smallwebwaf/internal/state/state_test.go

package state_test

import (
	"context"
	"encoding/json"
	"io/fs"
	"log/slog"
	"maps"
	"net"
	"net/http"
	"net/http/httptest"
	"net/netip"
	"net/url"
	"os"
	"path/filepath"
	"reflect"
	"slices"
	"strconv"
	"strings"
	"testing"
	"testing/synctest"
	"time"

	"sneak.berlin/go/smallwebwaf/internal/alerts"
	"sneak.berlin/go/smallwebwaf/internal/anomaly"
	"sneak.berlin/go/smallwebwaf/internal/bans"
	"sneak.berlin/go/smallwebwaf/internal/lookup"
	"sneak.berlin/go/smallwebwaf/internal/metrics"
	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
	"sneak.berlin/go/smallwebwaf/internal/reputation"
	"sneak.berlin/go/smallwebwaf/internal/state"
)

const (
	// The state files.
	bansJSON       = "bans.json"
	clientsJSON    = "clients.json"
	lookupsJSON    = "lookups.json"
	reputationJSON = "reputation.json"
	alertsJSON     = "alerts.json"
	// blocklistURL and torURL are the blocklists the tests' lists name, and
	// dnsblZone the DNSBL zone of the tests' verdicts.
	blocklistURL = "https://lists.example/drop.txt"
	torURL       = "https://lists.example/tor.txt"
	dnsblZone    = "dnsbl.example"
	// The AS number and AS name the tests' clients are looked up in.
	asn    = "AS64496"
	asName = "Example Net"
	// What the process log says once Watch watches the directory, and as
	// it takes in an edit.
	watching = "watching the state files for edits"
	tookIn   = "took in an edit of a state file"
	// maxLogLines is how many lines of the process log wait for a test to
	// read them.
	maxLogLines = 64
	// whole is the percentage of each limit a client gets when nothing
	// lowers its limits.
	whole = 100
)

// permanentBansJSON is bans.json holding permanentBan.
const permanentBansJSON = `{
    "version": 1,
    "bans": [
        {
            "netblock": "2001:db8::/64",
            "start": "2026-10-06T00:00:00Z",
            "expires": null,
            "cause": "admin",
            "reason": "scrapes every commit",
            "notes": {
                "asn": "AS64496",
                "as_name": "Example Net",
                "country": "DE",
                "limit": 1000,
                "window": "minute",
                "count": 1000.5,
                "request": {
                    "time": "2026-10-06T00:00:00Z",
                    "method": "GET",
                    "host": "app.example",
                    "path": "/repo?page=2",
                    "status": 403,
                    "user_agent": "scraper/1.0"
                },
                "requests": 1500,
                "refused": 3,
                "earlier_bans": {
                    "limit": 3,
                    "attack": 1,
                    "admin": 1
                }
            }
        }
    ]
}
`

// liftedClient is the client whose ban liftedBansJSON holds.
const liftedClient = "203.0.113.9"

// liftedBansJSON is bans.json holding an hour's ban for a broken limit on
// liftedClient, from midnight, that an admin lifted ten minutes in.
const liftedBansJSON = `{"version": 1, "bans": [{"netblock": "203.0.113.9/32", ` +
	`"start": "2026-10-06T00:00:00Z", "expires": "2026-10-06T01:00:00Z", ` +
	`"cause": "limit", "lifted": "2026-10-06T00:10:00Z"}]}`

// filledAlertsJSON is alerts.json holding the alerts of fill.
const filledAlertsJSON = `{
    "version": 1,
    "cooldowns": [
        {
            "event": "file_error",
            "netblock": "",
            "file": "/var/lib/smallwebwaf/bans.json",
            "sent": "2026-10-06T00:00:00Z",
            "suppressed_repeats": 0
        },
        {
            "event": "ban",
            "netblock": "203.0.113.9/32",
            "sent": "2026-10-06T00:00:00Z",
            "suppressed_repeats": 1
        }
    ],
    "hour": {
        "start": "2026-10-06T00:00:00Z",
        "sent": 2,
        "held_back": {
            "source_failure": 1
        }
    },
    "waiting": {
        "webhook": [
            {
                "instance": "fsn1app1/gitea",
                "time": "2026-10-06T00:00:00Z",
                "event": "ban",
                "client": "203.0.113.9",
                "netblock": "203.0.113.9/32",
                "asn": "",
                "as_name": "",
                "country": "DE",
                "reason": "requests per minute over the limit of 1",
                "detail": {
                    "cause": "limit"
                },
                "suppressed_repeats": 0
            },
            {
                "instance": "fsn1app1/gitea",
                "time": "2026-10-06T00:00:00Z",
                "event": "file_error",
                "client": "",
                "netblock": "",
                "asn": "",
                "as_name": "",
                "country": "",
                "reason": "writing the state files failed",
                "detail": {
                    "error": "no space left on device",
                    "file": "/var/lib/smallwebwaf/bans.json"
                },
                "suppressed_repeats": 0
            }
        ]
    },
    "anomaly_counters": [
        {
            "scope": "asn",
            "asn": "AS64496",
            "hour_bytes": {
                "start": "2026-10-06T00:00:00Z",
                "current": 8,
                "previous": 0
            }
        },
        {
            "scope": "net",
            "netblock": "203.0.113.0/24",
            "minute": {
                "start": "2026-10-06T00:00:00Z",
                "current": 1,
                "previous": 0
            }
        },
        {
            "scope": "total",
            "minute": {
                "start": "2026-10-06T00:00:00Z",
                "current": 1,
                "previous": 0
            },
            "minute_bytes": {
                "start": "2026-10-06T00:00:00Z",
                "current": 8,
                "previous": 0
            }
        },
        {
            "scope": "watch",
            "netblock": "203.0.113.0/24",
            "name": "office",
            "hour": {
                "start": "2026-10-06T00:00:00Z",
                "current": 1,
                "previous": 0
            }
        }
    ]
}
`

// filledReputationJSON is reputation.json holding the blocklists' last
// tries and the copy of one, with its comment line, two verdicts of a
// DNSBL zone, and the AbuseIPDB checks spent today with two scores, as
// fill puts them in.
const filledReputationJSON = `{
    "version": 1,
    "lists": [
        {
            "url": "https://lists.example/drop.txt",
            "tried": "2026-10-06T00:00:00Z",
            "fetched": "2026-10-05T23:00:00Z",
            "lines": [
                "; Spamhaus DROP List 2026/10/05 - (c) 2026 The Spamhaus Project SLL",
                "203.0.113.0/24 ; SBL1",
                "2001:db8::/32 ; SBL2"
            ]
        },
        {
            "url": "https://lists.example/tor.txt",
            "tried": "2026-10-06T00:00:00Z"
        }
    ],
    "verdicts": [
        {
            "zone": "dnsbl.example",
            "client": "203.0.113.9",
            "listed": true,
            "fetched": "2026-10-05T23:00:00Z"
        },
        {
            "zone": "dnsbl.example",
            "client": "2001:db8::1",
            "listed": false,
            "fetched": "2026-10-05T22:00:00Z"
        }
    ],
    "abuseipdb": {
        "day": "2026-10-06T00:00:00Z",
        "spent": 3,
        "scores": [
            {
                "client": "203.0.113.9/32",
                "score": 100,
                "fetched": "2026-10-05T23:00:00Z"
            },
            {
                "client": "2001:db8::/64",
                "score": 0,
                "fetched": "2026-10-05T22:00:00Z"
            }
        ]
    }
}
`

func TestFilesWrittenAndReadBack(t *testing.T) {
	t.Parallel()

	dir := t.TempDir()
	before := newParams(dir)
	fill(before)

	files, err := state.Load(before)
	if err != nil {
		t.Fatalf("load: %v", err)
	}

	err = files.WriteAll()
	if err != nil {
		t.Fatalf("write: %v", err)
	}

	// Read into new parts, as at the next start, the files give back what
	// was written.
	after := newParams(dir)
	load(t, after)

	wantEqual(t, bansJSON, after.Ledger.Snapshot(), before.Ledger.Snapshot())
	wantEqual(t, clientsJSON, after.Limiter.Snapshot(), before.Limiter.Snapshot())
	wantEqual(t, lookupsJSON, after.GeoJS.Snapshot(), before.GeoJS.Snapshot())

	if got, want := after.Lists.Snapshot(), before.Lists.Snapshot(); !reflect.DeepEqual(
		got, want) {
		t.Errorf("%s read back\n%+v\nwant\n%+v", reputationJSON, got, want)
	}

	wantEqual(t, reputationJSON, after.DNSBL.Snapshot(), before.DNSBL.Snapshot())

	checks, wantChecks := after.AbuseIPDB.Snapshot(), before.AbuseIPDB.Snapshot()
	if !reflect.DeepEqual(checks, wantChecks) {
		t.Errorf("%s read back\n%+v\nwant\n%+v", reputationJSON, checks, wantChecks)
	}

	if got, want := after.Alerts.Snapshot(), before.Alerts.Snapshot(); !reflect.DeepEqual(
		got, want) {
		t.Errorf("%s read back\n%+v\nwant\n%+v", alertsJSON, got, want)
	}

	wantEqual(t, alertsJSON, after.Anomalies.Snapshot(), before.Anomalies.Snapshot())

