package shell_test

import (
	"context"
	"errors"
	"os"
	"os/exec"
	"path/filepath"
	"reflect"
	"strings"
	"testing"

	"proxyctl/internal/profile"
	"proxyctl/internal/shell"
	"proxyctl/internal/target"
	"proxyctl/internal/target/targettest"
)

func TestShellDiagnosticsRejectSymlinkedPathsWithoutTouchingVictim(t *testing.T) {
	for _, test := range []struct {
		name string
		path func(t *testing.T, root, victim string) string
	}{
		{
			name: "final path",
			path: func(t *testing.T, root, victim string) string {
				t.Helper()
				path := filepath.Join(root, "config", "shell.env")
				if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
					t.Fatal(err)
				}
				if err := os.Symlink(victim, path); err != nil {
					t.Fatal(err)
				}
				return path
			},
		},
		{
			name: "ancestor path",
			path: func(t *testing.T, root, victim string) string {
				t.Helper()
				link := filepath.Join(root, "config")
				if err := os.Symlink(filepath.Dir(victim), link); err != nil {
					t.Fatal(err)
				}
				return filepath.Join(link, filepath.Base(victim))
			},
		},
	} {
		t.Run(test.name, func(t *testing.T) {
			root := t.TempDir()
			victim := filepath.Join(t.TempDir(), "victim")
			const content = "shell-diagnostic-victim"
			if err := os.WriteFile(victim, []byte(content), 0o640); err != nil {
				t.Fatal(err)
			}
			before, err := os.Stat(victim)
			if err != nil {
				t.Fatal(err)
			}
			environmentPath := test.path(t, root, victim)
			a := shell.New(shell.Configuration{Shell: "/bin/bash", EnvironmentFile: environmentPath, RecoveryFile: filepath.Join(root, "state", "shell.json")}, nil, shell.MapEnvironment{})

			checks := a.DiagnosticChecks(context.Background(), nil)
			if len(checks) != 2 || checks[1].OK || !strings.Contains(checks[1].Evidence, "symbolic link") {
				t.Fatalf("Shell diagnostics accepted symlink: %#v", checks)
			}
			after, err := os.Stat(victim)
			if err != nil {
				t.Fatal(err)
			}
			got, err := os.ReadFile(victim)
			if err != nil {
				t.Fatal(err)
			}
			if string(got) != content || !reflect.DeepEqual(before.Sys(), after.Sys()) {
				t.Fatalf("diagnostics changed victim: before=%#v after=%#v content=%q", before, after, got)
			}
		})
	}
}

func TestDetectClassifiesMalformedRecoveryMetadataAsFailure(t *testing.T) {
	a := newAdapter(t, "/bin/bash", nil)
	if err := os.MkdirAll(filepath.Dir(a.RecoveryPath()), 0o700); err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(a.RecoveryPath(), []byte("{malformed"), 0o600); err != nil {
		t.Fatal(err)
	}

	detection := a.Detect(context.Background(), activeProfile())
	if detection.Err == nil || detection.Inspection.State != target.Drifted {
		t.Fatalf("detection = %#v, want failed Drifted inspection", detection)
	}
	if got := a.Inspect(context.Background(), activeProfile()); got.State != target.Drifted {
		t.Fatalf("maintenance inspection = %#v, want established Drifted semantics", got)
	}
}

func TestShellAvailabilitySupportsOnlyBashAndZsh(t *testing.T) {
	for _, tc := range []struct {
		shell     string
		available bool
	}{{"/bin/bash", true}, {"/usr/bin/zsh", true}, {"/usr/bin/fish", false}, {"", false}} {
		t.Run(tc.shell, func(t *testing.T) {
			a := newAdapter(t, tc.shell, nil)
			got := a.Availability(context.Background())
			if got.Available != tc.available || (!tc.available && !strings.Contains(got.Evidence, "Bash or Zsh")) {
				t.Fatalf("availability = %#v", got)
			}
		})
	}
}

