# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
# frozen_string_literal: true

cs__scoped_require 'contrast/utils/assess/tracking_util'
cs__scoped_require 'contrast/utils/class_util'
cs__scoped_require 'contrast/utils/duck_utils'
cs__scoped_require 'contrast/utils/object_share'
cs__scoped_require 'contrast/utils/prevent_serialization'
cs__scoped_require 'contrast/utils/stack_trace_utils'
cs__scoped_require 'contrast/utils/string_utils'
cs__scoped_require 'contrast/utils/timer'

module Contrast
  module Agent
    module Assess
      # This class holds the data about an event in the application
      # We'll use it to build an event that TeamServer can consume if
      # the object to which this event belongs ends in a trigger.
      class ContrastEvent
        include Contrast::Utils::PreventSerialization

        class << self
          def safe_args_representation args
            return nil unless args
            return Contrast::Utils::ObjectShare::EMPTY_ARRAY if args.empty?

            rep = []
            args.each do |arg|
              # We have to handle named args
              rep <<  if arg.is_a?(Hash)
                        safe_arg_hash_representation(arg)
                      else
                        Contrast::Utils::ClassUtil.to_contrast_string(arg)
                      end
            end
            rep
          end

          def safe_arg_hash_representation hash
            # since this is the named hash for arguments, only the value is
            # suspect here
            hash.transform_values { |v| Contrast::Utils::ClassUtil.to_contrast_string(v) }
          end

          # if given an object that can be duped, duplicate it. otherwise just
          # return the original object. swallow all exceptions from
          # non-duplicable things.
          #
          # we can't just check respond_to? though b/c dup exists on the
          # base Object class
          def safe_dup original
            return nil unless original

            begin
              original.dup
            rescue StandardError
              original
            end
          end
        end

        attr_reader :event_id, :parent_ids, :policy_node, :stack_trace, :time, :thread, :object, :ret, :args

        # We need this to track the parent id's of events to build up a flow
        # chart of the finding
        @atomic_id = 0
        @atomic_mutex = Mutex.new
        def self.next_atomic_id
          @atomic_mutex.synchronize do
            @atomic_id += 1
            # Rollover things
          rescue StandardError
            @atomic_id = 1
          end
        end

        def initialize policy_node, tagged, object, ret, args
          @policy_node = policy_node
          # so long as this event is built in a factory, we know Contrast Code
          # will be the first three events
          @stack_trace = caller(3, 20)
          @time = Contrast::Utils::Timer.now_ms
          @thread = Thread.current.object_id

          # These methods rely on the above being set. Don't move them!
          @event_id = Contrast::Agent::Assess::ContrastEvent.next_atomic_id
          @parent_ids = find_parent_ids(policy_node, object, ret, args)
          snapshot(tagged, object, ret, args)
        end

        # Parent IDs are the event ids of all the sources of this event which
        # were tracked prior to this event occurring
        def find_parent_ids policy_node, object, ret, args
          mapped = policy_node.sources.map do |source|
            value_of_source(source, object, ret, args)
          end
          selected = mapped.select do |source|
            source &&
                Contrast::Utils::DuckUtils.quacks_to?(source, :cs__properties) &&
                source.cs__properties.events &&
                source.cs__properties.events.last
          end
          selected.map do |source|
            source.cs__properties.events.last.event_id
          end
        end

        def snapshot tagged, object, ret, args
          target = @policy_node.target
          case target
            # If the target is nil, this rule was violated simply by a method
            # being called. We'll save all the information, but nothing will be
            # marked up, as nothing need be tracked
          when nil
            @object = Contrast::Utils::ClassUtil.to_contrast_string(object)
            @args = cs__class.safe_args_representation(args)
            @ret = Contrast::Utils::ClassUtil.to_contrast_string(ret)
            # If the target is O, then we dup the O and safely represent the rest
          when Contrast::Utils::ObjectShare::OBJECT_KEY
            @object = cs__class.safe_dup(tagged)
            @args = cs__class.safe_args_representation(args)
            @ret = Contrast::Utils::ClassUtil.to_contrast_string(ret)
            # If the target is R, then we dup the R and safely represent the rest
          when Contrast::Utils::ObjectShare::RETURN_KEY
            @object = Contrast::Utils::ClassUtil.to_contrast_string(object)
            @args = cs__class.safe_args_representation(args)
            @ret = cs__class.safe_dup(tagged)
            # If the target is P*, then we need to dup things a differently. We
            # need to find the true target inside so that we can mark it up
            # later, but the other args should be represented as their safe form.
          else
            @object = Contrast::Utils::ClassUtil.to_contrast_string(object)
            @args = cs__class.safe_args_representation(args)
            @ret = Contrast::Utils::ClassUtil.to_contrast_string(ret)
            save_target_arg(target, tagged)
          end
        end

        # I know we're creating an extra string here since we replace the safe
        # one w/ a dup, but good enough for now. Trying not to make this too
        # complicated. - HM 8/8/19
        def save_target_arg target, tagged
          return if @args.cs__frozen?

          if target.is_a?(Integer)
            @args[target] = cs__class.safe_dup(tagged)
            return
          end

          @args.each_with_index do |search, index|
            next unless search.is_a?(Hash)
            next unless search[target]

            search[target] = cs__class.safe_dup(tagged)
            @highlight = index
            break
          end
        end

        # We have to do a little work to figure out what our TS appropriate
        # target is. To break this down, the logic is as follows:
        # 1) If my policy_node has a target, work on targets. Else, work on sources.
        #    Per TS law, each policy_node must have at least a source or a target.
        #    The only type of policy_node w/o targets is a Trigger, but that may
        #    change.
        # 2) If I have a highlight, it means that I have a P target that is
        #    not in integer form (it was a named / keyword type for which I had
        #    to find the index). I need to address this so that TS can process
        #    it.
        # 3) I'll set the event's source and target to TS values.
        # 4) Return the highlight or the first source/target as the taint
        #    target.
        def determine_taint_target event_dtm
          if @policy_node&.targets&.any?
            event_dtm.source = @policy_node.source_string if @policy_node.source_string
            event_dtm.target = @highlight ? "P#{ @highlight }" : @policy_node.target_string
            @highlight || @policy_node.targets[0]
          elsif policy_node&.sources&.any?
            event_dtm.source = @highlight ? "P#{ @highlight }" : @policy_node.source_string
            event_dtm.target = @policy_node.target_string if @policy_node.target_string
            @highlight || @policy_node.sources[0]
          end
        end

        def value_of_source source, object, ret, args
          case source
          when Contrast::Utils::ObjectShare::OBJECT_KEY
            object
          when Contrast::Utils::ObjectShare::RETURN_KEY
            ret
          else
            if source.is_a?(Integer)
              args[source]
            else
              args.each do |search|
                next unless search.is_a?(Hash)

                s = search[source]
                return s if s
              end
            end
          end
        end

        # Convert this event into a DTM that TeamServer can consume
        def to_dtm_event
          Contrast::Api::Dtm::TraceEvent.build(self)
        end
      end
    end
  end
end