/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package fileutil

import (
        "io"
        "os"
        "path/filepath"

        "helm.sh/helm/v3/internal/third_party/dep/fs"
)

// AtomicWriteFile atomically (as atomic as os.Rename allows) writes a file to a
// disk.
func AtomicWriteFile(filename string, reader io.Reader, mode os.FileMode) error {
        tempFile, err := os.CreateTemp(filepath.Split(filename))
        if err != nil {
                return err
        }
        tempName := tempFile.Name()

        if _, err := io.Copy(tempFile, reader); err != nil {
                tempFile.Close() // return value is ignored as we are already on error path
                return err
        }

        if err := tempFile.Close(); err != nil {
                return err
        }

        if err := os.Chmod(tempName, mode); err != nil {
                return err
        }

        return fs.RenameWithFallback(tempName, filename)
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package ignore

import (
        "bufio"
        "bytes"
        "io"
        "log"
        "os"
        "path/filepath"
        "strings"

        "github.com/pkg/errors"
)

// HelmIgnore default name of an ignorefile.
const HelmIgnore = ".helmignore"

// Rules is a collection of path matching rules.
//
// Parse() and ParseFile() will construct and populate new Rules.
// Empty() will create an immutable empty ruleset.
type Rules struct {
        patterns []*pattern
}

// Empty builds an empty ruleset.
func Empty() *Rules {
        return &Rules{patterns: []*pattern{}}
}

// AddDefaults adds default ignore patterns.
//
// Ignore all dotfiles in "templates/"
func (r *Rules) AddDefaults() {
        r.parseRule(`templates/.?*`)
}

// ParseFile parses a helmignore file and returns the *Rules.
func ParseFile(file string) (*Rules, error) {
        f, err := os.Open(file)
        if err != nil {
                return nil, err
        }
        defer f.Close()
        return Parse(f)
}

// Parse parses a rules file
func Parse(file io.Reader) (*Rules, error) {
        r := &Rules{patterns: []*pattern{}}

        s := bufio.NewScanner(file)
        currentLine := 0
        utf8bom := []byte{0xEF, 0xBB, 0xBF}
        for s.Scan() {
                scannedBytes := s.Bytes()
                // We trim UTF8 BOM
                if currentLine == 0 {
                        scannedBytes = bytes.TrimPrefix(scannedBytes, utf8bom)
                }
                line := string(scannedBytes)
                currentLine++

                if err := r.parseRule(line); err != nil {
                        return r, err
                }
        }
        return r, s.Err()
}

// Ignore evaluates the file at the given path, and returns true if it should be ignored.
//
// Ignore evaluates path against the rules in order. Evaluation stops when a match
// is found. Matching a negative rule will stop evaluation.
func (r *Rules) Ignore(path string, fi os.FileInfo) bool {
        // Don't match on empty dirs.
        if path == "" {
                return false
        }

        // Disallow ignoring the current working directory.
        // See issue:
        // 1776 (New York City) Hamilton: "Pardon me, are you Aaron Burr, sir?"
        if path == "." || path == "./" {
                return false
        }
        for _, p := range r.patterns {
                if p.match == nil {
                        log.Printf("ignore: no matcher supplied for %q", p.raw)
                        return false
                }

                // For negative rules, we need to capture and return non-matches,
                // and continue for matches.
                if p.negate {
                        if p.mustDir && !fi.IsDir() {
                                return true
                        }
                        if !p.match(path, fi) {
                                return true
                        }
                        continue
                }

                // If the rule is looking for directories, and this is not a directory,
                // skip it.
                if p.mustDir && !fi.IsDir() {
                        continue
                }
                if p.match(path, fi) {
                        return true
                }
        }
        return false
}

// parseRule parses a rule string and creates a pattern, which is then stored in the Rules object.
func (r *Rules) parseRule(rule string) error {
        rule = strings.TrimSpace(rule)

        // Ignore blank lines
        if rule == "" {
                return nil
        }
        // Comment
        if strings.HasPrefix(rule, "#") {
                return nil
        }

        // Fail any rules that contain **
        if strings.Contains(rule, "**") {
                return errors.New("double-star (**) syntax is not supported")
        }

        // Fail any patterns that can't compile. A non-empty string must be
        // given to Match() to avoid optimization that skips rule evaluation.
        if _, err := filepath.Match(rule, "abc"); err != nil {
                return err
        }

        p := &pattern{raw: rule}

        // Negation is handled at a higher level, so strip the leading ! from the
        // string.
        if strings.HasPrefix(rule, "!") {
                p.negate = true
                rule = rule[1:]
        }

        // Directory verification is handled by a higher level, so the trailing /
        // is removed from the rule. That way, a directory named "foo" matches,
        // even if the supplied string does not contain a literal slash character.
        if strings.HasSuffix(rule, "/") {
                p.mustDir = true
                rule = strings.TrimSuffix(rule, "/")
        }

        if strings.HasPrefix(rule, "/") {
                // Require path matches the root path.
                p.match = func(n string, fi os.FileInfo) bool {
                        rule = strings.TrimPrefix(rule, "/")
                        ok, err := filepath.Match(rule, n)
                        if err != nil {
                                log.Printf("Failed to compile %q: %s", rule, err)
                                return false
                        }
                        return ok
                }
        } else if strings.Contains(rule, "/") {
                // require structural match.
                p.match = func(n string, fi os.FileInfo) bool {
                        ok, err := filepath.Match(rule, n)
                        if err != nil {
                                log.Printf("Failed to compile %q: %s", rule, err)
                                return false
                        }
                        return ok
                }
        } else {
                p.match = func(n string, fi os.FileInfo) bool {
                        // When there is no slash in the pattern, we evaluate ONLY the
                        // filename.
                        n = filepath.Base(n)
                        ok, err := filepath.Match(rule, n)
                        if err != nil {
                                log.Printf("Failed to compile %q: %s", rule, err)
                                return false
                        }
                        return ok
                }
        }

        r.patterns = append(r.patterns, p)
        return nil
}

// matcher is a function capable of computing a match.
//
// It returns true if the rule matches.
type matcher func(name string, fi os.FileInfo) bool

// pattern describes a pattern to be matched in a rule set.
type pattern struct {
        // raw is the unparsed string, with nothing stripped.
        raw string
        // match is the matcher function.
        match matcher
        // negate indicates that the rule's outcome should be negated.
        negate bool
        // mustDir indicates that the matched file must be a directory.
        mustDir bool
}

/*
Copyright The Helm Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package resolver

import (
        "bytes"
        "encoding/json"
        "fmt"
        "os"
        "path/filepath"
        "strings"
        "time"

        "github.com/Masterminds/semver/v3"
        "github.com/pkg/errors"

        "helm.sh/helm/v3/pkg/chart"
        "helm.sh/helm/v3/pkg/chart/loader"
        "helm.sh/helm/v3/pkg/helmpath"
        "helm.sh/helm/v3/pkg/provenance"
        "helm.sh/helm/v3/pkg/registry"
        "helm.sh/helm/v3/pkg/repo"
)

// Resolver resolves dependencies from semantic version ranges to a particular version.
type Resolver struct {
        chartpath      string
        cachepath      string
        registryClient *registry.Client
}

// New creates a new resolver for a given chart, helm home and registry client.
func New(chartpath, cachepath string, registryClient *registry.Client) *Resolver {
        return &Resolver{
                chartpath:      chartpath,
                cachepath:      cachepath,
                registryClient: registryClient,
        }
}

// Resolve resolves dependencies and returns a lock file with the resolution.
func (r *Resolver) Resolve(reqs []*chart.Dependency, repoNames map[string]string) (*chart.Lock, error) {

        // Now we clone the dependencies, locking as we go.
        locked := make([]*chart.Dependency, len(reqs))
        missing := []string{}
        for i, d := range reqs {
                constraint, err := semver.NewConstraint(d.Version)
                if err != nil {
                        return nil, errors.Wrapf(err, "dependency %q has an invalid version/constraint format", d.Name)
                }

                if d.Repository == "" {
                        // Local chart subfolder
                        if _, err := GetLocalPath(filepath.Join("charts", d.Name), r.chartpath); err != nil {
                                return nil, err
                        }

                        locked[i] = &chart.Dependency{
                                Name:       d.Name,
                                Repository: "",
                                Version:    d.Version,
                        }
                        continue
                }
                if strings.HasPrefix(d.Repository, "file://") {

                        chartpath, err := GetLocalPath(d.Repository, r.chartpath)
                        if err != nil {
                                return nil, err
                        }

                        ch, err := loader.LoadDir(chartpath)
                        if err != nil {
                                return nil, err
                        }

                        v, err := semver.NewVersion(ch.Metadata.Version)
                        if err != nil {
                                // Not a legit entry.
                                continue
                        }

                        if !constraint.Check(v) {
                                missing = append(missing, d.Name)
                                continue
                        }

                        locked[i] = &chart.Dependency{
                                Name:       d.Name,
                                Repository: d.Repository,
                                Version:    ch.Metadata.Version,
                        }
                        continue
                }

                repoName := repoNames[d.Name]
                // if the repository was not defined, but the dependency defines a repository url, bypass the cache
                if repoName == "" && d.Repository != "" {
                        locked[i] = &chart.Dependency{
                                Name:       d.Name,
                                Repository: d.Repository,
                                Version:    d.Version,
                        }
                        continue
                }

                var vs repo.ChartVersions
                var version string
                var ok bool
                found := true
                if !registry.IsOCI(d.Repository) {
                        repoIndex, err := repo.LoadIndexFile(filepath.Join(r.cachepath, helmpath.CacheIndexFile(repoName)))
                        if err != nil {
                                return nil, errors.Wrapf(err, "no cached repository for %s found. (try 'helm repo update')", repoName)
                        }

                        vs, ok = repoIndex.Entries[d.Name]
                        if !ok {
                                return nil, errors.Errorf("%s chart not found in repo %s", d.Name, d.Repository)
                        }
                        found = false
                } else {
                        version = d.Version

                        // Check to see if an explicit version has been provided
                        _, err := semver.NewVersion(version)

                        // Use an explicit version, otherwise search for tags
                        if err == nil {
                                vs = []*repo.ChartVersion{{
                                        Metadata: &chart.Metadata{
                                                Version: version,
                                        },
                                }}

                        } else {
                                // Retrieve list of tags for repository
                                ref := fmt.Sprintf("%s/%s", strings.TrimPrefix(d.Repository, fmt.Sprintf("%s://", registry.OCIScheme)), d.Name)
                                tags, err := r.registryClient.Tags(ref)
                                if err != nil {
                                        return nil, errors.Wrapf(err, "could not retrieve list of tags for repository %s", d.Repository)
                                }

                                vs = make(repo.ChartVersions, len(tags))
                                for ti, t := range tags {
                                        // Mock chart version objects
                                        version := &repo.ChartVersion{
                                                Metadata: &chart.Metadata{
                                                        Version: t,
                                                },
                                        }
                                        vs[ti] = version
                                }
                        }
                }

                locked[i] = &chart.Dependency{
                        Name:       d.Name,
                        Repository: d.Repository,
                        Version:    version,
                }
                // The version are already sorted and hence the first one to satisfy the constraint is used
                for _, ver := range vs {
                        v, err := semver.NewVersion(ver.Version)
                        // OCI does not need URLs
                        if err != nil || (!registry.IsOCI(d.Repository) && len(ver.URLs) == 0) {
                                // Not a legit entry.
                                continue
                        }
                        if constraint.Check(v) {
                                found = true
                                locked[i].Version = v.Original()
                                break
                        }
                }

                if !found {
                        missing = append(missing, d.Name)
                }
        }
        if len(missing) > 0 {
                return nil, errors.Errorf("can't get a valid version for repositories %s. Try changing the version constraint in Chart.yaml", strings.Join(missing, ", "))
        }

        digest, err := HashReq(reqs, locked)
        if err != nil {
                return nil, err
        }

        return &chart.Lock{
                Generated:    time.Now(),
                Digest:       digest,
                Dependencies: locked,
        }, nil
}

// HashReq generates a hash of the dependencies.
//
// This should be used only to compare against another hash generated by this
// function.
func HashReq(req, lock []*chart.Dependency) (string, error) {
        data, err := json.Marshal([2][]*chart.Dependency{req, lock})
        if err != nil {
                return "", err
        }
        s, err := provenance.Digest(bytes.NewBuffer(data))
        return "sha256:" + s, err
}

// HashV2Req generates a hash of requirements generated in Helm v2.
//
// This should be used only to compare against another hash generated by the
// Helm v2 hash function. It is to handle issue:
// https://github.com/helm/helm/issues/7233
func HashV2Req(req []*chart.Dependency) (string, error) {
        dep := make(map[string][]*chart.Dependency)
        dep["dependencies"] = req
        data, err := json.Marshal(dep)
        if err != nil {
                return "", err
        }
        s, err := provenance.Digest(bytes.NewBuffer(data))
        return "sha256:" + s, err
}

// GetLocalPath generates absolute local path when use
// "file://" in repository of dependencies
func GetLocalPath(repo, chartpath string) (string, error) {
        var depPath string
        var err error
        p := strings.TrimPrefix(repo, "file://")

        // root path is absolute
        if strings.HasPrefix(p, "/") {
                if depPath, err = filepath.Abs(p); err != nil {
                        return "", err
                }
        } else {
                depPath = filepath.Join(chartpath, p)
        }

        if _, err = os.Stat(depPath); os.IsNotExist(err) {
                return "", errors.Errorf("directory %s not found", depPath)
        } else if err != nil {
                return "", err
        }

        return depPath, nil
}

//go:build gofuzz
// +build gofuzz

// Copyright 2022 ADA Logics Ltd
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

package resolver

import (
        fuzz "github.com/AdaLogics/go-fuzz-headers"
        "helm.sh/helm/v3/pkg/chart"
        "helm.sh/helm/v3/pkg/registry"
        "os"
)

func FuzzResolve(data []byte) int {
        f := fuzz.NewConsumer(data)
        noOfDeps, err := f.GetInt()
        if err != nil {
                return 0
        }
        deps := make([]*chart.Dependency, 0)
        for i := 0; i < noOfDeps%10; i++ {
                dep := &chart.Dependency{}
                err := f.GenerateStruct(dep)
                if err != nil {
                        return 0
                }
                deps = append(deps, dep)
        }
        chartPath := "chartPath"
        os.Mkdir(chartPath, 0755)
        defer os.RemoveAll(chartPath)
        err = f.CreateFiles(chartPath)
        if err != nil {
                return 0
        }

        repository := "repository"
        os.Mkdir(repository, 0755)
        defer os.RemoveAll(repository)
        err = f.CreateFiles(repository)
        if err != nil {
                return 0
        }

        repoNames := make(map[string]string)
        err = f.FuzzMap(&repoNames)
        if err != nil {
                return 0
        }

        registryClient, _ := registry.NewClient()
        r := New(chartPath, repository, registryClient)

        _, _ = r.Resolve(deps, repoNames)
        return 1
}

/*
Copyright (c) for portions of walk.go are held by The Go Authors, 2009 and are
provided under the BSD license.

https://github.com/golang/go/blob/master/LICENSE

Copyright The Helm Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package sympath

import (
        "log"
        "os"
        "path/filepath"
        "sort"

        "github.com/pkg/errors"
)

// Walk walks the file tree rooted at root, calling walkFn for each file or directory
// in the tree, including root. All errors that arise visiting files and directories
// are filtered by walkFn. The files are walked in lexical order, which makes the
// output deterministic but means that for very large directories Walk can be
// inefficient. Walk follows symbolic links.
func Walk(root string, walkFn filepath.WalkFunc) error {
        info, err := os.Lstat(root)
        if err != nil {
                err = walkFn(root, nil, err)
        } else {
                err = symwalk(root, info, walkFn)
        }
        if err == filepath.SkipDir {
                return nil
        }
        return err
}

// readDirNames reads the directory named by dirname and returns
// a sorted list of directory entries.
func readDirNames(dirname string) ([]string, error) {
        f, err := os.Open(dirname)
        if err != nil {
                return nil, err
        }
        names, err := f.Readdirnames(-1)
        f.Close()
        if err != nil {
                return nil, err
        }
        sort.Strings(names)
        return names, nil
}

// symwalk recursively descends path, calling walkFn.
func symwalk(path string, info os.FileInfo, walkFn filepath.WalkFunc) error {
        // Recursively walk symlinked directories.
        if IsSymlink(info) {
                resolved, err := filepath.EvalSymlinks(path)
                if err != nil {
                        return errors.Wrapf(err, "error evaluating symlink %s", path)
                }
                log.Printf("found symbolic link in path: %s resolves to %s. Contents of linked file included and used", path, resolved)
                if info, err = os.Lstat(resolved); err != nil {
                        return err
                }
                if err := symwalk(path, info, walkFn); err != nil && err != filepath.SkipDir {
                        return err
                }
                return nil
        }

        if err := walkFn(path, info, nil); err != nil {
                return err
        }

        if !info.IsDir() {
                return nil
        }

        names, err := readDirNames(path)
        if err != nil {
                return walkFn(path, info, err)
        }

        for _, name := range names {
                filename := filepath.Join(path, name)
                fileInfo, err := os.Lstat(filename)
                if err != nil {
                        if err := walkFn(filename, fileInfo, err); err != nil && err != filepath.SkipDir {
                                return err
                        }
                } else {
                        err = symwalk(filename, fileInfo, walkFn)
                        if err != nil {
                                if (!fileInfo.IsDir() && !IsSymlink(fileInfo)) || err != filepath.SkipDir {
                                        return err
                                }
                        }
                }
        }
        return nil
}

// IsSymlink is used to determine if the fileinfo is a symbolic link.
func IsSymlink(fi os.FileInfo) bool {
        return fi.Mode()&os.ModeSymlink != 0
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package ensure

import (
        "os"
        "path/filepath"
        "testing"

        "helm.sh/helm/v3/pkg/helmpath"
        "helm.sh/helm/v3/pkg/helmpath/xdg"
)

// HelmHome sets up a Helm Home in a temp dir.
func HelmHome(t *testing.T) {
        t.Helper()
        base := t.TempDir()
        os.Setenv(xdg.CacheHomeEnvVar, base)
        os.Setenv(xdg.ConfigHomeEnvVar, base)
        os.Setenv(xdg.DataHomeEnvVar, base)
        os.Setenv(helmpath.CacheHomeEnvVar, "")
        os.Setenv(helmpath.ConfigHomeEnvVar, "")
        os.Setenv(helmpath.DataHomeEnvVar, "")
}

// TempFile ensures a temp file for unit testing purposes.
//
// It returns the path to the directory (to which you will still need to join the filename)
//
// The returned directory is automatically removed when the test and all its subtests complete.
//
//        tempdir := TempFile(t, "foo", []byte("bar"))
//        filename := filepath.Join(tempdir, "foo")
func TempFile(t *testing.T, name string, data []byte) string {
        path := t.TempDir()
        filename := filepath.Join(path, name)
        if err := os.WriteFile(filename, data, 0755); err != nil {
                t.Fatal(err)
        }
        return path
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package test

import (
        "bytes"
        "flag"
        "os"
        "path/filepath"

        "github.com/pkg/errors"
)

// UpdateGolden writes out the golden files with the latest values, rather than failing the test.
var updateGolden = flag.Bool("update", false, "update golden files")

// TestingT describes a testing object compatible with the critical functions from the testing.T type
type TestingT interface {
        Fatal(...interface{})
        Fatalf(string, ...interface{})
        HelperT
}

// HelperT describes a test with a helper function
type HelperT interface {
        Helper()
}

// AssertGoldenString asserts that the given string matches the contents of the given file.
func AssertGoldenString(t TestingT, actual, filename string) {
        t.Helper()

        if err := compare([]byte(actual), path(filename)); err != nil {
                t.Fatalf("%v\n", err)
        }
}

// AssertGoldenFile asserts that the content of the actual file matches the contents of the expected file
func AssertGoldenFile(t TestingT, actualFileName string, expectedFilename string) {
        t.Helper()

        actual, err := os.ReadFile(actualFileName)
        if err != nil {
                t.Fatalf("%v", err)
        }
        AssertGoldenString(t, string(actual), expectedFilename)
}

func path(filename string) string {
        if filepath.IsAbs(filename) {
                return filename
        }
        return filepath.Join("testdata", filename)
}

func compare(actual []byte, filename string) error {
        actual = normalize(actual)
        if err := update(filename, actual); err != nil {
                return err
        }

        expected, err := os.ReadFile(filename)
        if err != nil {
                return errors.Wrapf(err, "unable to read testdata %s", filename)
        }
        expected = normalize(expected)
        if !bytes.Equal(expected, actual) {
                return errors.Errorf("does not match golden file %s\n\nWANT:\n'%s'\n\nGOT:\n'%s'", filename, expected, actual)
        }
        return nil
}

func update(filename string, in []byte) error {
        if !*updateGolden {
                return nil
        }
        return os.WriteFile(filename, normalize(in), 0666)
}

func normalize(in []byte) []byte {
        return bytes.Replace(in, []byte("\r\n"), []byte("\n"), -1)
}

/*
Copyright (c) for portions of fs.go are held by The Go Authors, 2016 and are provided under
the BSD license.

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are
met:

   * Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
   * Redistributions in binary form must reproduce the above
copyright notice, this list of conditions and the following disclaimer
in the documentation and/or other materials provided with the
distribution.
   * Neither the name of Google Inc. nor the names of its
contributors may be used to endorse or promote products derived from
this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/

package fs

import (
        "io"
        "os"
        "path/filepath"
        "runtime"
        "syscall"

        "github.com/pkg/errors"
)

// fs contains a copy of a few functions from dep tool code to avoid a dependency on golang/dep.
// This code is copied from https://github.com/golang/dep/blob/37d6c560cdf407be7b6cd035b23dba89df9275cf/internal/fs/fs.go
// No changes to the code were made other than removing some unused functions

// RenameWithFallback attempts to rename a file or directory, but falls back to
// copying in the event of a cross-device link error. If the fallback copy
// succeeds, src is still removed, emulating normal rename behavior.
func RenameWithFallback(src, dst string) error {
        _, err := os.Stat(src)
        if err != nil {
                return errors.Wrapf(err, "cannot stat %s", src)
        }

        err = os.Rename(src, dst)
        if err == nil {
                return nil
        }

        return renameFallback(err, src, dst)
}

// renameByCopy attempts to rename a file or directory by copying it to the
// destination and then removing the src thus emulating the rename behavior.
func renameByCopy(src, dst string) error {
        var cerr error
        if dir, _ := IsDir(src); dir {
                cerr = CopyDir(src, dst)
                if cerr != nil {
                        cerr = errors.Wrap(cerr, "copying directory failed")
                }
        } else {
                cerr = copyFile(src, dst)
                if cerr != nil {
                        cerr = errors.Wrap(cerr, "copying file failed")
                }
        }

        if cerr != nil {
                return errors.Wrapf(cerr, "rename fallback failed: cannot rename %s to %s", src, dst)
        }

        return errors.Wrapf(os.RemoveAll(src), "cannot delete %s", src)
}

var (
        errSrcNotDir = errors.New("source is not a directory")
        errDstExist  = errors.New("destination already exists")
)

// CopyDir recursively copies a directory tree, attempting to preserve permissions.
// Source directory must exist, destination directory must *not* exist.
func CopyDir(src, dst string) error {
        src = filepath.Clean(src)
        dst = filepath.Clean(dst)

        // We use os.Lstat() here to ensure we don't fall in a loop where a symlink
        // actually links to a one of its parent directories.
        fi, err := os.Lstat(src)
        if err != nil {
                return err
        }
        if !fi.IsDir() {
                return errSrcNotDir
        }

        _, err = os.Stat(dst)
        if err != nil && !os.IsNotExist(err) {
                return err
        }
        if err == nil {
                return errDstExist
        }

        if err = os.MkdirAll(dst, fi.Mode()); err != nil {
                return errors.Wrapf(err, "cannot mkdir %s", dst)
        }

        entries, err := os.ReadDir(src)
        if err != nil {
                return errors.Wrapf(err, "cannot read directory %s", dst)
        }

        for _, entry := range entries {
                srcPath := filepath.Join(src, entry.Name())
                dstPath := filepath.Join(dst, entry.Name())

                if entry.IsDir() {
                        if err = CopyDir(srcPath, dstPath); err != nil {
                                return errors.Wrap(err, "copying directory failed")
                        }
                } else {
                        // This will include symlinks, which is what we want when
                        // copying things.
                        if err = copyFile(srcPath, dstPath); err != nil {
                                return errors.Wrap(err, "copying file failed")
                        }
                }
        }

        return nil
}

// copyFile copies the contents of the file named src to the file named
// by dst. The file will be created if it does not already exist. If the
// destination file exists, all its contents will be replaced by the contents
// of the source file. The file mode will be copied from the source.
func copyFile(src, dst string) (err error) {
        if sym, err := IsSymlink(src); err != nil {
                return errors.Wrap(err, "symlink check failed")
        } else if sym {
                if err := cloneSymlink(src, dst); err != nil {
                        if runtime.GOOS == "windows" {
                                // If cloning the symlink fails on Windows because the user
                                // does not have the required privileges, ignore the error and
                                // fall back to copying the file contents.
                                //
                                // ERROR_PRIVILEGE_NOT_HELD is 1314 (0x522):
                                // https://msdn.microsoft.com/en-us/library/windows/desktop/ms681385(v=vs.85).aspx
                                if lerr, ok := err.(*os.LinkError); ok && lerr.Err != syscall.Errno(1314) {
                                        return err
                                }
                        } else {
                                return err
                        }
                } else {
                        return nil
                }
        }

        in, err := os.Open(src)
        if err != nil {
                return
        }
        defer in.Close()

        out, err := os.Create(dst)
        if err != nil {
                return
        }

        if _, err = io.Copy(out, in); err != nil {
                out.Close()
                return
        }

        // Check for write errors on Close
        if err = out.Close(); err != nil {
                return
        }

        si, err := os.Stat(src)
        if err != nil {
                return
        }

        // Temporary fix for Go < 1.9
        //
        // See: https://github.com/golang/dep/issues/774
        // and https://github.com/golang/go/issues/20829
        if runtime.GOOS == "windows" {
                dst = fixLongPath(dst)
        }
        err = os.Chmod(dst, si.Mode())

        return
}

// cloneSymlink will create a new symlink that points to the resolved path of sl.
// If sl is a relative symlink, dst will also be a relative symlink.
func cloneSymlink(sl, dst string) error {
        resolved, err := os.Readlink(sl)
        if err != nil {
                return err
        }

        return os.Symlink(resolved, dst)
}

// IsDir determines is the path given is a directory or not.
func IsDir(name string) (bool, error) {
        fi, err := os.Stat(name)
        if err != nil {
                return false, err
        }
        if !fi.IsDir() {
                return false, errors.Errorf("%q is not a directory", name)
        }
        return true, nil
}

// IsSymlink determines if the given path is a symbolic link.
func IsSymlink(path string) (bool, error) {
        l, err := os.Lstat(path)
        if err != nil {
                return false, err
        }

        return l.Mode()&os.ModeSymlink == os.ModeSymlink, nil
}

// fixLongPath returns the extended-length (\\?\-prefixed) form of
// path when needed, in order to avoid the default 260 character file
// path limit imposed by Windows. If path is not easily converted to
// the extended-length form (for example, if path is a relative path
// or contains .. elements), or is short enough, fixLongPath returns
// path unmodified.
//
// See https://msdn.microsoft.com/en-us/library/windows/desktop/aa365247(v=vs.85).aspx#maxpath
func fixLongPath(path string) string {
        // Do nothing (and don't allocate) if the path is "short".
        // Empirically (at least on the Windows Server 2013 builder),
        // the kernel is arbitrarily okay with < 248 bytes. That
        // matches what the docs above say:
        // "When using an API to create a directory, the specified
        // path cannot be so long that you cannot append an 8.3 file
        // name (that is, the directory name cannot exceed MAX_PATH
        // minus 12)." Since MAX_PATH is 260, 260 - 12 = 248.
        //
        // The MSDN docs appear to say that a normal path that is 248 bytes long
        // will work; empirically the path must be less then 248 bytes long.
        if len(path) < 248 {
                // Don't fix. (This is how Go 1.7 and earlier worked,
                // not automatically generating the \\?\ form)
                return path
        }

        // The extended form begins with \\?\, as in
        // \\?\c:\windows\foo.txt or \\?\UNC\server\share\foo.txt.
        // The extended form disables evaluation of . and .. path
        // elements and disables the interpretation of / as equivalent
        // to \. The conversion here rewrites / to \ and elides
        // . elements as well as trailing or duplicate separators. For
        // simplicity it avoids the conversion entirely for relative
        // paths or paths containing .. elements. For now,
        // \\server\share paths are not converted to
        // \\?\UNC\server\share paths because the rules for doing so
        // are less well-specified.
        if len(path) >= 2 && path[:2] == `\\` {
                // Don't canonicalize UNC paths.
                return path
        }
        if !isAbs(path) {
                // Relative path
                return path
        }

        const prefix = `\\?`

        pathbuf := make([]byte, len(prefix)+len(path)+len(`\`))
        copy(pathbuf, prefix)
        n := len(path)
        r, w := 0, len(prefix)
        for r < n {
                switch {
                case os.IsPathSeparator(path[r]):
                        // empty block
                        r++
                case path[r] == '.' && (r+1 == n || os.IsPathSeparator(path[r+1])):
                        // /./
                        r++
                case r+1 < n && path[r] == '.' && path[r+1] == '.' && (r+2 == n || os.IsPathSeparator(path[r+2])):
                        // /../ is currently unhandled
                        return path
                default:
                        pathbuf[w] = '\\'
                        w++
                        for ; r < n && !os.IsPathSeparator(path[r]); r++ {
                                pathbuf[w] = path[r]
                                w++
                        }
                }
        }
        // A drive's root directory needs a trailing \
        if w == len(`\\?\c:`) {
                pathbuf[w] = '\\'
                w++
        }
        return string(pathbuf[:w])
}

func isAbs(path string) (b bool) {
        v := volumeName(path)
        if v == "" {
                return false
        }
        path = path[len(v):]
        if path == "" {
                return false
        }
        return os.IsPathSeparator(path[0])
}

func volumeName(path string) (v string) {
        if len(path) < 2 {
                return ""
        }
        // with drive letter
        c := path[0]
        if path[1] == ':' &&
                ('0' <= c && c <= '9' || 'a' <= c && c <= 'z' ||
                        'A' <= c && c <= 'Z') {
                return path[:2]
        }
        // is it UNC
        if l := len(path); l >= 5 && os.IsPathSeparator(path[0]) && os.IsPathSeparator(path[1]) &&
                !os.IsPathSeparator(path[2]) && path[2] != '.' {
                // first, leading `\\` and next shouldn't be `\`. its server name.
                for n := 3; n < l-1; n++ {
                        // second, next '\' shouldn't be repeated.
                        if os.IsPathSeparator(path[n]) {
                                n++
                                // third, following something characters. its share name.
                                if !os.IsPathSeparator(path[n]) {
                                        if path[n] == '.' {
                                                break
                                        }
                                        for ; n < l; n++ {
                                                if os.IsPathSeparator(path[n]) {
                                                        break
                                                }
                                        }
                                        return path[:n]
                                }
                                break
                        }
                }
        }
        return ""
}

//go:build gofuzz
// +build gofuzz

// Copyright 2022 ADA Logics Ltd
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

package fs

import (
        "fmt"
        fuzz "github.com/AdaLogics/go-fuzz-headers"
        "io/ioutil"
        "os"
        "path/filepath"
        "strings"
)

func FuzzfixLongPath(data []byte) int {
        f := fuzz.NewConsumer(data)
        dirname1, err := f.GetString()
        if err != nil {
                return -1
        }
        dir, err := ioutil.TempDir("", dirname1)
        if err != nil {
                return -1
        }
        defer os.RemoveAll(dir)

        filename1, err := f.GetString()
        if err != nil {
                return -1
        }
        srcfPath := filepath.Join(dir, filename1)
        if !strings.HasPrefix(srcfPath, dir) {
                return -1
        }
        srcf, err := os.Create(srcfPath)
        if err != nil {
                return -1
        }

        want, err := f.GetBytes()
        if err != nil {
                return -1
        }
        if _, err := srcf.Write(want); err != nil {
                return -1
        }
        srcf.Close()

        destfName, err := f.GetString()
        if err != nil {
                return -1
        }
        destf := filepath.Join(dir, destfName)
        if !strings.HasPrefix(destf, dir) {
                return -1
        }
        if err := copyFile(srcf.Name(), destf); err != nil {
                return 0
        }

        got, err := ioutil.ReadFile(destf)
        if err != nil {
                return 0
        }

        got2, err := ioutil.ReadFile(srcfPath)
        if err != nil {
                return 0
        }

        if string(got2) != string(got) {
                fmt.Printf("expected: %s, got: %s\n", want, string(got))
                return 0
        }

        wantinfo, err := os.Stat(srcf.Name())
        if err != nil {
                return 0
        }

        gotinfo, err := os.Stat(destf)
        if err != nil {
                return 0
        }

        if wantinfo.Mode() != gotinfo.Mode() {
                panic(fmt.Sprintf("expected %s: %#v\n to be the same mode as %s: %#v", srcf.Name(), wantinfo.Mode(), destf, gotinfo.Mode()))
        }
        return 1
}

func Fuzz_fixLongPath(data []byte) int {
        _ = fixLongPath(string(data))
        return 1
}

func FuzzCopyDir(data []byte) int {
        srcDir := "srcDir"
        if err := os.MkdirAll(srcDir, 0755); err != nil {
                return 0
        }
        defer os.RemoveAll(srcDir)

        f := fuzz.NewConsumer(data)
        err := f.CreateFiles("src")
        if err != nil {
                return 0
        }

        destDir := "dest"
        if err := os.MkdirAll(destDir, 0755); err != nil {
                return 0
        }
        defer os.RemoveAll(destDir)

        CopyDir(srcDir, destDir)
        return 1
}

//go:build !windows

/*
Copyright (c) for portions of rename.go are held by The Go Authors, 2016 and are provided under
the BSD license.

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are
met:

   * Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
   * Redistributions in binary form must reproduce the above
copyright notice, this list of conditions and the following disclaimer
in the documentation and/or other materials provided with the
distribution.
   * Neither the name of Google Inc. nor the names of its
contributors may be used to endorse or promote products derived from
this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/

package fs

import (
        "os"
        "syscall"

        "github.com/pkg/errors"
)

// renameFallback attempts to determine the appropriate fallback to failed rename
// operation depending on the resulting error.
func renameFallback(err error, src, dst string) error {
        // Rename may fail if src and dst are on different devices; fall back to
        // copy if we detect that case. syscall.EXDEV is the common name for the
        // cross device link error which has varying output text across different
        // operating systems.
        terr, ok := err.(*os.LinkError)
        if !ok {
                return err
        } else if terr.Err != syscall.EXDEV {
                return errors.Wrapf(terr, "link error: cannot rename %s to %s", src, dst)
        }

        return renameByCopy(src, dst)
}

/*
Copyright 2016 The Kubernetes Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package util

import (
        "context"
        "sort"

        apps "k8s.io/api/apps/v1"
        v1 "k8s.io/api/core/v1"
        apiequality "k8s.io/apimachinery/pkg/api/equality"
        metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
        intstrutil "k8s.io/apimachinery/pkg/util/intstr"
        appsclient "k8s.io/client-go/kubernetes/typed/apps/v1"
)

// deploymentutil contains a copy of a few functions from Kubernetes controller code to avoid a dependency on k8s.io/kubernetes.
// This code is copied from https://github.com/kubernetes/kubernetes/blob/e856613dd5bb00bcfaca6974431151b5c06cbed5/pkg/controller/deployment/util/deployment_util.go
// No changes to the code were made other than removing some unused functions

// RsListFunc returns the ReplicaSet from the ReplicaSet namespace and the List metav1.ListOptions.
type RsListFunc func(string, metav1.ListOptions) ([]*apps.ReplicaSet, error)

// ListReplicaSets returns a slice of RSes the given deployment targets.
// Note that this does NOT attempt to reconcile ControllerRef (adopt/orphan),
// because only the controller itself should do that.
// However, it does filter out anything whose ControllerRef doesn't match.
func ListReplicaSets(deployment *apps.Deployment, getRSList RsListFunc) ([]*apps.ReplicaSet, error) {
        // TODO: Right now we list replica sets by their labels. We should list them by selector, i.e. the replica set's selector
        //       should be a superset of the deployment's selector, see https://github.com/kubernetes/kubernetes/issues/19830.
        namespace := deployment.Namespace
        selector, err := metav1.LabelSelectorAsSelector(deployment.Spec.Selector)
        if err != nil {
                return nil, err
        }
        options := metav1.ListOptions{LabelSelector: selector.String()}
        all, err := getRSList(namespace, options)
        if err != nil {
                return nil, err
        }
        // Only include those whose ControllerRef matches the Deployment.
        owned := make([]*apps.ReplicaSet, 0, len(all))
        for _, rs := range all {
                if metav1.IsControlledBy(rs, deployment) {
                        owned = append(owned, rs)
                }
        }
        return owned, nil
}

// ReplicaSetsByCreationTimestamp sorts a list of ReplicaSet by creation timestamp, using their names as a tie breaker.
type ReplicaSetsByCreationTimestamp []*apps.ReplicaSet

func (o ReplicaSetsByCreationTimestamp) Len() int      { return len(o) }
func (o ReplicaSetsByCreationTimestamp) Swap(i, j int) { o[i], o[j] = o[j], o[i] }
func (o ReplicaSetsByCreationTimestamp) Less(i, j int) bool {
        if o[i].CreationTimestamp.Equal(&o[j].CreationTimestamp) {
                return o[i].Name < o[j].Name
        }
        return o[i].CreationTimestamp.Before(&o[j].CreationTimestamp)
}

// FindNewReplicaSet returns the new RS this given deployment targets (the one with the same pod template).
func FindNewReplicaSet(deployment *apps.Deployment, rsList []*apps.ReplicaSet) *apps.ReplicaSet {
        sort.Sort(ReplicaSetsByCreationTimestamp(rsList))
        for i := range rsList {
                if EqualIgnoreHash(&rsList[i].Spec.Template, &deployment.Spec.Template) {
                        // In rare cases, such as after cluster upgrades, Deployment may end up with
                        // having more than one new ReplicaSets that have the same template as its template,
                        // see https://github.com/kubernetes/kubernetes/issues/40415
                        // We deterministically choose the oldest new ReplicaSet.
                        return rsList[i]
                }
        }
        // new ReplicaSet does not exist.
        return nil
}

// EqualIgnoreHash returns true if two given podTemplateSpec are equal, ignoring the diff in value of Labels[pod-template-hash]
// We ignore pod-template-hash because:
//  1. The hash result would be different upon podTemplateSpec API changes
//     (e.g. the addition of a new field will cause the hash code to change)
//  2. The deployment template won't have hash labels
func EqualIgnoreHash(template1, template2 *v1.PodTemplateSpec) bool {
        t1Copy := template1.DeepCopy()
        t2Copy := template2.DeepCopy()
        // Remove hash labels from template.Labels before comparing
        delete(t1Copy.Labels, apps.DefaultDeploymentUniqueLabelKey)
        delete(t2Copy.Labels, apps.DefaultDeploymentUniqueLabelKey)
        return apiequality.Semantic.DeepEqual(t1Copy, t2Copy)
}

// GetNewReplicaSet returns a replica set that matches the intent of the given deployment; get ReplicaSetList from client interface.
// Returns nil if the new replica set doesn't exist yet.
func GetNewReplicaSet(deployment *apps.Deployment, c appsclient.AppsV1Interface) (*apps.ReplicaSet, error) {
        rsList, err := ListReplicaSets(deployment, RsListFromClient(c))
        if err != nil {
                return nil, err
        }
        return FindNewReplicaSet(deployment, rsList), nil
}

// RsListFromClient returns an rsListFunc that wraps the given client.
func RsListFromClient(c appsclient.AppsV1Interface) RsListFunc {
        return func(namespace string, options metav1.ListOptions) ([]*apps.ReplicaSet, error) {
                rsList, err := c.ReplicaSets(namespace).List(context.Background(), options)
                if err != nil {
                        return nil, err
                }
                var ret []*apps.ReplicaSet
                for i := range rsList.Items {
                        ret = append(ret, &rsList.Items[i])
                }
                return ret, err
        }
}

// IsRollingUpdate returns true if the strategy type is a rolling update.
func IsRollingUpdate(deployment *apps.Deployment) bool {
        return deployment.Spec.Strategy.Type == apps.RollingUpdateDeploymentStrategyType
}

// MaxUnavailable returns the maximum unavailable pods a rolling deployment can take.
func MaxUnavailable(deployment apps.Deployment) int32 {
        if !IsRollingUpdate(&deployment) || *(deployment.Spec.Replicas) == 0 {
                return int32(0)
        }
        // Error caught by validation
        _, maxUnavailable, _ := ResolveFenceposts(deployment.Spec.Strategy.RollingUpdate.MaxSurge, deployment.Spec.Strategy.RollingUpdate.MaxUnavailable, *(deployment.Spec.Replicas))
        if maxUnavailable > *deployment.Spec.Replicas {
                return *deployment.Spec.Replicas
        }
        return maxUnavailable
}

// ResolveFenceposts resolves both maxSurge and maxUnavailable. This needs to happen in one
// step. For example:
//
// 2 desired, max unavailable 1%, surge 0% - should scale old(-1), then new(+1), then old(-1), then new(+1)
// 1 desired, max unavailable 1%, surge 0% - should scale old(-1), then new(+1)
// 2 desired, max unavailable 25%, surge 1% - should scale new(+1), then old(-1), then new(+1), then old(-1)
// 1 desired, max unavailable 25%, surge 1% - should scale new(+1), then old(-1)
// 2 desired, max unavailable 0%, surge 1% - should scale new(+1), then old(-1), then new(+1), then old(-1)
// 1 desired, max unavailable 0%, surge 1% - should scale new(+1), then old(-1)
func ResolveFenceposts(maxSurge, maxUnavailable *intstrutil.IntOrString, desired int32) (int32, int32, error) {
        surge, err := intstrutil.GetValueFromIntOrPercent(intstrutil.ValueOrDefault(maxSurge, intstrutil.FromInt(0)), int(desired), true)
        if err != nil {
                return 0, 0, err
        }
        unavailable, err := intstrutil.GetValueFromIntOrPercent(intstrutil.ValueOrDefault(maxUnavailable, intstrutil.FromInt(0)), int(desired), false)
        if err != nil {
                return 0, 0, err
        }

        if surge == 0 && unavailable == 0 {
                // Validation should never allow the user to explicitly use zero values for both maxSurge
                // maxUnavailable. Due to rounding down maxUnavailable though, it may resolve to zero.
                // If both fenceposts resolve to zero, then we should set maxUnavailable to 1 on the
                // theory that surge might not work due to quota.
                unavailable = 1
        }

        return int32(surge), int32(unavailable), nil
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package tlsutil

import (
        "crypto/tls"
        "crypto/x509"
        "os"

        "github.com/pkg/errors"
)

// Options represents configurable options used to create client and server TLS configurations.
type Options struct {
        CaCertFile string
        // If either the KeyFile or CertFile is empty, ClientConfig() will not load them.
        KeyFile  string
        CertFile string
        // Client-only options
        InsecureSkipVerify bool
}

// ClientConfig returns a TLS configuration for use by a Helm client.
func ClientConfig(opts Options) (cfg *tls.Config, err error) {
        var cert *tls.Certificate
        var pool *x509.CertPool

        if opts.CertFile != "" || opts.KeyFile != "" {
                if cert, err = CertFromFilePair(opts.CertFile, opts.KeyFile); err != nil {
                        if os.IsNotExist(err) {
                                return nil, errors.Wrapf(err, "could not load x509 key pair (cert: %q, key: %q)", opts.CertFile, opts.KeyFile)
                        }
                        return nil, errors.Wrapf(err, "could not read x509 key pair (cert: %q, key: %q)", opts.CertFile, opts.KeyFile)
                }
        }
        if !opts.InsecureSkipVerify && opts.CaCertFile != "" {
                if pool, err = CertPoolFromFile(opts.CaCertFile); err != nil {
                        return nil, err
                }
        }

        cfg = &tls.Config{InsecureSkipVerify: opts.InsecureSkipVerify, Certificates: []tls.Certificate{*cert}, RootCAs: pool}
        return cfg, nil
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package tlsutil

import (
        "crypto/tls"
        "crypto/x509"
        "os"

        "github.com/pkg/errors"
)

// NewClientTLS returns tls.Config appropriate for client auth.
func NewClientTLS(certFile, keyFile, caFile string, insecureSkipTLSverify bool) (*tls.Config, error) {
        config := tls.Config{
                InsecureSkipVerify: insecureSkipTLSverify,
        }

        if certFile != "" && keyFile != "" {
                cert, err := CertFromFilePair(certFile, keyFile)
                if err != nil {
                        return nil, err
                }
                config.Certificates = []tls.Certificate{*cert}
        }

        if caFile != "" {
                cp, err := CertPoolFromFile(caFile)
                if err != nil {
                        return nil, err
                }
                config.RootCAs = cp
        }

        return &config, nil
}

// CertPoolFromFile returns an x509.CertPool containing the certificates
// in the given PEM-encoded file.
// Returns an error if the file could not be read, a certificate could not
// be parsed, or if the file does not contain any certificates
func CertPoolFromFile(filename string) (*x509.CertPool, error) {
        b, err := os.ReadFile(filename)
        if err != nil {
                return nil, errors.Errorf("can't read CA file: %v", filename)
        }
        cp := x509.NewCertPool()
        if !cp.AppendCertsFromPEM(b) {
                return nil, errors.Errorf("failed to append certificates from file: %s", filename)
        }
        return cp, nil
}

// CertFromFilePair returns an tls.Certificate containing the
// certificates public/private key pair from a pair of given PEM-encoded files.
// Returns an error if the file could not be read, a certificate could not
// be parsed, or if the file does not contain any certificates
func CertFromFilePair(certFile, keyFile string) (*tls.Certificate, error) {
        cert, err := tls.LoadX509KeyPair(certFile, keyFile)
        if err != nil {
                return nil, errors.Wrapf(err, "can't load key pair from cert %s and key %s", certFile, keyFile)
        }
        return &cert, err
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package urlutil

import (
        "net/url"
        "path"
        "path/filepath"
)

// URLJoin joins a base URL to one or more path components.
//
// It's like filepath.Join for URLs. If the baseURL is pathish, this will still
// perform a join.
//
// If the URL is unparsable, this returns an error.
func URLJoin(baseURL string, paths ...string) (string, error) {
        u, err := url.Parse(baseURL)
        if err != nil {
                return "", err
        }
        // We want path instead of filepath because path always uses /.
        all := []string{u.Path}
        all = append(all, paths...)
        u.Path = path.Join(all...)
        return u.String(), nil
}

// Equal normalizes two URLs and then compares for equality.
func Equal(a, b string) bool {
        au, err := url.Parse(a)
        if err != nil {
                a = filepath.Clean(a)
                b = filepath.Clean(b)
                // If urls are paths, return true only if they are an exact match
                return a == b
        }
        bu, err := url.Parse(b)
        if err != nil {
                return false
        }

        for _, u := range []*url.URL{au, bu} {
                if u.Path == "" {
                        u.Path = "/"
                }
                u.Path = filepath.Clean(u.Path)
        }
        return au.String() == bu.String()
}

// ExtractHostname returns hostname from URL
func ExtractHostname(addr string) (string, error) {
        u, err := url.Parse(addr)
        if err != nil {
                return "", err
        }
        return u.Hostname(), nil
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package version // import "helm.sh/helm/v3/internal/version"

import (
        "flag"
        "runtime"
        "strings"
)

var (
        // version is the current version of Helm.
        // Update this whenever making a new release.
        // The version is of the format Major.Minor.Patch[-Prerelease][+BuildMetadata]
        //
        // Increment major number for new feature additions and behavioral changes.
        // Increment minor number for bug fixes and performance enhancements.
        version = "v3.13"

        // metadata is extra build time data
        metadata = ""
        // gitCommit is the git sha1
        gitCommit = ""
        // gitTreeState is the state of the git tree
        gitTreeState = ""
)

// BuildInfo describes the compile time information.
type BuildInfo struct {
        // Version is the current semver.
        Version string `json:"version,omitempty"`
        // GitCommit is the git sha1.
        GitCommit string `json:"git_commit,omitempty"`
        // GitTreeState is the state of the git tree.
        GitTreeState string `json:"git_tree_state,omitempty"`
        // GoVersion is the version of the Go compiler used.
        GoVersion string `json:"go_version,omitempty"`
}

// GetVersion returns the semver string of the version
func GetVersion() string {
        if metadata == "" {
                return version
        }
        return version + "+" + metadata
}

// GetUserAgent returns a user agent for user with an HTTP client
func GetUserAgent() string {
        return "Helm/" + strings.TrimPrefix(GetVersion(), "v")
}

// Get returns build info
func Get() BuildInfo {
        v := BuildInfo{
                Version:      GetVersion(),
                GitCommit:    gitCommit,
                GitTreeState: gitTreeState,
                GoVersion:    runtime.Version(),
        }

        // HACK(bacongobbler): strip out GoVersion during a test run for consistent test output
        if flag.Lookup("test.v") != nil {
                v.GoVersion = ""
        }
        return v
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package action

import (
        "bytes"
        "fmt"
        "os"
        "path"
        "path/filepath"
        "regexp"
        "strings"

        "github.com/pkg/errors"
        "k8s.io/apimachinery/pkg/api/meta"
        "k8s.io/cli-runtime/pkg/genericclioptions"
        "k8s.io/client-go/discovery"
        "k8s.io/client-go/kubernetes"
        "k8s.io/client-go/rest"

        "helm.sh/helm/v3/pkg/chart"
        "helm.sh/helm/v3/pkg/chartutil"
        "helm.sh/helm/v3/pkg/engine"
        "helm.sh/helm/v3/pkg/kube"
        "helm.sh/helm/v3/pkg/postrender"
        "helm.sh/helm/v3/pkg/registry"
        "helm.sh/helm/v3/pkg/release"
        "helm.sh/helm/v3/pkg/releaseutil"
        "helm.sh/helm/v3/pkg/storage"
        "helm.sh/helm/v3/pkg/storage/driver"
        "helm.sh/helm/v3/pkg/time"
)

// Timestamper is a function capable of producing a timestamp.Timestamper.
//
// By default, this is a time.Time function from the Helm time package. This can
// be overridden for testing though, so that timestamps are predictable.
var Timestamper = time.Now

var (
        // errMissingChart indicates that a chart was not provided.
        errMissingChart = errors.New("no chart provided")
        // errMissingRelease indicates that a release (name) was not provided.
        errMissingRelease = errors.New("no release provided")
        // errInvalidRevision indicates that an invalid release revision number was provided.
        errInvalidRevision = errors.New("invalid release revision")
        // errPending indicates that another instance of Helm is already applying an operation on a release.
        errPending = errors.New("another operation (install/upgrade/rollback) is in progress")
)

// ValidName is a regular expression for resource names.
//
// DEPRECATED: This will be removed in Helm 4, and is no longer used here. See
// pkg/lint/rules.validateMetadataNameFunc for the replacement.
//
// According to the Kubernetes help text, the regular expression it uses is:
//
//        [a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*
//
// This follows the above regular expression (but requires a full string match, not partial).
//
// The Kubernetes documentation is here, though it is not entirely correct:
// https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
var ValidName = regexp.MustCompile(`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`)

// Configuration injects the dependencies that all actions share.
type Configuration struct {
        // RESTClientGetter is an interface that loads Kubernetes clients.
        RESTClientGetter RESTClientGetter

        // Releases stores records of releases.
        Releases *storage.Storage

        // KubeClient is a Kubernetes API client.
        KubeClient kube.Interface

        // RegistryClient is a client for working with registries
        RegistryClient *registry.Client

        // Capabilities describes the capabilities of the Kubernetes cluster.
        Capabilities *chartutil.Capabilities

        Log func(string, ...interface{})
}

// renderResources renders the templates in a chart
//
// TODO: This function is badly in need of a refactor.
// TODO: As part of the refactor the duplicate code in cmd/helm/template.go should be removed
//
//        This code has to do with writing files to disk.
func (cfg *Configuration) renderResources(ch *chart.Chart, values chartutil.Values, releaseName, outputDir string, subNotes, useReleaseName, includeCrds bool, pr postrender.PostRenderer, interactWithRemote, enableDNS bool) ([]*release.Hook, *bytes.Buffer, string, error) {
        hs := []*release.Hook{}
        b := bytes.NewBuffer(nil)

        caps, err := cfg.getCapabilities()
        if err != nil {
                return hs, b, "", err
        }

        if ch.Metadata.KubeVersion != "" {
                if !chartutil.IsCompatibleRange(ch.Metadata.KubeVersion, caps.KubeVersion.String()) {
                        return hs, b, "", errors.Errorf("chart requires kubeVersion: %s which is incompatible with Kubernetes %s", ch.Metadata.KubeVersion, caps.KubeVersion.String())
                }
        }

        var files map[string]string
        var err2 error

        // A `helm template` should not talk to the remote cluster. However, commands with the flag
        //`--dry-run` with the value of `false`, `none`, or `server` should try to interact with the cluster.
        // It may break in interesting and exotic ways because other data (e.g. discovery) is mocked.
        if interactWithRemote && cfg.RESTClientGetter != nil {
                restConfig, err := cfg.RESTClientGetter.ToRESTConfig()
                if err != nil {
                        return hs, b, "", err
                }
                e := engine.New(restConfig)
                e.EnableDNS = enableDNS
                files, err2 = e.Render(ch, values)
        } else {
                var e engine.Engine
                e.EnableDNS = enableDNS
                files, err2 = e.Render(ch, values)
        }

        if err2 != nil {
                return hs, b, "", err2
        }

        // NOTES.txt gets rendered like all the other files, but because it's not a hook nor a resource,
        // pull it out of here into a separate file so that we can actually use the output of the rendered
        // text file. We have to spin through this map because the file contains path information, so we
        // look for terminating NOTES.txt. We also remove it from the files so that we don't have to skip
        // it in the sortHooks.
        var notesBuffer bytes.Buffer
        for k, v := range files {
                if strings.HasSuffix(k, notesFileSuffix) {
                        if subNotes || (k == path.Join(ch.Name(), "templates", notesFileSuffix)) {
                                // If buffer contains data, add newline before adding more
                                if notesBuffer.Len() > 0 {
                                        notesBuffer.WriteString("\n")
                                }
                                notesBuffer.WriteString(v)
                        }
                        delete(files, k)
                }
        }
        notes := notesBuffer.String()

        // Sort hooks, manifests, and partials. Only hooks and manifests are returned,
        // as partials are not used after renderer.Render. Empty manifests are also
        // removed here.
        hs, manifests, err := releaseutil.SortManifests(files, caps.APIVersions, releaseutil.InstallOrder)
        if err != nil {
                // By catching parse errors here, we can prevent bogus releases from going
                // to Kubernetes.
                //
                // We return the files as a big blob of data to help the user debug parser
                // errors.
                for name, content := range files {
                        if strings.TrimSpace(content) == "" {
                                continue
                        }
                        fmt.Fprintf(b, "---\n# Source: %s\n%s\n", name, content)
                }
                return hs, b, "", err
        }

        // Aggregate all valid manifests into one big doc.
        fileWritten := make(map[string]bool)

        if includeCrds {
                for _, crd := range ch.CRDObjects() {
                        if outputDir == "" {
                                fmt.Fprintf(b, "---\n# Source: %s\n%s\n", crd.Filename, string(crd.File.Data[:]))
                        } else {
                                err = writeToFile(outputDir, crd.Filename, string(crd.File.Data[:]), fileWritten[crd.Filename])
                                if err != nil {
                                        return hs, b, "", err
                                }
                                fileWritten[crd.Filename] = true
                        }
                }
        }

        for _, m := range manifests {
                if outputDir == "" {
                        fmt.Fprintf(b, "---\n# Source: %s\n%s\n", m.Name, m.Content)
                } else {
                        newDir := outputDir
                        if useReleaseName {
                                newDir = filepath.Join(outputDir, releaseName)
                        }
                        // NOTE: We do not have to worry about the post-renderer because
                        // output dir is only used by `helm template`. In the next major
                        // release, we should move this logic to template only as it is not
                        // used by install or upgrade
                        err = writeToFile(newDir, m.Name, m.Content, fileWritten[m.Name])
                        if err != nil {
                                return hs, b, "", err
                        }
                        fileWritten[m.Name] = true
                }
        }

        if pr != nil {
                b, err = pr.Run(b)
                if err != nil {
                        return hs, b, notes, errors.Wrap(err, "error while running post render on files")
                }
        }

        return hs, b, notes, nil
}

// RESTClientGetter gets the rest client
type RESTClientGetter interface {
        ToRESTConfig() (*rest.Config, error)
        ToDiscoveryClient() (discovery.CachedDiscoveryInterface, error)
        ToRESTMapper() (meta.RESTMapper, error)
}

// DebugLog sets the logger that writes debug strings
type DebugLog func(format string, v ...interface{})

// capabilities builds a Capabilities from discovery information.
func (cfg *Configuration) getCapabilities() (*chartutil.Capabilities, error) {
        if cfg.Capabilities != nil {
                return cfg.Capabilities, nil
        }
        dc, err := cfg.RESTClientGetter.ToDiscoveryClient()
        if err != nil {
                return nil, errors.Wrap(err, "could not get Kubernetes discovery client")
        }
        // force a discovery cache invalidation to always fetch the latest server version/capabilities.
        dc.Invalidate()
        kubeVersion, err := dc.ServerVersion()
        if err != nil {
                return nil, errors.Wrap(err, "could not get server version from Kubernetes")
        }
        // Issue #6361:
        // Client-Go emits an error when an API service is registered but unimplemented.
        // We trap that error here and print a warning. But since the discovery client continues
        // building the API object, it is correctly populated with all valid APIs.
        // See https://github.com/kubernetes/kubernetes/issues/72051#issuecomment-521157642
        apiVersions, err := GetVersionSet(dc)
        if err != nil {
                if discovery.IsGroupDiscoveryFailedError(err) {
                        cfg.Log("WARNING: The Kubernetes server has an orphaned API service. Server reports: %s", err)
                        cfg.Log("WARNING: To fix this, kubectl delete apiservice <service-name>")
                } else {
                        return nil, errors.Wrap(err, "could not get apiVersions from Kubernetes")
                }
        }

        cfg.Capabilities = &chartutil.Capabilities{
                APIVersions: apiVersions,
                KubeVersion: chartutil.KubeVersion{
                        Version: kubeVersion.GitVersion,
                        Major:   kubeVersion.Major,
                        Minor:   kubeVersion.Minor,
                },
                HelmVersion: chartutil.DefaultCapabilities.HelmVersion,
        }
        return cfg.Capabilities, nil
}

// KubernetesClientSet creates a new kubernetes ClientSet based on the configuration
func (cfg *Configuration) KubernetesClientSet() (kubernetes.Interface, error) {
        conf, err := cfg.RESTClientGetter.ToRESTConfig()
        if err != nil {
                return nil, errors.Wrap(err, "unable to generate config for kubernetes client")
        }

        return kubernetes.NewForConfig(conf)
}

// Now generates a timestamp
//
// If the configuration has a Timestamper on it, that will be used.
// Otherwise, this will use time.Now().
func (cfg *Configuration) Now() time.Time {
        return Timestamper()
}

func (cfg *Configuration) releaseContent(name string, version int) (*release.Release, error) {
        if err := chartutil.ValidateReleaseName(name); err != nil {
                return nil, errors.Errorf("releaseContent: Release name is invalid: %s", name)
        }

        if version <= 0 {
                return cfg.Releases.Last(name)
        }

        return cfg.Releases.Get(name, version)
}

// GetVersionSet retrieves a set of available k8s API versions
func GetVersionSet(client discovery.ServerResourcesInterface) (chartutil.VersionSet, error) {
        groups, resources, err := client.ServerGroupsAndResources()
        if err != nil && !discovery.IsGroupDiscoveryFailedError(err) {
                return chartutil.DefaultVersionSet, errors.Wrap(err, "could not get apiVersions from Kubernetes")
        }

        // FIXME: The Kubernetes test fixture for cli appears to always return nil
        // for calls to Discovery().ServerGroupsAndResources(). So in this case, we
        // return the default API list. This is also a safe value to return in any
        // other odd-ball case.
        if len(groups) == 0 && len(resources) == 0 {
                return chartutil.DefaultVersionSet, nil
        }

        versionMap := make(map[string]interface{})
        versions := []string{}

        // Extract the groups
        for _, g := range groups {
                for _, gv := range g.Versions {
                        versionMap[gv.GroupVersion] = struct{}{}
                }
        }

        // Extract the resources
        var id string
        var ok bool
        for _, r := range resources {
                for _, rl := range r.APIResources {

                        // A Kind at a GroupVersion can show up more than once. We only want
                        // it displayed once in the final output.
                        id = path.Join(r.GroupVersion, rl.Kind)
                        if _, ok = versionMap[id]; !ok {
                                versionMap[id] = struct{}{}
                        }
                }
        }

        // Convert to a form that NewVersionSet can use
        for k := range versionMap {
                versions = append(versions, k)
        }

        return chartutil.VersionSet(versions), nil
}

// recordRelease with an update operation in case reuse has been set.
func (cfg *Configuration) recordRelease(r *release.Release) {
        if err := cfg.Releases.Update(r); err != nil {
                cfg.Log("warning: Failed to update release %s: %s", r.Name, err)
        }
}

// Init initializes the action configuration
func (cfg *Configuration) Init(getter genericclioptions.RESTClientGetter, namespace, helmDriver string, log DebugLog) error {
        kc := kube.New(getter)
        kc.Log = log

        lazyClient := &lazyClient{
                namespace: namespace,
                clientFn:  kc.Factory.KubernetesClientSet,
        }

        var store *storage.Storage
        switch helmDriver {
        case "secret", "secrets", "":
                d := driver.NewSecrets(newSecretClient(lazyClient))
                d.Log = log
                store = storage.Init(d)
        case "configmap", "configmaps":
                d := driver.NewConfigMaps(newConfigMapClient(lazyClient))
                d.Log = log
                store = storage.Init(d)
        case "memory":
                var d *driver.Memory
                if cfg.Releases != nil {
                        if mem, ok := cfg.Releases.Driver.(*driver.Memory); ok {
                                // This function can be called more than once (e.g., helm list --all-namespaces).
                                // If a memory driver was already initialized, re-use it but set the possibly new namespace.
                                // We re-use it in case some releases where already created in the existing memory driver.
                                d = mem
                        }
                }
                if d == nil {
                        d = driver.NewMemory()
                }
                d.SetNamespace(namespace)
                store = storage.Init(d)
        case "sql":
                d, err := driver.NewSQL(
                        os.Getenv("HELM_DRIVER_SQL_CONNECTION_STRING"),
                        log,
                        namespace,
                )
                if err != nil {
                        panic(fmt.Sprintf("Unable to instantiate SQL driver: %v", err))
                }
                store = storage.Init(d)
        default:
                // Not sure what to do here.
                panic("Unknown driver in HELM_DRIVER: " + helmDriver)
        }

        cfg.RESTClientGetter = getter
        cfg.KubeClient = kc
        cfg.Releases = store
        cfg.Log = log

        return nil
}

//go:build gofuzz
// +build gofuzz

// Copyright 2022 ADA Logics Ltd
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

package action

import (
        "bytes"
        "fmt"
        "os"
        fuzz "github.com/AdaLogics/go-fuzz-headers"
        "helm.sh/helm/v3/pkg/chart"
        kubefake "helm.sh/helm/v3/pkg/kube/fake"
        "helm.sh/helm/v3/pkg/release"
        "testing"
)

func FuzzActionRun(data []byte) int {
        f := fuzz.NewConsumer(data)
        newChart := &chart.Chart{}
        err := f.GenerateStruct(newChart)
        if err != nil {
                return 0
        }

        t := &testing.T{}
        rel := &release.Release{}
        err = f.GenerateStruct(rel)
        if err != nil {
                return 0
        }

        relName, err := f.GetStringFrom("abcdefghijklmnopqrstuvwxyz0123456789-.", 52)
    if err != nil {
            return 0
    }
    rel.Name = relName
    rel.Info.Status = release.StatusDeployed

        upAction := upgradeAction(t)
        err = upAction.cfg.Releases.Create(rel)
        if err != nil {
                return 0
        }

        failer := upAction.cfg.KubeClient.(*kubefake.FailingKubeClient)
        failer.WaitError = fmt.Errorf("I timed out")
        failer.DeleteError = fmt.Errorf("I tried to delete nil")
        upAction.cfg.KubeClient = failer
        upAction.Wait = true
        upAction.CleanupOnFail = true
        vals := map[string]interface{}{}

        _, _ = upAction.Run(rel.Name, newChart, vals)
        return 1
}

func FuzzShowRun(data []byte) int {
        client := NewShow(ShowAll)
        newChart := &chart.Chart{}

        f := fuzz.NewConsumer(data)
        err := f.GenerateStruct(newChart)
        if err != nil {
                return 0
        }

        client.chart = newChart
        _, _ = client.Run("")
        return 1
}

func FuzzDependencyList(data []byte) int {
        f := fuzz.NewConsumer(data)
        err := os.Mkdir("fuzz-test-data", 0755)
        if err != nil {
                return 0
        }
        defer os.RemoveAll("fuzz-test-data")
        err = f.CreateFiles("fuzz-test-data")
        if err != nil {
                return 0
        }
        buf := bytes.Buffer{}
        NewDependency().List("fuzz-test-data", &buf)
        return 1
}

func FuzzActionList(data []byte) int {
        f := fuzz.NewConsumer(data)
        rls1 := &release.Release{}
        err := f.GenerateStruct(rls1)
        if err != nil {
                return 0
        }
        rls2 := &release.Release{}
        err = f.GenerateStruct(rls2)
        if err != nil {
                return 0
        }

        lister := &List{}
        err = f.GenerateStruct(lister)
        if err != nil {
                return 0
        }

        t := &testing.T{}
        cfg := actionConfigFixture(t)
        lister.cfg = cfg
        //lister := newListFixture(t)

        if err = lister.cfg.Releases.Create(rls1); err != nil {
                return 0
        }
        if err = lister.cfg.Releases.Create(rls2); err != nil {
                return 0
        }
        _, _ = lister.Run()
        return 1
}

func FuzzActionUninstall(data []byte) int {
        f := fuzz.NewConsumer(data)
        rls1 := &release.Release{}
        err := f.GenerateStruct(rls1)
        if err != nil {
                return 0
        }

        t := &testing.T{}
        unAction := uninstallAction(t)
        unAction.DisableHooks = true
        unAction.DryRun = false
        unAction.Wait = false
        unAction.KeepHistory = true

        if err = unAction.cfg.Releases.Create(rls1); err != nil {
                return 0
        }

        unAction.cfg.Releases.Create(rls1)
        failer := unAction.cfg.KubeClient.(*kubefake.FailingKubeClient)
        failer.WaitError = fmt.Errorf("U timed out")
        unAction.cfg.KubeClient = failer
        _, _ = unAction.Run(rls1.Name)
        return 1
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

        http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package action

import (
        "flag"
        "io"
        "testing"

        fakeclientset "k8s.io/client-go/kubernetes/fake"

        "helm.sh/helm/v3/pkg/chart"
        "helm.sh/helm/v3/pkg/chartutil"
        kubefake "helm.sh/helm/v3/pkg/kube/fake"
        "helm.sh/helm/v3/pkg/registry"
        "helm.sh/helm/v3/pkg/release"
        "helm.sh/helm/v3/pkg/storage"
        "helm.sh/helm/v3/pkg/storage/driver"
        "helm.sh/helm/v3/pkg/time"
)

var verbose = flag.Bool("test.log", false, "enable test logging")

func actionConfigFixture(t *testing.T) *Configuration {
        t.Helper()

        registryClient, err := registry.NewClient()
        if err != nil {
                t.Fatal(err)
        }

        return &Configuration{
                Releases:       storage.Init(driver.NewMemory()),
                KubeClient:     &kubefake.FailingKubeClient{PrintingKubeClient: kubefake.PrintingKubeClient{Out: io.Discard}},
                Capabilities:   chartutil.DefaultCapabilities,
                RegistryClient: registryClient,
                Log: func(format string, v ...interface{}) {
                        t.Helper()
                        if *verbose {
                                t.Logf(format, v...)
                        }
                },
        }
}

var manifestWithHook = `kind: ConfigMap
metadata:
  name: test-cm
  annotations:
    "helm.sh/hook": post-install,pre-delete,post-upgrade
data:
  name: value`

var manifestWithTestHook = `kind: Pod
  metadata:
        name: finding-nemo,
        annotations:
          "helm.sh/hook": test
  spec:
        containers:
        - name: nemo-test
          image: fake-image
          cmd: fake-command
  `

var rbacManifests = `apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: schedule-agents
rules:
- apiGroups: [""]
  resources: ["pods", "pods/exec", "pods/log"]
  verbs: ["*"]

