mrapids 0.1.31

/// Security utilities for MicroRapid CLI
/// Provides reusable security validation functions
use crate::core::api::ApiError;
use anyhow::Result;
use colored::*;
use std::net::IpAddr;
use std::path::Path;
use url::Url;

/// Validate URL for security (blocks SSRF attacks)
pub fn validate_url(url: &str) -> Result<()> {
    validate_url_with_options(url, false)
}

/// Validate URL for security with localhost override option
pub fn validate_url_with_options(url: &str, allow_localhost: bool) -> Result<()> {
    // Only allow HTTP and HTTPS
    if !url.starts_with("http://") && !url.starts_with("https://") {
        return Err(
            ApiError::ValidationError("Only HTTP and HTTPS URLs are allowed.".to_string()).into(),
        );
    }

    // Parse URL properly
    let parsed_url = Url::parse(url)
        .map_err(|e| ApiError::ValidationError(format!("Invalid URL format: {}", e)))?;

    // Get the host
    let host = parsed_url
        .host_str()
        .ok_or_else(|| ApiError::ValidationError("URL must have a host".to_string()))?;

    let host_lower = host.to_lowercase();

    // Check for localhost variants (unless explicitly allowed)
    if !allow_localhost {
        if host_lower == "localhost"
            || host_lower == "localhost.localdomain"
            || host_lower.starts_with("localhost:")
            || host_lower.ends_with(".local")
            || host_lower.ends_with(".localhost")
        {
            return Err(ApiError::ValidationError(
                "Access to localhost is not allowed. Use actual hostnames or IPs.\n\
                 For local development, use --allow-localhost flag."
                    .to_string(),
            )
            .into());
        }
    }

    // If host is an IP address, validate it
    if let Ok(ip) = host.parse::<IpAddr>() {
        match ip {
            IpAddr::V4(ipv4) => {
                // Check for loopback (127.0.0.0/8) unless explicitly allowed
                if !allow_localhost && ipv4.is_loopback() {
                    return Err(ApiError::ValidationError(
                        "Access to loopback addresses is not allowed.\n\
                         For local development, use --allow-localhost flag."
                            .to_string(),
                    )
                    .into());
                }

                // Check for private IP ranges (RFC 1918) unless localhost is allowed
                if !allow_localhost && ipv4.is_private() {
                    return Err(ApiError::ValidationError(
                        "Access to private IP ranges is not allowed for security reasons.\n\
                         For local development, use --allow-localhost flag."
                            .to_string(),
                    )
                    .into());
                }

                // Check for link-local (169.254.0.0/16)
                if ipv4.is_link_local() {
                    return Err(ApiError::ValidationError(
                        "Access to link-local addresses is not allowed.".to_string(),
                    )
                    .into());
                }

                // Check for broadcast
                if ipv4.is_broadcast() {
                    return Err(ApiError::ValidationError(
                        "Access to broadcast addresses is not allowed.".to_string(),
                    )
                    .into());
                }

                // Check for unspecified (0.0.0.0)
                if ipv4.is_unspecified() {
                    return Err(ApiError::ValidationError(
                        "Access to unspecified addresses is not allowed.".to_string(),
                    )
                    .into());
                }

                // Check for multicast
                if ipv4.is_multicast() {
                    return Err(ApiError::ValidationError(
                        "Access to multicast addresses is not allowed.".to_string(),
                    )
                    .into());
                }

                // Explicitly check cloud metadata endpoint
                if ipv4.octets() == [169, 254, 169, 254] {
                    return Err(ApiError::ValidationError(
                        "Access to cloud metadata endpoints is not allowed.".to_string(),
                    )
                    .into());
                }
            }
            IpAddr::V6(ipv6) => {
                // Check for loopback (::1)
                if ipv6.is_loopback() {
                    return Err(ApiError::ValidationError(
                        "Access to loopback addresses is not allowed.".to_string(),
                    )
                    .into());
                }

                // Check for unspecified (::)
                if ipv6.is_unspecified() {
                    return Err(ApiError::ValidationError(
                        "Access to unspecified addresses is not allowed.".to_string(),
                    )
                    .into());
                }

                // Check for multicast
                if ipv6.is_multicast() {
                    return Err(ApiError::ValidationError(
                        "Access to multicast addresses is not allowed.".to_string(),
                    )
                    .into());
                }

                // Check for IPv4-mapped IPv6 addresses
                if let Some(ipv4) = ipv6.to_ipv4_mapped() {
                    if ipv4.is_loopback() || ipv4.is_private() || ipv4.is_link_local() {
                        return Err(ApiError::ValidationError(
                            "Access to private/local addresses via IPv6 mapping is not allowed."
                                .to_string(),
                        )
                        .into());
                    }
                }
            }
        }
    }