	// Each one-per-line file lists its entries by client, and nothing
	// but the five files is left in the directory.
	wantEntries(t, filepath.Join(dir, clientsJSON), "clients",
		"192.0.2.1/32", "203.0.113.9/32", "2001:db8::/64")
	wantEntries(t, filepath.Join(dir, lookupsJSON), "lookups",
		"192.0.2.1/32", "203.0.113.9/32")
	wantFiles(t, dir, alertsJSON, bansJSON, clientsJSON, lookupsJSON, reputationJSON)
}

func TestReputationJSONKeepsEachCopyWholeOneLineToALine(t *testing.T) {
	t.Parallel()

	dir := t.TempDir()
	params := newParams(dir)
	fill(params)

	files := load(t, params)

	err := files.WriteAll()
	if err != nil {
		t.Fatalf("write: %v", err)
	}

	got := readFile(t, filepath.Join(dir, reputationJSON))
	if got != filledReputationJSON {
		t.Errorf("reputation.json\n%s\nwant\n%s", got, filledReputationJSON)
	}
}

func TestAlertsJSONIsIndentedWithTheCooldownsTheHourAndTheAlertsWaiting(t *testing.T) {
	t.Parallel()

	dir := t.TempDir()
	params := newParams(dir)
	fill(params)

	files := load(t, params)

	err := files.WriteAll()
	if err != nil {
		t.Fatalf("write: %v", err)
	}

	got := readFile(t, filepath.Join(dir, alertsJSON))
	if got != filledAlertsJSON {
		t.Errorf("alerts.json\n%s\nwant\n%s", got, filledAlertsJSON)
	}
}

func TestSourceFailureCooldownKeptInAlertsJSONAcrossARestart(t *testing.T) {
	t.Parallel()

	dir := t.TempDir()
	before := newParams(dir)
	files := load(t, before)

	failure := alerts.Alert{
		Event: alerts.EventSourceFailure, Reason: "asking GeoJS failed",
		Detail: map[string]any{"source": "geojs"},
	}
	before.Alerts.Raise(failure)

	err := files.WriteAll()
	if err != nil {
		t.Fatalf("write: %v", err)
	}

	// After the restart, the cooldown read back holds back a repeat for the
	// same source.
	after := newParams(dir)
	load(t, after)
	after.Alerts.Raise(failure)

	waiting := after.Alerts.Snapshot().Waiting[alerts.DestinationWebhook]
	if len(waiting) != 1 || after.Alerts.Suppressed() != 1 {
		t.Errorf("%d alerts wait and %d are held back, want the one read back and 1",
			len(waiting), after.Alerts.Suppressed())
	}
}

func TestAnomalyCountersKeptInAlertsJSONAcrossARestart(t *testing.T) {
	t.Parallel()

	dir := t.TempDir()
	request := anomaly.Request{
		Client:      netip.MustParseAddr("203.0.113.9"),
		ClientGroup: netip.MustParsePrefix("203.0.113.9/32"),
	}

	// The whole service may have two requests a minute.
	withThreshold := func() state.Params {
		params := newParams(dir)
		params.Anomalies = anomaly.New(anomaly.Params{
			Total: anomaly.Thresholds{RequestsPerMinute: 2}, Alerts: params.Alerts,
		})

		return params
	}

	before := withThreshold()
	files := load(t, before)

	for range 2 {
		before.Anomalies.Count(midnight(), request)
	}

	err := files.WriteAll()
	if err != nil {
		t.Fatalf("write: %v", err)
	}

	// After the restart, the third request in the minute is over it.
	after := withThreshold()
	load(t, after)
	after.Anomalies.Count(midnight(), request)

	waiting := after.Alerts.Snapshot().Waiting[alerts.DestinationWebhook]
	if len(waiting) != 1 || waiting[0].Event != alerts.EventAnomaly ||
		waiting[0].Detail["count"] != float64(3) {
		t.Errorf("alerts wait %+v, want one for 3 requests", waiting)
	}
}

func TestBansJSONIsIndentedWithNullForAPermanentBan(t *testing.T) {
	t.Parallel()

	dir := t.TempDir()
	params := newParams(dir)
	params.Ledger.Load([]bans.Ban{permanentBan()})

	files := load(t, params)

	err := files.WriteAll()
	if err != nil {
		t.Fatalf("write: %v", err)
	}

	got := readFile(t, filepath.Join(dir, bansJSON))
	if got != permanentBansJSON {
		t.Errorf("bans.json\n%s\nwant\n%s", got, permanentBansJSON)
	}
}

func TestMissingFilesAreEmptyState(t *testing.T) {
	t.Parallel()

	params := newParams(t.TempDir())
	load(t, params)

	held := params.Alerts.Snapshot()
	checks := params.AbuseIPDB.Snapshot()

	if len(params.Ledger.Snapshot()) != 0 || len(params.Limiter.Snapshot()) != 0 ||
		len(params.GeoJS.Snapshot()) != 0 || len(params.Lists.Snapshot()) != 0 ||
		len(params.DNSBL.Snapshot()) != 0 || len(checks.Scores) != 0 || checks.Spent != 0 ||
		len(held.Cooldowns) != 0 || len(held.Waiting[alerts.DestinationWebhook]) != 0 ||
		held.Hour.Sent != 0 {
		t.Error("state from no files")
	}
}

func TestFileThatDoesNotParseStopsTheStart(t *testing.T) {
	t.Parallel()

	for _, tc := range []struct {
		name, file, content string
		// want is what the error says after the file's path.
		want string
	}{
		{
			"a syntax error", bansJSON,
			"{\n    \"version\": 1,\n    \"bans\": [\n" +
				"        {\"netblock\": \"203.0.113.9/32\",}\n    ]\n}\n",
			", line 4, column 39: invalid character '}'",
		},
		{
			"a value of the wrong kind", clientsJSON,
			"{\n    \"version\": 1,\n    \"clients\": [\n" +
				"        {\"client\":\"203.0.113.9/32\",\"history\":{\"requests\":\"many\"}}\n" +
				"    ]\n}\n",
			", line 4, column ",
		},
		{
			// Found at the newline that ends the file.
			"a cut-off file", lookupsJSON,
			"{\n    \"version\": 1,\n    \"lookups\": [\n",
			", line 3, column 17: unexpected end of JSON input",
		},
		{
			"an unknown field", lookupsJSON,
			`{"version": 1, "lookups": [{"client": "203.0.113.9/32", "contry": "DE"}]}`,
			`: json: unknown field "contry"`,
		},
		{
			"a netblock that does not read", bansJSON,
			`{"version": 1, "bans": [{"netblock": "203.0.113.300/32"}]}`,
			`: netip.ParsePrefix("203.0.113.300/32")`,
		},
		{
			"an unknown field of an alert waiting", alertsJSON,
			`{"version": 1, "waiting": {"webhook": [{"event": "ban", "evnet": "ban"}]}}`,
			`: json: unknown field "evnet"`,
		},
		{
			"alerts waiting for an unknown destination", alertsJSON,
			`{"version": 1, "waiting": {"webhook": [], "slak": []}}`,
			`: waiting "slak" is not webhook, slack or ntfy`,
		},
		{
			"an anomaly counter of an unknown scope", alertsJSON,
			`{"version": 1, "anomaly_counters": [{"scope": "total"}, ` +
				`{"scope": "nett", "netblock": "203.0.113.0/24"}]}`,
			`: anomaly_counters entry 2's scope "nett" is not client, net, asn, total ` +
				`or watch`,
		},
		{
			"a copy of a list with a line that does not read", reputationJSON,
			`{"version": 1, "lists": [{"url": "` + blocklistURL + `", ` +
				`"tried": "2026-10-06T00:00:00Z", "fetched": "2026-10-06T00:00:00Z", ` +
				`"lines": ["; DROP", "203.0.113.300"]}]}`,
			`: the copy of ` + blocklistURL + `: line 2 is not an address or a netblock, ` +
				`such as 192.0.2.0/24`,
		},
	} {
		t.Run(tc.name, func(t *testing.T) {
			t.Parallel()

			wantRefused(t, tc.file, tc.content, tc.want)
		})
	}
}

func TestEntryWithoutAFieldItNeedsStopsTheStart(t *testing.T) {
	t.Parallel()

	const (
		// The other fields each entry needs.
		ban    = `"start": "2026-10-06T00:00:00Z", "expires": null`
		answer = `"answered": "2026-10-06T00:00:00Z"`

		noNetblock = `: entry 1 has no "netblock"`
	)