---

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: schedule-agents
  namespace: {{ default .Release.Namespace}}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: schedule-agents
subjects:
- kind: ServiceAccount
  name: schedule-agents
  namespace: {{ .Release.Namespace }}
`

type chartOptions struct {
        *chart.Chart
}

type chartOption func(*chartOptions)

func buildChart(opts ...chartOption) *chart.Chart {
        c := &chartOptions{
                Chart: &chart.Chart{
                        // TODO: This should be more complete.
                        Metadata: &chart.Metadata{
                                APIVersion: "v1",
                                Name:       "hello",
                                Version:    "0.1.0",
                        },
                        // This adds a basic template and hooks.
                        Templates: []*chart.File{
                                {Name: "templates/hello", Data: []byte("hello: world")},
                                {Name: "templates/hooks", Data: []byte(manifestWithHook)},
                        },
                },
        }

        for _, opt := range opts {
                opt(c)
        }

        return c.Chart
}

func withName(name string) chartOption {
        return func(opts *chartOptions) {
                opts.Metadata.Name = name
        }
}

func withSampleValues() chartOption {
        values := map[string]interface{}{
                "someKey": "someValue",
                "nestedKey": map[string]interface{}{
                        "simpleKey": "simpleValue",
                        "anotherNestedKey": map[string]interface{}{
                                "yetAnotherNestedKey": map[string]interface{}{
                                        "youReadyForAnotherNestedKey": "No",
                                },
                        },
                },
        }
        return func(opts *chartOptions) {
                opts.Values = values
        }
}

func withValues(values map[string]interface{}) chartOption {
        return func(opts *chartOptions) {
                opts.Values = values
        }
}

func withNotes(notes string) chartOption {
        return func(opts *chartOptions) {
                opts.Templates = append(opts.Templates, &chart.File{
                        Name: "templates/NOTES.txt",
                        Data: []byte(notes),
                })
        }
}

func withDependency(dependencyOpts ...chartOption) chartOption {
        return func(opts *chartOptions) {
                opts.AddDependency(buildChart(dependencyOpts...))
        }
}

func withMetadataDependency(dependency chart.Dependency) chartOption {
        return func(opts *chartOptions) {
                opts.Metadata.Dependencies = append(opts.Metadata.Dependencies, &dependency)
        }
}

func withSampleTemplates() chartOption {
        return func(opts *chartOptions) {
                sampleTemplates := []*chart.File{
                        // This adds basic templates and partials.
                        {Name: "templates/goodbye", Data: []byte("goodbye: world")},
                        {Name: "templates/empty", Data: []byte("")},
                        {Name: "templates/with-partials", Data: []byte(`hello: {{ template "_planet" . }}`)},
                        {Name: "templates/partials/_planet", Data: []byte(`{{define "_planet"}}Earth{{end}}`)},
                }
                opts.Templates = append(opts.Templates, sampleTemplates...)
        }
}

func withSampleIncludingIncorrectTemplates() chartOption {
        return func(opts *chartOptions) {
                sampleTemplates := []*chart.File{
                        // This adds basic templates and partials.
                        {Name: "templates/goodbye", Data: []byte("goodbye: world")},
                        {Name: "templates/empty", Data: []byte("")},
                        {Name: "templates/incorrect", Data: []byte("{{ .Values.bad.doh }}")},
                        {Name: "templates/with-partials", Data: []byte(`hello: {{ template "_planet" . }}`)},
                        {Name: "templates/partials/_planet", Data: []byte(`{{define "_planet"}}Earth{{end}}`)},
                }
                opts.Templates = append(opts.Templates, sampleTemplates...)
        }
}

func withMultipleManifestTemplate() chartOption {
        return func(opts *chartOptions) {
                sampleTemplates := []*chart.File{
                        {Name: "templates/rbac", Data: []byte(rbacManifests)},
                }
                opts.Templates = append(opts.Templates, sampleTemplates...)
        }
}

func withKube(version string) chartOption {
        return func(opts *chartOptions) {
                opts.Metadata.KubeVersion = version
        }
}

// releaseStub creates a release stub, complete with the chartStub as its chart.
func releaseStub() *release.Release {
        return namedReleaseStub("angry-panda", release.StatusDeployed)
}

func namedReleaseStub(name string, status release.Status) *release.Release {
        now := time.Now()
        return &release.Release{
                Name: name,
                Info: &release.Info{
                        FirstDeployed: now,
                        LastDeployed:  now,
                        Status:        status,
                        Description:   "Named Release Stub",
                },
                Chart:   buildChart(withSampleTemplates()),
                Config:  map[string]interface{}{"name": "value"},
                Version: 1,
                Hooks: []*release.Hook{
                        {
                                Name:     "test-cm",
                                Kind:     "ConfigMap",
                                Path:     "test-cm",
                                Manifest: manifestWithHook,
                                Events: []release.HookEvent{
                                        release.HookPostInstall,
                                        release.HookPreDelete,
                                },
                        },
                        {
                                Name:     "finding-nemo",
                                Kind:     "Pod",
                                Path:     "finding-nemo",
                                Manifest: manifestWithTestHook,
                                Events: []release.HookEvent{
                                        release.HookTest,
                                },
                        },
                },
        }
}

func TestGetVersionSet(t *testing.T) {
        client := fakeclientset.NewSimpleClientset()

        vs, err := GetVersionSet(client.Discovery())
        if err != nil {
                t.Error(err)
        }

        if !vs.Has("v1") {
                t.Errorf("Expected supported versions to at least include v1.")
        }
        if vs.Has("nosuchversion/v1") {
                t.Error("Non-existent version is reported found.")
        }
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package action

import (
        "fmt"
        "io"
        "os"
        "path/filepath"
        "strings"

        "github.com/Masterminds/semver/v3"
        "github.com/gosuri/uitable"

        "helm.sh/helm/v3/pkg/chart"
        "helm.sh/helm/v3/pkg/chart/loader"
)

// Dependency is the action for building a given chart's dependency tree.
//
// It provides the implementation of 'helm dependency' and its respective subcommands.
type Dependency struct {
        Verify      bool
        Keyring     string
        SkipRefresh bool
        ColumnWidth uint
}

// NewDependency creates a new Dependency object with the given configuration.
func NewDependency() *Dependency {
        return &Dependency{
                ColumnWidth: 80,
        }
}

// List executes 'helm dependency list'.
func (d *Dependency) List(chartpath string, out io.Writer) error {
        c, err := loader.Load(chartpath)
        if err != nil {
                return err
        }

        if c.Metadata.Dependencies == nil {
                fmt.Fprintf(out, "WARNING: no dependencies at %s\n", filepath.Join(chartpath, "charts"))
                return nil
        }

        d.printDependencies(chartpath, out, c)
        fmt.Fprintln(out)
        d.printMissing(chartpath, out, c.Metadata.Dependencies)
        return nil
}

// dependencyStatus returns a string describing the status of a dependency viz a viz the parent chart.
func (d *Dependency) dependencyStatus(chartpath string, dep *chart.Dependency, parent *chart.Chart) string {
        filename := fmt.Sprintf("%s-%s.tgz", dep.Name, "*")

        // If a chart is unpacked, this will check the unpacked chart's `charts/` directory for tarballs.
        // Technically, this is COMPLETELY unnecessary, and should be removed in Helm 4. It is here
        // to preserved backward compatibility. In Helm 2/3, there is a "difference" between
        // the tgz version (which outputs "ok" if it unpacks) and the loaded version (which outputs
        // "unpacked"). Early in Helm 2's history, this would have made a difference. But it no
        // longer does. However, since this code shipped with Helm 3, the output must remain stable
        // until Helm 4.
        switch archives, err := filepath.Glob(filepath.Join(chartpath, "charts", filename)); {
        case err != nil:
                return "bad pattern"
        case len(archives) > 1:
                // See if the second part is a SemVer
                found := []string{}
                for _, arc := range archives {
                        // we need to trip the prefix dirs and the extension off.
                        filename = strings.TrimSuffix(filepath.Base(arc), ".tgz")
                        maybeVersion := strings.TrimPrefix(filename, fmt.Sprintf("%s-", dep.Name))

                        if _, err := semver.StrictNewVersion(maybeVersion); err == nil {
                                // If the version parsed without an error, it is possibly a valid
                                // version.
                                found = append(found, arc)
                        }
                }

                if l := len(found); l == 1 {
                        // If we get here, we do the same thing as in len(archives) == 1.
                        if r := statArchiveForStatus(found[0], dep); r != "" {
                                return r
                        }

                        // Fall through and look for directories
                } else if l > 1 {
                        return "too many matches"
                }

                // The sanest thing to do here is to fall through and see if we have any directory
                // matches.

        case len(archives) == 1:
                archive := archives[0]
                if r := statArchiveForStatus(archive, dep); r != "" {
                        return r
                }

        }
        // End unnecessary code.

        var depChart *chart.Chart
        for _, item := range parent.Dependencies() {
                if item.Name() == dep.Name {
                        depChart = item
                }
        }

        if depChart == nil {
                return "missing"
        }

        if depChart.Metadata.Version != dep.Version {
                constraint, err := semver.NewConstraint(dep.Version)
                if err != nil {
                        return "invalid version"
                }

                v, err := semver.NewVersion(depChart.Metadata.Version)
                if err != nil {
                        return "invalid version"
                }

                if !constraint.Check(v) {
                        return "wrong version"
                }
        }

        return "unpacked"
}

// stat an archive and return a message if the stat is successful
//
// This is a refactor of the code originally in dependencyStatus. It is here to
// support legacy behavior, and should be removed in Helm 4.
func statArchiveForStatus(archive string, dep *chart.Dependency) string {
        if _, err := os.Stat(archive); err == nil {
                c, err := loader.Load(archive)
                if err != nil {
                        return "corrupt"
                }
                if c.Name() != dep.Name {
                        return "misnamed"
                }

                if c.Metadata.Version != dep.Version {
                        constraint, err := semver.NewConstraint(dep.Version)
                        if err != nil {
                                return "invalid version"
                        }

                        v, err := semver.NewVersion(c.Metadata.Version)
                        if err != nil {
                                return "invalid version"
                        }

                        if !constraint.Check(v) {
                                return "wrong version"
                        }
                }
                return "ok"
        }
        return ""
}

// printDependencies prints all of the dependencies in the yaml file.
func (d *Dependency) printDependencies(chartpath string, out io.Writer, c *chart.Chart) {
        table := uitable.New()
        table.MaxColWidth = d.ColumnWidth
        table.AddRow("NAME", "VERSION", "REPOSITORY", "STATUS")
        for _, row := range c.Metadata.Dependencies {
                table.AddRow(row.Name, row.Version, row.Repository, d.dependencyStatus(chartpath, row, c))
        }
        fmt.Fprintln(out, table)
}

// printMissing prints warnings about charts that are present on disk, but are
// not in Chart.yaml.
func (d *Dependency) printMissing(chartpath string, out io.Writer, reqs []*chart.Dependency) {
        folder := filepath.Join(chartpath, "charts/*")
        files, err := filepath.Glob(folder)
        if err != nil {
                fmt.Fprintln(out, err)
                return
        }

        for _, f := range files {
                fi, err := os.Stat(f)
                if err != nil {
                        fmt.Fprintf(out, "Warning: %s\n", err)
                }
                // Skip anything that is not a directory and not a tgz file.
                if !fi.IsDir() && filepath.Ext(f) != ".tgz" {
                        continue
                }
                c, err := loader.Load(f)
                if err != nil {
                        fmt.Fprintf(out, "WARNING: %q is not a chart.\n", f)
                        continue
                }
                found := false
                for _, d := range reqs {
                        if d.Name == c.Name() {
                                found = true
                                break
                        }
                }
                if !found {
                        fmt.Fprintf(out, "WARNING: %q is not in Chart.yaml.\n", f)
                }
        }
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package action

import (
        "helm.sh/helm/v3/pkg/release"
)

// Get is the action for checking a given release's information.
//
// It provides the implementation of 'helm get' and its respective subcommands (except `helm get values`).
type Get struct {
        cfg *Configuration

        // Initializing Version to 0 will get the latest revision of the release.
        Version int
}

// NewGet creates a new Get object with the given configuration.
func NewGet(cfg *Configuration) *Get {
        return &Get{
                cfg: cfg,
        }
}

// Run executes 'helm get' against the given release.
func (g *Get) Run(name string) (*release.Release, error) {
        if err := g.cfg.KubeClient.IsReachable(); err != nil {
                return nil, err
        }

        return g.cfg.releaseContent(name, g.Version)
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package action

import "time"

// GetMetadata is the action for checking a given release's metadata.
//
// It provides the implementation of 'helm get metadata'.
type GetMetadata struct {
        cfg *Configuration

        Version int
}

type Metadata struct {
        Name       string `json:"name" yaml:"name"`
        Chart      string `json:"chart" yaml:"chart"`
        Version    string `json:"version" yaml:"version"`
        AppVersion string `json:"appVersion" yaml:"appVersion"`
        Namespace  string `json:"namespace" yaml:"namespace"`
        Revision   int    `json:"revision" yaml:"revision"`
        Status     string `json:"status" yaml:"status"`
        DeployedAt string `json:"deployedAt" yaml:"deployedAt"`
}

// NewGetMetadata creates a new GetMetadata object with the given configuration.
func NewGetMetadata(cfg *Configuration) *GetMetadata {
        return &GetMetadata{
                cfg: cfg,
        }
}

// Run executes 'helm get metadata' against the given release.
func (g *GetMetadata) Run(name string) (*Metadata, error) {
        if err := g.cfg.KubeClient.IsReachable(); err != nil {
                return nil, err
        }

        rel, err := g.cfg.releaseContent(name, g.Version)
        if err != nil {
                return nil, err
        }

        return &Metadata{
                Name:       rel.Name,
                Chart:      rel.Chart.Metadata.Name,
                Version:    rel.Chart.Metadata.Version,
                AppVersion: rel.Chart.Metadata.AppVersion,
                Namespace:  rel.Namespace,
                Revision:   rel.Version,
                Status:     rel.Info.Status.String(),
                DeployedAt: rel.Info.LastDeployed.Format(time.RFC3339),
        }, nil
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package action

import (
        "helm.sh/helm/v3/pkg/chartutil"
)

// GetValues is the action for checking a given release's values.
//
// It provides the implementation of 'helm get values'.
type GetValues struct {
        cfg *Configuration

        Version   int
        AllValues bool
}

// NewGetValues creates a new GetValues object with the given configuration.
func NewGetValues(cfg *Configuration) *GetValues {
        return &GetValues{
                cfg: cfg,
        }
}

// Run executes 'helm get values' against the given release.
func (g *GetValues) Run(name string) (map[string]interface{}, error) {
        if err := g.cfg.KubeClient.IsReachable(); err != nil {
                return nil, err
        }

        rel, err := g.cfg.releaseContent(name, g.Version)
        if err != nil {
                return nil, err
        }

        // If the user wants all values, compute the values and return.
        if g.AllValues {
                cfg, err := chartutil.CoalesceValues(rel.Chart, rel.Config)
                if err != nil {
                        return nil, err
                }
                return cfg, nil
        }
        return rel.Config, nil
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package action

import (
        "github.com/pkg/errors"

        "helm.sh/helm/v3/pkg/chartutil"
        "helm.sh/helm/v3/pkg/release"
)

// History is the action for checking the release's ledger.
//
// It provides the implementation of 'helm history'.
// It returns all the revisions for a specific release.
// To list up to one revision of every release in one specific, or in all,
// namespaces, see the List action.
type History struct {
        cfg *Configuration

        Max     int
        Version int
}

// NewHistory creates a new History object with the given configuration.
func NewHistory(cfg *Configuration) *History {
        return &History{
                cfg: cfg,
        }
}

// Run executes 'helm history' against the given release.
func (h *History) Run(name string) ([]*release.Release, error) {
        if err := h.cfg.KubeClient.IsReachable(); err != nil {
                return nil, err
        }

        if err := chartutil.ValidateReleaseName(name); err != nil {
                return nil, errors.Errorf("release name is invalid: %s", name)
        }

        h.cfg.Log("getting history for release %s", name)
        return h.cfg.Releases.History(name)
}

/*
Copyright The Helm Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package action

import (
        "bytes"
        "sort"
        "time"

        "github.com/pkg/errors"

        "helm.sh/helm/v3/pkg/release"
        helmtime "helm.sh/helm/v3/pkg/time"
)

// execHook executes all of the hooks for the given hook event.
func (cfg *Configuration) execHook(rl *release.Release, hook release.HookEvent, timeout time.Duration) error {
        executingHooks := []*release.Hook{}

        for _, h := range rl.Hooks {
                for _, e := range h.Events {
                        if e == hook {
                                executingHooks = append(executingHooks, h)
                        }
                }
        }

        // hooke are pre-ordered by kind, so keep order stable
        sort.Stable(hookByWeight(executingHooks))

        for _, h := range executingHooks {
                // Set default delete policy to before-hook-creation
                if h.DeletePolicies == nil || len(h.DeletePolicies) == 0 {
                        // TODO(jlegrone): Only apply before-hook-creation delete policy to run to completion
                        //                 resources. For all other resource types update in place if a
                        //                 resource with the same name already exists and is owned by the
                        //                 current release.
                        h.DeletePolicies = []release.HookDeletePolicy{release.HookBeforeHookCreation}
                }

                if err := cfg.deleteHookByPolicy(h, release.HookBeforeHookCreation); err != nil {
                        return err
                }

                resources, err := cfg.KubeClient.Build(bytes.NewBufferString(h.Manifest), true)
                if err != nil {
                        return errors.Wrapf(err, "unable to build kubernetes object for %s hook %s", hook, h.Path)
                }

                // Record the time at which the hook was applied to the cluster
                h.LastRun = release.HookExecution{
                        StartedAt: helmtime.Now(),
                        Phase:     release.HookPhaseRunning,
                }
                cfg.recordRelease(rl)

                // As long as the implementation of WatchUntilReady does not panic, HookPhaseFailed or HookPhaseSucceeded
                // should always be set by this function. If we fail to do that for any reason, then HookPhaseUnknown is
                // the most appropriate value to surface.
                h.LastRun.Phase = release.HookPhaseUnknown

                // Create hook resources
                if _, err := cfg.KubeClient.Create(resources); err != nil {
                        h.LastRun.CompletedAt = helmtime.Now()
                        h.LastRun.Phase = release.HookPhaseFailed
                        return errors.Wrapf(err, "warning: Hook %s %s failed", hook, h.Path)
                }

                // Watch hook resources until they have completed
                err = cfg.KubeClient.WatchUntilReady(resources, timeout)
                // Note the time of success/failure
                h.LastRun.CompletedAt = helmtime.Now()
                // Mark hook as succeeded or failed
                if err != nil {
                        h.LastRun.Phase = release.HookPhaseFailed
                        // If a hook is failed, check the annotation of the hook to determine whether the hook should be deleted
                        // under failed condition. If so, then clear the corresponding resource object in the hook
                        if err := cfg.deleteHookByPolicy(h, release.HookFailed); err != nil {
                                return err
                        }
                        return err
                }
                h.LastRun.Phase = release.HookPhaseSucceeded
        }

        // If all hooks are successful, check the annotation of each hook to determine whether the hook should be deleted
        // under succeeded condition. If so, then clear the corresponding resource object in each hook
        for _, h := range executingHooks {
                if err := cfg.deleteHookByPolicy(h, release.HookSucceeded); err != nil {
                        return err
                }
        }

        return nil
}

// hookByWeight is a sorter for hooks
type hookByWeight []*release.Hook

func (x hookByWeight) Len() int      { return len(x) }
func (x hookByWeight) Swap(i, j int) { x[i], x[j] = x[j], x[i] }
func (x hookByWeight) Less(i, j int) bool {
        if x[i].Weight == x[j].Weight {
                return x[i].Name < x[j].Name
        }
        return x[i].Weight < x[j].Weight
}

// deleteHookByPolicy deletes a hook if the hook policy instructs it to
func (cfg *Configuration) deleteHookByPolicy(h *release.Hook, policy release.HookDeletePolicy) error {
        // Never delete CustomResourceDefinitions; this could cause lots of
        // cascading garbage collection.
        if h.Kind == "CustomResourceDefinition" {
                return nil
        }
        if hookHasDeletePolicy(h, policy) {
                resources, err := cfg.KubeClient.Build(bytes.NewBufferString(h.Manifest), false)
                if err != nil {
                        return errors.Wrapf(err, "unable to build kubernetes object for deleting hook %s", h.Path)
                }
                _, errs := cfg.KubeClient.Delete(resources)
                if len(errs) > 0 {
                        return errors.New(joinErrors(errs))
                }
        }
        return nil
}

// hookHasDeletePolicy determines whether the defined hook deletion policy matches the hook deletion polices
// supported by helm. If so, mark the hook as one should be deleted.
func hookHasDeletePolicy(h *release.Hook, policy release.HookDeletePolicy) bool {
        for _, v := range h.DeletePolicies {
                if policy == v {
                        return true
                }
        }
        return false
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package action

import (
        "bytes"
        "context"
        "fmt"
        "io"
        "net/url"
        "os"
        "path"
        "path/filepath"
        "strings"
        "sync"
        "text/template"
        "time"

        "github.com/Masterminds/sprig/v3"
        "github.com/pkg/errors"
        v1 "k8s.io/api/core/v1"
        apierrors "k8s.io/apimachinery/pkg/api/errors"
        "k8s.io/apimachinery/pkg/api/meta"
        metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
        "k8s.io/cli-runtime/pkg/resource"
        "sigs.k8s.io/yaml"

        "helm.sh/helm/v3/pkg/chart"
        "helm.sh/helm/v3/pkg/chartutil"
        "helm.sh/helm/v3/pkg/cli"
        "helm.sh/helm/v3/pkg/downloader"
        "helm.sh/helm/v3/pkg/getter"
        "helm.sh/helm/v3/pkg/kube"
        kubefake "helm.sh/helm/v3/pkg/kube/fake"
        "helm.sh/helm/v3/pkg/postrender"
        "helm.sh/helm/v3/pkg/registry"
        "helm.sh/helm/v3/pkg/release"
        "helm.sh/helm/v3/pkg/releaseutil"
        "helm.sh/helm/v3/pkg/repo"
        "helm.sh/helm/v3/pkg/storage"
        "helm.sh/helm/v3/pkg/storage/driver"
)

// NOTESFILE_SUFFIX that we want to treat special. It goes through the templating engine
// but it's not a yaml file (resource) hence can't have hooks, etc. And the user actually
// wants to see this file after rendering in the status command. However, it must be a suffix
// since there can be filepath in front of it.
const notesFileSuffix = "NOTES.txt"

const defaultDirectoryPermission = 0755

// Install performs an installation operation.
type Install struct {
        cfg *Configuration

        ChartPathOptions

        ClientOnly               bool
        Force                    bool
        CreateNamespace          bool
        DryRun                   bool
        DryRunOption             string
        DisableHooks             bool
        Replace                  bool
        Wait                     bool
        WaitForJobs              bool
        Devel                    bool
        DependencyUpdate         bool
        Timeout                  time.Duration
        Namespace                string
        ReleaseName              string
        GenerateName             bool
        NameTemplate             string
        Description              string
        OutputDir                string
        Atomic                   bool
        SkipCRDs                 bool
        SubNotes                 bool
        DisableOpenAPIValidation bool
        IncludeCRDs              bool
        Labels                   map[string]string
        // KubeVersion allows specifying a custom kubernetes version to use and
        // APIVersions allows a manual set of supported API Versions to be passed
        // (for things like templating). These are ignored if ClientOnly is false
        KubeVersion *chartutil.KubeVersion
        APIVersions chartutil.VersionSet
        // Used by helm template to render charts with .Release.IsUpgrade. Ignored if Dry-Run is false
        IsUpgrade bool
        // Enable DNS lookups when rendering templates
        EnableDNS bool
        // Used by helm template to add the release as part of OutputDir path
        // OutputDir/<ReleaseName>
        UseReleaseName bool
        PostRenderer   postrender.PostRenderer
        // Lock to control raceconditions when the process receives a SIGTERM
        Lock sync.Mutex
}

// ChartPathOptions captures common options used for controlling chart paths
type ChartPathOptions struct {
        CaFile                string // --ca-file
        CertFile              string // --cert-file
        KeyFile               string // --key-file
        InsecureSkipTLSverify bool   // --insecure-skip-verify
        PlainHTTP             bool   // --plain-http
        Keyring               string // --keyring
        Password              string // --password
        PassCredentialsAll    bool   // --pass-credentials
        RepoURL               string // --repo
        Username              string // --username
        Verify                bool   // --verify
        Version               string // --version

        // registryClient provides a registry client but is not added with
        // options from a flag
        registryClient *registry.Client
}

// NewInstall creates a new Install object with the given configuration.
func NewInstall(cfg *Configuration) *Install {
        in := &Install{
                cfg: cfg,
        }
        in.ChartPathOptions.registryClient = cfg.RegistryClient

        return in
}

// SetRegistryClient sets the registry client for the install action
func (i *Install) SetRegistryClient(registryClient *registry.Client) {
        i.ChartPathOptions.registryClient = registryClient
}

// GetRegistryClient get the registry client.
func (i *Install) GetRegistryClient() *registry.Client {
        return i.ChartPathOptions.registryClient
}

func (i *Install) installCRDs(crds []chart.CRD) error {
        // We do these one file at a time in the order they were read.
        totalItems := []*resource.Info{}
        for _, obj := range crds {
                // Read in the resources
                res, err := i.cfg.KubeClient.Build(bytes.NewBuffer(obj.File.Data), false)
                if err != nil {
                        return errors.Wrapf(err, "failed to install CRD %s", obj.Name)
                }

                // Send them to Kube
                if _, err := i.cfg.KubeClient.Create(res); err != nil {
                        // If the error is CRD already exists, continue.
                        if apierrors.IsAlreadyExists(err) {
                                crdName := res[0].Name
                                i.cfg.Log("CRD %s is already present. Skipping.", crdName)
                                continue
                        }
                        return errors.Wrapf(err, "failed to install CRD %s", obj.Name)
                }
                totalItems = append(totalItems, res...)
        }
        if len(totalItems) > 0 {
                // Give time for the CRD to be recognized.
                if err := i.cfg.KubeClient.Wait(totalItems, 60*time.Second); err != nil {
                        return err
                }

                // If we have already gathered the capabilities, we need to invalidate
                // the cache so that the new CRDs are recognized. This should only be
                // the case when an action configuration is reused for multiple actions,
                // as otherwise it is later loaded by ourselves when getCapabilities
                // is called later on in the installation process.
                if i.cfg.Capabilities != nil {
                        discoveryClient, err := i.cfg.RESTClientGetter.ToDiscoveryClient()
                        if err != nil {
                                return err
                        }

                        i.cfg.Log("Clearing discovery cache")
                        discoveryClient.Invalidate()

                        _, _ = discoveryClient.ServerGroups()
                }

                // Invalidate the REST mapper, since it will not have the new CRDs
                // present.
                restMapper, err := i.cfg.RESTClientGetter.ToRESTMapper()
                if err != nil {
                        return err
                }
                if resettable, ok := restMapper.(meta.ResettableRESTMapper); ok {
                        i.cfg.Log("Clearing REST mapper cache")
                        resettable.Reset()
                }
        }
        return nil
}

// Run executes the installation
//
// If DryRun is set to true, this will prepare the release, but not install it

func (i *Install) Run(chrt *chart.Chart, vals map[string]interface{}) (*release.Release, error) {
        ctx := context.Background()
        return i.RunWithContext(ctx, chrt, vals)
}

// Run executes the installation with Context
//
// When the task is cancelled through ctx, the function returns and the install
// proceeds in the background.
func (i *Install) RunWithContext(ctx context.Context, chrt *chart.Chart, vals map[string]interface{}) (*release.Release, error) {
        // Check reachability of cluster unless in client-only mode (e.g. `helm template` without `--validate`)
        if !i.ClientOnly {
                if err := i.cfg.KubeClient.IsReachable(); err != nil {
                        return nil, err
                }
        }

        if err := i.availableName(); err != nil {
                return nil, err
        }

        if err := chartutil.ProcessDependenciesWithMerge(chrt, vals); err != nil {
                return nil, err
        }

        var interactWithRemote bool
        if !i.isDryRun() || i.DryRunOption == "server" || i.DryRunOption == "none" || i.DryRunOption == "false" {
                interactWithRemote = true
        }

        // Pre-install anything in the crd/ directory. We do this before Helm
        // contacts the upstream server and builds the capabilities object.
        if crds := chrt.CRDObjects(); !i.ClientOnly && !i.SkipCRDs && len(crds) > 0 {
                // On dry run, bail here
                if i.isDryRun() {
                        i.cfg.Log("WARNING: This chart or one of its subcharts contains CRDs. Rendering may fail or contain inaccuracies.")
                } else if err := i.installCRDs(crds); err != nil {
                        return nil, err
                }
        }

        if i.ClientOnly {
                // Add mock objects in here so it doesn't use Kube API server
                // NOTE(bacongobbler): used for `helm template`
                i.cfg.Capabilities = chartutil.DefaultCapabilities.Copy()
                if i.KubeVersion != nil {
                        i.cfg.Capabilities.KubeVersion = *i.KubeVersion
                }
                i.cfg.Capabilities.APIVersions = append(i.cfg.Capabilities.APIVersions, i.APIVersions...)
                i.cfg.KubeClient = &kubefake.PrintingKubeClient{Out: io.Discard}

                mem := driver.NewMemory()
                mem.SetNamespace(i.Namespace)
                i.cfg.Releases = storage.Init(mem)
        } else if !i.ClientOnly && len(i.APIVersions) > 0 {
                i.cfg.Log("API Version list given outside of client only mode, this list will be ignored")
        }

        // Make sure if Atomic is set, that wait is set as well. This makes it so
        // the user doesn't have to specify both
        i.Wait = i.Wait || i.Atomic

        caps, err := i.cfg.getCapabilities()
        if err != nil {
                return nil, err
        }

        // special case for helm template --is-upgrade
        isUpgrade := i.IsUpgrade && i.isDryRun()
        options := chartutil.ReleaseOptions{
                Name:      i.ReleaseName,
                Namespace: i.Namespace,
                Revision:  1,
                IsInstall: !isUpgrade,
                IsUpgrade: isUpgrade,
        }
        valuesToRender, err := chartutil.ToRenderValues(chrt, vals, options, caps)
        if err != nil {
                return nil, err
        }

        if driver.ContainsSystemLabels(i.Labels) {
                return nil, fmt.Errorf("user suplied labels contains system reserved label name. System labels: %+v", driver.GetSystemLabels())
        }

        rel := i.createRelease(chrt, vals, i.Labels)

        var manifestDoc *bytes.Buffer
        rel.Hooks, manifestDoc, rel.Info.Notes, err = i.cfg.renderResources(chrt, valuesToRender, i.ReleaseName, i.OutputDir, i.SubNotes, i.UseReleaseName, i.IncludeCRDs, i.PostRenderer, interactWithRemote, i.EnableDNS)
        // Even for errors, attach this if available
        if manifestDoc != nil {
                rel.Manifest = manifestDoc.String()
        }
        // Check error from render
        if err != nil {
                rel.SetStatus(release.StatusFailed, fmt.Sprintf("failed to render resource: %s", err.Error()))
                // Return a release with partial data so that the client can show debugging information.
                return rel, err
        }

        // Mark this release as in-progress
        rel.SetStatus(release.StatusPendingInstall, "Initial install underway")

        var toBeAdopted kube.ResourceList
        resources, err := i.cfg.KubeClient.Build(bytes.NewBufferString(rel.Manifest), !i.DisableOpenAPIValidation)
        if err != nil {
                return nil, errors.Wrap(err, "unable to build kubernetes objects from release manifest")
        }

        // It is safe to use "force" here because these are resources currently rendered by the chart.
        err = resources.Visit(setMetadataVisitor(rel.Name, rel.Namespace, true))
        if err != nil {
                return nil, err
        }

        // Install requires an extra validation step of checking that resources
        // don't already exist before we actually create resources. If we continue
        // forward and create the release object with resources that already exist,
        // we'll end up in a state where we will delete those resources upon
        // deleting the release because the manifest will be pointing at that
        // resource
        if !i.ClientOnly && !isUpgrade && len(resources) > 0 {
                toBeAdopted, err = existingResourceConflict(resources, rel.Name, rel.Namespace)
                if err != nil {
                        return nil, errors.Wrap(err, "Unable to continue with install")
                }
        }

        // Bail out here if it is a dry run
        if i.isDryRun() {
                rel.Info.Description = "Dry run complete"
                return rel, nil
        }

        if i.CreateNamespace {
                ns := &v1.Namespace{
                        TypeMeta: metav1.TypeMeta{
                                APIVersion: "v1",
                                Kind:       "Namespace",
                        },
                        ObjectMeta: metav1.ObjectMeta{
                                Name: i.Namespace,
                                Labels: map[string]string{
                                        "name": i.Namespace,
                                },
                        },
                }
                buf, err := yaml.Marshal(ns)
                if err != nil {
                        return nil, err
                }
                resourceList, err := i.cfg.KubeClient.Build(bytes.NewBuffer(buf), true)
                if err != nil {
                        return nil, err
                }
                if _, err := i.cfg.KubeClient.Create(resourceList); err != nil && !apierrors.IsAlreadyExists(err) {
                        return nil, err
                }
        }

        // If Replace is true, we need to supercede the last release.
        if i.Replace {
                if err := i.replaceRelease(rel); err != nil {
                        return nil, err
                }
        }

        // Store the release in history before continuing (new in Helm 3). We always know
        // that this is a create operation.
        if err := i.cfg.Releases.Create(rel); err != nil {
                // We could try to recover gracefully here, but since nothing has been installed
                // yet, this is probably safer than trying to continue when we know storage is
                // not working.
                return rel, err
        }

        rel, err = i.performInstallCtx(ctx, rel, toBeAdopted, resources)
        if err != nil {
                rel, err = i.failRelease(rel, err)
        }
        return rel, err
}

func (i *Install) performInstallCtx(ctx context.Context, rel *release.Release, toBeAdopted kube.ResourceList, resources kube.ResourceList) (*release.Release, error) {
        type Msg struct {
                r *release.Release
                e error
        }
        resultChan := make(chan Msg, 1)

        go func() {
                rel, err := i.performInstall(rel, toBeAdopted, resources)
                resultChan <- Msg{rel, err}
        }()
        select {
        case <-ctx.Done():
                err := ctx.Err()
                return rel, err
        case msg := <-resultChan:
                return msg.r, msg.e
        }
}

// isDryRun returns true if Upgrade is set to run as a DryRun
func (i *Install) isDryRun() bool {
        if i.DryRun || i.DryRunOption == "client" || i.DryRunOption == "server" || i.DryRunOption == "true" {
                return true
        }
        return false
}

func (i *Install) performInstall(rel *release.Release, toBeAdopted kube.ResourceList, resources kube.ResourceList) (*release.Release, error) {
        var err error
        // pre-install hooks
        if !i.DisableHooks {
                if err := i.cfg.execHook(rel, release.HookPreInstall, i.Timeout); err != nil {
                        return rel, fmt.Errorf("failed pre-install: %s", err)
                }
        }

        // At this point, we can do the install. Note that before we were detecting whether to
        // do an update, but it's not clear whether we WANT to do an update if the re-use is set
        // to true, since that is basically an upgrade operation.
        if len(toBeAdopted) == 0 && len(resources) > 0 {
                _, err = i.cfg.KubeClient.Create(resources)
        } else if len(resources) > 0 {
                _, err = i.cfg.KubeClient.Update(toBeAdopted, resources, i.Force)
        }
        if err != nil {
                return rel, err
        }

        if i.Wait {
                if i.WaitForJobs {
                        err = i.cfg.KubeClient.WaitWithJobs(resources, i.Timeout)
                } else {
                        err = i.cfg.KubeClient.Wait(resources, i.Timeout)
                }
                if err != nil {
                        return rel, err
                }
        }

        if !i.DisableHooks {
                if err := i.cfg.execHook(rel, release.HookPostInstall, i.Timeout); err != nil {
                        return rel, fmt.Errorf("failed post-install: %s", err)
                }
        }

        if len(i.Description) > 0 {
                rel.SetStatus(release.StatusDeployed, i.Description)
        } else {
                rel.SetStatus(release.StatusDeployed, "Install complete")
        }

        // This is a tricky case. The release has been created, but the result
        // cannot be recorded. The truest thing to tell the user is that the
        // release was created. However, the user will not be able to do anything
        // further with this release.
        //
        // One possible strategy would be to do a timed retry to see if we can get
        // this stored in the future.
        if err := i.recordRelease(rel); err != nil {
                i.cfg.Log("failed to record the release: %s", err)
        }

        return rel, nil
}

func (i *Install) failRelease(rel *release.Release, err error) (*release.Release, error) {
        rel.SetStatus(release.StatusFailed, fmt.Sprintf("Release %q failed: %s", i.ReleaseName, err.Error()))
        if i.Atomic {
                i.cfg.Log("Install failed and atomic is set, uninstalling release")
                uninstall := NewUninstall(i.cfg)
                uninstall.DisableHooks = i.DisableHooks
                uninstall.KeepHistory = false
                uninstall.Timeout = i.Timeout
                if _, uninstallErr := uninstall.Run(i.ReleaseName); uninstallErr != nil {
                        return rel, errors.Wrapf(uninstallErr, "an error occurred while uninstalling the release. original install error: %s", err)
                }
                return rel, errors.Wrapf(err, "release %s failed, and has been uninstalled due to atomic being set", i.ReleaseName)
        }
        i.recordRelease(rel) // Ignore the error, since we have another error to deal with.
        return rel, err
}

// availableName tests whether a name is available
//
// Roughly, this will return an error if name is
//
//   - empty
//   - too long
//   - already in use, and not deleted
//   - used by a deleted release, and i.Replace is false
func (i *Install) availableName() error {
        start := i.ReleaseName

        if err := chartutil.ValidateReleaseName(start); err != nil {
                return errors.Wrapf(err, "release name %q", start)
        }
        // On dry run, bail here
        if i.isDryRun() {
                return nil
        }

        h, err := i.cfg.Releases.History(start)
        if err != nil || len(h) < 1 {
                return nil
        }
        releaseutil.Reverse(h, releaseutil.SortByRevision)
        rel := h[0]

        if st := rel.Info.Status; i.Replace && (st == release.StatusUninstalled || st == release.StatusFailed) {
                return nil
        }
        return errors.New("cannot re-use a name that is still in use")
}

// createRelease creates a new release object
func (i *Install) createRelease(chrt *chart.Chart, rawVals map[string]interface{}, labels map[string]string) *release.Release {
        ts := i.cfg.Now()
        return &release.Release{
                Name:      i.ReleaseName,
                Namespace: i.Namespace,
                Chart:     chrt,
                Config:    rawVals,
                Info: &release.Info{
                        FirstDeployed: ts,
                        LastDeployed:  ts,
                        Status:        release.StatusUnknown,
                },
                Version: 1,
                Labels:  labels,
        }
}

// recordRelease with an update operation in case reuse has been set.
func (i *Install) recordRelease(r *release.Release) error {
        // This is a legacy function which has been reduced to a oneliner. Could probably
        // refactor it out.
        return i.cfg.Releases.Update(r)
}

// replaceRelease replaces an older release with this one
//
// This allows us to re-use names by superseding an existing release with a new one
func (i *Install) replaceRelease(rel *release.Release) error {
        hist, err := i.cfg.Releases.History(rel.Name)
        if err != nil || len(hist) == 0 {
                // No releases exist for this name, so we can return early
                return nil
        }

        releaseutil.Reverse(hist, releaseutil.SortByRevision)
        last := hist[0]

        // Update version to the next available
        rel.Version = last.Version + 1

        // Do not change the status of a failed release.
        if last.Info.Status == release.StatusFailed {
                return nil
        }

        // For any other status, mark it as superseded and store the old record
        last.SetStatus(release.StatusSuperseded, "superseded by new release")
        return i.recordRelease(last)
}

// write the <data> to <output-dir>/<name>. <append> controls if the file is created or content will be appended
func writeToFile(outputDir string, name string, data string, append bool) error {
        outfileName := strings.Join([]string{outputDir, name}, string(filepath.Separator))

        err := ensureDirectoryForFile(outfileName)
        if err != nil {
                return err
        }

        f, err := createOrOpenFile(outfileName, append)
        if err != nil {
                return err
        }

        defer f.Close()

        _, err = f.WriteString(fmt.Sprintf("---\n# Source: %s\n%s\n", name, data))

        if err != nil {
                return err
        }

        fmt.Printf("wrote %s\n", outfileName)
        return nil
}

func createOrOpenFile(filename string, append bool) (*os.File, error) {
        if append {
                return os.OpenFile(filename, os.O_APPEND|os.O_WRONLY, 0600)
        }
        return os.Create(filename)
}

// check if the directory exists to create file. creates if don't exists
func ensureDirectoryForFile(file string) error {
        baseDir := path.Dir(file)
        _, err := os.Stat(baseDir)
        if err != nil && !os.IsNotExist(err) {
                return err
        }

        return os.MkdirAll(baseDir, defaultDirectoryPermission)
}

// NameAndChart returns the name and chart that should be used.
//
// This will read the flags and handle name generation if necessary.
func (i *Install) NameAndChart(args []string) (string, string, error) {
        flagsNotSet := func() error {
                if i.GenerateName {
                        return errors.New("cannot set --generate-name and also specify a name")
                }
                if i.NameTemplate != "" {
                        return errors.New("cannot set --name-template and also specify a name")
                }
                return nil
        }

        if len(args) > 2 {
                return args[0], args[1], errors.Errorf("expected at most two arguments, unexpected arguments: %v", strings.Join(args[2:], ", "))
        }

        if len(args) == 2 {
                return args[0], args[1], flagsNotSet()
        }

        if i.NameTemplate != "" {
                name, err := TemplateName(i.NameTemplate)
                return name, args[0], err
        }

        if i.ReleaseName != "" {
                return i.ReleaseName, args[0], nil
        }

        if !i.GenerateName {
                return "", args[0], errors.New("must either provide a name or specify --generate-name")
        }

        base := filepath.Base(args[0])
        if base == "." || base == "" {
                base = "chart"
        }
        // if present, strip out the file extension from the name
        if idx := strings.Index(base, "."); idx != -1 {
                base = base[0:idx]
        }

        return fmt.Sprintf("%s-%d", base, time.Now().Unix()), args[0], nil
}

// TemplateName renders a name template, returning the name or an error.
func TemplateName(nameTemplate string) (string, error) {
        if nameTemplate == "" {
                return "", nil
        }

        t, err := template.New("name-template").Funcs(sprig.TxtFuncMap()).Parse(nameTemplate)
        if err != nil {
                return "", err
        }
        var b bytes.Buffer
        if err := t.Execute(&b, nil); err != nil {
                return "", err
        }

        return b.String(), nil
}

// CheckDependencies checks the dependencies for a chart.
func CheckDependencies(ch *chart.Chart, reqs []*chart.Dependency) error {
        var missing []string

OUTER:
        for _, r := range reqs {
                for _, d := range ch.Dependencies() {
                        if d.Name() == r.Name {
                                continue OUTER
                        }
                }
                missing = append(missing, r.Name)
        }

        if len(missing) > 0 {
                return errors.Errorf("found in Chart.yaml, but missing in charts/ directory: %s", strings.Join(missing, ", "))
        }
        return nil
}

// LocateChart looks for a chart directory in known places, and returns either the full path or an error.
//
// This does not ensure that the chart is well-formed; only that the requested filename exists.
//
// Order of resolution:
// - relative to current working directory
// - if path is absolute or begins with '.', error out here
// - URL
//
// If 'verify' was set on ChartPathOptions, this will attempt to also verify the chart.
func (c *ChartPathOptions) LocateChart(name string, settings *cli.EnvSettings) (string, error) {
        if registry.IsOCI(name) && c.registryClient == nil {
                return "", fmt.Errorf("unable to lookup chart %q, missing registry client", name)
        }

        name = strings.TrimSpace(name)
        version := strings.TrimSpace(c.Version)

        if _, err := os.Stat(name); err == nil {
                abs, err := filepath.Abs(name)
                if err != nil {
                        return abs, err
                }
                if c.Verify {
                        if _, err := downloader.VerifyChart(abs, c.Keyring); err != nil {
                                return "", err
                        }
                }
                return abs, nil
        }
        if filepath.IsAbs(name) || strings.HasPrefix(name, ".") {
                return name, errors.Errorf("path %q not found", name)
        }

        dl := downloader.ChartDownloader{
                Out:     os.Stdout,
                Keyring: c.Keyring,
                Getters: getter.All(settings),
                Options: []getter.Option{
                        getter.WithPassCredentialsAll(c.PassCredentialsAll),
                        getter.WithTLSClientConfig(c.CertFile, c.KeyFile, c.CaFile),
                        getter.WithInsecureSkipVerifyTLS(c.InsecureSkipTLSverify),
                        getter.WithPlainHTTP(c.PlainHTTP),
                },
                RepositoryConfig: settings.RepositoryConfig,
                RepositoryCache:  settings.RepositoryCache,
                RegistryClient:   c.registryClient,
        }

        if registry.IsOCI(name) {
                dl.Options = append(dl.Options, getter.WithRegistryClient(c.registryClient))
        }

        if c.Verify {
                dl.Verify = downloader.VerifyAlways
        }
        if c.RepoURL != "" {
                chartURL, err := repo.FindChartInAuthAndTLSAndPassRepoURL(c.RepoURL, c.Username, c.Password, name, version,
                        c.CertFile, c.KeyFile, c.CaFile, c.InsecureSkipTLSverify, c.PassCredentialsAll, getter.All(settings))
                if err != nil {
                        return "", err
                }
                name = chartURL

                // Only pass the user/pass on when the user has said to or when the
                // location of the chart repo and the chart are the same domain.
                u1, err := url.Parse(c.RepoURL)
                if err != nil {
                        return "", err
                }
                u2, err := url.Parse(chartURL)
                if err != nil {
                        return "", err
                }

                // Host on URL (returned from url.Parse) contains the port if present.
                // This check ensures credentials are not passed between different
                // services on different ports.
                if c.PassCredentialsAll || (u1.Scheme == u2.Scheme && u1.Host == u2.Host) {
                        dl.Options = append(dl.Options, getter.WithBasicAuth(c.Username, c.Password))
                } else {
                        dl.Options = append(dl.Options, getter.WithBasicAuth("", ""))
                }
        } else {
                dl.Options = append(dl.Options, getter.WithBasicAuth(c.Username, c.Password))
        }

        if err := os.MkdirAll(settings.RepositoryCache, 0755); err != nil {
                return "", err
        }

        filename, _, err := dl.DownloadTo(name, version, settings.RepositoryCache)
        if err != nil {
                return "", err
        }

        lname, err := filepath.Abs(filename)
        if err != nil {
                return filename, err
        }
        return lname, nil
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package action

import (
        "context"
        "sync"

        v1 "k8s.io/api/core/v1"
        metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
        "k8s.io/apimachinery/pkg/types"
        "k8s.io/apimachinery/pkg/watch"
        applycorev1 "k8s.io/client-go/applyconfigurations/core/v1"
        "k8s.io/client-go/kubernetes"
        corev1 "k8s.io/client-go/kubernetes/typed/core/v1"
)

// lazyClient is a workaround to deal with Kubernetes having an unstable client API.
// In Kubernetes v1.18 the defaults where removed which broke creating a
// client without an explicit configuration. ಠ_ಠ
type lazyClient struct {
        // client caches an initialized kubernetes client
        initClient sync.Once
        client     kubernetes.Interface
        clientErr  error

        // clientFn loads a kubernetes client
        clientFn func() (*kubernetes.Clientset, error)

        // namespace passed to each client request
        namespace string
}

func (s *lazyClient) init() error {
        s.initClient.Do(func() {
                s.client, s.clientErr = s.clientFn()
        })
        return s.clientErr
}

// secretClient implements a corev1.SecretsInterface
type secretClient struct{ *lazyClient }

var _ corev1.SecretInterface = (*secretClient)(nil)

func newSecretClient(lc *lazyClient) *secretClient {
        return &secretClient{lazyClient: lc}
}

func (s *secretClient) Create(ctx context.Context, secret *v1.Secret, opts metav1.CreateOptions) (result *v1.Secret, err error) {
        if err := s.init(); err != nil {
                return nil, err
        }
        return s.client.CoreV1().Secrets(s.namespace).Create(ctx, secret, opts)
}

func (s *secretClient) Update(ctx context.Context, secret *v1.Secret, opts metav1.UpdateOptions) (*v1.Secret, error) {
        if err := s.init(); err != nil {
                return nil, err
        }
        return s.client.CoreV1().Secrets(s.namespace).Update(ctx, secret, opts)
}

func (s *secretClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
        if err := s.init(); err != nil {
                return err
        }
        return s.client.CoreV1().Secrets(s.namespace).Delete(ctx, name, opts)
}

func (s *secretClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
        if err := s.init(); err != nil {
                return err
        }
        return s.client.CoreV1().Secrets(s.namespace).DeleteCollection(ctx, opts, listOpts)
}

func (s *secretClient) Get(ctx context.Context, name string, opts metav1.GetOptions) (*v1.Secret, error) {
        if err := s.init(); err != nil {
                return nil, err
        }
        return s.client.CoreV1().Secrets(s.namespace).Get(ctx, name, opts)
}

func (s *secretClient) List(ctx context.Context, opts metav1.ListOptions) (*v1.SecretList, error) {
        if err := s.init(); err != nil {
                return nil, err
        }
        return s.client.CoreV1().Secrets(s.namespace).List(ctx, opts)
}

func (s *secretClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
        if err := s.init(); err != nil {
                return nil, err
        }
        return s.client.CoreV1().Secrets(s.namespace).Watch(ctx, opts)
}

func (s *secretClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*v1.Secret, error) {
        if err := s.init(); err != nil {
                return nil, err
        }
        return s.client.CoreV1().Secrets(s.namespace).Patch(ctx, name, pt, data, opts, subresources...)
}

func (s *secretClient) Apply(ctx context.Context, secretConfiguration *applycorev1.SecretApplyConfiguration, opts metav1.ApplyOptions) (*v1.Secret, error) {
        if err := s.init(); err != nil {
                return nil, err
        }
        return s.client.CoreV1().Secrets(s.namespace).Apply(ctx, secretConfiguration, opts)
}

// configMapClient implements a corev1.ConfigMapInterface
type configMapClient struct{ *lazyClient }

var _ corev1.ConfigMapInterface = (*configMapClient)(nil)

func newConfigMapClient(lc *lazyClient) *configMapClient {
        return &configMapClient{lazyClient: lc}
}

func (c *configMapClient) Create(ctx context.Context, configMap *v1.ConfigMap, opts metav1.CreateOptions) (*v1.ConfigMap, error) {
        if err := c.init(); err != nil {
                return nil, err
        }
        return c.client.CoreV1().ConfigMaps(c.namespace).Create(ctx, configMap, opts)
}

func (c *configMapClient) Update(ctx context.Context, configMap *v1.ConfigMap, opts metav1.UpdateOptions) (*v1.ConfigMap, error) {
        if err := c.init(); err != nil {
                return nil, err
        }
        return c.client.CoreV1().ConfigMaps(c.namespace).Update(ctx, configMap, opts)
}

func (c *configMapClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
        if err := c.init(); err != nil {
                return err
        }
        return c.client.CoreV1().ConfigMaps(c.namespace).Delete(ctx, name, opts)
}

func (c *configMapClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
        if err := c.init(); err != nil {
                return err
        }
        return c.client.CoreV1().ConfigMaps(c.namespace).DeleteCollection(ctx, opts, listOpts)
}

func (c *configMapClient) Get(ctx context.Context, name string, opts metav1.GetOptions) (*v1.ConfigMap, error) {
        if err := c.init(); err != nil {
                return nil, err
        }
        return c.client.CoreV1().ConfigMaps(c.namespace).Get(ctx, name, opts)
}

func (c *configMapClient) List(ctx context.Context, opts metav1.ListOptions) (*v1.ConfigMapList, error) {
        if err := c.init(); err != nil {
                return nil, err
        }
        return c.client.CoreV1().ConfigMaps(c.namespace).List(ctx, opts)
}

func (c *configMapClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
        if err := c.init(); err != nil {
                return nil, err
        }
        return c.client.CoreV1().ConfigMaps(c.namespace).Watch(ctx, opts)
}

func (c *configMapClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*v1.ConfigMap, error) {
        if err := c.init(); err != nil {
                return nil, err
        }
        return c.client.CoreV1().ConfigMaps(c.namespace).Patch(ctx, name, pt, data, opts, subresources...)
}

func (c *configMapClient) Apply(ctx context.Context, configMap *applycorev1.ConfigMapApplyConfiguration, opts metav1.ApplyOptions) (*v1.ConfigMap, error) {
        if err := c.init(); err != nil {
                return nil, err
        }
        return c.client.CoreV1().ConfigMaps(c.namespace).Apply(ctx, configMap, opts)
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package action

import (
        "os"
        "path/filepath"
        "strings"

        "github.com/pkg/errors"

        "helm.sh/helm/v3/pkg/chartutil"
        "helm.sh/helm/v3/pkg/lint"
        "helm.sh/helm/v3/pkg/lint/support"
)

// Lint is the action for checking that the semantics of a chart are well-formed.
//
// It provides the implementation of 'helm lint'.
type Lint struct {
        Strict        bool
        Namespace     string
        WithSubcharts bool
        Quiet         bool
}

// LintResult is the result of Lint
type LintResult struct {
        TotalChartsLinted int
        Messages          []support.Message
        Errors            []error
}

// NewLint creates a new Lint object with the given configuration.
func NewLint() *Lint {
        return &Lint{}
}

// Run executes 'helm Lint' against the given chart.
func (l *Lint) Run(paths []string, vals map[string]interface{}) *LintResult {
        lowestTolerance := support.ErrorSev
        if l.Strict {
                lowestTolerance = support.WarningSev
        }
        result := &LintResult{}
        for _, path := range paths {
                linter, err := lintChart(path, vals, l.Namespace, l.Strict)
                if err != nil {
                        result.Errors = append(result.Errors, err)
                        continue
                }

                result.Messages = append(result.Messages, linter.Messages...)
                result.TotalChartsLinted++
                for _, msg := range linter.Messages {
                        if msg.Severity >= lowestTolerance {
                                result.Errors = append(result.Errors, msg.Err)
                        }
                }
        }
        return result
}

// HasWarningsOrErrors checks is LintResult has any warnings or errors
func HasWarningsOrErrors(result *LintResult) bool {
        for _, msg := range result.Messages {
                if msg.Severity > support.InfoSev {
                        return true
                }
        }
        return len(result.Errors) > 0
}

func lintChart(path string, vals map[string]interface{}, namespace string, strict bool) (support.Linter, error) {
        var chartPath string
        linter := support.Linter{}

        if strings.HasSuffix(path, ".tgz") || strings.HasSuffix(path, ".tar.gz") {
                tempDir, err := os.MkdirTemp("", "helm-lint")
                if err != nil {
                        return linter, errors.Wrap(err, "unable to create temp dir to extract tarball")
                }
                defer os.RemoveAll(tempDir)

                file, err := os.Open(path)
                if err != nil {
                        return linter, errors.Wrap(err, "unable to open tarball")
                }
                defer file.Close()

                if err = chartutil.Expand(tempDir, file); err != nil {
                        return linter, errors.Wrap(err, "unable to extract tarball")
                }

                files, err := os.ReadDir(tempDir)
                if err != nil {
                        return linter, errors.Wrapf(err, "unable to read temporary output directory %s", tempDir)
                }
                if !files[0].IsDir() {
                        return linter, errors.Errorf("unexpected file %s in temporary output directory %s", files[0].Name(), tempDir)
                }

                chartPath = filepath.Join(tempDir, files[0].Name())
        } else {
                chartPath = path
        }

        // Guard: Error out if this is not a chart.
        if _, err := os.Stat(filepath.Join(chartPath, "Chart.yaml")); err != nil {
                return linter, errors.Wrap(err, "unable to check Chart.yaml file in chart")
        }

        return lint.All(chartPath, vals, namespace, strict), nil
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package action

import (
        "path"
        "regexp"

        "k8s.io/apimachinery/pkg/labels"

        "helm.sh/helm/v3/pkg/release"
        "helm.sh/helm/v3/pkg/releaseutil"
)

// ListStates represents zero or more status codes that a list item may have set
//
// Because this is used as a bitmask filter, more than one bit can be flipped
// in the ListStates.
type ListStates uint

const (
        // ListDeployed filters on status "deployed"
        ListDeployed ListStates = 1 << iota
        // ListUninstalled filters on status "uninstalled"
        ListUninstalled
        // ListUninstalling filters on status "uninstalling" (uninstall in progress)
        ListUninstalling
        // ListPendingInstall filters on status "pending" (deployment in progress)
        ListPendingInstall
        // ListPendingUpgrade filters on status "pending_upgrade" (upgrade in progress)
        ListPendingUpgrade
        // ListPendingRollback filters on status "pending_rollback" (rollback in progress)
        ListPendingRollback
        // ListSuperseded filters on status "superseded" (historical release version that is no longer deployed)
        ListSuperseded
        // ListFailed filters on status "failed" (release version not deployed because of error)
        ListFailed
        // ListUnknown filters on an unknown status
        ListUnknown
)

// FromName takes a state name and returns a ListStates representation.
//
// Currently, there are only names for individual flipped bits, so the returned
// ListStates will only match one of the constants. However, it is possible that
// this behavior could change in the future.
func (s ListStates) FromName(str string) ListStates {
        switch str {
        case "deployed":
                return ListDeployed
        case "uninstalled":
                return ListUninstalled
        case "superseded":
                return ListSuperseded
        case "failed":
                return ListFailed
        case "uninstalling":
                return ListUninstalling
        case "pending-install":
                return ListPendingInstall
        case "pending-upgrade":
                return ListPendingUpgrade
        case "pending-rollback":
                return ListPendingRollback
        }
        return ListUnknown
}

// ListAll is a convenience for enabling all list filters
const ListAll = ListDeployed | ListUninstalled | ListUninstalling | ListPendingInstall | ListPendingRollback | ListPendingUpgrade | ListSuperseded | ListFailed

// Sorter is a top-level sort
type Sorter uint

const (
        // ByNameDesc sorts by descending lexicographic order
        ByNameDesc Sorter = iota + 1
        // ByDateAsc sorts by ascending dates (oldest updated release first)
        ByDateAsc
        // ByDateDesc sorts by descending dates (latest updated release first)
        ByDateDesc
)

// List is the action for listing releases.
//
// It provides, for example, the implementation of 'helm list'.
// It returns no more than one revision of every release in one specific, or in
// all, namespaces.
// To list all the revisions of a specific release, see the History action.
type List struct {
        cfg *Configuration

        // All ignores the limit/offset
        All bool
        // AllNamespaces searches across namespaces
        AllNamespaces bool
        // Sort indicates the sort to use
        //
        // see pkg/releaseutil for several useful sorters
        Sort Sorter
        // Overrides the default lexicographic sorting
        ByDate      bool
        SortReverse bool
        // StateMask accepts a bitmask of states for items to show.
        // The default is ListDeployed
        StateMask ListStates
        // Limit is the number of items to return per Run()
        Limit int
        // Offset is the starting index for the Run() call
        Offset int
        // Filter is a filter that is applied to the results
        Filter       string
        Short        bool
        NoHeaders    bool
        TimeFormat   string
        Uninstalled  bool
        Superseded   bool
        Uninstalling bool
        Deployed     bool
        Failed       bool
        Pending      bool
        Selector     string
}

// NewList constructs a new *List
func NewList(cfg *Configuration) *List {
        return &List{
                StateMask: ListDeployed | ListFailed,
                cfg:       cfg,
        }
}

// Run executes the list command, returning a set of matches.
func (l *List) Run() ([]*release.Release, error) {
        if err := l.cfg.KubeClient.IsReachable(); err != nil {
                return nil, err
        }

        var filter *regexp.Regexp
        if l.Filter != "" {
                var err error
                filter, err = regexp.Compile(l.Filter)
                if err != nil {
                        return nil, err
                }
        }

        results, err := l.cfg.Releases.List(func(rel *release.Release) bool {
                // Skip anything that doesn't match the filter.
                if filter != nil && !filter.MatchString(rel.Name) {
                        return false
                }

                return true
        })

        if err != nil {
                return nil, err
        }

        if results == nil {
                return results, nil
        }

        // by definition, superseded releases are never shown if
        // only the latest releases are returned. so if requested statemask
        // is _only_ ListSuperseded, skip the latest release filter
        if l.StateMask != ListSuperseded {
                results = filterLatestReleases(results)
        }

        // State mask application must occur after filtering to
        // latest releases, otherwise outdated entries can be returned
        results = l.filterStateMask(results)

        // Skip anything that doesn't match the selector
        selectorObj, err := labels.Parse(l.Selector)
        if err != nil {
                return nil, err
        }
        results = l.filterSelector(results, selectorObj)

        // Unfortunately, we have to sort before truncating, which can incur substantial overhead
        l.sort(results)

        // Guard on offset
        if l.Offset >= len(results) {
                return []*release.Release{}, nil
        }

        // Calculate the limit and offset, and then truncate results if necessary.
        limit := len(results)
        if l.Limit > 0 && l.Limit < limit {
                limit = l.Limit
        }
        last := l.Offset + limit
        if l := len(results); l < last {
                last = l
        }
        results = results[l.Offset:last]

        return results, err
}

// sort is an in-place sort where order is based on the value of a.Sort
func (l *List) sort(rels []*release.Release) {
        if l.SortReverse {
                l.Sort = ByNameDesc
        }

        if l.ByDate {
                l.Sort = ByDateDesc
                if l.SortReverse {
                        l.Sort = ByDateAsc
                }
        }

        switch l.Sort {
        case ByDateDesc:
                releaseutil.SortByDate(rels)
        case ByDateAsc:
                releaseutil.Reverse(rels, releaseutil.SortByDate)
        case ByNameDesc:
                releaseutil.Reverse(rels, releaseutil.SortByName)
        default:
                releaseutil.SortByName(rels)
        }
}

// filterLatestReleases returns a list scrubbed of old releases.
func filterLatestReleases(releases []*release.Release) []*release.Release {
        latestReleases := make(map[string]*release.Release)

        for _, rls := range releases {
                name, namespace := rls.Name, rls.Namespace
                key := path.Join(namespace, name)
                if latestRelease, exists := latestReleases[key]; exists && latestRelease.Version > rls.Version {
                        continue
                }
                latestReleases[key] = rls
        }

        var list = make([]*release.Release, 0, len(latestReleases))
        for _, rls := range latestReleases {
                list = append(list, rls)
        }
        return list
}

func (l *List) filterStateMask(releases []*release.Release) []*release.Release {
        desiredStateReleases := make([]*release.Release, 0)

        for _, rls := range releases {
                currentStatus := l.StateMask.FromName(rls.Info.Status.String())
                mask := l.StateMask & currentStatus
                if mask == 0 {
                        continue
                }
                desiredStateReleases = append(desiredStateReleases, rls)
        }

        return desiredStateReleases
}

func (l *List) filterSelector(releases []*release.Release, selector labels.Selector) []*release.Release {
        desiredStateReleases := make([]*release.Release, 0)

        for _, rls := range releases {
                if selector.Matches(labels.Set(rls.Labels)) {
                        desiredStateReleases = append(desiredStateReleases, rls)
                }
        }

        return desiredStateReleases
}

// SetStateMask calculates the state mask based on parameters.
func (l *List) SetStateMask() {
        if l.All {
                l.StateMask = ListAll
                return
        }

        state := ListStates(0)
        if l.Deployed {
                state |= ListDeployed
        }
        if l.Uninstalled {
                state |= ListUninstalled
        }
        if l.Uninstalling {
                state |= ListUninstalling
        }
        if l.Pending {
                state |= ListPendingInstall | ListPendingRollback | ListPendingUpgrade
        }
        if l.Failed {
                state |= ListFailed
        }
        if l.Superseded {
                state |= ListSuperseded
        }

        // Apply a default
        if state == 0 {
                state = ListDeployed | ListFailed
        }

        l.StateMask = state
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package action

import (
        "testing"

        "github.com/stretchr/testify/assert"

        "helm.sh/helm/v3/pkg/release"
        "helm.sh/helm/v3/pkg/storage"
)

func TestListStates(t *testing.T) {
        for input, expect := range map[string]ListStates{
                "deployed":            ListDeployed,
                "uninstalled":         ListUninstalled,
                "uninstalling":        ListUninstalling,
                "superseded":          ListSuperseded,
                "failed":              ListFailed,
                "pending-install":     ListPendingInstall,
                "pending-rollback":    ListPendingRollback,
                "pending-upgrade":     ListPendingUpgrade,
                "unknown":             ListUnknown,
                "totally made up key": ListUnknown,
        } {
                if expect != expect.FromName(input) {
                        t.Errorf("Expected %d for %s", expect, input)
                }
                // This is a cheap way to verify that ListAll actually allows everything but Unknown
                if got := expect.FromName(input); got != ListUnknown && got&ListAll == 0 {
                        t.Errorf("Expected %s to match the ListAll filter", input)
                }
        }

        filter := ListDeployed | ListPendingRollback
        if status := filter.FromName("deployed"); filter&status == 0 {
                t.Errorf("Expected %d to match mask %d", status, filter)
        }
        if status := filter.FromName("failed"); filter&status != 0 {
                t.Errorf("Expected %d to fail to match mask %d", status, filter)
        }
}

func TestList_Empty(t *testing.T) {
        lister := NewList(actionConfigFixture(t))
        list, err := lister.Run()
        assert.NoError(t, err)
        assert.Len(t, list, 0)
}

func newListFixture(t *testing.T) *List {
        return NewList(actionConfigFixture(t))
}

func TestList_OneNamespace(t *testing.T) {
        is := assert.New(t)
        lister := newListFixture(t)
        makeMeSomeReleases(lister.cfg.Releases, t)
        list, err := lister.Run()
        is.NoError(err)
        is.Len(list, 3)
}

func TestList_AllNamespaces(t *testing.T) {
        is := assert.New(t)
        lister := newListFixture(t)
        makeMeSomeReleases(lister.cfg.Releases, t)
        lister.AllNamespaces = true
        lister.SetStateMask()
        list, err := lister.Run()
        is.NoError(err)
        is.Len(list, 3)
}

func TestList_Sort(t *testing.T) {
        is := assert.New(t)
        lister := newListFixture(t)
        lister.Sort = ByNameDesc // Other sorts are tested elsewhere
        makeMeSomeReleases(lister.cfg.Releases, t)
        list, err := lister.Run()
        is.NoError(err)
        is.Len(list, 3)
        is.Equal("two", list[0].Name)
        is.Equal("three", list[1].Name)
        is.Equal("one", list[2].Name)
}

func TestList_Limit(t *testing.T) {
        is := assert.New(t)
        lister := newListFixture(t)
        lister.Limit = 2
        makeMeSomeReleases(lister.cfg.Releases, t)
        list, err := lister.Run()
        is.NoError(err)
        is.Len(list, 2)
        // Lex order means one, three, two
        is.Equal("one", list[0].Name)
        is.Equal("three", list[1].Name)
}

func TestList_BigLimit(t *testing.T) {
        is := assert.New(t)
        lister := newListFixture(t)
        lister.Limit = 20
        makeMeSomeReleases(lister.cfg.Releases, t)
        list, err := lister.Run()
        is.NoError(err)
        is.Len(list, 3)

        // Lex order means one, three, two
        is.Equal("one", list[0].Name)
        is.Equal("three", list[1].Name)
        is.Equal("two", list[2].Name)
}

func TestList_LimitOffset(t *testing.T) {
        is := assert.New(t)
        lister := newListFixture(t)
        lister.Limit = 2
        lister.Offset = 1
        makeMeSomeReleases(lister.cfg.Releases, t)
        list, err := lister.Run()
        is.NoError(err)
        is.Len(list, 2)

        // Lex order means one, three, two
        is.Equal("three", list[0].Name)
        is.Equal("two", list[1].Name)
}

func TestList_LimitOffsetOutOfBounds(t *testing.T) {
        is := assert.New(t)
        lister := newListFixture(t)
        lister.Limit = 2
        lister.Offset = 3 // Last item is index 2
        makeMeSomeReleases(lister.cfg.Releases, t)
        list, err := lister.Run()
        is.NoError(err)
        is.Len(list, 0)

        lister.Limit = 10
        lister.Offset = 1
        list, err = lister.Run()
        is.NoError(err)
        is.Len(list, 2)
}

func TestList_StateMask(t *testing.T) {
        is := assert.New(t)
        lister := newListFixture(t)
        makeMeSomeReleases(lister.cfg.Releases, t)
        one, err := lister.cfg.Releases.Get("one", 1)
        is.NoError(err)
        one.SetStatus(release.StatusUninstalled, "uninstalled")
        err = lister.cfg.Releases.Update(one)
        is.NoError(err)

        res, err := lister.Run()
        is.NoError(err)
        is.Len(res, 2)
        is.Equal("three", res[0].Name)
        is.Equal("two", res[1].Name)

        lister.StateMask = ListUninstalled
        res, err = lister.Run()
        is.NoError(err)
        is.Len(res, 1)
        is.Equal("one", res[0].Name)

        lister.StateMask |= ListDeployed
        res, err = lister.Run()
        is.NoError(err)
        is.Len(res, 3)
}

func TestList_StateMaskWithStaleRevisions(t *testing.T) {
        is := assert.New(t)
        lister := newListFixture(t)
        lister.StateMask = ListFailed

        makeMeSomeReleasesWithStaleFailure(lister.cfg.Releases, t)

        res, err := lister.Run()

        is.NoError(err)
        is.Len(res, 1)

