build_test.go

package cmd

import (
	"os"
	"testing"

	"github.com/spf13/cobra"
)

func TestBuildCommandFlags(t *testing.T) {
	tests := []struct {
		name     string
		args     []string
		wantFlag string
		wantVal  interface{}
	}{
		{
			name:     "in-flight-checksums flag default",
			args:     []string{},
			wantFlag: "in-flight-checksums",
			wantVal:  false,
		},
		{
			name:     "in-flight-checksums flag enabled",
			args:     []string{"--in-flight-checksums"},
			wantFlag: "in-flight-checksums",
			wantVal:  true,
		},
		{
			name:     "in-flight-checksums flag explicitly disabled",
			args:     []string{"--in-flight-checksums=false"},
			wantFlag: "in-flight-checksums",
			wantVal:  false,
		},
		{
			name:     "slsa-require-attestation flag default",
			args:     []string{},
			wantFlag: "slsa-require-attestation",
			wantVal:  false,
		},
		{
			name:     "slsa-require-attestation flag enabled",
			args:     []string{"--slsa-require-attestation"},
			wantFlag: "slsa-require-attestation",
			wantVal:  true,
		},
		{
			name:     "slsa-require-attestation flag explicitly disabled",
			args:     []string{"--slsa-require-attestation=false"},
			wantFlag: "slsa-require-attestation",
			wantVal:  false,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			// Create a new build command for each test
			cmd := &cobra.Command{
				Use: "build",
				Run: func(cmd *cobra.Command, args []string) {
					// No-op for testing
				},
			}

			// Add the build flags
			addBuildFlags(cmd)

			// Set the args and parse
			cmd.SetArgs(tt.args)
			err := cmd.Execute()
			if err != nil {
				t.Fatalf("failed to execute command: %v", err)
			}

			// Check if the flag exists
			flag := cmd.Flags().Lookup(tt.wantFlag)
			if flag == nil {
				t.Fatalf("flag %s not found", tt.wantFlag)
			}

			// Get the flag value
			val, err := cmd.Flags().GetBool(tt.wantFlag)
			if err != nil {
				t.Fatalf("failed to get flag value: %v", err)
			}

			if val != tt.wantVal {
				t.Errorf("expected flag %s to be %v, got %v", tt.wantFlag, tt.wantVal, val)
			}
		})
	}
}

func TestInFlightChecksumsEnvironmentVariable(t *testing.T) {
	tests := []struct {
		name      string
		envValue  string
		flagValue string
		flagSet   bool
		expected  bool
	}{
		{
			name:     "env var enabled, no flag",
			envValue: "true",
			expected: true,
		},
		{
			name:     "env var disabled, no flag",
			envValue: "false",
			expected: false,
		},
		{
			name:     "no env var, no flag",
			envValue: "",
			expected: false,
		},
		{
			name:      "env var enabled, flag explicitly disabled",
			envValue:  "true",
			flagValue: "false",
			flagSet:   true,
			expected:  false, // Flag should override
		},
		{
			name:      "env var disabled, flag explicitly enabled",
			envValue:  "false",
			flagValue: "true",
			flagSet:   true,
			expected:  true, // Flag should override
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			// Set environment variable using t.Setenv for proper cleanup
			if tt.envValue != "" {
				t.Setenv(EnvvarEnableInFlightChecksums, tt.envValue)
			}

			// Create test command
			cmd := &cobra.Command{
				Use: "build",
				Run: func(cmd *cobra.Command, args []string) {},
			}

			addBuildFlags(cmd)

			// Set flag if specified
			if tt.flagSet {
				err := cmd.Flags().Set("in-flight-checksums", tt.flagValue)
				if err != nil {
					t.Fatalf("failed to set flag: %v", err)
				}
			}

			// Test the actual logic from getBuildOpts
			inFlightChecksumsDefault := os.Getenv(EnvvarEnableInFlightChecksums) == "true"
			inFlightChecksums, err := cmd.Flags().GetBool("in-flight-checksums")
			if err != nil {
				t.Fatalf("failed to get flag: %v", err)
			}
			// If flag wasn't explicitly set, use environment variable
			if !cmd.Flags().Changed("in-flight-checksums") {
				inFlightChecksums = inFlightChecksumsDefault
			}

			if inFlightChecksums != tt.expected {
				t.Errorf("expected in-flight checksums to be %v, got %v", tt.expected, inFlightChecksums)
			}
		})
	}
}

func TestBuildCommandHelpText(t *testing.T) {
	cmd := &cobra.Command{
		Use: "build",
		Run: func(cmd *cobra.Command, args []string) {
			// No-op for testing
		},
	}

	addBuildFlags(cmd)

	// Check that the in-flight-checksums flag is documented
	flag := cmd.Flags().Lookup("in-flight-checksums")
	if flag == nil {
		t.Fatal("in-flight-checksums flag not found")
	}

	expectedUsage := "Enable checksumming of cache artifacts to prevent TOCTU attacks"
	if flag.Usage != expectedUsage {
		t.Errorf("expected flag usage to be %q, got %q", expectedUsage, flag.Usage)
	}

	// Verify it's a boolean flag
	if flag.Value.Type() != "bool" {
		t.Errorf("expected flag type to be bool, got %s", flag.Value.Type())
	}