func TestShellAdapterRunsReusableTargetContract(t *testing.T) {
	for _, shellName := range []string{"/bin/bash", "/usr/bin/zsh"} {
		shellName := shellName
		t.Run(shellName, func(t *testing.T) {
			targettest.Run(t, func(t *testing.T) targettest.Fixture {
				adapter := newAdapter(t, shellName, nil)
				return targettest.Fixture{
					Target: adapter, Active: activeProfile(), Secret: "secret",
					MakeExternal: func(t *testing.T) {
						if err := os.MkdirAll(filepath.Dir(adapter.EnvironmentPath()), 0o700); err != nil {
							t.Fatal(err)
						}
						if err := os.WriteFile(adapter.EnvironmentPath(), []byte("export HTTP_PROXY='http://external.example:8080'\n"), 0o600); err != nil {
							t.Fatal(err)
						}
					},
					MakeDrifted: func(t *testing.T) {
						if err := os.WriteFile(adapter.EnvironmentPath(), []byte("export HTTP_PROXY='http://changed.example:8080'\n"), 0o600); err != nil {
							t.Fatal(err)
						}
					},
					PermissionFailure: func(t *testing.T) target.OperationResult {
						failed := newAdapterWithFS(t, shellName, nil, &failingFS{FileSystem: shell.OSFileSystem{}, permission: true})
						return failed.SetDesired(context.Background(), true, activeProfile())
					},
					PartialFailure: func(t *testing.T) target.OperationResult {
						failed := newAdapterWithFS(t, shellName, nil, &failingFS{FileSystem: shell.OSFileSystem{}, failEnvironment: true})
						return failed.SetDesired(context.Background(), true, activeProfile())
					},
					RedactionFailure: func(t *testing.T) target.OperationResult {
						failed := newAdapterWithFS(t, shellName, nil, &failingFS{FileSystem: shell.OSFileSystem{}, failWrite: true})
						return failed.SetDesired(context.Background(), true, activeProfile())
					},
					RecoveryRetry: func(t *testing.T) (target.OperationResult, target.OperationResult, target.OperationResult) {
						files := &failingFS{FileSystem: shell.OSFileSystem{}, failRecoveryOnce: true}
						failed := newAdapterWithFS(t, shellName, map[string]string{"HTTP_PROXY": "http://prior.example:3128"}, files)
						first := failed.SetDesired(context.Background(), true, activeProfile())
						retry := failed.SetDesired(context.Background(), true, activeProfile())
						disabled := failed.SetDesired(context.Background(), false, nil)
						return first, retry, disabled
					},
				}
			})
		})
	}
}

func TestIncompleteRecoveryMetadataRejectsRestoreWithoutChangingShellConfiguration(t *testing.T) {
	fingerprint := strings.Repeat("a", 64)
	cases := map[string]string{
		"empty object":          `{}`,
		"missing restoration":   `{"version":1,"fingerprint":"` + fingerprint + `","original":null}`,
		"invalid fingerprint":   `{"version":1,"fingerprint":"short","original":{}}`,
		"conflicting originals": `{"version":1,"fingerprint":"` + fingerprint + `","original":{"HTTP_PROXY":"http://prior.example:3128"},"originalScript":"export HTTP_PROXY=http://prior.example:3128\\n"}`,
	}
	for name, metadata := range cases {
		t.Run(name, func(t *testing.T) {
			a := newAdapter(t, "/bin/bash", nil)
			environment := []byte("export HTTP_PROXY='http://managed.example:8080'\n")
			for path, data := range map[string][]byte{a.EnvironmentPath(): environment, a.RecoveryPath(): []byte(metadata)} {
				if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
					t.Fatal(err)
				}
				if err := os.WriteFile(path, data, 0o600); err != nil {
					t.Fatal(err)
				}
			}
			if inspection := a.Inspect(context.Background(), nil); inspection.State != target.Drifted {
				t.Fatalf("inspection = %#v", inspection)
			}
			result := a.SetDesired(context.Background(), false, nil)
			if result.Err == nil || result.Inspection.State != target.Drifted {
				t.Fatalf("unsafe disable = %#v", result)
			}
			if got := readFile(t, a.EnvironmentPath()); got != string(environment) {
				t.Fatalf("environment changed to %q", got)
			}
			if got := readFile(t, a.RecoveryPath()); got != metadata {
				t.Fatalf("recovery changed to %q", got)
			}
		})
	}
}