        // "dirty" release should _not_ be present as most recent
        // release is deployed despite failed release in past
        is.Equal("failed", res[0].Name)
}

func makeMeSomeReleasesWithStaleFailure(store *storage.Storage, t *testing.T) {
        t.Helper()
        one := namedReleaseStub("clean", release.StatusDeployed)
        one.Namespace = "default"
        one.Version = 1

        two := namedReleaseStub("dirty", release.StatusDeployed)
        two.Namespace = "default"
        two.Version = 1

        three := namedReleaseStub("dirty", release.StatusFailed)
        three.Namespace = "default"
        three.Version = 2

        four := namedReleaseStub("dirty", release.StatusDeployed)
        four.Namespace = "default"
        four.Version = 3

        five := namedReleaseStub("failed", release.StatusFailed)
        five.Namespace = "default"
        five.Version = 1

        for _, rel := range []*release.Release{one, two, three, four, five} {
                if err := store.Create(rel); err != nil {
                        t.Fatal(err)
                }
        }

        all, err := store.ListReleases()
        assert.NoError(t, err)
        assert.Len(t, all, 5, "sanity test: five items added")
}

func TestList_Filter(t *testing.T) {
        is := assert.New(t)
        lister := newListFixture(t)
        lister.Filter = "th."
        makeMeSomeReleases(lister.cfg.Releases, t)

        res, err := lister.Run()
        is.NoError(err)
        is.Len(res, 1)
        is.Equal("three", res[0].Name)
}

func TestList_FilterFailsCompile(t *testing.T) {
        is := assert.New(t)
        lister := newListFixture(t)
        lister.Filter = "t[h.{{{"
        makeMeSomeReleases(lister.cfg.Releases, t)

        _, err := lister.Run()
        is.Error(err)
}

func makeMeSomeReleases(store *storage.Storage, t *testing.T) {
        t.Helper()
        one := releaseStub()
        one.Name = "one"
        one.Namespace = "default"
        one.Version = 1
        two := releaseStub()
        two.Name = "two"
        two.Namespace = "default"
        two.Version = 2
        three := releaseStub()
        three.Name = "three"
        three.Namespace = "default"
        three.Version = 3

        for _, rel := range []*release.Release{one, two, three} {
                if err := store.Create(rel); err != nil {
                        t.Fatal(err)
                }
        }

        all, err := store.ListReleases()
        assert.NoError(t, err)
        assert.Len(t, all, 3, "sanity test: three items added")
}

func TestFilterLatestReleases(t *testing.T) {
        t.Run("should filter old versions of the same release", func(t *testing.T) {
                r1 := releaseStub()
                r1.Name = "r"
                r1.Version = 1
                r2 := releaseStub()
                r2.Name = "r"
                r2.Version = 2
                another := releaseStub()
                another.Name = "another"
                another.Version = 1

                filteredList := filterLatestReleases([]*release.Release{r1, r2, another})
                expectedFilteredList := []*release.Release{r2, another}

                assert.ElementsMatch(t, expectedFilteredList, filteredList)
        })

        t.Run("should not filter out any version across namespaces", func(t *testing.T) {
                r1 := releaseStub()
                r1.Name = "r"
                r1.Namespace = "default"
                r1.Version = 1
                r2 := releaseStub()
                r2.Name = "r"
                r2.Namespace = "testing"
                r2.Version = 2

                filteredList := filterLatestReleases([]*release.Release{r1, r2})
                expectedFilteredList := []*release.Release{r1, r2}

                assert.ElementsMatch(t, expectedFilteredList, filteredList)
        })
}

func TestSelectorList(t *testing.T) {
        r1 := releaseStub()
        r1.Name = "r1"
        r1.Version = 1
        r1.Labels = map[string]string{"key": "value1"}
        r2 := releaseStub()
        r2.Name = "r2"
        r2.Version = 1
        r2.Labels = map[string]string{"key": "value2"}
        r3 := releaseStub()
        r3.Name = "r3"
        r3.Version = 1
        r3.Labels = map[string]string{}

        lister := newListFixture(t)
        for _, rel := range []*release.Release{r1, r2, r3} {
                if err := lister.cfg.Releases.Create(rel); err != nil {
                        t.Fatal(err)
                }
        }

        t.Run("should fail selector parsing", func(t *testing.T) {
                is := assert.New(t)
                lister.Selector = "a?=b"

                _, err := lister.Run()
                is.Error(err)
        })

        t.Run("should select one release with matching label", func(t *testing.T) {
                lister.Selector = "key==value1"
                res, _ := lister.Run()

                expectedFilteredList := []*release.Release{r1}
                assert.ElementsMatch(t, expectedFilteredList, res)
        })

        t.Run("should select two releases with non matching label", func(t *testing.T) {
                lister.Selector = "key!=value1"
                res, _ := lister.Run()

                expectedFilteredList := []*release.Release{r2, r3}
                assert.ElementsMatch(t, expectedFilteredList, res)
        })
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package action

import (
        "bufio"
        "fmt"
        "os"
        "syscall"

        "github.com/Masterminds/semver/v3"
        "github.com/pkg/errors"
        "golang.org/x/term"

        "helm.sh/helm/v3/pkg/chart/loader"
        "helm.sh/helm/v3/pkg/chartutil"
        "helm.sh/helm/v3/pkg/provenance"
)

// Package is the action for packaging a chart.
//
// It provides the implementation of 'helm package'.
type Package struct {
        Sign             bool
        Key              string
        Keyring          string
        PassphraseFile   string
        Version          string
        AppVersion       string
        Destination      string
        DependencyUpdate bool

        RepositoryConfig string
        RepositoryCache  string
}

// NewPackage creates a new Package object with the given configuration.
func NewPackage() *Package {
        return &Package{}
}

// Run executes 'helm package' against the given chart and returns the path to the packaged chart.
func (p *Package) Run(path string, vals map[string]interface{}) (string, error) {
        ch, err := loader.LoadDir(path)
        if err != nil {
                return "", err
        }

        // If version is set, modify the version.
        if p.Version != "" {
                ch.Metadata.Version = p.Version
        }

        if err := validateVersion(ch.Metadata.Version); err != nil {
                return "", err
        }

        if p.AppVersion != "" {
                ch.Metadata.AppVersion = p.AppVersion
        }

        if reqs := ch.Metadata.Dependencies; reqs != nil {
                if err := CheckDependencies(ch, reqs); err != nil {
                        return "", err
                }
        }

        var dest string
        if p.Destination == "." {
                // Save to the current working directory.
                dest, err = os.Getwd()
                if err != nil {
                        return "", err
                }
        } else {
                // Otherwise save to set destination
                dest = p.Destination
        }

        name, err := chartutil.Save(ch, dest)
        if err != nil {
                return "", errors.Wrap(err, "failed to save")
        }

        if p.Sign {
                err = p.Clearsign(name)
        }

        return name, err
}

// validateVersion Verify that version is a Version, and error out if it is not.
func validateVersion(ver string) error {
        if _, err := semver.NewVersion(ver); err != nil {
                return err
        }
        return nil
}

// Clearsign signs a chart
func (p *Package) Clearsign(filename string) error {
        // Load keyring
        signer, err := provenance.NewFromKeyring(p.Keyring, p.Key)
        if err != nil {
                return err
        }

        passphraseFetcher := promptUser
        if p.PassphraseFile != "" {
                passphraseFetcher, err = passphraseFileFetcher(p.PassphraseFile, os.Stdin)
                if err != nil {
                        return err
                }
        }

        if err := signer.DecryptKey(passphraseFetcher); err != nil {
                return err
        }

        sig, err := signer.ClearSign(filename)
        if err != nil {
                return err
        }

        return os.WriteFile(filename+".prov", []byte(sig), 0644)
}

// promptUser implements provenance.PassphraseFetcher
func promptUser(name string) ([]byte, error) {
        fmt.Printf("Password for key %q >  ", name)
        // syscall.Stdin is not an int in all environments and needs to be coerced
        // into one there (e.g., Windows)
        pw, err := term.ReadPassword(int(syscall.Stdin))
        fmt.Println()
        return pw, err
}

func passphraseFileFetcher(passphraseFile string, stdin *os.File) (provenance.PassphraseFetcher, error) {
        file, err := openPassphraseFile(passphraseFile, stdin)
        if err != nil {
                return nil, err
        }
        defer file.Close()

        reader := bufio.NewReader(file)
        passphrase, _, err := reader.ReadLine()
        if err != nil {
                return nil, err
        }
        return func(name string) ([]byte, error) {
                return passphrase, nil
        }, nil
}

func openPassphraseFile(passphraseFile string, stdin *os.File) (*os.File, error) {
        if passphraseFile == "-" {
                stat, err := stdin.Stat()
                if err != nil {
                        return nil, err
                }
                if (stat.Mode() & os.ModeNamedPipe) == 0 {
                        return nil, errors.New("specified reading passphrase from stdin, without input on stdin")
                }
                return stdin, nil
        }
        return os.Open(passphraseFile)
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package action

import (
        "fmt"
        "os"
        "path/filepath"
        "strings"

        "github.com/pkg/errors"

        "helm.sh/helm/v3/pkg/chartutil"
        "helm.sh/helm/v3/pkg/cli"
        "helm.sh/helm/v3/pkg/downloader"
        "helm.sh/helm/v3/pkg/getter"
        "helm.sh/helm/v3/pkg/registry"
        "helm.sh/helm/v3/pkg/repo"
)

// Pull is the action for checking a given release's information.
//
// It provides the implementation of 'helm pull'.
type Pull struct {
        ChartPathOptions

        Settings *cli.EnvSettings // TODO: refactor this out of pkg/action

        Devel       bool
        Untar       bool
        VerifyLater bool
        UntarDir    string
        DestDir     string
        cfg         *Configuration
}

type PullOpt func(*Pull)

func WithConfig(cfg *Configuration) PullOpt {
        return func(p *Pull) {
                p.cfg = cfg
        }
}

// NewPull creates a new Pull object.
func NewPull() *Pull {
        return NewPullWithOpts()
}

// NewPullWithOpts creates a new pull, with configuration options.
func NewPullWithOpts(opts ...PullOpt) *Pull {
        p := &Pull{}
        for _, fn := range opts {
                fn(p)
        }

        return p
}

// SetRegistryClient sets the registry client on the pull configuration object.
func (p *Pull) SetRegistryClient(client *registry.Client) {
        p.cfg.RegistryClient = client
}

// Run executes 'helm pull' against the given release.
func (p *Pull) Run(chartRef string) (string, error) {
        var out strings.Builder

        c := downloader.ChartDownloader{
                Out:     &out,
                Keyring: p.Keyring,
                Verify:  downloader.VerifyNever,
                Getters: getter.All(p.Settings),
                Options: []getter.Option{
                        getter.WithBasicAuth(p.Username, p.Password),
                        getter.WithPassCredentialsAll(p.PassCredentialsAll),
                        getter.WithTLSClientConfig(p.CertFile, p.KeyFile, p.CaFile),
                        getter.WithInsecureSkipVerifyTLS(p.InsecureSkipTLSverify),
                        getter.WithPlainHTTP(p.PlainHTTP),
                },
                RegistryClient:   p.cfg.RegistryClient,
                RepositoryConfig: p.Settings.RepositoryConfig,
                RepositoryCache:  p.Settings.RepositoryCache,
        }

        if registry.IsOCI(chartRef) {
                c.Options = append(c.Options,
                        getter.WithRegistryClient(p.cfg.RegistryClient))
                c.RegistryClient = p.cfg.RegistryClient
        }

        if p.Verify {
                c.Verify = downloader.VerifyAlways
        } else if p.VerifyLater {
                c.Verify = downloader.VerifyLater
        }

        // If untar is set, we fetch to a tempdir, then untar and copy after
        // verification.
        dest := p.DestDir
        if p.Untar {
                var err error
                dest, err = os.MkdirTemp("", "helm-")
                if err != nil {
                        return out.String(), errors.Wrap(err, "failed to untar")
                }
                defer os.RemoveAll(dest)
        }

        if p.RepoURL != "" {
                chartURL, err := repo.FindChartInAuthAndTLSAndPassRepoURL(p.RepoURL, p.Username, p.Password, chartRef, p.Version, p.CertFile, p.KeyFile, p.CaFile, p.InsecureSkipTLSverify, p.PassCredentialsAll, getter.All(p.Settings))
                if err != nil {
                        return out.String(), err
                }
                chartRef = chartURL
        }

        saved, v, err := c.DownloadTo(chartRef, p.Version, dest)
        if err != nil {
                return out.String(), err
        }

        if p.Verify {
                for name := range v.SignedBy.Identities {
                        fmt.Fprintf(&out, "Signed by: %v\n", name)
                }
                fmt.Fprintf(&out, "Using Key With Fingerprint: %X\n", v.SignedBy.PrimaryKey.Fingerprint)
                fmt.Fprintf(&out, "Chart Hash Verified: %s\n", v.FileHash)
        }

        // After verification, untar the chart into the requested directory.
        if p.Untar {
                ud := p.UntarDir
                if !filepath.IsAbs(ud) {
                        ud = filepath.Join(p.DestDir, ud)
                }
                // Let udCheck to check conflict file/dir without replacing ud when untarDir is the current directory(.).
                udCheck := ud
                if udCheck == "." {
                        _, udCheck = filepath.Split(chartRef)
                } else {
                        _, chartName := filepath.Split(chartRef)
                        udCheck = filepath.Join(udCheck, chartName)
                }

                if _, err := os.Stat(udCheck); err != nil {
                        if err := os.MkdirAll(udCheck, 0755); err != nil {
                                return out.String(), errors.Wrap(err, "failed to untar (mkdir)")
                        }

                } else {
                        return out.String(), errors.Errorf("failed to untar: a file or directory with the name %s already exists", udCheck)
                }

                return out.String(), chartutil.ExpandFile(ud, saved)
        }
        return out.String(), nil
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package action

import (
        "io"
        "strings"

        "helm.sh/helm/v3/pkg/cli"
        "helm.sh/helm/v3/pkg/pusher"
        "helm.sh/helm/v3/pkg/registry"
        "helm.sh/helm/v3/pkg/uploader"
)

// Push is the action for uploading a chart.
//
// It provides the implementation of 'helm push'.
type Push struct {
        Settings              *cli.EnvSettings
        cfg                   *Configuration
        certFile              string
        keyFile               string
        caFile                string
        insecureSkipTLSverify bool
        plainHTTP             bool
        out                   io.Writer
}

// PushOpt is a type of function that sets options for a push action.
type PushOpt func(*Push)

// WithPushConfig sets the cfg field on the push configuration object.
func WithPushConfig(cfg *Configuration) PushOpt {
        return func(p *Push) {
                p.cfg = cfg
        }
}

// WithTLSClientConfig sets the certFile, keyFile, and caFile fields on the push configuration object.
func WithTLSClientConfig(certFile, keyFile, caFile string) PushOpt {
        return func(p *Push) {
                p.certFile = certFile
                p.keyFile = keyFile
                p.caFile = caFile
        }
}

// WithInsecureSkipTLSVerify determines if a TLS Certificate will be checked
func WithInsecureSkipTLSVerify(insecureSkipTLSVerify bool) PushOpt {
        return func(p *Push) {
                p.insecureSkipTLSverify = insecureSkipTLSVerify
        }
}

// WithPlainHTTP configures the use of plain HTTP connections.
func WithPlainHTTP(plainHTTP bool) PushOpt {
        return func(p *Push) {
                p.plainHTTP = plainHTTP
        }
}

// WithOptWriter sets the registryOut field on the push configuration object.
func WithPushOptWriter(out io.Writer) PushOpt {
        return func(p *Push) {
                p.out = out
        }
}

// NewPushWithOpts creates a new push, with configuration options.
func NewPushWithOpts(opts ...PushOpt) *Push {
        p := &Push{}
        for _, fn := range opts {
                fn(p)
        }
        return p
}

// Run executes 'helm push' against the given chart archive.
func (p *Push) Run(chartRef string, remote string) (string, error) {
        var out strings.Builder

        c := uploader.ChartUploader{
                Out:     &out,
                Pushers: pusher.All(p.Settings),
                Options: []pusher.Option{
                        pusher.WithTLSClientConfig(p.certFile, p.keyFile, p.caFile),
                        pusher.WithInsecureSkipTLSVerify(p.insecureSkipTLSverify),
                        pusher.WithPlainHTTP(p.plainHTTP),
                },
        }

        if registry.IsOCI(remote) {
                // Don't use the default registry client if tls options are set.
                c.Options = append(c.Options, pusher.WithRegistryClient(p.cfg.RegistryClient))
        }

        return out.String(), c.UploadTo(chartRef, remote)
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package action

import (
        "io"

        "helm.sh/helm/v3/pkg/registry"
)

// RegistryLogin performs a registry login operation.
type RegistryLogin struct {
        cfg      *Configuration
        certFile string
        keyFile  string
        caFile   string
        insecure bool
}

type RegistryLoginOpt func(*RegistryLogin) error

// WithCertFile specifies the path to the certificate file to use for TLS.
func WithCertFile(certFile string) RegistryLoginOpt {
        return func(r *RegistryLogin) error {
                r.certFile = certFile
                return nil
        }
}

// WithKeyFile specifies whether to very certificates when communicating.
func WithInsecure(insecure bool) RegistryLoginOpt {
        return func(r *RegistryLogin) error {
                r.insecure = insecure
                return nil
        }
}

// WithKeyFile specifies the path to the key file to use for TLS.
func WithKeyFile(keyFile string) RegistryLoginOpt {
        return func(r *RegistryLogin) error {
                r.keyFile = keyFile
                return nil
        }
}

// WithCAFile specifies the path to the CA file to use for TLS.
func WithCAFile(caFile string) RegistryLoginOpt {
        return func(r *RegistryLogin) error {
                r.caFile = caFile
                return nil
        }
}

// NewRegistryLogin creates a new RegistryLogin object with the given configuration.
func NewRegistryLogin(cfg *Configuration) *RegistryLogin {
        return &RegistryLogin{
                cfg: cfg,
        }
}

// Run executes the registry login operation
func (a *RegistryLogin) Run(out io.Writer, hostname string, username string, password string, opts ...RegistryLoginOpt) error {
        for _, opt := range opts {
                if err := opt(a); err != nil {
                        return err
                }
        }

        return a.cfg.RegistryClient.Login(
                hostname,
                registry.LoginOptBasicAuth(username, password),
                registry.LoginOptInsecure(a.insecure),
                registry.LoginOptTLSClientConfig(a.certFile, a.keyFile, a.caFile))
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package action

import (
        "io"
)

// RegistryLogout performs a registry login operation.
type RegistryLogout struct {
        cfg *Configuration
}

// NewRegistryLogout creates a new RegistryLogout object with the given configuration.
func NewRegistryLogout(cfg *Configuration) *RegistryLogout {
        return &RegistryLogout{
                cfg: cfg,
        }
}

// Run executes the registry logout operation
func (a *RegistryLogout) Run(out io.Writer, hostname string) error {
        return a.cfg.RegistryClient.Logout(hostname)
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package action

import (
        "context"
        "fmt"
        "io"
        "sort"
        "time"

        "github.com/pkg/errors"
        v1 "k8s.io/api/core/v1"

        "helm.sh/helm/v3/pkg/chartutil"
        "helm.sh/helm/v3/pkg/release"
)

const (
        ExcludeNameFilter = "!name"
        IncludeNameFilter = "name"
)

// ReleaseTesting is the action for testing a release.
//
// It provides the implementation of 'helm test'.
type ReleaseTesting struct {
        cfg     *Configuration
        Timeout time.Duration
        // Used for fetching logs from test pods
        Namespace string
        Filters   map[string][]string
}

// NewReleaseTesting creates a new ReleaseTesting object with the given configuration.
func NewReleaseTesting(cfg *Configuration) *ReleaseTesting {
        return &ReleaseTesting{
                cfg:     cfg,
                Filters: map[string][]string{},
        }
}

// Run executes 'helm test' against the given release.
func (r *ReleaseTesting) Run(name string) (*release.Release, error) {
        if err := r.cfg.KubeClient.IsReachable(); err != nil {
                return nil, err
        }

        if err := chartutil.ValidateReleaseName(name); err != nil {
                return nil, errors.Errorf("releaseTest: Release name is invalid: %s", name)
        }

        // finds the non-deleted release with the given name
        rel, err := r.cfg.Releases.Last(name)
        if err != nil {
                return rel, err
        }

        skippedHooks := []*release.Hook{}
        executingHooks := []*release.Hook{}
        if len(r.Filters[ExcludeNameFilter]) != 0 {
                for _, h := range rel.Hooks {
                        if contains(r.Filters[ExcludeNameFilter], h.Name) {
                                skippedHooks = append(skippedHooks, h)
                        } else {
                                executingHooks = append(executingHooks, h)
                        }
                }
                rel.Hooks = executingHooks
        }
        if len(r.Filters[IncludeNameFilter]) != 0 {
                executingHooks = nil
                for _, h := range rel.Hooks {
                        if contains(r.Filters[IncludeNameFilter], h.Name) {
                                executingHooks = append(executingHooks, h)
                        } else {
                                skippedHooks = append(skippedHooks, h)
                        }
                }
                rel.Hooks = executingHooks
        }

        if err := r.cfg.execHook(rel, release.HookTest, r.Timeout); err != nil {
                rel.Hooks = append(skippedHooks, rel.Hooks...)
                r.cfg.Releases.Update(rel)
                return rel, err
        }

        rel.Hooks = append(skippedHooks, rel.Hooks...)
        return rel, r.cfg.Releases.Update(rel)
}

// GetPodLogs will write the logs for all test pods in the given release into
// the given writer. These can be immediately output to the user or captured for
// other uses
func (r *ReleaseTesting) GetPodLogs(out io.Writer, rel *release.Release) error {
        client, err := r.cfg.KubernetesClientSet()
        if err != nil {
                return errors.Wrap(err, "unable to get kubernetes client to fetch pod logs")
        }

        hooksByWight := append([]*release.Hook{}, rel.Hooks...)
        sort.Stable(hookByWeight(hooksByWight))
        for _, h := range hooksByWight {
                for _, e := range h.Events {
                        if e == release.HookTest {
                                if contains(r.Filters[ExcludeNameFilter], h.Name) {
                                        continue
                                }
                                if len(r.Filters[IncludeNameFilter]) > 0 && !contains(r.Filters[IncludeNameFilter], h.Name) {
                                        continue
                                }
                                req := client.CoreV1().Pods(r.Namespace).GetLogs(h.Name, &v1.PodLogOptions{})
                                logReader, err := req.Stream(context.Background())
                                if err != nil {
                                        return errors.Wrapf(err, "unable to get pod logs for %s", h.Name)
                                }

                                fmt.Fprintf(out, "POD LOGS: %s\n", h.Name)
                                _, err = io.Copy(out, logReader)
                                fmt.Fprintln(out)
                                if err != nil {
                                        return errors.Wrapf(err, "unable to write pod logs for %s", h.Name)
                                }
                        }
                }
        }
        return nil
}

func contains(arr []string, value string) bool {
        for _, item := range arr {
                if item == value {
                        return true
                }
        }
        return false
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package action

import (
        "strings"

        "helm.sh/helm/v3/pkg/kube"
        "helm.sh/helm/v3/pkg/releaseutil"
)

func filterManifestsToKeep(manifests []releaseutil.Manifest) (keep, remaining []releaseutil.Manifest) {
        for _, m := range manifests {
                if m.Head.Metadata == nil || m.Head.Metadata.Annotations == nil || len(m.Head.Metadata.Annotations) == 0 {
                        remaining = append(remaining, m)
                        continue
                }

                resourcePolicyType, ok := m.Head.Metadata.Annotations[kube.ResourcePolicyAnno]
                if !ok {
                        remaining = append(remaining, m)
                        continue
                }

                resourcePolicyType = strings.ToLower(strings.TrimSpace(resourcePolicyType))
                if resourcePolicyType == kube.KeepPolicy {
                        keep = append(keep, m)
                }

        }
        return keep, remaining
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package action

import (
        "bytes"
        "fmt"
        "strings"
        "time"

        "github.com/pkg/errors"

        "helm.sh/helm/v3/pkg/chartutil"
        "helm.sh/helm/v3/pkg/release"
        helmtime "helm.sh/helm/v3/pkg/time"
)

// Rollback is the action for rolling back to a given release.
//
// It provides the implementation of 'helm rollback'.
type Rollback struct {
        cfg *Configuration

        Version       int
        Timeout       time.Duration
        Wait          bool
        WaitForJobs   bool
        DisableHooks  bool
        DryRun        bool
        Recreate      bool // will (if true) recreate pods after a rollback.
        Force         bool // will (if true) force resource upgrade through uninstall/recreate if needed
        CleanupOnFail bool
        MaxHistory    int // MaxHistory limits the maximum number of revisions saved per release
}

// NewRollback creates a new Rollback object with the given configuration.
func NewRollback(cfg *Configuration) *Rollback {
        return &Rollback{
                cfg: cfg,
        }
}

// Run executes 'helm rollback' against the given release.
func (r *Rollback) Run(name string) error {
        if err := r.cfg.KubeClient.IsReachable(); err != nil {
                return err
        }

        r.cfg.Releases.MaxHistory = r.MaxHistory

        r.cfg.Log("preparing rollback of %s", name)
        currentRelease, targetRelease, err := r.prepareRollback(name)
        if err != nil {
                return err
        }

        if !r.DryRun {
                r.cfg.Log("creating rolled back release for %s", name)
                if err := r.cfg.Releases.Create(targetRelease); err != nil {
                        return err
                }
        }

        r.cfg.Log("performing rollback of %s", name)
        if _, err := r.performRollback(currentRelease, targetRelease); err != nil {
                return err
        }

        if !r.DryRun {
                r.cfg.Log("updating status for rolled back release for %s", name)
                if err := r.cfg.Releases.Update(targetRelease); err != nil {
                        return err
                }
        }
        return nil
}

// prepareRollback finds the previous release and prepares a new release object with
// the previous release's configuration
func (r *Rollback) prepareRollback(name string) (*release.Release, *release.Release, error) {
        if err := chartutil.ValidateReleaseName(name); err != nil {
                return nil, nil, errors.Errorf("prepareRollback: Release name is invalid: %s", name)
        }

        if r.Version < 0 {
                return nil, nil, errInvalidRevision
        }

        currentRelease, err := r.cfg.Releases.Last(name)
        if err != nil {
                return nil, nil, err
        }

        previousVersion := r.Version
        if r.Version == 0 {
                previousVersion = currentRelease.Version - 1
        }

        historyReleases, err := r.cfg.Releases.History(name)
        if err != nil {
                return nil, nil, err
        }

        // Check if the history version to be rolled back exists
        previousVersionExist := false
        for _, historyRelease := range historyReleases {
                version := historyRelease.Version
                if previousVersion == version {
                        previousVersionExist = true
                        break
                }
        }
        if !previousVersionExist {
                return nil, nil, errors.Errorf("release has no %d version", previousVersion)
        }

        r.cfg.Log("rolling back %s (current: v%d, target: v%d)", name, currentRelease.Version, previousVersion)

        previousRelease, err := r.cfg.Releases.Get(name, previousVersion)
        if err != nil {
                return nil, nil, err
        }

        // Store a new release object with previous release's configuration
        targetRelease := &release.Release{
                Name:      name,
                Namespace: currentRelease.Namespace,
                Chart:     previousRelease.Chart,
                Config:    previousRelease.Config,
                Info: &release.Info{
                        FirstDeployed: currentRelease.Info.FirstDeployed,
                        LastDeployed:  helmtime.Now(),
                        Status:        release.StatusPendingRollback,
                        Notes:         previousRelease.Info.Notes,
                        // Because we lose the reference to previous version elsewhere, we set the
                        // message here, and only override it later if we experience failure.
                        Description: fmt.Sprintf("Rollback to %d", previousVersion),
                },
                Version:  currentRelease.Version + 1,
                Labels:   previousRelease.Labels,
                Manifest: previousRelease.Manifest,
                Hooks:    previousRelease.Hooks,
        }

        return currentRelease, targetRelease, nil
}

func (r *Rollback) performRollback(currentRelease, targetRelease *release.Release) (*release.Release, error) {
        if r.DryRun {
                r.cfg.Log("dry run for %s", targetRelease.Name)
                return targetRelease, nil
        }

        current, err := r.cfg.KubeClient.Build(bytes.NewBufferString(currentRelease.Manifest), false)
        if err != nil {
                return targetRelease, errors.Wrap(err, "unable to build kubernetes objects from current release manifest")
        }
        target, err := r.cfg.KubeClient.Build(bytes.NewBufferString(targetRelease.Manifest), false)
        if err != nil {
                return targetRelease, errors.Wrap(err, "unable to build kubernetes objects from new release manifest")
        }

        // pre-rollback hooks
        if !r.DisableHooks {
                if err := r.cfg.execHook(targetRelease, release.HookPreRollback, r.Timeout); err != nil {
                        return targetRelease, err
                }
        } else {
                r.cfg.Log("rollback hooks disabled for %s", targetRelease.Name)
        }

        // It is safe to use "force" here because these are resources currently rendered by the chart.
        err = target.Visit(setMetadataVisitor(targetRelease.Name, targetRelease.Namespace, true))
        if err != nil {
                return targetRelease, errors.Wrap(err, "unable to set metadata visitor from target release")
        }
        results, err := r.cfg.KubeClient.Update(current, target, r.Force)

        if err != nil {
                msg := fmt.Sprintf("Rollback %q failed: %s", targetRelease.Name, err)
                r.cfg.Log("warning: %s", msg)
                currentRelease.Info.Status = release.StatusSuperseded
                targetRelease.Info.Status = release.StatusFailed
                targetRelease.Info.Description = msg
                r.cfg.recordRelease(currentRelease)
                r.cfg.recordRelease(targetRelease)
                if r.CleanupOnFail {
                        r.cfg.Log("Cleanup on fail set, cleaning up %d resources", len(results.Created))
                        _, errs := r.cfg.KubeClient.Delete(results.Created)
                        if errs != nil {
                                var errorList []string
                                for _, e := range errs {
                                        errorList = append(errorList, e.Error())
                                }
                                return targetRelease, errors.Wrapf(fmt.Errorf("unable to cleanup resources: %s", strings.Join(errorList, ", ")), "an error occurred while cleaning up resources. original rollback error: %s", err)
                        }
                        r.cfg.Log("Resource cleanup complete")
                }
                return targetRelease, err
        }

        if r.Recreate {
                // NOTE: Because this is not critical for a release to succeed, we just
                // log if an error occurs and continue onward. If we ever introduce log
                // levels, we should make these error level logs so users are notified
                // that they'll need to go do the cleanup on their own
                if err := recreate(r.cfg, results.Updated); err != nil {
                        r.cfg.Log(err.Error())
                }
        }

        if r.Wait {
                if r.WaitForJobs {
                        if err := r.cfg.KubeClient.WaitWithJobs(target, r.Timeout); err != nil {
                                targetRelease.SetStatus(release.StatusFailed, fmt.Sprintf("Release %q failed: %s", targetRelease.Name, err.Error()))
                                r.cfg.recordRelease(currentRelease)
                                r.cfg.recordRelease(targetRelease)
                                return targetRelease, errors.Wrapf(err, "release %s failed", targetRelease.Name)
                        }
                } else {
                        if err := r.cfg.KubeClient.Wait(target, r.Timeout); err != nil {
                                targetRelease.SetStatus(release.StatusFailed, fmt.Sprintf("Release %q failed: %s", targetRelease.Name, err.Error()))
                                r.cfg.recordRelease(currentRelease)
                                r.cfg.recordRelease(targetRelease)
                                return targetRelease, errors.Wrapf(err, "release %s failed", targetRelease.Name)
                        }
                }
        }

        // post-rollback hooks
        if !r.DisableHooks {
                if err := r.cfg.execHook(targetRelease, release.HookPostRollback, r.Timeout); err != nil {
                        return targetRelease, err
                }
        }

        deployed, err := r.cfg.Releases.DeployedAll(currentRelease.Name)
        if err != nil && !strings.Contains(err.Error(), "has no deployed releases") {
                return nil, err
        }
        // Supersede all previous deployments, see issue #2941.
        for _, rel := range deployed {
                r.cfg.Log("superseding previous deployment %d", rel.Version)
                rel.Info.Status = release.StatusSuperseded
                r.cfg.recordRelease(rel)
        }

        targetRelease.Info.Status = release.StatusDeployed

        return targetRelease, nil
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package action

import (
        "bytes"
        "fmt"
        "strings"

        "github.com/pkg/errors"
        "k8s.io/cli-runtime/pkg/printers"
        "sigs.k8s.io/yaml"

        "helm.sh/helm/v3/pkg/chart"
        "helm.sh/helm/v3/pkg/chart/loader"
        "helm.sh/helm/v3/pkg/chartutil"
        "helm.sh/helm/v3/pkg/registry"
)

// ShowOutputFormat is the format of the output of `helm show`
type ShowOutputFormat string

const (
        // ShowAll is the format which shows all the information of a chart
        ShowAll ShowOutputFormat = "all"
        // ShowChart is the format which only shows the chart's definition
        ShowChart ShowOutputFormat = "chart"
        // ShowValues is the format which only shows the chart's values
        ShowValues ShowOutputFormat = "values"
        // ShowReadme is the format which only shows the chart's README
        ShowReadme ShowOutputFormat = "readme"
        // ShowCRDs is the format which only shows the chart's CRDs
        ShowCRDs ShowOutputFormat = "crds"
)

var readmeFileNames = []string{"readme.md", "readme.txt", "readme"}

func (o ShowOutputFormat) String() string {
        return string(o)
}

// Show is the action for checking a given release's information.
//
// It provides the implementation of 'helm show' and its respective subcommands.
type Show struct {
        ChartPathOptions
        Devel            bool
        OutputFormat     ShowOutputFormat
        JSONPathTemplate string
        chart            *chart.Chart // for testing
}

// NewShow creates a new Show object with the given configuration.
// Deprecated: Use NewShowWithConfig
// TODO Helm 4: Fold NewShowWithConfig back into NewShow
func NewShow(output ShowOutputFormat) *Show {
        return &Show{
                OutputFormat: output,
        }
}

// NewShowWithConfig creates a new Show object with the given configuration.
func NewShowWithConfig(output ShowOutputFormat, cfg *Configuration) *Show {
        sh := &Show{
                OutputFormat: output,
        }
        sh.ChartPathOptions.registryClient = cfg.RegistryClient

        return sh
}

// SetRegistryClient sets the registry client to use when pulling a chart from a registry.
func (s *Show) SetRegistryClient(client *registry.Client) {
        s.ChartPathOptions.registryClient = client
}

// Run executes 'helm show' against the given release.
func (s *Show) Run(chartpath string) (string, error) {
        if s.chart == nil {
                chrt, err := loader.Load(chartpath)
                if err != nil {
                        return "", err
                }
                s.chart = chrt
        }
        cf, err := yaml.Marshal(s.chart.Metadata)
        if err != nil {
                return "", err
        }

        var out strings.Builder
        if s.OutputFormat == ShowChart || s.OutputFormat == ShowAll {
                fmt.Fprintf(&out, "%s\n", cf)
        }

        if (s.OutputFormat == ShowValues || s.OutputFormat == ShowAll) && s.chart.Values != nil {
                if s.OutputFormat == ShowAll {
                        fmt.Fprintln(&out, "---")
                }
                if s.JSONPathTemplate != "" {
                        printer, err := printers.NewJSONPathPrinter(s.JSONPathTemplate)
                        if err != nil {
                                return "", errors.Wrapf(err, "error parsing jsonpath %s", s.JSONPathTemplate)
                        }
                        printer.Execute(&out, s.chart.Values)
                } else {
                        for _, f := range s.chart.Raw {
                                if f.Name == chartutil.ValuesfileName {
                                        fmt.Fprintln(&out, string(f.Data))
                                }
                        }
                }
        }

        if s.OutputFormat == ShowReadme || s.OutputFormat == ShowAll {
                readme := findReadme(s.chart.Files)
                if readme != nil {
                        if s.OutputFormat == ShowAll {
                                fmt.Fprintln(&out, "---")
                        }
                        fmt.Fprintf(&out, "%s\n", readme.Data)
                }
        }

        if s.OutputFormat == ShowCRDs || s.OutputFormat == ShowAll {
                crds := s.chart.CRDObjects()
                if len(crds) > 0 {
                        if s.OutputFormat == ShowAll && !bytes.HasPrefix(crds[0].File.Data, []byte("---")) {
                                fmt.Fprintln(&out, "---")
                        }
                        for _, crd := range crds {
                                fmt.Fprintf(&out, "%s\n", string(crd.File.Data))
                        }
                }
        }
        return out.String(), nil
}

func findReadme(files []*chart.File) (file *chart.File) {
        for _, file := range files {
                for _, n := range readmeFileNames {
                        if file == nil {
                                continue
                        }
                        if strings.EqualFold(file.Name, n) {
                                return file
                        }
                }
        }
        return nil
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package action

import (
        "bytes"
        "errors"

        "helm.sh/helm/v3/pkg/kube"
        "helm.sh/helm/v3/pkg/release"
)

// Status is the action for checking the deployment status of releases.
//
// It provides the implementation of 'helm status'.
type Status struct {
        cfg *Configuration

        Version int

        // If true, display description to output format,
        // only affect print type table.
        // TODO Helm 4: Remove this flag and output the description by default.
        ShowDescription bool

        // ShowResources sets if the resources should be retrieved with the status.
        // TODO Helm 4: Remove this flag and output the resources by default.
        ShowResources bool

        // ShowResourcesTable is used with ShowResources. When true this will cause
        // the resulting objects to be retrieved as a kind=table.
        ShowResourcesTable bool
}

// NewStatus creates a new Status object with the given configuration.
func NewStatus(cfg *Configuration) *Status {
        return &Status{
                cfg: cfg,
        }
}

// Run executes 'helm status' against the given release.
func (s *Status) Run(name string) (*release.Release, error) {
        if err := s.cfg.KubeClient.IsReachable(); err != nil {
                return nil, err
        }

        if !s.ShowResources {
                return s.cfg.releaseContent(name, s.Version)
        }

        rel, err := s.cfg.releaseContent(name, s.Version)
        if err != nil {
                return nil, err
        }

        if kubeClient, ok := s.cfg.KubeClient.(kube.InterfaceResources); ok {
                var resources kube.ResourceList
                if s.ShowResourcesTable {
                        resources, err = kubeClient.BuildTable(bytes.NewBufferString(rel.Manifest), false)
                        if err != nil {
                                return nil, err
                        }
                } else {
                        resources, err = s.cfg.KubeClient.Build(bytes.NewBufferString(rel.Manifest), false)
                        if err != nil {
                                return nil, err
                        }
                }

                resp, err := kubeClient.Get(resources, true)
                if err != nil {
                        return nil, err
                }

                rel.Info.Resources = resp

                return rel, nil
        }
        return nil, errors.New("unable to get kubeClient with interface InterfaceResources")
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package action

import (
        "strings"
        "time"

        "github.com/pkg/errors"

        v1 "k8s.io/apimachinery/pkg/apis/meta/v1"

        "helm.sh/helm/v3/pkg/chartutil"
        "helm.sh/helm/v3/pkg/kube"
        "helm.sh/helm/v3/pkg/release"
        "helm.sh/helm/v3/pkg/releaseutil"
        helmtime "helm.sh/helm/v3/pkg/time"
)

// Uninstall is the action for uninstalling releases.
//
// It provides the implementation of 'helm uninstall'.
type Uninstall struct {
        cfg *Configuration

        DisableHooks        bool
        DryRun              bool
        IgnoreNotFound      bool
        KeepHistory         bool
        Wait                bool
        DeletionPropagation string
        Timeout             time.Duration
        Description         string
}

// NewUninstall creates a new Uninstall object with the given configuration.
func NewUninstall(cfg *Configuration) *Uninstall {
        return &Uninstall{
                cfg: cfg,
        }
}

// Run uninstalls the given release.
func (u *Uninstall) Run(name string) (*release.UninstallReleaseResponse, error) {
        if err := u.cfg.KubeClient.IsReachable(); err != nil {
                return nil, err
        }

        if u.DryRun {
                // In the dry run case, just see if the release exists
                r, err := u.cfg.releaseContent(name, 0)
                if err != nil {
                        return &release.UninstallReleaseResponse{}, err
                }
                return &release.UninstallReleaseResponse{Release: r}, nil
        }

        if err := chartutil.ValidateReleaseName(name); err != nil {
                return nil, errors.Errorf("uninstall: Release name is invalid: %s", name)
        }

        rels, err := u.cfg.Releases.History(name)
        if err != nil {
                if u.IgnoreNotFound {
                        return nil, nil
                }
                return nil, errors.Wrapf(err, "uninstall: Release not loaded: %s", name)
        }
        if len(rels) < 1 {
                return nil, errMissingRelease
        }

        releaseutil.SortByRevision(rels)
        rel := rels[len(rels)-1]

        // TODO: Are there any cases where we want to force a delete even if it's
        // already marked deleted?
        if rel.Info.Status == release.StatusUninstalled {
                if !u.KeepHistory {
                        if err := u.purgeReleases(rels...); err != nil {
                                return nil, errors.Wrap(err, "uninstall: Failed to purge the release")
                        }
                        return &release.UninstallReleaseResponse{Release: rel}, nil
                }
                return nil, errors.Errorf("the release named %q is already deleted", name)
        }

        u.cfg.Log("uninstall: Deleting %s", name)
        rel.Info.Status = release.StatusUninstalling
        rel.Info.Deleted = helmtime.Now()
        rel.Info.Description = "Deletion in progress (or silently failed)"
        res := &release.UninstallReleaseResponse{Release: rel}

        if !u.DisableHooks {
                if err := u.cfg.execHook(rel, release.HookPreDelete, u.Timeout); err != nil {
                        return res, err
                }
        } else {
                u.cfg.Log("delete hooks disabled for %s", name)
        }

        // From here on out, the release is currently considered to be in StatusUninstalling
        // state.
        if err := u.cfg.Releases.Update(rel); err != nil {
                u.cfg.Log("uninstall: Failed to store updated release: %s", err)
        }

        deletedResources, kept, errs := u.deleteRelease(rel)
        if errs != nil {
                u.cfg.Log("uninstall: Failed to delete release: %s", errs)
                return nil, errors.Errorf("failed to delete release: %s", name)
        }

        if kept != "" {
                kept = "These resources were kept due to the resource policy:\n" + kept
        }
        res.Info = kept

        if u.Wait {
                if kubeClient, ok := u.cfg.KubeClient.(kube.InterfaceExt); ok {
                        if err := kubeClient.WaitForDelete(deletedResources, u.Timeout); err != nil {
                                errs = append(errs, err)
                        }
                }
        }

        if !u.DisableHooks {
                if err := u.cfg.execHook(rel, release.HookPostDelete, u.Timeout); err != nil {
                        errs = append(errs, err)
                }
        }

        rel.Info.Status = release.StatusUninstalled
        if len(u.Description) > 0 {
                rel.Info.Description = u.Description
        } else {
                rel.Info.Description = "Uninstallation complete"
        }

        if !u.KeepHistory {
                u.cfg.Log("purge requested for %s", name)
                err := u.purgeReleases(rels...)
                if err != nil {
                        errs = append(errs, errors.Wrap(err, "uninstall: Failed to purge the release"))
                }

                // Return the errors that occurred while deleting the release, if any
                if len(errs) > 0 {
                        return res, errors.Errorf("uninstallation completed with %d error(s): %s", len(errs), joinErrors(errs))
                }

                return res, nil
        }

        if err := u.cfg.Releases.Update(rel); err != nil {
                u.cfg.Log("uninstall: Failed to store updated release: %s", err)
        }

        if len(errs) > 0 {
                return res, errors.Errorf("uninstallation completed with %d error(s): %s", len(errs), joinErrors(errs))
        }
        return res, nil
}

func (u *Uninstall) purgeReleases(rels ...*release.Release) error {
        for _, rel := range rels {
                if _, err := u.cfg.Releases.Delete(rel.Name, rel.Version); err != nil {
                        return err
                }
        }
        return nil
}

func joinErrors(errs []error) string {
        es := make([]string, 0, len(errs))
        for _, e := range errs {
                es = append(es, e.Error())
        }
        return strings.Join(es, "; ")
}

// deleteRelease deletes the release and returns list of delete resources and manifests that were kept in the deletion process
func (u *Uninstall) deleteRelease(rel *release.Release) (kube.ResourceList, string, []error) {
        var errs []error
        caps, err := u.cfg.getCapabilities()
        if err != nil {
                return nil, rel.Manifest, []error{errors.Wrap(err, "could not get apiVersions from Kubernetes")}
        }

        manifests := releaseutil.SplitManifests(rel.Manifest)
        _, files, err := releaseutil.SortManifests(manifests, caps.APIVersions, releaseutil.UninstallOrder)
        if err != nil {
                // We could instead just delete everything in no particular order.
                // FIXME: One way to delete at this point would be to try a label-based
                // deletion. The problem with this is that we could get a false positive
                // and delete something that was not legitimately part of this release.
                return nil, rel.Manifest, []error{errors.Wrap(err, "corrupted release record. You must manually delete the resources")}
        }

        filesToKeep, filesToDelete := filterManifestsToKeep(files)
        var kept string
        for _, f := range filesToKeep {
                kept += "[" + f.Head.Kind + "] " + f.Head.Metadata.Name + "\n"
        }

        var builder strings.Builder
        for _, file := range filesToDelete {
                builder.WriteString("\n---\n" + file.Content)
        }

        resources, err := u.cfg.KubeClient.Build(strings.NewReader(builder.String()), false)
        if err != nil {
                return nil, "", []error{errors.Wrap(err, "unable to build kubernetes objects for delete")}
        }
        if len(resources) > 0 {
                if kubeClient, ok := u.cfg.KubeClient.(kube.InterfaceDeletionPropagation); ok {
                        _, errs = kubeClient.DeleteWithPropagationPolicy(resources, parseCascadingFlag(u.cfg, u.DeletionPropagation))
                        return resources, kept, errs
                }
                _, errs = u.cfg.KubeClient.Delete(resources)
        }
        return resources, kept, errs
}

func parseCascadingFlag(cfg *Configuration, cascadingFlag string) v1.DeletionPropagation {
        switch cascadingFlag {
        case "orphan":
                return v1.DeletePropagationOrphan
        case "foreground":
                return v1.DeletePropagationForeground
        case "background":
                return v1.DeletePropagationBackground
        default:
                cfg.Log("uninstall: given cascade value: %s, defaulting to delete propagation background", cascadingFlag)
                return v1.DeletePropagationBackground
        }
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package action

import (
        "fmt"
        "testing"

        "github.com/stretchr/testify/assert"

        kubefake "helm.sh/helm/v3/pkg/kube/fake"
        "helm.sh/helm/v3/pkg/release"
)

func uninstallAction(t *testing.T) *Uninstall {
        config := actionConfigFixture(t)
        unAction := NewUninstall(config)
        return unAction
}

func TestUninstallRelease_ignoreNotFound(t *testing.T) {
        unAction := uninstallAction(t)
        unAction.DryRun = false
        unAction.IgnoreNotFound = true

        is := assert.New(t)
        res, err := unAction.Run("release-non-exist")
        is.Nil(res)
        is.NoError(err)
}

func TestUninstallRelease_deleteRelease(t *testing.T) {
        is := assert.New(t)

        unAction := uninstallAction(t)
        unAction.DisableHooks = true
        unAction.DryRun = false
        unAction.KeepHistory = true

        rel := releaseStub()
        rel.Name = "keep-secret"
        rel.Manifest = `{
                "apiVersion": "v1",
                "kind": "Secret",
                "metadata": {
                  "name": "secret",
                  "annotations": {
                        "helm.sh/resource-policy": "keep"
                  }
                },
                "type": "Opaque",
                "data": {
                  "password": "password"
                }
        }`
        unAction.cfg.Releases.Create(rel)
        res, err := unAction.Run(rel.Name)
        is.NoError(err)
        expected := `These resources were kept due to the resource policy:
[Secret] secret
`
        is.Contains(res.Info, expected)
}

func TestUninstallRelease_Wait(t *testing.T) {
        is := assert.New(t)

        unAction := uninstallAction(t)
        unAction.DisableHooks = true
        unAction.DryRun = false
        unAction.Wait = true

        rel := releaseStub()
        rel.Name = "come-fail-away"
        rel.Manifest = `{
                "apiVersion": "v1",
                "kind": "Secret",
                "metadata": {
                  "name": "secret"
                },
                "type": "Opaque",
                "data": {
                  "password": "password"
                }
        }`
        unAction.cfg.Releases.Create(rel)
        failer := unAction.cfg.KubeClient.(*kubefake.FailingKubeClient)
        failer.WaitError = fmt.Errorf("U timed out")
        unAction.cfg.KubeClient = failer
        res, err := unAction.Run(rel.Name)
        is.Error(err)
        is.Contains(err.Error(), "U timed out")
        is.Equal(res.Release.Info.Status, release.StatusUninstalled)
}

func TestUninstallRelease_Cascade(t *testing.T) {
        is := assert.New(t)

        unAction := uninstallAction(t)
        unAction.DisableHooks = true
        unAction.DryRun = false
        unAction.Wait = false
        unAction.DeletionPropagation = "foreground"

        rel := releaseStub()
        rel.Name = "come-fail-away"
        rel.Manifest = `{
                "apiVersion": "v1",
                "kind": "Secret",
                "metadata": {
                  "name": "secret"
                },
                "type": "Opaque",
                "data": {
                  "password": "password"
                }
        }`
        unAction.cfg.Releases.Create(rel)
        failer := unAction.cfg.KubeClient.(*kubefake.FailingKubeClient)
        failer.DeleteWithPropagationError = fmt.Errorf("Uninstall with cascade failed")
        failer.BuildDummy = true
        unAction.cfg.KubeClient = failer
        _, err := unAction.Run(rel.Name)
        is.Error(err)
        is.Contains(err.Error(), "failed to delete release: come-fail-away")
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package action

import (
        "bytes"
        "context"
        "fmt"
        "strings"
        "sync"
        "time"

        "github.com/pkg/errors"
        metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
        "k8s.io/cli-runtime/pkg/resource"

        "helm.sh/helm/v3/pkg/chart"
        "helm.sh/helm/v3/pkg/chartutil"
        "helm.sh/helm/v3/pkg/kube"
        "helm.sh/helm/v3/pkg/postrender"
        "helm.sh/helm/v3/pkg/registry"
        "helm.sh/helm/v3/pkg/release"
        "helm.sh/helm/v3/pkg/releaseutil"
        "helm.sh/helm/v3/pkg/storage/driver"
)

// Upgrade is the action for upgrading releases.
//
// It provides the implementation of 'helm upgrade'.
type Upgrade struct {
        cfg *Configuration

        ChartPathOptions

        // Install is a purely informative flag that indicates whether this upgrade was done in "install" mode.
        //
        // Applications may use this to determine whether this Upgrade operation was done as part of a
        // pure upgrade (Upgrade.Install == false) or as part of an install-or-upgrade operation
        // (Upgrade.Install == true).
        //
        // Setting this to `true` will NOT cause `Upgrade` to perform an install if the release does not exist.
        // That process must be handled by creating an Install action directly. See cmd/upgrade.go for an
        // example of how this flag is used.
        Install bool
        // Devel indicates that the operation is done in devel mode.
        Devel bool
        // Namespace is the namespace in which this operation should be performed.
        Namespace string
        // SkipCRDs skips installing CRDs when install flag is enabled during upgrade
        SkipCRDs bool
        // Timeout is the timeout for this operation
        Timeout time.Duration
        // Wait determines whether the wait operation should be performed after the upgrade is requested.
        Wait bool
        // WaitForJobs determines whether the wait operation for the Jobs should be performed after the upgrade is requested.
        WaitForJobs bool
        // DisableHooks disables hook processing if set to true.
        DisableHooks bool
        // DryRun controls whether the operation is prepared, but not executed.
        DryRun bool
        // DryRunOption controls whether the operation is prepared, but not executed with options on whether or not to interact with the remote cluster.
        DryRunOption string
        // Force will, if set to `true`, ignore certain warnings and perform the upgrade anyway.
        //
        // This should be used with caution.
        Force bool
        // ResetValues will reset the values to the chart's built-ins rather than merging with existing.
        ResetValues bool
        // ReuseValues will re-use the user's last supplied values.
        ReuseValues bool
        // ResetThenReuseValues will reset the values to the chart's built-ins then merge with user's last supplied values.
        ResetThenReuseValues bool
        // Recreate will (if true) recreate pods after a rollback.
        Recreate bool
        // MaxHistory limits the maximum number of revisions saved per release
        MaxHistory int
        // Atomic, if true, will roll back on failure.
        Atomic bool
        // CleanupOnFail will, if true, cause the upgrade to delete newly-created resources on a failed update.
        CleanupOnFail bool
        // SubNotes determines whether sub-notes are rendered in the chart.
        SubNotes bool
        // Description is the description of this operation
        Description string
        Labels      map[string]string
        // PostRender is an optional post-renderer
        //
        // If this is non-nil, then after templates are rendered, they will be sent to the
        // post renderer before sending to the Kubernetes API server.
        PostRenderer postrender.PostRenderer
        // DisableOpenAPIValidation controls whether OpenAPI validation is enforced.
        DisableOpenAPIValidation bool
        // Get missing dependencies
        DependencyUpdate bool
        // Lock to control raceconditions when the process receives a SIGTERM
        Lock sync.Mutex
        // Enable DNS lookups when rendering templates
        EnableDNS bool
}

type resultMessage struct {
        r *release.Release
        e error
}

// NewUpgrade creates a new Upgrade object with the given configuration.
func NewUpgrade(cfg *Configuration) *Upgrade {
        up := &Upgrade{
                cfg: cfg,
        }
        up.ChartPathOptions.registryClient = cfg.RegistryClient

        return up
}

// SetRegistryClient sets the registry client to use when fetching charts.
func (u *Upgrade) SetRegistryClient(client *registry.Client) {
        u.ChartPathOptions.registryClient = client
}

// Run executes the upgrade on the given release.
func (u *Upgrade) Run(name string, chart *chart.Chart, vals map[string]interface{}) (*release.Release, error) {
        ctx := context.Background()
        return u.RunWithContext(ctx, name, chart, vals)
}

// RunWithContext executes the upgrade on the given release with context.
func (u *Upgrade) RunWithContext(ctx context.Context, name string, chart *chart.Chart, vals map[string]interface{}) (*release.Release, error) {
        if err := u.cfg.KubeClient.IsReachable(); err != nil {
                return nil, err
        }

        // Make sure if Atomic is set, that wait is set as well. This makes it so
        // the user doesn't have to specify both
        u.Wait = u.Wait || u.Atomic

        if err := chartutil.ValidateReleaseName(name); err != nil {
                return nil, errors.Errorf("release name is invalid: %s", name)
        }

        u.cfg.Log("preparing upgrade for %s", name)
        currentRelease, upgradedRelease, err := u.prepareUpgrade(name, chart, vals)
        if err != nil {
                return nil, err
        }

        u.cfg.Releases.MaxHistory = u.MaxHistory

        u.cfg.Log("performing update for %s", name)
        res, err := u.performUpgrade(ctx, currentRelease, upgradedRelease)
        if err != nil {
                return res, err
        }

        // Do not update for dry runs
        if !u.isDryRun() {
                u.cfg.Log("updating status for upgraded release for %s", name)
                if err := u.cfg.Releases.Update(upgradedRelease); err != nil {
                        return res, err
                }
        }

        return res, nil
}

// isDryRun returns true if Upgrade is set to run as a DryRun
func (u *Upgrade) isDryRun() bool {
        if u.DryRun || u.DryRunOption == "client" || u.DryRunOption == "server" || u.DryRunOption == "true" {
                return true
        }
        return false
}

// prepareUpgrade builds an upgraded release for an upgrade operation.
func (u *Upgrade) prepareUpgrade(name string, chart *chart.Chart, vals map[string]interface{}) (*release.Release, *release.Release, error) {
        if chart == nil {
                return nil, nil, errMissingChart
        }

        // finds the last non-deleted release with the given name
        lastRelease, err := u.cfg.Releases.Last(name)
        if err != nil {
                // to keep existing behavior of returning the "%q has no deployed releases" error when an existing release does not exist
                if errors.Is(err, driver.ErrReleaseNotFound) {
                        return nil, nil, driver.NewErrNoDeployedReleases(name)
                }
                return nil, nil, err
        }

        // Concurrent `helm upgrade`s will either fail here with `errPending` or when creating the release with "already exists". This should act as a pessimistic lock.
        if lastRelease.Info.Status.IsPending() {
                return nil, nil, errPending
        }

        var currentRelease *release.Release
        if lastRelease.Info.Status == release.StatusDeployed {
                // no need to retrieve the last deployed release from storage as the last release is deployed
                currentRelease = lastRelease
        } else {
                // finds the deployed release with the given name
                currentRelease, err = u.cfg.Releases.Deployed(name)
                if err != nil {
                        if errors.Is(err, driver.ErrNoDeployedReleases) &&
                                (lastRelease.Info.Status == release.StatusFailed || lastRelease.Info.Status == release.StatusSuperseded) {
                                currentRelease = lastRelease
                        } else {
                                return nil, nil, err
                        }
                }
        }

        // determine if values will be reused
        vals, err = u.reuseValues(chart, currentRelease, vals)
        if err != nil {
                return nil, nil, err
        }

        if err := chartutil.ProcessDependenciesWithMerge(chart, vals); err != nil {
                return nil, nil, err
        }

        // Increment revision count. This is passed to templates, and also stored on
        // the release object.
        revision := lastRelease.Version + 1

        options := chartutil.ReleaseOptions{
                Name:      name,
                Namespace: currentRelease.Namespace,
                Revision:  revision,
                IsUpgrade: true,
        }

        caps, err := u.cfg.getCapabilities()
        if err != nil {
                return nil, nil, err
        }
        valuesToRender, err := chartutil.ToRenderValues(chart, vals, options, caps)
        if err != nil {
                return nil, nil, err
        }

        // Determine whether or not to interact with remote
        var interactWithRemote bool
        if !u.isDryRun() || u.DryRunOption == "server" || u.DryRunOption == "none" || u.DryRunOption == "false" {
                interactWithRemote = true
        }

        hooks, manifestDoc, notesTxt, err := u.cfg.renderResources(chart, valuesToRender, "", "", u.SubNotes, false, false, u.PostRenderer, interactWithRemote, u.EnableDNS)
        if err != nil {
                return nil, nil, err
        }

        if driver.ContainsSystemLabels(u.Labels) {
                return nil, nil, fmt.Errorf("user suplied labels contains system reserved label name. System labels: %+v", driver.GetSystemLabels())
        }

        // Store an upgraded release.
        upgradedRelease := &release.Release{
                Name:      name,
                Namespace: currentRelease.Namespace,
                Chart:     chart,
                Config:    vals,
                Info: &release.Info{
                        FirstDeployed: currentRelease.Info.FirstDeployed,
                        LastDeployed:  Timestamper(),
                        Status:        release.StatusPendingUpgrade,
                        Description:   "Preparing upgrade", // This should be overwritten later.
                },
                Version:  revision,
                Manifest: manifestDoc.String(),
                Hooks:    hooks,
                Labels:   mergeCustomLabels(lastRelease.Labels, u.Labels),
        }

        if len(notesTxt) > 0 {
                upgradedRelease.Info.Notes = notesTxt
        }
        err = validateManifest(u.cfg.KubeClient, manifestDoc.Bytes(), !u.DisableOpenAPIValidation)
        return currentRelease, upgradedRelease, err
}

func (u *Upgrade) performUpgrade(ctx context.Context, originalRelease, upgradedRelease *release.Release) (*release.Release, error) {
        current, err := u.cfg.KubeClient.Build(bytes.NewBufferString(originalRelease.Manifest), false)
        if err != nil {
                // Checking for removed Kubernetes API error so can provide a more informative error message to the user
                // Ref: https://github.com/helm/helm/issues/7219
                if strings.Contains(err.Error(), "unable to recognize \"\": no matches for kind") {
                        return upgradedRelease, errors.Wrap(err, "current release manifest contains removed kubernetes api(s) for this "+
                                "kubernetes version and it is therefore unable to build the kubernetes "+
                                "objects for performing the diff. error from kubernetes")
                }
                return upgradedRelease, errors.Wrap(err, "unable to build kubernetes objects from current release manifest")
        }
        target, err := u.cfg.KubeClient.Build(bytes.NewBufferString(upgradedRelease.Manifest), !u.DisableOpenAPIValidation)
        if err != nil {
                return upgradedRelease, errors.Wrap(err, "unable to build kubernetes objects from new release manifest")
        }

        // It is safe to use force only on target because these are resources currently rendered by the chart.
        err = target.Visit(setMetadataVisitor(upgradedRelease.Name, upgradedRelease.Namespace, true))
        if err != nil {
                return upgradedRelease, err
        }

        // Do a basic diff using gvk + name to figure out what new resources are being created so we can validate they don't already exist
        existingResources := make(map[string]bool)
        for _, r := range current {
                existingResources[objectKey(r)] = true
        }

        var toBeCreated kube.ResourceList
        for _, r := range target {
                if !existingResources[objectKey(r)] {
                        toBeCreated = append(toBeCreated, r)
                }
        }

        toBeUpdated, err := existingResourceConflict(toBeCreated, upgradedRelease.Name, upgradedRelease.Namespace)
        if err != nil {
                return nil, errors.Wrap(err, "Unable to continue with update")
        }

        toBeUpdated.Visit(func(r *resource.Info, err error) error {
                if err != nil {
                        return err
                }
                current.Append(r)
                return nil
        })

        // Run if it is a dry run
        if u.isDryRun() {
                u.cfg.Log("dry run for %s", upgradedRelease.Name)
                if len(u.Description) > 0 {
                        upgradedRelease.Info.Description = u.Description
                } else {
                        upgradedRelease.Info.Description = "Dry run complete"
                }
                return upgradedRelease, nil
        }

        u.cfg.Log("creating upgraded release for %s", upgradedRelease.Name)
        if err := u.cfg.Releases.Create(upgradedRelease); err != nil {
                return nil, err
        }
        rChan := make(chan resultMessage)
        ctxChan := make(chan resultMessage)
        doneChan := make(chan interface{})
        defer close(doneChan)
        go u.releasingUpgrade(rChan, upgradedRelease, current, target, originalRelease)
        go u.handleContext(ctx, doneChan, ctxChan, upgradedRelease)
        select {
        case result := <-rChan:
                return result.r, result.e
        case result := <-ctxChan:
                return result.r, result.e
        }
}

// Function used to lock the Mutex, this is important for the case when the atomic flag is set.
// In that case the upgrade will finish before the rollback is finished so it is necessary to wait for the rollback to finish.
// The rollback will be trigger by the function failRelease
func (u *Upgrade) reportToPerformUpgrade(c chan<- resultMessage, rel *release.Release, created kube.ResourceList, err error) {
        u.Lock.Lock()
        if err != nil {
                rel, err = u.failRelease(rel, created, err)
        }
        c <- resultMessage{r: rel, e: err}
        u.Lock.Unlock()
}

// Setup listener for SIGINT and SIGTERM
func (u *Upgrade) handleContext(ctx context.Context, done chan interface{}, c chan<- resultMessage, upgradedRelease *release.Release) {
        select {
        case <-ctx.Done():
                err := ctx.Err()

                // when the atomic flag is set the ongoing release finish first and doesn't give time for the rollback happens.
                u.reportToPerformUpgrade(c, upgradedRelease, kube.ResourceList{}, err)
        case <-done:
                return
        }
}
func (u *Upgrade) releasingUpgrade(c chan<- resultMessage, upgradedRelease *release.Release, current kube.ResourceList, target kube.ResourceList, originalRelease *release.Release) {
        // pre-upgrade hooks

        if !u.DisableHooks {
                if err := u.cfg.execHook(upgradedRelease, release.HookPreUpgrade, u.Timeout); err != nil {
                        u.reportToPerformUpgrade(c, upgradedRelease, kube.ResourceList{}, fmt.Errorf("pre-upgrade hooks failed: %s", err))
                        return
                }
        } else {
                u.cfg.Log("upgrade hooks disabled for %s", upgradedRelease.Name)
        }

        results, err := u.cfg.KubeClient.Update(current, target, u.Force)
        if err != nil {
                u.cfg.recordRelease(originalRelease)
                u.reportToPerformUpgrade(c, upgradedRelease, results.Created, err)
                return
        }

        if u.Recreate {
                // NOTE: Because this is not critical for a release to succeed, we just
                // log if an error occurs and continue onward. If we ever introduce log
                // levels, we should make these error level logs so users are notified
                // that they'll need to go do the cleanup on their own
                if err := recreate(u.cfg, results.Updated); err != nil {
                        u.cfg.Log(err.Error())
                }
        }

        if u.Wait {
                u.cfg.Log(
                        "waiting for release %s resources (created: %d updated: %d  deleted: %d)",
                        upgradedRelease.Name, len(results.Created), len(results.Updated), len(results.Deleted))
                if u.WaitForJobs {
                        if err := u.cfg.KubeClient.WaitWithJobs(target, u.Timeout); err != nil {
                                u.cfg.recordRelease(originalRelease)
                                u.reportToPerformUpgrade(c, upgradedRelease, results.Created, err)
                                return
                        }
                } else {
                        if err := u.cfg.KubeClient.Wait(target, u.Timeout); err != nil {
                                u.cfg.recordRelease(originalRelease)
                                u.reportToPerformUpgrade(c, upgradedRelease, results.Created, err)
                                return
                        }
                }
        }

        // post-upgrade hooks
        if !u.DisableHooks {
                if err := u.cfg.execHook(upgradedRelease, release.HookPostUpgrade, u.Timeout); err != nil {
                        u.reportToPerformUpgrade(c, upgradedRelease, results.Created, fmt.Errorf("post-upgrade hooks failed: %s", err))
                        return
                }
        }

        originalRelease.Info.Status = release.StatusSuperseded
        u.cfg.recordRelease(originalRelease)

        upgradedRelease.Info.Status = release.StatusDeployed
        if len(u.Description) > 0 {
                upgradedRelease.Info.Description = u.Description
        } else {
                upgradedRelease.Info.Description = "Upgrade complete"
        }
        u.reportToPerformUpgrade(c, upgradedRelease, nil, nil)
}

func (u *Upgrade) failRelease(rel *release.Release, created kube.ResourceList, err error) (*release.Release, error) {
        msg := fmt.Sprintf("Upgrade %q failed: %s", rel.Name, err)
        u.cfg.Log("warning: %s", msg)

        rel.Info.Status = release.StatusFailed
        rel.Info.Description = msg
        u.cfg.recordRelease(rel)
        if u.CleanupOnFail && len(created) > 0 {
                u.cfg.Log("Cleanup on fail set, cleaning up %d resources", len(created))
                _, errs := u.cfg.KubeClient.Delete(created)
                if errs != nil {
                        var errorList []string
                        for _, e := range errs {
                                errorList = append(errorList, e.Error())
                        }
                        return rel, errors.Wrapf(fmt.Errorf("unable to cleanup resources: %s", strings.Join(errorList, ", ")), "an error occurred while cleaning up resources. original upgrade error: %s", err)
                }
                u.cfg.Log("Resource cleanup complete")
        }
        if u.Atomic {
                u.cfg.Log("Upgrade failed and atomic is set, rolling back to last successful release")

                // As a protection, get the last successful release before rollback.
                // If there are no successful releases, bail out
                hist := NewHistory(u.cfg)
                fullHistory, herr := hist.Run(rel.Name)
                if herr != nil {
                        return rel, errors.Wrapf(herr, "an error occurred while finding last successful release. original upgrade error: %s", err)
                }

