# Copyright 2015 gRPC authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

require 'spec_helper'

def create_channel_creds
  test_root = File.join(File.dirname(__FILE__), 'testdata')
  files = ['ca.pem', 'client.key', 'client.pem']
  creds = files.map { |f| File.open(File.join(test_root, f)).read }
  GRPC::Core::ChannelCredentials.new(creds[0], creds[1], creds[2])
end

def client_cert
  test_root = File.join(File.dirname(__FILE__), 'testdata')
  cert = File.open(File.join(test_root, 'client.pem')).read
  fail unless cert.is_a?(String)
  cert
end

def create_server_creds
  test_root = File.join(File.dirname(__FILE__), 'testdata')
  GRPC.logger.info("test root: #{test_root}")
  files = ['ca.pem', 'server1.key', 'server1.pem']
  creds = files.map { |f| File.open(File.join(test_root, f)).read }
  GRPC::Core::ServerCredentials.new(
    creds[0],
    [{ private_key: creds[1], cert_chain: creds[2] }],
    true) # force client auth
end

# a test service that checks the cert of its peer
class SslTestService
  include GRPC::GenericService
  rpc :an_rpc, EchoMsg, EchoMsg
  rpc :a_client_streaming_rpc, stream(EchoMsg), EchoMsg
  rpc :a_server_streaming_rpc, EchoMsg, stream(EchoMsg)
  rpc :a_bidi_rpc, stream(EchoMsg), stream(EchoMsg)

  def check_peer_cert(call)
    error_msg = "want:\n#{client_cert}\n\ngot:\n#{call.peer_cert}"
    fail(error_msg) unless call.peer_cert == client_cert
  end

  def an_rpc(req, call)
    check_peer_cert(call)
    req
  end

  def a_client_streaming_rpc(call)
    check_peer_cert(call)
    call.each_remote_read.each { |r| GRPC.logger.info(r) }
    EchoMsg.new
  end

  def a_server_streaming_rpc(_, call)
    check_peer_cert(call)
    [EchoMsg.new, EchoMsg.new]
  end

  def a_bidi_rpc(requests, call)
    check_peer_cert(call)
    requests.each { |r| GRPC.logger.info(r) }
    [EchoMsg.new, EchoMsg.new]
  end
end

SslTestServiceStub = SslTestService.rpc_stub_class

describe 'client-server auth' do
  RpcServer = GRPC::RpcServer

  before(:all) do
    server_opts = {
      poll_period: 1
    }
    @srv = new_rpc_server_for_testing(**server_opts)
    port = @srv.add_http2_port('0.0.0.0:0', create_server_creds)
    @srv.handle(SslTestService)
    @srv_thd = Thread.new { @srv.run }
    @srv.wait_till_running

    client_opts = {
      channel_args: {
        GRPC::Core::Channel::SSL_TARGET => 'foo.test.google.fr'
      }
    }
    @stub = SslTestServiceStub.new("localhost:#{port}",
                                   create_channel_creds,
                                   **client_opts)
  end

  after(:all) do
    expect(@srv.stopped?).to be(false)
    @srv.stop
    @srv_thd.join
  end

  it 'client-server auth with unary RPCs' do
    @stub.an_rpc(EchoMsg.new)
  end

  it 'client-server auth with client streaming RPCs' do
    @stub.a_client_streaming_rpc([EchoMsg.new, EchoMsg.new])
  end

  it 'client-server auth with server streaming RPCs' do
    responses = @stub.a_server_streaming_rpc(EchoMsg.new)
    responses.each { |r| GRPC.logger.info(r) }
  end

  it 'client-server auth with bidi RPCs' do
    responses = @stub.a_bidi_rpc([EchoMsg.new, EchoMsg.new])
    responses.each { |r| GRPC.logger.info(r) }
  end
end