	for _, tc := range []struct {
		name, file, content string
		// want is what the error says after the file's path.
		want string
	}{
		{
			"a ban without a netblock", bansJSON,
			`{"version": 1, "bans": [{` + ban + `}]}`,
			noNetblock,
		},
		{
			"a ban whose netblock is null", bansJSON,
			`{"version": 1, "bans": [{"netblock": null, ` + ban + `}]}`,
			noNetblock,
		},
		{
			"a ban whose netblock is empty", bansJSON,
			`{"version": 1, "bans": [{"netblock": "", ` + ban + `}]}`,
			noNetblock,
		},
		{
			"a ban without a start", bansJSON,
			`{"version": 1, "bans": [{"netblock": "203.0.113.9/32", "expires": null}]}`,
			`: entry 1 has no "start"`,
		},
		{
			// The first ban's expires is null, as a permanent ban's is.
			"a ban without an expires", bansJSON,
			`{"version": 1, "bans": [{"netblock": "203.0.113.9/32", ` + ban + `}, ` +
				`{"netblock": "203.0.113.10/32", "start": "2026-10-06T00:00:00Z"}]}`,
			`: entry 2 has no "expires"`,
		},
		{
			"a client without its address", clientsJSON,
			`{"version": 1, "clients": [{"history": {"requests": 3}}]}`,
			`: entry 1 has no "client"`,
		},
		{
			"a client with requests in a window without its start", clientsJSON,
			`{"version": 1, "clients": [{"client": "203.0.113.9/32", ` +
				`"hour": {"current": 3}}]}`,
			`: entry 1 has no "hour.start"`,
		},
		{
			"a client with bytes in a window without its start", clientsJSON,
			`{"version": 1, "clients": [{"client": "203.0.113.9/32", ` +
				`"minute_bytes": {"previous": 5120}}]}`,
			`: entry 1 has no "minute_bytes.start"`,
		},
		{
			"an answer without a client", lookupsJSON,
			`{"version": 1, "lookups": [{"country": "DE", ` + answer + `}]}`,
			`: entry 1 has no "client"`,
		},
		{
			// A country of "" is a client GeoJS cannot place.
			"an answer without a country", lookupsJSON,
			`{"version": 1, "lookups": [{"client": "192.0.2.1/32", "country": "", ` +
				answer + `}, {"client": "203.0.113.9/32", ` + answer + `}]}`,
			`: entry 2 has no "country"`,
		},
		{
			"an answer without the time GeoJS gave it", lookupsJSON,
			`{"version": 1, "lookups": [{"client": "203.0.113.9/32", "country": "DE"}]}`,
			`: entry 1 has no "answered"`,
		},
	} {
		t.Run(tc.name, func(t *testing.T) {
			t.Parallel()

			wantRefused(t, tc.file, tc.content, tc.want)
		})
	}
}

func TestReputationJSONEntryWithoutAFieldItNeedsStopsTheStart(t *testing.T) {
	t.Parallel()

	const (
		drop    = `"url": "` + blocklistURL + `", `
		tried   = `"tried": "2026-10-06T00:00:00Z", `
		fetched = `"fetched": "2026-10-06T00:00:00Z"`
		// verdictZone, verdictClient and listed start a verdict, which
		// fetched ends.
		verdictZone   = `"zone": "` + dnsblZone + `", `
		verdictClient = `"client": "198.51.100.7", `
		listed        = `"listed": false, `
	)

	for _, tc := range []struct {
		name, content string
		// want is what the error says after the file's path.
		want string
	}{
		{
			"a list without its URL",
			`{"version": 1, "lists": [{` + tried + fetched + `, "lines": []}]}`,
			`: entry 1 has no "url"`,
		},
		{
			"a list without the time it was last tried",
			`{"version": 1, "lists": [{` + drop + fetched + `, "lines": []}]}`,
			`: entry 1 has no "tried"`,
		},
		{
			"a copy of a list without the time it was fetched",
			`{"version": 1, "lists": [{` + drop + tried + `"lines": []}]}`,
			`: entry 1 has no "fetched"`,
		},
		{
			// An empty list has no lines, which is not having none.
			"a copy of a list without its lines",
			`{"version": 1, "lists": [{` + drop + tried + fetched + `, "lines": []}, ` +
				`{"url": "` + torURL + `", ` + tried + fetched + `}]}`,
			`: entry 2 has no "lines"`,
		},
		{
			"a verdict without its zone",
			`{"version": 1, "verdicts": [{` + verdictClient + listed + fetched + `}]}`,
			`: verdicts entry 1 has no "zone"`,
		},
		{
			"a verdict without its client",
			`{"version": 1, "verdicts": [{` + verdictZone + listed + fetched + `}]}`,
			`: verdicts entry 1 has no "client"`,
		},
		{
			// A client the zone does not list has a listed of false, which is
			// not having none.
			"a verdict without whether the zone lists the client",
			`{"version": 1, "verdicts": [{` + verdictZone + verdictClient + listed +
				fetched + `}, {` + verdictZone + verdictClient + fetched + `}]}`,
			`: verdicts entry 2 has no "listed"`,
		},
		{
			"a verdict without the time it was fetched",
			`{"version": 1, "verdicts": [{` + verdictZone + verdictClient +
				`"listed": true}]}`,
			`: verdicts entry 1 has no "fetched"`,
		},
	} {
		t.Run(tc.name, func(t *testing.T) {
			t.Parallel()

			wantRefused(t, reputationJSON, tc.content, tc.want)
		})
	}
}

func TestReputationJSONScoreWithoutAFieldItNeedsStopsTheStart(t *testing.T) {
	t.Parallel()

	// scores opens the list of AbuseIPDB scores, and ends closes it; client,
	// score and fetched make a score.
	const (
		scores  = `{"version": 1, "abuseipdb": {"scores": [`
		client  = `"client": "198.51.100.7/32", `
		score   = `"score": 0, `
		fetched = `"fetched": "2026-10-06T00:00:00Z"`
		ends    = `}]}}`
	)

	for _, tc := range []struct {
		name, content string
		// want is what the error says after the file's path.
		want string
	}{
		{
			"without its client", scores + `{` + score + fetched + ends,
			`: abuseipdb scores entry 1 has no "client"`,
		},
		{
			// A score of 0 is not having none.
			"without the score",
			scores + `{` + client + score + fetched + `}, {` + client + fetched + ends,
			`: abuseipdb scores entry 2 has no "score"`,
		},
		{
			"without the time it was fetched", scores + `{` + client + `"score": 100` + ends,
			`: abuseipdb scores entry 1 has no "fetched"`,
		},
	} {
		t.Run(tc.name, func(t *testing.T) {
			t.Parallel()

			wantRefused(t, reputationJSON, tc.content, tc.want)
		})
	}
}

func TestAlertsJSONEntryWithoutAFieldItNeedsStopsTheStart(t *testing.T) {
	t.Parallel()

	for _, tc := range []struct {
		name, content string
		// want is what the error says after the file's path.
		want string
	}{
		{
			"a cooldown without its event",
			`{"version": 1, "cooldowns": [{"sent": "2026-10-06T00:00:00Z"}]}`,
			`: cooldowns entry 1 has no "event"`,
		},
		{
			"a cooldown without when it was sent",
			`{"version": 1, "cooldowns": [{"event": "ban"}]}`,
			`: cooldowns entry 1 has no "sent"`,
		},
		{
			"an alert waiting without its event",
			`{"version": 1, "waiting": {"ntfy": [{"time": "2026-10-06T00:00:00Z"}]}}`,
			`: waiting ntfy entry 1 has no "event"`,
		},
		{
			"an alert waiting without its time",
			`{"version": 1, "waiting": {"slack": [{"event": "ban"}]}}`,
			`: waiting slack entry 1 has no "time"`,
		},
		{
			// The whole service's counter needs nothing to tell it apart.
			"an anomaly counter of a netblock without it",
			`{"version": 1, "anomaly_counters": [{"scope": "total"}, {"scope": "net"}]}`,
			`: anomaly_counters entry 2 has no "netblock"`,
		},
		{
			"an anomaly counter of a client without its netblock",
			`{"version": 1, "anomaly_counters": [{"scope": "client"}]}`,
			`: anomaly_counters entry 1 has no "netblock"`,
		},
		{
			"an anomaly counter of an AS number without it",
			`{"version": 1, "anomaly_counters": [{"scope": "asn"}]}`,
			`: anomaly_counters entry 1 has no "asn"`,
		},
		{
			"an anomaly counter of a named netblock without its name",
			`{"version": 1, "anomaly_counters": [` +
				`{"scope": "watch", "netblock": "203.0.113.0/24"}]}`,
			`: anomaly_counters entry 1 has no "name"`,
		},
		{
			"an anomaly counter of a named netblock without its netblock",
			`{"version": 1, "anomaly_counters": [{"scope": "watch", "name": "office"}]}`,
			`: anomaly_counters entry 1 has no "netblock"`,
		},
		{
			"an anomaly counter with bytes in a window without its start",
			`{"version": 1, "anomaly_counters": [` +
				`{"scope": "total", "hour_bytes": {"current": 5}}]}`,
			`: anomaly_counters entry 1 has no "hour_bytes.start"`,
		},
	} {
		t.Run(tc.name, func(t *testing.T) {
			t.Parallel()

			wantRefused(t, alertsJSON, tc.content, tc.want)
		})
	}
}

func TestAlertsJSONWithWaitingAsAListStopsTheStartSayingWhatToChange(t *testing.T) {
	t.Parallel()