                // There isn't a way to tell if a previous release was successful, but
                // generally failed releases do not get superseded unless the next
                // release is successful, so this should be relatively safe
                filteredHistory := releaseutil.FilterFunc(func(r *release.Release) bool {
                        return r.Info.Status == release.StatusSuperseded || r.Info.Status == release.StatusDeployed
                }).Filter(fullHistory)
                if len(filteredHistory) == 0 {
                        return rel, errors.Wrap(err, "unable to find a previously successful release when attempting to rollback. original upgrade error")
                }

                releaseutil.Reverse(filteredHistory, releaseutil.SortByRevision)

                rollin := NewRollback(u.cfg)
                rollin.Version = filteredHistory[0].Version
                rollin.Wait = true
                rollin.WaitForJobs = u.WaitForJobs
                rollin.DisableHooks = u.DisableHooks
                rollin.Recreate = u.Recreate
                rollin.Force = u.Force
                rollin.Timeout = u.Timeout
                if rollErr := rollin.Run(rel.Name); rollErr != nil {
                        return rel, errors.Wrapf(rollErr, "an error occurred while rolling back the release. original upgrade error: %s", err)
                }
                return rel, errors.Wrapf(err, "release %s failed, and has been rolled back due to atomic being set", rel.Name)
        }

        return rel, err
}

// reuseValues copies values from the current release to a new release if the
// new release does not have any values.
//
// If the request already has values, or if there are no values in the current
// release, this does nothing.
//
// This is skipped if the u.ResetValues flag is set, in which case the
// request values are not altered.
func (u *Upgrade) reuseValues(chart *chart.Chart, current *release.Release, newVals map[string]interface{}) (map[string]interface{}, error) {
        if u.ResetValues {
                // If ResetValues is set, we completely ignore current.Config.
                u.cfg.Log("resetting values to the chart's original version")
                return newVals, nil
        }

        // If the ReuseValues flag is set, we always copy the old values over the new config's values.
        if u.ReuseValues {
                u.cfg.Log("reusing the old release's values")

                // We have to regenerate the old coalesced values:
                oldVals, err := chartutil.CoalesceValues(current.Chart, current.Config)
                if err != nil {
                        return nil, errors.Wrap(err, "failed to rebuild old values")
                }

                newVals = chartutil.CoalesceTables(newVals, current.Config)

                chart.Values = oldVals

                return newVals, nil
        }

        // If the ResetThenReuseValues flag is set, we use the new chart's values, but we copy the old config's values over the new config's values.
        if u.ResetThenReuseValues {
                u.cfg.Log("merging values from old release to new values")

                newVals = chartutil.CoalesceTables(newVals, current.Config)

                return newVals, nil
        }

        if len(newVals) == 0 && len(current.Config) > 0 {
                u.cfg.Log("copying values from %s (v%d) to new release.", current.Name, current.Version)
                newVals = current.Config
        }
        return newVals, nil
}

func validateManifest(c kube.Interface, manifest []byte, openAPIValidation bool) error {
        _, err := c.Build(bytes.NewReader(manifest), openAPIValidation)
        return err
}

// recreate captures all the logic for recreating pods for both upgrade and
// rollback. If we end up refactoring rollback to use upgrade, this can just be
// made an unexported method on the upgrade action.
func recreate(cfg *Configuration, resources kube.ResourceList) error {
        for _, res := range resources {
                versioned := kube.AsVersioned(res)
                selector, err := kube.SelectorsForObject(versioned)
                if err != nil {
                        // If no selector is returned, it means this object is
                        // definitely not a pod, so continue onward
                        continue
                }

                client, err := cfg.KubernetesClientSet()
                if err != nil {
                        return errors.Wrapf(err, "unable to recreate pods for object %s/%s because an error occurred", res.Namespace, res.Name)
                }

                pods, err := client.CoreV1().Pods(res.Namespace).List(context.Background(), metav1.ListOptions{
                        LabelSelector: selector.String(),
                })
                if err != nil {
                        return errors.Wrapf(err, "unable to recreate pods for object %s/%s because an error occurred", res.Namespace, res.Name)
                }

                // Restart pods
                for _, pod := range pods.Items {
                        // Delete each pod for get them restarted with changed spec.
                        if err := client.CoreV1().Pods(pod.Namespace).Delete(context.Background(), pod.Name, *metav1.NewPreconditionDeleteOptions(string(pod.UID))); err != nil {
                                return errors.Wrapf(err, "unable to recreate pods for object %s/%s because an error occurred", res.Namespace, res.Name)
                        }
                }
        }
        return nil
}

func objectKey(r *resource.Info) string {
        gvk := r.Object.GetObjectKind().GroupVersionKind()
        return fmt.Sprintf("%s/%s/%s/%s", gvk.GroupVersion().String(), gvk.Kind, r.Namespace, r.Name)
}

func mergeCustomLabels(current, desired map[string]string) map[string]string {
        labels := mergeStrStrMaps(current, desired)
        for k, v := range labels {
                if v == "null" {
                        delete(labels, k)
                }
        }
        return labels
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package action

import (
        "context"
        "fmt"
        "reflect"
        "testing"
        "time"

        "helm.sh/helm/v3/pkg/chart"
        "helm.sh/helm/v3/pkg/storage/driver"

        "github.com/stretchr/testify/assert"
        "github.com/stretchr/testify/require"

        kubefake "helm.sh/helm/v3/pkg/kube/fake"
        "helm.sh/helm/v3/pkg/release"
        helmtime "helm.sh/helm/v3/pkg/time"
)

func upgradeAction(t *testing.T) *Upgrade {
        config := actionConfigFixture(t)
        upAction := NewUpgrade(config)
        upAction.Namespace = "spaced"

        return upAction
}

func TestUpgradeRelease_Success(t *testing.T) {
        is := assert.New(t)
        req := require.New(t)

        upAction := upgradeAction(t)
        rel := releaseStub()
        rel.Name = "previous-release"
        rel.Info.Status = release.StatusDeployed
        req.NoError(upAction.cfg.Releases.Create(rel))

        upAction.Wait = true
        vals := map[string]interface{}{}

        ctx, done := context.WithCancel(context.Background())
        res, err := upAction.RunWithContext(ctx, rel.Name, buildChart(), vals)
        done()
        req.NoError(err)
        is.Equal(res.Info.Status, release.StatusDeployed)

        // Detecting previous bug where context termination after successful release
        // caused release to fail.
        time.Sleep(time.Millisecond * 100)
        lastRelease, err := upAction.cfg.Releases.Last(rel.Name)
        req.NoError(err)
        is.Equal(lastRelease.Info.Status, release.StatusDeployed)
}

func TestUpgradeRelease_Wait(t *testing.T) {
        is := assert.New(t)
        req := require.New(t)

        upAction := upgradeAction(t)
        rel := releaseStub()
        rel.Name = "come-fail-away"
        rel.Info.Status = release.StatusDeployed
        upAction.cfg.Releases.Create(rel)

        failer := upAction.cfg.KubeClient.(*kubefake.FailingKubeClient)
        failer.WaitError = fmt.Errorf("I timed out")
        upAction.cfg.KubeClient = failer
        upAction.Wait = true
        vals := map[string]interface{}{}

        res, err := upAction.Run(rel.Name, buildChart(), vals)
        req.Error(err)
        is.Contains(res.Info.Description, "I timed out")
        is.Equal(res.Info.Status, release.StatusFailed)
}

func TestUpgradeRelease_WaitForJobs(t *testing.T) {
        is := assert.New(t)
        req := require.New(t)

        upAction := upgradeAction(t)
        rel := releaseStub()
        rel.Name = "come-fail-away"
        rel.Info.Status = release.StatusDeployed
        upAction.cfg.Releases.Create(rel)

        failer := upAction.cfg.KubeClient.(*kubefake.FailingKubeClient)
        failer.WaitError = fmt.Errorf("I timed out")
        upAction.cfg.KubeClient = failer
        upAction.Wait = true
        upAction.WaitForJobs = true
        vals := map[string]interface{}{}

        res, err := upAction.Run(rel.Name, buildChart(), vals)
        req.Error(err)
        is.Contains(res.Info.Description, "I timed out")
        is.Equal(res.Info.Status, release.StatusFailed)
}

func TestUpgradeRelease_CleanupOnFail(t *testing.T) {
        is := assert.New(t)
        req := require.New(t)

        upAction := upgradeAction(t)
        rel := releaseStub()
        rel.Name = "come-fail-away"
        rel.Info.Status = release.StatusDeployed
        upAction.cfg.Releases.Create(rel)

        failer := upAction.cfg.KubeClient.(*kubefake.FailingKubeClient)
        failer.WaitError = fmt.Errorf("I timed out")
        failer.DeleteError = fmt.Errorf("I tried to delete nil")
        upAction.cfg.KubeClient = failer
        upAction.Wait = true
        upAction.CleanupOnFail = true
        vals := map[string]interface{}{}

        res, err := upAction.Run(rel.Name, buildChart(), vals)
        req.Error(err)
        is.NotContains(err.Error(), "unable to cleanup resources")
        is.Contains(res.Info.Description, "I timed out")
        is.Equal(res.Info.Status, release.StatusFailed)
}

func TestUpgradeRelease_Atomic(t *testing.T) {
        is := assert.New(t)
        req := require.New(t)

        t.Run("atomic rollback succeeds", func(t *testing.T) {
                upAction := upgradeAction(t)

                rel := releaseStub()
                rel.Name = "nuketown"
                rel.Info.Status = release.StatusDeployed
                upAction.cfg.Releases.Create(rel)

                failer := upAction.cfg.KubeClient.(*kubefake.FailingKubeClient)
                // We can't make Update error because then the rollback won't work
                failer.WatchUntilReadyError = fmt.Errorf("arming key removed")
                upAction.cfg.KubeClient = failer
                upAction.Atomic = true
                vals := map[string]interface{}{}

                res, err := upAction.Run(rel.Name, buildChart(), vals)
                req.Error(err)
                is.Contains(err.Error(), "arming key removed")
                is.Contains(err.Error(), "atomic")

                // Now make sure it is actually upgraded
                updatedRes, err := upAction.cfg.Releases.Get(res.Name, 3)
                is.NoError(err)
                // Should have rolled back to the previous
                is.Equal(updatedRes.Info.Status, release.StatusDeployed)
        })

        t.Run("atomic uninstall fails", func(t *testing.T) {
                upAction := upgradeAction(t)
                rel := releaseStub()
                rel.Name = "fallout"
                rel.Info.Status = release.StatusDeployed
                upAction.cfg.Releases.Create(rel)

                failer := upAction.cfg.KubeClient.(*kubefake.FailingKubeClient)
                failer.UpdateError = fmt.Errorf("update fail")
                upAction.cfg.KubeClient = failer
                upAction.Atomic = true
                vals := map[string]interface{}{}

                _, err := upAction.Run(rel.Name, buildChart(), vals)
                req.Error(err)
                is.Contains(err.Error(), "update fail")
                is.Contains(err.Error(), "an error occurred while rolling back the release")
        })
}

func TestUpgradeRelease_ReuseValues(t *testing.T) {
        is := assert.New(t)

        t.Run("reuse values should work with values", func(t *testing.T) {
                upAction := upgradeAction(t)

                existingValues := map[string]interface{}{
                        "name":        "value",
                        "maxHeapSize": "128m",
                        "replicas":    2,
                }
                newValues := map[string]interface{}{
                        "name":        "newValue",
                        "maxHeapSize": "512m",
                        "cpu":         "12m",
                }
                expectedValues := map[string]interface{}{
                        "name":        "newValue",
                        "maxHeapSize": "512m",
                        "cpu":         "12m",
                        "replicas":    2,
                }

                rel := releaseStub()
                rel.Name = "nuketown"
                rel.Info.Status = release.StatusDeployed
                rel.Config = existingValues

                err := upAction.cfg.Releases.Create(rel)
                is.NoError(err)

                upAction.ReuseValues = true
                // setting newValues and upgrading
                res, err := upAction.Run(rel.Name, buildChart(), newValues)
                is.NoError(err)

                // Now make sure it is actually upgraded
                updatedRes, err := upAction.cfg.Releases.Get(res.Name, 2)
                is.NoError(err)

                if updatedRes == nil {
                        is.Fail("Updated Release is nil")
                        return
                }
                is.Equal(release.StatusDeployed, updatedRes.Info.Status)
                is.Equal(expectedValues, updatedRes.Config)
        })

        t.Run("reuse values should not install disabled charts", func(t *testing.T) {
                upAction := upgradeAction(t)
                chartDefaultValues := map[string]interface{}{
                        "subchart": map[string]interface{}{
                                "enabled": true,
                        },
                }
                dependency := chart.Dependency{
                        Name:       "subchart",
                        Version:    "0.1.0",
                        Repository: "http://some-repo.com",
                        Condition:  "subchart.enabled",
                }
                sampleChart := buildChart(
                        withName("sample"),
                        withValues(chartDefaultValues),
                        withMetadataDependency(dependency),
                )
                now := helmtime.Now()
                existingValues := map[string]interface{}{
                        "subchart": map[string]interface{}{
                                "enabled": false,
                        },
                }
                rel := &release.Release{
                        Name: "nuketown",
                        Info: &release.Info{
                                FirstDeployed: now,
                                LastDeployed:  now,
                                Status:        release.StatusDeployed,
                                Description:   "Named Release Stub",
                        },
                        Chart:   sampleChart,
                        Config:  existingValues,
                        Version: 1,
                }
                err := upAction.cfg.Releases.Create(rel)
                is.NoError(err)

                upAction.ReuseValues = true
                sampleChartWithSubChart := buildChart(
                        withName(sampleChart.Name()),
                        withValues(sampleChart.Values),
                        withDependency(withName("subchart")),
                        withMetadataDependency(dependency),
                )
                // reusing values and upgrading
                res, err := upAction.Run(rel.Name, sampleChartWithSubChart, map[string]interface{}{})
                is.NoError(err)

                // Now get the upgraded release
                updatedRes, err := upAction.cfg.Releases.Get(res.Name, 2)
                is.NoError(err)

                if updatedRes == nil {
                        is.Fail("Updated Release is nil")
                        return
                }
                is.Equal(release.StatusDeployed, updatedRes.Info.Status)
                is.Equal(0, len(updatedRes.Chart.Dependencies()), "expected 0 dependencies")

                expectedValues := map[string]interface{}{
                        "subchart": map[string]interface{}{
                                "enabled": false,
                        },
                }
                is.Equal(expectedValues, updatedRes.Config)
        })
}

func TestUpgradeRelease_ResetThenReuseValues(t *testing.T) {
        is := assert.New(t)

        t.Run("reset then reuse values should work with values", func(t *testing.T) {
                upAction := upgradeAction(t)

                existingValues := map[string]interface{}{
                        "name":        "value",
                        "maxHeapSize": "128m",
                        "replicas":    2,
                }
                newValues := map[string]interface{}{
                        "name":        "newValue",
                        "maxHeapSize": "512m",
                        "cpu":         "12m",
                }
                newChartValues := map[string]interface{}{
                        "memory": "256m",
                }
                expectedValues := map[string]interface{}{
                        "name":        "newValue",
                        "maxHeapSize": "512m",
                        "cpu":         "12m",
                        "replicas":    2,
                }

                rel := releaseStub()
                rel.Name = "nuketown"
                rel.Info.Status = release.StatusDeployed
                rel.Config = existingValues

                err := upAction.cfg.Releases.Create(rel)
                is.NoError(err)

                upAction.ResetThenReuseValues = true
                // setting newValues and upgrading
                res, err := upAction.Run(rel.Name, buildChart(withValues(newChartValues)), newValues)
                is.NoError(err)

                // Now make sure it is actually upgraded
                updatedRes, err := upAction.cfg.Releases.Get(res.Name, 2)
                is.NoError(err)

                if updatedRes == nil {
                        is.Fail("Updated Release is nil")
                        return
                }
                is.Equal(release.StatusDeployed, updatedRes.Info.Status)
                is.Equal(expectedValues, updatedRes.Config)
                is.Equal(newChartValues, updatedRes.Chart.Values)
        })
}

func TestUpgradeRelease_Pending(t *testing.T) {
        req := require.New(t)

        upAction := upgradeAction(t)
        rel := releaseStub()
        rel.Name = "come-fail-away"
        rel.Info.Status = release.StatusDeployed
        upAction.cfg.Releases.Create(rel)
        rel2 := releaseStub()
        rel2.Name = "come-fail-away"
        rel2.Info.Status = release.StatusPendingUpgrade
        rel2.Version = 2
        upAction.cfg.Releases.Create(rel2)

        vals := map[string]interface{}{}

        _, err := upAction.Run(rel.Name, buildChart(), vals)
        req.Contains(err.Error(), "progress", err)
}

func TestUpgradeRelease_Interrupted_Wait(t *testing.T) {

        is := assert.New(t)
        req := require.New(t)

        upAction := upgradeAction(t)
        rel := releaseStub()
        rel.Name = "interrupted-release"
        rel.Info.Status = release.StatusDeployed
        upAction.cfg.Releases.Create(rel)

        failer := upAction.cfg.KubeClient.(*kubefake.FailingKubeClient)
        failer.WaitDuration = 10 * time.Second
        upAction.cfg.KubeClient = failer
        upAction.Wait = true
        vals := map[string]interface{}{}

        ctx := context.Background()
        ctx, cancel := context.WithCancel(ctx)
        time.AfterFunc(time.Second, cancel)

        res, err := upAction.RunWithContext(ctx, rel.Name, buildChart(), vals)

        req.Error(err)
        is.Contains(res.Info.Description, "Upgrade \"interrupted-release\" failed: context canceled")
        is.Equal(res.Info.Status, release.StatusFailed)

}

func TestUpgradeRelease_Interrupted_Atomic(t *testing.T) {

        is := assert.New(t)
        req := require.New(t)

        upAction := upgradeAction(t)
        rel := releaseStub()
        rel.Name = "interrupted-release"
        rel.Info.Status = release.StatusDeployed
        upAction.cfg.Releases.Create(rel)

        failer := upAction.cfg.KubeClient.(*kubefake.FailingKubeClient)
        failer.WaitDuration = 5 * time.Second
        upAction.cfg.KubeClient = failer
        upAction.Atomic = true
        vals := map[string]interface{}{}

        ctx := context.Background()
        ctx, cancel := context.WithCancel(ctx)
        time.AfterFunc(time.Second, cancel)

        res, err := upAction.RunWithContext(ctx, rel.Name, buildChart(), vals)

        req.Error(err)
        is.Contains(err.Error(), "release interrupted-release failed, and has been rolled back due to atomic being set: context canceled")

        // Now make sure it is actually upgraded
        updatedRes, err := upAction.cfg.Releases.Get(res.Name, 3)
        is.NoError(err)
        // Should have rolled back to the previous
        is.Equal(updatedRes.Info.Status, release.StatusDeployed)
}

func TestMergeCustomLabels(t *testing.T) {
        var tests = [][3]map[string]string{
                {nil, nil, map[string]string{}},
                {map[string]string{}, map[string]string{}, map[string]string{}},
                {map[string]string{"k1": "v1", "k2": "v2"}, nil, map[string]string{"k1": "v1", "k2": "v2"}},
                {nil, map[string]string{"k1": "v1", "k2": "v2"}, map[string]string{"k1": "v1", "k2": "v2"}},
                {map[string]string{"k1": "v1", "k2": "v2"}, map[string]string{"k1": "null", "k2": "v3"}, map[string]string{"k2": "v3"}},
        }
        for _, test := range tests {
                if output := mergeCustomLabels(test[0], test[1]); !reflect.DeepEqual(test[2], output) {
                        t.Errorf("Expected {%v}, got {%v}", test[2], output)
                }
        }
}

func TestUpgradeRelease_Labels(t *testing.T) {
        is := assert.New(t)
        upAction := upgradeAction(t)

        rel := releaseStub()
        rel.Name = "labels"
        // It's needed to check that suppressed release would keep original labels
        rel.Labels = map[string]string{
                "key1": "val1",
                "key2": "val2.1",
        }
        rel.Info.Status = release.StatusDeployed

        err := upAction.cfg.Releases.Create(rel)
        is.NoError(err)

        upAction.Labels = map[string]string{
                "key1": "null",
                "key2": "val2.2",
                "key3": "val3",
        }
        // setting newValues and upgrading
        res, err := upAction.Run(rel.Name, buildChart(), nil)
        is.NoError(err)

        // Now make sure it is actually upgraded and labels were merged
        updatedRes, err := upAction.cfg.Releases.Get(res.Name, 2)
        is.NoError(err)

        if updatedRes == nil {
                is.Fail("Updated Release is nil")
                return
        }
        is.Equal(release.StatusDeployed, updatedRes.Info.Status)
        is.Equal(mergeCustomLabels(rel.Labels, upAction.Labels), updatedRes.Labels)

        // Now make sure it is suppressed release still contains original labels
        initialRes, err := upAction.cfg.Releases.Get(res.Name, 1)
        is.NoError(err)

        if initialRes == nil {
                is.Fail("Updated Release is nil")
                return
        }
        is.Equal(initialRes.Info.Status, release.StatusSuperseded)
        is.Equal(initialRes.Labels, rel.Labels)
}

func TestUpgradeRelease_SystemLabels(t *testing.T) {
        is := assert.New(t)
        upAction := upgradeAction(t)

        rel := releaseStub()
        rel.Name = "labels"
        // It's needed to check that suppressed release would keep original labels
        rel.Labels = map[string]string{
                "key1": "val1",
                "key2": "val2.1",
        }
        rel.Info.Status = release.StatusDeployed

        err := upAction.cfg.Releases.Create(rel)
        is.NoError(err)

        upAction.Labels = map[string]string{
                "key1":  "null",
                "key2":  "val2.2",
                "owner": "val3",
        }
        // setting newValues and upgrading
        _, err = upAction.Run(rel.Name, buildChart(), nil)
        if err == nil {
                t.Fatal("expected an error")
        }

        is.Equal(fmt.Errorf("user suplied labels contains system reserved label name. System labels: %+v", driver.GetSystemLabels()), err)
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package action

import (
        "fmt"

        "github.com/pkg/errors"
        apierrors "k8s.io/apimachinery/pkg/api/errors"
        "k8s.io/apimachinery/pkg/api/meta"
        "k8s.io/apimachinery/pkg/runtime"
        "k8s.io/cli-runtime/pkg/resource"

        "helm.sh/helm/v3/pkg/kube"
)

var accessor = meta.NewAccessor()

const (
        appManagedByLabel              = "app.kubernetes.io/managed-by"
        appManagedByHelm               = "Helm"
        helmReleaseNameAnnotation      = "meta.helm.sh/release-name"
        helmReleaseNamespaceAnnotation = "meta.helm.sh/release-namespace"
)

func existingResourceConflict(resources kube.ResourceList, releaseName, releaseNamespace string) (kube.ResourceList, error) {
        var requireUpdate kube.ResourceList

        err := resources.Visit(func(info *resource.Info, err error) error {
                if err != nil {
                        return err
                }

                helper := resource.NewHelper(info.Client, info.Mapping)
                existing, err := helper.Get(info.Namespace, info.Name)
                if err != nil {
                        if apierrors.IsNotFound(err) {
                                return nil
                        }
                        return errors.Wrapf(err, "could not get information about the resource %s", resourceString(info))
                }

                // Allow adoption of the resource if it is managed by Helm and is annotated with correct release name and namespace.
                if err := checkOwnership(existing, releaseName, releaseNamespace); err != nil {
                        return fmt.Errorf("%s exists and cannot be imported into the current release: %s", resourceString(info), err)
                }

                requireUpdate.Append(info)
                return nil
        })

        return requireUpdate, err
}

func checkOwnership(obj runtime.Object, releaseName, releaseNamespace string) error {
        lbls, err := accessor.Labels(obj)
        if err != nil {
                return err
        }
        annos, err := accessor.Annotations(obj)
        if err != nil {
                return err
        }

        var errs []error
        if err := requireValue(lbls, appManagedByLabel, appManagedByHelm); err != nil {
                errs = append(errs, fmt.Errorf("label validation error: %s", err))
        }
        if err := requireValue(annos, helmReleaseNameAnnotation, releaseName); err != nil {
                errs = append(errs, fmt.Errorf("annotation validation error: %s", err))
        }
        if err := requireValue(annos, helmReleaseNamespaceAnnotation, releaseNamespace); err != nil {
                errs = append(errs, fmt.Errorf("annotation validation error: %s", err))
        }

        if len(errs) > 0 {
                err := errors.New("invalid ownership metadata")
                for _, e := range errs {
                        err = fmt.Errorf("%w; %s", err, e)
                }
                return err
        }

        return nil
}

func requireValue(meta map[string]string, k, v string) error {
        actual, ok := meta[k]
        if !ok {
                return fmt.Errorf("missing key %q: must be set to %q", k, v)
        }
        if actual != v {
                return fmt.Errorf("key %q must equal %q: current value is %q", k, v, actual)
        }
        return nil
}

// setMetadataVisitor adds release tracking metadata to all resources. If force is enabled, existing
// ownership metadata will be overwritten. Otherwise an error will be returned if any resource has an
// existing and conflicting value for the managed by label or Helm release/namespace annotations.
func setMetadataVisitor(releaseName, releaseNamespace string, force bool) resource.VisitorFunc {
        return func(info *resource.Info, err error) error {
                if err != nil {
                        return err
                }

                if !force {
                        if err := checkOwnership(info.Object, releaseName, releaseNamespace); err != nil {
                                return fmt.Errorf("%s cannot be owned: %s", resourceString(info), err)
                        }
                }

                if err := mergeLabels(info.Object, map[string]string{
                        appManagedByLabel: appManagedByHelm,
                }); err != nil {
                        return fmt.Errorf(
                                "%s labels could not be updated: %s",
                                resourceString(info), err,
                        )
                }

                if err := mergeAnnotations(info.Object, map[string]string{
                        helmReleaseNameAnnotation:      releaseName,
                        helmReleaseNamespaceAnnotation: releaseNamespace,
                }); err != nil {
                        return fmt.Errorf(
                                "%s annotations could not be updated: %s",
                                resourceString(info), err,
                        )
                }

                return nil
        }
}

func resourceString(info *resource.Info) string {
        _, k := info.Mapping.GroupVersionKind.ToAPIVersionAndKind()
        return fmt.Sprintf(
                "%s %q in namespace %q",
                k, info.Name, info.Namespace,
        )
}

func mergeLabels(obj runtime.Object, labels map[string]string) error {
        current, err := accessor.Labels(obj)
        if err != nil {
                return err
        }
        return accessor.SetLabels(obj, mergeStrStrMaps(current, labels))
}

func mergeAnnotations(obj runtime.Object, annotations map[string]string) error {
        current, err := accessor.Annotations(obj)
        if err != nil {
                return err
        }
        return accessor.SetAnnotations(obj, mergeStrStrMaps(current, annotations))
}

// merge two maps, always taking the value on the right
func mergeStrStrMaps(current, desired map[string]string) map[string]string {
        result := make(map[string]string)
        for k, v := range current {
                result[k] = v
        }
        for k, desiredVal := range desired {
                result[k] = desiredVal
        }
        return result
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package action

import (
        "fmt"
        "strings"

        "helm.sh/helm/v3/pkg/downloader"
)

// Verify is the action for building a given chart's Verify tree.
//
// It provides the implementation of 'helm verify'.
type Verify struct {
        Keyring string
        Out     string
}

// NewVerify creates a new Verify object with the given configuration.
func NewVerify() *Verify {
        return &Verify{}
}

// Run executes 'helm verify'.
func (v *Verify) Run(chartfile string) error {
        var out strings.Builder
        p, err := downloader.VerifyChart(chartfile, v.Keyring)
        if err != nil {
                return err
        }

        for name := range p.SignedBy.Identities {
                fmt.Fprintf(&out, "Signed by: %v\n", name)
        }
        fmt.Fprintf(&out, "Using Key With Fingerprint: %X\n", p.SignedBy.PrimaryKey.Fingerprint)
        fmt.Fprintf(&out, "Chart Hash Verified: %s\n", p.FileHash)

        // TODO(mattfarina): The output is set as a property rather than returned
        // to maintain the Go API. In Helm v4 this function should return the out
        // and the property on the struct can be removed.
        v.Out = out.String()

        return nil
}

/*
Copyright The Helm Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package chart

import (
        "path/filepath"
        "regexp"
        "strings"
)

// APIVersionV1 is the API version number for version 1.
const APIVersionV1 = "v1"

// APIVersionV2 is the API version number for version 2.
const APIVersionV2 = "v2"

// aliasNameFormat defines the characters that are legal in an alias name.
var aliasNameFormat = regexp.MustCompile("^[a-zA-Z0-9_-]+$")

// Chart is a helm package that contains metadata, a default config, zero or more
// optionally parameterizable templates, and zero or more charts (dependencies).
type Chart struct {
        // Raw contains the raw contents of the files originally contained in the chart archive.
        //
        // This should not be used except in special cases like `helm show values`,
        // where we want to display the raw values, comments and all.
        Raw []*File `json:"-"`
        // Metadata is the contents of the Chartfile.
        Metadata *Metadata `json:"metadata"`
        // Lock is the contents of Chart.lock.
        Lock *Lock `json:"lock"`
        // Templates for this chart.
        Templates []*File `json:"templates"`
        // Values are default config for this chart.
        Values map[string]interface{} `json:"values"`
        // Schema is an optional JSON schema for imposing structure on Values
        Schema []byte `json:"schema"`
        // Files are miscellaneous files in a chart archive,
        // e.g. README, LICENSE, etc.
        Files []*File `json:"files"`

        parent       *Chart
        dependencies []*Chart
}

type CRD struct {
        // Name is the File.Name for the crd file
        Name string
        // Filename is the File obj Name including (sub-)chart.ChartFullPath
        Filename string
        // File is the File obj for the crd
        File *File
}

// SetDependencies replaces the chart dependencies.
func (ch *Chart) SetDependencies(charts ...*Chart) {
        ch.dependencies = nil
        ch.AddDependency(charts...)
}

// Name returns the name of the chart.
func (ch *Chart) Name() string {
        if ch.Metadata == nil {
                return ""
        }
        return ch.Metadata.Name
}

// AddDependency determines if the chart is a subchart.
func (ch *Chart) AddDependency(charts ...*Chart) {
        for i, x := range charts {
                charts[i].parent = ch
                ch.dependencies = append(ch.dependencies, x)
        }
}

// Root finds the root chart.
func (ch *Chart) Root() *Chart {
        if ch.IsRoot() {
                return ch
        }
        return ch.Parent().Root()
}

// Dependencies are the charts that this chart depends on.
func (ch *Chart) Dependencies() []*Chart { return ch.dependencies }

// IsRoot determines if the chart is the root chart.
func (ch *Chart) IsRoot() bool { return ch.parent == nil }

// Parent returns a subchart's parent chart.
func (ch *Chart) Parent() *Chart { return ch.parent }

// ChartPath returns the full path to this chart in dot notation.
func (ch *Chart) ChartPath() string {
        if !ch.IsRoot() {
                return ch.Parent().ChartPath() + "." + ch.Name()
        }
        return ch.Name()
}

// ChartFullPath returns the full path to this chart.
func (ch *Chart) ChartFullPath() string {
        if !ch.IsRoot() {
                return ch.Parent().ChartFullPath() + "/charts/" + ch.Name()
        }
        return ch.Name()
}

// Validate validates the metadata.
func (ch *Chart) Validate() error {
        return ch.Metadata.Validate()
}

// AppVersion returns the appversion of the chart.
func (ch *Chart) AppVersion() string {
        if ch.Metadata == nil {
                return ""
        }
        return ch.Metadata.AppVersion
}

// CRDs returns a list of File objects in the 'crds/' directory of a Helm chart.
// Deprecated: use CRDObjects()
func (ch *Chart) CRDs() []*File {
        files := []*File{}
        // Find all resources in the crds/ directory
        for _, f := range ch.Files {
                if strings.HasPrefix(f.Name, "crds/") && hasManifestExtension(f.Name) {
                        files = append(files, f)
                }
        }
        // Get CRDs from dependencies, too.
        for _, dep := range ch.Dependencies() {
                files = append(files, dep.CRDs()...)
        }
        return files
}

// CRDObjects returns a list of CRD objects in the 'crds/' directory of a Helm chart & subcharts
func (ch *Chart) CRDObjects() []CRD {
        crds := []CRD{}
        // Find all resources in the crds/ directory
        for _, f := range ch.Files {
                if strings.HasPrefix(f.Name, "crds/") && hasManifestExtension(f.Name) {
                        mycrd := CRD{Name: f.Name, Filename: filepath.Join(ch.ChartFullPath(), f.Name), File: f}
                        crds = append(crds, mycrd)
                }
        }
        // Get CRDs from dependencies, too.
        for _, dep := range ch.Dependencies() {
                crds = append(crds, dep.CRDObjects()...)
        }
        return crds
}

func hasManifestExtension(fname string) bool {
        ext := filepath.Ext(fname)
        return strings.EqualFold(ext, ".yaml") || strings.EqualFold(ext, ".yml") || strings.EqualFold(ext, ".json")
}

//go:build gofuzz
// +build gofuzz

// Copyright 2022 ADA Logics Ltd
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

package chart

import (
        fuzz "github.com/AdaLogics/go-fuzz-headers"
)

func FuzzMetadataValidate(data []byte) int {
        f := fuzz.NewConsumer(data)
        md := &Metadata{}
        err := f.GenerateStruct(md)
        if err != nil {
                return 0
        }
        md.Validate()
        return 1
}

func FuzzDependencyValidate(data []byte) int {
        f := fuzz.NewConsumer(data)
        d := &Dependency{}
        err := f.GenerateStruct(d)
        if err != nil {
                return 0
        }
        d.Validate()
        return 1
}

/*
Copyright The Helm Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package chart

import "time"

// Dependency describes a chart upon which another chart depends.
//
// Dependencies can be used to express developer intent, or to capture the state
// of a chart.
type Dependency struct {
        // Name is the name of the dependency.
        //
        // This must mach the name in the dependency's Chart.yaml.
        Name string `json:"name"`
        // Version is the version (range) of this chart.
        //
        // A lock file will always produce a single version, while a dependency
        // may contain a semantic version range.
        Version string `json:"version,omitempty"`
        // The URL to the repository.
        //
        // Appending `index.yaml` to this string should result in a URL that can be
        // used to fetch the repository index.
        Repository string `json:"repository"`
        // A yaml path that resolves to a boolean, used for enabling/disabling charts (e.g. subchart1.enabled )
        Condition string `json:"condition,omitempty"`
        // Tags can be used to group charts for enabling/disabling together
        Tags []string `json:"tags,omitempty"`
        // Enabled bool determines if chart should be loaded
        Enabled bool `json:"enabled,omitempty"`
        // ImportValues holds the mapping of source values to parent key to be imported. Each item can be a
        // string or pair of child/parent sublist items.
        ImportValues []interface{} `json:"import-values,omitempty"`
        // Alias usable alias to be used for the chart
        Alias string `json:"alias,omitempty"`
}

// Validate checks for common problems with the dependency datastructure in
// the chart. This check must be done at load time before the dependency's charts are
// loaded.
func (d *Dependency) Validate() error {
        if d == nil {
                return ValidationError("dependencies must not contain empty or null nodes")
        }
        d.Name = sanitizeString(d.Name)
        d.Version = sanitizeString(d.Version)
        d.Repository = sanitizeString(d.Repository)
        d.Condition = sanitizeString(d.Condition)
        for i := range d.Tags {
                d.Tags[i] = sanitizeString(d.Tags[i])
        }
        if d.Alias != "" && !aliasNameFormat.MatchString(d.Alias) {
                return ValidationErrorf("dependency %q has disallowed characters in the alias", d.Name)
        }
        return nil
}

// Lock is a lock file for dependencies.
//
// It represents the state that the dependencies should be in.
type Lock struct {
        // Generated is the date the lock file was last generated.
        Generated time.Time `json:"generated"`
        // Digest is a hash of the dependencies in Chart.yaml.
        Digest string `json:"digest"`
        // Dependencies is the list of dependencies that this lock file has locked.
        Dependencies []*Dependency `json:"dependencies"`
}

/*
Copyright The Helm Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package chart

import "fmt"

// ValidationError represents a data validation error.
type ValidationError string

func (v ValidationError) Error() string {
        return "validation: " + string(v)
}

// ValidationErrorf takes a message and formatting options and creates a ValidationError
func ValidationErrorf(msg string, args ...interface{}) ValidationError {
        return ValidationError(fmt.Sprintf(msg, args...))
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package loader

import (
        "archive/tar"
        "bytes"
        "compress/gzip"
        "fmt"
        "io"
        "net/http"
        "os"
        "path"
        "regexp"
        "strings"

        "github.com/pkg/errors"

        "helm.sh/helm/v3/pkg/chart"
)

var drivePathPattern = regexp.MustCompile(`^[a-zA-Z]:/`)

// FileLoader loads a chart from a file
type FileLoader string

// Load loads a chart
func (l FileLoader) Load() (*chart.Chart, error) {
        return LoadFile(string(l))
}

// LoadFile loads from an archive file.
func LoadFile(name string) (*chart.Chart, error) {
        if fi, err := os.Stat(name); err != nil {
                return nil, err
        } else if fi.IsDir() {
                return nil, errors.New("cannot load a directory")
        }

        raw, err := os.Open(name)
        if err != nil {
                return nil, err
        }
        defer raw.Close()

        err = ensureArchive(name, raw)
        if err != nil {
                return nil, err
        }

        c, err := LoadArchive(raw)
        if err != nil {
                if err == gzip.ErrHeader {
                        return nil, fmt.Errorf("file '%s' does not appear to be a valid chart file (details: %s)", name, err)
                }
        }
        return c, err
}

// ensureArchive's job is to return an informative error if the file does not appear to be a gzipped archive.
//
// Sometimes users will provide a values.yaml for an argument where a chart is expected. One common occurrence
// of this is invoking `helm template values.yaml mychart` which would otherwise produce a confusing error
// if we didn't check for this.
func ensureArchive(name string, raw *os.File) error {
        defer raw.Seek(0, 0) // reset read offset to allow archive loading to proceed.

        // Check the file format to give us a chance to provide the user with more actionable feedback.
        buffer := make([]byte, 512)
        _, err := raw.Read(buffer)
        if err != nil && err != io.EOF {
                return fmt.Errorf("file '%s' cannot be read: %s", name, err)
        }

        // Helm may identify achieve of the application/x-gzip as application/vnd.ms-fontobject.
        // Fix for: https://github.com/helm/helm/issues/12261
        if contentType := http.DetectContentType(buffer); contentType != "application/x-gzip" && !isGZipApplication(buffer) {
                // TODO: Is there a way to reliably test if a file content is YAML? ghodss/yaml accepts a wide
                //       variety of content (Makefile, .zshrc) as valid YAML without errors.

                // Wrong content type. Let's check if it's yaml and give an extra hint?
                if strings.HasSuffix(name, ".yml") || strings.HasSuffix(name, ".yaml") {
                        return fmt.Errorf("file '%s' seems to be a YAML file, but expected a gzipped archive", name)
                }
                return fmt.Errorf("file '%s' does not appear to be a gzipped archive; got '%s'", name, contentType)
        }
        return nil
}

// isGZipApplication checks whether the achieve is of the application/x-gzip type.
func isGZipApplication(data []byte) bool {
        sig := []byte("\x1F\x8B\x08")
        return bytes.HasPrefix(data, sig)
}

// LoadArchiveFiles reads in files out of an archive into memory. This function
// performs important path security checks and should always be used before
// expanding a tarball
func LoadArchiveFiles(in io.Reader) ([]*BufferedFile, error) {
        unzipped, err := gzip.NewReader(in)
        if err != nil {
                return nil, err
        }
        defer unzipped.Close()

        files := []*BufferedFile{}
        tr := tar.NewReader(unzipped)
        for {
                b := bytes.NewBuffer(nil)
                hd, err := tr.Next()
                if err == io.EOF {
                        break
                }
                if err != nil {
                        return nil, err
                }

                if hd.FileInfo().IsDir() {
                        // Use this instead of hd.Typeflag because we don't have to do any
                        // inference chasing.
                        continue
                }

                switch hd.Typeflag {
                // We don't want to process these extension header files.
                case tar.TypeXGlobalHeader, tar.TypeXHeader:
                        continue
                }

                // Archive could contain \ if generated on Windows
                delimiter := "/"
                if strings.ContainsRune(hd.Name, '\\') {
                        delimiter = "\\"
                }

                parts := strings.Split(hd.Name, delimiter)
                n := strings.Join(parts[1:], delimiter)

                // Normalize the path to the / delimiter
                n = strings.ReplaceAll(n, delimiter, "/")

                if path.IsAbs(n) {
                        return nil, errors.New("chart illegally contains absolute paths")
                }

                n = path.Clean(n)
                if n == "." {
                        // In this case, the original path was relative when it should have been absolute.
                        return nil, errors.Errorf("chart illegally contains content outside the base directory: %q", hd.Name)
                }
                if strings.HasPrefix(n, "..") {
                        return nil, errors.New("chart illegally references parent directory")
                }

                // In some particularly arcane acts of path creativity, it is possible to intermix
                // UNIX and Windows style paths in such a way that you produce a result of the form
                // c:/foo even after all the built-in absolute path checks. So we explicitly check
                // for this condition.
                if drivePathPattern.MatchString(n) {
                        return nil, errors.New("chart contains illegally named files")
                }

                if parts[0] == "Chart.yaml" {
                        return nil, errors.New("chart yaml not in base directory")
                }

                if _, err := io.Copy(b, tr); err != nil {
                        return nil, err
                }

                data := bytes.TrimPrefix(b.Bytes(), utf8bom)

                files = append(files, &BufferedFile{Name: n, Data: data})
                b.Reset()
        }

        if len(files) == 0 {
                return nil, errors.New("no files in chart archive")
        }
        return files, nil
}

// LoadArchive loads from a reader containing a compressed tar archive.
func LoadArchive(in io.Reader) (*chart.Chart, error) {
        files, err := LoadArchiveFiles(in)
        if err != nil {
                return nil, err
        }

        return LoadFiles(files)
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package loader

import (
        "bytes"
        "fmt"
        "os"
        "path/filepath"
        "strings"

        "github.com/pkg/errors"

        "helm.sh/helm/v3/internal/ignore"
        "helm.sh/helm/v3/internal/sympath"
        "helm.sh/helm/v3/pkg/chart"
)

var utf8bom = []byte{0xEF, 0xBB, 0xBF}

// DirLoader loads a chart from a directory
type DirLoader string

// Load loads the chart
func (l DirLoader) Load() (*chart.Chart, error) {
        return LoadDir(string(l))
}

// LoadDir loads from a directory.
//
// This loads charts only from directories.
func LoadDir(dir string) (*chart.Chart, error) {
        topdir, err := filepath.Abs(dir)
        if err != nil {
                return nil, err
        }

        // Just used for errors.
        c := &chart.Chart{}

        rules := ignore.Empty()
        ifile := filepath.Join(topdir, ignore.HelmIgnore)
        if _, err := os.Stat(ifile); err == nil {
                r, err := ignore.ParseFile(ifile)
                if err != nil {
                        return c, err
                }
                rules = r
        }
        rules.AddDefaults()

        files := []*BufferedFile{}
        topdir += string(filepath.Separator)

        walk := func(name string, fi os.FileInfo, err error) error {
                n := strings.TrimPrefix(name, topdir)
                if n == "" {
                        // No need to process top level. Avoid bug with helmignore .* matching
                        // empty names. See issue 1779.
                        return nil
                }

                // Normalize to / since it will also work on Windows
                n = filepath.ToSlash(n)

                if err != nil {
                        return err
                }
                if fi.IsDir() {
                        // Directory-based ignore rules should involve skipping the entire
                        // contents of that directory.
                        if rules.Ignore(n, fi) {
                                return filepath.SkipDir
                        }
                        return nil
                }

                // If a .helmignore file matches, skip this file.
                if rules.Ignore(n, fi) {
                        return nil
                }

                // Irregular files include devices, sockets, and other uses of files that
                // are not regular files. In Go they have a file mode type bit set.
                // See https://golang.org/pkg/os/#FileMode for examples.
                if !fi.Mode().IsRegular() {
                        return fmt.Errorf("cannot load irregular file %s as it has file mode type bits set", name)
                }

                data, err := os.ReadFile(name)
                if err != nil {
                        return errors.Wrapf(err, "error reading %s", n)
                }

                data = bytes.TrimPrefix(data, utf8bom)

                files = append(files, &BufferedFile{Name: n, Data: data})
                return nil
        }
        if err = sympath.Walk(topdir, walk); err != nil {
                return c, err
        }

        return LoadFiles(files)
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package loader

import (
        "bytes"
        "log"
        "os"
        "path/filepath"
        "strings"

        "github.com/pkg/errors"
        "sigs.k8s.io/yaml"

        "helm.sh/helm/v3/pkg/chart"
)

// ChartLoader loads a chart.
type ChartLoader interface {
        Load() (*chart.Chart, error)
}

// Loader returns a new ChartLoader appropriate for the given chart name
func Loader(name string) (ChartLoader, error) {
        fi, err := os.Stat(name)
        if err != nil {
                return nil, err
        }
        if fi.IsDir() {
                return DirLoader(name), nil
        }
        return FileLoader(name), nil

}

// Load takes a string name, tries to resolve it to a file or directory, and then loads it.
//
// This is the preferred way to load a chart. It will discover the chart encoding
// and hand off to the appropriate chart reader.
//
// If a .helmignore file is present, the directory loader will skip loading any files
// matching it. But .helmignore is not evaluated when reading out of an archive.
func Load(name string) (*chart.Chart, error) {
        l, err := Loader(name)
        if err != nil {
                return nil, err
        }
        return l.Load()
}

// BufferedFile represents an archive file buffered for later processing.
type BufferedFile struct {
        Name string
        Data []byte
}

// LoadFiles loads from in-memory files.
func LoadFiles(files []*BufferedFile) (*chart.Chart, error) {
        c := new(chart.Chart)
        subcharts := make(map[string][]*BufferedFile)

        // do not rely on assumed ordering of files in the chart and crash
        // if Chart.yaml was not coming early enough to initialize metadata
        for _, f := range files {
                c.Raw = append(c.Raw, &chart.File{Name: f.Name, Data: f.Data})
                if f.Name == "Chart.yaml" {
                        if c.Metadata == nil {
                                c.Metadata = new(chart.Metadata)
                        }
                        if err := yaml.Unmarshal(f.Data, c.Metadata); err != nil {
                                return c, errors.Wrap(err, "cannot load Chart.yaml")
                        }
                        // NOTE(bacongobbler): while the chart specification says that APIVersion must be set,
                        // Helm 2 accepted charts that did not provide an APIVersion in their chart metadata.
                        // Because of that, if APIVersion is unset, we should assume we're loading a v1 chart.
                        if c.Metadata.APIVersion == "" {
                                c.Metadata.APIVersion = chart.APIVersionV1
                        }
                }
        }
        for _, f := range files {
                switch {
                case f.Name == "Chart.yaml":
                        // already processed
                        continue
                case f.Name == "Chart.lock":
                        c.Lock = new(chart.Lock)
                        if err := yaml.Unmarshal(f.Data, &c.Lock); err != nil {
                                return c, errors.Wrap(err, "cannot load Chart.lock")
                        }
                case f.Name == "values.yaml":
                        c.Values = make(map[string]interface{})
                        if err := yaml.Unmarshal(f.Data, &c.Values); err != nil {
                                return c, errors.Wrap(err, "cannot load values.yaml")
                        }
                case f.Name == "values.schema.json":
                        c.Schema = f.Data

                // Deprecated: requirements.yaml is deprecated use Chart.yaml.
                // We will handle it for you because we are nice people
                case f.Name == "requirements.yaml":
                        if c.Metadata == nil {
                                c.Metadata = new(chart.Metadata)
                        }
                        if c.Metadata.APIVersion != chart.APIVersionV1 {
                                log.Printf("Warning: Dependencies are handled in Chart.yaml since apiVersion \"v2\". We recommend migrating dependencies to Chart.yaml.")
                        }
                        if err := yaml.Unmarshal(f.Data, c.Metadata); err != nil {
                                return c, errors.Wrap(err, "cannot load requirements.yaml")
                        }
                        if c.Metadata.APIVersion == chart.APIVersionV1 {
                                c.Files = append(c.Files, &chart.File{Name: f.Name, Data: f.Data})
                        }
                // Deprecated: requirements.lock is deprecated use Chart.lock.
                case f.Name == "requirements.lock":
                        c.Lock = new(chart.Lock)
                        if err := yaml.Unmarshal(f.Data, &c.Lock); err != nil {
                                return c, errors.Wrap(err, "cannot load requirements.lock")
                        }
                        if c.Metadata == nil {
                                c.Metadata = new(chart.Metadata)
                        }
                        if c.Metadata.APIVersion == chart.APIVersionV1 {
                                c.Files = append(c.Files, &chart.File{Name: f.Name, Data: f.Data})
                        }

                case strings.HasPrefix(f.Name, "templates/"):
                        c.Templates = append(c.Templates, &chart.File{Name: f.Name, Data: f.Data})
                case strings.HasPrefix(f.Name, "charts/"):
                        if filepath.Ext(f.Name) == ".prov" {
                                c.Files = append(c.Files, &chart.File{Name: f.Name, Data: f.Data})
                                continue
                        }

                        fname := strings.TrimPrefix(f.Name, "charts/")
                        cname := strings.SplitN(fname, "/", 2)[0]
                        subcharts[cname] = append(subcharts[cname], &BufferedFile{Name: fname, Data: f.Data})
                default:
                        c.Files = append(c.Files, &chart.File{Name: f.Name, Data: f.Data})
                }
        }

        if c.Metadata == nil {
                return c, errors.New("Chart.yaml file is missing")
        }

        if err := c.Validate(); err != nil {
                return c, err
        }

        for n, files := range subcharts {
                var sc *chart.Chart
                var err error
                switch {
                case strings.IndexAny(n, "_.") == 0:
                        continue
                case filepath.Ext(n) == ".tgz":
                        file := files[0]
                        if file.Name != n {
                                return c, errors.Errorf("error unpacking tar in %s: expected %s, got %s", c.Name(), n, file.Name)
                        }
                        // Untar the chart and add to c.Dependencies
                        sc, err = LoadArchive(bytes.NewBuffer(file.Data))
                default:
                        // We have to trim the prefix off of every file, and ignore any file
                        // that is in charts/, but isn't actually a chart.
                        buff := make([]*BufferedFile, 0, len(files))
                        for _, f := range files {
                                parts := strings.SplitN(f.Name, "/", 2)
                                if len(parts) < 2 {
                                        continue
                                }
                                f.Name = parts[1]
                                buff = append(buff, f)
                        }
                        sc, err = LoadFiles(buff)
                }

                if err != nil {
                        return c, errors.Wrapf(err, "error unpacking %s in %s", n, c.Name())
                }
                c.AddDependency(sc)
        }

        return c, nil
}

//go:build gofuzz
// +build gofuzz

// Copyright 2022 ADA Logics Ltd
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

package loader

import (
        "os"
        fuzz "github.com/AdaLogics/go-fuzz-headers"
)

func FuzzLoadDir(data []byte) int {
        f := fuzz.NewConsumer(data)
        err := os.Mkdir("fuzzDir", 0755)
        if err != nil {
                return 0
        }
        defer os.RemoveAll("fuzzDir")
        err = f.CreateFiles("fuzzDir")
        if err != nil {
                return 0
        }
        _, _ = LoadDir("fuzzDir")
        return 1
}

/*
Copyright The Helm Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package chart

import (
        "strings"
        "unicode"

        "github.com/Masterminds/semver/v3"
)

// Maintainer describes a Chart maintainer.
type Maintainer struct {
        // Name is a user name or organization name
        Name string `json:"name,omitempty"`
        // Email is an optional email address to contact the named maintainer
        Email string `json:"email,omitempty"`
        // URL is an optional URL to an address for the named maintainer
        URL string `json:"url,omitempty"`
}

// Validate checks valid data and sanitizes string characters.
func (m *Maintainer) Validate() error {
        if m == nil {
                return ValidationError("maintainers must not contain empty or null nodes")
        }
        m.Name = sanitizeString(m.Name)
        m.Email = sanitizeString(m.Email)
        m.URL = sanitizeString(m.URL)
        return nil
}

// Metadata for a Chart file. This models the structure of a Chart.yaml file.
type Metadata struct {
        // The name of the chart. Required.
        Name string `json:"name,omitempty"`
        // The URL to a relevant project page, git repo, or contact person
        Home string `json:"home,omitempty"`
        // Source is the URL to the source code of this chart
        Sources []string `json:"sources,omitempty"`
        // A SemVer 2 conformant version string of the chart. Required.
        Version string `json:"version,omitempty"`
        // A one-sentence description of the chart
        Description string `json:"description,omitempty"`
        // A list of string keywords
        Keywords []string `json:"keywords,omitempty"`
        // A list of name and URL/email address combinations for the maintainer(s)
        Maintainers []*Maintainer `json:"maintainers,omitempty"`
        // The URL to an icon file.
        Icon string `json:"icon,omitempty"`
        // The API Version of this chart. Required.
        APIVersion string `json:"apiVersion,omitempty"`
        // The condition to check to enable chart
        Condition string `json:"condition,omitempty"`
        // The tags to check to enable chart
        Tags string `json:"tags,omitempty"`
        // The version of the application enclosed inside of this chart.
        AppVersion string `json:"appVersion,omitempty"`
        // Whether or not this chart is deprecated
        Deprecated bool `json:"deprecated,omitempty"`
        // Annotations are additional mappings uninterpreted by Helm,
        // made available for inspection by other applications.
        Annotations map[string]string `json:"annotations,omitempty"`
        // KubeVersion is a SemVer constraint specifying the version of Kubernetes required.
        KubeVersion string `json:"kubeVersion,omitempty"`
        // Dependencies are a list of dependencies for a chart.
        Dependencies []*Dependency `json:"dependencies,omitempty"`
        // Specifies the chart type: application or library
        Type string `json:"type,omitempty"`
}

// Validate checks the metadata for known issues and sanitizes string
// characters.
func (md *Metadata) Validate() error {
        if md == nil {
                return ValidationError("chart.metadata is required")
        }

        md.Name = sanitizeString(md.Name)
        md.Description = sanitizeString(md.Description)
        md.Home = sanitizeString(md.Home)
        md.Icon = sanitizeString(md.Icon)
        md.Condition = sanitizeString(md.Condition)
        md.Tags = sanitizeString(md.Tags)
        md.AppVersion = sanitizeString(md.AppVersion)
        md.KubeVersion = sanitizeString(md.KubeVersion)
        for i := range md.Sources {
                md.Sources[i] = sanitizeString(md.Sources[i])
        }
        for i := range md.Keywords {
                md.Keywords[i] = sanitizeString(md.Keywords[i])
        }

        if md.APIVersion == "" {
                return ValidationError("chart.metadata.apiVersion is required")
        }
        if md.Name == "" {
                return ValidationError("chart.metadata.name is required")
        }
        if md.Version == "" {
                return ValidationError("chart.metadata.version is required")
        }
        if !isValidSemver(md.Version) {
                return ValidationErrorf("chart.metadata.version %q is invalid", md.Version)
        }
        if !isValidChartType(md.Type) {
                return ValidationError("chart.metadata.type must be application or library")
        }

        for _, m := range md.Maintainers {
                if err := m.Validate(); err != nil {
                        return err
                }
        }

        // Aliases need to be validated here to make sure that the alias name does
        // not contain any illegal characters.
        for _, dependency := range md.Dependencies {
                if err := dependency.Validate(); err != nil {
                        return err
                }
        }
        return nil
}

func isValidChartType(in string) bool {
        switch in {
        case "", "application", "library":
                return true
        }
        return false
}

func isValidSemver(v string) bool {
        _, err := semver.NewVersion(v)
        return err == nil
}

// sanitizeString normalize spaces and removes non-printable characters.
func sanitizeString(str string) string {
        return strings.Map(func(r rune) rune {
                if unicode.IsSpace(r) {
                        return ' '
                }
                if unicode.IsPrint(r) {
                        return r
                }
                return -1
        }, str)
}

/*
Copyright The Helm Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package chartutil

import (
        "fmt"
        "strconv"

        "github.com/Masterminds/semver/v3"
        "k8s.io/client-go/kubernetes/scheme"

        apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
        apiextensionsv1beta1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"

        helmversion "helm.sh/helm/v3/internal/version"
)

var (
        // The Kubernetes version can be set by LDFLAGS. In order to do that the value
        // must be a string.
        k8sVersionMajor = "1"
        k8sVersionMinor = "20"

        // DefaultVersionSet is the default version set, which includes only Core V1 ("v1").
        DefaultVersionSet = allKnownVersions()

        // DefaultCapabilities is the default set of capabilities.
        DefaultCapabilities = &Capabilities{
                KubeVersion: KubeVersion{
                        Version: fmt.Sprintf("v%s.%s.0", k8sVersionMajor, k8sVersionMinor),
                        Major:   k8sVersionMajor,
                        Minor:   k8sVersionMinor,
                },
                APIVersions: DefaultVersionSet,
                HelmVersion: helmversion.Get(),
        }
)

// Capabilities describes the capabilities of the Kubernetes cluster.
type Capabilities struct {
        // KubeVersion is the Kubernetes version.
        KubeVersion KubeVersion
        // APIversions are supported Kubernetes API versions.
        APIVersions VersionSet
        // HelmVersion is the build information for this helm version
        HelmVersion helmversion.BuildInfo
}

func (capabilities *Capabilities) Copy() *Capabilities {
        return &Capabilities{
                KubeVersion: capabilities.KubeVersion,
                APIVersions: capabilities.APIVersions,
                HelmVersion: capabilities.HelmVersion,
        }
}

// KubeVersion is the Kubernetes version.
type KubeVersion struct {
        Version string // Kubernetes version
        Major   string // Kubernetes major version
        Minor   string // Kubernetes minor version
}

// String implements fmt.Stringer
func (kv *KubeVersion) String() string { return kv.Version }

// GitVersion returns the Kubernetes version string.
//
// Deprecated: use KubeVersion.Version.
func (kv *KubeVersion) GitVersion() string { return kv.Version }

// ParseKubeVersion parses kubernetes version from string
func ParseKubeVersion(version string) (*KubeVersion, error) {
        sv, err := semver.NewVersion(version)
        if err != nil {
                return nil, err
        }
        return &KubeVersion{
                Version: "v" + sv.String(),
                Major:   strconv.FormatUint(sv.Major(), 10),
                Minor:   strconv.FormatUint(sv.Minor(), 10),
        }, nil
}

// VersionSet is a set of Kubernetes API versions.
type VersionSet []string

// Has returns true if the version string is in the set.
//
//        vs.Has("apps/v1")
func (v VersionSet) Has(apiVersion string) bool {
        for _, x := range v {
                if x == apiVersion {
                        return true
                }
        }
        return false
}

func allKnownVersions() VersionSet {
        // We should register the built in extension APIs as well so CRDs are
        // supported in the default version set. This has caused problems with `helm
        // template` in the past, so let's be safe
        apiextensionsv1beta1.AddToScheme(scheme.Scheme)
        apiextensionsv1.AddToScheme(scheme.Scheme)

        groups := scheme.Scheme.PrioritizedVersionsAllGroups()
        vs := make(VersionSet, 0, len(groups))
        for _, gv := range groups {
                vs = append(vs, gv.String())
        }
        return vs
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package chartutil

import (
        "os"
        "path/filepath"

        "github.com/pkg/errors"
        "sigs.k8s.io/yaml"

        "helm.sh/helm/v3/pkg/chart"
)

// LoadChartfile loads a Chart.yaml file into a *chart.Metadata.
func LoadChartfile(filename string) (*chart.Metadata, error) {
        b, err := os.ReadFile(filename)
        if err != nil {
                return nil, err
        }
        y := new(chart.Metadata)
        err = yaml.Unmarshal(b, y)
        return y, err
}

// SaveChartfile saves the given metadata as a Chart.yaml file at the given path.
//
// 'filename' should be the complete path and filename ('foo/Chart.yaml')
func SaveChartfile(filename string, cf *chart.Metadata) error {
        // Pull out the dependencies of a v1 Chart, since there's no way
        // to tell the serializer to skip a field for just this use case
        savedDependencies := cf.Dependencies
        if cf.APIVersion == chart.APIVersionV1 {
                cf.Dependencies = nil
        }
        out, err := yaml.Marshal(cf)
        if cf.APIVersion == chart.APIVersionV1 {
                cf.Dependencies = savedDependencies
        }
        if err != nil {
                return err
        }
        return os.WriteFile(filename, out, 0644)
}

// IsChartDir validate a chart directory.
//
// Checks for a valid Chart.yaml.
func IsChartDir(dirName string) (bool, error) {
        if fi, err := os.Stat(dirName); err != nil {
                return false, err
        } else if !fi.IsDir() {
                return false, errors.Errorf("%q is not a directory", dirName)
        }

        chartYaml := filepath.Join(dirName, ChartfileName)
        if _, err := os.Stat(chartYaml); os.IsNotExist(err) {
                return false, errors.Errorf("no %s exists in directory %q", ChartfileName, dirName)
        }

        chartYamlContent, err := os.ReadFile(chartYaml)
        if err != nil {
                return false, errors.Errorf("cannot read %s in directory %q", ChartfileName, dirName)
        }

        chartContent := new(chart.Metadata)
        if err := yaml.Unmarshal(chartYamlContent, &chartContent); err != nil {
                return false, err
        }
        if chartContent == nil {
                return false, errors.Errorf("chart metadata (%s) missing", ChartfileName)
        }
        if chartContent.Name == "" {
                return false, errors.Errorf("invalid chart (%s): name must not be empty", ChartfileName)
        }

        return true, nil
}

//go:build gofuzz
// +build gofuzz

// Copyright 2022 ADA Logics Ltd
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

package chartutil

import (
        fuzz "github.com/AdaLogics/go-fuzz-headers"
        "helm.sh/helm/v3/pkg/chart"
        "os"
)

func FuzzProcessDependencies(data []byte) int {
        f := fuzz.NewConsumer(data)
        valuesBytes, err := f.GetBytes()
        if err != nil {
                return 0
        }
        vals, err := ReadValues(valuesBytes)
        if err != nil {
                return 0
        }
        c := &chart.Chart{}
        err = f.GenerateStruct(c)
        if err != nil {
                return 0
        }
        ProcessDependencies(c, vals)
        return 1
}

func FuzzIsChartDir(data []byte) int {
        err := os.Mkdir("fuzzdir", 0755)
        if err != nil {
                return 0
        }
        defer os.RemoveAll("fuzzdir")
        f := fuzz.NewConsumer(data)
        err = f.CreateFiles("fuzzdir")
        if err != nil {
                return 0
        }
        _, _ = IsChartDir("fuzzdir")
        return 1
}

func FuzzExpandFile(data []byte) int {
        fuzzFile, err := os.Create("fuzzFile")
        if err != nil {
                return 0
        }
        defer fuzzFile.Close()
        defer os.Remove(fuzzFile.Name())
        _, err = fuzzFile.Write(data)
        if err != nil {
                return 0
        }
        err = os.Mkdir("fuzzDir", 0755)
        if err != nil {
                return 0
        }
        defer os.RemoveAll("fuzzdir")
        _ = ExpandFile("fuzzDir", fuzzFile.Name())
        return 1
}

func FuzzCreateFrom(data []byte) int {
        f := fuzz.NewConsumer(data)
        md := &chart.Metadata{}
        err := f.GenerateStruct(md)
        if err != nil {
                return 0
        }
        err = os.Mkdir("fuzzDir1", 0755)
        if err != nil {
                return 0
        }
        defer os.RemoveAll("fuzzdir1")
        err = os.Mkdir("fuzzDir2", 0755)
        if err != nil {
                return 0
        }
        defer os.RemoveAll("fuzzDir2")
        err = f.CreateFiles("fuzzDir2")
        if err != nil {
                return 0
        }
        _ = CreateFrom(md, "fuzzDir1", "fuzzDir2")
        return 1
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package chartutil

import (
        "fmt"
        "log"

        "github.com/mitchellh/copystructure"
        "github.com/pkg/errors"

        "helm.sh/helm/v3/pkg/chart"
)

func concatPrefix(a, b string) string {
        if a == "" {
                return b
        }
        return fmt.Sprintf("%s.%s", a, b)
}

// CoalesceValues coalesces all of the values in a chart (and its subcharts).
//
// Values are coalesced together using the following rules:
//
//   - Values in a higher level chart always override values in a lower-level
//     dependency chart
//   - Scalar values and arrays are replaced, maps are merged
//   - A chart has access to all of the variables for it, as well as all of
//     the values destined for its dependencies.
func CoalesceValues(chrt *chart.Chart, vals map[string]interface{}) (Values, error) {
        valsCopy, err := copyValues(vals)
        if err != nil {
                return vals, err
        }
        return coalesce(log.Printf, chrt, valsCopy, "", false)
}

// MergeValues is used to merge the values in a chart and its subcharts. This
// is different from Coalescing as nil/null values are preserved.
//
// Values are coalesced together using the following rules:
//
//   - Values in a higher level chart always override values in a lower-level
//     dependency chart
//   - Scalar values and arrays are replaced, maps are merged
//   - A chart has access to all of the variables for it, as well as all of
//     the values destined for its dependencies.
//
// Retaining Nils is useful when processes early in a Helm action or business
// logic need to retain them for when Coalescing will happen again later in the
// business logic.
func MergeValues(chrt *chart.Chart, vals map[string]interface{}) (Values, error) {
        valsCopy, err := copyValues(vals)
        if err != nil {
                return vals, err
        }
        return coalesce(log.Printf, chrt, valsCopy, "", true)
}

func copyValues(vals map[string]interface{}) (Values, error) {
        v, err := copystructure.Copy(vals)
        if err != nil {
                return vals, err
        }

        valsCopy := v.(map[string]interface{})
        // if we have an empty map, make sure it is initialized
        if valsCopy == nil {
                valsCopy = make(map[string]interface{})
        }

        return valsCopy, nil
}

type printFn func(format string, v ...interface{})

// coalesce coalesces the dest values and the chart values, giving priority to the dest values.
//
// This is a helper function for CoalesceValues and MergeValues.
//
// Note, the merge argument specifies whether this is being used by MergeValues
// or CoalesceValues. Coalescing removes null values and their keys in some
// situations while merging keeps the null values.
func coalesce(printf printFn, ch *chart.Chart, dest map[string]interface{}, prefix string, merge bool) (map[string]interface{}, error) {
        coalesceValues(printf, ch, dest, prefix, merge)
        return coalesceDeps(printf, ch, dest, prefix, merge)
}

// coalesceDeps coalesces the dependencies of the given chart.
func coalesceDeps(printf printFn, chrt *chart.Chart, dest map[string]interface{}, prefix string, merge bool) (map[string]interface{}, error) {
        for _, subchart := range chrt.Dependencies() {
                if c, ok := dest[subchart.Name()]; !ok {
                        // If dest doesn't already have the key, create it.
                        dest[subchart.Name()] = make(map[string]interface{})
                } else if !istable(c) {
                        return dest, errors.Errorf("type mismatch on %s: %t", subchart.Name(), c)
                }
                if dv, ok := dest[subchart.Name()]; ok {
                        dvmap := dv.(map[string]interface{})
                        subPrefix := concatPrefix(prefix, chrt.Metadata.Name)
                        // Get globals out of dest and merge them into dvmap.
                        coalesceGlobals(printf, dvmap, dest, subPrefix, merge)
                        // Now coalesce the rest of the values.
                        var err error
                        dest[subchart.Name()], err = coalesce(printf, subchart, dvmap, subPrefix, merge)
                        if err != nil {
                                return dest, err
                        }
                }
        }
        return dest, nil
}

// coalesceGlobals copies the globals out of src and merges them into dest.
//
// For convenience, returns dest.
func coalesceGlobals(printf printFn, dest, src map[string]interface{}, prefix string, merge bool) {
        var dg, sg map[string]interface{}

        if destglob, ok := dest[GlobalKey]; !ok {
                dg = make(map[string]interface{})
        } else if dg, ok = destglob.(map[string]interface{}); !ok {
                printf("warning: skipping globals because destination %s is not a table.", GlobalKey)
                return
        }

        if srcglob, ok := src[GlobalKey]; !ok {
                sg = make(map[string]interface{})
        } else if sg, ok = srcglob.(map[string]interface{}); !ok {
                printf("warning: skipping globals because source %s is not a table.", GlobalKey)
                return
        }

        // EXPERIMENTAL: In the past, we have disallowed globals to test tables. This
        // reverses that decision. It may somehow be possible to introduce a loop
        // here, but I haven't found a way. So for the time being, let's allow
        // tables in globals.
        for key, val := range sg {
                if istable(val) {
                        vv := copyMap(val.(map[string]interface{}))
                        if destv, ok := dg[key]; !ok {
                                // Here there is no merge. We're just adding.
                                dg[key] = vv
                        } else {
                                if destvmap, ok := destv.(map[string]interface{}); !ok {
                                        printf("Conflict: cannot merge map onto non-map for %q. Skipping.", key)
                                } else {
                                        // Basically, we reverse order of coalesce here to merge
                                        // top-down.
                                        subPrefix := concatPrefix(prefix, key)
                                        // In this location coalesceTablesFullKey should always have
                                        // merge set to true. The output of coalesceGlobals is run
                                        // through coalesce where any nils will be removed.
                                        coalesceTablesFullKey(printf, vv, destvmap, subPrefix, true)
                                        dg[key] = vv
                                }
                        }
                } else if dv, ok := dg[key]; ok && istable(dv) {
                        // It's not clear if this condition can actually ever trigger.
                        printf("key %s is table. Skipping", key)
                } else {
                        // TODO: Do we need to do any additional checking on the value?
                        dg[key] = val
                }
        }
        dest[GlobalKey] = dg
}

func copyMap(src map[string]interface{}) map[string]interface{} {
        m := make(map[string]interface{}, len(src))
        for k, v := range src {
                m[k] = v
        }
        return m
}

