package pluginstore import (	"context"	"errors"	"io"	"net/http"	"strconv"	"strings"	"sync"	"sync/atomic"	"testing"	"time") func githubTestHeaders(values map[string]string) http.Header {	headers := make(http.Header)	for name, value := range values {		headers.Set(name, value)	}	return headers} func TestGitHubRateLimitHeaders(t *testing.T) {	t.Parallel()	now := time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)	reset := strconv.FormatInt(now.Add(time.Hour).Unix(), 10)	tests := []struct {		name    string		status  int		headers map[string]string		body    string		wait    time.Duration	}{		{name: "primary forbidden", status: 403, headers: map[string]string{"X-RateLimit-Remaining": "0", "X-RateLimit-Reset": reset}, wait: time.Hour},		{name: "retry seconds", status: 429, headers: map[string]string{"Retry-After": "120"}, wait: 2 * time.Minute},		{name: "retry date", status: 429, headers: map[string]string{"Retry-After": now.Add(3 * time.Minute).Format(http.TimeFormat)}, wait: 3 * time.Minute},		{name: "reset wins", status: 403, headers: map[string]string{"Retry-After": "120", "X-RateLimit-Remaining": "0", "X-RateLimit-Reset": reset}, wait: time.Hour},		{name: "retry wins", status: 429, headers: map[string]string{"Retry-After": "7200", "X-RateLimit-Remaining": "0", "X-RateLimit-Reset": reset}, wait: 2 * time.Hour},		{name: "secondary message", status: 403, body: `{"message":"You have exceeded a secondary rate limit."}`, wait: time.Minute},		{name: "abuse message", status: 403, body: `{"message":"You have triggered an abuse detection mechanism."}`, wait: time.Minute},		{name: "retry forbidden", status: 403, headers: map[string]string{"Retry-After": "60"}, wait: time.Minute},		{name: "headerless too many requests", status: 429, wait: time.Minute},		{name: "invalid retry", status: 429, headers: map[string]string{"Retry-After": "invalid"}, wait: time.Minute},		{name: "overflow retry", status: 429, headers: map[string]string{"Retry-After": "9223372036854775807"}, wait: time.Minute},		{name: "negative retry", status: 429, headers: map[string]string{"Retry-After": "-10"}, wait: time.Minute},		{name: "past reset", status: 403, headers: map[string]string{"X-RateLimit-Remaining": "0", "X-RateLimit-Reset": "1"}, wait: time.Minute},		{name: "invalid reset", status: 403, headers: map[string]string{"X-RateLimit-Remaining": "0", "X-RateLimit-Reset": "invalid"}, wait: time.Minute},		{name: "permission denied", status: 403, body: `{"message":"Resource not accessible by integration"}`},		{name: "invalid body", status: 403, body: "forbidden"},		{name: "not found", status: 404},	}	for _, tt := range tests {		t.Run(tt.name, func(t *testing.T) {			t.Parallel()			limiter := &GitHubRateLimiter{nowFunc: func() time.Time { return now }}			errLimit := limiter.observe("quota", tt.status, githubTestHeaders(tt.headers), []byte(tt.body))			if tt.wait == 0 {				if errLimit != nil || limiter.check("quota") != nil {					t.Fatalf("non-rate-limit response started cooldown: %v", errLimit)				}				return			}			var rateLimit *RateLimitError			if !errors.As(errLimit, &rateLimit) || rateLimit.StatusCode != tt.status || !rateLimit.RetryAt.Equal(now.Add(tt.wait)) {				t.Fatalf("error=%v, want status=%d retry=%s", errLimit, tt.status, now.Add(tt.wait))			}			if errCheck := limiter.check("quota"); !errors.As(errCheck, &rateLimit) {				t.Fatalf("check=%v, want cooldown", errCheck)			}		})	}} func TestGitHubRateLimitKeyCanonicalHost(t *testing.T) {	t.Parallel()	want := githubRateLimitKey("https://api.github.com/repos/owner/repo", "", nil, false)	for _, requestURL := range []string{"https://api.github.com:443/repos/other/repo", "https://API.GITHUB.COM/releases"} {		if got := githubRateLimitKey(requestURL, "", nil, false); got != want || got == "" {			t.Fatalf("key for %s = %q, want %q", requestURL, got, want)		}	}	for _, requestURL := range []string{"https://api.github.com:444/repos/owner/repo", "http://api.github.com/", "https://api.github.com.example/", "https://raw.githubusercontent.com/"} {		if got := githubRateLimitKey(requestURL, "", nil, false); got != "" {			t.Fatalf("unrelated URL %s has GitHub quota key %q", requestURL, got)		}	}} func TestGitHubRateLimitPrunesInactiveIdentities(t *testing.T) {	t.Parallel()	now := time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)	limiter := &GitHubRateLimiter{nowFunc: func() time.Time { return now }}	_ = limiter.observe("old-token", 429, nil, nil)	_ = limiter.observe("active-token", 429, githubTestHeaders(map[string]string{"Retry-After": "7200"}), nil)	now = now.Add(time.Hour + time.Minute)	_ = limiter.check("new-token")	if _, exists := limiter.entries["old-token"]; exists {		t.Fatal("inactive credential cooldown was not pruned")	}	if errCheck := limiter.check("active-token"); errCheck == nil {		t.Fatal("active cooldown was pruned")	}} func TestGitHubRateLimitBackoffAndRecovery(t *testing.T) {	t.Parallel()	now := time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)	limiter := &GitHubRateLimiter{nowFunc: func() time.Time { return now }}	for _, delay := range []time.Duration{time.Minute, 2 * time.Minute, 4 * time.Minute, 8 * time.Minute, 16 * time.Minute, 32 * time.Minute, time.Hour, time.Hour} {		errLimit := limiter.observe("quota", 429, nil, nil)		var rateLimit *RateLimitError		if !errors.As(errLimit, &rateLimit) || !rateLimit.RetryAt.Equal(now.Add(delay)) {			t.Fatalf("backoff=%v, want %s", errLimit, delay)		}		for range 5 {			if limiter.check("quota") == nil {				t.Fatal("local check lost cooldown")			}		}		now = now.Add(delay)		if errCheck := limiter.check("quota"); errCheck != nil {			t.Fatalf("expired cooldown: %v", errCheck)		}	}	_ = limiter.observe("quota", 200, nil, nil)	var rateLimit *RateLimitError	if errLimit := limiter.observe("quota", 429, nil, nil); !errors.As(errLimit, &rateLimit) || !rateLimit.RetryAt.Equal(now.Add(time.Minute)) {		t.Fatalf("success did not reset backoff: %v", errLimit)	}} func TestGitHubRateLimitSuccessfulExhaustionAndLateResponses(t *testing.T) {	t.Parallel()	now := time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)	limiter := &GitHubRateLimiter{nowFunc: func() time.Time { return now }}	headers := githubTestHeaders(map[string]string{"X-RateLimit-Remaining": "0", "X-RateLimit-Reset": strconv.FormatInt(now.Add(time.Hour).Unix(), 10)})	if errObserve := limiter.observe("quota", 200, headers, nil); errObserve != nil {		t.Fatalf("final successful request failed: %v", errObserve)	}	_ = limiter.observe("quota", 200, nil, nil)	_ = limiter.observe("quota", 429, githubTestHeaders(map[string]string{"Retry-After": "60"}), nil)	var rateLimit *RateLimitError	if errCheck := limiter.check("quota"); !errors.As(errCheck, &rateLimit) || !rateLimit.RetryAt.Equal(now.Add(time.Hour)) {		t.Fatalf("late response shortened cooldown: %v", errCheck)	}} func TestGitHubCooldownSharedAcrossClientsRepositoriesAndAssets(t *testing.T) {	t.Parallel()	now := time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)	limiter := &GitHubRateLimiter{nowFunc: func() time.Time { return now }}	calls := 0	doer := pluginIdentityDoerFunc(func(*http.Request) (*http.Response, error) {		calls++		if calls == 1 {			return &http.Response{StatusCode: 429, Header: githubTestHeaders(map[string]string{"Retry-After": "60"}), Body: io.NopCloser(strings.NewReader("limited"))}, nil		}		return &http.Response{StatusCode: 200, Header: make(http.Header), Body: io.NopCloser(strings.NewReader(`{"tag_name":"v1.0.0"}`))}, nil	})	first := Client{HTTPClient: doer, RateLimiter: limiter}	second := Client{HTTPClient: doer, RateLimiter: limiter}	ctx := context.Background()	_, errFirst := first.FetchLatestRelease(ctx, Plugin{Repository: "https://github.com/owner/first"})	_, errSecond := second.FetchReleaseByTag(ctx, Plugin{Repository: "https://github.com/other/second"}, "v1.0.0")	_, errAsset := second.DownloadAsset(ctx, ReleaseAsset{APIURL: "https://api.github.com:443/repos/other/second/releases/assets/1"})	for _, errRequest := range []error{errFirst, errSecond, errAsset} {		var rateLimit *RateLimitError		if !errors.As(errRequest, &rateLimit) {			t.Fatalf("request error=%v, want rate limit", errRequest)		}	}	if calls != 1 {		t.Fatalf("calls=%d, want 1", calls)	}	if _, errRaw := second.get(ctx, DefaultRegistryURL, "application/json", RequestKindRegistry, 0); errRaw != nil {		t.Fatalf("API cooldown blocked raw registry: %v", errRaw)	}	now = now.Add(time.Minute)	if _, errRecovered := second.FetchLatestRelease(ctx, Plugin{Repository: "https://github.com/other/second"}); errRecovered != nil || calls != 3 {		t.Fatalf("recovery error=%v calls=%d", errRecovered, calls)	}} func TestGitHubCooldownSeparatesCredentialsAndNetworkScope(t *testing.T) {	t.Parallel()	limiter := &GitHubRateLimiter{}	calls := 0	client := Client{RateLimiter: limiter, HTTPClient: pluginIdentityDoerFunc(func(*http.Request) (*http.Response, error) {		calls++		return &http.Response{StatusCode: 429, Header: githubTestHeaders(map[string]string{"Retry-After": "3600"}), Body: io.NopCloser(strings.NewReader("limited"))}, nil	})}	plugin := Plugin{Repository: "https://github.com/owner/repo"}	for _, token := range []string{"", "token-a", "token-b", "token-a", ""} {		client.ResolvedAuth = nil		if token != "" {			client.ResolvedAuth = []ResolvedAuthConfig{{Match: "https://api.github.com/", Type: AuthTypeGitHubToken, Token: Secret(token)}}		}		_, _ = client.FetchLatestRelease(context.Background(), plugin)	}	if calls != 3 {		t.Fatalf("credential scopes made %d calls, want 3", calls)	}	client.NetworkScope = "other-egress"	_, _ = client.FetchLatestRelease(context.Background(), plugin)	if calls != 4 {		t.Fatalf("egress scopes made %d calls, want 4", calls)	}} func TestGitHubRateLimitAuthenticatedBodyIsNotExposed(t *testing.T) {	t.Parallel()	client := Client{		RateLimiter:  &GitHubRateLimiter{},		ResolvedAuth: []ResolvedAuthConfig{{Match: "https://api.github.com/", Type: AuthTypeGitHubToken, Token: Secret("secret-token")}},		HTTPClient: pluginIdentityDoerFunc(func(*http.Request) (*http.Response, error) {			return &http.Response{StatusCode: 403, Header: make(http.Header), Body: io.NopCloser(strings.NewReader(`{"message":"secondary rate limit: secret-token"}`))}, nil		}),	}	_, errRelease := client.FetchLatestRelease(context.Background(), Plugin{Repository: "https://github.com/owner/repo"})	var rateLimit *RateLimitError	if !errors.As(errRelease, &rateLimit) || strings.Contains(errRelease.Error(), "secret-token") {		t.Fatalf("unsafe or unclassified error: %v", errRelease)	}} func TestGitHubDefaultCooldownBlocksConcurrentNewClients(t *testing.T) {	t.Parallel()	var calls atomic.Int32	client := Client{NetworkScope: t.Name(), HTTPClient: pluginIdentityDoerFunc(func(*http.Request) (*http.Response, error) {		calls.Add(1)		return &http.Response{StatusCode: 429, Header: githubTestHeaders(map[string]string{"Retry-After": "3600"}), Body: io.NopCloser(strings.NewReader("limited"))}, nil	})}	key := githubRateLimitKey("https://api.github.com/", client.NetworkScope, nil, false)	t.Cleanup(func() {		defaultGitHubRateLimiter.mu.Lock()		delete(defaultGitHubRateLimiter.entries, key)		defaultGitHubRateLimiter.mu.Unlock()	})	_, _ = client.FetchLatestRelease(context.Background(), Plugin{Repository: "https://github.com/owner/first"})	var wg sync.WaitGroup	for range 20 {		wg.Go(func() {			copyClient := Client{NetworkScope: client.NetworkScope, HTTPClient: client.HTTPClient}			_, errRelease := copyClient.FetchLatestRelease(context.Background(), Plugin{Repository: "https://github.com/other/second"})			var rateLimit *RateLimitError			if !errors.As(errRelease, &rateLimit) {				t.Errorf("request error = %v", errRelease)			}		})	}	wg.Wait()	if calls.Load() != 1 {		t.Fatalf("calls=%d, want 1", calls.Load())	}} type githubHeaderOnlyBody struct {	reads  int	closed bool} func (body *githubHeaderOnlyBody) Read([]byte) (int, error) {	body.reads++	return 0, errors.New("body must not be read")} func (body *githubHeaderOnlyBody) Close() error {	body.closed = true	return nil} func TestGitHubHeaderCooldownClosesBodyWithoutReading(t *testing.T) {	t.Parallel()	body := &githubHeaderOnlyBody{}	client := Client{RateLimiter: &GitHubRateLimiter{}, HTTPClient: pluginIdentityDoerFunc(func(*http.Request) (*http.Response, error) {		return &http.Response{StatusCode: 429, Header: githubTestHeaders(map[string]string{"Retry-After": "60"}), Body: body}, nil	})}	_, errRelease := client.FetchLatestRelease(context.Background(), Plugin{Repository: "https://github.com/owner/repo"})	var rateLimit *RateLimitError	if !errors.As(errRelease, &rateLimit) || body.reads != 0 || !body.closed {		t.Fatalf("error=%v reads=%d closed=%v", errRelease, body.reads, body.closed)	}} func TestGitHubSuccessfulFinalRequestReturnsRelease(t *testing.T) {	t.Parallel()	calls := 0	client := Client{RateLimiter: &GitHubRateLimiter{}, HTTPClient: pluginIdentityDoerFunc(func(*http.Request) (*http.Response, error) {		calls++		return &http.Response{			StatusCode: 200,			Header:     githubTestHeaders(map[string]string{"X-RateLimit-Remaining": "0", "X-RateLimit-Reset": strconv.FormatInt(time.Now().Add(time.Hour).Unix(), 10)}),			Body:       io.NopCloser(strings.NewReader(`{"tag_name":"v1.0.0"}`)),		}, nil	})}	release, errRelease := client.FetchLatestRelease(context.Background(), Plugin{Repository: "https://github.com/owner/repo"})	if errRelease != nil || release.TagName != "v1.0.0" {		t.Fatalf("release=%#v error=%v", release, errRelease)	}	_, errNext := client.FetchLatestRelease(context.Background(), Plugin{Repository: "https://github.com/owner/other"})	var rateLimit *RateLimitError	if !errors.As(errNext, &rateLimit) || calls != 1 {		t.Fatalf("next error=%v calls=%d", errNext, calls)	}} func TestNonGitHubRateLimitDoesNotCoolGitHub(t *testing.T) {	t.Parallel()	calls := 0	client := Client{RateLimiter: &GitHubRateLimiter{}, HTTPClient: pluginIdentityDoerFunc(func(req *http.Request) (*http.Response, error) {		calls++		if req.URL.Host != "api.github.com" {			return &http.Response{StatusCode: 429, Header: githubTestHeaders(map[string]string{"Retry-After": "3600"}), Body: io.NopCloser(strings.NewReader("limited"))}, nil		}		return &http.Response{StatusCode: 200, Header: make(http.Header), Body: io.NopCloser(strings.NewReader(`{"tag_name":"v1.0.0"}`))}, nil	})}	_, errRegistry := client.FetchRegistry(context.Background())	var rateLimit *RateLimitError	if errRegistry == nil || errors.As(errRegistry, &rateLimit) {		t.Fatalf("non-API error=%v, want ordinary HTTP error", errRegistry)	}	_, errRelease := client.FetchLatestRelease(context.Background(), Plugin{Repository: "https://github.com/owner/repo"})	if errRelease != nil || calls != 2 {		t.Fatalf("release error=%v calls=%d", errRelease, calls)	}} func TestRateLimitRetryAfterRoundsUp(t *testing.T) {	t.Parallel()	now := time.Unix(100, 0)	for _, tt := range []struct {		delay time.Duration		want  int64	}{{-time.Second, 0}, {0, 0}, {time.Nanosecond, 1}, {time.Second, 1}, {time.Second + time.Nanosecond, 2}} {		errLimit := &RateLimitError{RetryAt: now.Add(tt.delay)}		if got := errLimit.RetryAfterSeconds(now); got != tt.want {			t.Fatalf("RetryAfterSeconds(%s)=%d, want %d", tt.delay, got, tt.want)		}	}}