func TestRecoveryFailureRetryPreservesOriginalShellState(t *testing.T) {
	files := &failingFS{FileSystem: shell.OSFileSystem{}, failRecoveryOnce: true}
	a := newAdapterWithFS(t, "/bin/bash", map[string]string{"HTTP_PROXY": "http://prior.example:3128"}, files)
	first := a.SetDesired(context.Background(), true, activeProfile())
	if first.Err == nil || first.Inspection.State != target.External {
		t.Fatalf("first enable = %#v", first)
	}
	if _, err := os.Stat(a.EnvironmentPath()); !errors.Is(err, os.ErrNotExist) {
		t.Fatalf("managed environment was visible before recovery persisted: %v", err)
	}
	if retry := a.SetDesired(context.Background(), true, activeProfile()); retry.Err != nil || retry.Inspection.State != target.Enabled {
		t.Fatalf("retry = %#v", retry)
	}
	if disabled := a.SetDesired(context.Background(), false, nil); disabled.Err != nil || disabled.Inspection.State != target.External {
		t.Fatalf("disable = %#v", disabled)
	}
	if restored := readFile(t, a.EnvironmentPath()); !strings.Contains(restored, "http://prior.example:3128") || strings.Contains(restored, "proxy.example:8080") {
		t.Fatalf("original was not restored: %s", restored)
	}
}

func TestRecognizesOnlyExactSupportedShellProxySyntax(t *testing.T) {
	for _, tc := range []struct {
		name, contents string
		state          target.State
	}{
		{"comment", "# export HTTP_PROXY='http://comment.example:8080'\n", target.Disabled},
		{"prefixed variable", "export NOT_HTTP_PROXY='http://wrong.example:8080'\n", target.Disabled},
		{"prose", "echo export HTTP_PROXY=http://wrong.example:8080\n", target.Disabled},
		{"unset", "unset HTTP_PROXY http_proxy\n", target.Disabled},
		{"assignment", "HTTP_PROXY='http://external.example:8080'\n", target.External},
		{"export assignment", "export http_proxy='http://external.example:8080'\n", target.External},
	} {
		t.Run(tc.name, func(t *testing.T) {
			a := newAdapter(t, "/bin/bash", nil)
			if err := os.MkdirAll(filepath.Dir(a.EnvironmentPath()), 0o700); err != nil {
				t.Fatal(err)
			}
			if err := os.WriteFile(a.EnvironmentPath(), []byte(tc.contents), 0o600); err != nil {
				t.Fatal(err)
			}
			assertState(t, a, activeProfile(), tc.state)
		})
	}
}

func TestShellTargetContract(t *testing.T) {
	contract := func(t *testing.T, shellName string) {
		t.Helper()
		t.Run(shellName, func(t *testing.T) {
			t.Run("disabled-enable-idempotent-disable", func(t *testing.T) {
				a := newAdapter(t, shellName, map[string]string{"HTTP_PROXY": "http://prior.example:3128"})
				assertState(t, a, activeProfile(), target.External)
				result := a.SetDesired(context.Background(), true, activeProfile())
				if result.Err != nil || result.Inspection.State != target.Enabled {
					t.Fatalf("enable = %#v", result)
				}
				env := readFile(t, a.EnvironmentPath())
				for _, name := range []string{"HTTP_PROXY", "http_proxy", "HTTPS_PROXY", "https_proxy", "ALL_PROXY", "all_proxy", "NO_PROXY", "no_proxy"} {
					if !strings.Contains(env, "export "+name+"=") {
						t.Errorf("generated environment missing %s:\n%s", name, env)
					}
				}
				if second := a.SetDesired(context.Background(), true, activeProfile()); second.Err != nil || second.Inspection.State != target.Enabled {
					t.Fatalf("second enable = %#v", second)
				}
				result = a.SetDesired(context.Background(), false, nil)
				if result.Err != nil || result.Inspection.State != target.External {
					t.Fatalf("disable = %#v", result)
				}
				restored := readFile(t, a.EnvironmentPath())
				if !strings.Contains(restored, "export HTTP_PROXY='http://prior.example:3128'") || !strings.Contains(restored, "unset http_proxy HTTPS_PROXY https_proxy ALL_PROXY all_proxy NO_PROXY no_proxy") {
					t.Fatalf("prior state not restored with required unsets:\n%s", restored)
				}
				if second := a.SetDesired(context.Background(), false, nil); second.Err != nil || second.Inspection.State != target.External {
					t.Fatalf("idempotent disable = %#v", second)
				}
			})