    // Block known cloud metadata endpoints by hostname
    let blocked_hosts = [
        "metadata.google.internal",
        "metadata.google",
        "metadata.goog",
        "metadata.amazon",
        "metadata.azure",
        "instance-data",
        "instance.metadata",
    ];

    for blocked in &blocked_hosts {
        if host_lower.contains(blocked) {
            return Err(ApiError::ValidationError(
                "Access to cloud metadata endpoints is not allowed.".to_string(),
            )
            .into());
        }
    }

    // Block file:// and other dangerous protocols (redundant but explicit)
    match parsed_url.scheme() {
        "http" | "https" => Ok(()),
        _ => Err(ApiError::ValidationError(
            "Only HTTP and HTTPS protocols are allowed.".to_string(),
        )
        .into()),
    }
}

/// Check if URL uses HTTPS and enforce security policy
pub fn enforce_https(url: &str, allow_insecure: bool) -> Result<()> {
    enforce_https_with_options(url, allow_insecure, false)
}

/// Check if URL uses HTTPS and enforce security policy with localhost override
pub fn enforce_https_with_options(
    url: &str,
    allow_insecure: bool,
    allow_localhost: bool,
) -> Result<()> {
    // First validate the URL for other security issues
    validate_url_with_options(url, allow_localhost)?;

    // Check if it's HTTP
    if url.starts_with("http://") && !allow_insecure {
        let url_lower = url.to_lowercase();
        let is_loopback = url_lower.starts_with("http://localhost")
            || url_lower.starts_with("http://127.0.0.1")
            || url_lower.starts_with("http://[::1]")
            || url_lower.starts_with("http://0.0.0.0");

        // --allow-localhost implies --allow-insecure for loopback addresses.
        // Loopback traffic never leaves the machine, so HTTPS adds no security.
        if is_loopback && allow_localhost {
            // Fall through to the warning below
        } else if is_loopback {
            return Err(ApiError::ValidationError(
                "HTTP localhost access requires --allow-localhost flag.\n\
                 For local development: mrapids run <op> --allow-localhost"
                    .to_string(),
            )
            .into());
        } else {
            return Err(ApiError::ValidationError(format!(
                "Insecure HTTP connection blocked: {}\n\
                 \n\
                 {} {}\n\
                 \n\
                 HTTP connections are vulnerable to:\n\
                 • Man-in-the-middle attacks\n\
                 • Credential theft\n\
                 • Data tampering\n\
                 \n\
                 To use HTTP anyway (NOT RECOMMENDED):\n\
                 Add --allow-insecure flag to your command\n\
                 \n\
                 Better solution: Use HTTPS URLs",
                url,
                "⚠️".red().bold(),
                "SECURITY WARNING".red().bold()
            ))
            .into());
        }
    }

    // If HTTP is allowed, show a warning (skip verbose warning for localhost)
    if url.starts_with("http://") && (allow_insecure || allow_localhost) {
        let url_lower = url.to_lowercase();
        let is_loopback = url_lower.starts_with("http://localhost")
            || url_lower.starts_with("http://127.0.0.1")
            || url_lower.starts_with("http://[::1]")
            || url_lower.starts_with("http://0.0.0.0");

        if is_loopback && !allow_insecure {
            // Lightweight warning for localhost — no scary ASCII box
            eprintln!("{} Using HTTP for localhost ({})", "ℹ️".dimmed(), url);
        } else {
            eprintln!("\n{}", "━".repeat(60).red());
            eprintln!(
                "{} {} {}",
                "⚠️".red().bold(),
                "INSECURE CONNECTION WARNING".red().bold(),
                "⚠️".red().bold()
            );
            eprintln!("{}", "━".repeat(60).red());
            eprintln!("{} Using insecure HTTP connection to:", "⚠️".yellow());
            eprintln!("   {}", url.yellow());
            eprintln!();
            eprintln!(
                "{}",
                "This connection is NOT encrypted and vulnerable to:".red()
            );
            eprintln!("   • {} Man-in-the-middle attacks", "❌".red());
            eprintln!("   • {} Credential and API key theft", "❌".red());
            eprintln!("   • {} Data tampering and injection", "❌".red());
            eprintln!("   • {} Request/response interception", "❌".red());
            eprintln!();
            eprintln!(
                "{} {}",
                "👉".cyan(),
                "Recommendation: Use HTTPS instead".cyan().bold()
            );
            eprintln!("{}", "━".repeat(60).red());
            eprintln!();
        }
    }