// coalesceValues builds up a values map for a particular chart.
//
// Values in v will override the values in the chart.
func coalesceValues(printf printFn, c *chart.Chart, v map[string]interface{}, prefix string, merge bool) {
        subPrefix := concatPrefix(prefix, c.Metadata.Name)

        // Using c.Values directly when coalescing a table can cause problems where
        // the original c.Values is altered. Creating a deep copy stops the problem.
        // This section is fault-tolerant as there is no ability to return an error.
        valuesCopy, err := copystructure.Copy(c.Values)
        var vc map[string]interface{}
        var ok bool
        if err != nil {
                // If there is an error something is wrong with copying c.Values it
                // means there is a problem in the deep copying package or something
                // wrong with c.Values. In this case we will use c.Values and report
                // an error.
                printf("warning: unable to copy values, err: %s", err)
                vc = c.Values
        } else {
                vc, ok = valuesCopy.(map[string]interface{})
                if !ok {
                        // c.Values has a map[string]interface{} structure. If the copy of
                        // it cannot be treated as map[string]interface{} there is something
                        // strangely wrong. Log it and use c.Values
                        printf("warning: unable to convert values copy to values type")
                        vc = c.Values
                }
        }

        for key, val := range vc {
                if value, ok := v[key]; ok {
                        if value == nil && !merge {
                                // When the YAML value is null and we are coalescing instead of
                                // merging, we remove the value's key.
                                // This allows Helm's various sources of values (value files or --set) to
                                // remove incompatible keys from any previous chart, file, or set values.
                                delete(v, key)
                        } else if dest, ok := value.(map[string]interface{}); ok {
                                // if v[key] is a table, merge nv's val table into v[key].
                                src, ok := val.(map[string]interface{})
                                if !ok {
                                        // If the original value is nil, there is nothing to coalesce, so we don't print
                                        // the warning
                                        if val != nil {
                                                printf("warning: skipped value for %s.%s: Not a table.", subPrefix, key)
                                        }
                                } else {
                                        // Because v has higher precedence than nv, dest values override src
                                        // values.
                                        coalesceTablesFullKey(printf, dest, src, concatPrefix(subPrefix, key), merge)
                                }
                        }
                } else {
                        // If the key is not in v, copy it from nv.
                        v[key] = val
                }
        }
}

// CoalesceTables merges a source map into a destination map.
//
// dest is considered authoritative.
func CoalesceTables(dst, src map[string]interface{}) map[string]interface{} {
        return coalesceTablesFullKey(log.Printf, dst, src, "", false)
}

func MergeTables(dst, src map[string]interface{}) map[string]interface{} {
        return coalesceTablesFullKey(log.Printf, dst, src, "", true)
}

// coalesceTablesFullKey merges a source map into a destination map.
//
// dest is considered authoritative.
func coalesceTablesFullKey(printf printFn, dst, src map[string]interface{}, prefix string, merge bool) map[string]interface{} {
        // When --reuse-values is set but there are no modifications yet, return new values
        if src == nil {
                return dst
        }
        if dst == nil {
                return src
        }
        // Because dest has higher precedence than src, dest values override src
        // values.
        for key, val := range src {
                fullkey := concatPrefix(prefix, key)
                if dv, ok := dst[key]; ok && !merge && dv == nil {
                        delete(dst, key)
                } else if !ok {
                        dst[key] = val
                } else if istable(val) {
                        if istable(dv) {
                                coalesceTablesFullKey(printf, dv.(map[string]interface{}), val.(map[string]interface{}), fullkey, merge)
                        } else {
                                printf("warning: cannot overwrite table with non table for %s (%v)", fullkey, val)
                        }
                } else if istable(dv) && val != nil {
                        printf("warning: destination for %s is a table. Ignoring non-table value (%v)", fullkey, val)
                }
        }
        return dst
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package chartutil

import "github.com/Masterminds/semver/v3"

// IsCompatibleRange compares a version to a constraint.
// It returns true if the version matches the constraint, and false in all other cases.
func IsCompatibleRange(constraint, ver string) bool {
        sv, err := semver.NewVersion(ver)
        if err != nil {
                return false
        }

        c, err := semver.NewConstraint(constraint)
        if err != nil {
                return false
        }
        return c.Check(sv)
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package chartutil

import (
        "fmt"
        "io"
        "os"
        "path/filepath"
        "regexp"
        "strings"

        "github.com/pkg/errors"
        "sigs.k8s.io/yaml"

        "helm.sh/helm/v3/pkg/chart"
        "helm.sh/helm/v3/pkg/chart/loader"
)

// chartName is a regular expression for testing the supplied name of a chart.
// This regular expression is probably stricter than it needs to be. We can relax it
// somewhat. Newline characters, as well as $, quotes, +, parens, and % are known to be
// problematic.
var chartName = regexp.MustCompile("^[a-zA-Z0-9._-]+$")

const (
        // ChartfileName is the default Chart file name.
        ChartfileName = "Chart.yaml"
        // ValuesfileName is the default values file name.
        ValuesfileName = "values.yaml"
        // SchemafileName is the default values schema file name.
        SchemafileName = "values.schema.json"
        // TemplatesDir is the relative directory name for templates.
        TemplatesDir = "templates"
        // ChartsDir is the relative directory name for charts dependencies.
        ChartsDir = "charts"
        // TemplatesTestsDir is the relative directory name for tests.
        TemplatesTestsDir = TemplatesDir + sep + "tests"
        // IgnorefileName is the name of the Helm ignore file.
        IgnorefileName = ".helmignore"
        // IngressFileName is the name of the example ingress file.
        IngressFileName = TemplatesDir + sep + "ingress.yaml"
        // DeploymentName is the name of the example deployment file.
        DeploymentName = TemplatesDir + sep + "deployment.yaml"
        // ServiceName is the name of the example service file.
        ServiceName = TemplatesDir + sep + "service.yaml"
        // ServiceAccountName is the name of the example serviceaccount file.
        ServiceAccountName = TemplatesDir + sep + "serviceaccount.yaml"
        // HorizontalPodAutoscalerName is the name of the example hpa file.
        HorizontalPodAutoscalerName = TemplatesDir + sep + "hpa.yaml"
        // NotesName is the name of the example NOTES.txt file.
        NotesName = TemplatesDir + sep + "NOTES.txt"
        // HelpersName is the name of the example helpers file.
        HelpersName = TemplatesDir + sep + "_helpers.tpl"
        // TestConnectionName is the name of the example test file.
        TestConnectionName = TemplatesTestsDir + sep + "test-connection.yaml"
)

// maxChartNameLength is lower than the limits we know of with certain file systems,
// and with certain Kubernetes fields.
const maxChartNameLength = 250

const sep = string(filepath.Separator)

const defaultChartfile = `apiVersion: v2
name: %s
description: A Helm chart for Kubernetes

# A chart can be either an 'application' or a 'library' chart.
#
# Application charts are a collection of templates that can be packaged into versioned archives
# to be deployed.
#
# Library charts provide useful utilities or functions for the chart developer. They're included as
# a dependency of application charts to inject those utilities and functions into the rendering
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
type: application

# This is the chart version. This version number should be incremented each time you make changes
# to the chart and its templates, including the app version.
# Versions are expected to follow Semantic Versioning (https://semver.org/)
version: 0.1.0

# This is the version number of the application being deployed. This version number should be
# incremented each time you make changes to the application. Versions are not expected to
# follow Semantic Versioning. They should reflect the version the application is using.
# It is recommended to use it with quotes.
appVersion: "1.16.0"
`

const defaultValues = `# Default values for %s.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

replicaCount: 1

image:
  repository: nginx
  pullPolicy: IfNotPresent
  # Overrides the image tag whose default is the chart appVersion.
  tag: ""

imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""

serviceAccount:
  # Specifies whether a service account should be created
  create: true
  # Automatically mount a ServiceAccount's API credentials?
  automount: true
  # Annotations to add to the service account
  annotations: {}
  # The name of the service account to use.
  # If not set and create is true, a name is generated using the fullname template
  name: ""

podAnnotations: {}
podLabels: {}

podSecurityContext: {}
  # fsGroup: 2000

securityContext: {}
  # capabilities:
  #   drop:
  #   - ALL
  # readOnlyRootFilesystem: true
  # runAsNonRoot: true
  # runAsUser: 1000

service:
  type: ClusterIP
  port: 80

ingress:
  enabled: false
  className: ""
  annotations: {}
    # kubernetes.io/ingress.class: nginx
    # kubernetes.io/tls-acme: "true"
  hosts:
    - host: chart-example.local
      paths:
        - path: /
          pathType: ImplementationSpecific
  tls: []
  #  - secretName: chart-example-tls
  #    hosts:
  #      - chart-example.local

resources: {}
  # We usually recommend not to specify default resources and to leave this as a conscious
  # choice for the user. This also increases chances charts run on environments with little
  # resources, such as Minikube. If you do want to specify resources, uncomment the following
  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
  # limits:
  #   cpu: 100m
  #   memory: 128Mi
  # requests:
  #   cpu: 100m
  #   memory: 128Mi

autoscaling:
  enabled: false
  minReplicas: 1
  maxReplicas: 100
  targetCPUUtilizationPercentage: 80
  # targetMemoryUtilizationPercentage: 80

# Additional volumes on the output Deployment definition.
volumes: []
# - name: foo
#   secret:
#     secretName: mysecret
#     optional: false

# Additional volumeMounts on the output Deployment definition.
volumeMounts: []
# - name: foo
#   mountPath: "/etc/foo"
#   readOnly: true

nodeSelector: {}

tolerations: []

affinity: {}
`

const defaultIgnore = `# Patterns to ignore when building packages.
# This supports shell glob matching, relative path matching, and
# negation (prefixed with !). Only one pattern per line.
.DS_Store
# Common VCS dirs
.git/
.gitignore
.bzr/
.bzrignore
.hg/
.hgignore
.svn/
# Common backup files
*.swp
*.bak
*.tmp
*.orig
*~
# Various IDEs
.project
.idea/
*.tmproj
.vscode/
`

const defaultIngress = `{{- if .Values.ingress.enabled -}}
{{- $fullName := include "<CHARTNAME>.fullname" . -}}
{{- $svcPort := .Values.service.port -}}
{{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
  {{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }}
  {{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}}
  {{- end }}
{{- end }}
{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}}
apiVersion: networking.k8s.io/v1
{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
apiVersion: networking.k8s.io/v1beta1
{{- else -}}
apiVersion: extensions/v1beta1
{{- end }}
kind: Ingress
metadata:
  name: {{ $fullName }}
  labels:
    {{- include "<CHARTNAME>.labels" . | nindent 4 }}
  {{- with .Values.ingress.annotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
spec:
  {{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }}
  ingressClassName: {{ .Values.ingress.className }}
  {{- end }}
  {{- if .Values.ingress.tls }}
  tls:
    {{- range .Values.ingress.tls }}
    - hosts:
        {{- range .hosts }}
        - {{ . | quote }}
        {{- end }}
      secretName: {{ .secretName }}
    {{- end }}
  {{- end }}
  rules:
    {{- range .Values.ingress.hosts }}
    - host: {{ .host | quote }}
      http:
        paths:
          {{- range .paths }}
          - path: {{ .path }}
            {{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }}
            pathType: {{ .pathType }}
            {{- end }}
            backend:
              {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
              service:
                name: {{ $fullName }}
                port:
                  number: {{ $svcPort }}
              {{- else }}
              serviceName: {{ $fullName }}
              servicePort: {{ $svcPort }}
              {{- end }}
          {{- end }}
    {{- end }}
{{- end }}
`

const defaultDeployment = `apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "<CHARTNAME>.fullname" . }}
  labels:
    {{- include "<CHARTNAME>.labels" . | nindent 4 }}
spec:
  {{- if not .Values.autoscaling.enabled }}
  replicas: {{ .Values.replicaCount }}
  {{- end }}
  selector:
    matchLabels:
      {{- include "<CHARTNAME>.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      {{- with .Values.podAnnotations }}
      annotations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      labels:
        {{- include "<CHARTNAME>.labels" . | nindent 8 }}
        {{- with .Values.podLabels }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
    spec:
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      serviceAccountName: {{ include "<CHARTNAME>.serviceAccountName" . }}
      securityContext:
        {{- toYaml .Values.podSecurityContext | nindent 8 }}
      containers:
        - name: {{ .Chart.Name }}
          securityContext:
            {{- toYaml .Values.securityContext | nindent 12 }}
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          ports:
            - name: http
              containerPort: {{ .Values.service.port }}
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /
              port: http
          readinessProbe:
            httpGet:
              path: /
              port: http
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
          {{- with .Values.volumeMounts }}
          volumeMounts:
            {{- toYaml . | nindent 12 }}
          {{- end }}
      {{- with .Values.volumes }}
      volumes:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
`

const defaultService = `apiVersion: v1
kind: Service
metadata:
  name: {{ include "<CHARTNAME>.fullname" . }}
  labels:
    {{- include "<CHARTNAME>.labels" . | nindent 4 }}
spec:
  type: {{ .Values.service.type }}
  ports:
    - port: {{ .Values.service.port }}
      targetPort: http
      protocol: TCP
      name: http
  selector:
    {{- include "<CHARTNAME>.selectorLabels" . | nindent 4 }}
`

const defaultServiceAccount = `{{- if .Values.serviceAccount.create -}}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ include "<CHARTNAME>.serviceAccountName" . }}
  labels:
    {{- include "<CHARTNAME>.labels" . | nindent 4 }}
  {{- with .Values.serviceAccount.annotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
automountServiceAccountToken: {{ .Values.serviceAccount.automount }}
{{- end }}
`

const defaultHorizontalPodAutoscaler = `{{- if .Values.autoscaling.enabled }}
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: {{ include "<CHARTNAME>.fullname" . }}
  labels:
    {{- include "<CHARTNAME>.labels" . | nindent 4 }}
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: {{ include "<CHARTNAME>.fullname" . }}
  minReplicas: {{ .Values.autoscaling.minReplicas }}
  maxReplicas: {{ .Values.autoscaling.maxReplicas }}
  metrics:
    {{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
    {{- end }}
    {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
    - type: Resource
      resource:
        name: memory
        target:
          type: Utilization
          averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
    {{- end }}
{{- end }}
`

const defaultNotes = `1. Get the application URL by running these commands:
{{- if .Values.ingress.enabled }}
{{- range $host := .Values.ingress.hosts }}
  {{- range .paths }}
  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
  {{- end }}
{{- end }}
{{- else if contains "NodePort" .Values.service.type }}
  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "<CHARTNAME>.fullname" . }})
  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
  echo http://$NODE_IP:$NODE_PORT
{{- else if contains "LoadBalancer" .Values.service.type }}
     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "<CHARTNAME>.fullname" . }}'
  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "<CHARTNAME>.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
  echo http://$SERVICE_IP:{{ .Values.service.port }}
{{- else if contains "ClusterIP" .Values.service.type }}
  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "<CHARTNAME>.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
  echo "Visit http://127.0.0.1:8080 to use your application"
  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
{{- end }}
`

const defaultHelpers = `{{/*
Expand the name of the chart.
*/}}
{{- define "<CHARTNAME>.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
{{- end }}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "<CHARTNAME>.fullname" -}}
{{- if .Values.fullnameOverride }}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- $name := default .Chart.Name .Values.nameOverride }}
{{- if contains $name .Release.Name }}
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}
{{- end }}

{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "<CHARTNAME>.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
{{- end }}

{{/*
Common labels
*/}}
{{- define "<CHARTNAME>.labels" -}}
helm.sh/chart: {{ include "<CHARTNAME>.chart" . }}
{{ include "<CHARTNAME>.selectorLabels" . }}
{{- if .Chart.AppVersion }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- end }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- end }}

{{/*
Selector labels
*/}}
{{- define "<CHARTNAME>.selectorLabels" -}}
app.kubernetes.io/name: {{ include "<CHARTNAME>.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }}

{{/*
Create the name of the service account to use
*/}}
{{- define "<CHARTNAME>.serviceAccountName" -}}
{{- if .Values.serviceAccount.create }}
{{- default (include "<CHARTNAME>.fullname" .) .Values.serviceAccount.name }}
{{- else }}
{{- default "default" .Values.serviceAccount.name }}
{{- end }}
{{- end }}
`

const defaultTestConnection = `apiVersion: v1
kind: Pod
metadata:
  name: "{{ include "<CHARTNAME>.fullname" . }}-test-connection"
  labels:
    {{- include "<CHARTNAME>.labels" . | nindent 4 }}
  annotations:
    "helm.sh/hook": test
spec:
  containers:
    - name: wget
      image: busybox
      command: ['wget']
      args: ['{{ include "<CHARTNAME>.fullname" . }}:{{ .Values.service.port }}']
  restartPolicy: Never
`

// Stderr is an io.Writer to which error messages can be written
//
// In Helm 4, this will be replaced. It is needed in Helm 3 to preserve API backward
// compatibility.
var Stderr io.Writer = os.Stderr

// CreateFrom creates a new chart, but scaffolds it from the src chart.
func CreateFrom(chartfile *chart.Metadata, dest, src string) error {
        schart, err := loader.Load(src)
        if err != nil {
                return errors.Wrapf(err, "could not load %s", src)
        }

        schart.Metadata = chartfile

        var updatedTemplates []*chart.File

        for _, template := range schart.Templates {
                newData := transform(string(template.Data), schart.Name())
                updatedTemplates = append(updatedTemplates, &chart.File{Name: template.Name, Data: newData})
        }

        schart.Templates = updatedTemplates
        b, err := yaml.Marshal(schart.Values)
        if err != nil {
                return errors.Wrap(err, "reading values file")
        }

        var m map[string]interface{}
        if err := yaml.Unmarshal(transform(string(b), schart.Name()), &m); err != nil {
                return errors.Wrap(err, "transforming values file")
        }
        schart.Values = m

        // SaveDir looks for the file values.yaml when saving rather than the values
        // key in order to preserve the comments in the YAML. The name placeholder
        // needs to be replaced on that file.
        for _, f := range schart.Raw {
                if f.Name == ValuesfileName {
                        f.Data = transform(string(f.Data), schart.Name())
                }
        }

        return SaveDir(schart, dest)
}

// Create creates a new chart in a directory.
//
// Inside of dir, this will create a directory based on the name of
// chartfile.Name. It will then write the Chart.yaml into this directory and
// create the (empty) appropriate directories.
//
// The returned string will point to the newly created directory. It will be
// an absolute path, even if the provided base directory was relative.
//
// If dir does not exist, this will return an error.
// If Chart.yaml or any directories cannot be created, this will return an
// error. In such a case, this will attempt to clean up by removing the
// new chart directory.
func Create(name, dir string) (string, error) {

        // Sanity-check the name of a chart so user doesn't create one that causes problems.
        if err := validateChartName(name); err != nil {
                return "", err
        }

        path, err := filepath.Abs(dir)
        if err != nil {
                return path, err
        }

        if fi, err := os.Stat(path); err != nil {
                return path, err
        } else if !fi.IsDir() {
                return path, errors.Errorf("no such directory %s", path)
        }

        cdir := filepath.Join(path, name)
        if fi, err := os.Stat(cdir); err == nil && !fi.IsDir() {
                return cdir, errors.Errorf("file %s already exists and is not a directory", cdir)
        }

        files := []struct {
                path    string
                content []byte
        }{
                {
                        // Chart.yaml
                        path:    filepath.Join(cdir, ChartfileName),
                        content: []byte(fmt.Sprintf(defaultChartfile, name)),
                },
                {
                        // values.yaml
                        path:    filepath.Join(cdir, ValuesfileName),
                        content: []byte(fmt.Sprintf(defaultValues, name)),
                },
                {
                        // .helmignore
                        path:    filepath.Join(cdir, IgnorefileName),
                        content: []byte(defaultIgnore),
                },
                {
                        // ingress.yaml
                        path:    filepath.Join(cdir, IngressFileName),
                        content: transform(defaultIngress, name),
                },
                {
                        // deployment.yaml
                        path:    filepath.Join(cdir, DeploymentName),
                        content: transform(defaultDeployment, name),
                },
                {
                        // service.yaml
                        path:    filepath.Join(cdir, ServiceName),
                        content: transform(defaultService, name),
                },
                {
                        // serviceaccount.yaml
                        path:    filepath.Join(cdir, ServiceAccountName),
                        content: transform(defaultServiceAccount, name),
                },
                {
                        // hpa.yaml
                        path:    filepath.Join(cdir, HorizontalPodAutoscalerName),
                        content: transform(defaultHorizontalPodAutoscaler, name),
                },
                {
                        // NOTES.txt
                        path:    filepath.Join(cdir, NotesName),
                        content: transform(defaultNotes, name),
                },
                {
                        // _helpers.tpl
                        path:    filepath.Join(cdir, HelpersName),
                        content: transform(defaultHelpers, name),
                },
                {
                        // test-connection.yaml
                        path:    filepath.Join(cdir, TestConnectionName),
                        content: transform(defaultTestConnection, name),
                },
        }

        for _, file := range files {
                if _, err := os.Stat(file.path); err == nil {
                        // There is no handle to a preferred output stream here.
                        fmt.Fprintf(Stderr, "WARNING: File %q already exists. Overwriting.\n", file.path)
                }
                if err := writeFile(file.path, file.content); err != nil {
                        return cdir, err
                }
        }
        // Need to add the ChartsDir explicitly as it does not contain any file OOTB
        if err := os.MkdirAll(filepath.Join(cdir, ChartsDir), 0755); err != nil {
                return cdir, err
        }
        return cdir, nil
}

// transform performs a string replacement of the specified source for
// a given key with the replacement string
func transform(src, replacement string) []byte {
        return []byte(strings.ReplaceAll(src, "<CHARTNAME>", replacement))
}

func writeFile(name string, content []byte) error {
        if err := os.MkdirAll(filepath.Dir(name), 0755); err != nil {
                return err
        }
        return os.WriteFile(name, content, 0644)
}

func validateChartName(name string) error {
        if name == "" || len(name) > maxChartNameLength {
                return fmt.Errorf("chart name must be between 1 and %d characters", maxChartNameLength)
        }
        if !chartName.MatchString(name) {
                return fmt.Errorf("chart name must match the regular expression %q", chartName.String())
        }
        return nil
}

/*
Copyright The Helm Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package chartutil

import (
        "log"
        "strings"

        "github.com/mitchellh/copystructure"

        "helm.sh/helm/v3/pkg/chart"
)

// ProcessDependencies checks through this chart's dependencies, processing accordingly.
//
// TODO: For Helm v4 this can be combined with or turned into ProcessDependenciesWithMerge
func ProcessDependencies(c *chart.Chart, v Values) error {
        if err := processDependencyEnabled(c, v, ""); err != nil {
                return err
        }
        return processDependencyImportValues(c, false)
}

// ProcessDependenciesWithMerge checks through this chart's dependencies, processing accordingly.
// It is similar to ProcessDependencies but it does not remove nil values during
// the import/export handling process.
func ProcessDependenciesWithMerge(c *chart.Chart, v Values) error {
        if err := processDependencyEnabled(c, v, ""); err != nil {
                return err
        }
        return processDependencyImportValues(c, true)
}

// processDependencyConditions disables charts based on condition path value in values
func processDependencyConditions(reqs []*chart.Dependency, cvals Values, cpath string) {
        if reqs == nil {
                return
        }
        for _, r := range reqs {
                for _, c := range strings.Split(strings.TrimSpace(r.Condition), ",") {
                        if len(c) > 0 {
                                // retrieve value
                                vv, err := cvals.PathValue(cpath + c)
                                if err == nil {
                                        // if not bool, warn
                                        if bv, ok := vv.(bool); ok {
                                                r.Enabled = bv
                                                break
                                        } else {
                                                log.Printf("Warning: Condition path '%s' for chart %s returned non-bool value", c, r.Name)
                                        }
                                } else if _, ok := err.(ErrNoValue); !ok {
                                        // this is a real error
                                        log.Printf("Warning: PathValue returned error %v", err)
                                }
                        }
                }
        }
}

// processDependencyTags disables charts based on tags in values
func processDependencyTags(reqs []*chart.Dependency, cvals Values) {
        if reqs == nil {
                return
        }
        vt, err := cvals.Table("tags")
        if err != nil {
                return
        }
        for _, r := range reqs {
                var hasTrue, hasFalse bool
                for _, k := range r.Tags {
                        if b, ok := vt[k]; ok {
                                // if not bool, warn
                                if bv, ok := b.(bool); ok {
                                        if bv {
                                                hasTrue = true
                                        } else {
                                                hasFalse = true
                                        }
                                } else {
                                        log.Printf("Warning: Tag '%s' for chart %s returned non-bool value", k, r.Name)
                                }
                        }
                }
                if !hasTrue && hasFalse {
                        r.Enabled = false
                } else if hasTrue || !hasTrue && !hasFalse {
                        r.Enabled = true
                }
        }
}

func getAliasDependency(charts []*chart.Chart, dep *chart.Dependency) *chart.Chart {
        for _, c := range charts {
                if c == nil {
                        continue
                }
                if c.Name() != dep.Name {
                        continue
                }
                if !IsCompatibleRange(dep.Version, c.Metadata.Version) {
                        continue
                }

                out := *c
                md := *c.Metadata
                out.Metadata = &md

                if dep.Alias != "" {
                        md.Name = dep.Alias
                }
                return &out
        }
        return nil
}

// processDependencyEnabled removes disabled charts from dependencies
func processDependencyEnabled(c *chart.Chart, v map[string]interface{}, path string) error {
        if c.Metadata.Dependencies == nil {
                return nil
        }

        var chartDependencies []*chart.Chart
        // If any dependency is not a part of Chart.yaml
        // then this should be added to chartDependencies.
        // However, if the dependency is already specified in Chart.yaml
        // we should not add it, as it would be anyways processed from Chart.yaml

Loop:
        for _, existing := range c.Dependencies() {
                for _, req := range c.Metadata.Dependencies {
                        if existing.Name() == req.Name && IsCompatibleRange(req.Version, existing.Metadata.Version) {
                                continue Loop
                        }
                }
                chartDependencies = append(chartDependencies, existing)
        }

        for _, req := range c.Metadata.Dependencies {
                if req == nil {
                        continue
                }
                if chartDependency := getAliasDependency(c.Dependencies(), req); chartDependency != nil {
                        chartDependencies = append(chartDependencies, chartDependency)
                }
                if req.Alias != "" {
                        req.Name = req.Alias
                }
        }
        c.SetDependencies(chartDependencies...)

        // set all to true
        for _, lr := range c.Metadata.Dependencies {
                lr.Enabled = true
        }
        cvals, err := CoalesceValues(c, v)
        if err != nil {
                return err
        }
        // flag dependencies as enabled/disabled
        processDependencyTags(c.Metadata.Dependencies, cvals)
        processDependencyConditions(c.Metadata.Dependencies, cvals, path)
        // make a map of charts to remove
        rm := map[string]struct{}{}
        for _, r := range c.Metadata.Dependencies {
                if !r.Enabled {
                        // remove disabled chart
                        rm[r.Name] = struct{}{}
                }
        }
        // don't keep disabled charts in new slice
        cd := []*chart.Chart{}
        copy(cd, c.Dependencies()[:0])
        for _, n := range c.Dependencies() {
                if _, ok := rm[n.Metadata.Name]; !ok {
                        cd = append(cd, n)
                }
        }
        // don't keep disabled charts in metadata
        cdMetadata := []*chart.Dependency{}
        copy(cdMetadata, c.Metadata.Dependencies[:0])
        for _, n := range c.Metadata.Dependencies {
                if _, ok := rm[n.Name]; !ok {
                        cdMetadata = append(cdMetadata, n)
                }
        }

        // recursively call self to process sub dependencies
        for _, t := range cd {
                subpath := path + t.Metadata.Name + "."
                if err := processDependencyEnabled(t, cvals, subpath); err != nil {
                        return err
                }
        }
        // set the correct dependencies in metadata
        c.Metadata.Dependencies = nil
        c.Metadata.Dependencies = append(c.Metadata.Dependencies, cdMetadata...)
        c.SetDependencies(cd...)

        return nil
}

// pathToMap creates a nested map given a YAML path in dot notation.
func pathToMap(path string, data map[string]interface{}) map[string]interface{} {
        if path == "." {
                return data
        }
        return set(parsePath(path), data)
}

func set(path []string, data map[string]interface{}) map[string]interface{} {
        if len(path) == 0 {
                return nil
        }
        cur := data
        for i := len(path) - 1; i >= 0; i-- {
                cur = map[string]interface{}{path[i]: cur}
        }
        return cur
}

// processImportValues merges values from child to parent based on the chart's dependencies' ImportValues field.
func processImportValues(c *chart.Chart, merge bool) error {
        if c.Metadata.Dependencies == nil {
                return nil
        }
        // combine chart values and empty config to get Values
        var cvals Values
        var err error
        if merge {
                cvals, err = MergeValues(c, nil)
        } else {
                cvals, err = CoalesceValues(c, nil)
        }
        if err != nil {
                return err
        }
        b := make(map[string]interface{})
        // import values from each dependency if specified in import-values
        for _, r := range c.Metadata.Dependencies {
                var outiv []interface{}
                for _, riv := range r.ImportValues {
                        switch iv := riv.(type) {
                        case map[string]interface{}:
                                child := iv["child"].(string)
                                parent := iv["parent"].(string)

                                outiv = append(outiv, map[string]string{
                                        "child":  child,
                                        "parent": parent,
                                })

                                // get child table
                                vv, err := cvals.Table(r.Name + "." + child)
                                if err != nil {
                                        log.Printf("Warning: ImportValues missing table from chart %s: %v", r.Name, err)
                                        continue
                                }
                                // create value map from child to be merged into parent
                                if merge {
                                        b = MergeTables(b, pathToMap(parent, vv.AsMap()))
                                } else {
                                        b = CoalesceTables(b, pathToMap(parent, vv.AsMap()))
                                }
                        case string:
                                child := "exports." + iv
                                outiv = append(outiv, map[string]string{
                                        "child":  child,
                                        "parent": ".",
                                })
                                vm, err := cvals.Table(r.Name + "." + child)
                                if err != nil {
                                        log.Printf("Warning: ImportValues missing table: %v", err)
                                        continue
                                }
                                if merge {
                                        b = MergeTables(b, vm.AsMap())
                                } else {
                                        b = CoalesceTables(b, vm.AsMap())
                                }
                        }
                }
                r.ImportValues = outiv
        }

        // Imported values from a child to a parent chart have a lower priority than
        // the parents values. This enables parent charts to import a large section
        // from a child and then override select parts. This is why b is merged into
        // cvals in the code below and not the other way around.
        if merge {
                // deep copying the cvals as there are cases where pointers can end
                // up in the cvals when they are copied onto b in ways that break things.
                cvals = deepCopyMap(cvals)
                c.Values = MergeTables(cvals, b)
        } else {
                // Trimming the nil values from cvals is needed for backwards compatibility.
                // Previously, the b value had been populated with cvals along with some
                // overrides. This caused the coalescing functionality to remove the
                // nil/null values. This trimming is for backwards compat.
                cvals = trimNilValues(cvals)
                c.Values = CoalesceTables(cvals, b)
        }

        return nil
}

func deepCopyMap(vals map[string]interface{}) map[string]interface{} {
        valsCopy, err := copystructure.Copy(vals)
        if err != nil {
                return vals
        }
        return valsCopy.(map[string]interface{})
}

func trimNilValues(vals map[string]interface{}) map[string]interface{} {
        valsCopy, err := copystructure.Copy(vals)
        if err != nil {
                return vals
        }
        valsCopyMap := valsCopy.(map[string]interface{})
        for key, val := range valsCopyMap {
                if val == nil {
                        // Iterate over the values and remove nil keys
                        delete(valsCopyMap, key)
                } else if istable(val) {
                        // Recursively call into ourselves to remove keys from inner tables
                        valsCopyMap[key] = trimNilValues(val.(map[string]interface{}))
                }
        }

        return valsCopyMap
}

// processDependencyImportValues imports specified chart values from child to parent.
func processDependencyImportValues(c *chart.Chart, merge bool) error {
        for _, d := range c.Dependencies() {
                // recurse
                if err := processDependencyImportValues(d, merge); err != nil {
                        return err
                }
        }
        return processImportValues(c, merge)
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package chartutil

import (
        "fmt"
)

// ErrNoTable indicates that a chart does not have a matching table.
type ErrNoTable struct {
        Key string
}

func (e ErrNoTable) Error() string { return fmt.Sprintf("%q is not a table", e.Key) }

// ErrNoValue indicates that Values does not contain a key with a value
type ErrNoValue struct {
        Key string
}

func (e ErrNoValue) Error() string { return fmt.Sprintf("%q is not a value", e.Key) }

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package chartutil

import (
        "io"
        "os"
        "path/filepath"

        securejoin "github.com/cyphar/filepath-securejoin"
        "github.com/pkg/errors"
        "sigs.k8s.io/yaml"

        "helm.sh/helm/v3/pkg/chart"
        "helm.sh/helm/v3/pkg/chart/loader"
)

// Expand uncompresses and extracts a chart into the specified directory.
func Expand(dir string, r io.Reader) error {
        files, err := loader.LoadArchiveFiles(r)
        if err != nil {
                return err
        }

        // Get the name of the chart
        var chartName string
        for _, file := range files {
                if file.Name == "Chart.yaml" {
                        ch := &chart.Metadata{}
                        if err := yaml.Unmarshal(file.Data, ch); err != nil {
                                return errors.Wrap(err, "cannot load Chart.yaml")
                        }
                        chartName = ch.Name
                }
        }
        if chartName == "" {
                return errors.New("chart name not specified")
        }

        // Find the base directory
        chartdir, err := securejoin.SecureJoin(dir, chartName)
        if err != nil {
                return err
        }

        // Copy all files verbatim. We don't parse these files because parsing can remove
        // comments.
        for _, file := range files {
                outpath, err := securejoin.SecureJoin(chartdir, file.Name)
                if err != nil {
                        return err
                }

                // Make sure the necessary subdirs get created.
                basedir := filepath.Dir(outpath)
                if err := os.MkdirAll(basedir, 0755); err != nil {
                        return err
                }

                if err := os.WriteFile(outpath, file.Data, 0644); err != nil {
                        return err
                }
        }

        return nil
}

// ExpandFile expands the src file into the dest directory.
func ExpandFile(dest, src string) error {
        h, err := os.Open(src)
        if err != nil {
                return err
        }
        defer h.Close()
        return Expand(dest, h)
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package chartutil

import (
        "bytes"
        "fmt"
        "strings"

        "github.com/pkg/errors"
        "github.com/xeipuuv/gojsonschema"
        "sigs.k8s.io/yaml"

        "helm.sh/helm/v3/pkg/chart"
)

// ValidateAgainstSchema checks that values does not violate the structure laid out in schema
func ValidateAgainstSchema(chrt *chart.Chart, values map[string]interface{}) error {
        var sb strings.Builder
        if chrt.Schema != nil {
                err := ValidateAgainstSingleSchema(values, chrt.Schema)
                if err != nil {
                        sb.WriteString(fmt.Sprintf("%s:\n", chrt.Name()))
                        sb.WriteString(err.Error())
                }
        }

        // For each dependency, recursively call this function with the coalesced values
        for _, subchart := range chrt.Dependencies() {
                subchartValues := values[subchart.Name()].(map[string]interface{})
                if err := ValidateAgainstSchema(subchart, subchartValues); err != nil {
                        sb.WriteString(err.Error())
                }
        }

        if sb.Len() > 0 {
                return errors.New(sb.String())
        }

        return nil
}

// ValidateAgainstSingleSchema checks that values does not violate the structure laid out in this schema
func ValidateAgainstSingleSchema(values Values, schemaJSON []byte) (reterr error) {
        defer func() {
                if r := recover(); r != nil {
                        reterr = fmt.Errorf("unable to validate schema: %s", r)
                }
        }()

        valuesData, err := yaml.Marshal(values)
        if err != nil {
                return err
        }
        valuesJSON, err := yaml.YAMLToJSON(valuesData)
        if err != nil {
                return err
        }
        if bytes.Equal(valuesJSON, []byte("null")) {
                valuesJSON = []byte("{}")
        }
        schemaLoader := gojsonschema.NewBytesLoader(schemaJSON)
        valuesLoader := gojsonschema.NewBytesLoader(valuesJSON)

        result, err := gojsonschema.Validate(schemaLoader, valuesLoader)
        if err != nil {
                return err
        }

        if !result.Valid() {
                var sb strings.Builder
                for _, desc := range result.Errors() {
                        sb.WriteString(fmt.Sprintf("- %s\n", desc))
                }
                return errors.New(sb.String())
        }

        return nil
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package chartutil

import (
        "archive/tar"
        "compress/gzip"
        "encoding/json"
        "fmt"
        "os"
        "path/filepath"
        "time"

        "github.com/pkg/errors"
        "sigs.k8s.io/yaml"

        "helm.sh/helm/v3/pkg/chart"
)

var headerBytes = []byte("+aHR0cHM6Ly95b3V0dS5iZS96OVV6MWljandyTQo=")

// SaveDir saves a chart as files in a directory.
//
// This takes the chart name, and creates a new subdirectory inside of the given dest
// directory, writing the chart's contents to that subdirectory.
func SaveDir(c *chart.Chart, dest string) error {
        // Create the chart directory
        outdir := filepath.Join(dest, c.Name())
        if fi, err := os.Stat(outdir); err == nil && !fi.IsDir() {
                return errors.Errorf("file %s already exists and is not a directory", outdir)
        }
        if err := os.MkdirAll(outdir, 0755); err != nil {
                return err
        }

        // Save the chart file.
        if err := SaveChartfile(filepath.Join(outdir, ChartfileName), c.Metadata); err != nil {
                return err
        }

        // Save values.yaml
        for _, f := range c.Raw {
                if f.Name == ValuesfileName {
                        vf := filepath.Join(outdir, ValuesfileName)
                        if err := writeFile(vf, f.Data); err != nil {
                                return err
                        }
                }
        }

        // Save values.schema.json if it exists
        if c.Schema != nil {
                filename := filepath.Join(outdir, SchemafileName)
                if err := writeFile(filename, c.Schema); err != nil {
                        return err
                }
        }

        // Save templates and files
        for _, o := range [][]*chart.File{c.Templates, c.Files} {
                for _, f := range o {
                        n := filepath.Join(outdir, f.Name)
                        if err := writeFile(n, f.Data); err != nil {
                                return err
                        }
                }
        }

        // Save dependencies
        base := filepath.Join(outdir, ChartsDir)
        for _, dep := range c.Dependencies() {
                // Here, we write each dependency as a tar file.
                if _, err := Save(dep, base); err != nil {
                        return errors.Wrapf(err, "saving %s", dep.ChartFullPath())
                }
        }
        return nil
}

// Save creates an archived chart to the given directory.
//
// This takes an existing chart and a destination directory.
//
// If the directory is /foo, and the chart is named bar, with version 1.0.0, this
// will generate /foo/bar-1.0.0.tgz.
//
// This returns the absolute path to the chart archive file.
func Save(c *chart.Chart, outDir string) (string, error) {
        if err := c.Validate(); err != nil {
                return "", errors.Wrap(err, "chart validation")
        }

        filename := fmt.Sprintf("%s-%s.tgz", c.Name(), c.Metadata.Version)
        filename = filepath.Join(outDir, filename)
        dir := filepath.Dir(filename)
        if stat, err := os.Stat(dir); err != nil {
                if os.IsNotExist(err) {
                        if err2 := os.MkdirAll(dir, 0755); err2 != nil {
                                return "", err2
                        }
                } else {
                        return "", errors.Wrapf(err, "stat %s", dir)
                }
        } else if !stat.IsDir() {
                return "", errors.Errorf("is not a directory: %s", dir)
        }

        f, err := os.Create(filename)
        if err != nil {
                return "", err
        }

        // Wrap in gzip writer
        zipper := gzip.NewWriter(f)
        zipper.Header.Extra = headerBytes
        zipper.Header.Comment = "Helm"

        // Wrap in tar writer
        twriter := tar.NewWriter(zipper)
        rollback := false
        defer func() {
                twriter.Close()
                zipper.Close()
                f.Close()
                if rollback {
                        os.Remove(filename)
                }
        }()

        if err := writeTarContents(twriter, c, ""); err != nil {
                rollback = true
                return filename, err
        }
        return filename, nil
}

func writeTarContents(out *tar.Writer, c *chart.Chart, prefix string) error {
        base := filepath.Join(prefix, c.Name())

        // Pull out the dependencies of a v1 Chart, since there's no way
        // to tell the serializer to skip a field for just this use case
        savedDependencies := c.Metadata.Dependencies
        if c.Metadata.APIVersion == chart.APIVersionV1 {
                c.Metadata.Dependencies = nil
        }
        // Save Chart.yaml
        cdata, err := yaml.Marshal(c.Metadata)
        if c.Metadata.APIVersion == chart.APIVersionV1 {
                c.Metadata.Dependencies = savedDependencies
        }
        if err != nil {
                return err
        }
        if err := writeToTar(out, filepath.Join(base, ChartfileName), cdata); err != nil {
                return err
        }

        // Save Chart.lock
        // TODO: remove the APIVersion check when APIVersionV1 is not used anymore
        if c.Metadata.APIVersion == chart.APIVersionV2 {
                if c.Lock != nil {
                        ldata, err := yaml.Marshal(c.Lock)
                        if err != nil {
                                return err
                        }
                        if err := writeToTar(out, filepath.Join(base, "Chart.lock"), ldata); err != nil {
                                return err
                        }
                }
        }

        // Save values.yaml
        for _, f := range c.Raw {
                if f.Name == ValuesfileName {
                        if err := writeToTar(out, filepath.Join(base, ValuesfileName), f.Data); err != nil {
                                return err
                        }
                }
        }

        // Save values.schema.json if it exists
        if c.Schema != nil {
                if !json.Valid(c.Schema) {
                        return errors.New("Invalid JSON in " + SchemafileName)
                }
                if err := writeToTar(out, filepath.Join(base, SchemafileName), c.Schema); err != nil {
                        return err
                }
        }

        // Save templates
        for _, f := range c.Templates {
                n := filepath.Join(base, f.Name)
                if err := writeToTar(out, n, f.Data); err != nil {
                        return err
                }
        }

        // Save files
        for _, f := range c.Files {
                n := filepath.Join(base, f.Name)
                if err := writeToTar(out, n, f.Data); err != nil {
                        return err
                }
        }

        // Save dependencies
        for _, dep := range c.Dependencies() {
                if err := writeTarContents(out, dep, filepath.Join(base, ChartsDir)); err != nil {
                        return err
                }
        }
        return nil
}

// writeToTar writes a single file to a tar archive.
func writeToTar(out *tar.Writer, name string, body []byte) error {
        // TODO: Do we need to create dummy parent directory names if none exist?
        h := &tar.Header{
                Name:    filepath.ToSlash(name),
                Mode:    0644,
                Size:    int64(len(body)),
                ModTime: time.Now(),
        }
        if err := out.WriteHeader(h); err != nil {
                return err
        }
        _, err := out.Write(body)
        return err
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package chartutil

import (
        "fmt"
        "regexp"

        "github.com/pkg/errors"
)

// validName is a regular expression for resource names.
//
// According to the Kubernetes help text, the regular expression it uses is:
//
//        [a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*
//
// This follows the above regular expression (but requires a full string match, not partial).
//
// The Kubernetes documentation is here, though it is not entirely correct:
// https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
var validName = regexp.MustCompile(`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`)

var (
        // errMissingName indicates that a release (name) was not provided.
        errMissingName = errors.New("no name provided")

        // errInvalidName indicates that an invalid release name was provided
        errInvalidName = fmt.Errorf(
                "invalid release name, must match regex %s and the length must not be longer than 53",
                validName.String())

        // errInvalidKubernetesName indicates that the name does not meet the Kubernetes
        // restrictions on metadata names.
        errInvalidKubernetesName = fmt.Errorf(
                "invalid metadata name, must match regex %s and the length must not be longer than 253",
                validName.String())
)

const (
        // According to the Kubernetes docs (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#rfc-1035-label-names)
        // some resource names have a max length of 63 characters while others have a max
        // length of 253 characters. As we cannot be sure the resources used in a chart, we
        // therefore need to limit it to 63 chars and reserve 10 chars for additional part to name
        // of the resource. The reason is that chart maintainers can use release name as part of
        // the resource name (and some additional chars).
        maxReleaseNameLen = 53
        // maxMetadataNameLen is the maximum length Kubernetes allows for any name.
        maxMetadataNameLen = 253
)

// ValidateReleaseName performs checks for an entry for a Helm release name
//
// For Helm to allow a name, it must be below a certain character count (53) and also match
// a regular expression.
//
// According to the Kubernetes help text, the regular expression it uses is:
//
//        [a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*
//
// This follows the above regular expression (but requires a full string match, not partial).
//
// The Kubernetes documentation is here, though it is not entirely correct:
// https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
func ValidateReleaseName(name string) error {
        // This case is preserved for backwards compatibility
        if name == "" {
                return errMissingName

        }
        if len(name) > maxReleaseNameLen || !validName.MatchString(name) {
                return errInvalidName
        }
        return nil
}

// ValidateMetadataName validates the name field of a Kubernetes metadata object.
//
// Empty strings, strings longer than 253 chars, or strings that don't match the regexp
// will fail.
//
// According to the Kubernetes help text, the regular expression it uses is:
//
//        [a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*
//
// This follows the above regular expression (but requires a full string match, not partial).
//
// The Kubernetes documentation is here, though it is not entirely correct:
// https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
//
// Deprecated: remove in Helm 4.  Name validation now uses rules defined in
// pkg/lint/rules.validateMetadataNameFunc()
func ValidateMetadataName(name string) error {
        if name == "" || len(name) > maxMetadataNameLen || !validName.MatchString(name) {
                return errInvalidKubernetesName
        }
        return nil
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package chartutil

import (
        "fmt"
        "io"
        "os"
        "strings"

        "github.com/pkg/errors"
        "sigs.k8s.io/yaml"

        "helm.sh/helm/v3/pkg/chart"
)

// GlobalKey is the name of the Values key that is used for storing global vars.
const GlobalKey = "global"

// Values represents a collection of chart values.
type Values map[string]interface{}

// YAML encodes the Values into a YAML string.
func (v Values) YAML() (string, error) {
        b, err := yaml.Marshal(v)
        return string(b), err
}

// Table gets a table (YAML subsection) from a Values object.
//
// The table is returned as a Values.
//
// Compound table names may be specified with dots:
//
//        foo.bar
//
// The above will be evaluated as "The table bar inside the table
// foo".
//
// An ErrNoTable is returned if the table does not exist.
func (v Values) Table(name string) (Values, error) {
        table := v
        var err error

        for _, n := range parsePath(name) {
                if table, err = tableLookup(table, n); err != nil {
                        break
                }
        }
        return table, err
}

// AsMap is a utility function for converting Values to a map[string]interface{}.
//
// It protects against nil map panics.
func (v Values) AsMap() map[string]interface{} {
        if len(v) == 0 {
                return map[string]interface{}{}
        }
        return v
}

// Encode writes serialized Values information to the given io.Writer.
func (v Values) Encode(w io.Writer) error {
        out, err := yaml.Marshal(v)
        if err != nil {
                return err
        }
        _, err = w.Write(out)
        return err
}

func tableLookup(v Values, simple string) (Values, error) {
        v2, ok := v[simple]
        if !ok {
                return v, ErrNoTable{simple}
        }
        if vv, ok := v2.(map[string]interface{}); ok {
                return vv, nil
        }

        // This catches a case where a value is of type Values, but doesn't (for some
        // reason) match the map[string]interface{}. This has been observed in the
        // wild, and might be a result of a nil map of type Values.
        if vv, ok := v2.(Values); ok {
                return vv, nil
        }

        return Values{}, ErrNoTable{simple}
}

// ReadValues will parse YAML byte data into a Values.
func ReadValues(data []byte) (vals Values, err error) {
        err = yaml.Unmarshal(data, &vals)
        if len(vals) == 0 {
                vals = Values{}
        }
        return vals, err
}

// ReadValuesFile will parse a YAML file into a map of values.
func ReadValuesFile(filename string) (Values, error) {
        data, err := os.ReadFile(filename)
        if err != nil {
                return map[string]interface{}{}, err
        }
        return ReadValues(data)
}

// ReleaseOptions represents the additional release options needed
// for the composition of the final values struct
type ReleaseOptions struct {
        Name      string
        Namespace string
        Revision  int
        IsUpgrade bool
        IsInstall bool
}

// ToRenderValues composes the struct from the data coming from the Releases, Charts and Values files
//
// This takes both ReleaseOptions and Capabilities to merge into the render values.
func ToRenderValues(chrt *chart.Chart, chrtVals map[string]interface{}, options ReleaseOptions, caps *Capabilities) (Values, error) {
        if caps == nil {
                caps = DefaultCapabilities
        }
        top := map[string]interface{}{
                "Chart":        chrt.Metadata,
                "Capabilities": caps,
                "Release": map[string]interface{}{
                        "Name":      options.Name,
                        "Namespace": options.Namespace,
                        "IsUpgrade": options.IsUpgrade,
                        "IsInstall": options.IsInstall,
                        "Revision":  options.Revision,
                        "Service":   "Helm",
                },
        }

        vals, err := CoalesceValues(chrt, chrtVals)
        if err != nil {
                return top, err
        }

        if err := ValidateAgainstSchema(chrt, vals); err != nil {
                errFmt := "values don't meet the specifications of the schema(s) in the following chart(s):\n%s"
                return top, fmt.Errorf(errFmt, err.Error())
        }

        top["Values"] = vals
        return top, nil
}

// istable is a special-purpose function to see if the present thing matches the definition of a YAML table.
func istable(v interface{}) bool {
        _, ok := v.(map[string]interface{})
        return ok
}

// PathValue takes a path that traverses a YAML structure and returns the value at the end of that path.
// The path starts at the root of the YAML structure and is comprised of YAML keys separated by periods.
// Given the following YAML data the value at path "chapter.one.title" is "Loomings".
//
//        chapter:
//          one:
//            title: "Loomings"
func (v Values) PathValue(path string) (interface{}, error) {
        if path == "" {
                return nil, errors.New("YAML path cannot be empty")
        }
        return v.pathValue(parsePath(path))
}

func (v Values) pathValue(path []string) (interface{}, error) {
        if len(path) == 1 {
                // if exists must be root key not table
                if _, ok := v[path[0]]; ok && !istable(v[path[0]]) {
                        return v[path[0]], nil
                }
                return nil, ErrNoValue{path[0]}
        }

        key, path := path[len(path)-1], path[:len(path)-1]
        // get our table for table path
        t, err := v.Table(joinPath(path...))
        if err != nil {
                return nil, ErrNoValue{key}
        }
        // check table for key and ensure value is not a table
        if k, ok := t[key]; ok && !istable(k) {
                return k, nil
        }
        return nil, ErrNoValue{key}
}

func parsePath(key string) []string { return strings.Split(key, ".") }

func joinPath(path ...string) string { return strings.Join(path, ".") }

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

/*
Package cli describes the operating environment for the Helm CLI.

Helm's environment encapsulates all of the service dependencies Helm has.
These dependencies are expressed as interfaces so that alternate implementations
(mocks, etc.) can be easily generated.
*/
package cli

import (
        "fmt"
        "net/http"
        "os"
        "strconv"
        "strings"

        "github.com/spf13/pflag"
        "k8s.io/cli-runtime/pkg/genericclioptions"
        "k8s.io/client-go/rest"

        "helm.sh/helm/v3/internal/version"
        "helm.sh/helm/v3/pkg/helmpath"
)

// defaultMaxHistory sets the maximum number of releases to 0: unlimited
const defaultMaxHistory = 10

// defaultBurstLimit sets the default client-side throttling limit
const defaultBurstLimit = 100

// EnvSettings describes all of the environment settings.
type EnvSettings struct {
        namespace string
        config    *genericclioptions.ConfigFlags

        // KubeConfig is the path to the kubeconfig file
        KubeConfig string
        // KubeContext is the name of the kubeconfig context.
        KubeContext string
        // Bearer KubeToken used for authentication
        KubeToken string
        // Username to impersonate for the operation
        KubeAsUser string
        // Groups to impersonate for the operation, multiple groups parsed from a comma delimited list
        KubeAsGroups []string
        // Kubernetes API Server Endpoint for authentication
        KubeAPIServer string
        // Custom certificate authority file.
        KubeCaFile string
        // KubeInsecureSkipTLSVerify indicates if server's certificate will not be checked for validity.
        // This makes the HTTPS connections insecure
        KubeInsecureSkipTLSVerify bool
        // KubeTLSServerName overrides the name to use for server certificate validation.
        // If it is not provided, the hostname used to contact the server is used
        KubeTLSServerName string
        // Debug indicates whether or not Helm is running in Debug mode.
        Debug bool
        // RegistryConfig is the path to the registry config file.
        RegistryConfig string
        // RepositoryConfig is the path to the repositories file.
        RepositoryConfig string
        // RepositoryCache is the path to the repository cache directory.
        RepositoryCache string
        // PluginsDirectory is the path to the plugins directory.
        PluginsDirectory string
        // MaxHistory is the max release history maintained.
        MaxHistory int
        // BurstLimit is the default client-side throttling limit.
        BurstLimit int
}

func New() *EnvSettings {
        env := &EnvSettings{
                namespace:                 os.Getenv("HELM_NAMESPACE"),
                MaxHistory:                envIntOr("HELM_MAX_HISTORY", defaultMaxHistory),
                KubeContext:               os.Getenv("HELM_KUBECONTEXT"),
                KubeToken:                 os.Getenv("HELM_KUBETOKEN"),
                KubeAsUser:                os.Getenv("HELM_KUBEASUSER"),
                KubeAsGroups:              envCSV("HELM_KUBEASGROUPS"),
                KubeAPIServer:             os.Getenv("HELM_KUBEAPISERVER"),
                KubeCaFile:                os.Getenv("HELM_KUBECAFILE"),
                KubeTLSServerName:         os.Getenv("HELM_KUBETLS_SERVER_NAME"),
                KubeInsecureSkipTLSVerify: envBoolOr("HELM_KUBEINSECURE_SKIP_TLS_VERIFY", false),
                PluginsDirectory:          envOr("HELM_PLUGINS", helmpath.DataPath("plugins")),
                RegistryConfig:            envOr("HELM_REGISTRY_CONFIG", helmpath.ConfigPath("registry/config.json")),
                RepositoryConfig:          envOr("HELM_REPOSITORY_CONFIG", helmpath.ConfigPath("repositories.yaml")),
                RepositoryCache:           envOr("HELM_REPOSITORY_CACHE", helmpath.CachePath("repository")),
                BurstLimit:                envIntOr("HELM_BURST_LIMIT", defaultBurstLimit),
        }
        env.Debug, _ = strconv.ParseBool(os.Getenv("HELM_DEBUG"))

        // bind to kubernetes config flags
        env.config = &genericclioptions.ConfigFlags{
                Namespace:        &env.namespace,
                Context:          &env.KubeContext,
                BearerToken:      &env.KubeToken,
                APIServer:        &env.KubeAPIServer,
                CAFile:           &env.KubeCaFile,
                KubeConfig:       &env.KubeConfig,
                Impersonate:      &env.KubeAsUser,
                Insecure:         &env.KubeInsecureSkipTLSVerify,
                TLSServerName:    &env.KubeTLSServerName,
                ImpersonateGroup: &env.KubeAsGroups,
                WrapConfigFn: func(config *rest.Config) *rest.Config {
                        config.Burst = env.BurstLimit
                        config.Wrap(func(rt http.RoundTripper) http.RoundTripper {
                                return &retryingRoundTripper{wrapped: rt}
                        })
                        config.UserAgent = version.GetUserAgent()
                        return config
                },
        }
        return env
}

// AddFlags binds flags to the given flagset.
func (s *EnvSettings) AddFlags(fs *pflag.FlagSet) {
        fs.StringVarP(&s.namespace, "namespace", "n", s.namespace, "namespace scope for this request")
        fs.StringVar(&s.KubeConfig, "kubeconfig", "", "path to the kubeconfig file")
        fs.StringVar(&s.KubeContext, "kube-context", s.KubeContext, "name of the kubeconfig context to use")
        fs.StringVar(&s.KubeToken, "kube-token", s.KubeToken, "bearer token used for authentication")
        fs.StringVar(&s.KubeAsUser, "kube-as-user", s.KubeAsUser, "username to impersonate for the operation")
        fs.StringArrayVar(&s.KubeAsGroups, "kube-as-group", s.KubeAsGroups, "group to impersonate for the operation, this flag can be repeated to specify multiple groups.")
        fs.StringVar(&s.KubeAPIServer, "kube-apiserver", s.KubeAPIServer, "the address and the port for the Kubernetes API server")
        fs.StringVar(&s.KubeCaFile, "kube-ca-file", s.KubeCaFile, "the certificate authority file for the Kubernetes API server connection")
        fs.StringVar(&s.KubeTLSServerName, "kube-tls-server-name", s.KubeTLSServerName, "server name to use for Kubernetes API server certificate validation. If it is not provided, the hostname used to contact the server is used")
        fs.BoolVar(&s.KubeInsecureSkipTLSVerify, "kube-insecure-skip-tls-verify", s.KubeInsecureSkipTLSVerify, "if true, the Kubernetes API server's certificate will not be checked for validity. This will make your HTTPS connections insecure")
        fs.BoolVar(&s.Debug, "debug", s.Debug, "enable verbose output")
        fs.StringVar(&s.RegistryConfig, "registry-config", s.RegistryConfig, "path to the registry config file")
        fs.StringVar(&s.RepositoryConfig, "repository-config", s.RepositoryConfig, "path to the file containing repository names and URLs")
        fs.StringVar(&s.RepositoryCache, "repository-cache", s.RepositoryCache, "path to the file containing cached repository indexes")
        fs.IntVar(&s.BurstLimit, "burst-limit", s.BurstLimit, "client-side default throttling limit")
}

func envOr(name, def string) string {
        if v, ok := os.LookupEnv(name); ok {
                return v
        }
        return def
}

func envBoolOr(name string, def bool) bool {
        if name == "" {
                return def
        }
        envVal := envOr(name, strconv.FormatBool(def))
        ret, err := strconv.ParseBool(envVal)
        if err != nil {
                return def
        }
        return ret
}

func envIntOr(name string, def int) int {
        if name == "" {
                return def
        }
        envVal := envOr(name, strconv.Itoa(def))
        ret, err := strconv.Atoi(envVal)
        if err != nil {
                return def
        }
        return ret
}

func envCSV(name string) (ls []string) {
        trimmed := strings.Trim(os.Getenv(name), ", ")
        if trimmed != "" {
                ls = strings.Split(trimmed, ",")
        }
        return
}

func (s *EnvSettings) EnvVars() map[string]string {
        envvars := map[string]string{
                "HELM_BIN":               os.Args[0],
                "HELM_CACHE_HOME":        helmpath.CachePath(""),
                "HELM_CONFIG_HOME":       helmpath.ConfigPath(""),
                "HELM_DATA_HOME":         helmpath.DataPath(""),
                "HELM_DEBUG":             fmt.Sprint(s.Debug),
                "HELM_PLUGINS":           s.PluginsDirectory,
                "HELM_REGISTRY_CONFIG":   s.RegistryConfig,
                "HELM_REPOSITORY_CACHE":  s.RepositoryCache,
                "HELM_REPOSITORY_CONFIG": s.RepositoryConfig,
                "HELM_NAMESPACE":         s.Namespace(),
                "HELM_MAX_HISTORY":       strconv.Itoa(s.MaxHistory),
                "HELM_BURST_LIMIT":       strconv.Itoa(s.BurstLimit),

                // broken, these are populated from helm flags and not kubeconfig.
                "HELM_KUBECONTEXT":                  s.KubeContext,
                "HELM_KUBETOKEN":                    s.KubeToken,
                "HELM_KUBEASUSER":                   s.KubeAsUser,
                "HELM_KUBEASGROUPS":                 strings.Join(s.KubeAsGroups, ","),
                "HELM_KUBEAPISERVER":                s.KubeAPIServer,
                "HELM_KUBECAFILE":                   s.KubeCaFile,
                "HELM_KUBEINSECURE_SKIP_TLS_VERIFY": strconv.FormatBool(s.KubeInsecureSkipTLSVerify),
                "HELM_KUBETLS_SERVER_NAME":          s.KubeTLSServerName,
        }
        if s.KubeConfig != "" {
                envvars["KUBECONFIG"] = s.KubeConfig
        }
        return envvars
}

// Namespace gets the namespace from the configuration
func (s *EnvSettings) Namespace() string {
        if ns, _, err := s.config.ToRawKubeConfigLoader().Namespace(); err == nil {
                return ns
        }
        return "default"
}

// SetNamespace sets the namespace in the configuration
func (s *EnvSettings) SetNamespace(namespace string) {
        s.namespace = namespace
}

// RESTClientGetter gets the kubeconfig from EnvSettings
func (s *EnvSettings) RESTClientGetter() genericclioptions.RESTClientGetter {
        return s.config
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package cli

import (
        "bytes"
        "encoding/json"
        "io"
        "net/http"
        "strings"
)

type retryingRoundTripper struct {
        wrapped http.RoundTripper
}

func (rt *retryingRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
        return rt.roundTrip(req, 1, nil)
}

func (rt *retryingRoundTripper) roundTrip(req *http.Request, retry int, prevResp *http.Response) (*http.Response, error) {
        if retry < 0 {
                return prevResp, nil
        }
        resp, rtErr := rt.wrapped.RoundTrip(req)
        if rtErr != nil {
                return resp, rtErr
        }
        if resp.StatusCode < 500 {
                return resp, rtErr
        }
        if resp.Header.Get("content-type") != "application/json" {
                return resp, rtErr
        }
        b, err := io.ReadAll(resp.Body)
        resp.Body.Close()
        if err != nil {
                return resp, rtErr
        }

        var ke kubernetesError
        r := bytes.NewReader(b)
        err = json.NewDecoder(r).Decode(&ke)
        r.Seek(0, io.SeekStart)
        resp.Body = io.NopCloser(r)
        if err != nil {
                return resp, rtErr
        }
        if ke.Code < 500 {
                return resp, rtErr
        }
        // Matches messages like "etcdserver: leader changed"
        if strings.HasSuffix(ke.Message, "etcdserver: leader changed") {
                return rt.roundTrip(req, retry-1, resp)
        }
        // Matches messages like "rpc error: code = Unknown desc = raft proposal dropped"
        if strings.HasSuffix(ke.Message, "raft proposal dropped") {
                return rt.roundTrip(req, retry-1, resp)
        }
        return resp, rtErr
}

type kubernetesError struct {
        Message string `json:"message"`
        Code    int    `json:"code"`
}

/*
Copyright The Helm Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package downloader

import (
        "fmt"
        "io"
        "net/url"
        "os"
        "path/filepath"
        "strings"

        "github.com/Masterminds/semver/v3"
        "github.com/pkg/errors"

        "helm.sh/helm/v3/internal/fileutil"
        "helm.sh/helm/v3/internal/urlutil"
        "helm.sh/helm/v3/pkg/getter"
        "helm.sh/helm/v3/pkg/helmpath"
        "helm.sh/helm/v3/pkg/provenance"
        "helm.sh/helm/v3/pkg/registry"
        "helm.sh/helm/v3/pkg/repo"
)

// VerificationStrategy describes a strategy for determining whether to verify a chart.
type VerificationStrategy int

const (
        // VerifyNever will skip all verification of a chart.
        VerifyNever VerificationStrategy = iota
        // VerifyIfPossible will attempt a verification, it will not error if verification
        // data is missing. But it will not stop processing if verification fails.
        VerifyIfPossible
        // VerifyAlways will always attempt a verification, and will fail if the
        // verification fails.
        VerifyAlways
        // VerifyLater will fetch verification data, but not do any verification.
        // This is to accommodate the case where another step of the process will
        // perform verification.
        VerifyLater
)

// ErrNoOwnerRepo indicates that a given chart URL can't be found in any repos.
var ErrNoOwnerRepo = errors.New("could not find a repo containing the given URL")

// ChartDownloader handles downloading a chart.
//
// It is capable of performing verifications on charts as well.
type ChartDownloader struct {
        // Out is the location to write warning and info messages.
        Out io.Writer
        // Verify indicates what verification strategy to use.
        Verify VerificationStrategy
        // Keyring is the keyring file used for verification.
        Keyring string
        // Getter collection for the operation
        Getters getter.Providers
        // Options provide parameters to be passed along to the Getter being initialized.
        Options          []getter.Option
        RegistryClient   *registry.Client
        RepositoryConfig string
        RepositoryCache  string
}

// DownloadTo retrieves a chart. Depending on the settings, it may also download a provenance file.
//
// If Verify is set to VerifyNever, the verification will be nil.
// If Verify is set to VerifyIfPossible, this will return a verification (or nil on failure), and print a warning on failure.
// If Verify is set to VerifyAlways, this will return a verification or an error if the verification fails.
// If Verify is set to VerifyLater, this will download the prov file (if it exists), but not verify it.
//
// For VerifyNever and VerifyIfPossible, the Verification may be empty.
//
// Returns a string path to the location where the file was downloaded and a verification
// (if provenance was verified), or an error if something bad happened.
func (c *ChartDownloader) DownloadTo(ref, version, dest string) (string, *provenance.Verification, error) {
        u, err := c.ResolveChartVersion(ref, version)
        if err != nil {
                return "", nil, err
        }

        g, err := c.Getters.ByScheme(u.Scheme)
        if err != nil {
                return "", nil, err
        }

        data, err := g.Get(u.String(), c.Options...)
        if err != nil {
                return "", nil, err
        }

        name := filepath.Base(u.Path)
        if u.Scheme == registry.OCIScheme {
                idx := strings.LastIndexByte(name, ':')
                name = fmt.Sprintf("%s-%s.tgz", name[:idx], name[idx+1:])
        }

        destfile := filepath.Join(dest, name)
        if err := fileutil.AtomicWriteFile(destfile, data, 0644); err != nil {
                return destfile, nil, err
        }

        // If provenance is requested, verify it.
        ver := &provenance.Verification{}
        if c.Verify > VerifyNever {
                body, err := g.Get(u.String() + ".prov")
                if err != nil {
                        if c.Verify == VerifyAlways {
                                return destfile, ver, errors.Errorf("failed to fetch provenance %q", u.String()+".prov")
                        }
                        fmt.Fprintf(c.Out, "WARNING: Verification not found for %s: %s\n", ref, err)
                        return destfile, ver, nil
                }
                provfile := destfile + ".prov"
                if err := fileutil.AtomicWriteFile(provfile, body, 0644); err != nil {
                        return destfile, nil, err
                }

                if c.Verify != VerifyLater {
                        ver, err = VerifyChart(destfile, c.Keyring)
                        if err != nil {
                                // Fail always in this case, since it means the verification step
                                // failed.
                                return destfile, ver, err
                        }
                }
        }
        return destfile, ver, nil
}

func (c *ChartDownloader) getOciURI(ref, version string, u *url.URL) (*url.URL, error) {
        var tag string
        var err error

        // Evaluate whether an explicit version has been provided. Otherwise, determine version to use
        _, errSemVer := semver.NewVersion(version)
        if errSemVer == nil {
                tag = version
        } else {
                // Retrieve list of repository tags
                tags, err := c.RegistryClient.Tags(strings.TrimPrefix(ref, fmt.Sprintf("%s://", registry.OCIScheme)))
                if err != nil {
                        return nil, err
                }
                if len(tags) == 0 {
                        return nil, errors.Errorf("Unable to locate any tags in provided repository: %s", ref)
                }

                // Determine if version provided
                // If empty, try to get the highest available tag
                // If exact version, try to find it
                // If semver constraint string, try to find a match
                tag, err = registry.GetTagMatchingVersionOrConstraint(tags, version)
                if err != nil {
                        return nil, err
                }
        }

        u.Path = fmt.Sprintf("%s:%s", u.Path, tag)

        return u, err
}

// ResolveChartVersion resolves a chart reference to a URL.
//
// It returns the URL and sets the ChartDownloader's Options that can fetch
// the URL using the appropriate Getter.
//
// A reference may be an HTTP URL, an oci reference URL, a 'reponame/chartname'
// reference, or a local path.
//
// A version is a SemVer string (1.2.3-beta.1+f334a6789).
//
//   - For fully qualified URLs, the version will be ignored (since URLs aren't versioned)
//   - For a chart reference
//   - If version is non-empty, this will return the URL for that version
//   - If version is empty, this will return the URL for the latest version
//   - If no version can be found, an error is returned
func (c *ChartDownloader) ResolveChartVersion(ref, version string) (*url.URL, error) {
        u, err := url.Parse(ref)
        if err != nil {
                return nil, errors.Errorf("invalid chart URL format: %s", ref)
        }

        if registry.IsOCI(u.String()) {
                return c.getOciURI(ref, version, u)
        }

        rf, err := loadRepoConfig(c.RepositoryConfig)
        if err != nil {
                return u, err
        }

        if u.IsAbs() && len(u.Host) > 0 && len(u.Path) > 0 {
                // In this case, we have to find the parent repo that contains this chart
                // URL. And this is an unfortunate problem, as it requires actually going
                // through each repo cache file and finding a matching URL. But basically
                // we want to find the repo in case we have special SSL cert config
                // for that repo.

