nexarch/dms/internal/trigger/trigger_test.go

package trigger

import (
	"context"
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"

	"gitea.perlbach24.de/scripte/nexarch/dms/internal/documenttype"
	"gitea.perlbach24.de/scripte/nexarch/dms/internal/tag"
	"gitea.perlbach24.de/scripte/nexarch/dms/internal/testenv"
)

func sp(s string) *string { return &s }

// memVault ist ein Test-Vault ohne echten KEK-Server: es verpackt reversibel
// (Praefix statt Klartext-Passthrough), damit Tests einen echten Seal/Open-
// Roundtrip pruefen koennen, ohne einen KEK-Provider hochzufahren.
type memVault struct{}

func (memVault) Seal(_ context.Context, _, plaintext string) ([]byte, []byte, error) {
	return []byte("dek"), []byte("enc:" + plaintext), nil
}
func (memVault) Open(_ context.Context, _ string, _, ciphertext []byte) (string, error) {
	return strings.TrimPrefix(string(ciphertext), "enc:"), nil
}

func newEnv(t *testing.T) *testenv.Env {
	t.Helper()
	return testenv.New(t)
}

func TestCreate_ValidationRejectsIncompleteTriggers(t *testing.T) {
	e := newEnv(t)
	ctx := context.Background()
	cases := []struct {
		name string
		tr   Trigger
	}{
		{"kein name", Trigger{Event: EventUploaded, ActionType: ActionSetTag, ActionTagID: sp("00000000-0000-0000-0000-000000000001")}},
		{"unbekanntes ereignis", Trigger{Name: "x", Event: "document.deleted", ActionType: ActionSetTag, ActionTagID: sp("00000000-0000-0000-0000-000000000001")}},
		{"webhook ohne url", Trigger{Name: "x", Event: EventUploaded, ActionType: ActionWebhook}},
		{"set_tag ohne tag", Trigger{Name: "x", Event: EventUploaded, ActionType: ActionSetTag}},
		{"ungueltiges muster", Trigger{Name: "x", Event: EventUploaded, FilenamePattern: sp("(["), ActionType: ActionSetTag, ActionTagID: sp("00000000-0000-0000-0000-000000000001")}},
	}
	for _, c := range cases {
		t.Run(c.name, func(t *testing.T) {
			if _, err := Create(ctx, e.Pool, memVault{}, testenv.TenantSlug, "tester", c.tr, ""); err == nil {
				t.Fatalf("erwartet fehler fuer %q", c.name)
			}
		})
	}
}

func TestFire_FilenamePatternMatchAndNoMatch(t *testing.T) {
	e := newEnv(t)
	ctx := context.Background()
	tg, err := tag.Create(ctx, e.Pool, "auto", "", nil)
	if err != nil {
		t.Fatal(err)
	}
	if _, err := Create(ctx, e.Pool, memVault{}, testenv.TenantSlug, "tester", Trigger{
		Name: "Rechnung", Event: EventUploaded, FilenamePattern: sp(`(?i)rechnung`), ActionType: ActionSetTag, ActionTagID: sp(tg.ID),
	}, ""); err != nil {
		t.Fatal(err)
	}

	docMatch, _ := e.UploadDoc(t, "Rechnung-2026.pdf", "text/plain", []byte("inhalt rechnung"))
	if err := Fire(ctx, e.Pool, memVault{}, testenv.TenantSlug, EventUploaded, docMatch); err != nil {
		t.Fatal(err)
	}
	var n int
	_ = e.Pool.QueryRow(ctx, `SELECT count(*) FROM document_tags WHERE document_id = $1 AND tag_id = $2`, docMatch, tg.ID).Scan(&n)
	if n != 1 {
		t.Fatalf("tag nicht gesetzt bei passendem dateinamen, n=%d", n)
	}

	docNoMatch, _ := e.UploadDoc(t, "Kontoauszug.pdf", "text/plain", []byte("inhalt kontoauszug"))
	if err := Fire(ctx, e.Pool, memVault{}, testenv.TenantSlug, EventUploaded, docNoMatch); err != nil {
		t.Fatal(err)
	}
	n = 0
	_ = e.Pool.QueryRow(ctx, `SELECT count(*) FROM document_tags WHERE document_id = $1`, docNoMatch).Scan(&n)
	if n != 0 {
		t.Fatalf("tag faelschlich gesetzt bei nicht passendem dateinamen, n=%d", n)
	}

