name: Testing TPS

on: workflow_call

env:
  NAMESPACE: ${{ vars.REGISTRY_NAMESPACE || 'dogtagpki' }}
  DS_IMAGE: ${{ vars.DS_IMAGE || 'quay.io/389ds/dirsrv' }}

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    env:
      SHARED: /tmp/workdir/pki
    steps:
      - name: Clone repository
        uses: actions/checkout@v4

      - name: Retrieve JSS images
        uses: actions/cache@v4
        with:
          key: jss-images-${{ github.sha }}
          path: jss-images.tar

      - name: Load JSS images
        run: docker load --input jss-images.tar

      - name: Create network
        run: docker network create example

      - name: Set up DS container
        run: |
          tests/bin/ds-create.sh \
              --image=${{ env.DS_IMAGE }} \
              --hostname=ds.example.com \
              --password=Secret.123 \
              --network=example \
              --network-alias=ds.example.com \
              ds

      - name: Set up PKI container
        run: |
          tests/bin/runner-init.sh \
              --hostname=pki.example.com \
              --network=example \
              --network-alias=pki.example.com \
              pki

      - name: Import LDAP SDK packages
        run: |
          docker create --name=ldapjdk-dist quay.io/$NAMESPACE/ldapjdk-dist:5.6
          docker cp ldapjdk-dist:/root/RPMS/. /tmp/RPMS/
          docker rm -f ldapjdk-dist

      - name: Import PKI packages
        run: |
          docker create --name=pki-dist quay.io/$NAMESPACE/pki-dist:11.9
          docker cp pki-dist:/root/RPMS/. /tmp/RPMS/
          docker rm -f pki-dist

      - name: Install packages
        run: |
          docker cp /tmp/RPMS/. pki:/root/RPMS/
          docker exec pki bash -c "dnf install -y /root/RPMS/*"

      - name: Install CA
        run: |
          docker exec pki pkispawn \
              -f /usr/share/pki/server/examples/installation/ca.cfg \
              -s CA \
              -D pki_ds_url=ldap://ds.example.com:3389 \
              -v

      - name: Update PKI server configuration
        run: |
          docker exec pki dnf install -y xmlstarlet

          # disable access log buffer to avoid logging delay
          docker exec pki xmlstarlet edit --inplace \
              -u "//Valve[@className='org.apache.catalina.valves.AccessLogValve']/@buffered" \
              -v "false" \
              -i "//Valve[@className='org.apache.catalina.valves.AccessLogValve' and not(@buffered)]" \
              -t attr \
              -n "buffered" \
              -v "false" \
              /etc/pki/pki-tomcat/server.xml

          # restart PKI server
          docker exec pki pki-server restart --wait

      - name: Install TKS
        run: |
          docker exec pki pkispawn \
              -f /usr/share/pki/server/examples/installation/tks.cfg \
              -s TKS \
              -D pki_ds_url=ldap://ds.example.com:3389 \
              -v

      - name: Install TPS
        run: |
          docker exec pki pkispawn \
              -f /usr/share/pki/server/examples/installation/tps.cfg \
              -s TPS \
              -D pki_ds_url=ldap://ds.example.com:3389 \
              -D pki_authdb_url=ldap://ds.example.com:3389 \
              -v

      - name: Check TPS admin
        run: |
          docker exec pki pki-server cert-export ca_signing --cert-file ca_signing.crt

          docker exec pki pki nss-cert-import \
              --cert ca_signing.crt \
              --trust CT,C,C \
              ca_signing

          docker exec pki pki pkcs12-import \
              --pkcs12 /root/.dogtag/pki-tomcat/ca_admin_cert.p12 \
              --pkcs12-password Secret.123

          docker exec pki pki -n caadmin tps-user-show tpsadmin

      - name: Update TPS configuration
        run: |
          # import sample TPS users
          docker exec pki ldapadd \
              -H ldap://ds.example.com:3389 \
              -D "cn=Directory Manager" \
              -w Secret.123 \
              -f /usr/share/pki/tps/auth/ds/create.ldif
          docker exec pki ldapadd \
              -H ldap://ds.example.com:3389 \
              -D "cn=Directory Manager" \
              -w Secret.123 \
              -f /usr/share/pki/tps/auth/ds/example.ldif

          # configure TPS to use the sample TPS users
          docker exec pki pki-server tps-config-set \
              auths.instance.ldap1.ldap.basedn \
              ou=people,dc=example,dc=com

          # allow token enrollment
          # https://github.com/dogtagpki/pki/commit/847ddbc9e146603d11e917609411fde03e301778
          docker exec pki pki-server tps-config-set \
              channel.scp01.no.le.byte true

          # restart TPS subsystem
          docker exec pki pki-server tps-redeploy --wait

      - name: Add token
        run: |
          hexdump -v -n "10" -e '1/1 "%02x"' /dev/urandom > cuid
          CUID=$(cat cuid)
          docker exec pki pki -n caadmin tps-token-add $CUID | tee output

          echo "UNFORMATTED" > expected
          sed -n 's/\s*Status:\s\+\(\S\+\)\s*/\1/p' output > actual
          diff expected actual

          docker exec pki pki -n caadmin tps-cert-find --token $CUID

      - name: Format token
        run: |
          CUID=$(cat cuid)
          docker exec pki /usr/share/pki/tps/bin/pki-tps-format \
              --user=testuser \
              --password=Secret.123 \
              $CUID

          echo "FORMATTED" > expected
          docker exec pki pki -n caadmin tps-token-show $CUID | tee output
          sed -n 's/\s*Status:\s\+\(\S\+\)\s*/\1/p' output > actual
          diff expected actual

          docker exec pki pki -n caadmin tps-cert-find --token $CUID

      - name: Enroll token
        run: |
          CUID=$(cat cuid)
          docker exec pki /usr/share/pki/tps/bin/pki-tps-enroll \
              --user=testuser \
              --password=Secret.123 \
              $CUID

          echo "ACTIVE" > expected
          docker exec pki pki -n caadmin tps-token-show $CUID | tee output
          sed -n 's/\s*Status:\s\+\(\S\+\)\s*/\1/p' output > actual
          diff expected actual

          docker exec pki pki -n caadmin tps-cert-find --token $CUID

      - name: Remove TPS
        run: docker exec pki pkidestroy -i pki-tomcat -s TPS -v

      - name: Remove TKS
        run: docker exec pki pkidestroy -i pki-tomcat -s TKS -v

      - name: Remove CA
        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v

      - name: Check DS server systemd journal
        if: always()
        run: |
          docker exec ds journalctl -x --no-pager -u dirsrv@localhost.service

      - name: Check DS container logs
        if: always()
        run: |
          docker logs ds

      - name: Check PKI server systemd journal
        if: always()
        run: |
          docker exec pki journalctl -x --no-pager -u pki-tomcatd@pki-tomcat.service

      - name: Check PKI server access log
        if: always()
        run: |
          docker exec pki find /var/log/pki/pki-tomcat -name "localhost_access_log.*" -exec cat {} \;

      - name: Check CA debug log
        if: always()
        run: |
          docker exec pki find /var/lib/pki/pki-tomcat/logs/ca -name "debug.*" -exec cat {} \;

      - name: Check TKS debug log
        if: always()
        run: |
          docker exec pki find /var/lib/pki/pki-tomcat/logs/tks -name "debug.*" -exec cat {} \;

      - name: Check TPS debug log
        if: always()
        run: |
          docker exec pki find /var/lib/pki/pki-tomcat/logs/tps -name "debug.*" -exec cat {} \;