			t.Run("all-four-inspection-states", func(t *testing.T) {
				a := newAdapter(t, shellName, nil)
				assertState(t, a, activeProfile(), target.Disabled)
				if err := os.MkdirAll(filepath.Dir(a.EnvironmentPath()), 0o700); err != nil {
					t.Fatal(err)
				}
				if err := os.WriteFile(a.EnvironmentPath(), []byte("export HTTP_PROXY='http://external.example:8080'\n"), 0o600); err != nil {
					t.Fatal(err)
				}
				assertState(t, a, activeProfile(), target.External)
				if result := a.SetDesired(context.Background(), true, activeProfile()); result.Err != nil {
					t.Fatal(result.Err)
				}
				assertState(t, a, activeProfile(), target.Enabled)
				if err := os.WriteFile(a.EnvironmentPath(), []byte("export HTTP_PROXY='http://changed.example:8080'\n"), 0o600); err != nil {
					t.Fatal(err)
				}
				assertState(t, a, activeProfile(), target.Drifted)
			})

			t.Run("drifted-environment-refuses-destructive-restore", func(t *testing.T) {
				a := newAdapter(t, shellName, nil)
				if result := a.SetDesired(context.Background(), true, activeProfile()); result.Err != nil {
					t.Fatal(result.Err)
				}
				changed := "export HTTP_PROXY='http://user-change.example:8080'\n"
				if err := os.WriteFile(a.EnvironmentPath(), []byte(changed), 0o600); err != nil {
					t.Fatal(err)
				}
				result := a.SetDesired(context.Background(), false, nil)
				if result.Err == nil || result.Inspection.State != target.Drifted {
					t.Fatalf("unsafe restore = %#v", result)
				}
				if got := readFile(t, a.EnvironmentPath()); got != changed {
					t.Fatalf("drifted environment overwritten:\n%s", got)
				}
				if _, err := os.Stat(a.RecoveryPath()); err != nil {
					t.Fatalf("recovery metadata removed after refused restore: %v", err)
				}
			})

			t.Run("validation-and-redaction", func(t *testing.T) {
				fs := &failingFS{FileSystem: shell.OSFileSystem{}, failWrite: true}
				a := newAdapterWithFS(t, shellName, nil, fs)
				if got := a.SetDesired(context.Background(), true, nil); got.Err == nil || !strings.Contains(got.Err.Error(), "Profile management") {
					t.Fatalf("no Active Profile result = %#v", got)
				}
				got := a.SetDesired(context.Background(), true, activeProfile())
				if got.Err == nil || strings.Contains(got.Err.Error(), "secret") || got.Inspection.State != target.Disabled {
					t.Fatalf("failure was not truthful/redacted: %#v", got)
				}

				restoreFS := &failingFS{FileSystem: shell.OSFileSystem{}}
				restore := newAdapterWithFS(t, shellName, map[string]string{"HTTP_PROXY": "http://alice:restore-secret@prior.example:8080"}, restoreFS)
				if enabled := restore.SetDesired(context.Background(), true, activeProfile()); enabled.Err != nil {
					t.Fatal(enabled.Err)
				}
				restoreFS.failRestore = true
				disabled := restore.SetDesired(context.Background(), false, nil)
				if disabled.Err == nil || strings.Contains(disabled.Err.Error(), "restore-secret") {
					t.Fatalf("disable error exposed restored secret: %#v", disabled)
				}
			})

			t.Run("permission-and-partial-failure-reinspect", func(t *testing.T) {
				fs := &failingFS{FileSystem: shell.OSFileSystem{}, failEnvironment: true}
				a := newAdapterWithFS(t, shellName, nil, fs)
				got := a.SetDesired(context.Background(), true, activeProfile())
				if got.Err == nil || !errors.Is(got.Err, os.ErrPermission) {
					t.Fatalf("permission error = %#v", got)
				}
				if got.Inspection.State != target.Drifted {
					t.Fatalf("partial write state = %s, want Drifted", got.Inspection.State)
				}
			})
		})
	}
	contract(t, "/bin/bash")
	contract(t, "/usr/bin/zsh")
}