	// alerts.json as it was written before alerts went to Slack and ntfy too,
	// with no alert waiting, or one.
	for _, waiting := range []string{
		`[]`,
		`[{"event": "ban", "time": "2026-10-06T00:00:00Z"}]`,
	} {
		wantRefused(t, alertsJSON, `{"version": 1, "cooldowns": [], `+
			`"hour": {"start": "2026-10-06T00:00:00Z", "sent": 0, "held_back": {}}, `+
			`"waiting": `+waiting+`}`,
			`: waiting is a list, but now lists the alerts by destination: put the `+
				`list under "webhook", as "waiting": {"webhook": [...]}, or remove the file`)
	}
}

func TestBanWithAnotherCauseStopsTheStart(t *testing.T) {
	t.Parallel()

	wantRefused(t, bansJSON, `{"version": 1, "bans": [`+
		`{"netblock": "203.0.113.9/32", "start": "2026-10-06T00:00:00Z", `+
		`"expires": null, "cause": "attack"}, `+
		`{"netblock": "203.0.113.10/32", "start": "2026-10-06T00:00:00Z", `+
		`"expires": null, "cause": "admin"}, `+
		`{"netblock": "203.0.113.11/32", "start": "2026-10-06T00:00:00Z", `+
		`"expires": null, "cause": "atack"}]}`,
		`: entry 3's cause "atack" is not limit, attack or admin`)
}

func TestUnknownVersionStopsTheStart(t *testing.T) {
	t.Parallel()

	for _, file := range []string{
		bansJSON, clientsJSON, lookupsJSON, reputationJSON, alertsJSON,
	} {
		for _, content := range []string{`{"version": 2}`, `{}`} {
			t.Run(file+" "+content, func(t *testing.T) {
				t.Parallel()

				wantRefused(t, file, content, ": unknown version ")
			})
		}
	}
}

func TestUnwritableDirectoryStopsTheStart(t *testing.T) {
	t.Parallel()

	notADirectory := filepath.Join(t.TempDir(), "file")

	err := os.WriteFile(notADirectory, nil, 0o600)
	if err != nil {
		t.Fatalf("write: %v", err)
	}

	for _, dir := range []string{
		filepath.Join(t.TempDir(), "missing"),
		notADirectory,
	} {
		const want = "SWWAF_STATE_DIR cannot be written: "

		_, err := state.Load(newParams(dir))
		if err == nil || !strings.HasPrefix(err.Error(), want) {
			t.Errorf("state directory %s: error %v, want one starting %s", dir, err, want)
		}
	}
}

// The three tests below run Run in a synctest bubble, where time is a clock
// of the test's own: time.Sleep moves it on at once, and synctest.Wait
// returns once Run waits for its next write, so that every write due by
// then is on disk.

func TestBansWrittenOnceWriteDelayAfterABan(t *testing.T) {
	t.Parallel()

	synctest.Test(t, func(t *testing.T) {
		dir := t.TempDir()
		params := newParams(dir)
		params.WriteDelay = 10 * time.Second
		run(t, load(t, params).Run)

		// A second ban, made while the first waits to be written, puts the
		// write off no further, and is written with it.
		first, _ := params.Ledger.BanForLimit(netip.MustParsePrefix("203.0.113.9/32"),
			midnight(), bans.Notes{})

		time.Sleep(5 * time.Second)

		second, _ := params.Ledger.BanForLimit(netip.MustParsePrefix("203.0.113.10/32"),
			midnight(), bans.Notes{})

		time.Sleep(5*time.Second - time.Nanosecond)
		synctest.Wait()
		wantFiles(t, dir)

		time.Sleep(time.Nanosecond)
		synctest.Wait()
		wantFiles(t, dir, bansJSON)

		read := newParams(dir)
		load(t, read)

		want := []bans.Ban{first, second}
		if got := read.Ledger.Snapshot(); !slices.Equal(got, want) {
			t.Errorf("bans.json holds %+v, want %+v", got, want)
		}

		// That write was the only one: bans.json is not written again for
		// the second ban. The other files wait for the interval, an hour
		// away.
		removeFiles(t, dir, bansJSON)
		time.Sleep(params.WriteDelay)
		synctest.Wait()
		wantFiles(t, dir)
	})
}

func TestEveryFileWrittenEveryCounterInterval(t *testing.T) {
	t.Parallel()

	synctest.Test(t, func(t *testing.T) {
		dir := t.TempDir()
		params := newParams(dir)
		params.CounterInterval = time.Minute
		run(t, load(t, params).Run)

		// The files are removed once written, so that each interval shows
		// them written again.
		for range 3 {
			time.Sleep(time.Minute - time.Nanosecond)
			synctest.Wait()
			wantFiles(t, dir)

			time.Sleep(time.Nanosecond)
			synctest.Wait()
			wantFiles(t, dir, alertsJSON, bansJSON, clientsJSON, lookupsJSON, reputationJSON)
			removeFiles(t, dir, alertsJSON, bansJSON, clientsJSON, lookupsJSON,
				reputationJSON)
		}
	})
}

func TestEditJustBeforeAScheduledWriteSurvivesIt(t *testing.T) {
	t.Parallel()

	synctest.Test(t, func(t *testing.T) {
		dir := t.TempDir()
		params := newParams(dir)
		params.WriteDelay = 10 * time.Second
		run(t, load(t, params).Run)

		// A ban, and bans.json written with it.
		params.Ledger.BanForLimit(netip.MustParsePrefix("203.0.113.9/32"),
			midnight(), bans.Notes{})
		time.Sleep(params.WriteDelay)
		synctest.Wait()

		// A second ban is to be written WriteDelay later. Just before
		// then, an admin saves bans.json with the first ban lifted and
		// another added.
		params.Ledger.BanForLimit(netip.MustParsePrefix("203.0.113.10/32"),
			midnight(), bans.Notes{})
		time.Sleep(params.WriteDelay - time.Nanosecond)
		synctest.Wait()
		edit(t, dir, bansJSON, permanentBansJSON)

		// The write takes the edit in first, and writes it back. The second
		// ban, made after the admin opened the file, is lost, as "Edits
		// while running" in SPEC.md says.
		time.Sleep(time.Nanosecond)
		synctest.Wait()

		if got := readFile(t, filepath.Join(dir, bansJSON)); got != permanentBansJSON {
			t.Errorf("bans.json holds\n%s\nwant the edit", got)
		}

		wantEqual(t, bansJSON, params.Ledger.Snapshot(), []bans.Ban{permanentBan()})
	})
}

func TestWriteThatFailsWhileRunningRaisesAFileErrorAlertOncePerCooldown(t *testing.T) {
	t.Parallel()

	synctest.Test(t, func(t *testing.T) {
		dir := t.TempDir()
		params := newParams(dir)
		params.CounterInterval = time.Minute
		run(t, load(t, params).Run)

		// A directory in the way of clients.json's temporary file fails each
		// of its writes, while the other files are written. It holds a file,
		// so that the write cannot remove it.
		err := os.Mkdir(filepath.Join(dir, clientsJSON+".tmp"), 0o700)
		if err == nil {
			err = os.WriteFile(filepath.Join(dir, clientsJSON+".tmp", "kept"), nil, 0o600)
		}

		if err != nil {
			t.Fatalf("put a directory in the way: %v", err)
		}

		time.Sleep(time.Minute)
		synctest.Wait()

		waiting := params.Alerts.Snapshot().Waiting[alerts.DestinationWebhook]
		if len(waiting) != 1 {
			t.Fatalf("%d alerts wait, want 1", len(waiting))
		}

		message, _ := waiting[0].Detail["error"].(string)

		if waiting[0].Event != alerts.EventFileError ||
			waiting[0].Reason != "writing the state files failed" ||
			waiting[0].Detail["file"] != filepath.Join(dir, clientsJSON) ||
			!strings.Contains(message, clientsJSON+".tmp") {
			t.Fatalf("alerts waiting %+v, want a file_error alert for clients.json, "+
				"naming its temporary file", waiting)
		}

		// The next write fails too, within the cooldown, which holds it back.
		time.Sleep(time.Minute)
		synctest.Wait()

		waiting = params.Alerts.Snapshot().Waiting[alerts.DestinationWebhook]
		if len(waiting) != 1 || params.Alerts.Suppressed() != 1 {
			t.Errorf("%d alerts wait and %d are held back, want 1 and 1",
				len(waiting), params.Alerts.Suppressed())
		}
	})
}

func TestFailedWriteLeavesTheFileAsItWas(t *testing.T) {
	t.Parallel()

	dir := t.TempDir()
	params := newParams(dir)
	params.Ledger.Load([]bans.Ban{permanentBan()})
	files := load(t, params)

	err := files.WriteAll()
	if err != nil {
		t.Fatalf("write: %v", err)
	}

	// A directory in the way of bans.json's temporary file fails its
	// next write, but not the others'.
	err = os.Mkdir(filepath.Join(dir, bansJSON+".tmp"), 0o700)
	if err != nil {
		t.Fatalf("mkdir: %v", err)
	}

	params.Ledger.BanForLimit(netip.MustParsePrefix("203.0.113.9/32"), midnight(),
		bans.Notes{})
	params.Limiter.Count(netip.MustParsePrefix("203.0.113.9/32"), midnight(), whole)

	err = files.WriteAll()
	if err == nil || !strings.Contains(err.Error(), bansJSON+".tmp") {
		t.Errorf("error %v, want one naming bans.json's temporary file", err)
	}

	got := readFile(t, filepath.Join(dir, bansJSON))
	if got != permanentBansJSON {
		t.Errorf("bans.json is now\n%s\nwant it as it was", got)
	}

	read := newParams(dir)
	load(t, read)

	if len(read.Limiter.Snapshot()) != 1 {
		t.Error("clients.json was not written")
	}
}

func TestWritesAreCountedInTheMetrics(t *testing.T) {
	t.Parallel()

	dir := t.TempDir()
	params := newParams(dir)
	params.Ledger.Load([]bans.Ban{permanentBan()})
	files := load(t, params)

	err := files.WriteAll()
	if err != nil {
		t.Fatalf("write: %v", err)
	}

	const (
		ofBans    = `{file="bans.json",instance="app"}`
		ofClients = `{file="clients.json",instance="app"}`
	)

	got := scrape(t, params)
	wantMetric(t, got, "smallwebwaf_state_file_writes_total"+ofBans, 1)
	wantMetric(t, got, "smallwebwaf_state_file_writes_total"+ofClients, 1)
	wantMetric(t, got, "smallwebwaf_state_file_write_failures_total"+ofBans, 0)
	wantMetric(t, got, "smallwebwaf_state_file_size_bytes"+ofBans,
		float64(len(permanentBansJSON)))

	written := metric(t, got, "smallwebwaf_state_file_last_write_timestamp_seconds"+ofBans)
	if written < float64(time.Now().Add(-time.Hour).Unix()) {
		t.Errorf("bans.json was last written at %v, not by that write", written)
	}

