OwnCord/Server/service/message_test.go

package service

import (
	"context"
	"errors"
	"strings"
	"testing"

	"github.com/owncord/server/db"
	"github.com/owncord/server/permissions"
	"github.com/owncord/server/store"
)

// newTestMessageService creates a MessageService with a MemStore pre-populated
// with one text channel, one user, and a member role that has basic permissions.
// The rate limiter is nil (disabled) to avoid flakiness in unit tests.
func newTestMessageService() (*MessageService, *store.MemStore) {
	ms := store.NewMemStore()
	ms.SeedRole(&db.Role{
		ID:          permissions.MemberRoleID,
		Name:        "member",
		Permissions: permissions.SendMessages | permissions.ReadMessages | permissions.AddReactions,
		Position:    1,
	})
	ms.SeedUserRole(1, permissions.MemberRoleID)
	ms.SeedUser(&db.User{ID: 1, Username: "alice", Status: "online"})
	ms.SeedChannel(&db.Channel{ID: 10, Name: "general", Type: "text"})

	checker := permissions.NewChecker(ms)
	permSvc := NewPermissionService(ms, checker)
	msgSvc := NewMessageService(ms, permSvc, nil)
	return msgSvc, ms
}

func TestSendMessage_Valid(t *testing.T) {
	svc, _ := newTestMessageService()

	result, err := svc.SendMessage(context.Background(), SendMessageParams{
		ChannelID: 10,
		UserID:    1,
		Username:  "alice",
		RoleName:  "member",
		Content:   "hello world",
	})
	if err != nil {
		t.Fatalf("unexpected error: %v", err)
	}
	if result.MessageID <= 0 {
		t.Fatal("expected positive message ID")
	}
	if result.Content != "hello world" {
		t.Fatalf("expected content %q, got %q", "hello world", result.Content)
	}
	if result.IsDM {
		t.Fatal("expected IsDM to be false for text channel")
	}
}

// TestCanPost_DMBlockEnforced locks the W2-7 property: the plugin-broadcast
// gate delegates to CanPost, so a blocked user is refused from posting into
// a DM — the old broadcast gate's DM branch skipped the block check entirely.
func TestCanPost_DMBlockEnforced(t *testing.T) {
	ms := store.NewMemStore()
	ms.SeedRole(&db.Role{
		ID: permissions.MemberRoleID, Name: "member",
		Permissions: permissions.SendMessages | permissions.ReadMessages, Position: 1,
	})
	ms.SeedUserRole(1, permissions.MemberRoleID)
	ms.SeedUserRole(2, permissions.MemberRoleID)
	ms.SeedUser(&db.User{ID: 1, Username: "alice"})
	ms.SeedUser(&db.User{ID: 2, Username: "bob"})
	ms.SeedChannel(&db.Channel{ID: 50, Name: "dm-1-2", Type: "dm"})
	ms.SeedDMParticipant(50, 1)
	ms.SeedDMParticipant(50, 2)
	checker := permissions.NewChecker(ms)
	svc := NewMessageService(ms, NewPermissionService(ms, checker), nil)

	if err := svc.CanPost(1, 50); err != nil {
		t.Fatalf("unblocked DM participant should be allowed: %v", err)
	}
	ms.SeedBlock(2, 1) // bob blocks alice
	if err := svc.CanPost(1, 50); !errors.Is(err, ErrBlocked) {
		t.Fatalf("blocked user must be refused: got %v", err)
	}
	if err := svc.CanPost(3, 50); !errors.Is(err, ErrForbidden) {
		t.Fatalf("non-participant must be refused: got %v", err)
	}
	if err := svc.CanPost(1, 999); !errors.Is(err, ErrNotFound) {
		t.Fatalf("missing channel must be NotFound: got %v", err)
	}
}