func TestIntegrationInstallUninstallPreservesStartupFileAndLoadsAfterCommand(t *testing.T) {
	a := newAdapter(t, "/bin/bash", nil)
	startup := a.StartupPath()
	if err := os.MkdirAll(filepath.Dir(startup), 0o700); err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(startup, []byte("# user alias\nalias ll='ls -l'\n"), 0o640); err != nil {
		t.Fatal(err)
	}
	if err := os.Chmod(filepath.Dir(startup), 0o751); err != nil {
		t.Fatal(err)
	}
	if err := a.Install(context.Background(), "/opt/bin/proxyctl"); err != nil {
		t.Fatal(err)
	}
	if err := a.Install(context.Background(), "/opt/bin/proxyctl"); err != nil {
		t.Fatal(err)
	}
	installed := readFile(t, startup)
	if strings.Count(installed, "# >>> proxyctl shell integration >>>") != 1 || !strings.Contains(installed, "command '/opt/bin/proxyctl'") || !strings.Contains(installed, a.EnvironmentPath()) || !strings.Contains(installed, "alias ll=") {
		t.Fatalf("installed startup file:\n%s", installed)
	}
	startupInfo, _ := os.Stat(startup)
	homeInfo, _ := os.Stat(filepath.Dir(startup))
	if startupInfo.Mode().Perm() != 0o640 || homeInfo.Mode().Perm() != 0o751 {
		t.Fatalf("install changed unrelated permissions: file=%o directory=%o", startupInfo.Mode().Perm(), homeInfo.Mode().Perm())
	}
	if err := a.Uninstall(context.Background()); err != nil {
		t.Fatal(err)
	}
	if err := a.Uninstall(context.Background()); err != nil {
		t.Fatal(err)
	}
	if got := readFile(t, startup); got != "# user alias\nalias ll='ls -l'\n" {
		t.Fatalf("uninstall changed unrelated content: %q", got)
	}
}

func TestDescriptorAnchoredWritesRejectSymlinkedAncestorVictims(t *testing.T) {
	t.Run("configuration", func(t *testing.T) {
		root, victim := t.TempDir(), t.TempDir()
		if err := os.Symlink(victim, filepath.Join(root, "config")); err != nil {
			t.Fatal(err)
		}
		a := shell.New(shell.Configuration{Shell: "/bin/bash", StartupFile: filepath.Join(root, "home", ".bashrc"), EnvironmentFile: filepath.Join(root, "config", "proxyctl", "shell.env"), RecoveryFile: filepath.Join(root, "state", "proxyctl", "shell.json"), TrustedRoots: []string{root}}, nil, shell.MapEnvironment{})
		if got := a.SetDesired(context.Background(), true, activeProfile()); got.Err == nil {
			t.Fatal("enable followed symlinked configuration ancestor")
		}
		assertVictimEmpty(t, victim)
	})
	t.Run("configuration final file", func(t *testing.T) {
		root := t.TempDir()
		victim := filepath.Join(t.TempDir(), "victim")
		if err := os.WriteFile(victim, []byte("unchanged\n"), 0o600); err != nil {
			t.Fatal(err)
		}
		if err := os.MkdirAll(filepath.Join(root, "config", "proxyctl"), 0o700); err != nil {
			t.Fatal(err)
		}
		environmentFile := filepath.Join(root, "config", "proxyctl", "shell.env")
		if err := os.Symlink(victim, environmentFile); err != nil {
			t.Fatal(err)
		}
		a := shell.New(shell.Configuration{Shell: "/bin/bash", StartupFile: filepath.Join(root, ".bashrc"), EnvironmentFile: environmentFile, RecoveryFile: filepath.Join(root, "state", "proxyctl", "shell.json"), TrustedRoots: []string{root}}, nil, shell.MapEnvironment{})
		if got := a.SetDesired(context.Background(), true, activeProfile()); got.Err == nil {
			t.Fatal("enable replaced symlinked final configuration file")
		}
		if got := readFile(t, victim); got != "unchanged\n" {
			t.Fatalf("final symlink victim changed to %q", got)
		}
	})
	t.Run("state", func(t *testing.T) {
		root, victim := t.TempDir(), t.TempDir()
		if err := os.Mkdir(filepath.Join(root, ".local"), 0o700); err != nil {
			t.Fatal(err)
		}
		if err := os.Symlink(victim, filepath.Join(root, ".local", "state")); err != nil {
			t.Fatal(err)
		}
		a := shell.New(shell.Configuration{Shell: "/bin/bash", StartupFile: filepath.Join(root, ".bashrc"), EnvironmentFile: filepath.Join(root, ".config", "proxyctl", "shell.env"), RecoveryFile: filepath.Join(root, ".local", "state", "proxyctl", "shell.json"), TrustedRoots: []string{root}}, nil, shell.MapEnvironment{})
		if got := a.SetDesired(context.Background(), true, activeProfile()); got.Err == nil {
			t.Fatal("enable followed symlinked state ancestor")
		}
		assertVictimEmpty(t, victim)
		if _, err := os.Stat(a.EnvironmentPath()); !errors.Is(err, os.ErrNotExist) {
			t.Fatalf("environment changed before secure recovery: %v", err)
		}
	})
	t.Run("integration", func(t *testing.T) {
		root, victim := t.TempDir(), t.TempDir()
		if err := os.Symlink(victim, filepath.Join(root, "home")); err != nil {
			t.Fatal(err)
		}
		a := shell.New(shell.Configuration{Shell: "/bin/bash", StartupFile: filepath.Join(root, "home", ".bashrc"), EnvironmentFile: filepath.Join(root, "config", "shell.env"), RecoveryFile: filepath.Join(root, "state", "shell.json"), TrustedRoots: []string{root}}, nil, shell.MapEnvironment{})
		if err := a.Install(context.Background(), "/bin/proxyctl"); err == nil {
			t.Fatal("install followed symlinked startup ancestor")
		}
		assertVictimEmpty(t, victim)
	})
}