	// A directory in the way of bans.json's temporary file fails its next
	// write, which leaves its size as it was, although it has a ban more.
	err = os.Mkdir(filepath.Join(dir, bansJSON+".tmp"), 0o700)
	if err != nil {
		t.Fatalf("mkdir: %v", err)
	}

	params.Ledger.BanForLimit(netip.MustParsePrefix("203.0.113.9/32"), midnight(),
		bans.Notes{})

	err = files.WriteAll()
	if err == nil {
		t.Fatal("the write did not fail")
	}

	got = scrape(t, params)
	wantMetric(t, got, "smallwebwaf_state_file_writes_total"+ofBans, 2)
	wantMetric(t, got, "smallwebwaf_state_file_write_failures_total"+ofBans, 1)
	wantMetric(t, got, "smallwebwaf_state_file_write_failures_total"+ofClients, 0)
	wantMetric(t, got, "smallwebwaf_state_file_size_bytes"+ofBans,
		float64(len(permanentBansJSON)))
}

func TestFileThatCannotBeReadIsNotWrittenOver(t *testing.T) {
	t.Parallel()

	dir := t.TempDir()
	path := filepath.Join(dir, bansJSON)
	params := newParams(dir)
	files := load(t, params)

	// bans.json is a socket, which cannot be opened as a file, even by
	// root, as the tests run in Docker, but which a rename could replace.
	// Whether it holds an edit cannot be told, so it is left as it is.
	socket, err := (&net.ListenConfig{}).Listen(t.Context(), "unix", path)
	if err != nil {
		t.Fatalf("listen: %v", err)
	}

	defer func() {
		_ = socket.Close()
	}()

	err = files.WriteAll()
	if err == nil {
		t.Error("writing with bans.json unreadable did not fail")
	}

	info, err := os.Lstat(path)
	if err != nil || info.Mode().Type() != fs.ModeSocket {
		t.Errorf("bans.json is now %v (%v), want the socket", info, err)
	}

	wantFiles(t, dir, alertsJSON, bansJSON, clientsJSON, lookupsJSON, reputationJSON)
	wantWriteFailed(t, params, bansJSON)
}

func TestBrokenEditThatCannotBeSetAsideIsNotWrittenOver(t *testing.T) {
	t.Parallel()

	const broken = `{"version": 1, "bans": [`

	dir := t.TempDir()
	path := filepath.Join(dir, bansJSON)
	params := newParams(dir)
	files := load(t, params)

	// A directory named bans.json.bad cannot be renamed over, so the
	// broken edit cannot be set aside, and is left as it is.
	edit(t, dir, bansJSON, broken)

	err := os.Mkdir(path+".bad", 0o700)
	if err != nil {
		t.Fatalf("mkdir: %v", err)
	}

	err = files.WriteAll()
	if err == nil {
		t.Error("writing with bans.json.bad in the way did not fail")
	}

	if got := readFile(t, path); got != broken {
		t.Errorf("bans.json holds\n%s\nwant the edit", got)
	}

	wantWriteFailed(t, params, bansJSON)
}

func TestEditOfEachFileTakenIn(t *testing.T) {
	t.Parallel()

	dir := t.TempDir()
	params := newParams(dir)
	lines := logInto(&params)
	fill(params)
	files := load(t, params)

	err := files.WriteAll()
	if err != nil {
		t.Fatalf("write: %v", err)
	}

	watch(t, files, lines)

	// Each edit holds one entry, for a client the parts did not hold, and
	// takes the place of everything the part held.
	client := netip.MustParsePrefix("198.51.100.7/32")

	edit(t, dir, bansJSON, `{"version": 1, "bans": [{"netblock": "198.51.100.7/32", `+
		`"start": "2026-10-06T00:00:00Z", "expires": null}]}`)
	wantTakenIn(t, lines, dir, bansJSON)
	wantEqual(t, bansJSON, params.Ledger.Snapshot(),
		[]bans.Ban{{Netblock: client, Start: midnight(), Cause: bans.CauseAdmin}})

	edit(t, dir, clientsJSON, `{"version": 1, "clients": [`+
		`{"client": "198.51.100.7/32", "history": {"requests": 7}}]}`)
	wantTakenIn(t, lines, dir, clientsJSON)
	wantEqual(t, clientsJSON, params.Limiter.Snapshot(),
		[]ratelimit.Client{{Client: client, History: ratelimit.History{Requests: 7}}})

	edit(t, dir, lookupsJSON, `{"version": 1, "lookups": [{"client": "198.51.100.7/32", `+
		`"country": "FR", "answered": "2026-10-06T00:00:00Z"}]}`)
	wantTakenIn(t, lines, dir, lookupsJSON)
	wantEqual(t, lookupsJSON, params.GeoJS.Snapshot(),
		[]lookup.Answer{{Client: client, Country: "FR", Answered: midnight()}})

	edit(t, dir, reputationJSON, `{"version": 1, "lists": [{"url": "`+blocklistURL+`", `+
		`"tried": "2026-10-06T00:00:00Z", "fetched": "2026-10-06T00:00:00Z", `+
		`"lines": ["198.51.100.7"]}], "verdicts": [{"zone": "`+dnsblZone+`", `+
		`"client": "198.51.100.7", "listed": true, "fetched": "2026-10-06T00:00:00Z"}], `+
		`"abuseipdb": {"day": "2026-10-06T00:00:00Z", "spent": 9, "scores": [`+
		`{"client": "198.51.100.7/32", "score": 80, "fetched": "2026-10-06T00:00:00Z"}]}}`)
	wantTakenIn(t, lines, dir, reputationJSON)

	listedBy := params.Lists.ListedBy(client.Addr())
	if !slices.Equal(listedBy, []string{blocklistURL}) {
		t.Errorf("%s taken in lists %s on %v, want on the blocklist", reputationJSON,
			client.Addr(), listedBy)
	}

	wantEqual(t, reputationJSON, params.DNSBL.Snapshot(), []reputation.Verdict{{
		Zone: dnsblZone, Client: client.Addr(), Listed: true, Fetched: midnight(),
	}})

	checks := reputation.Checks{
		Day: midnight(), Spent: 9,
		Scores: []reputation.Score{{Client: client, Score: 80, Fetched: midnight()}},
	}
	if got := params.AbuseIPDB.Snapshot(); !reflect.DeepEqual(got, checks) {
		t.Errorf("%s taken in as\n%+v\nwant\n%+v", reputationJSON, got, checks)
	}

	// A netblock with bits past its length is read as the netblock it is
	// in.
	edit(t, dir, alertsJSON, `{"version": 1, "cooldowns": [{"event": "ban", `+
		`"netblock": "198.51.100.9/24", "sent": "2026-10-06T00:00:00Z"}], `+
		`"waiting": {"webhook": [{"event": "file_error", "time": "2026-10-06T00:00:00Z"}]}}`)
	wantTakenIn(t, lines, dir, alertsJSON)

	want := alerts.State{
		Cooldowns: []alerts.Cooldown{{
			Event: alerts.EventBan, Netblock: netip.MustParsePrefix("198.51.100.0/24"),
			Sent: midnight(),
		}},
		Hour: alerts.Hour{HeldBack: map[string]int{}},
		Waiting: map[string][]alerts.Alert{
			alerts.DestinationWebhook: {{Event: alerts.EventFileError, Time: midnight()}},
		},
	}
	if got := params.Alerts.Snapshot(); !reflect.DeepEqual(got, want) {
		t.Errorf("%s taken in as\n%+v\nwant\n%+v", alertsJSON, got, want)
	}
}

func TestOwnWritesAreNotTakenIn(t *testing.T) {
	t.Parallel()

	dir := t.TempDir()
	params := newParams(dir)
	lines := logInto(&params)
	fill(params)
	files := load(t, params)
	watch(t, files, lines)

	// Every file is written while watched, and then lookups.json edited:
	// the first edit taken in is that one.
	err := files.WriteAll()
	if err != nil {
		t.Fatalf("write: %v", err)
	}

	edit(t, dir, lookupsJSON, `{"version": 1, "lookups": []}`)
	wantTakenIn(t, lines, dir, lookupsJSON)
}

func TestFileRenamedOverAStateFileTakenIn(t *testing.T) {
	t.Parallel()

	dir := t.TempDir()
	path := filepath.Join(dir, bansJSON)
	params := newParams(dir)
	lines := logInto(&params)
	files := load(t, params)

	err := files.WriteAll()
	if err != nil {
		t.Fatalf("write: %v", err)
	}

	watch(t, files, lines)

