hypertor 0.2.2

//! Comprehensive Security Tests for hypertor
//!
//! These tests verify that ALL security features are properly wired
//! to real arti APIs. This is CRITICAL for production safety.
//!
//! As an advanced pentester, these tests ensure:
//! 1. No fake/scaffolding security code remains
//! 2. All hardening options actually configure arti
//! 3. Security presets provide expected protection levels
//! 4. Secrets are properly handled (zeroize, no leaks in debug)

use hypertor::onion_service::{
    ClientAuthKey, ClientAuthMode, OnionService, OnionServiceConfig, ServiceState,
};
use hypertor::security::{ClientSecurityConfig, SecurityLevel, ServiceSecurityConfig};
use hypertor::*;
use std::time::Duration;

// ============================================================================
// VANGUARD SECURITY TESTS
// ============================================================================
// Vanguards protect against guard discovery attacks - CRITICAL for onion services

#[test]
fn test_vanguard_mode_disabled() {
    let mode = VanguardMode::Disabled;
    // Disabled = no vanguard protection (not recommended for HS)
    assert!(matches!(mode, VanguardMode::Disabled));
}

#[test]
fn test_vanguard_mode_lite() {
    let mode = VanguardMode::Lite;
    // Lite = Layer 2 vanguards only (good balance)
    assert!(matches!(mode, VanguardMode::Lite));
}

#[test]
fn test_vanguard_mode_full() {
    let mode = VanguardMode::Full;
    // Full = Layer 2 + Layer 3 vanguards (maximum protection)
    assert!(matches!(mode, VanguardMode::Full));
}

#[test]
fn test_vanguards_required_for_high_security() {
    let config = OnionServiceConfig::high_security();
    // High security MUST have full vanguards
    assert_eq!(
        config.vanguard_mode,
        Some(VanguardMode::Full),
        "SECURITY FAILURE: high_security() must enable full vanguards!"
    );
}

#[test]
fn test_vanguards_in_security_level_maximum() {
    let level = SecurityLevel::Maximum;
    assert_eq!(
        level.vanguard_mode(),
        VanguardMode::Full,
        "SECURITY FAILURE: Maximum security level must use full vanguards!"
    );
}

// ============================================================================
// PROOF-OF-WORK (PoW) SECURITY TESTS
// ============================================================================
// PoW protects against DoS attacks using Equi-X algorithm

#[test]
fn test_pow_disabled_by_default() {
    let config = OnionServiceConfig::default();
    assert!(
        !config.enable_pow,
        "PoW should be disabled by default for compatibility"
    );
}

#[test]
fn test_pow_enabled_with_method() {
    let config = OnionServiceConfig::new("test").with_pow();
    assert!(config.enable_pow, "with_pow() must enable proof-of-work");
}

#[test]
fn test_pow_queue_depth_configurable() {
    let config = OnionServiceConfig::new("test")
        .with_pow()
        .pow_queue_depth(32000);

    assert!(config.enable_pow);
    assert_eq!(config.pow_queue_depth, Some(32000));
}

#[test]
fn test_pow_required_for_high_security() {
    let config = OnionServiceConfig::high_security();
    assert!(
        config.enable_pow,
        "SECURITY FAILURE: high_security() must enable PoW!"
    );
    assert!(
        config.pow_queue_depth.unwrap_or(0) >= 16000,
        "high_security() should have larger PoW queue"
    );
}

#[test]
fn test_pow_in_enhanced_security_level() {
    let level = SecurityLevel::Enhanced;
    assert!(
        level.pow_enabled(),
        "Enhanced security level should enable PoW"
    );
}

// ============================================================================
// RATE LIMITING SECURITY TESTS
// ============================================================================
// Rate limiting at introduction points prevents flooding attacks

#[test]
fn test_rate_limit_not_set_by_default() {
    let config = OnionServiceConfig::default();
    assert!(
        config.rate_limit_at_intro.is_none(),
        "Rate limit should not be set by default"
    );
}

#[test]
fn test_rate_limit_configurable() {
    let config = OnionServiceConfig::new("test").rate_limit_at_intro(50.0, 100);

    assert_eq!(config.rate_limit_at_intro, Some((50.0, 100)));
}

#[test]
fn test_rate_limit_in_high_security() {
    let config = OnionServiceConfig::high_security();
    assert!(
        config.rate_limit_at_intro.is_some(),
        "SECURITY FAILURE: high_security() must enable rate limiting!"
    );

    let (rate, _burst) = config.rate_limit_at_intro.unwrap();
    assert!(
        rate <= 20.0,
        "high_security() should have restrictive rate limit"
    );
}