func assertVictimEmpty(t *testing.T, path string) {
	t.Helper()
	entries, err := os.ReadDir(path)
	if err != nil {
		t.Fatal(err)
	}
	if len(entries) != 0 {
		t.Fatalf("symlink victim changed: %v", entries)
	}
}

func TestIntegrationRefusesStartupSymlinkWithoutChangingVictim(t *testing.T) {
	a := newAdapter(t, "/bin/bash", nil)
	if err := os.MkdirAll(filepath.Dir(a.StartupPath()), 0o700); err != nil {
		t.Fatal(err)
	}
	victim := filepath.Join(t.TempDir(), "victim")
	if err := os.WriteFile(victim, []byte("unchanged\n"), 0o644); err != nil {
		t.Fatal(err)
	}
	if err := os.Symlink(victim, a.StartupPath()); err != nil {
		t.Fatal(err)
	}
	if err := a.Install(context.Background(), "/bin/proxyctl"); err == nil {
		t.Fatal("install followed startup symlink")
	}
	if got := readFile(t, victim); got != "unchanged\n" {
		t.Fatalf("symlink victim changed to %q", got)
	}
}

func TestMalformedIntegrationMarkersNeverCauseStartupContentDeletion(t *testing.T) {
	a := newAdapter(t, "/bin/bash", nil)
	if err := os.MkdirAll(filepath.Dir(a.StartupPath()), 0o700); err != nil {
		t.Fatal(err)
	}
	original := "# >>> proxyctl shell integration >>>\n# user content without closing marker\n"
	if err := os.WriteFile(a.StartupPath(), []byte(original), 0o644); err != nil {
		t.Fatal(err)
	}
	if err := a.Install(context.Background(), "/bin/proxyctl"); err == nil {
		t.Fatal("install accepted malformed integration markers")
	}
	if got := readFile(t, a.StartupPath()); got != original {
		t.Fatalf("malformed startup changed to %q", got)
	}
}