	// The admin mends bans.json.bad and moves it back, as editors that
	// save by renaming do with a file of their own: nothing is written
	// into bans.json itself. An edit of clients.json after it must be
	// taken in second.
	edit(t, dir, bansJSON+".bad", permanentBansJSON)

	err = os.Rename(path+".bad", path)
	if err != nil {
		t.Fatalf("rename: %v", err)
	}

	edit(t, dir, clientsJSON, `{"version": 1, "clients": []}`)

	wantTakenIn(t, lines, dir, bansJSON)
	wantEqual(t, bansJSON, params.Ledger.Snapshot(), []bans.Ban{permanentBan()})
}

func TestBanAddedAndLiftedThroughBansJSON(t *testing.T) {
	t.Parallel()

	dir := t.TempDir()
	params := newParams(dir)
	lines := logInto(&params)
	watch(t, load(t, params), lines)

	client := netip.MustParseAddr("203.0.113.9")

	// An entry added, as an admin writes it, bans its netblock.
	edit(t, dir, bansJSON, `{"version": 1, "bans": [{"netblock": "203.0.113.0/24", `+
		`"start": "2026-10-06T00:00:00Z", "expires": null}]}`)
	wantTakenIn(t, lines, dir, bansJSON)

	_, banned, _ := params.Ledger.Check(client, midnight())
	if !banned {
		t.Error("the ban added to bans.json does not refuse")
	}

	// The entry removed lifts the ban.
	edit(t, dir, bansJSON, `{"version": 1, "bans": []}`)
	wantTakenIn(t, lines, dir, bansJSON)

	_, banned, _ = params.Ledger.Check(client, midnight())
	if banned {
		t.Error("the ban removed from bans.json still refuses")
	}
}

func TestBanWithoutACauseTakenInAsAnAdmins(t *testing.T) {
	t.Parallel()

	const reason = "probes for logins"

	// adminsBansJSON is bans.json as an admin writes it, with a ban on
	// netblock without a cause, and adminsBans the bans it holds.
	adminsBansJSON := func(netblock string) string {
		return `{"version": 1, "bans": [{"netblock": "` + netblock + `", ` +
			`"start": "2026-10-06T00:00:00Z", "expires": null, "reason": "` +
			reason + `"}]}`
	}
	adminsBans := func(netblock string) []bans.Ban {
		return []bans.Ban{{
			Netblock: netip.MustParsePrefix(netblock),
			Start:    midnight(),
			Cause:    bans.CauseAdmin,
			Reason:   reason,
		}}
	}

	// Read at the start, the ban is taken in as an admin's, though not
	// counted among the bans made since the start, and written back with
	// that cause and the admin's reason.
	dir := t.TempDir()
	edit(t, dir, bansJSON, adminsBansJSON("203.0.113.0/24"))

	params := newParams(dir)
	lines := logInto(&params)
	files := load(t, params)
	wantEqual(t, bansJSON, params.Ledger.Snapshot(), adminsBans("203.0.113.0/24"))
	wantMadeByAnAdmin(t, params.Ledger, 0)

	err := files.WriteAll()
	if err != nil {
		t.Fatalf("write: %v", err)
	}

	var written struct {
		Bans []struct {
			Cause  string `json:"cause"`
			Reason string `json:"reason"`
		} `json:"bans"`
	}

	err = json.Unmarshal([]byte(readFile(t, filepath.Join(dir, bansJSON))), &written)
	if err != nil || len(written.Bans) != 1 || written.Bans[0].Cause != bans.CauseAdmin ||
		written.Bans[0].Reason != reason {
		t.Errorf("bans.json holds %+v (%v), want the ban with the cause admin "+
			"and the reason %q", written, err, reason)
	}

	// Taken in while smallwebwaf runs, a ban on another netblock is an
	// admin's too, and one made since the start.
	watch(t, files, lines)
	edit(t, dir, bansJSON, adminsBansJSON("198.51.100.0/24"))
	wantTakenIn(t, lines, dir, bansJSON)
	wantEqual(t, bansJSON, params.Ledger.Snapshot(), adminsBans("198.51.100.0/24"))
	wantMadeByAnAdmin(t, params.Ledger, 1)
}

func TestLiftedBanReadAtTheStart(t *testing.T) {
	t.Parallel()

	dir := t.TempDir()
	edit(t, dir, bansJSON, liftedBansJSON)

	params := newParams(dir)
	wantLiftedBanKept(t, load(t, params), dir, params.Ledger)
}

func TestBanLiftedByAnEditWhileRunning(t *testing.T) {
	t.Parallel()

	dir := t.TempDir()
	params := newParams(dir)
	lines := logInto(&params)
	files := load(t, params)
	watch(t, files, lines)

	// The ban that liftedBansJSON lifts, before it is lifted.
	netblock := netip.MustParsePrefix(liftedClient + "/32")
	params.Ledger.BanForLimit(netblock, midnight(), bans.Notes{})

	_, banned, _ := params.Ledger.Find(netblock.Addr(), afterLifting())
	if !banned {
		t.Fatal("the ban does not refuse before it is lifted")
	}

	edit(t, dir, bansJSON, liftedBansJSON)
	wantTakenIn(t, lines, dir, bansJSON)
	wantLiftedBanKept(t, files, dir, params.Ledger)
}

func TestBrokenEditSetAsideAtTheNextWrite(t *testing.T) {
	t.Parallel()

	// It ends a ban's entry with a comma.
	const broken = "{\n    \"version\": 1,\n    \"bans\": [\n" +
		"        {\"netblock\": \"203.0.113.9/32\",}\n    ]\n}\n"

	dir := t.TempDir()
	path := filepath.Join(dir, bansJSON)
	params := newParams(dir)
	lines := logInto(&params)
	params.Ledger.Load([]bans.Ban{permanentBan()})
	files := load(t, params)

	err := files.WriteAll()
	if err != nil {
		t.Fatalf("write: %v", err)
	}

	watch(t, files, lines)

	// While smallwebwaf runs, the broken edit is left as it is: an edit
	// of clients.json, made after it and taken in, shows that it has been
	// seen.
	edit(t, dir, bansJSON, broken)
	edit(t, dir, clientsJSON, `{"version": 1, "clients": []}`)
	wantTakenIn(t, lines, dir, clientsJSON)
	wantFiles(t, dir, alertsJSON, bansJSON, clientsJSON, lookupsJSON, reputationJSON)

	// The next write sets it aside, logged with where the error is, and
	// writes bans.json again from what smallwebwaf still holds.
	err = files.WriteAll()
	if err != nil {
		t.Fatalf("write: %v", err)
	}

	line := lines.waitFor(t, "set aside an edit of a state file that does not parse")
	message, _ := line["error"].(string)

	if line["file"] != path+".bad" ||
		!strings.HasPrefix(message, path+", line 4, column 39: ") {
		t.Errorf("set aside with %v", line)
	}

	// It is raised as a file_error alert, with the same file and error.
	waiting := params.Alerts.Snapshot().Waiting[alerts.DestinationWebhook]
	if len(waiting) != 1 || waiting[0].Event != alerts.EventFileError ||
		waiting[0].Detail["file"] != path+".bad" || waiting[0].Detail["error"] != message {
		t.Errorf("alerts waiting %+v, want a file_error alert for %s", waiting, path+".bad")
	}

	wantFiles(t, dir, alertsJSON, bansJSON, bansJSON+".bad", clientsJSON, lookupsJSON,
		reputationJSON)

	if got := readFile(t, path+".bad"); got != broken {
		t.Errorf("bans.json.bad holds\n%s\nwant the edit", got)
	}

	if got := readFile(t, path); got != permanentBansJSON {
		t.Errorf("bans.json holds\n%s\nwant\n%s", got, permanentBansJSON)
	}
}

func TestEditsTakenInAreCountedInTheMetrics(t *testing.T) {
	t.Parallel()

	dir := t.TempDir()
	params := newParams(dir)
	lines := logInto(&params)
	files := load(t, params)

	// One edit is taken in by the write of its file, before Watch runs,
	// and one by Watch.
	edit(t, dir, bansJSON, `{"version": 1, "bans": []}`)

	err := files.WriteAll()
	if err != nil {
		t.Fatalf("write: %v", err)
	}

	watch(t, files, lines)
	edit(t, dir, bansJSON, permanentBansJSON)
	wantTakenIn(t, lines, dir, bansJSON)

	wantMetric(t, scrape(t, params),
		`smallwebwaf_state_file_edits_taken_in_total{file="bans.json",instance="app"}`, 2)
}

func TestEditTakenInByAWriteIsLoggedAsWatchLogsIt(t *testing.T) {
	t.Parallel()

	dir := t.TempDir()
	params := newParams(dir)
	lines := logInto(&params)
	files := load(t, params)

	// An edit taken in by Watch, which is then stopped.
	ctx, stop := context.WithCancel(t.Context())
	stopped := make(chan struct{})

	go func() {
		files.Watch(ctx)
		close(stopped)
	}()

	lines.waitFor(t, watching)
	edit(t, dir, bansJSON, `{"version": 1, "bans": []}`)
	byWatch := lines.waitFor(t, tookIn)

	stop()
	<-stopped

	// An edit taken in by the write of its file. Nothing logs after the
	// write, so the log is closed, and a write that does not log the edit
	// fails the test at once instead of waiting for the line.
	edit(t, dir, bansJSON, permanentBansJSON)

	err := files.WriteAll()
	if err != nil {
		t.Fatalf("write: %v", err)
	}

	close(lines)

	byWrite := lines.waitFor(t, tookIn)