// TestCanPost_ChannelPermissionRequired: regular channels still require
// READ|SEND via the cached checker.
func TestCanPost_ChannelPermissionRequired(t *testing.T) {
	ms := store.NewMemStore()
	ms.SeedRole(&db.Role{
		ID: permissions.MemberRoleID, Name: "member",
		Permissions: permissions.ReadMessages, Position: 1, // no SendMessages
	})
	ms.SeedUserRole(1, permissions.MemberRoleID)
	ms.SeedUser(&db.User{ID: 1, Username: "alice"})
	ms.SeedChannel(&db.Channel{ID: 10, Name: "general", Type: "text"})
	checker := permissions.NewChecker(ms)
	svc := NewMessageService(ms, NewPermissionService(ms, checker), nil)

	if err := svc.CanPost(1, 10); !errors.Is(err, ErrForbidden) {
		t.Fatalf("missing SEND_MESSAGES must refuse: got %v", err)
	}
}

// TestCanPost_AnnouncementRequiresManageMessages: announcement channels are
// postable only by users with MANAGE_MESSAGES, even when they hold
// READ|SEND. A plain member is refused; a moderator with MANAGE_MESSAGES posts.
func TestCanPost_AnnouncementRequiresManageMessages(t *testing.T) {
	ms := store.NewMemStore()
	ms.SeedRole(&db.Role{
		ID: permissions.MemberRoleID, Name: "member",
		Permissions: permissions.ReadMessages | permissions.SendMessages, Position: 1,
	})
	ms.SeedRole(&db.Role{
		ID: permissions.ModeratorRoleID, Name: "moderator",
		Permissions: permissions.ReadMessages | permissions.SendMessages | permissions.ManageMessages, Position: 60,
	})
	ms.SeedUserRole(1, permissions.MemberRoleID)
	ms.SeedUserRole(2, permissions.ModeratorRoleID)
	ms.SeedUser(&db.User{ID: 1, Username: "alice"})
	ms.SeedUser(&db.User{ID: 2, Username: "mod"})
	ms.SeedChannel(&db.Channel{ID: 20, Name: "announcements", Type: "announcement"})
	checker := permissions.NewChecker(ms)
	svc := NewMessageService(ms, NewPermissionService(ms, checker), nil)

	// Member has READ|SEND but not MANAGE_MESSAGES → refused in an announcement channel.
	if err := svc.CanPost(1, 20); !errors.Is(err, ErrForbidden) {
		t.Fatalf("member without MANAGE_MESSAGES must be refused in announcement channel: got %v", err)
	}
	// Moderator with MANAGE_MESSAGES → allowed.
	if err := svc.CanPost(2, 20); err != nil {
		t.Fatalf("moderator with MANAGE_MESSAGES must post in announcement channel: got %v", err)
	}
}

// TestSendMessage_AttachmentOwnershipAtomic locks the W1-3 semantics: the
// link UPDATE itself enforces ownership, so a foreign, already-linked, or
// nonexistent attachment is skipped (never linked) while the message still
// sends — no check-then-link race, and retries cannot hard-fail.
func TestSendMessage_AttachmentOwnershipAtomic(t *testing.T) {
	ms := store.NewMemStore()
	ms.SeedRole(&db.Role{
		ID:          permissions.MemberRoleID,
		Name:        "member",
		Permissions: permissions.SendMessages | permissions.ReadMessages | permissions.AttachFiles,
		Position:    1,
	})
	ms.SeedUserRole(1, permissions.MemberRoleID)
	ms.SeedUserRole(2, permissions.MemberRoleID)
	ms.SeedUser(&db.User{ID: 1, Username: "alice", Status: "online"})
	ms.SeedUser(&db.User{ID: 2, Username: "mallory", Status: "online"})
	ms.SeedChannel(&db.Channel{ID: 10, Name: "general", Type: "text"})
	checker := permissions.NewChecker(ms)
	svc := NewMessageService(ms, NewPermissionService(ms, checker), nil)

