -> Option<PathBuf> {
        if self.owned {
            self.owned = false;
            Some(self.path.clone())
        } else {
            None
        }
    }
}

impl Drop for BrowserProfileGuard {
    fn drop(&mut self) {
        if self.owned {
            if let Err(error) = remove_dir_if_exists(&self.path) {
                tracing::warn!("Failed to remove unclaimed browser profile: {}", error);
            }
        }
    }
}

/// Result of synchronous browser preparation. Until the child is transferred
/// to `Transport`, dropping this value kills Chrome and reclaims its profile.
/// `child` is `None` when we attached to an already-running Chrome instead
/// of spawning one (see `try_attach_existing`).
pub(super) struct PreparedBrowserLaunch {
    pub(super) child: Option<Child>,
    pub(super) ws_url: String,
    pub(super) fingerprint: Option<Fingerprint>,
    pub(super) profile: BrowserProfileGuard,
}

impl Drop for PreparedBrowserLaunch {
    fn drop(&mut self) {
        if let Some(mut child) = self.child.take() {
            if let Err(error) = stop_child(&mut child) {
                tracing::warn!("Failed to clean up unclaimed Chrome launch: {}", error);
            }
        }
    }
}

/// Check whether a Chrome instance is already running on `profile_dir` and,
/// if so, return the ws:// URL to attach to instead of spawning a second
/// process. A second `--user-data-dir=<same dir>` launch would silently be
/// handed off to the running instance over Chrome's `SingletonSocket` and
/// exit without ever printing a DevTools URL, so this must run first.
///
/// Returns `Ok(None)` when there's nothing to attach to (no lock, a stale
/// lock that was just cleared, or a platform where reuse detection isn't
/// implemented) — the caller should spawn normally. Returns `Err` when a
/// live instance exists but can't safely be attached to (headless/headed
/// mismatch, no debug port, or an unresponsive port).
fn try_attach_existing(profile_dir: &Path, want_headless: bool) -> Result<Option<String>> {
    use crate::cdp::discover;

    let Some(pid) = discover::read_singleton_lock(profile_dir) else {
        return Ok(None);
    };

    if !discover::pid_is_alive(pid) {
        // Stale lock left behind by a crashed/killed Chrome. Clear it so a
        // normal spawn below can proceed, mirroring what Chrome itself does.
        let _ = std::fs::remove_file(profile_dir.join("SingletonLock"));
        return Ok(None);
    }

    // Check the cheap local signal before touching the network — a
    // headless/headed mismatch always fails the attach, so there's no
    // reason to round-trip to Chrome's DevTools port first.
    if let Some(argv) = discover::read_process_argv(pid) {
        let running_headless = argv.iter().any(|arg| arg.starts_with("--headless"));
        if running_headless != want_headless {
            let (running, requested) = if running_headless {
                ("headless", "headed")
            } else {
                ("non-headless", "headless")
            };
            return Err(Error::Launch(format!(
                "A {} Chrome instance (pid {}) is already running on profile {}; close it \
                 before requesting {} mode, or drop that flag for this launch",
                running,
                pid,
                profile_dir.display(),
                requested
            )));
        }
    }

    let Some(port) = discover::read_devtools_active_port(profile_dir) else {
        return Err(Error::Launch(format!(
            "A Chrome instance (pid {}) is already running on profile {}, but it wasn't \
             launched with a debug port; close it first or relaunch it with \
             --remote-debugging-port",
            pid,
            profile_dir.display()
        )));
    };

    let ws_url = discover::discover_browser_ws("127.0.0.1", port).map_err(|e| {
        Error::Launch(format!(
            "A Chrome instance (pid {}) is already running on profile {}, but its DevTools \
             port {} isn't responding: {}",
            pid,
            profile_dir.display(),
            port,
            e
        ))
    })?;

    Ok(Some(ws_url))
}

pub(super) fn prepare_browser_launch(config: Arc<StealthConfig>) -> Result<PreparedBrowserLaunch> {
    let profile = BrowserProfileGuard::create(&config)?;

    // Only a durable, user-owned profile can already have a live Chrome on
    // it — ephemeral profiles are freshly created above and can't collide.
    if !profile.owned {
        if let Some(ws_url) = try_attach_existing(&profile.path, config.headless)? {
            tracing::info!("Reusing running Chrome on profile {:?}", profile.path);
            let fingerprint = Fingerprint::resolve_for_profile(
                config.user_agent.as_deref(),
                config.timezone.as_deref(),
                Some(profile.path.as_path()),
            )?;
            return Ok(PreparedBrowserLaunch {
                child: None,
                ws_url,
                fingerprint: Some(fingerprint),
                profile,
            });
        }
    }

    let chrome_path = match &config.chrome_path {
        Some(path) => PathBuf::from(path),
        None => find_chrome()?,
    };

