package agentfiles_test

import (

"bytes"

"encoding/json"

"net/http"

"net/http/httptest"

"os"

"path/filepath"

"slices"

"strings"

"testing"

"github.com/spf13/afero"

"github.com/stretchr/testify/require"

"cdr.dev/slog/v3"

"cdr.dev/slog/v3/sloggers/slogtest"

"github.com/coder/coder/v2/agent/agentfiles"

"github.com/coder/coder/v2/agent/usershell"

"github.com/coder/coder/v2/codersdk"

"github.com/coder/coder/v2/codersdk/workspacesdk"

"github.com/coder/coder/v2/testutil"

)

func TestBundleFilesCollectsExpandedPathsAndGlobs(t *testing.T) {

t.Parallel()

home := testutil.TempDirResolved(t)

writeBundleSourceFile(t, home, ".vscode-server/data/logs/20260706T101112/remoteagent.log", "remote agent")

writeBundleSourceFile(t, home, ".vscode-server/data/logs/20260706T101112/exthost1/exthost.log", "exthost")

writeBundleSourceFile(t, home, ".vscode-server/data/logs/20260706T101112/exthost1/output.txt", "skip")

writeBundleSourceFile(t, home, ".local/share/code-server/coder-logs/app.log", "code server log")

writeBundleSourceFile(t, home, ".cache/JetBrains/RemoteDev/dist/241.15989.150/log/idea.log", "idea log")

writeBundleSourceFile(t, home, "brace/one.log", "one")

writeBundleSourceFile(t, home, "brace/two.txt", "two")

writeBundleSourceFile(t, home, "brace/skip.json", "skip")

entries := readBundleFilesArchive(t, requestBundleFiles(t, newBundleFilesHandler(t, home), []string{

filepath.Join(home, ".vscode-server/data/logs/20260706T101112/remoteagent.log"),

"~/.vscode-server/data/logs/**/*.log",

"~/.local/share/code-server/coder-logs/app.log",

"~/.cache/JetBrains/RemoteDev/dist/*/log/idea.log",

"~/brace/*.{log,txt}",

}))

requireBundleEntry(t, entries, home, ".vscode-server/data/logs/20260706T101112/remoteagent.log", "remote agent")

requireBundleEntry(t, entries, home, ".vscode-server/data/logs/20260706T101112/exthost1/exthost.log", "exthost")

requireBundleEntry(t, entries, home, ".local/share/code-server/coder-logs/app.log", "code server log")

requireBundleEntry(t, entries, home, ".cache/JetBrains/RemoteDev/dist/241.15989.150/log/idea.log", "idea log")

requireBundleEntry(t, entries, home, "brace/one.log", "one")

requireBundleEntry(t, entries, home, "brace/two.txt", "two")

require.NotContains(t, entries.files, bundleArchivePath(t, home, ".vscode-server/data/logs/20260706T101112/exthost1/output.txt"))

require.NotContains(t, entries.files, bundleArchivePath(t, home, "brace/skip.json"))

require.Empty(t, entries.manifest.Errors)

// remoteagent.log matches both the absolute path and the ** glob; it

// must be archived once.

require.Len(t, entries.manifest.Files, 6)

}

func TestBundleFilesCollectsAbsolutePathsOutsideHome(t *testing.T) {

t.Parallel()

home := testutil.TempDirResolved(t)

outside := testutil.TempDirResolved(t)

writeBundleSourceFile(t, outside, "service.log", "outside log")

writeBundleSourceFile(t, outside, "glob/a.log", "glob a")

entries := readBundleFilesArchive(t, requestBundleFiles(t, newBundleFilesHandler(t, home), []string{

filepath.Join(outside, "service.log"),

filepath.Join(outside, "glob", "*.log"),

}))

requireBundleEntry(t, entries, outside, "service.log", "outside log")

requireBundleEntry(t, entries, outside, "glob/a.log", "glob a")

require.Empty(t, entries.manifest.Errors)

require.Len(t, entries.manifest.Files, 2)

}

func TestBundleFilesRejectedPathsAreNonFatal(t *testing.T) {

t.Parallel()

home := testutil.TempDirResolved(t)

writeBundleSourceFile(t, home, "kept.log", "kept")

require.NoError(t, os.MkdirAll(filepath.Join(home, "somedir"), 0o700))

entries := readBundleFilesArchive(t, requestBundleFiles(t, newBundleFilesHandler(t, home), []string{

"~/kept.log",

"relative.log",

"~/missing.log",

"~/somedir",

"~/no-matches/**/*.log",

}))

requireBundleEntry(t, entries, home, "kept.log", "kept")

require.Len(t, entries.manifest.Files, 1)

requireBundleFilesManifestErrors(t, entries.manifest.Errors,

"is not absolute",

"does not exist",

"not a regular file: directory",

"no matches",

)

}

func TestBundleFilesTailBytesTruncation(t *testing.T) {

t.Parallel()

home := testutil.TempDirResolved(t)

writeBundleSourceFile(t, home, "large.log", "0123456789")

entries := readBundleFilesArchive(t, requestBundleFiles(t, newBundleFilesHandler(t, home, agentfiles.WithBundleFilesLimits(workspacesdk.BundleFilesLimits{

MaxFiles: 10,

MaxBytesPerFile: 4,

MaxTotalBytes: 100 * 1024,

})), []string{"~/large.log"}))

requireBundleEntry(t, entries, home, "large.log", "6789")

require.Len(t, entries.manifest.Files, 1)

require.True(t, entries.manifest.Files[0].Truncated)

require.Equal(t, int64(10), entries.manifest.Files[0].Size)

require.Equal(t, int64(4), entries.manifest.Files[0].BytesWritten)

}

func TestBundleFilesFileAndByteLimits(t *testing.T) {

t.Parallel()

home := testutil.TempDirResolved(t)

writeBundleSourceFile(t, home, "one.log", "1111")

writeBundleSourceFile(t, home, "two.log", "2222")

writeBundleSourceFile(t, home, "three.log", "3333")

entries := readBundleFilesArchive(t, requestBundleFiles(t, newBundleFilesHandler(t, home, agentfiles.WithBundleFilesLimits(workspacesdk.BundleFilesLimits{

MaxFiles: 1,

MaxBytesPerFile: 100,

// One 512-byte tar header plus 3 data bytes: the first file is

// truncated to 3 bytes by the total budget.