                rc, err := c.scanReposForURL(ref, rf)
                if err != nil {
                        // If there is no special config, return the default HTTP client and
                        // swallow the error.
                        if err == ErrNoOwnerRepo {
                                // Make sure to add the ref URL as the URL for the getter
                                c.Options = append(c.Options, getter.WithURL(ref))
                                return u, nil
                        }
                        return u, err
                }

                // If we get here, we don't need to go through the next phase of looking
                // up the URL. We have it already. So we just set the parameters and return.
                c.Options = append(
                        c.Options,
                        getter.WithURL(rc.URL),
                )
                if rc.CertFile != "" || rc.KeyFile != "" || rc.CAFile != "" {
                        c.Options = append(c.Options, getter.WithTLSClientConfig(rc.CertFile, rc.KeyFile, rc.CAFile))
                }
                if rc.Username != "" && rc.Password != "" {
                        c.Options = append(
                                c.Options,
                                getter.WithBasicAuth(rc.Username, rc.Password),
                                getter.WithPassCredentialsAll(rc.PassCredentialsAll),
                        )
                }
                return u, nil
        }

        // See if it's of the form: repo/path_to_chart
        p := strings.SplitN(u.Path, "/", 2)
        if len(p) < 2 {
                return u, errors.Errorf("non-absolute URLs should be in form of repo_name/path_to_chart, got: %s", u)
        }

        repoName := p[0]
        chartName := p[1]
        rc, err := pickChartRepositoryConfigByName(repoName, rf.Repositories)

        if err != nil {
                return u, err
        }

        // Now that we have the chart repository information we can use that URL
        // to set the URL for the getter.
        c.Options = append(c.Options, getter.WithURL(rc.URL))

        r, err := repo.NewChartRepository(rc, c.Getters)
        if err != nil {
                return u, err
        }

        if r != nil && r.Config != nil {
                if r.Config.CertFile != "" || r.Config.KeyFile != "" || r.Config.CAFile != "" {
                        c.Options = append(c.Options, getter.WithTLSClientConfig(r.Config.CertFile, r.Config.KeyFile, r.Config.CAFile))
                }
                if r.Config.Username != "" && r.Config.Password != "" {
                        c.Options = append(c.Options,
                                getter.WithBasicAuth(r.Config.Username, r.Config.Password),
                                getter.WithPassCredentialsAll(r.Config.PassCredentialsAll),
                        )
                }
        }

        // Next, we need to load the index, and actually look up the chart.
        idxFile := filepath.Join(c.RepositoryCache, helmpath.CacheIndexFile(r.Config.Name))
        i, err := repo.LoadIndexFile(idxFile)
        if err != nil {
                return u, errors.Wrap(err, "no cached repo found. (try 'helm repo update')")
        }

        cv, err := i.Get(chartName, version)
        if err != nil {
                return u, errors.Wrapf(err, "chart %q matching %s not found in %s index. (try 'helm repo update')", chartName, version, r.Config.Name)
        }

        if len(cv.URLs) == 0 {
                return u, errors.Errorf("chart %q has no downloadable URLs", ref)
        }

        // TODO: Seems that picking first URL is not fully correct
        resolvedURL, err := repo.ResolveReferenceURL(rc.URL, cv.URLs[0])

        if err != nil {
                return u, errors.Errorf("invalid chart URL format: %s", ref)
        }

        return url.Parse(resolvedURL)
}

// VerifyChart takes a path to a chart archive and a keyring, and verifies the chart.
//
// It assumes that a chart archive file is accompanied by a provenance file whose
// name is the archive file name plus the ".prov" extension.
func VerifyChart(path, keyring string) (*provenance.Verification, error) {
        // For now, error out if it's not a tar file.
        switch fi, err := os.Stat(path); {
        case err != nil:
                return nil, err
        case fi.IsDir():
                return nil, errors.New("unpacked charts cannot be verified")
        case !isTar(path):
                return nil, errors.New("chart must be a tgz file")
        }

        provfile := path + ".prov"
        if _, err := os.Stat(provfile); err != nil {
                return nil, errors.Wrapf(err, "could not load provenance file %s", provfile)
        }

        sig, err := provenance.NewFromKeyring(keyring, "")
        if err != nil {
                return nil, errors.Wrap(err, "failed to load keyring")
        }
        return sig.Verify(path, provfile)
}

// isTar tests whether the given file is a tar file.
//
// Currently, this simply checks extension, since a subsequent function will
// untar the file and validate its binary format.
func isTar(filename string) bool {
        return strings.EqualFold(filepath.Ext(filename), ".tgz")
}

func pickChartRepositoryConfigByName(name string, cfgs []*repo.Entry) (*repo.Entry, error) {
        for _, rc := range cfgs {
                if rc.Name == name {
                        if rc.URL == "" {
                                return nil, errors.Errorf("no URL found for repository %s", name)
                        }
                        return rc, nil
                }
        }
        return nil, errors.Errorf("repo %s not found", name)
}

// scanReposForURL scans all repos to find which repo contains the given URL.
//
// This will attempt to find the given URL in all of the known repositories files.
//
// If the URL is found, this will return the repo entry that contained that URL.
//
// If all of the repos are checked, but the URL is not found, an ErrNoOwnerRepo
// error is returned.
//
// Other errors may be returned when repositories cannot be loaded or searched.
//
// Technically, the fact that a URL is not found in a repo is not a failure indication.
// Charts are not required to be included in an index before they are valid. So
// be mindful of this case.
//
// The same URL can technically exist in two or more repositories. This algorithm
// will return the first one it finds. Order is determined by the order of repositories
// in the repositories.yaml file.
func (c *ChartDownloader) scanReposForURL(u string, rf *repo.File) (*repo.Entry, error) {
        // FIXME: This is far from optimal. Larger installations and index files will
        // incur a performance hit for this type of scanning.
        for _, rc := range rf.Repositories {
                r, err := repo.NewChartRepository(rc, c.Getters)
                if err != nil {
                        return nil, err
                }

                idxFile := filepath.Join(c.RepositoryCache, helmpath.CacheIndexFile(r.Config.Name))
                i, err := repo.LoadIndexFile(idxFile)
                if err != nil {
                        return nil, errors.Wrap(err, "no cached repo found. (try 'helm repo update')")
                }

                for _, entry := range i.Entries {
                        for _, ver := range entry {
                                for _, dl := range ver.URLs {
                                        if urlutil.Equal(u, dl) {
                                                return rc, nil
                                        }
                                }
                        }
                }
        }
        // This means that there is no repo file for the given URL.
        return nil, ErrNoOwnerRepo
}

func loadRepoConfig(file string) (*repo.File, error) {
        r, err := repo.LoadFile(file)
        if err != nil && !os.IsNotExist(errors.Cause(err)) {
                return nil, err
        }
        return r, nil
}

/*
Copyright The Helm Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package downloader

import (
        "crypto"
        "encoding/hex"
        "fmt"
        "io"
        "log"
        "net/url"
        "os"
        "path"
        "path/filepath"
        "regexp"
        "strings"
        "sync"

        "github.com/Masterminds/semver/v3"
        "github.com/pkg/errors"
        "sigs.k8s.io/yaml"

        "helm.sh/helm/v3/internal/resolver"
        "helm.sh/helm/v3/internal/third_party/dep/fs"
        "helm.sh/helm/v3/internal/urlutil"
        "helm.sh/helm/v3/pkg/chart"
        "helm.sh/helm/v3/pkg/chart/loader"
        "helm.sh/helm/v3/pkg/chartutil"
        "helm.sh/helm/v3/pkg/getter"
        "helm.sh/helm/v3/pkg/helmpath"
        "helm.sh/helm/v3/pkg/registry"
        "helm.sh/helm/v3/pkg/repo"
)

// ErrRepoNotFound indicates that chart repositories can't be found in local repo cache.
// The value of Repos is missing repos.
type ErrRepoNotFound struct {
        Repos []string
}

// Error implements the error interface.
func (e ErrRepoNotFound) Error() string {
        return fmt.Sprintf("no repository definition for %s", strings.Join(e.Repos, ", "))
}

// Manager handles the lifecycle of fetching, resolving, and storing dependencies.
type Manager struct {
        // Out is used to print warnings and notifications.
        Out io.Writer
        // ChartPath is the path to the unpacked base chart upon which this operates.
        ChartPath string
        // Verification indicates whether the chart should be verified.
        Verify VerificationStrategy
        // Debug is the global "--debug" flag
        Debug bool
        // Keyring is the key ring file.
        Keyring string
        // SkipUpdate indicates that the repository should not be updated first.
        SkipUpdate bool
        // Getter collection for the operation
        Getters          []getter.Provider
        RegistryClient   *registry.Client
        RepositoryConfig string
        RepositoryCache  string
}

// Build rebuilds a local charts directory from a lockfile.
//
// If the lockfile is not present, this will run a Manager.Update()
//
// If SkipUpdate is set, this will not update the repository.
func (m *Manager) Build() error {
        c, err := m.loadChartDir()
        if err != nil {
                return err
        }

        // If a lock file is found, run a build from that. Otherwise, just do
        // an update.
        lock := c.Lock
        if lock == nil {
                return m.Update()
        }

        // Check that all of the repos we're dependent on actually exist.
        req := c.Metadata.Dependencies

        // If using apiVersion v1, calculate the hash before resolve repo names
        // because resolveRepoNames will change req if req uses repo alias
        // and Helm 2 calculate the digest from the original req
        // Fix for: https://github.com/helm/helm/issues/7619
        var v2Sum string
        if c.Metadata.APIVersion == chart.APIVersionV1 {
                v2Sum, err = resolver.HashV2Req(req)
                if err != nil {
                        return errors.New("the lock file (requirements.lock) is out of sync with the dependencies file (requirements.yaml). Please update the dependencies")
                }
        }

        if _, err := m.resolveRepoNames(req); err != nil {
                return err
        }

        if sum, err := resolver.HashReq(req, lock.Dependencies); err != nil || sum != lock.Digest {
                // If lock digest differs and chart is apiVersion v1, it maybe because the lock was built
                // with Helm 2 and therefore should be checked with Helm v2 hash
                // Fix for: https://github.com/helm/helm/issues/7233
                if c.Metadata.APIVersion == chart.APIVersionV1 {
                        log.Println("warning: a valid Helm v3 hash was not found. Checking against Helm v2 hash...")
                        if v2Sum != lock.Digest {
                                return errors.New("the lock file (requirements.lock) is out of sync with the dependencies file (requirements.yaml). Please update the dependencies")
                        }
                } else {
                        return errors.New("the lock file (Chart.lock) is out of sync with the dependencies file (Chart.yaml). Please update the dependencies")
                }
        }

        // Check that all of the repos we're dependent on actually exist.
        if err := m.hasAllRepos(lock.Dependencies); err != nil {
                return err
        }

        if !m.SkipUpdate {
                // For each repo in the file, update the cached copy of that repo
                if err := m.UpdateRepositories(); err != nil {
                        return err
                }
        }

        // Now we need to fetch every package here into charts/
        return m.downloadAll(lock.Dependencies)
}

// Update updates a local charts directory.
//
// It first reads the Chart.yaml file, and then attempts to
// negotiate versions based on that. It will download the versions
// from remote chart repositories unless SkipUpdate is true.
func (m *Manager) Update() error {
        c, err := m.loadChartDir()
        if err != nil {
                return err
        }

        // If no dependencies are found, we consider this a successful
        // completion.
        req := c.Metadata.Dependencies
        if req == nil {
                return nil
        }

        // Get the names of the repositories the dependencies need that Helm is
        // configured to know about.
        repoNames, err := m.resolveRepoNames(req)
        if err != nil {
                return err
        }

        // For the repositories Helm is not configured to know about, ensure Helm
        // has some information about them and, when possible, the index files
        // locally.
        // TODO(mattfarina): Repositories should be explicitly added by end users
        // rather than automattic. In Helm v4 require users to add repositories. They
        // should have to add them in order to make sure they are aware of the
        // repositories and opt-in to any locations, for security.
        repoNames, err = m.ensureMissingRepos(repoNames, req)
        if err != nil {
                return err
        }

        // For each of the repositories Helm is configured to know about, update
        // the index information locally.
        if !m.SkipUpdate {
                if err := m.UpdateRepositories(); err != nil {
                        return err
                }
        }

        // Now we need to find out which version of a chart best satisfies the
        // dependencies in the Chart.yaml
        lock, err := m.resolve(req, repoNames)
        if err != nil {
                return err
        }

        // Now we need to fetch every package here into charts/
        if err := m.downloadAll(lock.Dependencies); err != nil {
                return err
        }

        // downloadAll might overwrite dependency version, recalculate lock digest
        newDigest, err := resolver.HashReq(req, lock.Dependencies)
        if err != nil {
                return err
        }
        lock.Digest = newDigest

        // If the lock file hasn't changed, don't write a new one.
        oldLock := c.Lock
        if oldLock != nil && oldLock.Digest == lock.Digest {
                return nil
        }

        // Finally, we need to write the lockfile.
        return writeLock(m.ChartPath, lock, c.Metadata.APIVersion == chart.APIVersionV1)
}

func (m *Manager) loadChartDir() (*chart.Chart, error) {
        if fi, err := os.Stat(m.ChartPath); err != nil {
                return nil, errors.Wrapf(err, "could not find %s", m.ChartPath)
        } else if !fi.IsDir() {
                return nil, errors.New("only unpacked charts can be updated")
        }
        return loader.LoadDir(m.ChartPath)
}

// resolve takes a list of dependencies and translates them into an exact version to download.
//
// This returns a lock file, which has all of the dependencies normalized to a specific version.
func (m *Manager) resolve(req []*chart.Dependency, repoNames map[string]string) (*chart.Lock, error) {
        res := resolver.New(m.ChartPath, m.RepositoryCache, m.RegistryClient)
        return res.Resolve(req, repoNames)
}

// downloadAll takes a list of dependencies and downloads them into charts/
//
// It will delete versions of the chart that exist on disk and might cause
// a conflict.
func (m *Manager) downloadAll(deps []*chart.Dependency) error {
        repos, err := m.loadChartRepositories()
        if err != nil {
                return err
        }

        destPath := filepath.Join(m.ChartPath, "charts")
        tmpPath := filepath.Join(m.ChartPath, "tmpcharts")

        // Check if 'charts' directory is not actually a directory. If it does not exist, create it.
        if fi, err := os.Stat(destPath); err == nil {
                if !fi.IsDir() {
                        return errors.Errorf("%q is not a directory", destPath)
                }
        } else if os.IsNotExist(err) {
                if err := os.MkdirAll(destPath, 0755); err != nil {
                        return err
                }
        } else {
                return fmt.Errorf("unable to retrieve file info for '%s': %v", destPath, err)
        }

        // Prepare tmpPath
        if err := os.MkdirAll(tmpPath, 0755); err != nil {
                return err
        }
        defer os.RemoveAll(tmpPath)

        fmt.Fprintf(m.Out, "Saving %d charts\n", len(deps))
        var saveError error
        churls := make(map[string]struct{})
        for _, dep := range deps {
                // No repository means the chart is in charts directory
                if dep.Repository == "" {
                        fmt.Fprintf(m.Out, "Dependency %s did not declare a repository. Assuming it exists in the charts directory\n", dep.Name)
                        // NOTE: we are only validating the local dependency conforms to the constraints. No copying to tmpPath is necessary.
                        chartPath := filepath.Join(destPath, dep.Name)
                        ch, err := loader.LoadDir(chartPath)
                        if err != nil {
                                return fmt.Errorf("unable to load chart '%s': %v", chartPath, err)
                        }

                        constraint, err := semver.NewConstraint(dep.Version)
                        if err != nil {
                                return fmt.Errorf("dependency %s has an invalid version/constraint format: %s", dep.Name, err)
                        }

                        v, err := semver.NewVersion(ch.Metadata.Version)
                        if err != nil {
                                return fmt.Errorf("invalid version %s for dependency %s: %s", dep.Version, dep.Name, err)
                        }

                        if !constraint.Check(v) {
                                saveError = fmt.Errorf("dependency %s at version %s does not satisfy the constraint %s", dep.Name, ch.Metadata.Version, dep.Version)
                                break
                        }
                        continue
                }
                if strings.HasPrefix(dep.Repository, "file://") {
                        if m.Debug {
                                fmt.Fprintf(m.Out, "Archiving %s from repo %s\n", dep.Name, dep.Repository)
                        }
                        ver, err := tarFromLocalDir(m.ChartPath, dep.Name, dep.Repository, dep.Version, tmpPath)
                        if err != nil {
                                saveError = err
                                break
                        }
                        dep.Version = ver
                        continue
                }

                // Any failure to resolve/download a chart should fail:
                // https://github.com/helm/helm/issues/1439
                churl, username, password, insecureskiptlsverify, passcredentialsall, caFile, certFile, keyFile, err := m.findChartURL(dep.Name, dep.Version, dep.Repository, repos)
                if err != nil {
                        saveError = errors.Wrapf(err, "could not find %s", churl)
                        break
                }

                if _, ok := churls[churl]; ok {
                        fmt.Fprintf(m.Out, "Already downloaded %s from repo %s\n", dep.Name, dep.Repository)
                        continue
                }

                fmt.Fprintf(m.Out, "Downloading %s from repo %s\n", dep.Name, dep.Repository)

                dl := ChartDownloader{
                        Out:              m.Out,
                        Verify:           m.Verify,
                        Keyring:          m.Keyring,
                        RepositoryConfig: m.RepositoryConfig,
                        RepositoryCache:  m.RepositoryCache,
                        RegistryClient:   m.RegistryClient,
                        Getters:          m.Getters,
                        Options: []getter.Option{
                                getter.WithBasicAuth(username, password),
                                getter.WithPassCredentialsAll(passcredentialsall),
                                getter.WithInsecureSkipVerifyTLS(insecureskiptlsverify),
                                getter.WithTLSClientConfig(certFile, keyFile, caFile),
                        },
                }

                version := ""
                if registry.IsOCI(churl) {
                        churl, version, err = parseOCIRef(churl)
                        if err != nil {
                                return errors.Wrapf(err, "could not parse OCI reference")
                        }
                        dl.Options = append(dl.Options,
                                getter.WithRegistryClient(m.RegistryClient),
                                getter.WithTagName(version))
                }

                if _, _, err = dl.DownloadTo(churl, version, tmpPath); err != nil {
                        saveError = errors.Wrapf(err, "could not download %s", churl)
                        break
                }

                churls[churl] = struct{}{}
        }

        // TODO: this should probably be refactored to be a []error, so we can capture and provide more information rather than "last error wins".
        if saveError == nil {
                // now we can move all downloaded charts to destPath and delete outdated dependencies
                if err := m.safeMoveDeps(deps, tmpPath, destPath); err != nil {
                        return err
                }
        } else {
                fmt.Fprintln(m.Out, "Save error occurred: ", saveError)
                return saveError
        }
        return nil
}

func parseOCIRef(chartRef string) (string, string, error) {
        refTagRegexp := regexp.MustCompile(`^(oci://[^:]+(:[0-9]{1,5})?[^:]+):(.*)$`)
        caps := refTagRegexp.FindStringSubmatch(chartRef)
        if len(caps) != 4 {
                return "", "", errors.Errorf("improperly formatted oci chart reference: %s", chartRef)
        }
        chartRef = caps[1]
        tag := caps[3]

        return chartRef, tag, nil
}

// safeMoveDep moves all dependencies in the source and moves them into dest.
//
// It does this by first matching the file name to an expected pattern, then loading
// the file to verify that it is a chart.
//
// Any charts in dest that do not exist in source are removed (barring local dependencies)
//
// Because it requires tar file introspection, it is more intensive than a basic move.
//
// This will only return errors that should stop processing entirely. Other errors
// will emit log messages or be ignored.
func (m *Manager) safeMoveDeps(deps []*chart.Dependency, source, dest string) error {
        existsInSourceDirectory := map[string]bool{}
        isLocalDependency := map[string]bool{}
        sourceFiles, err := os.ReadDir(source)
        if err != nil {
                return err
        }
        // attempt to read destFiles; fail fast if we can't
        destFiles, err := os.ReadDir(dest)
        if err != nil {
                return err
        }

        for _, dep := range deps {
                if dep.Repository == "" {
                        isLocalDependency[dep.Name] = true
                }
        }

        for _, file := range sourceFiles {
                if file.IsDir() {
                        continue
                }
                filename := file.Name()
                sourcefile := filepath.Join(source, filename)
                destfile := filepath.Join(dest, filename)
                existsInSourceDirectory[filename] = true
                if _, err := loader.LoadFile(sourcefile); err != nil {
                        fmt.Fprintf(m.Out, "Could not verify %s for moving: %s (Skipping)", sourcefile, err)
                        continue
                }
                // NOTE: no need to delete the dest; os.Rename replaces it.
                if err := fs.RenameWithFallback(sourcefile, destfile); err != nil {
                        fmt.Fprintf(m.Out, "Unable to move %s to charts dir %s (Skipping)", sourcefile, err)
                        continue
                }
        }

        fmt.Fprintln(m.Out, "Deleting outdated charts")
        // find all files that exist in dest that do not exist in source; delete them (outdated dependencies)
        for _, file := range destFiles {
                if !file.IsDir() && !existsInSourceDirectory[file.Name()] {
                        fname := filepath.Join(dest, file.Name())
                        ch, err := loader.LoadFile(fname)
                        if err != nil {
                                fmt.Fprintf(m.Out, "Could not verify %s for deletion: %s (Skipping)\n", fname, err)
                                continue
                        }
                        // local dependency - skip
                        if isLocalDependency[ch.Name()] {
                                continue
                        }
                        if err := os.Remove(fname); err != nil {
                                fmt.Fprintf(m.Out, "Could not delete %s: %s (Skipping)", fname, err)
                                continue
                        }
                }
        }

        return nil
}

// hasAllRepos ensures that all of the referenced deps are in the local repo cache.
func (m *Manager) hasAllRepos(deps []*chart.Dependency) error {
        rf, err := loadRepoConfig(m.RepositoryConfig)
        if err != nil {
                return err
        }
        repos := rf.Repositories

        // Verify that all repositories referenced in the deps are actually known
        // by Helm.
        missing := []string{}
Loop:
        for _, dd := range deps {
                // If repo is from local path or OCI, continue
                if strings.HasPrefix(dd.Repository, "file://") || registry.IsOCI(dd.Repository) {
                        continue
                }

                if dd.Repository == "" {
                        continue
                }
                for _, repo := range repos {
                        if urlutil.Equal(repo.URL, strings.TrimSuffix(dd.Repository, "/")) {
                                continue Loop
                        }
                }
                missing = append(missing, dd.Repository)
        }
        if len(missing) > 0 {
                return ErrRepoNotFound{missing}
        }
        return nil
}

// ensureMissingRepos attempts to ensure the repository information for repos
// not managed by Helm is present. This takes in the repoNames Helm is configured
// to work with along with the chart dependencies. It will find the deps not
// in a known repo and attempt to ensure the data is present for steps like
// version resolution.
func (m *Manager) ensureMissingRepos(repoNames map[string]string, deps []*chart.Dependency) (map[string]string, error) {

        var ru []*repo.Entry

        for _, dd := range deps {

                // If the chart is in the local charts directory no repository needs
                // to be specified.
                if dd.Repository == "" {
                        continue
                }

                // When the repoName for a dependency is known we can skip ensuring
                if _, ok := repoNames[dd.Name]; ok {
                        continue
                }

                // The generated repository name, which will result in an index being
                // locally cached, has a name pattern of "helm-manager-" followed by a
                // sha256 of the repo name. This assumes end users will never create
                // repositories with these names pointing to other repositories. Using
                // this method of naming allows the existing repository pulling and
                // resolution code to do most of the work.
                rn, err := key(dd.Repository)
                if err != nil {
                        return repoNames, err
                }
                rn = managerKeyPrefix + rn

                repoNames[dd.Name] = rn

                // Assuming the repository is generally available. For Helm managed
                // access controls the repository needs to be added through the user
                // managed system. This path will work for public charts, like those
                // supplied by Bitnami, but not for protected charts, like corp ones
                // behind a username and pass.
                ri := &repo.Entry{
                        Name: rn,
                        URL:  dd.Repository,
                }
                ru = append(ru, ri)
        }

        // Calls to UpdateRepositories (a public function) will only update
        // repositories configured by the user. Here we update repos found in
        // the dependencies that are not known to the user if update skipping
        // is not configured.
        if !m.SkipUpdate && len(ru) > 0 {
                fmt.Fprintln(m.Out, "Getting updates for unmanaged Helm repositories...")
                if err := m.parallelRepoUpdate(ru); err != nil {
                        return repoNames, err
                }
        }

        return repoNames, nil
}

// resolveRepoNames returns the repo names of the referenced deps which can be used to fetch the cached index file
// and replaces aliased repository URLs into resolved URLs in dependencies.
func (m *Manager) resolveRepoNames(deps []*chart.Dependency) (map[string]string, error) {
        rf, err := loadRepoConfig(m.RepositoryConfig)
        if err != nil {
                if os.IsNotExist(err) {
                        return make(map[string]string), nil
                }
                return nil, err
        }
        repos := rf.Repositories

        reposMap := make(map[string]string)

        // Verify that all repositories referenced in the deps are actually known
        // by Helm.
        missing := []string{}
        for _, dd := range deps {
                // Don't map the repository, we don't need to download chart from charts directory
                if dd.Repository == "" {
                        continue
                }
                // if dep chart is from local path, verify the path is valid
                if strings.HasPrefix(dd.Repository, "file://") {
                        if _, err := resolver.GetLocalPath(dd.Repository, m.ChartPath); err != nil {
                                return nil, err
                        }

                        if m.Debug {
                                fmt.Fprintf(m.Out, "Repository from local path: %s\n", dd.Repository)
                        }
                        reposMap[dd.Name] = dd.Repository
                        continue
                }

                if registry.IsOCI(dd.Repository) {
                        reposMap[dd.Name] = dd.Repository
                        continue
                }

                found := false

                for _, repo := range repos {
                        if (strings.HasPrefix(dd.Repository, "@") && strings.TrimPrefix(dd.Repository, "@") == repo.Name) ||
                                (strings.HasPrefix(dd.Repository, "alias:") && strings.TrimPrefix(dd.Repository, "alias:") == repo.Name) {
                                found = true
                                dd.Repository = repo.URL
                                reposMap[dd.Name] = repo.Name
                                break
                        } else if urlutil.Equal(repo.URL, dd.Repository) {
                                found = true
                                reposMap[dd.Name] = repo.Name
                                break
                        }
                }
                if !found {
                        repository := dd.Repository
                        // Add if URL
                        _, err := url.ParseRequestURI(repository)
                        if err == nil {
                                reposMap[repository] = repository
                                continue
                        }
                        missing = append(missing, repository)
                }
        }
        if len(missing) > 0 {
                errorMessage := fmt.Sprintf("no repository definition for %s. Please add them via 'helm repo add'", strings.Join(missing, ", "))
                // It is common for people to try to enter "stable" as a repository instead of the actual URL.
                // For this case, let's give them a suggestion.
                containsNonURL := false
                for _, repo := range missing {
                        if !strings.Contains(repo, "//") && !strings.HasPrefix(repo, "@") && !strings.HasPrefix(repo, "alias:") {
                                containsNonURL = true
                        }
                }
                if containsNonURL {
                        errorMessage += `
Note that repositories must be URLs or aliases. For example, to refer to the "example"
repository, use "https://charts.example.com/" or "@example" instead of
"example". Don't forget to add the repo, too ('helm repo add').`
                }
                return nil, errors.New(errorMessage)
        }
        return reposMap, nil
}

// UpdateRepositories updates all of the local repos to the latest.
func (m *Manager) UpdateRepositories() error {
        rf, err := loadRepoConfig(m.RepositoryConfig)
        if err != nil {
                return err
        }
        repos := rf.Repositories
        if len(repos) > 0 {
                fmt.Fprintln(m.Out, "Hang tight while we grab the latest from your chart repositories...")
                // This prints warnings straight to out.
                if err := m.parallelRepoUpdate(repos); err != nil {
                        return err
                }
                fmt.Fprintln(m.Out, "Update Complete. ⎈Happy Helming!⎈")
        }
        return nil
}

func (m *Manager) parallelRepoUpdate(repos []*repo.Entry) error {

        var wg sync.WaitGroup
        for _, c := range repos {
                r, err := repo.NewChartRepository(c, m.Getters)
                if err != nil {
                        return err
                }
                r.CachePath = m.RepositoryCache
                wg.Add(1)
                go func(r *repo.ChartRepository) {
                        if _, err := r.DownloadIndexFile(); err != nil {
                                // For those dependencies that are not known to helm and using a
                                // generated key name we display the repo url.
                                if strings.HasPrefix(r.Config.Name, managerKeyPrefix) {
                                        fmt.Fprintf(m.Out, "...Unable to get an update from the %q chart repository:\n\t%s\n", r.Config.URL, err)
                                } else {
                                        fmt.Fprintf(m.Out, "...Unable to get an update from the %q chart repository (%s):\n\t%s\n", r.Config.Name, r.Config.URL, err)
                                }
                        } else {
                                // For those dependencies that are not known to helm and using a
                                // generated key name we display the repo url.
                                if strings.HasPrefix(r.Config.Name, managerKeyPrefix) {
                                        fmt.Fprintf(m.Out, "...Successfully got an update from the %q chart repository\n", r.Config.URL)
                                } else {
                                        fmt.Fprintf(m.Out, "...Successfully got an update from the %q chart repository\n", r.Config.Name)
                                }
                        }
                        wg.Done()
                }(r)
        }
        wg.Wait()

        return nil
}

// findChartURL searches the cache of repo data for a chart that has the name and the repoURL specified.
//
// 'name' is the name of the chart. Version is an exact semver, or an empty string. If empty, the
// newest version will be returned.
//
// repoURL is the repository to search
//
// If it finds a URL that is "relative", it will prepend the repoURL.
func (m *Manager) findChartURL(name, version, repoURL string, repos map[string]*repo.ChartRepository) (url, username, password string, insecureskiptlsverify, passcredentialsall bool, caFile, certFile, keyFile string, err error) {
        if registry.IsOCI(repoURL) {
                return fmt.Sprintf("%s/%s:%s", repoURL, name, version), "", "", false, false, "", "", "", nil
        }

        for _, cr := range repos {

                if urlutil.Equal(repoURL, cr.Config.URL) {
                        var entry repo.ChartVersions
                        entry, err = findEntryByName(name, cr)
                        if err != nil {
                                return
                        }
                        var ve *repo.ChartVersion
                        ve, err = findVersionedEntry(version, entry)
                        if err != nil {
                                return
                        }
                        url, err = normalizeURL(repoURL, ve.URLs[0])
                        if err != nil {
                                return
                        }
                        username = cr.Config.Username
                        password = cr.Config.Password
                        passcredentialsall = cr.Config.PassCredentialsAll
                        insecureskiptlsverify = cr.Config.InsecureSkipTLSverify
                        caFile = cr.Config.CAFile
                        certFile = cr.Config.CertFile
                        keyFile = cr.Config.KeyFile
                        return
                }
        }
        url, err = repo.FindChartInRepoURL(repoURL, name, version, certFile, keyFile, caFile, m.Getters)
        if err == nil {
                return url, username, password, false, false, "", "", "", err
        }
        err = errors.Errorf("chart %s not found in %s: %s", name, repoURL, err)
        return url, username, password, false, false, "", "", "", err
}

// findEntryByName finds an entry in the chart repository whose name matches the given name.
//
// It returns the ChartVersions for that entry.
func findEntryByName(name string, cr *repo.ChartRepository) (repo.ChartVersions, error) {
        for ename, entry := range cr.IndexFile.Entries {
                if ename == name {
                        return entry, nil
                }
        }
        return nil, errors.New("entry not found")
}

// findVersionedEntry takes a ChartVersions list and returns a single chart version that satisfies the version constraints.
//
// If version is empty, the first chart found is returned.
func findVersionedEntry(version string, vers repo.ChartVersions) (*repo.ChartVersion, error) {
        for _, verEntry := range vers {
                if len(verEntry.URLs) == 0 {
                        // Not a legit entry.
                        continue
                }

                if version == "" || versionEquals(version, verEntry.Version) {
                        return verEntry, nil
                }
        }
        return nil, errors.New("no matching version")
}

func versionEquals(v1, v2 string) bool {
        sv1, err := semver.NewVersion(v1)
        if err != nil {
                // Fallback to string comparison.
                return v1 == v2
        }
        sv2, err := semver.NewVersion(v2)
        if err != nil {
                return false
        }
        return sv1.Equal(sv2)
}

func normalizeURL(baseURL, urlOrPath string) (string, error) {
        u, err := url.Parse(urlOrPath)
        if err != nil {
                return urlOrPath, err
        }
        if u.IsAbs() {
                return u.String(), nil
        }
        u2, err := url.Parse(baseURL)
        if err != nil {
                return urlOrPath, errors.Wrap(err, "base URL failed to parse")
        }

        u2.RawPath = path.Join(u2.RawPath, urlOrPath)
        u2.Path = path.Join(u2.Path, urlOrPath)
        return u2.String(), nil
}

// loadChartRepositories reads the repositories.yaml, and then builds a map of
// ChartRepositories.
//
// The key is the local name (which is only present in the repositories.yaml).
func (m *Manager) loadChartRepositories() (map[string]*repo.ChartRepository, error) {
        indices := map[string]*repo.ChartRepository{}

        // Load repositories.yaml file
        rf, err := loadRepoConfig(m.RepositoryConfig)
        if err != nil {
                return indices, errors.Wrapf(err, "failed to load %s", m.RepositoryConfig)
        }

        for _, re := range rf.Repositories {
                lname := re.Name
                idxFile := filepath.Join(m.RepositoryCache, helmpath.CacheIndexFile(lname))
                index, err := repo.LoadIndexFile(idxFile)
                if err != nil {
                        return indices, err
                }

                // TODO: use constructor
                cr := &repo.ChartRepository{
                        Config:    re,
                        IndexFile: index,
                }
                indices[lname] = cr
        }
        return indices, nil
}

// writeLock writes a lockfile to disk
func writeLock(chartpath string, lock *chart.Lock, legacyLockfile bool) error {
        data, err := yaml.Marshal(lock)
        if err != nil {
                return err
        }
        lockfileName := "Chart.lock"
        if legacyLockfile {
                lockfileName = "requirements.lock"
        }
        dest := filepath.Join(chartpath, lockfileName)
        return os.WriteFile(dest, data, 0644)
}

// archive a dep chart from local directory and save it into destPath
func tarFromLocalDir(chartpath, name, repo, version, destPath string) (string, error) {
        if !strings.HasPrefix(repo, "file://") {
                return "", errors.Errorf("wrong format: chart %s repository %s", name, repo)
        }

        origPath, err := resolver.GetLocalPath(repo, chartpath)
        if err != nil {
                return "", err
        }

        ch, err := loader.LoadDir(origPath)
        if err != nil {
                return "", err
        }

        constraint, err := semver.NewConstraint(version)
        if err != nil {
                return "", errors.Wrapf(err, "dependency %s has an invalid version/constraint format", name)
        }

        v, err := semver.NewVersion(ch.Metadata.Version)
        if err != nil {
                return "", err
        }

        if constraint.Check(v) {
                _, err = chartutil.Save(ch, destPath)
                return ch.Metadata.Version, err
        }

        return "", errors.Errorf("can't get a valid version for dependency %s", name)
}

// The prefix to use for cache keys created by the manager for repo names
const managerKeyPrefix = "helm-manager-"

// key is used to turn a name, such as a repository url, into a filesystem
// safe name that is unique for querying. To accomplish this a unique hash of
// the string is used.
func key(name string) (string, error) {
        in := strings.NewReader(name)
        hash := crypto.SHA256.New()
        if _, err := io.Copy(hash, in); err != nil {
                return "", nil
        }
        return hex.EncodeToString(hash.Sum(nil)), nil
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package engine

import (
        "fmt"
        "log"
        "path"
        "path/filepath"
        "regexp"
        "sort"
        "strings"
        "text/template"

        "github.com/pkg/errors"
        "k8s.io/client-go/rest"

        "helm.sh/helm/v3/pkg/chart"
        "helm.sh/helm/v3/pkg/chartutil"
)

// Engine is an implementation of the Helm rendering implementation for templates.
type Engine struct {
        // If strict is enabled, template rendering will fail if a template references
        // a value that was not passed in.
        Strict bool
        // In LintMode, some 'required' template values may be missing, so don't fail
        LintMode bool
        // the rest config to connect to the kubernetes api
        config *rest.Config
        // EnableDNS tells the engine to allow DNS lookups when rendering templates
        EnableDNS bool
}

// New creates a new instance of Engine using the passed in rest config.
func New(config *rest.Config) Engine {
        return Engine{
                config: config,
        }
}

// Render takes a chart, optional values, and value overrides, and attempts to render the Go templates.
//
// Render can be called repeatedly on the same engine.
//
// This will look in the chart's 'templates' data (e.g. the 'templates/' directory)
// and attempt to render the templates there using the values passed in.
//
// Values are scoped to their templates. A dependency template will not have
// access to the values set for its parent. If chart "foo" includes chart "bar",
// "bar" will not have access to the values for "foo".
//
// Values should be prepared with something like `chartutils.ReadValues`.
//
// Values are passed through the templates according to scope. If the top layer
// chart includes the chart foo, which includes the chart bar, the values map
// will be examined for a table called "foo". If "foo" is found in vals,
// that section of the values will be passed into the "foo" chart. And if that
// section contains a value named "bar", that value will be passed on to the
// bar chart during render time.
func (e Engine) Render(chrt *chart.Chart, values chartutil.Values) (map[string]string, error) {
        tmap := allTemplates(chrt, values)
        return e.render(tmap)
}

// Render takes a chart, optional values, and value overrides, and attempts to
// render the Go templates using the default options.
func Render(chrt *chart.Chart, values chartutil.Values) (map[string]string, error) {
        return new(Engine).Render(chrt, values)
}

// RenderWithClient takes a chart, optional values, and value overrides, and attempts to
// render the Go templates using the default options. This engine is client aware and so can have template
// functions that interact with the client
func RenderWithClient(chrt *chart.Chart, values chartutil.Values, config *rest.Config) (map[string]string, error) {
        return Engine{
                config: config,
        }.Render(chrt, values)
}

// renderable is an object that can be rendered.
type renderable struct {
        // tpl is the current template.
        tpl string
        // vals are the values to be supplied to the template.
        vals chartutil.Values
        // namespace prefix to the templates of the current chart
        basePath string
}

const warnStartDelim = "HELM_ERR_START"
const warnEndDelim = "HELM_ERR_END"
const recursionMaxNums = 1000

var warnRegex = regexp.MustCompile(warnStartDelim + `((?s).*)` + warnEndDelim)

func warnWrap(warn string) string {
        return warnStartDelim + warn + warnEndDelim
}

// initFunMap creates the Engine's FuncMap and adds context-specific functions.
func (e Engine) initFunMap(t *template.Template, referenceTpls map[string]renderable) {
        funcMap := funcMap()
        includedNames := make(map[string]int)

        // Add the 'include' function here so we can close over t.
        funcMap["include"] = func(name string, data interface{}) (string, error) {
                var buf strings.Builder
                if v, ok := includedNames[name]; ok {
                        if v > recursionMaxNums {
                                return "", errors.Wrapf(fmt.Errorf("unable to execute template"), "rendering template has a nested reference name: %s", name)
                        }
                        includedNames[name]++
                } else {
                        includedNames[name] = 1
                }
                err := t.ExecuteTemplate(&buf, name, data)
                includedNames[name]--
                return buf.String(), err
        }

        // Add the 'tpl' function here
        funcMap["tpl"] = func(tpl string, vals chartutil.Values) (string, error) {
                basePath, err := vals.PathValue("Template.BasePath")
                if err != nil {
                        return "", errors.Wrapf(err, "cannot retrieve Template.Basepath from values inside tpl function: %s", tpl)
                }

                templateName, err := vals.PathValue("Template.Name")
                if err != nil {
                        return "", errors.Wrapf(err, "cannot retrieve Template.Name from values inside tpl function: %s", tpl)
                }

                templates := map[string]renderable{
                        templateName.(string): {
                                tpl:      tpl,
                                vals:     vals,
                                basePath: basePath.(string),
                        },
                }

                result, err := e.renderWithReferences(templates, referenceTpls)
                if err != nil {
                        return "", errors.Wrapf(err, "error during tpl function execution for %q", tpl)
                }
                return result[templateName.(string)], nil
        }

        // Add the `required` function here so we can use lintMode
        funcMap["required"] = func(warn string, val interface{}) (interface{}, error) {
                if val == nil {
                        if e.LintMode {
                                // Don't fail on missing required values when linting
                                log.Printf("[INFO] Missing required value: %s", warn)
                                return "", nil
                        }
                        return val, errors.Errorf(warnWrap(warn))
                } else if _, ok := val.(string); ok {
                        if val == "" {
                                if e.LintMode {
                                        // Don't fail on missing required values when linting
                                        log.Printf("[INFO] Missing required value: %s", warn)
                                        return "", nil
                                }
                                return val, errors.Errorf(warnWrap(warn))
                        }
                }
                return val, nil
        }

        // Override sprig fail function for linting and wrapping message
        funcMap["fail"] = func(msg string) (string, error) {
                if e.LintMode {
                        // Don't fail when linting
                        log.Printf("[INFO] Fail: %s", msg)
                        return "", nil
                }
                return "", errors.New(warnWrap(msg))
        }

        // If we are not linting and have a cluster connection, provide a Kubernetes-backed
        // implementation.
        if !e.LintMode && e.config != nil {
                funcMap["lookup"] = NewLookupFunction(e.config)
        }

        // When DNS lookups are not enabled override the sprig function and return
        // an empty string.
        if !e.EnableDNS {
                funcMap["getHostByName"] = func(name string) string {
                        return ""
                }
        }

        t.Funcs(funcMap)
}

// render takes a map of templates/values and renders them.
func (e Engine) render(tpls map[string]renderable) (map[string]string, error) {
        return e.renderWithReferences(tpls, tpls)
}

// renderWithReferences takes a map of templates/values to render, and a map of
// templates which can be referenced within them.
func (e Engine) renderWithReferences(tpls, referenceTpls map[string]renderable) (rendered map[string]string, err error) {
        // Basically, what we do here is start with an empty parent template and then
        // build up a list of templates -- one for each file. Once all of the templates
        // have been parsed, we loop through again and execute every template.
        //
        // The idea with this process is to make it possible for more complex templates
        // to share common blocks, but to make the entire thing feel like a file-based
        // template engine.
        defer func() {
                if r := recover(); r != nil {
                        err = errors.Errorf("rendering template failed: %v", r)
                }
        }()
        t := template.New("gotpl")
        if e.Strict {
                t.Option("missingkey=error")
        } else {
                // Not that zero will attempt to add default values for types it knows,
                // but will still emit <no value> for others. We mitigate that later.
                t.Option("missingkey=zero")
        }

        e.initFunMap(t, referenceTpls)

        // We want to parse the templates in a predictable order. The order favors
        // higher-level (in file system) templates over deeply nested templates.
        keys := sortTemplates(tpls)
        referenceKeys := sortTemplates(referenceTpls)

        for _, filename := range keys {
                r := tpls[filename]
                if _, err := t.New(filename).Parse(r.tpl); err != nil {
                        return map[string]string{}, cleanupParseError(filename, err)
                }
        }

        // Adding the reference templates to the template context
        // so they can be referenced in the tpl function
        for _, filename := range referenceKeys {
                if t.Lookup(filename) == nil {
                        r := referenceTpls[filename]
                        if _, err := t.New(filename).Parse(r.tpl); err != nil {
                                return map[string]string{}, cleanupParseError(filename, err)
                        }
                }
        }

        rendered = make(map[string]string, len(keys))
        for _, filename := range keys {
                // Don't render partials. We don't care out the direct output of partials.
                // They are only included from other templates.
                if strings.HasPrefix(path.Base(filename), "_") {
                        continue
                }
                // At render time, add information about the template that is being rendered.
                vals := tpls[filename].vals
                vals["Template"] = chartutil.Values{"Name": filename, "BasePath": tpls[filename].basePath}
                var buf strings.Builder
                if err := t.ExecuteTemplate(&buf, filename, vals); err != nil {
                        return map[string]string{}, cleanupExecError(filename, err)
                }

                // Work around the issue where Go will emit "<no value>" even if Options(missing=zero)
                // is set. Since missing=error will never get here, we do not need to handle
                // the Strict case.
                rendered[filename] = strings.ReplaceAll(buf.String(), "<no value>", "")
        }

        return rendered, nil
}

func cleanupParseError(filename string, err error) error {
        tokens := strings.Split(err.Error(), ": ")
        if len(tokens) == 1 {
                // This might happen if a non-templating error occurs
                return fmt.Errorf("parse error in (%s): %s", filename, err)
        }
        // The first token is "template"
        // The second token is either "filename:lineno" or "filename:lineNo:columnNo"
        location := tokens[1]
        // The remaining tokens make up a stacktrace-like chain, ending with the relevant error
        errMsg := tokens[len(tokens)-1]
        return fmt.Errorf("parse error at (%s): %s", string(location), errMsg)
}

func cleanupExecError(filename string, err error) error {
        if _, isExecError := err.(template.ExecError); !isExecError {
                return err
        }

        tokens := strings.SplitN(err.Error(), ": ", 3)
        if len(tokens) != 3 {
                // This might happen if a non-templating error occurs
                return fmt.Errorf("execution error in (%s): %s", filename, err)
        }

        // The first token is "template"
        // The second token is either "filename:lineno" or "filename:lineNo:columnNo"
        location := tokens[1]

        parts := warnRegex.FindStringSubmatch(tokens[2])
        if len(parts) >= 2 {
                return fmt.Errorf("execution error at (%s): %s", string(location), parts[1])
        }

        return err
}

func sortTemplates(tpls map[string]renderable) []string {
        keys := make([]string, len(tpls))
        i := 0
        for key := range tpls {
                keys[i] = key
                i++
        }
        sort.Sort(sort.Reverse(byPathLen(keys)))
        return keys
}

type byPathLen []string

func (p byPathLen) Len() int      { return len(p) }
func (p byPathLen) Swap(i, j int) { p[j], p[i] = p[i], p[j] }
func (p byPathLen) Less(i, j int) bool {
        a, b := p[i], p[j]
        ca, cb := strings.Count(a, "/"), strings.Count(b, "/")
        if ca == cb {
                return strings.Compare(a, b) == -1
        }
        return ca < cb
}

// allTemplates returns all templates for a chart and its dependencies.
//
// As it goes, it also prepares the values in a scope-sensitive manner.
func allTemplates(c *chart.Chart, vals chartutil.Values) map[string]renderable {
        templates := make(map[string]renderable)
        recAllTpls(c, templates, vals)
        return templates
}

// recAllTpls recurses through the templates in a chart.
//
// As it recurses, it also sets the values to be appropriate for the template
// scope.
func recAllTpls(c *chart.Chart, templates map[string]renderable, vals chartutil.Values) map[string]interface{} {
        subCharts := make(map[string]interface{})
        chartMetaData := struct {
                chart.Metadata
                IsRoot bool
        }{*c.Metadata, c.IsRoot()}

        next := map[string]interface{}{
                "Chart":        chartMetaData,
                "Files":        newFiles(c.Files),
                "Release":      vals["Release"],
                "Capabilities": vals["Capabilities"],
                "Values":       make(chartutil.Values),
                "Subcharts":    subCharts,
        }

        // If there is a {{.Values.ThisChart}} in the parent metadata,
        // copy that into the {{.Values}} for this template.
        if c.IsRoot() {
                next["Values"] = vals["Values"]
        } else if vs, err := vals.Table("Values." + c.Name()); err == nil {
                next["Values"] = vs
        }

        for _, child := range c.Dependencies() {
                subCharts[child.Name()] = recAllTpls(child, templates, next)
        }

        newParentID := c.ChartFullPath()
        for _, t := range c.Templates {
                if t == nil {
                        continue
                }
                if !isTemplateValid(c, t.Name) {
                        continue
                }
                templates[path.Join(newParentID, t.Name)] = renderable{
                        tpl:      string(t.Data),
                        vals:     next,
                        basePath: path.Join(newParentID, "templates"),
                }
        }

        return next
}

// isTemplateValid returns true if the template is valid for the chart type
func isTemplateValid(ch *chart.Chart, templateName string) bool {
        if isLibraryChart(ch) {
                return strings.HasPrefix(filepath.Base(templateName), "_")
        }
        return true
}

// isLibraryChart returns true if the chart is a library chart
func isLibraryChart(c *chart.Chart) bool {
        return strings.EqualFold(c.Metadata.Type, "library")
}

//go:build gofuzz
// +build gofuzz

// Copyright 2022 ADA Logics Ltd
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

package engine

import (
        "helm.sh/helm/v3/pkg/chart"
        "helm.sh/helm/v3/pkg/chartutil"

        fuzz "github.com/AdaLogics/go-fuzz-headers"
)

func FuzzEngineRender(data []byte) int {
        f := fuzz.NewConsumer(data)
        chrt := &chart.Chart{}
        err := f.GenerateStruct(chrt)
        if err != nil {
                return 0
        }
        valuesBytes, err := f.GetBytes()
        if err != nil {
                return 0
        }
        values, err := chartutil.ReadValues(valuesBytes)
        if err != nil {
                return 0
        }
        _, _ = Render(chrt, values)
        return 1
}

func FuzzEngineFiles(data []byte) int {
        f := fuzz.NewConsumer(data)
        noOfEntries, err := f.GetInt()
        if err != nil {
                return 0
        }
        files := make(files, 0)
        for i:=0;i<noOfEntries%15;i++ {
                name, err := f.GetString()
                if err != nil {
                        return 0
                }
                byteData, err := f.GetBytes()
                if err != nil {
                        return 0
                }
                files[name] = byteData
        }
        name, err := f.GetString()
        if err != nil {
                return 0
        }
        _ = files.Get(name)
        pattern, err := f.GetString()
        if err != nil {
                return 0
        }
        _ = files.Glob(pattern)
        _ = files.AsConfig()
        _ = files.AsSecrets()

        path, err := f.GetString()
        if err != nil {
                return 0
        }
        _ = files.Lines(path)
        return 1
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package engine

import (
        "encoding/base64"
        "path"
        "strings"

        "github.com/gobwas/glob"

        "helm.sh/helm/v3/pkg/chart"
)

// files is a map of files in a chart that can be accessed from a template.
type files map[string][]byte

// NewFiles creates a new files from chart files.
// Given an []*chart.File (the format for files in a chart.Chart), extract a map of files.
func newFiles(from []*chart.File) files {
        files := make(map[string][]byte)
        for _, f := range from {
                files[f.Name] = f.Data
        }
        return files
}

// GetBytes gets a file by path.
//
// The returned data is raw. In a template context, this is identical to calling
// {{index .Files $path}}.
//
// This is intended to be accessed from within a template, so a missed key returns
// an empty []byte.
func (f files) GetBytes(name string) []byte {
        if v, ok := f[name]; ok {
                return v
        }
        return []byte{}
}

// Get returns a string representation of the given file.
//
// Fetch the contents of a file as a string. It is designed to be called in a
// template.
//
//        {{.Files.Get "foo"}}
func (f files) Get(name string) string {
        return string(f.GetBytes(name))
}

// Glob takes a glob pattern and returns another files object only containing
// matched  files.
//
// This is designed to be called from a template.
//
// {{ range $name, $content := .Files.Glob("foo/**") }}
// {{ $name }}: |
// {{ .Files.Get($name) | indent 4 }}{{ end }}
func (f files) Glob(pattern string) files {
        g, err := glob.Compile(pattern, '/')
        if err != nil {
                g, _ = glob.Compile("**")
        }

        nf := newFiles(nil)
        for name, contents := range f {
                if g.Match(name) {
                        nf[name] = contents
                }
        }

        return nf
}

// AsConfig turns a Files group and flattens it to a YAML map suitable for
// including in the 'data' section of a Kubernetes ConfigMap definition.
// Duplicate keys will be overwritten, so be aware that your file names
// (regardless of path) should be unique.
//
// This is designed to be called from a template, and will return empty string
// (via toYAML function) if it cannot be serialized to YAML, or if the Files
// object is nil.
//
// The output will not be indented, so you will want to pipe this to the
// 'indent' template function.
//
//        data:
//
// {{ .Files.Glob("config/**").AsConfig() | indent 4 }}
func (f files) AsConfig() string {
        if f == nil {
                return ""
        }

        m := make(map[string]string)

        // Explicitly convert to strings, and file names
        for k, v := range f {
                m[path.Base(k)] = string(v)
        }

        return toYAML(m)
}

// AsSecrets returns the base64-encoded value of a Files object suitable for
// including in the 'data' section of a Kubernetes Secret definition.
// Duplicate keys will be overwritten, so be aware that your file names
// (regardless of path) should be unique.
//
// This is designed to be called from a template, and will return empty string
// (via toYAML function) if it cannot be serialized to YAML, or if the Files
// object is nil.
//
// The output will not be indented, so you will want to pipe this to the
// 'indent' template function.
//
//        data:
//
// {{ .Files.Glob("secrets/*").AsSecrets() | indent 4 }}
func (f files) AsSecrets() string {
        if f == nil {
                return ""
        }

        m := make(map[string]string)

        for k, v := range f {
                m[path.Base(k)] = base64.StdEncoding.EncodeToString(v)
        }

        return toYAML(m)
}

// Lines returns each line of a named file (split by "\n") as a slice, so it can
// be ranged over in your templates.
//
// This is designed to be called from a template.
//
// {{ range .Files.Lines "foo/bar.html" }}
// {{ . }}{{ end }}
func (f files) Lines(path string) []string {
        if f == nil || f[path] == nil {
                return []string{}
        }
        s := string(f[path])
        if s[len(s)-1] == '\n' {
                s = s[:len(s)-1]
        }
        return strings.Split(s, "\n")
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package engine

import (
        "bytes"
        "encoding/json"
        "strings"
        "text/template"

        "github.com/BurntSushi/toml"
        "github.com/Masterminds/sprig/v3"
        "sigs.k8s.io/yaml"
)

// funcMap returns a mapping of all of the functions that Engine has.
//
// Because some functions are late-bound (e.g. contain context-sensitive
// data), the functions may not all perform identically outside of an Engine
// as they will inside of an Engine.
//
// Known late-bound functions:
//
//   - "include"
//   - "tpl"
//
// These are late-bound in Engine.Render().  The
// version included in the FuncMap is a placeholder.
func funcMap() template.FuncMap {
        f := sprig.TxtFuncMap()
        delete(f, "env")
        delete(f, "expandenv")

        // Add some extra functionality
        extra := template.FuncMap{
                "toToml":        toTOML,
                "toYaml":        toYAML,
                "fromYaml":      fromYAML,
                "fromYamlArray": fromYAMLArray,
                "toJson":        toJSON,
                "fromJson":      fromJSON,
                "fromJsonArray": fromJSONArray,

                // This is a placeholder for the "include" function, which is
                // late-bound to a template. By declaring it here, we preserve the
                // integrity of the linter.
                "include":  func(string, interface{}) string { return "not implemented" },
                "tpl":      func(string, interface{}) interface{} { return "not implemented" },
                "required": func(string, interface{}) (interface{}, error) { return "not implemented", nil },
                // Provide a placeholder for the "lookup" function, which requires a kubernetes
                // connection.
                "lookup": func(string, string, string, string) (map[string]interface{}, error) {
                        return map[string]interface{}{}, nil
                },
        }

        for k, v := range extra {
                f[k] = v
        }

        return f
}

// toYAML takes an interface, marshals it to yaml, and returns a string. It will
// always return a string, even on marshal error (empty string).
//
// This is designed to be called from a template.
func toYAML(v interface{}) string {
        data, err := yaml.Marshal(v)
        if err != nil {
                // Swallow errors inside of a template.
                return ""
        }
        return strings.TrimSuffix(string(data), "\n")
}

// fromYAML converts a YAML document into a map[string]interface{}.
//
// This is not a general-purpose YAML parser, and will not parse all valid
// YAML documents. Additionally, because its intended use is within templates
// it tolerates errors. It will insert the returned error message string into
// m["Error"] in the returned map.
func fromYAML(str string) map[string]interface{} {
        m := map[string]interface{}{}

        if err := yaml.Unmarshal([]byte(str), &m); err != nil {
                m["Error"] = err.Error()
        }
        return m
}

// fromYAMLArray converts a YAML array into a []interface{}.
//
// This is not a general-purpose YAML parser, and will not parse all valid
// YAML documents. Additionally, because its intended use is within templates
// it tolerates errors. It will insert the returned error message string as
// the first and only item in the returned array.
func fromYAMLArray(str string) []interface{} {
        a := []interface{}{}

        if err := yaml.Unmarshal([]byte(str), &a); err != nil {
                a = []interface{}{err.Error()}
        }
        return a
}

// toTOML takes an interface, marshals it to toml, and returns a string. It will
// always return a string, even on marshal error (empty string).
//
// This is designed to be called from a template.
func toTOML(v interface{}) string {
        b := bytes.NewBuffer(nil)
        e := toml.NewEncoder(b)
        err := e.Encode(v)
        if err != nil {
                return err.Error()
        }
        return b.String()
}

// toJSON takes an interface, marshals it to json, and returns a string. It will
// always return a string, even on marshal error (empty string).
//
// This is designed to be called from a template.
func toJSON(v interface{}) string {
        data, err := json.Marshal(v)
        if err != nil {
                // Swallow errors inside of a template.
                return ""
        }
        return string(data)
}

// fromJSON converts a JSON document into a map[string]interface{}.
//
// This is not a general-purpose JSON parser, and will not parse all valid
// JSON documents. Additionally, because its intended use is within templates
// it tolerates errors. It will insert the returned error message string into
// m["Error"] in the returned map.
func fromJSON(str string) map[string]interface{} {
        m := make(map[string]interface{})

        if err := json.Unmarshal([]byte(str), &m); err != nil {
                m["Error"] = err.Error()
        }
        return m
}

// fromJSONArray converts a JSON array into a []interface{}.
//
// This is not a general-purpose JSON parser, and will not parse all valid
// JSON documents. Additionally, because its intended use is within templates
// it tolerates errors. It will insert the returned error message string as
// the first and only item in the returned array.
func fromJSONArray(str string) []interface{} {
        a := []interface{}{}

        if err := json.Unmarshal([]byte(str), &a); err != nil {
                a = []interface{}{err.Error()}
        }
        return a
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package engine

import (
        "context"
        "log"
        "strings"

        "github.com/pkg/errors"
        apierrors "k8s.io/apimachinery/pkg/api/errors"
        metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
        "k8s.io/apimachinery/pkg/runtime/schema"
        "k8s.io/client-go/discovery"
        "k8s.io/client-go/dynamic"
        "k8s.io/client-go/rest"
)

type lookupFunc = func(apiversion string, resource string, namespace string, name string) (map[string]interface{}, error)

// NewLookupFunction returns a function for looking up objects in the cluster.
//
// If the resource does not exist, no error is raised.
//
// This function is considered deprecated, and will be renamed in Helm 4. It will no
// longer be a public function.
func NewLookupFunction(config *rest.Config) lookupFunc {
        return func(apiversion string, resource string, namespace string, name string) (map[string]interface{}, error) {
                var client dynamic.ResourceInterface
                c, namespaced, err := getDynamicClientOnKind(apiversion, resource, config)
                if err != nil {
                        return map[string]interface{}{}, err
                }
                if namespaced && namespace != "" {
                        client = c.Namespace(namespace)
                } else {
                        client = c
                }
                if name != "" {
                        // this will return a single object
                        obj, err := client.Get(context.Background(), name, metav1.GetOptions{})
                        if err != nil {
                                if apierrors.IsNotFound(err) {
                                        // Just return an empty interface when the object was not found.
                                        // That way, users can use `if not (lookup ...)` in their templates.
                                        return map[string]interface{}{}, nil
                                }
                                return map[string]interface{}{}, err
                        }
                        return obj.UnstructuredContent(), nil
                }
                // this will return a list
                obj, err := client.List(context.Background(), metav1.ListOptions{})
                if err != nil {
                        if apierrors.IsNotFound(err) {
                                // Just return an empty interface when the object was not found.
                                // That way, users can use `if not (lookup ...)` in their templates.
                                return map[string]interface{}{}, nil
                        }
                        return map[string]interface{}{}, err
                }
                return obj.UnstructuredContent(), nil
        }
}

// getDynamicClientOnKind returns a dynamic client on an Unstructured type. This client can be further namespaced.
func getDynamicClientOnKind(apiversion string, kind string, config *rest.Config) (dynamic.NamespaceableResourceInterface, bool, error) {
        gvk := schema.FromAPIVersionAndKind(apiversion, kind)
        apiRes, err := getAPIResourceForGVK(gvk, config)
        if err != nil {
                log.Printf("[ERROR] unable to get apiresource from unstructured: %s , error %s", gvk.String(), err)
                return nil, false, errors.Wrapf(err, "unable to get apiresource from unstructured: %s", gvk.String())
        }
        gvr := schema.GroupVersionResource{
                Group:    apiRes.Group,
                Version:  apiRes.Version,
                Resource: apiRes.Name,
        }
        intf, err := dynamic.NewForConfig(config)
        if err != nil {
                log.Printf("[ERROR] unable to get dynamic client %s", err)
                return nil, false, err
        }
        res := intf.Resource(gvr)
        return res, apiRes.Namespaced, nil
}

func getAPIResourceForGVK(gvk schema.GroupVersionKind, config *rest.Config) (metav1.APIResource, error) {
        res := metav1.APIResource{}
        discoveryClient, err := discovery.NewDiscoveryClientForConfig(config)
        if err != nil {
                log.Printf("[ERROR] unable to create discovery client %s", err)
                return res, err
        }
        resList, err := discoveryClient.ServerResourcesForGroupVersion(gvk.GroupVersion().String())
        if err != nil {
                log.Printf("[ERROR] unable to retrieve resource list for: %s , error: %s", gvk.GroupVersion().String(), err)
                return res, err
        }
        for _, resource := range resList.APIResources {
                // if a resource contains a "/" it's referencing a subresource. we don't support suberesource for now.
                if resource.Kind == gvk.Kind && !strings.Contains(resource.Name, "/") {
                        res = resource
                        res.Group = gvk.Group
                        res.Version = gvk.Version
                        break
                }
        }
        return res, nil
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package getter

import (
        "bytes"
        "net/http"
        "time"

        "github.com/pkg/errors"

        "helm.sh/helm/v3/pkg/cli"
        "helm.sh/helm/v3/pkg/registry"
)

// options are generic parameters to be provided to the getter during instantiation.
//
// Getters may or may not ignore these parameters as they are passed in.
type options struct {
        url                   string
        certFile              string
        keyFile               string
        caFile                string
        unTar                 bool
        insecureSkipVerifyTLS bool
        plainHTTP             bool
        username              string
        password              string
        passCredentialsAll    bool
        userAgent             string
        version               string
        registryClient        *registry.Client
        timeout               time.Duration
        transport             *http.Transport
}

// Option allows specifying various settings configurable by the user for overriding the defaults
// used when performing Get operations with the Getter.
type Option func(*options)

// WithURL informs the getter the server name that will be used when fetching objects. Used in conjunction with
// WithTLSClientConfig to set the TLSClientConfig's server name.
func WithURL(url string) Option {
        return func(opts *options) {
                opts.url = url
        }
}

// WithBasicAuth sets the request's Authorization header to use the provided credentials
func WithBasicAuth(username, password string) Option {
        return func(opts *options) {
                opts.username = username
                opts.password = password
        }
}

func WithPassCredentialsAll(pass bool) Option {
        return func(opts *options) {
                opts.passCredentialsAll = pass
        }
}

// WithUserAgent sets the request's User-Agent header to use the provided agent name.
func WithUserAgent(userAgent string) Option {
        return func(opts *options) {
                opts.userAgent = userAgent
        }
}

// WithInsecureSkipVerifyTLS determines if a TLS Certificate will be checked
func WithInsecureSkipVerifyTLS(insecureSkipVerifyTLS bool) Option {
        return func(opts *options) {
                opts.insecureSkipVerifyTLS = insecureSkipVerifyTLS
        }
}

// WithTLSClientConfig sets the client auth with the provided credentials.
func WithTLSClientConfig(certFile, keyFile, caFile string) Option {
        return func(opts *options) {
                opts.certFile = certFile
                opts.keyFile = keyFile
                opts.caFile = caFile
        }
}

func WithPlainHTTP(plainHTTP bool) Option {
        return func(opts *options) {
                opts.plainHTTP = plainHTTP
        }
}

// WithTimeout sets the timeout for requests
func WithTimeout(timeout time.Duration) Option {
        return func(opts *options) {
                opts.timeout = timeout
        }
}

func WithTagName(tagname string) Option {
        return func(opts *options) {
                opts.version = tagname
        }
}

func WithRegistryClient(client *registry.Client) Option {
        return func(opts *options) {
                opts.registryClient = client
        }
}

func WithUntar() Option {
        return func(opts *options) {
                opts.unTar = true
        }
}

// WithTransport sets the http.Transport to allow overwriting the HTTPGetter default.
func WithTransport(transport *http.Transport) Option {
        return func(opts *options) {
                opts.transport = transport
        }
}

// Getter is an interface to support GET to the specified URL.
type Getter interface {
        // Get file content by url string
        Get(url string, options ...Option) (*bytes.Buffer, error)
}

// Constructor is the function for every getter which creates a specific instance
// according to the configuration
type Constructor func(options ...Option) (Getter, error)

// Provider represents any getter and the schemes that it supports.
//
// For example, an HTTP provider may provide one getter that handles both
// 'http' and 'https' schemes.
type Provider struct {
        Schemes []string
        New     Constructor
}

// Provides returns true if the given scheme is supported by this Provider.
func (p Provider) Provides(scheme string) bool {
        for _, i := range p.Schemes {
                if i == scheme {
                        return true
                }
        }
        return false
}

// Providers is a collection of Provider objects.
type Providers []Provider

// ByScheme returns a Provider that handles the given scheme.
//
// If no provider handles this scheme, this will return an error.
func (p Providers) ByScheme(scheme string) (Getter, error) {
        for _, pp := range p {
                if pp.Provides(scheme) {
                        return pp.New()
                }
        }
        return nil, errors.Errorf("scheme %q not supported", scheme)
}

const (
        // The cost timeout references curl's default connection timeout.
        // https://github.com/curl/curl/blob/master/lib/connect.h#L40C21-L40C21
        // The helm commands are usually executed manually. Considering the acceptable waiting time, we reduced the entire request time to 120s.
        DefaultHTTPTimeout = 120
)

var defaultOptions = []Option{WithTimeout(time.Second * DefaultHTTPTimeout)}

var httpProvider = Provider{
        Schemes: []string{"http", "https"},
        New: func(options ...Option) (Getter, error) {
                options = append(options, defaultOptions...)
                return NewHTTPGetter(options...)
        },
}

var ociProvider = Provider{
        Schemes: []string{registry.OCIScheme},
        New:     NewOCIGetter,
}

// All finds all of the registered getters as a list of Provider instances.
// Currently, the built-in getters and the discovered plugins with downloader
// notations are collected.
func All(settings *cli.EnvSettings) Providers {
        result := Providers{httpProvider, ociProvider}
        pluginDownloaders, _ := collectPlugins(settings)
        result = append(result, pluginDownloaders...)
        return result
}

/*
Copyright The Helm Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package getter

import (
        "bytes"
        "crypto/tls"
        "io"
        "net/http"
        "net/url"
        "sync"

        "github.com/pkg/errors"

        "helm.sh/helm/v3/internal/tlsutil"
        "helm.sh/helm/v3/internal/urlutil"
        "helm.sh/helm/v3/internal/version"
)

// HTTPGetter is the default HTTP(/S) backend handler
type HTTPGetter struct {
        opts      options
        transport *http.Transport
        once      sync.Once
}

// Get performs a Get from repo.Getter and returns the body.
func (g *HTTPGetter) Get(href string, options ...Option) (*bytes.Buffer, error) {
        for _, opt := range options {
                opt(&g.opts)
        }
        return g.get(href)
}

func (g *HTTPGetter) get(href string) (*bytes.Buffer, error) {
        // Set a helm specific user agent so that a repo server and metrics can
        // separate helm calls from other tools interacting with repos.
        req, err := http.NewRequest(http.MethodGet, href, nil)
        if err != nil {
                return nil, err
        }

        req.Header.Set("User-Agent", version.GetUserAgent())
        if g.opts.userAgent != "" {
                req.Header.Set("User-Agent", g.opts.userAgent)
        }