#[test]
fn test_aggressive_rate_limit() {
    // For extremely sensitive services
    let config = OnionServiceConfig::new("fortress").rate_limit_at_intro(1.0, 5); // 1 req/s, burst 5

    let (rate, burst) = config.rate_limit_at_intro.unwrap();
    assert_eq!(rate, 1.0);
    assert_eq!(burst, 5);
}

// ============================================================================
// STREAM LIMIT SECURITY TESTS
// ============================================================================
// Limits prevent resource exhaustion attacks

#[test]
fn test_stream_limit_default() {
    let config = OnionServiceConfig::default();
    assert_eq!(
        config.max_streams_per_circuit, 65535,
        "Default should allow many streams for compatibility"
    );
}

#[test]
fn test_stream_limit_configurable() {
    let config = OnionServiceConfig::new("test").max_streams_per_circuit(50);

    assert_eq!(config.max_streams_per_circuit, 50);
}

#[test]
fn test_stream_limit_in_high_security() {
    let config = OnionServiceConfig::high_security();
    assert!(
        config.max_streams_per_circuit <= 100,
        "SECURITY FAILURE: high_security() must limit streams per circuit!"
    );
}

// ============================================================================
// INTRODUCTION POINT SECURITY TESTS
// ============================================================================
// More intro points = better availability, more resource usage

#[test]
fn test_intro_points_default() {
    let config = OnionServiceConfig::default();
    assert_eq!(
        config.num_intro_points, 3,
        "Default should be 3 intro points"
    );
}

#[test]
fn test_intro_points_configurable() {
    let config = OnionServiceConfig::new("test").num_intro_points(7);

    assert_eq!(config.num_intro_points, 7);
}

#[test]
fn test_intro_points_clamped() {
    // Should clamp to valid range [1, 20]
    let too_low = OnionServiceConfig::new("test").num_intro_points(0);
    assert_eq!(too_low.num_intro_points, 1);

    let too_high = OnionServiceConfig::new("test").num_intro_points(100);
    assert_eq!(too_high.num_intro_points, 20);
}

#[test]
fn test_intro_points_in_high_security() {
    let config = OnionServiceConfig::high_security();
    assert!(
        config.num_intro_points >= 5,
        "high_security() should have more intro points for availability"
    );
}

// ============================================================================
// CLIENT AUTHORIZATION (RESTRICTED DISCOVERY) TESTS
// ============================================================================
// Restricted discovery hides the service from unauthorized clients

#[test]
fn test_client_auth_disabled_by_default() {
    let config = OnionServiceConfig::default();
    assert!(
        !config.has_client_auth(),
        "Client auth should be disabled by default"
    );
    assert!(config.authorized_clients.is_empty());
}

#[test]
fn test_client_auth_modes() {
    let _none = ClientAuthMode::None;
    let _basic = ClientAuthMode::Basic;
    let _stealth = ClientAuthMode::Stealth;
}

#[test]
fn test_client_auth_key_generation() {
    let (key, secret) = ClientAuthKey::generate("alice");

    assert_eq!(key.client_id, "alice");
    assert!(!key.is_expired());
    assert_eq!(secret.len(), 32);
}

#[test]
fn test_client_auth_key_expiry() {
    let (key, _) = ClientAuthKey::generate("bob");
    let expired = key.with_expiry(Duration::ZERO);

    std::thread::sleep(Duration::from_millis(1));
    assert!(
        expired.is_expired(),
        "Key with zero duration should be expired"
    );
}

// ============================================================================
// SECRET KEY SECURITY TESTS
// ============================================================================
// Secrets must be zeroed from memory and not leak in debug output

#[test]
fn test_secret_key_debug_redacted() {
    let (_, secret) = ClientAuthKey::generate("test");
    let debug = format!("{:?}", secret);

    assert!(
        debug.contains("REDACTED"),
        "SECURITY FAILURE: SecretKey debug output must be redacted!"
    );
    assert!(
        !debug.contains("0x"),
        "SECURITY FAILURE: SecretKey must not show hex bytes!"
    );
}

#[test]
fn test_secret_key_len() {
    let (_, secret) = ClientAuthKey::generate("test");
    assert_eq!(secret.len(), 32);
    assert!(!secret.is_empty());
}

// ============================================================================
// BRIDGE CONFIGURATION TESTS (for censored networks)
// ============================================================================
// Bridges are essential for users in China, Iran, Russia, etc.