	// Verify default value
	if flag.DefValue != "false" {
		t.Errorf("expected default value to be false, got %s", flag.DefValue)
	}
}

func TestGetBuildOptsWithInFlightChecksums(t *testing.T) {
	tests := []struct {
		name                    string
		inFlightChecksumsFlag   bool
		expectInFlightChecksums bool
	}{
		{
			name:                    "in-flight checksums disabled",
			inFlightChecksumsFlag:   false,
			expectInFlightChecksums: false,
		},
		{
			name:                    "in-flight checksums enabled",
			inFlightChecksumsFlag:   true,
			expectInFlightChecksums: true,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			cmd := &cobra.Command{
				Use: "build",
				Run: func(cmd *cobra.Command, args []string) {
					// No-op for testing
				},
			}

			addBuildFlags(cmd)

			// Set the flag value
			err := cmd.Flags().Set("in-flight-checksums", "false")
			if tt.inFlightChecksumsFlag {
				err = cmd.Flags().Set("in-flight-checksums", "true")
			}
			if err != nil {
				t.Fatalf("failed to set flag: %v", err)
			}

			// Test getBuildOpts function
			opts, localCache := getBuildOpts(cmd)

			// We can't directly test the WithInFlightChecksums option since it's internal,
			// but we can verify the function doesn't error and returns options
			if opts == nil {
				t.Error("expected build options but got nil")
			}
			if localCache == nil {
				t.Error("expected local cache but got nil")
			}

			// The actual verification of the in-flight checksums option would need
			// to be done through integration tests or by exposing the option state
		})
	}
}

func TestParseSLSAConfig(t *testing.T) {
	tests := []struct {
		name                   string
		envVerification        string
		envSourceURI           string
		envRequireAttestation  string
		flagVerification       *bool
		flagSourceURI          *string
		flagRequireAttestation *bool
		wantConfig             bool
		wantRequireAttestation bool
		wantError              bool
	}{
		{
			name:       "verification disabled",
			wantConfig: false,
		},
		{
			name:            "verification enabled via env, no source URI",
			envVerification: "true",
			wantError:       true,
		},
		{
			name:            "verification enabled via env with source URI",
			envVerification: "true",
			envSourceURI:    "https://github.com/gitpod-io/leeway",
			wantConfig:      true,
		},
		{
			name:                   "require attestation via env",
			envVerification:        "true",
			envSourceURI:           "https://github.com/gitpod-io/leeway",
			envRequireAttestation:  "true",
			wantConfig:             true,
			wantRequireAttestation: true,
		},
		{
			name:                   "require attestation via flag overrides env",
			envVerification:        "true",
			envSourceURI:           "https://github.com/gitpod-io/leeway",
			envRequireAttestation:  "false",
			flagRequireAttestation: boolPtr(true),
			wantConfig:             true,
			wantRequireAttestation: true,
		},
		{
			name:                   "flag disables require attestation",
			envVerification:        "true",
			envSourceURI:           "https://github.com/gitpod-io/leeway",
			envRequireAttestation:  "true",
			flagRequireAttestation: boolPtr(false),
			wantConfig:             true,
			wantRequireAttestation: false,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			// Set environment variables
			if tt.envVerification != "" {
				t.Setenv(EnvvarSLSACacheVerification, tt.envVerification)
			}
			if tt.envSourceURI != "" {
				t.Setenv(EnvvarSLSASourceURI, tt.envSourceURI)
			}
			if tt.envRequireAttestation != "" {
				t.Setenv(EnvvarSLSARequireAttestation, tt.envRequireAttestation)
			}

			// Create test command
			cmd := &cobra.Command{
				Use: "build",
				Run: func(cmd *cobra.Command, args []string) {},
			}
			addBuildFlags(cmd)

			// Set flags if specified
			if tt.flagVerification != nil {
				if err := cmd.Flags().Set("slsa-cache-verification", boolToString(*tt.flagVerification)); err != nil {
					t.Fatalf("failed to set verification flag: %v", err)
				}
			}
			if tt.flagSourceURI != nil {
				if err := cmd.Flags().Set("slsa-source-uri", *tt.flagSourceURI); err != nil {
					t.Fatalf("failed to set source URI flag: %v", err)
				}
			}
			if tt.flagRequireAttestation != nil {
				if err := cmd.Flags().Set("slsa-require-attestation", boolToString(*tt.flagRequireAttestation)); err != nil {
					t.Fatalf("failed to set require attestation flag: %v", err)
				}
			}

			// Test parseSLSAConfig
			config, err := parseSLSAConfig(cmd)

			if tt.wantError {
				if err == nil {
					t.Error("expected error but got none")
				}
				return
			}

			if err != nil {
				t.Fatalf("unexpected error: %v", err)
			}

			if tt.wantConfig {
				if config == nil {
					t.Fatal("expected config but got nil")
				}
				if config.RequireAttestation != tt.wantRequireAttestation {
					t.Errorf("expected RequireAttestation=%v, got %v", tt.wantRequireAttestation, config.RequireAttestation)
				}
			} else {
				if config != nil {
					t.Errorf("expected nil config but got %+v", config)
				}
			}
		})
	}
}

func boolPtr(b bool) *bool {
	return &b
}

func boolToString(b bool) string {
	if b {
		return "true"
	}
	return "false"
}