	// The two lines differ only in their time.
	delete(byWatch, "time")
	delete(byWrite, "time")

	if !maps.Equal(byWrite, byWatch) {
		t.Errorf("the write logged %v, where Watch logged %v", byWrite, byWatch)
	}
}

func TestEditsSetAsideAreCountedInTheMetrics(t *testing.T) {
	t.Parallel()

	dir := t.TempDir()
	params := newParams(dir)
	files := load(t, params)

	edit(t, dir, bansJSON, `{"version": 1, "bans": [`)

	err := files.WriteAll()
	if err != nil {
		t.Fatalf("write: %v", err)
	}

	wantMetric(t, scrape(t, params),
		`smallwebwaf_state_file_edits_set_aside_total{file="bans.json",instance="app"}`, 1)
}

func TestDirectoryThatCannotBeWatchedIsLogged(t *testing.T) {
	t.Parallel()

	dir := t.TempDir()
	params := newParams(dir)
	lines := logInto(&params)
	files := load(t, params)

	err := os.Remove(dir)
	if err != nil {
		t.Fatalf("remove: %v", err)
	}

	// Watch returns at once.
	files.Watch(t.Context())

	line := lines.waitFor(t, "cannot watch the state files for edits")
	if line["level"] != "ERROR" {
		t.Errorf("logged as %v", line)
	}
}

// midnight is the time of the tests' clock.
func midnight() time.Time {
	return time.Date(2026, 10, 6, 0, 0, 0, 0, time.UTC)
}

// newParams returns Params for the state files in dir, with parts that
// hold nothing yet. GeoJS is never asked, the lists, two blocklists, are
// never fetched, and the alerts, at most two an hour, are
// never sent. The anomaly counters count the scopes fill counts, with
// thresholds fill does not reach.
func newParams(dir string) state.Params {
	discard := slog.New(slog.DiscardHandler)
	m := metrics.New(1, "app")
	queue := alerts.New(alerts.Params{
		WebhookURL: &url.URL{Scheme: "https", Host: "alerts.example"},
		Events:     alerts.Events(),
		Cooldown:   15 * time.Minute,
		MaxPerHour: 2,
		Instance:   "fsn1app1/gitea",
		Now:        midnight,
	})

	return state.Params{
		Dir:             dir,
		WriteDelay:      time.Hour,
		CounterInterval: time.Hour,
		Ledger: bans.New(bans.Rules{
			LimitBanDuration:     time.Hour,
			LimitBanRepeatWindow: 24 * time.Hour,
			MaxBanDuration:       7 * 24 * time.Hour,
			AttackBanDuration:    7 * 24 * time.Hour,
			MaxBans:              5000,
		}),
		Limiter: ratelimit.New(ratelimit.Limits{}, 20000),
		GeoJS: lookup.New(lookup.Params{
			Now: midnight, ProcessLog: discard, Metrics: m,
		}),
		Lists: reputation.New(reputation.Params{
			BlocklistURLs: []string{blocklistURL, torURL}, Refresh: 24 * time.Hour,
			Now: midnight, ProcessLog: discard, Alerts: queue,
		}),
		DNSBL: reputation.NewDNSBL(reputation.DNSBLParams{
			Zones: []string{dnsblZone}, CacheTTL: 24 * time.Hour, Timeout: time.Second,
			Now: midnight, ProcessLog: discard, Alerts: queue,
		}),
		AbuseIPDB: reputation.NewAbuseIPDB(reputation.AbuseIPDBParams{
			MinScore: 75, DailyBudget: 900, CacheTTL: 24 * time.Hour, Timeout: time.Second,
			Now: midnight, ProcessLog: discard, Alerts: queue,
		}),
		Alerts: queue,
		Anomalies: anomaly.New(anomaly.Params{
			Net:            anomaly.Thresholds{RequestsPerMinute: 1000},
			ASN:            anomaly.Thresholds{BytesPerHour: 1 << 30},
			Total:          anomaly.Thresholds{RequestsPerMinute: 1000, BytesPerMinute: 1 << 30},
			Watch:          anomaly.Thresholds{RequestsPerHour: 1000},
			NetV4Prefix:    24,
			NetV6Prefix:    48,
			NamedNetblocks: []anomaly.NamedNetblock{{Name: "office", Netblock: office()}},
			Alerts:         queue,
		}),
		Now:        midnight,
		ProcessLog: discard,
		Metrics:    m,
	}
}

// office is the named netblock of the anomaly counters of newParams.
func office() netip.Prefix {
	return netip.MustParsePrefix("203.0.113.0/24")
}

// fill puts a permanent ban an admin made, a ban for a broken limit and
// one for a clear sign of attack, clients with counts and histories,
// GeoJS answers, the blocklists' last tries and the copy of one, two
// verdicts of a DNSBL zone, and the AbuseIPDB checks spent today with two
// scores, as filledReputationJSON holds them, and alerts
// and anomaly counters, as filledAlertsJSON holds them, into the parts of
// params.
func fill(params state.Params) {
	now := midnight()
	client := netip.MustParsePrefix("203.0.113.9/32")

	params.Ledger.Load([]bans.Ban{permanentBan()})
	params.Ledger.BanForLimit(client, now, bans.Notes{
		ASN: asn, ASName: asName, Country: "DE", Limit: 1,
	})
	params.Ledger.BanForAttack(netip.MustParsePrefix("192.0.2.1/32"), now,
		bans.Notes{RuleID: "env-file", Target: "path"})

	for _, c := range []string{"2001:db8::/64", "203.0.113.9/32", "192.0.2.1/32"} {
		params.Limiter.Count(netip.MustParsePrefix(c), now, whole)
	}

	params.Limiter.CountBytes(client, now, 8, whole)
	params.Limiter.AddToHistory(client, now, ratelimit.Request{
		Forwarded: true, Status: 200, RequestBytes: 3, ResponseBytes: 5,
	})
	params.Limiter.AddLookup(client, now.Add(-time.Hour), asn, asName, "DE")

	params.GeoJS.Load([]lookup.Answer{
		{
			Client: client, ASN: asn, ASName: asName, Country: "DE",
			Answered: now.Add(-time.Hour), Used: now,
		},
		{
			Client:   netip.MustParsePrefix("192.0.2.1/32"),
			Answered: now.Add(-time.Hour), Used: now.Add(-time.Minute),
		},
	})

	// The copy of drop.txt was fetched an hour ago, and the fetches of it
	// and of tor.txt tried since failed.
	err := params.Lists.Load([]reputation.List{{
		URL: blocklistURL, Tried: now, Fetched: now.Add(-time.Hour),
		Lines: []string{
			"; Spamhaus DROP List 2026/10/05 - (c) 2026 The Spamhaus Project SLL",
			"203.0.113.0/24 ; SBL1",
			"2001:db8::/32 ; SBL2",
		},
	}, {URL: torURL, Tried: now}})
	if err != nil {
		panic(err) // the copy reads
	}

	params.DNSBL.Load([]reputation.Verdict{
		{
			Zone: dnsblZone, Client: netip.MustParseAddr("2001:db8::1"),
			Fetched: now.Add(-2 * time.Hour),
		},
		{Zone: dnsblZone, Client: client.Addr(), Listed: true, Fetched: now.Add(-time.Hour)},
	})
	params.AbuseIPDB.Load(reputation.Checks{Day: now, Spent: 3, Scores: []reputation.Score{
		{Client: netip.MustParsePrefix("2001:db8::/64"), Fetched: now.Add(-2 * time.Hour)},
		{Client: client, Score: 100, Fetched: now.Add(-time.Hour)},
	}})

	// An alert waiting, a repeat of it the cooldown holds back, another
	// alert waiting, and one past the two an hour, for the hour's summary.
	ban := alerts.Alert{
		Event: alerts.EventBan, Client: client.Addr(), Netblock: client, Country: "DE",
		Reason: "requests per minute over the limit of 1",
		Detail: map[string]any{"cause": "limit"},
	}
	params.Alerts.Raise(ban)
	params.Alerts.Raise(ban)
	params.Alerts.Raise(alerts.Alert{
		Event: alerts.EventFileError, Reason: "writing the state files failed",
		Detail: map[string]any{
			"file": "/var/lib/smallwebwaf/bans.json", "error": "no space left on device",
		},
	})
	params.Alerts.Raise(alerts.Alert{
		Event: alerts.EventSourceFailure, Reason: "asking GeoJS failed",
	})

	params.Anomalies.Count(now, anomaly.Request{
		Client: client.Addr(), ClientGroup: client, ASN: asn, Bytes: 8,
	})
}

// permanentBan is the ban permanentBansJSON holds.
func permanentBan() bans.Ban {
	return bans.Ban{
		Netblock: netip.MustParsePrefix("2001:db8::/64"),
		Start:    midnight(),
		Cause:    bans.CauseAdmin,
		Reason:   "scrapes every commit",
		Notes: bans.Notes{
			ASN:     asn,
			ASName:  asName,
			Country: "DE",
			Limit:   1000,
			Window:  "minute",
			Count:   1000.5,
			Request: bans.Request{
				Time:      midnight(),
				Method:    "GET",
				Host:      "app.example",
				Path:      "/repo?page=2",
				Status:    403,
				UserAgent: "scraper/1.0",
			},
			Requests:    1500,
			Refused:     3,
			EarlierBans: bans.EarlierBans{Limit: 3, Attack: 1, Admin: 1},
		},
	}
}