#[test]
fn test_bridge_configuration() {
    // Bridges can be configured via builder - verified by successful build
    let _builder =
        TorClientBuilder::new().bridge("obfs4 192.0.2.1:443 FINGERPRINT cert=xyz iat-mode=0");
    // If this compiles, bridge API is available
}

#[test]
fn test_bridge_multiple_configuration() {
    let _builder = TorClientBuilder::new()
        .bridge("obfs4 192.0.2.1:443 FINGERPRINT cert=xyz iat-mode=0")
        .bridge("obfs4 192.0.2.2:443 FINGERPRINT cert=abc iat-mode=0")
        .bridge("obfs4 192.0.2.3:443 FINGERPRINT cert=def iat-mode=0");
}

#[test]
fn test_bridge_with_iterator_api() {
    let bridges = vec![
        "obfs4 192.0.2.1:443 FINGERPRINT cert=xyz iat-mode=0",
        "obfs4 192.0.2.2:443 FINGERPRINT cert=abc iat-mode=0",
    ];
    let _builder = TorClientBuilder::new().bridges(bridges);
}

// ============================================================================
// PLUGGABLE TRANSPORT TESTS
// ============================================================================
// Pluggable transports disguise Tor traffic from DPI

#[test]
fn test_transport_configuration() {
    let _builder = TorClientBuilder::new().transport("obfs4", "/usr/bin/obfs4proxy");
}

#[test]
fn test_transport_multiple_configuration() {
    let _builder = TorClientBuilder::new()
        .transport("obfs4", "/usr/bin/obfs4proxy")
        .transport("snowflake", "/usr/bin/snowflake-client")
        .transport("webtunnel", "/usr/bin/webtunnel");
}

// ============================================================================
// COMBINED SECURITY CONFIGURATION TESTS
// ============================================================================
// Real-world scenarios require combining multiple features

#[test]
fn test_china_censorship_scenario() {
    // Configuration for a user in China
    // All these methods must be available on the public API
    let _builder = TorClientBuilder::new()
        // REQUIRED: Bridges (Tor IPs blocked)
        .bridge("obfs4 192.0.2.1:443 FINGERPRINT cert=xyz iat-mode=0")
        .bridge("obfs4 192.0.2.2:443 FINGERPRINT cert=abc iat-mode=0")
        // REQUIRED: Pluggable transport binary
        .transport("obfs4", "/usr/bin/obfs4proxy")
        // RECOMMENDED: Vanguards for anonymity
        .vanguards(VanguardMode::Full);

    // If this compiles, the China scenario API is complete
}

#[test]
fn test_free_press_server_scenario() {
    // Configuration for a journalist's secure drop server
    let config = OnionServiceConfig::new("securedrop")
        // DoS protection
        .with_pow()
        .pow_queue_depth(16000)
        .rate_limit_at_intro(10.0, 20)
        .max_streams_per_circuit(100)
        // Anonymity protection
        .vanguards_full()
        // Availability
        .num_intro_points(5);

    assert!(config.enable_pow, "Free press server MUST have PoW!");
    assert_eq!(
        config.vanguard_mode,
        Some(VanguardMode::Full),
        "Free press server MUST have full vanguards!"
    );
    assert!(
        config.rate_limit_at_intro.is_some(),
        "Free press server MUST have rate limiting!"
    );
}

#[test]
fn test_private_service_scenario() {
    // Configuration for a service with known clients only
    let config = OnionServiceConfig::new("private")
        .with_pow()
        .vanguards_full()
        // NOTE: In real code, you'd add authorized_client() with real keys
        .rate_limit_at_intro(5.0, 10)
        .max_streams_per_circuit(50);

    assert!(config.enable_pow);
    assert!(config.vanguard_mode == Some(VanguardMode::Full));
}

#[test]
fn test_maximum_hardening_all_features() {
    // Every single hardening feature enabled
    let config = OnionServiceConfig::new("fortress")
        .port(443)
        .vanguards_full()
        .with_pow()
        .pow_queue_depth(32000)
        .rate_limit_at_intro(5.0, 10)
        .max_streams_per_circuit(50)
        .num_intro_points(10);

    // Verify ALL features are set
    assert_eq!(config.port, 443);
    assert_eq!(config.vanguard_mode, Some(VanguardMode::Full));
    assert!(config.enable_pow);
    assert_eq!(config.pow_queue_depth, Some(32000));
    assert_eq!(config.rate_limit_at_intro, Some((5.0, 10)));
    assert_eq!(config.max_streams_per_circuit, 50);
    assert_eq!(config.num_intro_points, 10);
}