MaxTotalBytes: 515,

})), []string{"~/*.log"}))

require.Len(t, entries.files, 1)

require.True(t, entries.manifest.Truncated)

require.Equal(t, int64(3), entries.manifest.Files[0].BytesWritten)

// The glob walk itself stops at the file cap.

requireBundleFilesManifestErrors(t, entries.manifest.Errors, "file count limit reached")

}

func TestBundleFilesDedupeByCleanedPath(t *testing.T) {

t.Parallel()

home := testutil.TempDirResolved(t)

writeBundleSourceFile(t, home, "dup.log", "one")

writeBundleSourceFile(t, home, "other.log", "two")

entries := readBundleFilesArchive(t, requestBundleFiles(t, newBundleFilesHandler(t, home), []string{

"~/dup.log",

"~/./dup.log",

filepath.Join(home, "somedir", "..", "dup.log"),

"~/other.log",

}))

requireBundleEntry(t, entries, home, "dup.log", "one")

requireBundleEntry(t, entries, home, "other.log", "two")

require.Len(t, entries.manifest.Files, 2)

}

// TestBundleFilesRequestBodyLimit pins the 64 KiB cap on the request body and

// the limit named in the rejection. The handler decodes an attacker-supplied

// path list, so the cap is what stops one request from buffering unbounded

// memory in the agent.

func TestBundleFilesRequestBodyLimit(t *testing.T) {

t.Parallel()

// One path long enough to push the encoded request past the cap.

body, err := json.Marshal(workspacesdk.BundleFilesRequest{

Paths: []string{"~/" + strings.Repeat("a", 64*1024)},

})

require.NoError(t, err)

req := httptest.NewRequest(http.MethodPost, "/bundle-files", bytes.NewReader(body))

res := httptest.NewRecorder()

newBundleFilesHandler(t, testutil.TempDirResolved(t)).ServeHTTP(res, req)

require.Equal(t, http.StatusRequestEntityTooLarge, res.Code)

var resp codersdk.Response

require.NoError(t, json.NewDecoder(res.Body).Decode(&resp))

require.Contains(t, resp.Detail, "65536")

}

// fakeBundleEnvInfo overrides the home directory so tests can point path

// expansion at a temp dir.

type fakeBundleEnvInfo struct {

usershell.SystemEnvInfo

home string

}

func (e fakeBundleEnvInfo) HomeDir() (string, error) {

return e.home, nil

}

func newBundleFilesHandler(t *testing.T, home string, opts ...agentfiles.Option) http.Handler {

t.Helper()

logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Leveled(slog.LevelDebug)

opts = append([]agentfiles.Option{agentfiles.WithEnvInfo(fakeBundleEnvInfo{home: home})}, opts...)

return agentfiles.NewAPI(logger, afero.NewOsFs(), nil, opts...).Routes()

}

func requestBundleFiles(t *testing.T, handler http.Handler, paths []string) []byte {

t.Helper()

body, err := json.Marshal(workspacesdk.BundleFilesRequest{Paths: paths})

require.NoError(t, err)

req := httptest.NewRequest(http.MethodPost, "/bundle-files", bytes.NewReader(body))

res := httptest.NewRecorder()

handler.ServeHTTP(res, req)

require.Equal(t, http.StatusOK, res.Code)

require.Equal(t, "application/x-tar", res.Header().Get("Content-Type"))

return res.Body.Bytes()

}

func writeBundleSourceFile(t *testing.T, dir string, rel string, content string) {

t.Helper()

path := filepath.Join(dir, filepath.FromSlash(rel))

require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o700))

require.NoError(t, os.WriteFile(path, []byte(content), 0o600))

}

// bundleArchivePath returns the expected archive entry name for the file

// at dir/rel.

func bundleArchivePath(t *testing.T, dir string, rel string) string {

t.Helper()

return agentfiles.BundleFilesArchivePath(filepath.Join(dir, filepath.FromSlash(rel)))

}

func requireBundleEntry(t *testing.T, entries bundleFilesArchive, dir string, rel string, content string) {

t.Helper()

require.Equal(t, content, string(entries.files[bundleArchivePath(t, dir, rel)]))

}

type bundleFilesArchive struct {

manifest workspacesdk.BundleFilesManifest

files map[string][]byte

}

func readBundleFilesArchive(t *testing.T, data []byte) bundleFilesArchive {

t.Helper()

entries := bundleFilesArchive{files: testutil.ReadTar(t, data)}

manifestJSON, ok := entries.files["manifest.json"]

require.True(t, ok, "archive should contain manifest.json")

delete(entries.files, "manifest.json")

require.NoError(t, json.Unmarshal(manifestJSON, &entries.manifest))

require.NotEmpty(t, entries.manifest.Requested)

return entries

}

func requireBundleFilesManifestErrors(t *testing.T, errs []workspacesdk.BundleFilesManifestError, contains ...string) {

t.Helper()

for _, want := range contains {

found := slices.ContainsFunc(errs, func(e workspacesdk.BundleFilesManifestError) bool {

return strings.Contains(e.Reason, want)

})

require.Truef(t, found, "expected manifest error containing %q in %#v", want, errs)

}

}