    Ok(())
}

/// Validate file path for reads (prevents directory traversal)
pub fn validate_file_path(path: &Path) -> Result<()> {
    let path_str = path.to_string_lossy();

    // Block path traversal
    if path_str.contains("..") {
        return Err(ApiError::ValidationError("Path traversal is not allowed".to_string()).into());
    }

    // Block access to sensitive system files
    let blocked_paths = [
        "/etc/passwd",
        "/etc/shadow",
        "/etc/sudoers",
        "/.ssh/",
        "/root/",
        "/proc/",
        "/sys/",
        "/.aws/",
        "/.kube/",
        "/.docker/",
        "/.git/credentials",
        "/.netrc",
        "/.npmrc",
    ];

    for blocked in &blocked_paths {
        if path_str.contains(blocked) {
            return Err(
                ApiError::ValidationError(format!("Access to {} is not allowed", blocked)).into(),
            );
        }
    }

    // Block Windows sensitive paths
    if cfg!(windows) {
        let blocked_windows = [
            "C:\\Windows\\System32",
            "C:\\Windows\\System",
            "C:\\Program Files",
        ];
        for blocked in &blocked_windows {
            if path_str.contains(blocked) {
                return Err(ApiError::ValidationError(format!(
                    "Access to {} is not allowed",
                    blocked
                ))
                .into());
            }
        }
    }

    Ok(())
}

/// Validate output path for writes (additional restrictions)
pub fn validate_output_path(path: &Path) -> Result<()> {
    // First do all read validations
    validate_file_path(path)?;

    let path_str = path.to_string_lossy();

    // Block writing to system directories
    let blocked_write_paths = [
        "/usr/",
        "/bin/",
        "/sbin/",
        "/lib/",
        "/lib64/",
        "/etc/",
        "/boot/",
        "/dev/",
        "/opt/",
        "/var/lib/",
        "/var/run/",
    ];

    for blocked in &blocked_write_paths {
        if path_str.starts_with(blocked) {
            return Err(ApiError::ValidationError(format!(
                "Cannot write to system directory: {}",
                blocked
            ))
            .into());
        }
    }

    // Block Windows system directories
    if cfg!(windows) {
        let blocked_windows = [
            "C:\\Windows",
            "C:\\Program Files",
            "C:\\ProgramData",
            "C:\\System",
        ];
        for blocked in &blocked_windows {
            if path_str.starts_with(blocked) {
                return Err(ApiError::ValidationError(format!(
                    "Cannot write to system directory: {}",
                    blocked
                ))
                .into());
            }
        }
    }

    Ok(())
}

/// Validate directory for deletion operations
pub fn validate_delete_path(path: &Path) -> Result<()> {
    validate_output_path(path)?;

    let path_str = path.to_string_lossy();

    // Extra restrictions for deletions
    let critical_paths = ["/", "/home", "/Users", "~", ".", ".."];

    for critical in &critical_paths {
        if path_str == *critical || path_str.ends_with(critical) {
            return Err(ApiError::ValidationError(format!(
                "Cannot delete critical directory: {}",
                critical
            ))
            .into());
        }
    }

    Ok(())
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_url_validation() {
        // Should block
        assert!(validate_url("http://localhost/api").is_err());
        assert!(validate_url("http://127.0.0.1/api").is_err());
        assert!(validate_url("http://192.168.1.1/api").is_err());
        assert!(validate_url("http://10.0.0.1/api").is_err());
        assert!(validate_url("http://172.16.0.1/api").is_err());
        assert!(validate_url("http://169.254.169.254/metadata").is_err());
        assert!(validate_url("file:///etc/passwd").is_err());

        // Should allow
        assert!(validate_url("https://api.example.com").is_ok());
        assert!(validate_url("http://8.8.8.8/api").is_ok());
    }

    #[test]
    fn test_file_path_validation() {
        // Should block
        assert!(validate_file_path(Path::new("/etc/passwd")).is_err());
        assert!(validate_file_path(Path::new("../../../etc/passwd")).is_err());
        assert!(validate_file_path(Path::new("/home/user/.ssh/id_rsa")).is_err());

        // Should allow
        assert!(validate_file_path(Path::new("/home/user/project/api.yaml")).is_ok());
        assert!(validate_file_path(Path::new("./specs/api.yaml")).is_ok());
    }

    #[test]
    fn test_output_path_validation() {
        // Should block
        assert!(validate_output_path(Path::new("/etc/test.yaml")).is_err());
        assert!(validate_output_path(Path::new("/usr/bin/test")).is_err());

        // Should allow
        assert!(validate_output_path(Path::new("/tmp/test.yaml")).is_ok());
        assert!(validate_output_path(Path::new("./output/sdk/")).is_ok());
    }
}