    // Patching a browser binary is not appropriate for a durable user-owned
    // profile. Let that profile provide continuity instead of fresh spoofing.
    let chrome_path = if config.patch_binary && profile.owned {
        ChromePatcher::new(&chrome_path)?.get_patched_path()?
    } else {
        chrome_path
    };

    let detected_user_agent = if config.user_agent.is_none() {
        installed_chrome_user_agent(&chrome_path)
    } else {
        None
    };
    let fingerprint = Fingerprint::resolve_for_profile(
        config
            .user_agent
            .as_deref()
            .or(detected_user_agent.as_deref()),
        config.timezone.as_deref(),
        (!profile.owned).then_some(profile.path.as_path()),
    )?;

    let mut args = stealth_args(&config, &fingerprint);
    args.push(format!("--user-data-dir={}", profile.path.display()));

    tracing::info!("Launching Chrome from {:?}", chrome_path);
    let (child, ws_url) =
        launch_chrome_with_profile_dir(&chrome_path, &args, &profile.path, config.live_session)?;
    Ok(PreparedBrowserLaunch {
        child: Some(child),
        ws_url,
        fingerprint: Some(fingerprint),
        profile,
    })
}

fn installed_chrome_user_agent(chrome_path: &std::path::Path) -> Option<String> {
    let output = Command::new(chrome_path).arg("--version").output().ok()?;
    let version = String::from_utf8_lossy(&output.stdout);
    let full_version = version.split_whitespace().find(|part| {
        let pieces: Vec<_> = part.split('.').collect();
        pieces.len() == 4
            && pieces
                .iter()
                .all(|piece| !piece.is_empty() && piece.bytes().all(|byte| byte.is_ascii_digit()))
    })?;
    Fingerprint::native_chrome_user_agent(full_version)
}

#[cfg(test)]
use super::{accept_language_for, ua_override_for};
#[cfg(test)]
use crate::stealth::build_evasion_script_for;

#[cfg(all(test, unix))]
mod try_attach_existing_tests {
    use super::*;
    use std::os::unix::fs::symlink;

    fn temp_profile_dir(name: &str) -> PathBuf {
        let dir = std::env::temp_dir().join(format!(
            "eoka-browser-test-{}-{}-{}",
            std::process::id(),
            name,
            fastrand::u64(..)
        ));
        std::fs::create_dir_all(&dir).unwrap();
        dir
    }

    /// Our own cmdline never contains "--headless" (it's the `cargo test`
    /// binary), so pointing a fake lock at `std::process::id()` gives us a
    /// guaranteed-live pid with a known, non-headless argv — no real Chrome
    /// needed to exercise the liveness/headless-detection branches.
    fn lock_self(dir: &std::path::Path) {
        symlink(
            format!("some-host-{}", std::process::id()),
            dir.join("SingletonLock"),
        )
        .unwrap();
    }

    #[test]
    fn no_lock_returns_none() {
        let dir = temp_profile_dir("no-lock");
        assert!(try_attach_existing(&dir, true).unwrap().is_none());
        std::fs::remove_dir_all(&dir).unwrap();
    }

    #[test]
    fn stale_lock_is_cleared_and_returns_none() {
        let dir = temp_profile_dir("stale-lock");
        // A pid this large is never a real live process.
        symlink("some-host-2147483647", dir.join("SingletonLock")).unwrap();

        assert!(try_attach_existing(&dir, true).unwrap().is_none());
        assert!(
            !dir.join("SingletonLock").exists(),
            "stale lock should have been removed"
        );
        std::fs::remove_dir_all(&dir).unwrap();
    }

    #[test]
    fn headless_mismatch_errors_before_touching_the_network() {
        let dir = temp_profile_dir("headless-mismatch");
        lock_self(&dir);
        // No DevToolsActivePort written — if the headless check didn't run
        // first, this would produce the "no debug port" error instead.
        let error = try_attach_existing(&dir, true).unwrap_err().to_string();
        assert!(
            error.contains("non-headless") && error.contains("requesting headless mode"),
            "expected a headless/headed mismatch error, got: {}",
            error
        );
        std::fs::remove_dir_all(&dir).unwrap();
    }