        // Before setting the basic auth credentials, make sure the URL associated
        // with the basic auth is the one being fetched.
        u1, err := url.Parse(g.opts.url)
        if err != nil {
                return nil, errors.Wrap(err, "Unable to parse getter URL")
        }
        u2, err := url.Parse(href)
        if err != nil {
                return nil, errors.Wrap(err, "Unable to parse URL getting from")
        }

        // Host on URL (returned from url.Parse) contains the port if present.
        // This check ensures credentials are not passed between different
        // services on different ports.
        if g.opts.passCredentialsAll || (u1.Scheme == u2.Scheme && u1.Host == u2.Host) {
                if g.opts.username != "" && g.opts.password != "" {
                        req.SetBasicAuth(g.opts.username, g.opts.password)
                }
        }

        client, err := g.httpClient()
        if err != nil {
                return nil, err
        }

        resp, err := client.Do(req)
        if err != nil {
                return nil, err
        }
        defer resp.Body.Close()
        if resp.StatusCode != http.StatusOK {
                return nil, errors.Errorf("failed to fetch %s : %s", href, resp.Status)
        }

        buf := bytes.NewBuffer(nil)
        _, err = io.Copy(buf, resp.Body)
        return buf, err
}

// NewHTTPGetter constructs a valid http/https client as a Getter
func NewHTTPGetter(options ...Option) (Getter, error) {
        var client HTTPGetter

        for _, opt := range options {
                opt(&client.opts)
        }

        return &client, nil
}

func (g *HTTPGetter) httpClient() (*http.Client, error) {
        if g.opts.transport != nil {
                return &http.Client{
                        Transport: g.opts.transport,
                        Timeout:   g.opts.timeout,
                }, nil
        }

        g.once.Do(func() {
                g.transport = &http.Transport{
                        DisableCompression: true,
                        Proxy:              http.ProxyFromEnvironment,
                }
        })

        if (g.opts.certFile != "" && g.opts.keyFile != "") || g.opts.caFile != "" || g.opts.insecureSkipVerifyTLS {
                tlsConf, err := tlsutil.NewClientTLS(g.opts.certFile, g.opts.keyFile, g.opts.caFile, g.opts.insecureSkipVerifyTLS)
                if err != nil {
                        return nil, errors.Wrap(err, "can't create TLS config for client")
                }

                sni, err := urlutil.ExtractHostname(g.opts.url)
                if err != nil {
                        return nil, err
                }
                tlsConf.ServerName = sni

                g.transport.TLSClientConfig = tlsConf
        }

        if g.opts.insecureSkipVerifyTLS {
                if g.transport.TLSClientConfig == nil {
                        g.transport.TLSClientConfig = &tls.Config{
                                InsecureSkipVerify: true,
                        }
                } else {
                        g.transport.TLSClientConfig.InsecureSkipVerify = true
                }
        }

        client := &http.Client{
                Transport: g.transport,
                Timeout:   g.opts.timeout,
        }

        return client, nil
}

/*
Copyright The Helm Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package getter

import (
        "bytes"
        "fmt"
        "net"
        "net/http"
        "strings"
        "sync"
        "time"

        "helm.sh/helm/v3/internal/tlsutil"
        "helm.sh/helm/v3/internal/urlutil"
        "helm.sh/helm/v3/pkg/registry"
)

// OCIGetter is the default HTTP(/S) backend handler
type OCIGetter struct {
        opts      options
        transport *http.Transport
        once      sync.Once
}

// Get performs a Get from repo.Getter and returns the body.
func (g *OCIGetter) Get(href string, options ...Option) (*bytes.Buffer, error) {
        for _, opt := range options {
                opt(&g.opts)
        }
        return g.get(href)
}

func (g *OCIGetter) get(href string) (*bytes.Buffer, error) {
        client := g.opts.registryClient
        // if the user has already provided a configured registry client, use it,
        // this is particularly true when user has his own way of handling the client credentials.
        if client == nil {
                c, err := g.newRegistryClient()
                if err != nil {
                        return nil, err
                }
                client = c
        }

        ref := strings.TrimPrefix(href, fmt.Sprintf("%s://", registry.OCIScheme))

        var pullOpts []registry.PullOption
        requestingProv := strings.HasSuffix(ref, ".prov")
        if requestingProv {
                ref = strings.TrimSuffix(ref, ".prov")
                pullOpts = append(pullOpts,
                        registry.PullOptWithChart(false),
                        registry.PullOptWithProv(true))
        }

        result, err := client.Pull(ref, pullOpts...)
        if err != nil {
                return nil, err
        }

        if requestingProv {
                return bytes.NewBuffer(result.Prov.Data), nil
        }
        return bytes.NewBuffer(result.Chart.Data), nil
}

// NewOCIGetter constructs a valid http/https client as a Getter
func NewOCIGetter(ops ...Option) (Getter, error) {
        var client OCIGetter

        for _, opt := range ops {
                opt(&client.opts)
        }

        return &client, nil
}

func (g *OCIGetter) newRegistryClient() (*registry.Client, error) {
        if g.opts.transport != nil {
                client, err := registry.NewClient(
                        registry.ClientOptHTTPClient(&http.Client{
                                Transport: g.opts.transport,
                                Timeout:   g.opts.timeout,
                        }),
                )
                if err != nil {
                        return nil, err
                }
                return client, nil
        }

        g.once.Do(func() {
                g.transport = &http.Transport{
                        // From https://github.com/google/go-containerregistry/blob/31786c6cbb82d6ec4fb8eb79cd9387905130534e/pkg/v1/remote/options.go#L87
                        DisableCompression: true,
                        DialContext: (&net.Dialer{
                                // By default we wrap the transport in retries, so reduce the
                                // default dial timeout to 5s to avoid 5x 30s of connection
                                // timeouts when doing the "ping" on certain http registries.
                                Timeout:   5 * time.Second,
                                KeepAlive: 30 * time.Second,
                        }).DialContext,
                        ForceAttemptHTTP2:     true,
                        MaxIdleConns:          100,
                        IdleConnTimeout:       90 * time.Second,
                        TLSHandshakeTimeout:   10 * time.Second,
                        ExpectContinueTimeout: 1 * time.Second,
                }
        })

        if (g.opts.certFile != "" && g.opts.keyFile != "") || g.opts.caFile != "" || g.opts.insecureSkipVerifyTLS {
                tlsConf, err := tlsutil.NewClientTLS(g.opts.certFile, g.opts.keyFile, g.opts.caFile, g.opts.insecureSkipVerifyTLS)
                if err != nil {
                        return nil, fmt.Errorf("can't create TLS config for client: %w", err)
                }

                sni, err := urlutil.ExtractHostname(g.opts.url)
                if err != nil {
                        return nil, err
                }
                tlsConf.ServerName = sni

                g.transport.TLSClientConfig = tlsConf
        }

        opts := []registry.ClientOption{registry.ClientOptHTTPClient(&http.Client{
                Transport: g.transport,
                Timeout:   g.opts.timeout,
        })}
        if g.opts.plainHTTP {
                opts = append(opts, registry.ClientOptPlainHTTP())
        }

        client, err := registry.NewClient(opts...)

        if err != nil {
                return nil, err
        }

        return client, nil
}

/*
Copyright The Helm Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package getter

import (
        "bytes"
        "os"
        "os/exec"
        "path/filepath"
        "strings"

        "github.com/pkg/errors"

        "helm.sh/helm/v3/pkg/cli"
        "helm.sh/helm/v3/pkg/plugin"
)

// collectPlugins scans for getter plugins.
// This will load plugins according to the cli.
func collectPlugins(settings *cli.EnvSettings) (Providers, error) {
        plugins, err := plugin.FindPlugins(settings.PluginsDirectory)
        if err != nil {
                return nil, err
        }
        var result Providers
        for _, plugin := range plugins {
                for _, downloader := range plugin.Metadata.Downloaders {
                        result = append(result, Provider{
                                Schemes: downloader.Protocols,
                                New: NewPluginGetter(
                                        downloader.Command,
                                        settings,
                                        plugin.Metadata.Name,
                                        plugin.Dir,
                                ),
                        })
                }
        }
        return result, nil
}

// pluginGetter is a generic type to invoke custom downloaders,
// implemented in plugins.
type pluginGetter struct {
        command  string
        settings *cli.EnvSettings
        name     string
        base     string
        opts     options
}

// Get runs downloader plugin command
func (p *pluginGetter) Get(href string, options ...Option) (*bytes.Buffer, error) {
        for _, opt := range options {
                opt(&p.opts)
        }
        commands := strings.Split(p.command, " ")
        argv := append(commands[1:], p.opts.certFile, p.opts.keyFile, p.opts.caFile, href)
        prog := exec.Command(filepath.Join(p.base, commands[0]), argv...)
        plugin.SetupPluginEnv(p.settings, p.name, p.base)
        prog.Env = os.Environ()
        buf := bytes.NewBuffer(nil)
        prog.Stdout = buf
        prog.Stderr = os.Stderr
        if err := prog.Run(); err != nil {
                if eerr, ok := err.(*exec.ExitError); ok {
                        os.Stderr.Write(eerr.Stderr)
                        return nil, errors.Errorf("plugin %q exited with error", p.command)
                }
                return nil, err
        }
        return buf, nil
}

// NewPluginGetter constructs a valid plugin getter
func NewPluginGetter(command string, settings *cli.EnvSettings, name, base string) Constructor {
        return func(options ...Option) (Getter, error) {
                result := &pluginGetter{
                        command:  command,
                        settings: settings,
                        name:     name,
                        base:     base,
                }
                for _, opt := range options {
                        opt(&result.opts)
                }
                return result, nil
        }
}

// Copyright The Helm Authors.
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at

// http://www.apache.org/licenses/LICENSE-2.0

// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

// Package helmpath calculates filesystem paths to Helm's configuration, cache and data.
package helmpath

// This helper builds paths to Helm's configuration, cache and data paths.
const lp = lazypath("helm")

// ConfigPath returns the path where Helm stores configuration.
func ConfigPath(elem ...string) string { return lp.configPath(elem...) }

// CachePath returns the path where Helm stores cached objects.
func CachePath(elem ...string) string { return lp.cachePath(elem...) }

// DataPath returns the path where Helm stores data.
func DataPath(elem ...string) string { return lp.dataPath(elem...) }

// CacheIndexFile returns the path to an index for the given named repository.
func CacheIndexFile(name string) string {
        if name != "" {
                name += "-"
        }
        return name + "index.yaml"
}

// CacheChartsFile returns the path to a text file listing all the charts
// within the given named repository.
func CacheChartsFile(name string) string {
        if name != "" {
                name += "-"
        }
        return name + "charts.txt"
}

// Copyright The Helm Authors.
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at

// http://www.apache.org/licenses/LICENSE-2.0

// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package helmpath

import (
        "os"
        "path/filepath"

        "helm.sh/helm/v3/pkg/helmpath/xdg"
)

const (
        // CacheHomeEnvVar is the environment variable used by Helm
        // for the cache directory. When no value is set a default is used.
        CacheHomeEnvVar = "HELM_CACHE_HOME"

        // ConfigHomeEnvVar is the environment variable used by Helm
        // for the config directory. When no value is set a default is used.
        ConfigHomeEnvVar = "HELM_CONFIG_HOME"

        // DataHomeEnvVar is the environment variable used by Helm
        // for the data directory. When no value is set a default is used.
        DataHomeEnvVar = "HELM_DATA_HOME"
)

// lazypath is an lazy-loaded path buffer for the XDG base directory specification.
type lazypath string

func (l lazypath) path(helmEnvVar, xdgEnvVar string, defaultFn func() string, elem ...string) string {

        // There is an order to checking for a path.
        // 1. See if a Helm specific environment variable has been set.
        // 2. Check if an XDG environment variable is set
        // 3. Fall back to a default
        base := os.Getenv(helmEnvVar)
        if base != "" {
                return filepath.Join(base, filepath.Join(elem...))
        }
        base = os.Getenv(xdgEnvVar)
        if base == "" {
                base = defaultFn()
        }
        return filepath.Join(base, string(l), filepath.Join(elem...))
}

// cachePath defines the base directory relative to which user specific non-essential data files
// should be stored.
func (l lazypath) cachePath(elem ...string) string {
        return l.path(CacheHomeEnvVar, xdg.CacheHomeEnvVar, cacheHome, filepath.Join(elem...))
}

// configPath defines the base directory relative to which user specific configuration files should
// be stored.
func (l lazypath) configPath(elem ...string) string {
        return l.path(ConfigHomeEnvVar, xdg.ConfigHomeEnvVar, configHome, filepath.Join(elem...))
}

// dataPath defines the base directory relative to which user specific data files should be stored.
func (l lazypath) dataPath(elem ...string) string {
        return l.path(DataHomeEnvVar, xdg.DataHomeEnvVar, dataHome, filepath.Join(elem...))
}

// Copyright The Helm Authors.
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at

// http://www.apache.org/licenses/LICENSE-2.0

// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

//go:build !windows && !darwin

package helmpath

import (
        "path/filepath"

        "k8s.io/client-go/util/homedir"
)

// dataHome defines the base directory relative to which user specific data files should be stored.
//
// If $XDG_DATA_HOME is either not set or empty, a default equal to $HOME/.local/share is used.
func dataHome() string {
        return filepath.Join(homedir.HomeDir(), ".local", "share")
}

// configHome defines the base directory relative to which user specific configuration files should
// be stored.
//
// If $XDG_CONFIG_HOME is either not set or empty, a default equal to $HOME/.config is used.
func configHome() string {
        return filepath.Join(homedir.HomeDir(), ".config")
}

// cacheHome defines the base directory relative to which user specific non-essential data files
// should be stored.
//
// If $XDG_CACHE_HOME is either not set or empty, a default equal to $HOME/.cache is used.
func cacheHome() string {
        return filepath.Join(homedir.HomeDir(), ".cache")
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package kube // import "helm.sh/helm/v3/pkg/kube"

import (
        "bytes"
        "context"
        "encoding/json"
        "fmt"
        "io"
        "os"
        "path/filepath"
        "reflect"
        "strings"
        "sync"
        "time"

        jsonpatch "github.com/evanphx/json-patch"
        "github.com/pkg/errors"
        batch "k8s.io/api/batch/v1"
        v1 "k8s.io/api/core/v1"
        apiextv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
        apiextv1beta1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
        apierrors "k8s.io/apimachinery/pkg/api/errors"

        multierror "github.com/hashicorp/go-multierror"
        "k8s.io/apimachinery/pkg/api/meta"
        metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
        "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
        metav1beta1 "k8s.io/apimachinery/pkg/apis/meta/v1beta1"
        "k8s.io/apimachinery/pkg/fields"
        "k8s.io/apimachinery/pkg/labels"
        "k8s.io/apimachinery/pkg/runtime"
        "k8s.io/apimachinery/pkg/types"
        "k8s.io/apimachinery/pkg/util/strategicpatch"
        "k8s.io/apimachinery/pkg/watch"
        "k8s.io/cli-runtime/pkg/genericclioptions"
        "k8s.io/cli-runtime/pkg/resource"
        "k8s.io/client-go/kubernetes"
        "k8s.io/client-go/kubernetes/scheme"
        "k8s.io/client-go/rest"
        cachetools "k8s.io/client-go/tools/cache"
        watchtools "k8s.io/client-go/tools/watch"
        cmdutil "k8s.io/kubectl/pkg/cmd/util"
)

// ErrNoObjectsVisited indicates that during a visit operation, no matching objects were found.
var ErrNoObjectsVisited = errors.New("no objects visited")

var metadataAccessor = meta.NewAccessor()

// ManagedFieldsManager is the name of the manager of Kubernetes managedFields
// first introduced in Kubernetes 1.18
var ManagedFieldsManager string

// Client represents a client capable of communicating with the Kubernetes API.
type Client struct {
        // Factory provides a minimal version of the kubectl Factory interface. If
        // you need the full Factory you can type switch to the full interface.
        // Since Kubernetes Go API does not provide backwards compatibility across
        // minor versions, this API does not follow Helm backwards compatibility.
        // Helm is exposing Kubernetes in this property and cannot guarantee this
        // will not change. The minimal interface only has the functions that Helm
        // needs. The smaller surface area of the interface means there is a lower
        // chance of it changing.
        Factory Factory
        Log     func(string, ...interface{})
        // Namespace allows to bypass the kubeconfig file for the choice of the namespace
        Namespace string

        kubeClient *kubernetes.Clientset
}

var addToScheme sync.Once

// New creates a new Client.
func New(getter genericclioptions.RESTClientGetter) *Client {
        if getter == nil {
                getter = genericclioptions.NewConfigFlags(true)
        }
        // Add CRDs to the scheme. They are missing by default.
        addToScheme.Do(func() {
                if err := apiextv1.AddToScheme(scheme.Scheme); err != nil {
                        // This should never happen.
                        panic(err)
                }
                if err := apiextv1beta1.AddToScheme(scheme.Scheme); err != nil {
                        panic(err)
                }
        })
        return &Client{
                Factory: cmdutil.NewFactory(getter),
                Log:     nopLogger,
        }
}

var nopLogger = func(_ string, _ ...interface{}) {}

// getKubeClient get or create a new KubernetesClientSet
func (c *Client) getKubeClient() (*kubernetes.Clientset, error) {
        var err error
        if c.kubeClient == nil {
                c.kubeClient, err = c.Factory.KubernetesClientSet()
        }

        return c.kubeClient, err
}

// IsReachable tests connectivity to the cluster.
func (c *Client) IsReachable() error {
        client, err := c.getKubeClient()
        if err == genericclioptions.ErrEmptyConfig {
                // re-replace kubernetes ErrEmptyConfig error with a friendy error
                // moar workarounds for Kubernetes API breaking.
                return errors.New("Kubernetes cluster unreachable")
        }
        if err != nil {
                return errors.Wrap(err, "Kubernetes cluster unreachable")
        }
        if _, err := client.ServerVersion(); err != nil {
                return errors.Wrap(err, "Kubernetes cluster unreachable")
        }
        return nil
}

// Create creates Kubernetes resources specified in the resource list.
func (c *Client) Create(resources ResourceList) (*Result, error) {
        c.Log("creating %d resource(s)", len(resources))
        if err := perform(resources, createResource); err != nil {
                return nil, err
        }
        return &Result{Created: resources}, nil
}

func transformRequests(req *rest.Request) {
        tableParam := strings.Join([]string{
                fmt.Sprintf("application/json;as=Table;v=%s;g=%s", metav1.SchemeGroupVersion.Version, metav1.GroupName),
                fmt.Sprintf("application/json;as=Table;v=%s;g=%s", metav1beta1.SchemeGroupVersion.Version, metav1beta1.GroupName),
                "application/json",
        }, ",")
        req.SetHeader("Accept", tableParam)

        // if sorting, ensure we receive the full object in order to introspect its fields via jsonpath
        req.Param("includeObject", "Object")
}

// Get retrieves the resource objects supplied. If related is set to true the
// related pods are fetched as well. If the passed in resources are a table kind
// the related resources will also be fetched as kind=table.
func (c *Client) Get(resources ResourceList, related bool) (map[string][]runtime.Object, error) {
        buf := new(bytes.Buffer)
        objs := make(map[string][]runtime.Object)

        podSelectors := []map[string]string{}
        err := resources.Visit(func(info *resource.Info, err error) error {
                if err != nil {
                        return err
                }

                gvk := info.ResourceMapping().GroupVersionKind
                vk := gvk.Version + "/" + gvk.Kind
                obj, err := getResource(info)
                if err != nil {
                        fmt.Fprintf(buf, "Get resource %s failed, err:%v\n", info.Name, err)
                } else {
                        objs[vk] = append(objs[vk], obj)

                        // Only fetch related pods if they are requested
                        if related {
                                // Discover if the existing object is a table. If it is, request
                                // the pods as Tables. Otherwise request them normally.
                                objGVK := obj.GetObjectKind().GroupVersionKind()
                                var isTable bool
                                if objGVK.Kind == "Table" {
                                        isTable = true
                                }

                                objs, err = c.getSelectRelationPod(info, objs, isTable, &podSelectors)
                                if err != nil {
                                        c.Log("Warning: get the relation pod is failed, err:%s", err.Error())
                                }
                        }
                }

                return nil
        })
        if err != nil {
                return nil, err
        }

        return objs, nil
}

func (c *Client) getSelectRelationPod(info *resource.Info, objs map[string][]runtime.Object, table bool, podSelectors *[]map[string]string) (map[string][]runtime.Object, error) {
        if info == nil {
                return objs, nil
        }
        c.Log("get relation pod of object: %s/%s/%s", info.Namespace, info.Mapping.GroupVersionKind.Kind, info.Name)
        selector, ok, _ := getSelectorFromObject(info.Object)
        if !ok {
                return objs, nil
        }

        for index := range *podSelectors {
                if reflect.DeepEqual((*podSelectors)[index], selector) {
                        // check if pods for selectors are already added. This avoids duplicate printing of pods
                        return objs, nil
                }
        }

        *podSelectors = append(*podSelectors, selector)

        var infos []*resource.Info
        var err error
        if table {
                infos, err = c.Factory.NewBuilder().
                        Unstructured().
                        ContinueOnError().
                        NamespaceParam(info.Namespace).
                        DefaultNamespace().
                        ResourceTypes("pods").
                        LabelSelector(labels.Set(selector).AsSelector().String()).
                        TransformRequests(transformRequests).
                        Do().Infos()
                if err != nil {
                        return objs, err
                }
        } else {
                infos, err = c.Factory.NewBuilder().
                        Unstructured().
                        ContinueOnError().
                        NamespaceParam(info.Namespace).
                        DefaultNamespace().
                        ResourceTypes("pods").
                        LabelSelector(labels.Set(selector).AsSelector().String()).
                        Do().Infos()
                if err != nil {
                        return objs, err
                }
        }
        vk := "v1/Pod(related)"

        for _, info := range infos {
                objs[vk] = append(objs[vk], info.Object)
        }
        return objs, nil
}

func getSelectorFromObject(obj runtime.Object) (map[string]string, bool, error) {
        typed := obj.(*unstructured.Unstructured)
        kind := typed.Object["kind"]
        switch kind {
        case "ReplicaSet", "Deployment", "StatefulSet", "DaemonSet", "Job":
                return unstructured.NestedStringMap(typed.Object, "spec", "selector", "matchLabels")
        case "ReplicationController":
                return unstructured.NestedStringMap(typed.Object, "spec", "selector")
        default:
                return nil, false, nil
        }
}

func getResource(info *resource.Info) (runtime.Object, error) {
        obj, err := resource.NewHelper(info.Client, info.Mapping).Get(info.Namespace, info.Name)
        if err != nil {
                return nil, err
        }
        return obj, nil
}

// Wait waits up to the given timeout for the specified resources to be ready.
func (c *Client) Wait(resources ResourceList, timeout time.Duration) error {
        cs, err := c.getKubeClient()
        if err != nil {
                return err
        }
        checker := NewReadyChecker(cs, c.Log, PausedAsReady(true))
        w := waiter{
                c:       checker,
                log:     c.Log,
                timeout: timeout,
        }
        return w.waitForResources(resources)
}

// WaitWithJobs wait up to the given timeout for the specified resources to be ready, including jobs.
func (c *Client) WaitWithJobs(resources ResourceList, timeout time.Duration) error {
        cs, err := c.getKubeClient()
        if err != nil {
                return err
        }
        checker := NewReadyChecker(cs, c.Log, PausedAsReady(true), CheckJobs(true))
        w := waiter{
                c:       checker,
                log:     c.Log,
                timeout: timeout,
        }
        return w.waitForResources(resources)
}

// WaitForDelete wait up to the given timeout for the specified resources to be deleted.
func (c *Client) WaitForDelete(resources ResourceList, timeout time.Duration) error {
        w := waiter{
                log:     c.Log,
                timeout: timeout,
        }
        return w.waitForDeletedResources(resources)
}

func (c *Client) namespace() string {
        if c.Namespace != "" {
                return c.Namespace
        }
        if ns, _, err := c.Factory.ToRawKubeConfigLoader().Namespace(); err == nil {
                return ns
        }
        return v1.NamespaceDefault
}

// newBuilder returns a new resource builder for structured api objects.
func (c *Client) newBuilder() *resource.Builder {
        return c.Factory.NewBuilder().
                ContinueOnError().
                NamespaceParam(c.namespace()).
                DefaultNamespace().
                Flatten()
}

// Build validates for Kubernetes objects and returns unstructured infos.
func (c *Client) Build(reader io.Reader, validate bool) (ResourceList, error) {
        validationDirective := metav1.FieldValidationIgnore
        if validate {
                validationDirective = metav1.FieldValidationStrict
        }

        schema, err := c.Factory.Validator(validationDirective)
        if err != nil {
                return nil, err
        }
        result, err := c.newBuilder().
                Unstructured().
                Schema(schema).
                Stream(reader, "").
                Do().Infos()
        return result, scrubValidationError(err)
}

// BuildTable validates for Kubernetes objects and returns unstructured infos.
// The returned kind is a Table.
func (c *Client) BuildTable(reader io.Reader, validate bool) (ResourceList, error) {
        validationDirective := metav1.FieldValidationIgnore
        if validate {
                validationDirective = metav1.FieldValidationStrict
        }

        schema, err := c.Factory.Validator(validationDirective)
        if err != nil {
                return nil, err
        }
        result, err := c.newBuilder().
                Unstructured().
                Schema(schema).
                Stream(reader, "").
                TransformRequests(transformRequests).
                Do().Infos()
        return result, scrubValidationError(err)
}

// Update takes the current list of objects and target list of objects and
// creates resources that don't already exist, updates resources that have been
// modified in the target configuration, and deletes resources from the current
// configuration that are not present in the target configuration. If an error
// occurs, a Result will still be returned with the error, containing all
// resource updates, creations, and deletions that were attempted. These can be
// used for cleanup or other logging purposes.
func (c *Client) Update(original, target ResourceList, force bool) (*Result, error) {
        updateErrors := []string{}
        res := &Result{}

        c.Log("checking %d resources for changes", len(target))
        err := target.Visit(func(info *resource.Info, err error) error {
                if err != nil {
                        return err
                }

                helper := resource.NewHelper(info.Client, info.Mapping).WithFieldManager(getManagedFieldsManager())
                if _, err := helper.Get(info.Namespace, info.Name); err != nil {
                        if !apierrors.IsNotFound(err) {
                                return errors.Wrap(err, "could not get information about the resource")
                        }

                        // Append the created resource to the results, even if something fails
                        res.Created = append(res.Created, info)

                        // Since the resource does not exist, create it.
                        if err := createResource(info); err != nil {
                                return errors.Wrap(err, "failed to create resource")
                        }

                        kind := info.Mapping.GroupVersionKind.Kind
                        c.Log("Created a new %s called %q in %s\n", kind, info.Name, info.Namespace)
                        return nil
                }

                originalInfo := original.Get(info)
                if originalInfo == nil {
                        kind := info.Mapping.GroupVersionKind.Kind
                        return errors.Errorf("no %s with the name %q found", kind, info.Name)
                }

                if err := updateResource(c, info, originalInfo.Object, force); err != nil {
                        c.Log("error updating the resource %q:\n\t %v", info.Name, err)
                        updateErrors = append(updateErrors, err.Error())
                }
                // Because we check for errors later, append the info regardless
                res.Updated = append(res.Updated, info)

                return nil
        })

        switch {
        case err != nil:
                return res, err
        case len(updateErrors) != 0:
                return res, errors.Errorf(strings.Join(updateErrors, " && "))
        }

        for _, info := range original.Difference(target) {
                c.Log("Deleting %s %q in namespace %s...", info.Mapping.GroupVersionKind.Kind, info.Name, info.Namespace)

                if err := info.Get(); err != nil {
                        c.Log("Unable to get obj %q, err: %s", info.Name, err)
                        continue
                }
                annotations, err := metadataAccessor.Annotations(info.Object)
                if err != nil {
                        c.Log("Unable to get annotations on %q, err: %s", info.Name, err)
                }
                if annotations != nil && annotations[ResourcePolicyAnno] == KeepPolicy {
                        c.Log("Skipping delete of %q due to annotation [%s=%s]", info.Name, ResourcePolicyAnno, KeepPolicy)
                        continue
                }
                if err := deleteResource(info, metav1.DeletePropagationBackground); err != nil {
                        c.Log("Failed to delete %q, err: %s", info.ObjectName(), err)
                        continue
                }
                res.Deleted = append(res.Deleted, info)
        }
        return res, nil
}

// Delete deletes Kubernetes resources specified in the resources list with
// background cascade deletion. It will attempt to delete all resources even
// if one or more fail and collect any errors. All successfully deleted items
// will be returned in the `Deleted` ResourceList that is part of the result.
func (c *Client) Delete(resources ResourceList) (*Result, []error) {
        return delete(c, resources, metav1.DeletePropagationBackground)
}

// Delete deletes Kubernetes resources specified in the resources list with
// given deletion propagation policy. It will attempt to delete all resources even
// if one or more fail and collect any errors. All successfully deleted items
// will be returned in the `Deleted` ResourceList that is part of the result.
func (c *Client) DeleteWithPropagationPolicy(resources ResourceList, policy metav1.DeletionPropagation) (*Result, []error) {
        return delete(c, resources, policy)
}

func delete(c *Client, resources ResourceList, propagation metav1.DeletionPropagation) (*Result, []error) {
        var errs []error
        res := &Result{}
        mtx := sync.Mutex{}
        err := perform(resources, func(info *resource.Info) error {
                c.Log("Starting delete for %q %s", info.Name, info.Mapping.GroupVersionKind.Kind)
                err := deleteResource(info, propagation)
                if err == nil || apierrors.IsNotFound(err) {
                        if err != nil {
                                c.Log("Ignoring delete failure for %q %s: %v", info.Name, info.Mapping.GroupVersionKind, err)
                        }
                        mtx.Lock()
                        defer mtx.Unlock()
                        res.Deleted = append(res.Deleted, info)
                        return nil
                }
                mtx.Lock()
                defer mtx.Unlock()
                // Collect the error and continue on
                errs = append(errs, err)
                return nil
        })
        if err != nil {
                if errors.Is(err, ErrNoObjectsVisited) {
                        err = fmt.Errorf("object not found, skipping delete: %w", err)
                }
                errs = append(errs, err)
        }
        if errs != nil {
                return nil, errs
        }
        return res, nil
}

func (c *Client) watchTimeout(t time.Duration) func(*resource.Info) error {
        return func(info *resource.Info) error {
                return c.watchUntilReady(t, info)
        }
}

// WatchUntilReady watches the resources given and waits until it is ready.
//
// This method is mainly for hook implementations. It watches for a resource to
// hit a particular milestone. The milestone depends on the Kind.
//
// For most kinds, it checks to see if the resource is marked as Added or Modified
// by the Kubernetes event stream. For some kinds, it does more:
//
//   - Jobs: A job is marked "Ready" when it has successfully completed. This is
//     ascertained by watching the Status fields in a job's output.
//   - Pods: A pod is marked "Ready" when it has successfully completed. This is
//     ascertained by watching the status.phase field in a pod's output.
//
// Handling for other kinds will be added as necessary.
func (c *Client) WatchUntilReady(resources ResourceList, timeout time.Duration) error {
        // For jobs, there's also the option to do poll c.Jobs(namespace).Get():
        // https://github.com/adamreese/kubernetes/blob/master/test/e2e/job.go#L291-L300
        return perform(resources, c.watchTimeout(timeout))
}

func perform(infos ResourceList, fn func(*resource.Info) error) error {
        var result error

        if len(infos) == 0 {
                return ErrNoObjectsVisited
        }

        errs := make(chan error)
        go batchPerform(infos, fn, errs)

        for range infos {
                err := <-errs
                if err != nil {
                        result = multierror.Append(result, err)
                }
        }

        return result
}

// getManagedFieldsManager returns the manager string. If one was set it will be returned.
// Otherwise, one is calculated based on the name of the binary.
func getManagedFieldsManager() string {

        // When a manager is explicitly set use it
        if ManagedFieldsManager != "" {
                return ManagedFieldsManager
        }

        // When no manager is set and no calling application can be found it is unknown
        if len(os.Args[0]) == 0 {
                return "unknown"
        }

        // When there is an application that can be determined and no set manager
        // use the base name. This is one of the ways Kubernetes libs handle figuring
        // names out.
        return filepath.Base(os.Args[0])
}

func batchPerform(infos ResourceList, fn func(*resource.Info) error, errs chan<- error) {
        var kind string
        var wg sync.WaitGroup
        for _, info := range infos {
                currentKind := info.Object.GetObjectKind().GroupVersionKind().Kind
                if kind != currentKind {
                        wg.Wait()
                        kind = currentKind
                }
                wg.Add(1)
                go func(i *resource.Info) {
                        errs <- fn(i)
                        wg.Done()
                }(info)
        }
}

func createResource(info *resource.Info) error {
        obj, err := resource.NewHelper(info.Client, info.Mapping).WithFieldManager(getManagedFieldsManager()).Create(info.Namespace, true, info.Object)
        if err != nil {
                return err
        }
        return info.Refresh(obj, true)
}

func deleteResource(info *resource.Info, policy metav1.DeletionPropagation) error {
        opts := &metav1.DeleteOptions{PropagationPolicy: &policy}
        _, err := resource.NewHelper(info.Client, info.Mapping).WithFieldManager(getManagedFieldsManager()).DeleteWithOptions(info.Namespace, info.Name, opts)
        return err
}

func createPatch(target *resource.Info, current runtime.Object) ([]byte, types.PatchType, error) {
        oldData, err := json.Marshal(current)
        if err != nil {
                return nil, types.StrategicMergePatchType, errors.Wrap(err, "serializing current configuration")
        }
        newData, err := json.Marshal(target.Object)
        if err != nil {
                return nil, types.StrategicMergePatchType, errors.Wrap(err, "serializing target configuration")
        }

        // Fetch the current object for the three way merge
        helper := resource.NewHelper(target.Client, target.Mapping).WithFieldManager(getManagedFieldsManager())
        currentObj, err := helper.Get(target.Namespace, target.Name)
        if err != nil && !apierrors.IsNotFound(err) {
                return nil, types.StrategicMergePatchType, errors.Wrapf(err, "unable to get data for current object %s/%s", target.Namespace, target.Name)
        }

        // Even if currentObj is nil (because it was not found), it will marshal just fine
        currentData, err := json.Marshal(currentObj)
        if err != nil {
                return nil, types.StrategicMergePatchType, errors.Wrap(err, "serializing live configuration")
        }

        // Get a versioned object
        versionedObject := AsVersioned(target)

        // Unstructured objects, such as CRDs, may not have an not registered error
        // returned from ConvertToVersion. Anything that's unstructured should
        // use the jsonpatch.CreateMergePatch. Strategic Merge Patch is not supported
        // on objects like CRDs.
        _, isUnstructured := versionedObject.(runtime.Unstructured)

        // On newer K8s versions, CRDs aren't unstructured but has this dedicated type
        _, isCRD := versionedObject.(*apiextv1beta1.CustomResourceDefinition)

        if isUnstructured || isCRD {
                // fall back to generic JSON merge patch
                patch, err := jsonpatch.CreateMergePatch(oldData, newData)
                return patch, types.MergePatchType, err
        }

        patchMeta, err := strategicpatch.NewPatchMetaFromStruct(versionedObject)
        if err != nil {
                return nil, types.StrategicMergePatchType, errors.Wrap(err, "unable to create patch metadata from object")
        }

        patch, err := strategicpatch.CreateThreeWayMergePatch(oldData, newData, currentData, patchMeta, true)
        return patch, types.StrategicMergePatchType, err
}

func updateResource(c *Client, target *resource.Info, currentObj runtime.Object, force bool) error {
        var (
                obj    runtime.Object
                helper = resource.NewHelper(target.Client, target.Mapping).WithFieldManager(getManagedFieldsManager())
                kind   = target.Mapping.GroupVersionKind.Kind
        )

        // if --force is applied, attempt to replace the existing resource with the new object.
        if force {
                var err error
                obj, err = helper.Replace(target.Namespace, target.Name, true, target.Object)
                if err != nil {
                        return errors.Wrap(err, "failed to replace object")
                }
                c.Log("Replaced %q with kind %s for kind %s", target.Name, currentObj.GetObjectKind().GroupVersionKind().Kind, kind)
        } else {
                patch, patchType, err := createPatch(target, currentObj)
                if err != nil {
                        return errors.Wrap(err, "failed to create patch")
                }

                if patch == nil || string(patch) == "{}" {
                        c.Log("Looks like there are no changes for %s %q", kind, target.Name)
                        // This needs to happen to make sure that Helm has the latest info from the API
                        // Otherwise there will be no labels and other functions that use labels will panic
                        if err := target.Get(); err != nil {
                                return errors.Wrap(err, "failed to refresh resource information")
                        }
                        return nil
                }
                // send patch to server
                c.Log("Patch %s %q in namespace %s", kind, target.Name, target.Namespace)
                obj, err = helper.Patch(target.Namespace, target.Name, patchType, patch, nil)
                if err != nil {
                        return errors.Wrapf(err, "cannot patch %q with kind %s", target.Name, kind)
                }
        }

        target.Refresh(obj, true)
        return nil
}

func (c *Client) watchUntilReady(timeout time.Duration, info *resource.Info) error {
        kind := info.Mapping.GroupVersionKind.Kind
        switch kind {
        case "Job", "Pod":
        default:
                return nil
        }

        c.Log("Watching for changes to %s %s with timeout of %v", kind, info.Name, timeout)

        // Use a selector on the name of the resource. This should be unique for the
        // given version and kind
        selector, err := fields.ParseSelector(fmt.Sprintf("metadata.name=%s", info.Name))
        if err != nil {
                return err
        }
        lw := cachetools.NewListWatchFromClient(info.Client, info.Mapping.Resource.Resource, info.Namespace, selector)

        // What we watch for depends on the Kind.
        // - For a Job, we watch for completion.
        // - For all else, we watch until Ready.
        // In the future, we might want to add some special logic for types
        // like Ingress, Volume, etc.

        ctx, cancel := watchtools.ContextWithOptionalTimeout(context.Background(), timeout)
        defer cancel()
        _, err = watchtools.UntilWithSync(ctx, lw, &unstructured.Unstructured{}, nil, func(e watch.Event) (bool, error) {
                // Make sure the incoming object is versioned as we use unstructured
                // objects when we build manifests
                obj := convertWithMapper(e.Object, info.Mapping)
                switch e.Type {
                case watch.Added, watch.Modified:
                        // For things like a secret or a config map, this is the best indicator
                        // we get. We care mostly about jobs, where what we want to see is
                        // the status go into a good state. For other types, like ReplicaSet
                        // we don't really do anything to support these as hooks.
                        c.Log("Add/Modify event for %s: %v", info.Name, e.Type)
                        switch kind {
                        case "Job":
                                return c.waitForJob(obj, info.Name)
                        case "Pod":
                                return c.waitForPodSuccess(obj, info.Name)
                        }
                        return true, nil
                case watch.Deleted:
                        c.Log("Deleted event for %s", info.Name)
                        return true, nil
                case watch.Error:
                        // Handle error and return with an error.
                        c.Log("Error event for %s", info.Name)
                        return true, errors.Errorf("failed to deploy %s", info.Name)
                default:
                        return false, nil
                }
        })
        return err
}

// waitForJob is a helper that waits for a job to complete.
//
// This operates on an event returned from a watcher.
func (c *Client) waitForJob(obj runtime.Object, name string) (bool, error) {
        o, ok := obj.(*batch.Job)
        if !ok {
                return true, errors.Errorf("expected %s to be a *batch.Job, got %T", name, obj)
        }

        for _, c := range o.Status.Conditions {
                if c.Type == batch.JobComplete && c.Status == "True" {
                        return true, nil
                } else if c.Type == batch.JobFailed && c.Status == "True" {
                        return true, errors.Errorf("job failed: %s", c.Reason)
                }
        }

        c.Log("%s: Jobs active: %d, jobs failed: %d, jobs succeeded: %d", name, o.Status.Active, o.Status.Failed, o.Status.Succeeded)
        return false, nil
}

// waitForPodSuccess is a helper that waits for a pod to complete.
//
// This operates on an event returned from a watcher.
func (c *Client) waitForPodSuccess(obj runtime.Object, name string) (bool, error) {
        o, ok := obj.(*v1.Pod)
        if !ok {
                return true, errors.Errorf("expected %s to be a *v1.Pod, got %T", name, obj)
        }

        switch o.Status.Phase {
        case v1.PodSucceeded:
                c.Log("Pod %s succeeded", o.Name)
                return true, nil
        case v1.PodFailed:
                return true, errors.Errorf("pod %s failed", o.Name)
        case v1.PodPending:
                c.Log("Pod %s pending", o.Name)
        case v1.PodRunning:
                c.Log("Pod %s running", o.Name)
        }

        return false, nil
}

// scrubValidationError removes kubectl info from the message.
func scrubValidationError(err error) error {
        if err == nil {
                return nil
        }
        const stopValidateMessage = "if you choose to ignore these errors, turn validation off with --validate=false"

        if strings.Contains(err.Error(), stopValidateMessage) {
                return errors.New(strings.ReplaceAll(err.Error(), "; "+stopValidateMessage, ""))
        }
        return err
}

// WaitAndGetCompletedPodPhase waits up to a timeout until a pod enters a completed phase
// and returns said phase (PodSucceeded or PodFailed qualify).
func (c *Client) WaitAndGetCompletedPodPhase(name string, timeout time.Duration) (v1.PodPhase, error) {
        client, err := c.getKubeClient()
        if err != nil {
                return v1.PodUnknown, err
        }
        to := int64(timeout)
        watcher, err := client.CoreV1().Pods(c.namespace()).Watch(context.Background(), metav1.ListOptions{
                FieldSelector:  fmt.Sprintf("metadata.name=%s", name),
                TimeoutSeconds: &to,
        })
        if err != nil {
                return v1.PodUnknown, err
        }

        for event := range watcher.ResultChan() {
                p, ok := event.Object.(*v1.Pod)
                if !ok {
                        return v1.PodUnknown, fmt.Errorf("%s not a pod", name)
                }
                switch p.Status.Phase {
                case v1.PodFailed:
                        return v1.PodFailed, nil
                case v1.PodSucceeded:
                        return v1.PodSucceeded, nil
                }
        }

        return v1.PodUnknown, err
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package kube

import (
        "bytes"
        "io"
        "net/http"
        "strings"
        "testing"

        v1 "k8s.io/api/core/v1"
        metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
        "k8s.io/apimachinery/pkg/runtime"
        "k8s.io/cli-runtime/pkg/resource"
        "k8s.io/client-go/kubernetes/scheme"
        "k8s.io/client-go/rest/fake"
        cmdtesting "k8s.io/kubectl/pkg/cmd/testing"
)

var unstructuredSerializer = resource.UnstructuredPlusDefaultContentConfig().NegotiatedSerializer
var codec = scheme.Codecs.LegacyCodec(scheme.Scheme.PrioritizedVersionsAllGroups()...)

func objBody(obj runtime.Object) io.ReadCloser {
        return io.NopCloser(bytes.NewReader([]byte(runtime.EncodeOrDie(codec, obj))))
}

func newPod(name string) v1.Pod {
        return newPodWithStatus(name, v1.PodStatus{}, "")
}

func newPodWithStatus(name string, status v1.PodStatus, namespace string) v1.Pod {
        ns := v1.NamespaceDefault
        if namespace != "" {
                ns = namespace
        }
        return v1.Pod{
                ObjectMeta: metav1.ObjectMeta{
                        Name:      name,
                        Namespace: ns,
                        SelfLink:  "/api/v1/namespaces/default/pods/" + name,
                },
                Spec: v1.PodSpec{
                        Containers: []v1.Container{{
                                Name:  "app:v4",
                                Image: "abc/app:v4",
                                Ports: []v1.ContainerPort{{Name: "http", ContainerPort: 80}},
                        }},
                },
                Status: status,
        }
}

func newPodList(names ...string) v1.PodList {
        var list v1.PodList
        for _, name := range names {
                list.Items = append(list.Items, newPod(name))
        }
        return list
}

func notFoundBody() *metav1.Status {
        return &metav1.Status{
                Code:    http.StatusNotFound,
                Status:  metav1.StatusFailure,
                Reason:  metav1.StatusReasonNotFound,
                Message: " \"\" not found",
                Details: &metav1.StatusDetails{},
        }
}

func newResponse(code int, obj runtime.Object) (*http.Response, error) {
        header := http.Header{}
        header.Set("Content-Type", runtime.ContentTypeJSON)
        body := io.NopCloser(bytes.NewReader([]byte(runtime.EncodeOrDie(codec, obj))))
        return &http.Response{StatusCode: code, Header: header, Body: body}, nil
}

func newTestClient(t *testing.T) *Client {
        testFactory := cmdtesting.NewTestFactory()
        t.Cleanup(testFactory.Cleanup)

        return &Client{
                Factory: testFactory.WithNamespace("default"),
                Log:     nopLogger,
        }
}

func TestUpdate(t *testing.T) {
        listA := newPodList("starfish", "otter", "squid")
        listB := newPodList("starfish", "otter", "dolphin")
        listC := newPodList("starfish", "otter", "dolphin")
        listB.Items[0].Spec.Containers[0].Ports = []v1.ContainerPort{{Name: "https", ContainerPort: 443}}
        listC.Items[0].Spec.Containers[0].Ports = []v1.ContainerPort{{Name: "https", ContainerPort: 443}}

        var actions []string

        c := newTestClient(t)
        c.Factory.(*cmdtesting.TestFactory).UnstructuredClient = &fake.RESTClient{
                NegotiatedSerializer: unstructuredSerializer,
                Client: fake.CreateHTTPClient(func(req *http.Request) (*http.Response, error) {
                        p, m := req.URL.Path, req.Method
                        actions = append(actions, p+":"+m)
                        t.Logf("got request %s %s", p, m)
                        switch {
                        case p == "/namespaces/default/pods/starfish" && m == "GET":
                                return newResponse(200, &listA.Items[0])
                        case p == "/namespaces/default/pods/otter" && m == "GET":
                                return newResponse(200, &listA.Items[1])
                        case p == "/namespaces/default/pods/otter" && m == "PATCH":
                                data, err := io.ReadAll(req.Body)
                                if err != nil {
                                        t.Fatalf("could not dump request: %s", err)
                                }
                                req.Body.Close()
                                expected := `{}`
                                if string(data) != expected {
                                        t.Errorf("expected patch\n%s\ngot\n%s", expected, string(data))
                                }
                                return newResponse(200, &listB.Items[0])
                        case p == "/namespaces/default/pods/dolphin" && m == "GET":
                                return newResponse(404, notFoundBody())
                        case p == "/namespaces/default/pods/starfish" && m == "PATCH":
                                data, err := io.ReadAll(req.Body)
                                if err != nil {
                                        t.Fatalf("could not dump request: %s", err)
                                }
                                req.Body.Close()
                                expected := `{"spec":{"$setElementOrder/containers":[{"name":"app:v4"}],"containers":[{"$setElementOrder/ports":[{"containerPort":443}],"name":"app:v4","ports":[{"containerPort":443,"name":"https"},{"$patch":"delete","containerPort":80}]}]}}`
                                if string(data) != expected {
                                        t.Errorf("expected patch\n%s\ngot\n%s", expected, string(data))
                                }
                                return newResponse(200, &listB.Items[0])
                        case p == "/namespaces/default/pods" && m == "POST":
                                return newResponse(200, &listB.Items[1])
                        case p == "/namespaces/default/pods/squid" && m == "DELETE":
                                return newResponse(200, &listB.Items[1])
                        case p == "/namespaces/default/pods/squid" && m == "GET":
                                return newResponse(200, &listB.Items[2])
                        default:
                                t.Fatalf("unexpected request: %s %s", req.Method, req.URL.Path)
                                return nil, nil
                        }
                }),
        }
        first, err := c.Build(objBody(&listA), false)
        if err != nil {
                t.Fatal(err)
        }
        second, err := c.Build(objBody(&listB), false)
        if err != nil {
                t.Fatal(err)
        }

        result, err := c.Update(first, second, false)
        if err != nil {
                t.Fatal(err)
        }

        if len(result.Created) != 1 {
                t.Errorf("expected 1 resource created, got %d", len(result.Created))
        }
        if len(result.Updated) != 2 {
                t.Errorf("expected 2 resource updated, got %d", len(result.Updated))
        }
        if len(result.Deleted) != 1 {
                t.Errorf("expected 1 resource deleted, got %d", len(result.Deleted))
        }

        // TODO: Find a way to test methods that use Client Set
        // Test with a wait
        // if err := c.Update("test", objBody(codec, &listB), objBody(codec, &listC), false, 300, true); err != nil {
        //         t.Fatal(err)
        // }
        // Test with a wait should fail
        // TODO: A way to make this not based off of an extremely short timeout?
        // if err := c.Update("test", objBody(codec, &listC), objBody(codec, &listA), false, 2, true); err != nil {
        //         t.Fatal(err)
        // }
        expectedActions := []string{
                "/namespaces/default/pods/starfish:GET",
                "/namespaces/default/pods/starfish:GET",
                "/namespaces/default/pods/starfish:PATCH",
                "/namespaces/default/pods/otter:GET",
                "/namespaces/default/pods/otter:GET",
                "/namespaces/default/pods/otter:GET",
                "/namespaces/default/pods/dolphin:GET",
                "/namespaces/default/pods:POST",
                "/namespaces/default/pods/squid:GET",
                "/namespaces/default/pods/squid:DELETE",
        }
        if len(expectedActions) != len(actions) {
                t.Fatalf("unexpected number of requests, expected %d, got %d", len(expectedActions), len(actions))
        }
        for k, v := range expectedActions {
                if actions[k] != v {
                        t.Errorf("expected %s request got %s", v, actions[k])
                }
        }
}

func TestBuild(t *testing.T) {
        tests := []struct {
                name      string
                namespace string
                reader    io.Reader
                count     int
                err       bool
        }{
                {
                        name:      "Valid input",
                        namespace: "test",
                        reader:    strings.NewReader(guestbookManifest),
                        count:     6,
                }, {
                        name:      "Valid input, deploying resources into different namespaces",
                        namespace: "test",
                        reader:    strings.NewReader(namespacedGuestbookManifest),
                        count:     1,
                },
        }

        c := newTestClient(t)
        for _, tt := range tests {
                t.Run(tt.name, func(t *testing.T) {
                        // Test for an invalid manifest
                        infos, err := c.Build(tt.reader, false)
                        if err != nil && !tt.err {
                                t.Errorf("Got error message when no error should have occurred: %v", err)
                        } else if err != nil && strings.Contains(err.Error(), "--validate=false") {
                                t.Error("error message was not scrubbed")
                        }

                        if len(infos) != tt.count {
                                t.Errorf("expected %d result objects, got %d", tt.count, len(infos))
                        }
                })
        }
}

func TestBuildTable(t *testing.T) {
        tests := []struct {
                name      string
                namespace string
                reader    io.Reader
                count     int
                err       bool
        }{
                {
                        name:      "Valid input",
                        namespace: "test",
                        reader:    strings.NewReader(guestbookManifest),
                        count:     6,
                }, {
                        name:      "Valid input, deploying resources into different namespaces",
                        namespace: "test",
                        reader:    strings.NewReader(namespacedGuestbookManifest),
                        count:     1,
                },
        }

        c := newTestClient(t)
        for _, tt := range tests {
                t.Run(tt.name, func(t *testing.T) {
                        // Test for an invalid manifest
                        infos, err := c.BuildTable(tt.reader, false)
                        if err != nil && !tt.err {
                                t.Errorf("Got error message when no error should have occurred: %v", err)
                        } else if err != nil && strings.Contains(err.Error(), "--validate=false") {
                                t.Error("error message was not scrubbed")
                        }

                        if len(infos) != tt.count {
                                t.Errorf("expected %d result objects, got %d", tt.count, len(infos))
                        }
                })
        }
}

func TestPerform(t *testing.T) {
        tests := []struct {
                name       string
                reader     io.Reader
                count      int
                err        bool
                errMessage string
        }{
                {
                        name:   "Valid input",
                        reader: strings.NewReader(guestbookManifest),
                        count:  6,
                }, {
                        name:       "Empty manifests",
                        reader:     strings.NewReader(""),
                        err:        true,
                        errMessage: "no objects visited",
                },
        }

        for _, tt := range tests {
                t.Run(tt.name, func(t *testing.T) {
                        results := []*resource.Info{}

                        fn := func(info *resource.Info) error {
                                results = append(results, info)
                                return nil
                        }

                        c := newTestClient(t)
                        infos, err := c.Build(tt.reader, false)
                        if err != nil && err.Error() != tt.errMessage {
                                t.Errorf("Error while building manifests: %v", err)
                        }

                        err = perform(infos, fn)
                        if (err != nil) != tt.err {
                                t.Errorf("expected error: %v, got %v", tt.err, err)
                        }
                        if err != nil && err.Error() != tt.errMessage {
                                t.Errorf("expected error message: %v, got %v", tt.errMessage, err)
                        }

                        if len(results) != tt.count {
                                t.Errorf("expected %d result objects, got %d", tt.count, len(results))
                        }
                })
        }
}

func TestReal(t *testing.T) {
        t.Skip("This is a live test, comment this line to run")
        c := New(nil)
        resources, err := c.Build(strings.NewReader(guestbookManifest), false)
        if err != nil {
                t.Fatal(err)
        }
        if _, err := c.Create(resources); err != nil {
                t.Fatal(err)
        }

        testSvcEndpointManifest := testServiceManifest + "\n---\n" + testEndpointManifest
        c = New(nil)
        resources, err = c.Build(strings.NewReader(testSvcEndpointManifest), false)
        if err != nil {
                t.Fatal(err)
        }
        if _, err := c.Create(resources); err != nil {
                t.Fatal(err)
        }

        resources, err = c.Build(strings.NewReader(testEndpointManifest), false)
        if err != nil {
                t.Fatal(err)
        }

        if _, errs := c.Delete(resources); errs != nil {
                t.Fatal(errs)
        }

        resources, err = c.Build(strings.NewReader(testSvcEndpointManifest), false)
        if err != nil {
                t.Fatal(err)
        }
        // ensures that delete does not fail if a resource is not found
        if _, errs := c.Delete(resources); errs != nil {
                t.Fatal(errs)
        }
}

const testServiceManifest = `
kind: Service
apiVersion: v1
metadata:
  name: my-service
spec:
  selector:
    app: myapp
  ports:
    - port: 80
      protocol: TCP
      targetPort: 9376
`

const testEndpointManifest = `
kind: Endpoints
apiVersion: v1
metadata:
  name: my-service
subsets:
  - addresses:
      - ip: "1.2.3.4"
    ports:
      - port: 9376
`

const guestbookManifest = `
apiVersion: v1
kind: Service
metadata:
  name: redis-master
  labels:
    app: redis
    tier: backend
    role: master
spec:
  ports:
  - port: 6379
    targetPort: 6379
  selector:
    app: redis
    tier: backend
    role: master
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: redis-master
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: redis
        role: master
        tier: backend
    spec:
      containers:
      - name: master
        image: registry.k8s.io/redis:e2e  # or just image: redis
        resources:
          requests:
            cpu: 100m
            memory: 100Mi
        ports:
        - containerPort: 6379
---
apiVersion: v1
kind: Service
metadata:
  name: redis-slave
  labels:
    app: redis
    tier: backend
    role: slave
spec:
  ports:
    # the port that this service should serve on
  - port: 6379
  selector:
    app: redis
    tier: backend
    role: slave
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: redis-slave
spec:
  replicas: 2
  template:
    metadata:
      labels:
        app: redis
        role: slave
        tier: backend
    spec:
      containers:
      - name: slave
        image: gcr.io/google_samples/gb-redisslave:v1
        resources:
          requests:
            cpu: 100m
            memory: 100Mi
        env:
        - name: GET_HOSTS_FROM
          value: dns
        ports:
        - containerPort: 6379
---
apiVersion: v1
kind: Service
metadata:
  name: frontend
  labels:
    app: guestbook
    tier: frontend
spec:
  ports:
  - port: 80
  selector:
    app: guestbook
    tier: frontend
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: frontend
spec:
  replicas: 3
  template:
    metadata:
      labels:
        app: guestbook
        tier: frontend
    spec:
      containers:
      - name: php-redis
        image: gcr.io/google-samples/gb-frontend:v4
        resources:
          requests:
            cpu: 100m
            memory: 100Mi
        env:
        - name: GET_HOSTS_FROM
          value: dns
        ports:
        - containerPort: 80
`

const namespacedGuestbookManifest = `
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: frontend
  namespace: guestbook
spec:
  replicas: 3
  template:
    metadata:
      labels:
        app: guestbook
        tier: frontend
    spec:
      containers:
      - name: php-redis
        image: gcr.io/google-samples/gb-frontend:v4
        resources:
          requests:
            cpu: 100m
            memory: 100Mi
        env:
        - name: GET_HOSTS_FROM
          value: dns
        ports:
        - containerPort: 80
`

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package kube // import "helm.sh/helm/v3/pkg/kube"

import "k8s.io/cli-runtime/pkg/genericclioptions"

// GetConfig returns a Kubernetes client config.
//
// Deprecated
func GetConfig(kubeconfig, context, namespace string) *genericclioptions.ConfigFlags {
        cf := genericclioptions.NewConfigFlags(true)
        cf.Namespace = &namespace
        cf.Context = &context
        cf.KubeConfig = &kubeconfig
        return cf
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package kube // import "helm.sh/helm/v3/pkg/kube"

import (
        "sync"

        apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
        apiextensionsv1beta1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
        "k8s.io/apimachinery/pkg/api/meta"
        "k8s.io/apimachinery/pkg/runtime"
        "k8s.io/apimachinery/pkg/runtime/schema"
        "k8s.io/cli-runtime/pkg/resource"
        "k8s.io/client-go/kubernetes/scheme"
)

var k8sNativeScheme *runtime.Scheme
var k8sNativeSchemeOnce sync.Once

// AsVersioned converts the given info into a runtime.Object with the correct
// group and version set
func AsVersioned(info *resource.Info) runtime.Object {
        return convertWithMapper(info.Object, info.Mapping)
}

// convertWithMapper converts the given object with the optional provided
// RESTMapping. If no mapping is provided, the default schema versioner is used
func convertWithMapper(obj runtime.Object, mapping *meta.RESTMapping) runtime.Object {
        s := kubernetesNativeScheme()
        var gv = runtime.GroupVersioner(schema.GroupVersions(s.PrioritizedVersionsAllGroups()))
        if mapping != nil {
                gv = mapping.GroupVersionKind.GroupVersion()
        }
        if obj, err := runtime.ObjectConvertor(s).ConvertToVersion(obj, gv); err == nil {
                return obj
        }
        return obj
}

// kubernetesNativeScheme returns a clean *runtime.Scheme with _only_ Kubernetes
// native resources added to it. This is required to break free of custom resources
// that may have been added to scheme.Scheme due to Helm being used as a package in
// combination with e.g. a versioned kube client. If we would not do this, the client
// may attempt to perform e.g. a 3-way-merge strategy patch for custom resources.
func kubernetesNativeScheme() *runtime.Scheme {
        k8sNativeSchemeOnce.Do(func() {
                k8sNativeScheme = runtime.NewScheme()
                scheme.AddToScheme(k8sNativeScheme)
                // API extensions are not in the above scheme set,
                // and must thus be added separately.
                apiextensionsv1beta1.AddToScheme(k8sNativeScheme)
                apiextensionsv1.AddToScheme(k8sNativeScheme)
        })
        return k8sNativeScheme
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

// Package fake implements various fake KubeClients for use in testing
package fake

import (
        "io"
        "time"

        v1 "k8s.io/api/core/v1"
        metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
        "k8s.io/apimachinery/pkg/runtime"
        "k8s.io/cli-runtime/pkg/resource"

        "helm.sh/helm/v3/pkg/kube"
)

// FailingKubeClient implements KubeClient for testing purposes. It also has
// additional errors you can set to fail different functions, otherwise it
// delegates all its calls to `PrintingKubeClient`
type FailingKubeClient struct {
        PrintingKubeClient
        CreateError                      error
        GetError                         error
        WaitError                        error
        DeleteError                      error
        DeleteWithPropagationError       error
        WatchUntilReadyError             error
        UpdateError                      error
        BuildError                       error
        BuildTableError                  error
        BuildDummy                       bool
        BuildUnstructuredError           error
        WaitAndGetCompletedPodPhaseError error
        WaitDuration                     time.Duration
}

// Create returns the configured error if set or prints
func (f *FailingKubeClient) Create(resources kube.ResourceList) (*kube.Result, error) {
        if f.CreateError != nil {
                return nil, f.CreateError
        }
        return f.PrintingKubeClient.Create(resources)
}

// Get returns the configured error if set or prints
func (f *FailingKubeClient) Get(resources kube.ResourceList, related bool) (map[string][]runtime.Object, error) {
        if f.GetError != nil {
                return nil, f.GetError
        }
        return f.PrintingKubeClient.Get(resources, related)
}

// Waits the amount of time defined on f.WaitDuration, then returns the configured error if set or prints.
func (f *FailingKubeClient) Wait(resources kube.ResourceList, d time.Duration) error {
        time.Sleep(f.WaitDuration)
        if f.WaitError != nil {
                return f.WaitError
        }
        return f.PrintingKubeClient.Wait(resources, d)
}

// WaitWithJobs returns the configured error if set or prints
func (f *FailingKubeClient) WaitWithJobs(resources kube.ResourceList, d time.Duration) error {
        if f.WaitError != nil {
                return f.WaitError
        }
        return f.PrintingKubeClient.WaitWithJobs(resources, d)
}

// WaitForDelete returns the configured error if set or prints
func (f *FailingKubeClient) WaitForDelete(resources kube.ResourceList, d time.Duration) error {
        if f.WaitError != nil {
                return f.WaitError
        }
        return f.PrintingKubeClient.WaitForDelete(resources, d)
}

// Delete returns the configured error if set or prints
func (f *FailingKubeClient) Delete(resources kube.ResourceList) (*kube.Result, []error) {
        if f.DeleteError != nil {
                return nil, []error{f.DeleteError}
        }
        return f.PrintingKubeClient.Delete(resources)
}

// WatchUntilReady returns the configured error if set or prints
func (f *FailingKubeClient) WatchUntilReady(resources kube.ResourceList, d time.Duration) error {
        if f.WatchUntilReadyError != nil {
                return f.WatchUntilReadyError
        }
        return f.PrintingKubeClient.WatchUntilReady(resources, d)
}

// Update returns the configured error if set or prints
func (f *FailingKubeClient) Update(r, modified kube.ResourceList, ignoreMe bool) (*kube.Result, error) {
        if f.UpdateError != nil {
                return &kube.Result{}, f.UpdateError
        }
        return f.PrintingKubeClient.Update(r, modified, ignoreMe)
}

// Build returns the configured error if set or prints
func (f *FailingKubeClient) Build(r io.Reader, _ bool) (kube.ResourceList, error) {
        if f.BuildError != nil {
                return []*resource.Info{}, f.BuildError
        }
        if f.BuildDummy {
                return createDummyResourceList(), nil
        }
        return f.PrintingKubeClient.Build(r, false)
}

// BuildTable returns the configured error if set or prints
func (f *FailingKubeClient) BuildTable(r io.Reader, _ bool) (kube.ResourceList, error) {
        if f.BuildTableError != nil {
                return []*resource.Info{}, f.BuildTableError
        }
        return f.PrintingKubeClient.BuildTable(r, false)
}

// WaitAndGetCompletedPodPhase returns the configured error if set or prints
func (f *FailingKubeClient) WaitAndGetCompletedPodPhase(s string, d time.Duration) (v1.PodPhase, error) {
        if f.WaitAndGetCompletedPodPhaseError != nil {
                return v1.PodSucceeded, f.WaitAndGetCompletedPodPhaseError
        }
        return f.PrintingKubeClient.WaitAndGetCompletedPodPhase(s, d)
}

// DeleteWithPropagationPolicy returns the configured error if set or prints
func (f *FailingKubeClient) DeleteWithPropagationPolicy(resources kube.ResourceList, policy metav1.DeletionPropagation) (*kube.Result, []error) {
        if f.DeleteWithPropagationError != nil {
                return nil, []error{f.DeleteWithPropagationError}
        }
        return f.PrintingKubeClient.DeleteWithPropagationPolicy(resources, policy)
}

func createDummyResourceList() kube.ResourceList {
        var resInfo resource.Info
        resInfo.Name = "dummyName"
        resInfo.Namespace = "dummyNamespace"
        var resourceList kube.ResourceList
        resourceList.Append(&resInfo)
        return resourceList

}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package fake

import (
        "io"
        "strings"
        "time"

        v1 "k8s.io/api/core/v1"
        metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
        "k8s.io/apimachinery/pkg/runtime"
        "k8s.io/cli-runtime/pkg/resource"

        "helm.sh/helm/v3/pkg/kube"
)

// PrintingKubeClient implements KubeClient, but simply prints the reader to
// the given output.
type PrintingKubeClient struct {
        Out io.Writer
}

// IsReachable checks if the cluster is reachable
func (p *PrintingKubeClient) IsReachable() error {
        return nil
}

// Create prints the values of what would be created with a real KubeClient.
func (p *PrintingKubeClient) Create(resources kube.ResourceList) (*kube.Result, error) {
        _, err := io.Copy(p.Out, bufferize(resources))
        if err != nil {
                return nil, err
        }
        return &kube.Result{Created: resources}, nil
}

func (p *PrintingKubeClient) Get(resources kube.ResourceList, related bool) (map[string][]runtime.Object, error) {
        _, err := io.Copy(p.Out, bufferize(resources))
        if err != nil {
                return nil, err
        }
        return make(map[string][]runtime.Object), nil
}

func (p *PrintingKubeClient) Wait(resources kube.ResourceList, _ time.Duration) error {
        _, err := io.Copy(p.Out, bufferize(resources))
        return err
}

func (p *PrintingKubeClient) WaitWithJobs(resources kube.ResourceList, _ time.Duration) error {
        _, err := io.Copy(p.Out, bufferize(resources))
        return err
}

func (p *PrintingKubeClient) WaitForDelete(resources kube.ResourceList, _ time.Duration) error {
        _, err := io.Copy(p.Out, bufferize(resources))
        return err
}

// Delete implements KubeClient delete.
//
// It only prints out the content to be deleted.
func (p *PrintingKubeClient) Delete(resources kube.ResourceList) (*kube.Result, []error) {
        _, err := io.Copy(p.Out, bufferize(resources))
        if err != nil {
                return nil, []error{err}
        }
        return &kube.Result{Deleted: resources}, nil
}

// WatchUntilReady implements KubeClient WatchUntilReady.
func (p *PrintingKubeClient) WatchUntilReady(resources kube.ResourceList, _ time.Duration) error {
        _, err := io.Copy(p.Out, bufferize(resources))
        return err
}

// Update implements KubeClient Update.
func (p *PrintingKubeClient) Update(_, modified kube.ResourceList, _ bool) (*kube.Result, error) {
        _, err := io.Copy(p.Out, bufferize(modified))
        if err != nil {
                return nil, err
        }
        // TODO: This doesn't completely mock out have some that get created,
        // updated, and deleted. I don't think these are used in any unit tests, but
        // we may want to refactor a way to handle future tests
        return &kube.Result{Updated: modified}, nil
}

// Build implements KubeClient Build.
func (p *PrintingKubeClient) Build(_ io.Reader, _ bool) (kube.ResourceList, error) {
        return []*resource.Info{}, nil
}

// BuildTable implements KubeClient BuildTable.
func (p *PrintingKubeClient) BuildTable(_ io.Reader, _ bool) (kube.ResourceList, error) {
        return []*resource.Info{}, nil
}

// WaitAndGetCompletedPodPhase implements KubeClient WaitAndGetCompletedPodPhase.
func (p *PrintingKubeClient) WaitAndGetCompletedPodPhase(_ string, _ time.Duration) (v1.PodPhase, error) {
        return v1.PodSucceeded, nil
}

// DeleteWithPropagationPolicy implements KubeClient delete.
//
// It only prints out the content to be deleted.
func (p *PrintingKubeClient) DeleteWithPropagationPolicy(resources kube.ResourceList, policy metav1.DeletionPropagation) (*kube.Result, []error) {
        _, err := io.Copy(p.Out, bufferize(resources))
        if err != nil {
                return nil, []error{err}
        }
        return &kube.Result{Deleted: resources}, nil
}

func bufferize(resources kube.ResourceList) io.Reader {
        var builder strings.Builder
        for _, info := range resources {
                builder.WriteString(info.String() + "\n")
        }
        return strings.NewReader(builder.String())
}