	var runs int
	_ = e.Pool.QueryRow(ctx, `SELECT count(*) FROM trigger_runs WHERE document_id = $1 AND status = 'ok'`, docMatch).Scan(&runs)
	if runs != 1 {
		t.Fatalf("erwartet 1 erfolgreichen lauf, habe %d", runs)
	}
}

func TestFire_SetTypeAction(t *testing.T) {
	e := newEnv(t)
	ctx := context.Background()
	typ, err := documenttype.Create(ctx, e.Pool, "Rechnung", nil, nil, nil)
	if err != nil {
		t.Fatal(err)
	}
	if _, err := Create(ctx, e.Pool, memVault{}, testenv.TenantSlug, "tester", Trigger{
		Name: "SetzeTyp", Event: EventUploaded, ActionType: ActionSetType, ActionDocumentTypeID: sp(typ.ID),
	}, ""); err != nil {
		t.Fatal(err)
	}
	doc, _ := e.UploadDoc(t, "beleg.txt", "text/plain", []byte("inhalt"))
	if err := Fire(ctx, e.Pool, memVault{}, testenv.TenantSlug, EventUploaded, doc); err != nil {
		t.Fatal(err)
	}
	var typeID string
	_ = e.Pool.QueryRow(ctx, `SELECT document_type_id::text FROM documents WHERE id = $1`, doc).Scan(&typeID)
	if typeID != typ.ID {
		t.Fatalf("dokumententyp nicht gesetzt: %q", typeID)
	}
}

func TestFire_WebhookSendsSignedPayload(t *testing.T) {
	e := newEnv(t)
	ctx := context.Background()
	received := make(chan webhookPayload, 1)
	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		sig := r.Header.Get("X-Trigger-Signature")
		if sig == "" {
			t.Error("erwartet signatur-header")
		}
		var p webhookPayload
		_ = json.NewDecoder(r.Body).Decode(&p)
		received <- p
		w.WriteHeader(http.StatusOK)
	}))
	defer srv.Close()
	t.Setenv("NEXARCH_DMS_APP_TRIGGER_WEBHOOK_ALLOW_PRIVATE", "true")

	url := srv.URL
	if _, err := Create(ctx, e.Pool, memVault{}, testenv.TenantSlug, "tester", Trigger{
		Name: "Hook", Event: EventUploaded, ActionType: ActionWebhook, WebhookURL: &url,
	}, "geheim"); err != nil {
		t.Fatal(err)
	}
	doc, _ := e.UploadDoc(t, "beleg.txt", "text/plain", []byte("inhalt"))
	if err := Fire(ctx, e.Pool, memVault{}, testenv.TenantSlug, EventUploaded, doc); err != nil {
		t.Fatal(err)
	}
	select {
	case p := <-received:
		if p.DocumentID != doc || p.Event != EventUploaded {
			t.Fatalf("unerwartete nutzlast: %+v", p)
		}
	default:
		t.Fatal("webhook wurde nicht aufgerufen")
	}
}