func TestFreshIntegratedShellSourcesExistingEnvironmentAtStartup(t *testing.T) {
	for _, shellName := range []string{"bash", "zsh"} {
		t.Run(shellName, func(t *testing.T) {
			path, err := exec.LookPath(shellName)
			if err != nil {
				t.Skip(shellName + " is not installed")
			}
			a := newAdapter(t, filepath.Join("/bin", shellName), nil)
			if enabled := a.SetDesired(context.Background(), true, activeProfile()); enabled.Err != nil {
				t.Fatal(enabled.Err)
			}
			if err := a.Install(context.Background(), "/bin/true"); err != nil {
				t.Fatal(err)
			}
			var command *exec.Cmd
			if shellName == "bash" {
				command = exec.Command(path, "--noprofile", "--rcfile", a.StartupPath(), "-i", "-c", `printf %s "$HTTP_PROXY"`)
			} else {
				command = exec.Command(path, "-d", "-i", "-c", `printf %s "$HTTP_PROXY"`)
				command.Env = append(os.Environ(), "ZDOTDIR="+filepath.Dir(a.StartupPath()))
			}
			output, err := command.Output()
			if err != nil {
				t.Fatalf("start fresh %s: %v", shellName, err)
			}
			if got := string(output); got != "http://alice:secret@proxy.example:8080" {
				t.Fatalf("fresh %s HTTP_PROXY = %q", shellName, got)
			}
		})
	}
}

func TestInstalledBashWrapperReloadsParentEnvironmentAfterProxyctlExits(t *testing.T) {
	if _, err := exec.LookPath("bash"); err != nil {
		t.Skip("bash is not installed")
	}
	a := newAdapter(t, "/bin/bash", nil)
	executable := filepath.Join(t.TempDir(), "fake-proxyctl")
	if err := os.MkdirAll(filepath.Dir(a.EnvironmentPath()), 0o700); err != nil {
		t.Fatal(err)
	}
	script := "#!/bin/sh\nprintf '%s\\n' \"export HTTP_PROXY='http://reloaded.example:8080'\" > " + shellPathQuote(a.EnvironmentPath()) + "\nexit 7\n"
	if err := os.WriteFile(executable, []byte(script), 0o700); err != nil {
		t.Fatal(err)
	}
	if err := a.Install(context.Background(), executable); err != nil {
		t.Fatal(err)
	}
	command := exec.Command("bash", "--noprofile", "--rcfile", a.StartupPath(), "-i", "-c", `proxyctl >/dev/null || test $? -eq 7; printf %s "$HTTP_PROXY"`)
	output, err := command.Output()
	if err != nil {
		t.Fatalf("run integrated Bash: %v", err)
	}
	if got := string(output); got != "http://reloaded.example:8080" {
		t.Fatalf("parent Shell proxy = %q", got)
	}
}

func shellPathQuote(value string) string { return "'" + strings.ReplaceAll(value, "'", "'\\''") + "'" }

func TestOwnedWritesCarryInvokingUserIdentityIntoAtomicReplacement(t *testing.T) {
	root := t.TempDir()
	files := &ownershipFS{FileSystem: shell.OSFileSystem{}}
	a := shell.New(shell.Configuration{Shell: "/bin/bash", StartupFile: filepath.Join(root, ".bashrc"), EnvironmentFile: filepath.Join(root, "config", "shell.env"), RecoveryFile: filepath.Join(root, "state", "shell.json"), OwnFiles: true, UID: 1234, GID: 1235}, files, shell.MapEnvironment{})
	if result := a.SetDesired(context.Background(), true, activeProfile()); result.Err != nil {
		t.Fatal(result.Err)
	}
	if len(files.owners) != 2 {
		t.Fatalf("owned atomic writes = %#v", files.owners)
	}
	for _, owner := range files.owners {
		if owner == nil || owner.UID != 1234 || owner.GID != 1235 {
			t.Fatalf("atomic owner = %#v", owner)
		}
	}
}

type ownershipFS struct {
	shell.FileSystem
	owners []*shell.Ownership
}

func (f *ownershipFS) AtomicWrite(path string, data []byte, mode os.FileMode, owner *shell.Ownership) error {
	f.owners = append(f.owners, owner)
	return f.FileSystem.AtomicWrite(path, data, mode, nil)
}