	if err := ms.CreateAttachment("att-own", 1, "a.png", "s-a.png", "image/png", 10, nil, nil); err != nil {
		t.Fatal(err)
	}
	if err := ms.CreateAttachment("att-foreign", 2, "b.png", "s-b.png", "image/png", 10, nil, nil); err != nil {
		t.Fatal(err)
	}

	result, err := svc.SendMessage(context.Background(), SendMessageParams{
		ChannelID: 10, UserID: 1, Username: "alice", RoleName: "member",
		Content:       "with files",
		AttachmentIDs: []string{"att-own", "att-foreign", "att-missing"},
	})
	if err != nil {
		t.Fatalf("SendMessage: %v", err)
	}
	if result.MessageID <= 0 {
		t.Fatal("message should persist even when some attachments are skipped")
	}

	own, _ := ms.GetAttachmentByID("att-own")
	if own.MessageID == nil || *own.MessageID != result.MessageID {
		t.Error("sender's own attachment should be linked to the new message")
	}
	foreign, _ := ms.GetAttachmentByID("att-foreign")
	if foreign.MessageID != nil {
		t.Error("another user's attachment must never be linked (IDOR guard)")
	}

	// A retry naming the now-linked attachment must still send.
	retry, err := svc.SendMessage(context.Background(), SendMessageParams{
		ChannelID: 10, UserID: 1, Username: "alice", RoleName: "member",
		Content:       "retry",
		AttachmentIDs: []string{"att-own"},
	})
	if err != nil {
		t.Fatalf("retry with already-linked attachment should still send: %v", err)
	}
	if retry.MessageID <= 0 {
		t.Fatal("retry should persist a message")
	}
	own2, _ := ms.GetAttachmentByID("att-own")
	if own2.MessageID == nil || *own2.MessageID != result.MessageID {
		t.Error("already-linked attachment must stay linked to the original message")
	}
}

func TestSendMessage_EmptyContent(t *testing.T) {
	svc, _ := newTestMessageService()

	_, err := svc.SendMessage(context.Background(), SendMessageParams{
		ChannelID: 10,
		UserID:    1,
		Username:  "alice",
		RoleName:  "member",
		Content:   "",
	})
	if err == nil {
		t.Fatal("expected error for empty content")
	}
	if !errors.Is(err, ErrBadRequest) {
		t.Fatalf("expected ErrBadRequest, got: %v", err)
	}
}

func TestSendMessage_ExceedsMaxLength(t *testing.T) {
	svc, _ := newTestMessageService()

	// maxMessageLen is 4000 runes; create content that exceeds it.
	longContent := strings.Repeat("a", 4001)

	_, err := svc.SendMessage(context.Background(), SendMessageParams{
		ChannelID: 10,
		UserID:    1,
		Username:  "alice",
		RoleName:  "member",
		Content:   longContent,
	})
	if err == nil {
		t.Fatal("expected error for content exceeding max length")
	}
	if !errors.Is(err, ErrBadRequest) {
		t.Fatalf("expected ErrBadRequest, got: %v", err)
	}
}

func TestSendMessage_ChannelNotFound(t *testing.T) {
	svc, _ := newTestMessageService()

	_, err := svc.SendMessage(context.Background(), SendMessageParams{
		ChannelID: 999,
		UserID:    1,
		Username:  "alice",
		Content:   "hello",
	})
	if err == nil {
		t.Fatal("expected error for non-existent channel")
	}
	if !errors.Is(err, ErrNotFound) {
		t.Fatalf("expected ErrNotFound, got: %v", err)
	}
}

func TestSendMessage_InvalidChannelID(t *testing.T) {
	svc, _ := newTestMessageService()

