<?php
// This file is part of Moodle - http://moodle.org/
//
// Moodle is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// Moodle is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.

namespace tool_mfa;

/**
 * Tests for base factor implementation methods.
 *
 * @package     tool_mfa
 * @author      Peter Burnett <peterburnett@catalyst-au.net>
 * @copyright   2023 Catalyst IT
 * @license     http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
 */
final class object_factor_base_test extends \advanced_testcase {

    use \tool_mfa\tests\mfa_settings_trait;

    /**
     * Test deleting user's configured factors
     *
     * @covers ::setup_user_factor
     * @return void
     */
    public function test_revoke_user_factor(): void {
        $this->resetAfterTest();
        $user = $this->getDataGenerator()->create_user();
        $this->setUser($user);

        $this->set_factor_state('totp', 1, 100);
        $totpfactor = \tool_mfa\plugininfo\factor::get_factor('totp');
        $totpdata = [
            'secret' => 'fakekey',
            'devicename' => 'fakedevice',
        ];
        $factorinstance = $totpfactor->setup_user_factor((object) $totpdata);
        $totpdata2 = [
            'secret' => 'fakekey2',
            'devicename' => 'fakedevice2',
        ];
        $totpfactor->setup_user_factor((object) $totpdata2);

        $this->assertFalse((bool) $factorinstance->revoked);
        $this->assertEquals(2, count($totpfactor->get_active_user_factors($user)));

        // Test that calling the revoke on the generic type revokes all.
        $totpfactor->revoke_user_factor();
        $this->assertEquals(0, count($totpfactor->get_active_user_factors($user)));

        // Add another factor for testing.
        $totpdata3 = [
            'secret' => 'fakekey3',
            'devicename' => 'fakedevice3',
        ];
        $factorinstance2 = $totpfactor->setup_user_factor((object) $totpdata3);

        // Now test you can't revoke another users factor.
        $user2 = $this->getDataGenerator()->create_user();
        $this->setUser($user2);

        $this->assertFalse($totpfactor->revoke_user_factor($factorinstance2->id));
        $this->assertEquals(1, count($totpfactor->get_active_user_factors($user)));

        // Now revoke as ourselves.
        $this->setUser($user);
        $this->assertTrue($totpfactor->revoke_user_factor($factorinstance2->id));
        $this->assertEquals(0, count($totpfactor->get_active_user_factors($user)));
    }

    /**
     * Tests the replacement of a factor.
     *
     * @covers ::setup_user_factor
     * @covers ::replace_user_factor
     */
    public function test_replace_user_factor(): void {
        $this->resetAfterTest();
        $user = $this->getDataGenerator()->create_user();
        $this->setUser($user);

        $factor = \tool_mfa\plugininfo\factor::get_factor('totp');

        // Set up the factor.
        $data1 = new \stdClass();
        $data1->secret = 'fakesecret1';
        $data1->devicename = 'fakedevice1';
        $factor1 = $factor->setup_user_factor($data1);

        // Prepare some replacement data.
        $data2 = new \stdClass();
        $data2->secret = 'fakesecret2';
        $data2->devicename = 'fakedevice2';

        // Replace the active factor with the replacement data.
        $factor2 = $factor->replace_user_factor($data2, $factor1->id);

        // Check the active factor is the newer one.
        $activefactors = $factor->get_active_user_factors($user);
        $this->assertEquals(1, count($activefactors));
        $this->assertEquals($factor2->id, $activefactors[0]->id);
    }

    /**
     * Tests that the lock counter does not exceed the lockout threshold.
     *
     * @covers ::increment_lock_counter
     * @covers ::get_remaining_attempts
     * @return void
     */
    public function test_increment_lock_counter_does_not_exceed_threshold(): void {
        $this->resetAfterTest();
        $user = $this->getDataGenerator()->create_user();
        $this->setUser($user);

        $this->set_factor_state('totp', 1, 100);

        $lockoutthreshold = 3;
        set_config('lockout', $lockoutthreshold, 'tool_mfa');

        $totpfactor = \tool_mfa\plugininfo\factor::get_factor('totp');
        $totpfactor->setup_user_factor((object) ['secret' => 'fakekey', 'devicename' => 'fakedevice']);

        // Reach the lockout threshold.
        $factor = \tool_mfa\plugininfo\factor::get_factor('totp');
        for ($i = 0; $i < $lockoutthreshold; $i++) {
            $factor->increment_lock_counter();
        }

        $this->assertEquals(0, $factor->get_remaining_attempts());
        $this->assertEquals(\tool_mfa\plugininfo\factor::STATE_LOCKED, $factor->get_state());

        // Simulate a page refresh, remaining attempts must not go negative.
        $refreshedfactor = \tool_mfa\plugininfo\factor::get_factor('totp');
        $refreshedfactor->increment_lock_counter();

        $this->assertEquals(0, $refreshedfactor->get_remaining_attempts());
        $this->assertEquals(\tool_mfa\plugininfo\factor::STATE_LOCKED, $refreshedfactor->get_state());
    }
}