// afterLifting is a time after the ban liftedBansJSON holds was lifted,
// while it would still last.
func afterLifting() time.Time {
	return midnight().Add(30 * time.Minute)
}

// wantLiftedBanKept checks that ledger holds the ban liftedBansJSON holds,
// which refuses nothing and does not make the next ban for a broken limit
// longer, and that files write it to bans.json, in dir, still lifted.
func wantLiftedBanKept(
	t *testing.T, files *state.Files, dir string, ledger *bans.Ledger,
) {
	t.Helper()

	err := files.WriteAll()
	if err != nil {
		t.Fatalf("write: %v", err)
	}

	const lifted = `"lifted": "2026-10-06T00:10:00Z"`
	if got := readFile(t, filepath.Join(dir, bansJSON)); !strings.Contains(got, lifted) {
		t.Errorf("bans.json holds\n%s\nwant the ban with %s", got, lifted)
	}

	netblock := netip.MustParsePrefix(liftedClient + "/32")

	_, banned, _ := ledger.Check(netblock.Addr(), afterLifting())
	if banned {
		t.Error("the lifted ban refuses")
	}

	// Were the lifted ban counted, the next would last three hours.
	ban, _ := ledger.BanForLimit(netblock, afterLifting(), bans.Notes{})
	if ban.Expires.Sub(ban.Start) != time.Hour {
		t.Errorf("the next ban lasts %s, want 1h", ban.Expires.Sub(ban.Start))
	}

	held := ledger.Bans(netblock)
	if len(held) != 2 || !held[0].Lifted.Equal(midnight().Add(10*time.Minute)) {
		t.Errorf("the ledger holds %+v, want the lifted ban and the new one", held)
	}
}

// wantMadeByAnAdmin checks how many bans ledger counts as made by an
// admin since the start.
func wantMadeByAnAdmin(t *testing.T, ledger *bans.Ledger, want int) {
	t.Helper()

	if got := ledger.Made(bans.CauseAdmin); got != want {
		t.Errorf("%d bans made by an admin, want %d", got, want)
	}
}

// load reads the state files into the parts of params.
func load(t *testing.T, params state.Params) *state.Files {
	t.Helper()

	files, err := state.Load(params)
	if err != nil {
		t.Fatalf("load: %v", err)
	}

	return files
}

// run runs task, the Run or the Watch of state files, until the test
// ends.
func run(t *testing.T, task func(context.Context)) {
	t.Helper()

	ctx, stop := context.WithCancel(t.Context())
	stopped := make(chan struct{})

	go func() {
		task(ctx)
		close(stopped)
	}()

	t.Cleanup(func() {
		stop()
		<-stopped
	})
}

// watch runs files' Watch until the test ends, and waits until it
// watches the directory.
func watch(t *testing.T, files *state.Files, lines processLog) {
	t.Helper()

	run(t, files.Watch)
	lines.waitFor(t, watching)
}

// processLog receives the lines of a process log, each a JSON object, for
// a test to wait for.
type processLog chan string

// logInto has params' process log write its lines into a new processLog,
// and returns that.
func logInto(params *state.Params) processLog {
	lines := make(processLog, maxLogLines)
	params.ProcessLog = slog.New(slog.NewJSONHandler(lines, nil))

	return lines
}

// Write receives a line of the process log.
func (l processLog) Write(line []byte) (int, error) {
	l <- string(line)

	return len(line), nil
}

// waitFor returns the next line of the process log whose message is msg,
// passing over the lines before it, or nil if the log is closed first. It
// waits as long as that takes, so that a slow test process cannot fail
// the test.
func (l processLog) waitFor(t *testing.T, msg string) map[string]any {
	t.Helper()

	for line := range l {
		var fields map[string]any

		err := json.Unmarshal([]byte(line), &fields)
		if err != nil {
			t.Fatalf("process log line %q is not JSON: %v", line, err)
		}

		if fields["msg"] == msg {
			return fields
		}
	}

	return nil
}

// wantTakenIn waits for the next edit taken in, and checks that it is of
// the state file name in dir.
func wantTakenIn(t *testing.T, lines processLog, dir, name string) {
	t.Helper()

	line := lines.waitFor(t, tookIn)
	if line["file"] != filepath.Join(dir, name) {
		t.Fatalf("took in %v, want an edit of %s", line, name)
	}
}

// edit writes content to the state file name in dir, as an admin saves an
// edit of it.
func edit(t *testing.T, dir, name, content string) {
	t.Helper()

	err := os.WriteFile(filepath.Join(dir, name), []byte(content), 0o600)
	if err != nil {
		t.Fatalf("write %s: %v", name, err)
	}
}

// wantEqual checks that the entries read back from file are those
// written.
func wantEqual[E comparable](t *testing.T, file string, got, want []E) {
	t.Helper()

	if !slices.Equal(got, want) {
		t.Errorf("%s read back\n%+v\nwant\n%+v", file, got, want)
	}
}

// readFile returns what the file at path holds.
func readFile(t *testing.T, path string) string {
	t.Helper()

	data, err := os.ReadFile(path) //nolint:gosec // a file the test wrote
	if err != nil {
		t.Fatalf("read: %v", err)
	}

	return string(data)
}

// wantRefused writes content to the state file named file in a new
// directory, and checks that Load refuses it with an error that is the
// file's path and then starts with want.
func wantRefused(t *testing.T, file, content, want string) {
	t.Helper()

	dir := t.TempDir()
	path := filepath.Join(dir, file)

	err := os.WriteFile(path, []byte(content), 0o600)
	if err != nil {
		t.Fatalf("write %s: %v", file, err)
	}

	_, err = state.Load(newParams(dir))
	if err == nil || !strings.HasPrefix(err.Error(), path+want) {
		t.Errorf("error %v, want one starting %s%s", err, path, want)
	}
}

// removeFiles removes the named files from dir.
func removeFiles(t *testing.T, dir string, names ...string) {
	t.Helper()

	for _, name := range names {
		err := os.Remove(filepath.Join(dir, name))
		if err != nil {
			t.Fatalf("remove: %v", err)
		}
	}
}

// wantFiles checks the names of the files in dir.
func wantFiles(t *testing.T, dir string, want ...string) {
	t.Helper()

	entries, err := os.ReadDir(dir)
	if err != nil {
		t.Fatalf("read %s: %v", dir, err)
	}

	got := make([]string, 0, len(entries))
	for _, entry := range entries {
		got = append(got, entry.Name())
	}

	if !slices.Equal(got, want) {
		t.Errorf("%s holds %v, want %v", dir, got, want)
	}
}

// wantEntries checks that the file at path has its version, then its
// entries under key, each on a line of its own, for the clients want
// names in that order.
func wantEntries(t *testing.T, path, key string, want ...string) {
	t.Helper()

	data := readFile(t, path)
	lines := strings.Split(strings.TrimSuffix(data, "\n"), "\n")
	head := []string{"{", `    "version": 1,`, `    "` + key + `": [`}
	tail := []string{"    ]", "}"}

	if len(lines) != len(head)+len(want)+len(tail) ||
		!slices.Equal(lines[:len(head)], head) ||
		!slices.Equal(lines[len(lines)-len(tail):], tail) {
		t.Fatalf("%s is\n%s", path, data)
	}

	for i, client := range want {
		line := strings.TrimSuffix(lines[len(head)+i], ",")

		var entry struct {
			Client string `json:"client"`
		}

		err := json.Unmarshal([]byte(line), &entry)
		if err != nil || entry.Client != client {
			t.Errorf("entry %d of %s is %s (%v), want %s's", i, path, line, err, client)
		}
	}
}

// scrape returns the metrics of params, in the Prometheus text format.
func scrape(t *testing.T, params state.Params) string {
	t.Helper()

	recorder := httptest.NewRecorder()
	params.Metrics.ServeHTTP(recorder,
		httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", http.NoBody))

	if recorder.Code != http.StatusOK {
		t.Fatalf("the metrics were answered %d", recorder.Code)
	}

	return recorder.Body.String()
}

// metric returns the value of series in text, the metrics, such as
// smallwebwaf_state_file_writes_total{file="bans.json",instance="app"}, or
// fails the test if there is no such series.
func metric(t *testing.T, text, series string) float64 {
	t.Helper()

	for line := range strings.Lines(text) {
		value, found := strings.CutPrefix(strings.TrimSuffix(line, "\n"), series+" ")
		if !found {
			continue
		}

		number, err := strconv.ParseFloat(value, 64)
		if err != nil {
			t.Fatalf("%s has the value %q", series, value)
		}

		return number
	}

	t.Fatalf("no series %s in the metrics:\n%s", series, text)

	return 0
}

// wantWriteFailed checks that the metrics of params count one write of the
// state file name, and that it failed.
func wantWriteFailed(t *testing.T, params state.Params, name string) {
	t.Helper()

	got := scrape(t, params)
	file := `{file="` + name + `",instance="app"}`

	wantMetric(t, got, "smallwebwaf_state_file_writes_total"+file, 1)
	wantMetric(t, got, "smallwebwaf_state_file_write_failures_total"+file, 1)
}

// wantMetric checks the value of series in text, the metrics, as metric
// reads it.
func wantMetric(t *testing.T, text, series string, want float64) {
	t.Helper()

	got := metric(t, text, series)
	if got != want {
		t.Errorf("%s is %v, want %v", series, got, want)
	}
}