	_, err := svc.SendMessage(context.Background(), SendMessageParams{
		ChannelID: 0,
		UserID:    1,
		Username:  "alice",
		Content:   "hello",
	})
	if err == nil {
		t.Fatal("expected error for zero channel ID")
	}
	if !errors.Is(err, ErrBadRequest) {
		t.Fatalf("expected ErrBadRequest, got: %v", err)
	}
}

func TestSendMessage_NoPermission(t *testing.T) {
	ms := store.NewMemStore()
	// Role with ReadMessages only (no SendMessages).
	ms.SeedRole(&db.Role{
		ID:          permissions.MemberRoleID,
		Name:        "member",
		Permissions: permissions.ReadMessages,
		Position:    1,
	})
	ms.SeedUserRole(1, permissions.MemberRoleID)
	ms.SeedUser(&db.User{ID: 1, Username: "alice"})
	ms.SeedChannel(&db.Channel{ID: 10, Name: "readonly", Type: "text"})

	checker := permissions.NewChecker(ms)
	permSvc := NewPermissionService(ms, checker)
	svc := NewMessageService(ms, permSvc, nil)

	_, err := svc.SendMessage(context.Background(), SendMessageParams{
		ChannelID: 10,
		UserID:    1,
		Username:  "alice",
		Content:   "hello",
	})
	if err == nil {
		t.Fatal("expected error for missing SendMessages permission")
	}
	if !errors.Is(err, ErrForbidden) {
		t.Fatalf("expected ErrForbidden, got: %v", err)
	}
}

func TestEditMessage_OwnerCanEdit(t *testing.T) {
	svc, _ := newTestMessageService()

	// Send a message first.
	result, err := svc.SendMessage(context.Background(), SendMessageParams{
		ChannelID: 10,
		UserID:    1,
		Username:  "alice",
		Content:   "original",
	})
	if err != nil {
		t.Fatalf("send: %v", err)
	}

	editResult, err := svc.EditMessage(1, result.MessageID, "edited content")
	if err != nil {
		t.Fatalf("edit: %v", err)
	}
	if editResult.Content != "edited content" {
		t.Fatalf("expected %q, got %q", "edited content", editResult.Content)
	}
	if editResult.EditedAt == "" {
		t.Fatal("expected non-empty EditedAt after edit")
	}
}

func TestEditMessage_NonOwnerFails(t *testing.T) {
	svc, ms := newTestMessageService()
	// Add a second user.
	ms.SeedUserRole(2, permissions.MemberRoleID)
	ms.SeedUser(&db.User{ID: 2, Username: "bob"})

	// User 1 sends a message.
	result, err := svc.SendMessage(context.Background(), SendMessageParams{
		ChannelID: 10,
		UserID:    1,
		Username:  "alice",
		Content:   "alice's message",
	})
	if err != nil {
		t.Fatalf("send: %v", err)
	}

	// User 2 tries to edit it.
	_, err = svc.EditMessage(2, result.MessageID, "hacked")
	if err == nil {
		t.Fatal("expected error when non-owner edits message")
	}
	if !errors.Is(err, ErrForbidden) {
		t.Fatalf("expected ErrForbidden, got: %v", err)
	}
}

func TestEditMessage_EmptyContentFails(t *testing.T) {
	svc, _ := newTestMessageService()

	result, err := svc.SendMessage(context.Background(), SendMessageParams{
		ChannelID: 10,
		UserID:    1,
		Username:  "alice",
		Content:   "original",
	})
	if err != nil {
		t.Fatalf("send: %v", err)
	}

	_, err = svc.EditMessage(1, result.MessageID, "")
	if err == nil {
		t.Fatal("expected error for empty edit content")
	}
	if !errors.Is(err, ErrBadRequest) {
		t.Fatalf("expected ErrBadRequest, got: %v", err)
	}
}

func TestDeleteMessage_OwnerCanDelete(t *testing.T) {
	svc, _ := newTestMessageService()

	result, err := svc.SendMessage(context.Background(), SendMessageParams{
		ChannelID: 10,
		UserID:    1,
		Username:  "alice",
		Content:   "delete me",
	})
	if err != nil {
		t.Fatalf("send: %v", err)
	}

	delResult, err := svc.DeleteMessage(1, result.MessageID)
	if err != nil {
		t.Fatalf("delete: %v", err)
	}
	if delResult.MessageID != result.MessageID {
		t.Fatalf("expected message ID %d, got %d", result.MessageID, delResult.MessageID)
	}
	if delResult.IsDM {
		t.Fatal("expected IsDM to be false")
	}
}

func TestDeleteMessage_NonOwnerWithoutModFails(t *testing.T) {
	svc, ms := newTestMessageService()
	ms.SeedUserRole(2, permissions.MemberRoleID)
	ms.SeedUser(&db.User{ID: 2, Username: "bob"})