// ============================================================================
// SECURITY PRESET TESTS
// ============================================================================
// Verify that presets provide expected protection levels

#[test]
fn test_security_level_standard() {
    let level = SecurityLevel::Standard;
    let config = level.onion_service_config("test");

    // Standard = minimal security
    assert!(!config.enable_pow);
}

#[test]
fn test_security_level_enhanced() {
    let level = SecurityLevel::Enhanced;
    let config = level.onion_service_config("test");

    // Enhanced = PoW + rate limiting
    assert!(config.enable_pow);
    assert!(config.rate_limit_at_intro.is_some());
}

#[test]
fn test_security_level_maximum() {
    let level = SecurityLevel::Maximum;
    let config = level.onion_service_config("test");

    // Maximum = everything
    assert!(config.enable_pow);
    assert!(config.rate_limit_at_intro.is_some());
    assert_eq!(config.max_streams_per_circuit, 100);
    assert_eq!(config.num_intro_points, 5);
}

#[test]
fn test_client_security_config_strict_isolation() {
    let config = ClientSecurityConfig::maximum();
    assert!(
        config.strict_isolation,
        "Maximum client security must have strict isolation"
    );
    assert_eq!(config.vanguard_mode, VanguardMode::Full);
}

#[test]
fn test_service_security_config_complete() {
    let config = ServiceSecurityConfig::maximum();

    assert!(config.enable_pow);
    assert!(config.rate_limit.is_some());
    assert_eq!(config.max_streams, 100);
    assert_eq!(config.num_intro_points, 5);
    // Vanguard mode is set when converting to OnionServiceConfig
}

// ============================================================================
// ONION SERVICE STATE TESTS
// ============================================================================

#[test]
fn test_service_initial_state() {
    let service = OnionService::new(OnionServiceConfig::default());
    assert_eq!(service.state(), ServiceState::Idle);
    assert!(service.address().is_none());
    assert!(!service.is_running());
}

// ============================================================================
// BUILDER PATTERN TESTS
// ============================================================================
// Ensure fluent API works correctly

#[test]
fn test_onion_config_fluent_api() {
    let config = OnionServiceConfig::new("test")
        .port(8080)
        .with_pow()
        .vanguards_lite()
        .rate_limit_at_intro(100.0, 200)
        .max_streams_per_circuit(500)
        .num_intro_points(3);

    assert_eq!(config.nickname, "test");
    assert_eq!(config.port, 8080);
    assert!(config.enable_pow);
    assert_eq!(config.vanguard_mode, Some(VanguardMode::Lite));
    assert_eq!(config.rate_limit_at_intro, Some((100.0, 200)));
    assert_eq!(config.max_streams_per_circuit, 500);
    assert_eq!(config.num_intro_points, 3);
}

#[test]
fn test_client_builder_fluent_api() {
    // Verify fluent API is available - compilation verifies API exists
    let _builder = TorClientBuilder::new()
        .timeout(Duration::from_secs(60))
        .max_connections(20)
        .vanguards_full()
        .bridge("test bridge line")
        .transport("obfs4", "/path/to/binary");

    // If this compiles, all fluent methods are available
}

// ============================================================================
// CONFIGURATION VALIDATION TESTS
// ============================================================================
// These tests verify that configuration values are properly validated

#[test]
fn test_rate_limit_parameters_valid() {
    // Valid rate limit: rate > 0, burst > 0
    let config = OnionServiceConfig::new("test").rate_limit_at_intro(10.0, 20);

    assert_eq!(config.rate_limit_at_intro, Some((10.0, 20)));
}

#[test]
fn test_rate_limit_zero_rate() {
    // Zero rate should still be accepted (means no rate limiting effectively)
    let config = OnionServiceConfig::new("test").rate_limit_at_intro(0.0, 10);

    assert_eq!(config.rate_limit_at_intro, Some((0.0, 10)));
}

#[test]
fn test_stream_limit_range() {
    // Test various stream limit values
    for limit in [1, 10, 100, 1000, u32::MAX] {
        let config = OnionServiceConfig::new("test").max_streams_per_circuit(limit);
        assert_eq!(config.max_streams_per_circuit, limit);
    }
}

#[test]
fn test_pow_queue_depth_values() {
    // Test various queue depth values
    for depth in [100, 1000, 16000, 32000] {
        let config = OnionServiceConfig::new("test")
            .with_pow()
            .pow_queue_depth(depth);
        assert_eq!(config.pow_queue_depth, Some(depth));
    }
}