    #[test]
    fn live_lock_without_debug_port_errors() {
        let dir = temp_profile_dir("no-port");
        lock_self(&dir);

        // Matches our own (non-headless) argv, so the headless check passes
        // and the missing-port error is what should surface.
        let error = try_attach_existing(&dir, false).unwrap_err().to_string();
        assert!(
            error.contains("debug port"),
            "expected a missing-debug-port error, got: {}",
            error
        );
        std::fs::remove_dir_all(&dir).unwrap();
    }

    #[test]
    fn unresponsive_port_errors() {
        let dir = temp_profile_dir("bad-port");
        lock_self(&dir);
        // Port 0 is never a connectable listener.
        std::fs::write(dir.join("DevToolsActivePort"), "0\n/devtools/browser/x\n").unwrap();

        let error = try_attach_existing(&dir, false).unwrap_err().to_string();
        assert!(
            error.contains("isn't responding"),
            "expected an unresponsive-port error, got: {}",
            error
        );
        std::fs::remove_dir_all(&dir).unwrap();
    }

    #[test]
    fn stealth_args_disable_field_trials() {
        let config = StealthConfig::default();
        let fp = Fingerprint::random();
        let args = stealth_args(&config, &fp);
        assert!(args.iter().any(|arg| arg == "--disable-field-trial-config"));
    }

    // Privacy regression: profile dirs hold the cookie store and previously
    // landed in /tmp with default umask (world-readable). They must be 0700.
    #[cfg(unix)]
    #[test]
    fn profile_dirs_are_owner_only() {
        use std::os::unix::fs::PermissionsExt;

        let owned = BrowserProfileGuard::create(&StealthConfig::default()).unwrap();
        let mode = std::fs::metadata(&owned.path).unwrap().permissions().mode() & 0o777;
        assert_eq!(mode, 0o700, "spawned temp profile dir must be 0700");
        std::fs::remove_dir_all(&owned.path).unwrap();

        let custom = temp_profile_dir("user-supplied");
        let guard = BrowserProfileGuard::create(&StealthConfig {
            user_data_dir: Some(custom.to_string_lossy().into_owned()),
            ..StealthConfig::default()
        })
        .unwrap();
        let mode = std::fs::metadata(&guard.path).unwrap().permissions().mode() & 0o777;
        assert_eq!(
            mode, 0o700,
            "user-supplied profile dir must be tightened to 0700"
        );
        std::fs::remove_dir_all(&custom).unwrap();
    }

    // Audit regression: the Accept-Language header used to be hardcoded
    // en-US while navigator.languages followed the fingerprint/geo align —
    // a header-vs-JS mismatch any server can compare.
    #[test]
    fn accept_language_matches_fingerprint_languages() {
        assert_eq!(
            accept_language_for(&["en-US".into(), "en".into()]),
            "en-US,en;q=0.9"
        );
        assert_eq!(
            accept_language_for(&["de-DE".into(), "de".into(), "en".into()]),
            "de-DE,de;q=0.9,en;q=0.8"
        );

        let fp = Fingerprint::random();
        let override_payload = ua_override_for(&fp);
        assert_eq!(
            override_payload.accept_language.as_deref(),
            Some(accept_language_for(&fp.languages).as_str()),
            "Accept-Language must be derived from navigator.languages"
        );
    }

    // Regression: the fonts and keyboard hooks must be present and driven by
    // fingerprint data, with Linux keyboard passing through untouched.
    #[test]
    fn fonts_and_keyboard_hooks_are_fingerprint_driven() {
        let windows_fp = Fingerprint::resolve(
            Some("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.7312.86 Safari/537.36"),
            None,
        );
        let windows_script = build_evasion_script_for(&StealthConfig::default(), &windows_fp);
        assert!(windows_script.contains("document.fonts.check"));
        assert!(
            windows_script.contains(&serde_json::to_string(&windows_fp.fonts).unwrap()),
            "claimed font set must flow into the script"
        );
        assert!(windows_script.contains("getLayoutMap"));

        let linux_fp = Fingerprint::resolve(
            Some("Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.7312.86 Safari/537.36"),
            None,
        );
        let linux_script = build_evasion_script_for(&StealthConfig::default(), &linux_fp);
        assert!(
            linux_script
                .contains("if (navigator.keyboard && navigator.keyboard.getLayoutMap && null)"),
            "Linux keyboard spoof must be inert"
        );
    }
}