func TestRecoveryAndGeneratedFilesAreAtomicOwnerOnly(t *testing.T) {
	a := newAdapter(t, "/usr/bin/zsh", nil)
	if result := a.SetDesired(context.Background(), true, activeProfile()); result.Err != nil {
		t.Fatal(result.Err)
	}
	for _, path := range []string{a.EnvironmentPath(), a.RecoveryPath()} {
		info, err := os.Stat(path)
		if err != nil {
			t.Fatal(err)
		}
		if info.Mode().Perm() != 0o600 {
			t.Errorf("%s mode = %o", path, info.Mode().Perm())
		}
	}
	matches, _ := filepath.Glob(filepath.Join(filepath.Dir(a.RecoveryPath()), ".proxyctl-*"))
	if len(matches) != 0 {
		t.Fatalf("atomic temporary files remain: %v", matches)
	}
}

func TestDisableManagedShellAfterCurrentShellBecomesUnsupported(t *testing.T) {
	root := t.TempDir()
	configuration := shell.Configuration{Shell: "/bin/bash", StartupFile: filepath.Join(root, ".bashrc"), EnvironmentFile: filepath.Join(root, "config", "shell.env"), RecoveryFile: filepath.Join(root, "state", "shell.json")}
	enabled := shell.New(configuration, shell.OSFileSystem{}, shell.MapEnvironment{})
	if result := enabled.SetDesired(context.Background(), true, activeProfile()); result.Err != nil {
		t.Fatal(result.Err)
	}
	configuration.Shell = "/bin/fish"
	unsupported := shell.New(configuration, shell.OSFileSystem{}, shell.MapEnvironment{})
	result := unsupported.SetDesired(context.Background(), false, nil)
	if result.Err != nil || result.Inspection.State != target.Disabled {
		t.Fatalf("disable from unsupported Shell = %#v", result)
	}
}

func activeProfile() *profile.Profile {
	return &profile.Profile{Name: "office", Mode: profile.AdvancedMode, HTTPURL: "http://alice:secret@proxy.example:8080", HTTPSURL: "https://proxy.example:8443", AllURL: "socks5h://proxy.example:1080", Bypass: []string{"localhost", ".example.com", "10.0.0.0/8"}}
}

func newAdapter(t *testing.T, shellName string, env map[string]string) *shell.Adapter {
	return newAdapterWithFS(t, shellName, env, shell.OSFileSystem{})
}
func newAdapterWithFS(t *testing.T, shellName string, env map[string]string, fs shell.FileSystem) *shell.Adapter {
	t.Helper()
	root := t.TempDir()
	startup := ".bashrc"
	if filepath.Base(shellName) == "zsh" {
		startup = ".zshrc"
	}
	return shell.New(shell.Configuration{Shell: shellName, StartupFile: filepath.Join(root, "home", startup), EnvironmentFile: filepath.Join(root, "config", "shell.env"), RecoveryFile: filepath.Join(root, "state", "shell.json")}, fs, shell.MapEnvironment(env))
}
func assertState(t *testing.T, a *shell.Adapter, p *profile.Profile, want target.State) {
	t.Helper()
	if got := a.Inspect(context.Background(), p); got.State != want {
		t.Fatalf("state = %s (%s), want %s", got.State, got.Evidence, want)
	}
}
func readFile(t *testing.T, path string) string {
	t.Helper()
	data, err := os.ReadFile(path)
	if err != nil {
		t.Fatal(err)
	}
	return string(data)
}

type failingFS struct {
	shell.FileSystem
	failWrite, failState, failEnvironment, failRestore, permission, failRecoveryOnce bool
}

func (f *failingFS) AtomicWrite(path string, data []byte, mode os.FileMode, owner *shell.Ownership) error {
	if f.permission {
		return os.ErrPermission
	}
	if f.failWrite {
		return errors.New("write http://alice:secret@proxy.example:8080 failed")
	}
	if f.failEnvironment && strings.HasSuffix(path, "shell.env") {
		return os.ErrPermission
	}
	if f.failRestore && strings.HasSuffix(path, "shell.env") {
		return errors.New("restore http://alice:restore-secret@prior.example:8080 failed")
	}
	if f.failRecoveryOnce && strings.HasSuffix(path, "shell.json") {
		f.failRecoveryOnce = false
		return os.ErrPermission
	}
	if f.failState && strings.HasSuffix(path, "shell.json") {
		return os.ErrPermission
	}
	return f.FileSystem.AtomicWrite(path, data, mode, owner)
}