using System.Text.RegularExpressions;
using SQLInsight.Core.Servers;

namespace SQLInsight.Core.Tests;

/// <summary>
/// db/permissions/grant-windows-server.ps1 as SQLInsight Web shows it: the agent's account filled in safely, and the
/// script itself only ever gives read rights (the SDDL logic is run in SQLInsight.Servers.Tests/GrantScriptTests).
/// </summary>
public sealed partial class ServerGrantScriptTests
{
    [Fact]
    public void The_account_is_filled_in()
    {
        var script = ServerGrantScript.For(@"FIRMA\AGENT01$");

        Assert.Contains(@"[string] $Account = 'FIRMA\AGENT01$',", script, StringComparison.Ordinal);
        Assert.DoesNotContain("DOMÆNE\\AGENTSERVER$',   #", script, StringComparison.Ordinal);
        Assert.Equal(script, ServerGrantScript.For(@"FIRMA\AGENT01$"));
        Assert.Contains("'O''Brien'", ServerGrantScript.For("O'Brien"), StringComparison.Ordinal);
    }

    [Theory]
    [InlineData("X’; Invoke-Evil; ’")] // PowerShell also ends a single-quoted string at ‘ ’ ‚ ‛
    [InlineData("X‘")]
    [InlineData("X‚")]
    [InlineData("X‛")]
    [InlineData("X\r\nInvoke-Evil")]
    public void An_account_that_could_break_out_of_the_string_is_not_filled_in(string account)
    {
        Assert.False(ServerGrantScript.IsSafeAccount(account));
        Assert.Equal(ServerGrantScript.Template(), ServerGrantScript.For(account));
        Assert.DoesNotContain("Invoke-Evil", ServerGrantScript.For(account), StringComparison.Ordinal);
    }

    [Fact]
    public void Only_read_rights_are_given()
    {
        var script = ServerGrantScript.Template();

        // Groups: Performance Monitor Users, Event Log Readers, Distributed COM Users. Never Administrators or Remote
        // Management Users (which also allows PowerShell Remoting).
        var groups = GroupBlock().Match(script);
        Assert.True(groups.Success);
        Assert.Equal(["S-1-5-32-558", "S-1-5-32-573", "S-1-5-32-562"], Sid().Matches(groups.Value).Select(m => m.Value));

        // WMI Enable Account + Remote Enable; SCM connect, list, lock status, read control; WinRM read only.
        Assert.Contains("$wmiMask = 0x21 ", script, StringComparison.Ordinal);
        Assert.Contains("$scmMask = 0x20015 ", script, StringComparison.Ordinal);
        Assert.Contains("$winrmMask = [int] 0x80000000 ", script, StringComparison.Ordinal);

        // Nothing that changes a service, a task, or runs WMI methods; Windows' own firewall rules are not touched.
        foreach (var forbidden in new[]
                 {
                     "Start-Service", "Stop-Service", "Restart-Service", "Set-Service", "sc.exe config", "sc.exe start", "sc.exe stop",
                     "Invoke-WmiMethod", "Invoke-CimMethod", "Enable-NetFirewallRule", "Disable-NetFirewallRule", "Enable-PSRemoting",
                     "Set-PSSessionConfiguration", "S-1-5-32-580", "Add-LocalGroupMember",
                 })
        {
            Assert.DoesNotContain(forbidden, script, StringComparison.OrdinalIgnoreCase);
        }

        Assert.Contains("SupportsShouldProcess", script, StringComparison.Ordinal);   // -WhatIf
        Assert.Contains("IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)", script, StringComparison.Ordinal);
    }

    [GeneratedRegex(@"\$groups = @\((?:.|\n|\r)*?\n\)")]
    private static partial Regex GroupBlock();

    [GeneratedRegex(@"S-1-5-32-\d+")]
    private static partial Regex Sid();
}