func TestFire_WebhookFailureDoesNotBlockFireOrOtherTriggers(t *testing.T) {
	e := newEnv(t)
	ctx := context.Background()
	t.Setenv("NEXARCH_DMS_APP_TRIGGER_WEBHOOK_ALLOW_PRIVATE", "true") // erlaubt das ziel bei der ANLAGE; der Verbindungsfehler entsteht erst beim Senden.
	tg, err := tag.Create(ctx, e.Pool, "trotzdem", "", nil)
	if err != nil {
		t.Fatal(err)
	}
	badURL := "http://127.0.0.1:1" // verbindungsfehler garantiert
	if _, err := Create(ctx, e.Pool, memVault{}, testenv.TenantSlug, "tester", Trigger{
		Name: "KaputterHook", Event: EventUploaded, ActionType: ActionWebhook, WebhookURL: &badURL,
	}, ""); err != nil {
		t.Fatal(err)
	}
	if _, err := Create(ctx, e.Pool, memVault{}, testenv.TenantSlug, "tester", Trigger{
		Name: "FunktionierendesTag", Event: EventUploaded, ActionType: ActionSetTag, ActionTagID: sp(tg.ID),
	}, ""); err != nil {
		t.Fatal(err)
	}
	doc, _ := e.UploadDoc(t, "beleg.txt", "text/plain", []byte("inhalt"))
	// Fire selbst darf trotz fehlschlagendem Webhook keinen Fehler liefern
	// (Trigger-Fehler blockiert die Verarbeitung des Dokuments nicht).
	if err := Fire(ctx, e.Pool, memVault{}, testenv.TenantSlug, EventUploaded, doc); err != nil {
		t.Fatalf("Fire darf nicht fehlschlagen: %v", err)
	}
	var n int
	_ = e.Pool.QueryRow(ctx, `SELECT count(*) FROM document_tags WHERE document_id = $1 AND tag_id = $2`, doc, tg.ID).Scan(&n)
	if n != 1 {
		t.Fatal("der andere trigger haette trotzdem feuern muessen")
	}
	var failed int
	_ = e.Pool.QueryRow(ctx, `SELECT count(*) FROM trigger_runs WHERE document_id = $1 AND status = 'failed'`, doc).Scan(&failed)
	if failed != 1 {
		t.Fatalf("erwartet 1 fehlgeschlagenen lauf protokolliert, habe %d", failed)
	}
}

func TestValidateWebhookURL_RejectsPrivateAndLoopbackTargets(t *testing.T) {
	cases := []string{
		"http://127.0.0.1:8080/hook",
		"http://localhost/hook",
		"http://10.0.0.5/hook",
		"http://169.254.169.254/latest/meta-data",
		"http://192.168.1.1/hook",
		"ftp://example.test/hook",
		"not-a-url",
	}
	for _, c := range cases {
		t.Run(c, func(t *testing.T) {
			if err := ValidateWebhookURL(c); err == nil {
				t.Fatalf("erwartet ablehnung fuer %q", c)
			}
		})
	}
}

func TestValidateWebhookURL_AcceptsPublicHTTPS(t *testing.T) {
	if err := ValidateWebhookURL("https://example.test/hook"); err != nil {
		t.Fatalf("oeffentliches ziel sollte erlaubt sein: %v", err)
	}
}

func TestValidateWebhookURL_AllowPrivateOverride(t *testing.T) {
	t.Setenv("NEXARCH_DMS_APP_TRIGGER_WEBHOOK_ALLOW_PRIVATE", "true")
	if err := ValidateWebhookURL("http://127.0.0.1:9999/hook"); err != nil {
		t.Fatalf("mit freigabe sollte loopback erlaubt sein: %v", err)
	}
}

func TestFire_DisabledTriggerDoesNotFire(t *testing.T) {
	e := newEnv(t)
	ctx := context.Background()
	tg, err := tag.Create(ctx, e.Pool, "sollte-nicht", "", nil)
	if err != nil {
		t.Fatal(err)
	}
	out, err := Create(ctx, e.Pool, memVault{}, testenv.TenantSlug, "tester", Trigger{
		Name: "Deaktiviert", Event: EventUploaded, ActionType: ActionSetTag, ActionTagID: sp(tg.ID),
	}, "")
	if err != nil {
		t.Fatal(err)
	}
	if err := SetEnabled(ctx, e.Pool, "tester", out.ID, false); err != nil {
		t.Fatal(err)
	}
	doc, _ := e.UploadDoc(t, "beleg.txt", "text/plain", []byte("inhalt"))
	if err := Fire(ctx, e.Pool, memVault{}, testenv.TenantSlug, EventUploaded, doc); err != nil {
		t.Fatal(err)
	}
	var n int
	_ = e.Pool.QueryRow(ctx, `SELECT count(*) FROM document_tags WHERE document_id = $1`, doc).Scan(&n)
	if n != 0 {
		t.Fatal("deaktivierter trigger hat trotzdem gefeuert")
	}
}

func TestDelete_UnknownReturnsErrNotFound(t *testing.T) {
	e := newEnv(t)
	ctx := context.Background()
	if err := Delete(ctx, e.Pool, "tester", "00000000-0000-0000-0000-000000000001"); err == nil || !strings.Contains(err.Error(), "nicht gefunden") {
		t.Fatalf("erwartet ErrNotFound, habe %v", err)
	}
}