	// User 1 sends.
	result, err := svc.SendMessage(context.Background(), SendMessageParams{
		ChannelID: 10,
		UserID:    1,
		Username:  "alice",
		Content:   "important message",
	})
	if err != nil {
		t.Fatalf("send: %v", err)
	}

	// User 2 (no ManageMessages) tries to delete user 1's message.
	_, err = svc.DeleteMessage(2, result.MessageID)
	if err == nil {
		t.Fatal("expected error when non-owner without mod perms deletes message")
	}
	if !errors.Is(err, ErrForbidden) {
		t.Fatalf("expected ErrForbidden, got: %v", err)
	}
}

func TestDeleteMessage_ModCanDeleteOthersMessage(t *testing.T) {
	ms := store.NewMemStore()
	// Mod role has ManageMessages + SendMessages + ReadMessages.
	modPerms := permissions.SendMessages | permissions.ReadMessages | permissions.ManageMessages
	ms.SeedRole(&db.Role{
		ID:          permissions.ModeratorRoleID,
		Name:        "moderator",
		Permissions: modPerms,
		Position:    10,
	})
	ms.SeedRole(&db.Role{
		ID:          permissions.MemberRoleID,
		Name:        "member",
		Permissions: permissions.SendMessages | permissions.ReadMessages,
		Position:    1,
	})
	ms.SeedUserRole(1, permissions.MemberRoleID)
	ms.SeedUserRole(2, permissions.ModeratorRoleID)
	ms.SeedUser(&db.User{ID: 1, Username: "alice"})
	ms.SeedUser(&db.User{ID: 2, Username: "mod_bob"})
	ms.SeedChannel(&db.Channel{ID: 10, Name: "general", Type: "text"})

	checker := permissions.NewChecker(ms)
	permSvc := NewPermissionService(ms, checker)
	svc := NewMessageService(ms, permSvc, nil)

	// User 1 sends a message.
	result, err := svc.SendMessage(context.Background(), SendMessageParams{
		ChannelID: 10,
		UserID:    1,
		Username:  "alice",
		Content:   "rule-breaking content",
	})
	if err != nil {
		t.Fatalf("send: %v", err)
	}

	// Mod (user 2) deletes it.
	delResult, err := svc.DeleteMessage(2, result.MessageID)
	if err != nil {
		t.Fatalf("mod delete: %v", err)
	}
	if !delResult.IsMod {
		t.Fatal("expected IsMod to be true for moderator deletion")
	}
}

func TestDeleteMessage_InvalidMessageID(t *testing.T) {
	svc, _ := newTestMessageService()

	_, err := svc.DeleteMessage(1, 0)
	if err == nil {
		t.Fatal("expected error for zero message ID")
	}
	if !errors.Is(err, ErrBadRequest) {
		t.Fatalf("expected ErrBadRequest, got: %v", err)
	}
}

func TestSendMessage_HTMLSanitized(t *testing.T) {
	svc, _ := newTestMessageService()

	result, err := svc.SendMessage(context.Background(), SendMessageParams{
		ChannelID: 10,
		UserID:    1,
		Username:  "alice",
		Content:   `<script>alert("xss")</script>hello`,
	})
	if err != nil {
		t.Fatalf("unexpected error: %v", err)
	}
	if strings.Contains(result.Content, "<script>") {
		t.Fatal("expected HTML to be stripped from content")
	}
	if !strings.Contains(result.Content, "hello") {
		t.Fatal("expected safe text to remain in content")
	}
}