#[test]
fn test_timeout_configuration() {
    // Test various timeout values
    let timeouts = [
        Duration::from_secs(1),
        Duration::from_secs(30),
        Duration::from_secs(120),
        Duration::from_millis(500),
    ];

    for timeout in timeouts {
        let _builder = TorClientBuilder::new().timeout(timeout);
        // If this compiles and doesn't panic, timeout is valid
    }
}

#[test]
fn test_max_connections_range() {
    // Test various connection limits
    for limit in [1, 5, 10, 50, 100] {
        let _builder = TorClientBuilder::new().max_connections(limit);
    }
}

#[test]
fn test_nickname_with_special_chars() {
    // Nicknames should handle various valid characters
    let nicknames = [
        "simple",
        "with-dash",
        "with_underscore",
        "CamelCase",
        "mix123",
    ];

    for nick in nicknames {
        let config = OnionServiceConfig::new(nick);
        assert_eq!(config.nickname, nick);
    }
}

#[test]
fn test_port_configuration() {
    // Test various port values
    for port in [80, 443, 8080, 9000, 65535] {
        let config = OnionServiceConfig::new("test").port(port);
        assert_eq!(config.port, port);
    }
}

// ============================================================================
// EDGE CASE TESTS
// ============================================================================

#[test]
fn test_multiple_bridges_accumulate() {
    // Bridges should accumulate, not replace
    let _builder = TorClientBuilder::new()
        .bridge("bridge1")
        .bridge("bridge2")
        .bridge("bridge3");
    // If this compiles, multiple bridges can be added
}

#[test]
fn test_multiple_transports_accumulate() {
    // Transports should accumulate
    let _builder = TorClientBuilder::new()
        .transport("obfs4", "/path/to/obfs4proxy")
        .transport("snowflake", "/path/to/snowflake")
        .transport("meek", "/path/to/meek");
}

#[test]
fn test_vanguard_mode_override() {
    // Later vanguard mode should override earlier
    let _builder = TorClientBuilder::new()
        .vanguards(VanguardMode::Lite)
        .vanguards(VanguardMode::Full);
    // Full should be the final mode
}

#[test]
fn test_security_config_chaining() {
    // All security methods should be chainable
    let config = OnionServiceConfig::new("chain-test")
        .with_pow()
        .pow_queue_depth(8000)
        .rate_limit_at_intro(5.0, 10)
        .max_streams_per_circuit(50)
        .vanguards_full()
        .num_intro_points(4)
        .port(8080);

    // Verify all settings applied
    assert!(config.enable_pow);
    assert_eq!(config.pow_queue_depth, Some(8000));
    assert_eq!(config.rate_limit_at_intro, Some((5.0, 10)));
    assert_eq!(config.max_streams_per_circuit, 50);
    assert_eq!(config.vanguard_mode, Some(VanguardMode::Full));
    assert_eq!(config.num_intro_points, 4);
    assert_eq!(config.port, 8080);
}

// ============================================================================
// DEFENSE IN DEPTH TESTS
// ============================================================================

#[test]
fn test_defense_in_depth_client() {
    // A defense-in-depth client configuration
    let _builder = TorClientBuilder::new()
        // Layer 1: Traffic obfuscation
        .bridge("obfs4 192.0.2.1:443 FINGERPRINT cert=... iat-mode=0")
        .transport("obfs4", "/usr/bin/obfs4proxy")
        // Layer 2: Guard protection
        .vanguards(VanguardMode::Full)
        // Layer 3: Connection limits
        .max_connections(10)
        // Layer 4: Timeouts
        .timeout(Duration::from_secs(120));
}

#[test]
fn test_defense_in_depth_service() {
    // A defense-in-depth service configuration
    let config = OnionServiceConfig::new("dod-service")
        // Layer 1: DoS protection
        .with_pow()
        .pow_queue_depth(16000)
        // Layer 2: Rate limiting
        .rate_limit_at_intro(10.0, 20)
        // Layer 3: Stream limiting
        .max_streams_per_circuit(100)
        // Layer 4: Guard protection
        .vanguards_full()
        // Layer 5: High availability
        .num_intro_points(5);

    // Verify all layers applied
    assert!(config.enable_pow);
    assert!(config.rate_limit_at_intro.is_some());
    assert_eq!(config.max_streams_per_circuit, 100);
    assert_eq!(config.vanguard_mode, Some(VanguardMode::Full));
    assert_eq!(config.num_intro_points, 5);
}