// Copyright 2022 ADA Logics Ltd
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

package kube

import (
        "bytes"
        "fmt"
        fuzz "github.com/AdaLogics/go-fuzz-headers"
        "io"
        "io/ioutil"
        v1 "k8s.io/api/core/v1"
        "k8s.io/apimachinery/pkg/runtime"
        "k8s.io/client-go/kubernetes/scheme"
        "k8s.io/client-go/rest/fake"
        cmdtesting "k8s.io/kubectl/pkg/cmd/testing"
        "net/http"
        "testing"
)

var fuzzCodec = scheme.Codecs.LegacyCodec(scheme.Scheme.PrioritizedVersionsAllGroups()...)

func createPod(f *fuzz.ConsumeFuzzer) (v1.Pod, error) {
        pod := v1.Pod{}
        err := f.GenerateStruct(&pod)
        if err != nil {
                return pod, err
        }
        return pod, nil
}

func createPodList(f *fuzz.ConsumeFuzzer) (v1.PodList, error) {
        var list v1.PodList
        noOfPods, err := f.GetInt()
        if err != nil {
                return list, err
        }
        for i := 0; i < noOfPods%20; i++ {
                newPod, err := createPod(f)
                if err != nil {
                        return list, err
                }
                list.Items = append(list.Items, newPod)
        }
        return list, nil
}

func objBodyFuzz(obj runtime.Object) (io.ReadCloser, error) {
        bodyBytes, err := runtime.Encode(fuzzCodec, obj)
        if err != nil {
                return nil, err
        }
        return ioutil.NopCloser(bytes.NewReader([]byte(bodyBytes))), nil
}

func newResponseFuzz(code int, obj runtime.Object) (*http.Response, error) {
        header := http.Header{}
        header.Set("Content-Type", runtime.ContentTypeJSON)
        objBody, err := runtime.Encode(codec, obj)
        if err != nil {
                return &http.Response{}, err
        }
        body := ioutil.NopCloser(bytes.NewReader([]byte(objBody)))
        return &http.Response{StatusCode: code, Header: header, Body: body}, nil
}

func FuzzKubeClient(data []byte) int {
        f := fuzz.NewConsumer(data)
        listA, err := createPodList(f)
        if err != nil {
                return 0
        }
        objBodyA, err := objBodyFuzz(&listA)
        if err != nil {
                return 0
        }
        listB, err := createPodList(f)
        if err != nil {
                return 0
        }
        objBodyB, err := objBodyFuzz(&listB)
        if err != nil {
                return 0
        }
        t := &testing.T{}
        c := newTestClient(t)
        var actions []string

        c.Factory.(*cmdtesting.TestFactory).UnstructuredClient = &fake.RESTClient{
                NegotiatedSerializer: unstructuredSerializer,
                Client: fake.CreateHTTPClient(func(req *http.Request) (*http.Response, error) {
                        p, m := req.URL.Path, req.Method
                        actions = append(actions, p+":"+m)
                        switch {
                        case p == "/namespaces/default/pods/starfish" && m == "GET":
                                return newResponseFuzz(200, &listA.Items[0])
                        case p == "/namespaces/default/pods/otter" && m == "GET":
                                return newResponseFuzz(200, &listA.Items[1])
                        case p == "/namespaces/default/pods/otter" && m == "PATCH":
                                _, err := ioutil.ReadAll(req.Body)
                                if err != nil {
                                        panic(fmt.Sprintf("could not dump request: %s\n", err))
                                }
                                req.Body.Close()
                                return newResponseFuzz(200, &listB.Items[0])
                        case p == "/namespaces/default/pods/dolphin" && m == "GET":
                                return newResponseFuzz(404, notFoundBody())
                        case p == "/namespaces/default/pods/starfish" && m == "PATCH":
                                _, err := ioutil.ReadAll(req.Body)
                                if err != nil {
                                        panic(fmt.Sprintf("could not dump request: %s", err))
                                }
                                req.Body.Close()
                                return newResponseFuzz(200, &listB.Items[0])
                        case p == "/namespaces/default/pods" && m == "POST":
                                return newResponseFuzz(200, &listB.Items[1])
                        case p == "/namespaces/default/pods/squid" && m == "DELETE":
                                return newResponseFuzz(200, &listB.Items[1])
                        case p == "/namespaces/default/pods/squid" && m == "GET":
                                return newResponseFuzz(200, &listB.Items[2])
                        default:
                                return &http.Response{}, fmt.Errorf("err")
                        }
                }),
        }

        first, err := c.Build(objBodyA, false)
        if err != nil {
                return 0
        }
        second, err := c.Build(objBodyB, false)
        if err != nil {
                return 0
        }
        _, _ = c.Update(first, second, false)
        return 1
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package kube // import "helm.sh/helm/v3/pkg/kube"

import (
        "context"
        "fmt"

        appsv1 "k8s.io/api/apps/v1"
        appsv1beta1 "k8s.io/api/apps/v1beta1"
        appsv1beta2 "k8s.io/api/apps/v1beta2"
        batchv1 "k8s.io/api/batch/v1"
        corev1 "k8s.io/api/core/v1"
        extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
        apiextv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
        apiextv1beta1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
        metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
        "k8s.io/apimachinery/pkg/runtime"
        "k8s.io/apimachinery/pkg/util/intstr"
        "k8s.io/cli-runtime/pkg/resource"
        "k8s.io/client-go/kubernetes"
        "k8s.io/client-go/kubernetes/scheme"

        deploymentutil "helm.sh/helm/v3/internal/third_party/k8s.io/kubernetes/deployment/util"
)

// ReadyCheckerOption is a function that configures a ReadyChecker.
type ReadyCheckerOption func(*ReadyChecker)

// PausedAsReady returns a ReadyCheckerOption that configures a ReadyChecker
// to consider paused resources to be ready. For example a Deployment
// with spec.paused equal to true would be considered ready.
func PausedAsReady(pausedAsReady bool) ReadyCheckerOption {
        return func(c *ReadyChecker) {
                c.pausedAsReady = pausedAsReady
        }
}

// CheckJobs returns a ReadyCheckerOption that configures a ReadyChecker
// to consider readiness of Job resources.
func CheckJobs(checkJobs bool) ReadyCheckerOption {
        return func(c *ReadyChecker) {
                c.checkJobs = checkJobs
        }
}

// NewReadyChecker creates a new checker. Passed ReadyCheckerOptions can
// be used to override defaults.
func NewReadyChecker(cl kubernetes.Interface, log func(string, ...interface{}), opts ...ReadyCheckerOption) ReadyChecker {
        c := ReadyChecker{
                client: cl,
                log:    log,
        }
        if c.log == nil {
                c.log = nopLogger
        }
        for _, opt := range opts {
                opt(&c)
        }
        return c
}

// ReadyChecker is a type that can check core Kubernetes types for readiness.
type ReadyChecker struct {
        client        kubernetes.Interface
        log           func(string, ...interface{})
        checkJobs     bool
        pausedAsReady bool
}

// IsReady checks if v is ready. It supports checking readiness for pods,
// deployments, persistent volume claims, services, daemon sets, custom
// resource definitions, stateful sets, replication controllers, jobs (optional),
// and replica sets. All other resource kinds are always considered ready.
//
// IsReady will fetch the latest state of the object from the server prior to
// performing readiness checks, and it will return any error encountered.
func (c *ReadyChecker) IsReady(ctx context.Context, v *resource.Info) (bool, error) {
        var (
                // This defaults to true, otherwise we get to a point where
                // things will always return false unless one of the objects
                // that manages pods has been hit
                ok  = true
                err error
        )
        switch value := AsVersioned(v).(type) {
        case *corev1.Pod:
                pod, err := c.client.CoreV1().Pods(v.Namespace).Get(ctx, v.Name, metav1.GetOptions{})
                if err != nil || !c.isPodReady(pod) {
                        return false, err
                }
        case *batchv1.Job:
                if c.checkJobs {
                        job, err := c.client.BatchV1().Jobs(v.Namespace).Get(ctx, v.Name, metav1.GetOptions{})
                        if err != nil {
                                return false, err
                        }
                        ready, err := c.jobReady(job)
                        return ready, err
                }
        case *appsv1.Deployment, *appsv1beta1.Deployment, *appsv1beta2.Deployment, *extensionsv1beta1.Deployment:
                currentDeployment, err := c.client.AppsV1().Deployments(v.Namespace).Get(ctx, v.Name, metav1.GetOptions{})
                if err != nil {
                        return false, err
                }
                // If paused deployment will never be ready
                if currentDeployment.Spec.Paused {
                        return c.pausedAsReady, nil
                }
                // Find RS associated with deployment
                newReplicaSet, err := deploymentutil.GetNewReplicaSet(currentDeployment, c.client.AppsV1())
                if err != nil || newReplicaSet == nil {
                        return false, err
                }
                if !c.deploymentReady(newReplicaSet, currentDeployment) {
                        return false, nil
                }
        case *corev1.PersistentVolumeClaim:
                claim, err := c.client.CoreV1().PersistentVolumeClaims(v.Namespace).Get(ctx, v.Name, metav1.GetOptions{})
                if err != nil {
                        return false, err
                }
                if !c.volumeReady(claim) {
                        return false, nil
                }
        case *corev1.Service:
                svc, err := c.client.CoreV1().Services(v.Namespace).Get(ctx, v.Name, metav1.GetOptions{})
                if err != nil {
                        return false, err
                }
                if !c.serviceReady(svc) {
                        return false, nil
                }
        case *extensionsv1beta1.DaemonSet, *appsv1.DaemonSet, *appsv1beta2.DaemonSet:
                ds, err := c.client.AppsV1().DaemonSets(v.Namespace).Get(ctx, v.Name, metav1.GetOptions{})
                if err != nil {
                        return false, err
                }
                if !c.daemonSetReady(ds) {
                        return false, nil
                }
        case *apiextv1beta1.CustomResourceDefinition:
                if err := v.Get(); err != nil {
                        return false, err
                }
                crd := &apiextv1beta1.CustomResourceDefinition{}
                if err := scheme.Scheme.Convert(v.Object, crd, nil); err != nil {
                        return false, err
                }
                if !c.crdBetaReady(*crd) {
                        return false, nil
                }
        case *apiextv1.CustomResourceDefinition:
                if err := v.Get(); err != nil {
                        return false, err
                }
                crd := &apiextv1.CustomResourceDefinition{}
                if err := scheme.Scheme.Convert(v.Object, crd, nil); err != nil {
                        return false, err
                }
                if !c.crdReady(*crd) {
                        return false, nil
                }
        case *appsv1.StatefulSet, *appsv1beta1.StatefulSet, *appsv1beta2.StatefulSet:
                sts, err := c.client.AppsV1().StatefulSets(v.Namespace).Get(ctx, v.Name, metav1.GetOptions{})
                if err != nil {
                        return false, err
                }
                if !c.statefulSetReady(sts) {
                        return false, nil
                }
        case *corev1.ReplicationController, *extensionsv1beta1.ReplicaSet, *appsv1beta2.ReplicaSet, *appsv1.ReplicaSet:
                ok, err = c.podsReadyForObject(ctx, v.Namespace, value)
        }
        if !ok || err != nil {
                return false, err
        }
        return true, nil
}

func (c *ReadyChecker) podsReadyForObject(ctx context.Context, namespace string, obj runtime.Object) (bool, error) {
        pods, err := c.podsforObject(ctx, namespace, obj)
        if err != nil {
                return false, err
        }
        for _, pod := range pods {
                if !c.isPodReady(&pod) {
                        return false, nil
                }
        }
        return true, nil
}

func (c *ReadyChecker) podsforObject(ctx context.Context, namespace string, obj runtime.Object) ([]corev1.Pod, error) {
        selector, err := SelectorsForObject(obj)
        if err != nil {
                return nil, err
        }
        list, err := getPods(ctx, c.client, namespace, selector.String())
        return list, err
}

// isPodReady returns true if a pod is ready; false otherwise.
func (c *ReadyChecker) isPodReady(pod *corev1.Pod) bool {
        for _, c := range pod.Status.Conditions {
                if c.Type == corev1.PodReady && c.Status == corev1.ConditionTrue {
                        return true
                }
        }
        c.log("Pod is not ready: %s/%s", pod.GetNamespace(), pod.GetName())
        return false
}

func (c *ReadyChecker) jobReady(job *batchv1.Job) (bool, error) {
        if job.Status.Failed > *job.Spec.BackoffLimit {
                c.log("Job is failed: %s/%s", job.GetNamespace(), job.GetName())
                // If a job is failed, it can't recover, so throw an error
                return false, fmt.Errorf("job is failed: %s/%s", job.GetNamespace(), job.GetName())
        }
        if job.Spec.Completions != nil && job.Status.Succeeded < *job.Spec.Completions {
                c.log("Job is not completed: %s/%s", job.GetNamespace(), job.GetName())
                return false, nil
        }
        return true, nil
}

func (c *ReadyChecker) serviceReady(s *corev1.Service) bool {
        // ExternalName Services are external to cluster so helm shouldn't be checking to see if they're 'ready' (i.e. have an IP Set)
        if s.Spec.Type == corev1.ServiceTypeExternalName {
                return true
        }

        // Ensure that the service cluster IP is not empty
        if s.Spec.ClusterIP == "" {
                c.log("Service does not have cluster IP address: %s/%s", s.GetNamespace(), s.GetName())
                return false
        }

        // This checks if the service has a LoadBalancer and that balancer has an Ingress defined
        if s.Spec.Type == corev1.ServiceTypeLoadBalancer {
                // do not wait when at least 1 external IP is set
                if len(s.Spec.ExternalIPs) > 0 {
                        c.log("Service %s/%s has external IP addresses (%v), marking as ready", s.GetNamespace(), s.GetName(), s.Spec.ExternalIPs)
                        return true
                }

                if s.Status.LoadBalancer.Ingress == nil {
                        c.log("Service does not have load balancer ingress IP address: %s/%s", s.GetNamespace(), s.GetName())
                        return false
                }
        }

        return true
}

func (c *ReadyChecker) volumeReady(v *corev1.PersistentVolumeClaim) bool {
        if v.Status.Phase != corev1.ClaimBound {
                c.log("PersistentVolumeClaim is not bound: %s/%s", v.GetNamespace(), v.GetName())
                return false
        }
        return true
}

func (c *ReadyChecker) deploymentReady(rs *appsv1.ReplicaSet, dep *appsv1.Deployment) bool {
        expectedReady := *dep.Spec.Replicas - deploymentutil.MaxUnavailable(*dep)
        if !(rs.Status.ReadyReplicas >= expectedReady) {
                c.log("Deployment is not ready: %s/%s. %d out of %d expected pods are ready", dep.Namespace, dep.Name, rs.Status.ReadyReplicas, expectedReady)
                return false
        }
        return true
}

func (c *ReadyChecker) daemonSetReady(ds *appsv1.DaemonSet) bool {
        // If the update strategy is not a rolling update, there will be nothing to wait for
        if ds.Spec.UpdateStrategy.Type != appsv1.RollingUpdateDaemonSetStrategyType {
                return true
        }

        // Make sure all the updated pods have been scheduled
        if ds.Status.UpdatedNumberScheduled != ds.Status.DesiredNumberScheduled {
                c.log("DaemonSet is not ready: %s/%s. %d out of %d expected pods have been scheduled", ds.Namespace, ds.Name, ds.Status.UpdatedNumberScheduled, ds.Status.DesiredNumberScheduled)
                return false
        }
        maxUnavailable, err := intstr.GetScaledValueFromIntOrPercent(ds.Spec.UpdateStrategy.RollingUpdate.MaxUnavailable, int(ds.Status.DesiredNumberScheduled), true)
        if err != nil {
                // If for some reason the value is invalid, set max unavailable to the
                // number of desired replicas. This is the same behavior as the
                // `MaxUnavailable` function in deploymentutil
                maxUnavailable = int(ds.Status.DesiredNumberScheduled)
        }

        expectedReady := int(ds.Status.DesiredNumberScheduled) - maxUnavailable
        if !(int(ds.Status.NumberReady) >= expectedReady) {
                c.log("DaemonSet is not ready: %s/%s. %d out of %d expected pods are ready", ds.Namespace, ds.Name, ds.Status.NumberReady, expectedReady)
                return false
        }
        return true
}

// Because the v1 extensions API is not available on all supported k8s versions
// yet and because Go doesn't support generics, we need to have a duplicate
// function to support the v1beta1 types
func (c *ReadyChecker) crdBetaReady(crd apiextv1beta1.CustomResourceDefinition) bool {
        for _, cond := range crd.Status.Conditions {
                switch cond.Type {
                case apiextv1beta1.Established:
                        if cond.Status == apiextv1beta1.ConditionTrue {
                                return true
                        }
                case apiextv1beta1.NamesAccepted:
                        if cond.Status == apiextv1beta1.ConditionFalse {
                                // This indicates a naming conflict, but it's probably not the
                                // job of this function to fail because of that. Instead,
                                // we treat it as a success, since the process should be able to
                                // continue.
                                return true
                        }
                }
        }
        return false
}

func (c *ReadyChecker) crdReady(crd apiextv1.CustomResourceDefinition) bool {
        for _, cond := range crd.Status.Conditions {
                switch cond.Type {
                case apiextv1.Established:
                        if cond.Status == apiextv1.ConditionTrue {
                                return true
                        }
                case apiextv1.NamesAccepted:
                        if cond.Status == apiextv1.ConditionFalse {
                                // This indicates a naming conflict, but it's probably not the
                                // job of this function to fail because of that. Instead,
                                // we treat it as a success, since the process should be able to
                                // continue.
                                return true
                        }
                }
        }
        return false
}

func (c *ReadyChecker) statefulSetReady(sts *appsv1.StatefulSet) bool {
        // If the update strategy is not a rolling update, there will be nothing to wait for
        if sts.Spec.UpdateStrategy.Type != appsv1.RollingUpdateStatefulSetStrategyType {
                c.log("StatefulSet skipped ready check: %s/%s. updateStrategy is %v", sts.Namespace, sts.Name, sts.Spec.UpdateStrategy.Type)
                return true
        }

        // Make sure the status is up-to-date with the StatefulSet changes
        if sts.Status.ObservedGeneration < sts.Generation {
                c.log("StatefulSet is not ready: %s/%s. update has not yet been observed", sts.Namespace, sts.Name)
                return false
        }

        // Dereference all the pointers because StatefulSets like them
        var partition int
        // 1 is the default for replicas if not set
        var replicas = 1
        // For some reason, even if the update strategy is a rolling update, the
        // actual rollingUpdate field can be nil. If it is, we can safely assume
        // there is no partition value
        if sts.Spec.UpdateStrategy.RollingUpdate != nil && sts.Spec.UpdateStrategy.RollingUpdate.Partition != nil {
                partition = int(*sts.Spec.UpdateStrategy.RollingUpdate.Partition)
        }
        if sts.Spec.Replicas != nil {
                replicas = int(*sts.Spec.Replicas)
        }

        // Because an update strategy can use partitioning, we need to calculate the
        // number of updated replicas we should have. For example, if the replicas
        // is set to 3 and the partition is 2, we'd expect only one pod to be
        // updated
        expectedReplicas := replicas - partition

        // Make sure all the updated pods have been scheduled
        if int(sts.Status.UpdatedReplicas) < expectedReplicas {
                c.log("StatefulSet is not ready: %s/%s. %d out of %d expected pods have been scheduled", sts.Namespace, sts.Name, sts.Status.UpdatedReplicas, expectedReplicas)
                return false
        }

        if int(sts.Status.ReadyReplicas) != replicas {
                c.log("StatefulSet is not ready: %s/%s. %d out of %d expected pods are ready", sts.Namespace, sts.Name, sts.Status.ReadyReplicas, replicas)
                return false
        }
        // This check only makes sense when all partitions are being upgraded otherwise during a
        // partioned rolling upgrade, this condition will never evaluate to true, leading to
        // error.
        if partition == 0 && sts.Status.CurrentRevision != sts.Status.UpdateRevision {
                c.log("StatefulSet is not ready: %s/%s. currentRevision %s does not yet match updateRevision %s", sts.Namespace, sts.Name, sts.Status.CurrentRevision, sts.Status.UpdateRevision)
                return false
        }

        c.log("StatefulSet is ready: %s/%s. %d out of %d expected pods are ready", sts.Namespace, sts.Name, sts.Status.ReadyReplicas, replicas)
        return true
}

func getPods(ctx context.Context, client kubernetes.Interface, namespace, selector string) ([]corev1.Pod, error) {
        list, err := client.CoreV1().Pods(namespace).List(ctx, metav1.ListOptions{
                LabelSelector: selector,
        })
        return list.Items, err
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package kube // import "helm.sh/helm/v3/pkg/kube"

import "k8s.io/cli-runtime/pkg/resource"

// ResourceList provides convenience methods for comparing collections of Infos.
type ResourceList []*resource.Info

// Append adds an Info to the Result.
func (r *ResourceList) Append(val *resource.Info) {
        *r = append(*r, val)
}

// Visit implements resource.Visitor.
func (r ResourceList) Visit(fn resource.VisitorFunc) error {
        for _, i := range r {
                if err := fn(i, nil); err != nil {
                        return err
                }
        }
        return nil
}

// Filter returns a new Result with Infos that satisfy the predicate fn.
func (r ResourceList) Filter(fn func(*resource.Info) bool) ResourceList {
        var result ResourceList
        for _, i := range r {
                if fn(i) {
                        result.Append(i)
                }
        }
        return result
}

// Get returns the Info from the result that matches the name and kind.
func (r ResourceList) Get(info *resource.Info) *resource.Info {
        for _, i := range r {
                if isMatchingInfo(i, info) {
                        return i
                }
        }
        return nil
}

// Contains checks to see if an object exists.
func (r ResourceList) Contains(info *resource.Info) bool {
        for _, i := range r {
                if isMatchingInfo(i, info) {
                        return true
                }
        }
        return false
}

// Difference will return a new Result with objects not contained in rs.
func (r ResourceList) Difference(rs ResourceList) ResourceList {
        return r.Filter(func(info *resource.Info) bool {
                return !rs.Contains(info)
        })
}

// Intersect will return a new Result with objects contained in both Results.
func (r ResourceList) Intersect(rs ResourceList) ResourceList {
        return r.Filter(rs.Contains)
}

// isMatchingInfo returns true if infos match on Name and GroupVersionKind.
func isMatchingInfo(a, b *resource.Info) bool {
        return a.Name == b.Name && a.Namespace == b.Namespace && a.Mapping.GroupVersionKind.Kind == b.Mapping.GroupVersionKind.Kind
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package kube // import "helm.sh/helm/v3/pkg/kube"

import (
        "context"
        "fmt"
        "time"

        "github.com/pkg/errors"
        appsv1 "k8s.io/api/apps/v1"
        appsv1beta1 "k8s.io/api/apps/v1beta1"
        appsv1beta2 "k8s.io/api/apps/v1beta2"
        batchv1 "k8s.io/api/batch/v1"
        corev1 "k8s.io/api/core/v1"
        extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
        apierrors "k8s.io/apimachinery/pkg/api/errors"
        metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
        "k8s.io/apimachinery/pkg/labels"
        "k8s.io/apimachinery/pkg/runtime"

        "k8s.io/apimachinery/pkg/util/wait"
)

type waiter struct {
        c       ReadyChecker
        timeout time.Duration
        log     func(string, ...interface{})
}

// waitForResources polls to get the current status of all pods, PVCs, Services and
// Jobs(optional) until all are ready or a timeout is reached
func (w *waiter) waitForResources(created ResourceList) error {
        w.log("beginning wait for %d resources with timeout of %v", len(created), w.timeout)

        ctx, cancel := context.WithTimeout(context.Background(), w.timeout)
        defer cancel()

        return wait.PollUntilContextCancel(ctx, 2*time.Second, true, func(ctx context.Context) (bool, error) {
                for _, v := range created {
                        ready, err := w.c.IsReady(ctx, v)
                        if !ready || err != nil {
                                return false, err
                        }
                }
                return true, nil
        })
}

// waitForDeletedResources polls to check if all the resources are deleted or a timeout is reached
func (w *waiter) waitForDeletedResources(deleted ResourceList) error {
        w.log("beginning wait for %d resources to be deleted with timeout of %v", len(deleted), w.timeout)

        ctx, cancel := context.WithTimeout(context.Background(), w.timeout)
        defer cancel()

        return wait.PollUntilContextCancel(ctx, 2*time.Second, true, func(ctx context.Context) (bool, error) {
                for _, v := range deleted {
                        err := v.Get()
                        if err == nil || !apierrors.IsNotFound(err) {
                                return false, err
                        }
                }
                return true, nil
        })
}

// SelectorsForObject returns the pod label selector for a given object
//
// Modified version of https://github.com/kubernetes/kubernetes/blob/v1.14.1/pkg/kubectl/polymorphichelpers/helpers.go#L84
func SelectorsForObject(object runtime.Object) (selector labels.Selector, err error) {
        switch t := object.(type) {
        case *extensionsv1beta1.ReplicaSet:
                selector, err = metav1.LabelSelectorAsSelector(t.Spec.Selector)
        case *appsv1.ReplicaSet:
                selector, err = metav1.LabelSelectorAsSelector(t.Spec.Selector)
        case *appsv1beta2.ReplicaSet:
                selector, err = metav1.LabelSelectorAsSelector(t.Spec.Selector)
        case *corev1.ReplicationController:
                selector = labels.SelectorFromSet(t.Spec.Selector)
        case *appsv1.StatefulSet:
                selector, err = metav1.LabelSelectorAsSelector(t.Spec.Selector)
        case *appsv1beta1.StatefulSet:
                selector, err = metav1.LabelSelectorAsSelector(t.Spec.Selector)
        case *appsv1beta2.StatefulSet:
                selector, err = metav1.LabelSelectorAsSelector(t.Spec.Selector)
        case *extensionsv1beta1.DaemonSet:
                selector, err = metav1.LabelSelectorAsSelector(t.Spec.Selector)
        case *appsv1.DaemonSet:
                selector, err = metav1.LabelSelectorAsSelector(t.Spec.Selector)
        case *appsv1beta2.DaemonSet:
                selector, err = metav1.LabelSelectorAsSelector(t.Spec.Selector)
        case *extensionsv1beta1.Deployment:
                selector, err = metav1.LabelSelectorAsSelector(t.Spec.Selector)
        case *appsv1.Deployment:
                selector, err = metav1.LabelSelectorAsSelector(t.Spec.Selector)
        case *appsv1beta1.Deployment:
                selector, err = metav1.LabelSelectorAsSelector(t.Spec.Selector)
        case *appsv1beta2.Deployment:
                selector, err = metav1.LabelSelectorAsSelector(t.Spec.Selector)
        case *batchv1.Job:
                selector, err = metav1.LabelSelectorAsSelector(t.Spec.Selector)
        case *corev1.Service:
                if t.Spec.Selector == nil || len(t.Spec.Selector) == 0 {
                        return nil, fmt.Errorf("invalid service '%s': Service is defined without a selector", t.Name)
                }
                selector = labels.SelectorFromSet(t.Spec.Selector)

        default:
                return nil, fmt.Errorf("selector for %T not implemented", object)
        }

        return selector, errors.Wrap(err, "invalid label selector")
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package lint // import "helm.sh/helm/v3/pkg/lint"

import (
        "path/filepath"

        "helm.sh/helm/v3/pkg/lint/rules"
        "helm.sh/helm/v3/pkg/lint/support"
)

// All runs all of the available linters on the given base directory.
func All(basedir string, values map[string]interface{}, namespace string, strict bool) support.Linter {
        // Using abs path to get directory context
        chartDir, _ := filepath.Abs(basedir)

        linter := support.Linter{ChartDir: chartDir}
        rules.Chartfile(&linter)
        rules.ValuesWithOverrides(&linter, values)
        rules.Templates(&linter, values, namespace, strict)
        rules.Dependencies(&linter)
        return linter
}

//go:build gofuzz
// +build gofuzz

// Copyright 2022 ADA Logics Ltd
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

package lint

import (
        "os"
        fuzz "github.com/AdaLogics/go-fuzz-headers"
)

func FuzzLintAll(data []byte) int {
        f := fuzz.NewConsumer(data)

        err := os.Mkdir("fuzzDir", 0755)
        if err != nil {
                return 0
        }
        defer os.RemoveAll("fuzzDir")
        err = f.CreateFiles("fuzzDir")
        if err != nil {
                return 0
        }
        var values map[string]interface{}
        _ = All("fuzzDir", values, "fuzzNamespace", false)
        return 1
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package rules // import "helm.sh/helm/v3/pkg/lint/rules"

import (
        "fmt"
        "os"
        "path/filepath"

        "github.com/Masterminds/semver/v3"
        "github.com/asaskevich/govalidator"
        "github.com/pkg/errors"
        "sigs.k8s.io/yaml"

        "helm.sh/helm/v3/pkg/chart"
        "helm.sh/helm/v3/pkg/chartutil"
        "helm.sh/helm/v3/pkg/lint/support"
)

// Chartfile runs a set of linter rules related to Chart.yaml file
func Chartfile(linter *support.Linter) {
        chartFileName := "Chart.yaml"
        chartPath := filepath.Join(linter.ChartDir, chartFileName)

        linter.RunLinterRule(support.ErrorSev, chartFileName, validateChartYamlNotDirectory(chartPath))

        chartFile, err := chartutil.LoadChartfile(chartPath)
        validChartFile := linter.RunLinterRule(support.ErrorSev, chartFileName, validateChartYamlFormat(err))

        // Guard clause. Following linter rules require a parsable ChartFile
        if !validChartFile {
                return
        }

        // type check for Chart.yaml . ignoring error as any parse
        // errors would already be caught in the above load function
        chartFileForTypeCheck, _ := loadChartFileForTypeCheck(chartPath)

        linter.RunLinterRule(support.ErrorSev, chartFileName, validateChartName(chartFile))

        // Chart metadata
        linter.RunLinterRule(support.ErrorSev, chartFileName, validateChartAPIVersion(chartFile))

        linter.RunLinterRule(support.ErrorSev, chartFileName, validateChartVersionType(chartFileForTypeCheck))
        linter.RunLinterRule(support.ErrorSev, chartFileName, validateChartVersion(chartFile))
        linter.RunLinterRule(support.ErrorSev, chartFileName, validateChartAppVersionType(chartFileForTypeCheck))
        linter.RunLinterRule(support.ErrorSev, chartFileName, validateChartMaintainer(chartFile))
        linter.RunLinterRule(support.ErrorSev, chartFileName, validateChartSources(chartFile))
        linter.RunLinterRule(support.InfoSev, chartFileName, validateChartIconPresence(chartFile))
        linter.RunLinterRule(support.ErrorSev, chartFileName, validateChartIconURL(chartFile))
        linter.RunLinterRule(support.ErrorSev, chartFileName, validateChartType(chartFile))
        linter.RunLinterRule(support.ErrorSev, chartFileName, validateChartDependencies(chartFile))
}

func validateChartVersionType(data map[string]interface{}) error {
        return isStringValue(data, "version")
}

func validateChartAppVersionType(data map[string]interface{}) error {
        return isStringValue(data, "appVersion")
}

func isStringValue(data map[string]interface{}, key string) error {
        value, ok := data[key]
        if !ok {
                return nil
        }
        valueType := fmt.Sprintf("%T", value)
        if valueType != "string" {
                return errors.Errorf("%s should be of type string but it's of type %s", key, valueType)
        }
        return nil
}

func validateChartYamlNotDirectory(chartPath string) error {
        fi, err := os.Stat(chartPath)

        if err == nil && fi.IsDir() {
                return errors.New("should be a file, not a directory")
        }
        return nil
}

func validateChartYamlFormat(chartFileError error) error {
        if chartFileError != nil {
                return errors.Errorf("unable to parse YAML\n\t%s", chartFileError.Error())
        }
        return nil
}

func validateChartName(cf *chart.Metadata) error {
        if cf.Name == "" {
                return errors.New("name is required")
        }
        return nil
}

func validateChartAPIVersion(cf *chart.Metadata) error {
        if cf.APIVersion == "" {
                return errors.New("apiVersion is required. The value must be either \"v1\" or \"v2\"")
        }

        if cf.APIVersion != chart.APIVersionV1 && cf.APIVersion != chart.APIVersionV2 {
                return fmt.Errorf("apiVersion '%s' is not valid. The value must be either \"v1\" or \"v2\"", cf.APIVersion)
        }

        return nil
}

func validateChartVersion(cf *chart.Metadata) error {
        if cf.Version == "" {
                return errors.New("version is required")
        }

        version, err := semver.NewVersion(cf.Version)

        if err != nil {
                return errors.Errorf("version '%s' is not a valid SemVer", cf.Version)
        }

        c, err := semver.NewConstraint(">0.0.0-0")
        if err != nil {
                return err
        }
        valid, msg := c.Validate(version)

        if !valid && len(msg) > 0 {
                return errors.Errorf("version %v", msg[0])
        }

        return nil
}

func validateChartMaintainer(cf *chart.Metadata) error {
        for _, maintainer := range cf.Maintainers {
                if maintainer.Name == "" {
                        return errors.New("each maintainer requires a name")
                } else if maintainer.Email != "" && !govalidator.IsEmail(maintainer.Email) {
                        return errors.Errorf("invalid email '%s' for maintainer '%s'", maintainer.Email, maintainer.Name)
                } else if maintainer.URL != "" && !govalidator.IsURL(maintainer.URL) {
                        return errors.Errorf("invalid url '%s' for maintainer '%s'", maintainer.URL, maintainer.Name)
                }
        }
        return nil
}

func validateChartSources(cf *chart.Metadata) error {
        for _, source := range cf.Sources {
                if source == "" || !govalidator.IsRequestURL(source) {
                        return errors.Errorf("invalid source URL '%s'", source)
                }
        }
        return nil
}

func validateChartIconPresence(cf *chart.Metadata) error {
        if cf.Icon == "" {
                return errors.New("icon is recommended")
        }
        return nil
}

func validateChartIconURL(cf *chart.Metadata) error {
        if cf.Icon != "" && !govalidator.IsRequestURL(cf.Icon) {
                return errors.Errorf("invalid icon URL '%s'", cf.Icon)
        }
        return nil
}

func validateChartDependencies(cf *chart.Metadata) error {
        if len(cf.Dependencies) > 0 && cf.APIVersion != chart.APIVersionV2 {
                return fmt.Errorf("dependencies are not valid in the Chart file with apiVersion '%s'. They are valid in apiVersion '%s'", cf.APIVersion, chart.APIVersionV2)
        }
        return nil
}

func validateChartType(cf *chart.Metadata) error {
        if len(cf.Type) > 0 && cf.APIVersion != chart.APIVersionV2 {
                return fmt.Errorf("chart type is not valid in apiVersion '%s'. It is valid in apiVersion '%s'", cf.APIVersion, chart.APIVersionV2)
        }
        return nil
}

// loadChartFileForTypeCheck loads the Chart.yaml
// in a generic form of a map[string]interface{}, so that the type
// of the values can be checked
func loadChartFileForTypeCheck(filename string) (map[string]interface{}, error) {
        b, err := os.ReadFile(filename)
        if err != nil {
                return nil, err
        }
        y := make(map[string]interface{})
        err = yaml.Unmarshal(b, &y)
        return y, err
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package rules // import "helm.sh/helm/v3/pkg/lint/rules"

import (
        "fmt"
        "strings"

        "github.com/pkg/errors"

        "helm.sh/helm/v3/pkg/chart"
        "helm.sh/helm/v3/pkg/chart/loader"
        "helm.sh/helm/v3/pkg/lint/support"
)

// Dependencies runs lints against a chart's dependencies
//
// See https://github.com/helm/helm/issues/7910
func Dependencies(linter *support.Linter) {
        c, err := loader.LoadDir(linter.ChartDir)
        if !linter.RunLinterRule(support.ErrorSev, "", validateChartFormat(err)) {
                return
        }

        linter.RunLinterRule(support.ErrorSev, linter.ChartDir, validateDependencyInMetadata(c))
        linter.RunLinterRule(support.WarningSev, linter.ChartDir, validateDependencyInChartsDir(c))
}

func validateChartFormat(chartError error) error {
        if chartError != nil {
                return errors.Errorf("unable to load chart\n\t%s", chartError)
        }
        return nil
}

func validateDependencyInChartsDir(c *chart.Chart) (err error) {
        dependencies := map[string]struct{}{}
        missing := []string{}
        for _, dep := range c.Dependencies() {
                dependencies[dep.Metadata.Name] = struct{}{}
        }
        for _, dep := range c.Metadata.Dependencies {
                if _, ok := dependencies[dep.Name]; !ok {
                        missing = append(missing, dep.Name)
                }
        }
        if len(missing) > 0 {
                err = fmt.Errorf("chart directory is missing these dependencies: %s", strings.Join(missing, ","))
        }
        return err
}

func validateDependencyInMetadata(c *chart.Chart) (err error) {
        dependencies := map[string]struct{}{}
        missing := []string{}
        for _, dep := range c.Metadata.Dependencies {
                dependencies[dep.Name] = struct{}{}
        }
        for _, dep := range c.Dependencies() {
                if _, ok := dependencies[dep.Metadata.Name]; !ok {
                        missing = append(missing, dep.Metadata.Name)
                }
        }
        if len(missing) > 0 {
                err = fmt.Errorf("chart metadata is missing these dependencies: %s", strings.Join(missing, ","))
        }
        return err
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package rules // import "helm.sh/helm/v3/pkg/lint/rules"

import (
        "fmt"
        "strconv"

        "k8s.io/apimachinery/pkg/runtime"
        "k8s.io/apimachinery/pkg/runtime/schema"
        "k8s.io/apiserver/pkg/endpoints/deprecation"
        kscheme "k8s.io/client-go/kubernetes/scheme"
)

var (
        // This should be set in the Makefile based on the version of client-go being imported.
        // These constants will be overwritten with LDFLAGS. The version components must be
        // strings in order for LDFLAGS to set them.
        k8sVersionMajor = "1"
        k8sVersionMinor = "20"
)

// deprecatedAPIError indicates than an API is deprecated in Kubernetes
type deprecatedAPIError struct {
        Deprecated string
        Message    string
}

func (e deprecatedAPIError) Error() string {
        msg := e.Message
        return msg
}

func validateNoDeprecations(resource *K8sYamlStruct) error {
        // if `resource` does not have an APIVersion or Kind, we cannot test it for deprecation
        if resource.APIVersion == "" {
                return nil
        }
        if resource.Kind == "" {
                return nil
        }

        runtimeObject, err := resourceToRuntimeObject(resource)
        if err != nil {
                // do not error for non-kubernetes resources
                if runtime.IsNotRegisteredError(err) {
                        return nil
                }
                return err
        }
        maj, err := strconv.Atoi(k8sVersionMajor)
        if err != nil {
                return err
        }
        min, err := strconv.Atoi(k8sVersionMinor)
        if err != nil {
                return err
        }

        if !deprecation.IsDeprecated(runtimeObject, maj, min) {
                return nil
        }
        gvk := fmt.Sprintf("%s %s", resource.APIVersion, resource.Kind)
        return deprecatedAPIError{
                Deprecated: gvk,
                Message:    deprecation.WarningMessage(runtimeObject),
        }
}

func resourceToRuntimeObject(resource *K8sYamlStruct) (runtime.Object, error) {
        scheme := runtime.NewScheme()
        kscheme.AddToScheme(scheme)

        gvk := schema.FromAPIVersionAndKind(resource.APIVersion, resource.Kind)
        out, err := scheme.New(gvk)
        if err != nil {
                return nil, err
        }
        out.GetObjectKind().SetGroupVersionKind(gvk)
        return out, nil
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package rules

import (
        "bufio"
        "bytes"
        "fmt"
        "io"
        "os"
        "path"
        "path/filepath"
        "regexp"
        "strings"

        "github.com/pkg/errors"
        "k8s.io/apimachinery/pkg/api/validation"
        apipath "k8s.io/apimachinery/pkg/api/validation/path"
        "k8s.io/apimachinery/pkg/util/validation/field"
        "k8s.io/apimachinery/pkg/util/yaml"

        "helm.sh/helm/v3/pkg/chart/loader"
        "helm.sh/helm/v3/pkg/chartutil"
        "helm.sh/helm/v3/pkg/engine"
        "helm.sh/helm/v3/pkg/lint/support"
)

var (
        crdHookSearch     = regexp.MustCompile(`"?helm\.sh/hook"?:\s+crd-install`)
        releaseTimeSearch = regexp.MustCompile(`\.Release\.Time`)
)

// Templates lints the templates in the Linter.
func Templates(linter *support.Linter, values map[string]interface{}, namespace string, strict bool) {
        fpath := "templates/"
        templatesPath := filepath.Join(linter.ChartDir, fpath)

        templatesDirExist := linter.RunLinterRule(support.WarningSev, fpath, validateTemplatesDir(templatesPath))

        // Templates directory is optional for now
        if !templatesDirExist {
                return
        }

        // Load chart and parse templates
        chart, err := loader.Load(linter.ChartDir)

        chartLoaded := linter.RunLinterRule(support.ErrorSev, fpath, err)

        if !chartLoaded {
                return
        }

        options := chartutil.ReleaseOptions{
                Name:      "test-release",
                Namespace: namespace,
        }

        // lint ignores import-values
        // See https://github.com/helm/helm/issues/9658
        if err := chartutil.ProcessDependenciesWithMerge(chart, values); err != nil {
                return
        }

        cvals, err := chartutil.CoalesceValues(chart, values)
        if err != nil {
                return
        }
        valuesToRender, err := chartutil.ToRenderValues(chart, cvals, options, nil)
        if err != nil {
                linter.RunLinterRule(support.ErrorSev, fpath, err)
                return
        }
        var e engine.Engine
        e.LintMode = true
        renderedContentMap, err := e.Render(chart, valuesToRender)

        renderOk := linter.RunLinterRule(support.ErrorSev, fpath, err)

        if !renderOk {
                return
        }

        /* Iterate over all the templates to check:
        - It is a .yaml file
        - All the values in the template file is defined
        - {{}} include | quote
        - Generated content is a valid Yaml file
        - Metadata.Namespace is not set
        */
        for _, template := range chart.Templates {
                fileName, data := template.Name, template.Data
                fpath = fileName

                linter.RunLinterRule(support.ErrorSev, fpath, validateAllowedExtension(fileName))
                // These are v3 specific checks to make sure and warn people if their
                // chart is not compatible with v3
                linter.RunLinterRule(support.WarningSev, fpath, validateNoCRDHooks(data))
                linter.RunLinterRule(support.ErrorSev, fpath, validateNoReleaseTime(data))

                // We only apply the following lint rules to yaml files
                if filepath.Ext(fileName) != ".yaml" || filepath.Ext(fileName) == ".yml" {
                        continue
                }

                // NOTE: disabled for now, Refs https://github.com/helm/helm/issues/1463
                // Check that all the templates have a matching value
                // linter.RunLinterRule(support.WarningSev, fpath, validateNoMissingValues(templatesPath, valuesToRender, preExecutedTemplate))

                // NOTE: disabled for now, Refs https://github.com/helm/helm/issues/1037
                // linter.RunLinterRule(support.WarningSev, fpath, validateQuotes(string(preExecutedTemplate)))

                renderedContent := renderedContentMap[path.Join(chart.Name(), fileName)]
                if strings.TrimSpace(renderedContent) != "" {
                        linter.RunLinterRule(support.WarningSev, fpath, validateTopIndentLevel(renderedContent))

                        decoder := yaml.NewYAMLOrJSONDecoder(strings.NewReader(renderedContent), 4096)

                        // Lint all resources if the file contains multiple documents separated by ---
                        for {
                                // Even though K8sYamlStruct only defines a few fields, an error in any other
                                // key will be raised as well
                                var yamlStruct *K8sYamlStruct

                                err := decoder.Decode(&yamlStruct)
                                if err == io.EOF {
                                        break
                                }

                                //  If YAML linting fails here, it will always fail in the next block as well, so we should return here.
                                // fix https://github.com/helm/helm/issues/11391
                                if !linter.RunLinterRule(support.ErrorSev, fpath, validateYamlContent(err)) {
                                        return
                                }
                                if yamlStruct != nil {
                                        // NOTE: set to warnings to allow users to support out-of-date kubernetes
                                        // Refs https://github.com/helm/helm/issues/8596
                                        linter.RunLinterRule(support.WarningSev, fpath, validateMetadataName(yamlStruct))
                                        linter.RunLinterRule(support.WarningSev, fpath, validateNoDeprecations(yamlStruct))

                                        linter.RunLinterRule(support.ErrorSev, fpath, validateMatchSelector(yamlStruct, renderedContent))
                                        linter.RunLinterRule(support.ErrorSev, fpath, validateListAnnotations(yamlStruct, renderedContent))
                                }
                        }
                }
        }
}

// validateTopIndentLevel checks that the content does not start with an indent level > 0.
//
// This error can occur when a template accidentally inserts space. It can cause
// unpredictable errors depending on whether the text is normalized before being passed
// into the YAML parser. So we trap it here.
//
// See https://github.com/helm/helm/issues/8467
func validateTopIndentLevel(content string) error {
        // Read lines until we get to a non-empty one
        scanner := bufio.NewScanner(bytes.NewBufferString(content))
        for scanner.Scan() {
                line := scanner.Text()
                // If line is empty, skip
                if strings.TrimSpace(line) == "" {
                        continue
                }
                // If it starts with one or more spaces, this is an error
                if strings.HasPrefix(line, " ") || strings.HasPrefix(line, "\t") {
                        return fmt.Errorf("document starts with an illegal indent: %q, which may cause parsing problems", line)
                }
                // Any other condition passes.
                return nil
        }
        return scanner.Err()
}

// Validation functions
func validateTemplatesDir(templatesPath string) error {
        if fi, err := os.Stat(templatesPath); err == nil {
                if !fi.IsDir() {
                        return errors.New("not a directory")
                }
        }
        return nil
}

func validateAllowedExtension(fileName string) error {
        ext := filepath.Ext(fileName)
        validExtensions := []string{".yaml", ".yml", ".tpl", ".txt"}

        for _, b := range validExtensions {
                if b == ext {
                        return nil
                }
        }

        return errors.Errorf("file extension '%s' not valid. Valid extensions are .yaml, .yml, .tpl, or .txt", ext)
}

func validateYamlContent(err error) error {
        return errors.Wrap(err, "unable to parse YAML")
}

// validateMetadataName uses the correct validation function for the object
// Kind, or if not set, defaults to the standard definition of a subdomain in
// DNS (RFC 1123), used by most resources.
func validateMetadataName(obj *K8sYamlStruct) error {
        fn := validateMetadataNameFunc(obj)
        allErrs := field.ErrorList{}
        for _, msg := range fn(obj.Metadata.Name, false) {
                allErrs = append(allErrs, field.Invalid(field.NewPath("metadata").Child("name"), obj.Metadata.Name, msg))
        }
        if len(allErrs) > 0 {
                return errors.Wrapf(allErrs.ToAggregate(), "object name does not conform to Kubernetes naming requirements: %q", obj.Metadata.Name)
        }
        return nil
}

// validateMetadataNameFunc will return a name validation function for the
// object kind, if defined below.
//
// Rules should match those set in the various api validations:
// https://github.com/kubernetes/kubernetes/blob/v1.20.0/pkg/apis/core/validation/validation.go#L205-L274
// https://github.com/kubernetes/kubernetes/blob/v1.20.0/pkg/apis/apps/validation/validation.go#L39
// ...
//
// Implementing here to avoid importing k/k.
//
// If no mapping is defined, returns NameIsDNSSubdomain.  This is used by object
// kinds that don't have special requirements, so is the most likely to work if
// new kinds are added.
func validateMetadataNameFunc(obj *K8sYamlStruct) validation.ValidateNameFunc {
        switch strings.ToLower(obj.Kind) {
        case "pod", "node", "secret", "endpoints", "resourcequota", // core
                "controllerrevision", "daemonset", "deployment", "replicaset", "statefulset", // apps
                "autoscaler",     // autoscaler
                "cronjob", "job", // batch
                "lease",                    // coordination
                "endpointslice",            // discovery
                "networkpolicy", "ingress", // networking
                "podsecuritypolicy",                           // policy
                "priorityclass",                               // scheduling
                "podpreset",                                   // settings
                "storageclass", "volumeattachment", "csinode": // storage
                return validation.NameIsDNSSubdomain
        case "service":
                return validation.NameIsDNS1035Label
        case "namespace":
                return validation.ValidateNamespaceName
        case "serviceaccount":
                return validation.ValidateServiceAccountName
        case "certificatesigningrequest":
                // No validation.
                // https://github.com/kubernetes/kubernetes/blob/v1.20.0/pkg/apis/certificates/validation/validation.go#L137-L140
                return func(name string, prefix bool) []string { return nil }
        case "role", "clusterrole", "rolebinding", "clusterrolebinding":
                // https://github.com/kubernetes/kubernetes/blob/v1.20.0/pkg/apis/rbac/validation/validation.go#L32-L34
                return func(name string, prefix bool) []string {
                        return apipath.IsValidPathSegmentName(name)
                }
        default:
                return validation.NameIsDNSSubdomain
        }
}

func validateNoCRDHooks(manifest []byte) error {
        if crdHookSearch.Match(manifest) {
                return errors.New("manifest is a crd-install hook. This hook is no longer supported in v3 and all CRDs should also exist the crds/ directory at the top level of the chart")
        }
        return nil
}

func validateNoReleaseTime(manifest []byte) error {
        if releaseTimeSearch.Match(manifest) {
                return errors.New(".Release.Time has been removed in v3, please replace with the `now` function in your templates")
        }
        return nil
}

// validateMatchSelector ensures that template specs have a selector declared.
// See https://github.com/helm/helm/issues/1990
func validateMatchSelector(yamlStruct *K8sYamlStruct, manifest string) error {
        switch yamlStruct.Kind {
        case "Deployment", "ReplicaSet", "DaemonSet", "StatefulSet":
                // verify that matchLabels or matchExpressions is present
                if !(strings.Contains(manifest, "matchLabels") || strings.Contains(manifest, "matchExpressions")) {
                        return fmt.Errorf("a %s must contain matchLabels or matchExpressions, and %q does not", yamlStruct.Kind, yamlStruct.Metadata.Name)
                }
        }
        return nil
}
func validateListAnnotations(yamlStruct *K8sYamlStruct, manifest string) error {
        if yamlStruct.Kind == "List" {
                m := struct {
                        Items []struct {
                                Metadata struct {
                                        Annotations map[string]string
                                }
                        }
                }{}

                if err := yaml.Unmarshal([]byte(manifest), &m); err != nil {
                        return validateYamlContent(err)
                }

                for _, i := range m.Items {
                        if _, ok := i.Metadata.Annotations["helm.sh/resource-policy"]; ok {
                                return errors.New("Annotation 'helm.sh/resource-policy' within List objects are ignored")
                        }
                }
        }
        return nil
}

// K8sYamlStruct stubs a Kubernetes YAML file.
//
// DEPRECATED: In Helm 4, this will be made a private type, as it is for use only within
// the rules package.
type K8sYamlStruct struct {
        APIVersion string `json:"apiVersion"`
        Kind       string
        Metadata   k8sYamlMetadata
}

type k8sYamlMetadata struct {
        Namespace string
        Name      string
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package rules

import (
        "os"
        "path/filepath"

        "github.com/pkg/errors"

        "helm.sh/helm/v3/pkg/chartutil"
        "helm.sh/helm/v3/pkg/lint/support"
)

// Values lints a chart's values.yaml file.
//
// This function is deprecated and will be removed in Helm 4.
func Values(linter *support.Linter) {
        ValuesWithOverrides(linter, map[string]interface{}{})
}

// ValuesWithOverrides tests the values.yaml file.
//
// If a schema is present in the chart, values are tested against that. Otherwise,
// they are only tested for well-formedness.
//
// If additional values are supplied, they are coalesced into the values in values.yaml.
func ValuesWithOverrides(linter *support.Linter, values map[string]interface{}) {
        file := "values.yaml"
        vf := filepath.Join(linter.ChartDir, file)
        fileExists := linter.RunLinterRule(support.InfoSev, file, validateValuesFileExistence(vf))

        if !fileExists {
                return
        }

        linter.RunLinterRule(support.ErrorSev, file, validateValuesFile(vf, values))
}

func validateValuesFileExistence(valuesPath string) error {
        _, err := os.Stat(valuesPath)
        if err != nil {
                return errors.Errorf("file does not exist")
        }
        return nil
}

func validateValuesFile(valuesPath string, overrides map[string]interface{}) error {
        values, err := chartutil.ReadValuesFile(valuesPath)
        if err != nil {
                return errors.Wrap(err, "unable to parse YAML")
        }

        // Helm 3.0.0 carried over the values linting from Helm 2.x, which only tests the top
        // level values against the top-level expectations. Subchart values are not linted.
        // We could change that. For now, though, we retain that strategy, and thus can
        // coalesce tables (like reuse-values does) instead of doing the full chart
        // CoalesceValues
        coalescedValues := chartutil.CoalesceTables(make(map[string]interface{}, len(overrides)), overrides)
        coalescedValues = chartutil.CoalesceTables(coalescedValues, values)

        ext := filepath.Ext(valuesPath)
        schemaPath := valuesPath[:len(valuesPath)-len(ext)] + ".schema.json"
        schema, err := os.ReadFile(schemaPath)
        if len(schema) == 0 {
                return nil
        }
        if err != nil {
                return err
        }
        return chartutil.ValidateAgainstSingleSchema(coalescedValues, schema)
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package support

import "fmt"

// Severity indicates the severity of a Message.
const (
        // UnknownSev indicates that the severity of the error is unknown, and should not stop processing.
        UnknownSev = iota
        // InfoSev indicates information, for example missing values.yaml file
        InfoSev
        // WarningSev indicates that something does not meet code standards, but will likely function.
        WarningSev
        // ErrorSev indicates that something will not likely function.
        ErrorSev
)

// sev matches the *Sev states.
var sev = []string{"UNKNOWN", "INFO", "WARNING", "ERROR"}

// Linter encapsulates a linting run of a particular chart.
type Linter struct {
        Messages []Message
        // The highest severity of all the failing lint rules
        HighestSeverity int
        ChartDir        string
}

// Message describes an error encountered while linting.
type Message struct {
        // Severity is one of the *Sev constants
        Severity int
        Path     string
        Err      error
}

func (m Message) Error() string {
        return fmt.Sprintf("[%s] %s: %s", sev[m.Severity], m.Path, m.Err.Error())
}

// NewMessage creates a new Message struct
func NewMessage(severity int, path string, err error) Message {
        return Message{Severity: severity, Path: path, Err: err}
}

// RunLinterRule returns true if the validation passed
func (l *Linter) RunLinterRule(severity int, path string, err error) bool {
        // severity is out of bound
        if severity < 0 || severity >= len(sev) {
                return false
        }

        if err != nil {
                l.Messages = append(l.Messages, NewMessage(severity, path, err))

                if severity > l.HighestSeverity {
                        l.HighestSeverity = severity
                }
        }
        return err == nil
}

/*
Copyright The Helm Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package plugin // import "helm.sh/helm/v3/pkg/plugin"

import (
        "fmt"
        "os"
        "path/filepath"
        "regexp"
        "runtime"
        "strings"
        "unicode"

        "github.com/pkg/errors"
        "sigs.k8s.io/yaml"

        "helm.sh/helm/v3/pkg/cli"
)

const PluginFileName = "plugin.yaml"

// Downloaders represents the plugins capability if it can retrieve
// charts from special sources
type Downloaders struct {
        // Protocols are the list of schemes from the charts URL.
        Protocols []string `json:"protocols"`
        // Command is the executable path with which the plugin performs
        // the actual download for the corresponding Protocols
        Command string `json:"command"`
}

// PlatformCommand represents a command for a particular operating system and architecture
type PlatformCommand struct {
        OperatingSystem string `json:"os"`
        Architecture    string `json:"arch"`
        Command         string `json:"command"`
}

// Metadata describes a plugin.
//
// This is the plugin equivalent of a chart.Metadata.
type Metadata struct {
        // Name is the name of the plugin
        Name string `json:"name"`

        // Version is a SemVer 2 version of the plugin.
        Version string `json:"version"`

        // Usage is the single-line usage text shown in help
        Usage string `json:"usage"`

        // Description is a long description shown in places like `helm help`
        Description string `json:"description"`

        // Command is the command, as a single string.
        //
        // The command will be passed through environment expansion, so env vars can
        // be present in this command. Unless IgnoreFlags is set, this will
        // also merge the flags passed from Helm.
        //
        // Note that command is not executed in a shell. To do so, we suggest
        // pointing the command to a shell script.
        //
        // The following rules will apply to processing commands:
        // - If platformCommand is present, it will be searched first
        // - If both OS and Arch match the current platform, search will stop and the command will be executed
        // - If OS matches and there is no more specific match, the command will be executed
        // - If no OS/Arch match is found, the default command will be executed
        // - If no command is present and no matches are found in platformCommand, Helm will exit with an error
        PlatformCommand []PlatformCommand `json:"platformCommand"`
        Command         string            `json:"command"`

        // IgnoreFlags ignores any flags passed in from Helm
        //
        // For example, if the plugin is invoked as `helm --debug myplugin`, if this
        // is false, `--debug` will be appended to `--command`. If this is true,
        // the `--debug` flag will be discarded.
        IgnoreFlags bool `json:"ignoreFlags"`

        // Hooks are commands that will run on events.
        Hooks Hooks

        // Downloaders field is used if the plugin supply downloader mechanism
        // for special protocols.
        Downloaders []Downloaders `json:"downloaders"`

        // UseTunnelDeprecated indicates that this command needs a tunnel.
        // Setting this will cause a number of side effects, such as the
        // automatic setting of HELM_HOST.
        // DEPRECATED and unused, but retained for backwards compatibility with Helm 2 plugins. Remove in Helm 4
        UseTunnelDeprecated bool `json:"useTunnel,omitempty"`
}

// Plugin represents a plugin.
type Plugin struct {
        // Metadata is a parsed representation of a plugin.yaml
        Metadata *Metadata
        // Dir is the string path to the directory that holds the plugin.
        Dir string
}

// The following rules will apply to processing the Plugin.PlatformCommand.Command:
// - If both OS and Arch match the current platform, search will stop and the command will be prepared for execution
// - If OS matches and there is no more specific match, the command will be prepared for execution
// - If no OS/Arch match is found, return nil
func getPlatformCommand(cmds []PlatformCommand) []string {
        var command []string
        eq := strings.EqualFold
        for _, c := range cmds {
                if eq(c.OperatingSystem, runtime.GOOS) {
                        command = strings.Split(c.Command, " ")
                }
                if eq(c.OperatingSystem, runtime.GOOS) && eq(c.Architecture, runtime.GOARCH) {
                        return strings.Split(c.Command, " ")
                }
        }
        return command
}

// PrepareCommand takes a Plugin.PlatformCommand.Command, a Plugin.Command and will applying the following processing:
// - If platformCommand is present, it will be searched first
// - If both OS and Arch match the current platform, search will stop and the command will be prepared for execution
// - If OS matches and there is no more specific match, the command will be prepared for execution
// - If no OS/Arch match is found, the default command will be prepared for execution
// - If no command is present and no matches are found in platformCommand, will exit with an error
//
// It merges extraArgs into any arguments supplied in the plugin. It
// returns the name of the command and an args array.
//
// The result is suitable to pass to exec.Command.
func (p *Plugin) PrepareCommand(extraArgs []string) (string, []string, error) {
        var parts []string
        platCmdLen := len(p.Metadata.PlatformCommand)
        if platCmdLen > 0 {
                parts = getPlatformCommand(p.Metadata.PlatformCommand)
        }
        if platCmdLen == 0 || parts == nil {
                parts = strings.Split(p.Metadata.Command, " ")
        }
        if len(parts) == 0 || parts[0] == "" {
                return "", nil, fmt.Errorf("no plugin command is applicable")
        }

        main := os.ExpandEnv(parts[0])
        baseArgs := []string{}
        if len(parts) > 1 {
                for _, cmdpart := range parts[1:] {
                        cmdexp := os.ExpandEnv(cmdpart)
                        baseArgs = append(baseArgs, cmdexp)
                }
        }
        if !p.Metadata.IgnoreFlags {
                baseArgs = append(baseArgs, extraArgs...)
        }
        return main, baseArgs, nil
}

// validPluginName is a regular expression that validates plugin names.
//
// Plugin names can only contain the ASCII characters a-z, A-Z, 0-9, ​_​ and ​-.
var validPluginName = regexp.MustCompile("^[A-Za-z0-9_-]+$")

// validatePluginData validates a plugin's YAML data.
func validatePluginData(plug *Plugin, filepath string) error {
        if !validPluginName.MatchString(plug.Metadata.Name) {
                return fmt.Errorf("invalid plugin name at %q", filepath)
        }
        plug.Metadata.Usage = sanitizeString(plug.Metadata.Usage)

        // We could also validate SemVer, executable, and other fields should we so choose.
        return nil
}

// sanitizeString normalize spaces and removes non-printable characters.
func sanitizeString(str string) string {
        return strings.Map(func(r rune) rune {
                if unicode.IsSpace(r) {
                        return ' '
                }
                if unicode.IsPrint(r) {
                        return r
                }
                return -1
        }, str)
}

func detectDuplicates(plugs []*Plugin) error {
        names := map[string]string{}

        for _, plug := range plugs {
                if oldpath, ok := names[plug.Metadata.Name]; ok {
                        return fmt.Errorf(
                                "two plugins claim the name %q at %q and %q",
                                plug.Metadata.Name,
                                oldpath,
                                plug.Dir,
                        )
                }
                names[plug.Metadata.Name] = plug.Dir
        }

        return nil
}

// LoadDir loads a plugin from the given directory.
func LoadDir(dirname string) (*Plugin, error) {
        pluginfile := filepath.Join(dirname, PluginFileName)
        data, err := os.ReadFile(pluginfile)
        if err != nil {
                return nil, errors.Wrapf(err, "failed to read plugin at %q", pluginfile)
        }

        plug := &Plugin{Dir: dirname}
        if err := yaml.UnmarshalStrict(data, &plug.Metadata); err != nil {
                return nil, errors.Wrapf(err, "failed to load plugin at %q", pluginfile)
        }
        return plug, validatePluginData(plug, pluginfile)
}

// LoadAll loads all plugins found beneath the base directory.
//
// This scans only one directory level.
func LoadAll(basedir string) ([]*Plugin, error) {
        plugins := []*Plugin{}
        // We want basedir/*/plugin.yaml
        scanpath := filepath.Join(basedir, "*", PluginFileName)
        matches, err := filepath.Glob(scanpath)
        if err != nil {
                return plugins, errors.Wrapf(err, "failed to find plugins in %q", scanpath)
        }

        if matches == nil {
                return plugins, nil
        }

        for _, yaml := range matches {
                dir := filepath.Dir(yaml)
                p, err := LoadDir(dir)
                if err != nil {
                        return plugins, err
                }
                plugins = append(plugins, p)
        }
        return plugins, detectDuplicates(plugins)
}

// FindPlugins returns a list of YAML files that describe plugins.
func FindPlugins(plugdirs string) ([]*Plugin, error) {
        found := []*Plugin{}
        // Let's get all UNIXy and allow path separators
        for _, p := range filepath.SplitList(plugdirs) {
                matches, err := LoadAll(p)
                if err != nil {
                        return matches, err
                }
                found = append(found, matches...)
        }
        return found, nil
}

// SetupPluginEnv prepares os.Env for plugins. It operates on os.Env because
// the plugin subsystem itself needs access to the environment variables
// created here.
func SetupPluginEnv(settings *cli.EnvSettings, name, base string) {
        env := settings.EnvVars()
        env["HELM_PLUGIN_NAME"] = name
        env["HELM_PLUGIN_DIR"] = base
        for key, val := range env {
                os.Setenv(key, val)
        }
}

//go:build gofuzz
// +build gofuzz

// Copyright 2022 ADA Logics Ltd
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

package plugin

import (
        "os"

        fuzz "github.com/AdaLogics/go-fuzz-headers"
)

func FuzzFindPlugins(data []byte) int {
        err := os.Mkdir("fuzzdir", 0755)
        if err != nil {
                return 0
        }
        defer os.RemoveAll("fuzzdir")
        f := fuzz.NewConsumer(data)
        err = f.CreateFiles("fuzzdir")
        if err != nil {
                return 0
        }
        _, _ = FindPlugins("fuzzdir")
        return 1
}

func FuzzLoadAll(data []byte) int {
        err := os.Mkdir("fuzzdir", 0755)
        if err != nil {
                return 0
        }
        defer os.RemoveAll("fuzzdir")
        f := fuzz.NewConsumer(data)
        err = f.CreateFiles("fuzzdir")
        if err != nil {
                return 0
        }
        _, _ = LoadAll("fuzzdir")
        return 1
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package postrender

import (
        "bytes"
        "io"
        "os/exec"
        "path/filepath"

        "github.com/pkg/errors"
)

type execRender struct {
        binaryPath string
        args       []string
}

// NewExec returns a PostRenderer implementation that calls the provided binary.
// It returns an error if the binary cannot be found. If the path does not
// contain any separators, it will search in $PATH, otherwise it will resolve
// any relative paths to a fully qualified path
func NewExec(binaryPath string, args ...string) (PostRenderer, error) {
        fullPath, err := getFullPath(binaryPath)
        if err != nil {
                return nil, err
        }
        return &execRender{fullPath, args}, nil
}

// Run the configured binary for the post render
func (p *execRender) Run(renderedManifests *bytes.Buffer) (*bytes.Buffer, error) {
        cmd := exec.Command(p.binaryPath, p.args...)
        stdin, err := cmd.StdinPipe()
        if err != nil {
                return nil, err
        }

        var postRendered = &bytes.Buffer{}
        var stderr = &bytes.Buffer{}
        cmd.Stdout = postRendered
        cmd.Stderr = stderr

        go func() {
                defer stdin.Close()
                io.Copy(stdin, renderedManifests)
        }()
        err = cmd.Run()
        if err != nil {
                return nil, errors.Wrapf(err, "error while running command %s. error output:\n%s", p.binaryPath, stderr.String())
        }

        return postRendered, nil
}

// getFullPath returns the full filepath to the binary to execute. If the path
// does not contain any separators, it will search in $PATH, otherwise it will
// resolve any relative paths to a fully qualified path
func getFullPath(binaryPath string) (string, error) {
        // NOTE(thomastaylor312): I am leaving this code commented out here. During
        // the implementation of post-render, it was brought up that if we are
        // relying on plugins, we should actually use the plugin system so it can
        // properly handle multiple OSs. This will be a feature add in the future,
        // so I left this code for reference. It can be deleted or reused once the
        // feature is implemented

        // Manually check the plugin dir first
        // if !strings.Contains(binaryPath, string(filepath.Separator)) {
        //         // First check the plugin dir
        //         pluginDir := helmpath.DataPath("plugins") // Default location
        //         // If location for plugins is explicitly set, check there
        //         if v, ok := os.LookupEnv("HELM_PLUGINS"); ok {
        //                 pluginDir = v
        //         }
        //         // The plugins variable can actually contain multiple paths, so loop through those
        //         for _, p := range filepath.SplitList(pluginDir) {
        //                 _, err := os.Stat(filepath.Join(p, binaryPath))
        //                 if err != nil && !os.IsNotExist(err) {
        //                         return "", err
        //                 } else if err == nil {
        //                         binaryPath = filepath.Join(p, binaryPath)
        //                         break
        //                 }
        //         }
        // }

        // Now check for the binary using the given path or check if it exists in
        // the path and is executable
        checkedPath, err := exec.LookPath(binaryPath)
        if err != nil {
                return "", errors.Wrapf(err, "unable to find binary at %s", binaryPath)
        }

        return filepath.Abs(checkedPath)
}

package provenance

import (
        fuzz "github.com/AdaLogics/go-fuzz-headers"
        "os"
)

func FuzzNewFromFiles(data []byte) int {
        f := fuzz.NewConsumer(data)
        keyFileBytes, err := f.GetBytes()
        if err != nil {
                return 0
        }
        keyFile, err := os.Create("keyFile")
        if err != nil {
                return 0
        }
        defer keyFile.Close()
        defer os.Remove(keyFile.Name())
        _, err = keyFile.Write(keyFileBytes)
        if err != nil {
                return 0
        }
        keyringFile, err := os.Create("keyringFile ")
        if err != nil {
                return 0
        }
        defer keyringFile.Close()
        defer os.Remove(keyringFile.Name())
        keyringFileBytes, err := f.GetBytes()
        if err != nil {
                return 0
        }
        _, err = keyringFile.Write(keyringFileBytes)
        if err != nil {
                return 0
        }
        _, _ = NewFromFiles(keyFile.Name(), keyringFile.Name())
        return 1
}

func FuzzParseMessageBlock(data []byte) int {
        _, _, _ = parseMessageBlock(data)
        return 1
}

func FuzzMessageBlock(data []byte) int {
        f := fuzz.NewConsumer(data)
        err := os.Mkdir("fuzzDir", 0755)
        if err != nil {
                return 0
        }
        defer os.RemoveAll("fuzzDir")
        err = f.CreateFiles("fuzzDir")
        if err != nil {
                return 0
        }
        _, _ = messageBlock("fuzzDir")
        return 1
}

/*
Copyright The Helm Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package provenance

import (
        "bytes"
        "crypto"
        "encoding/hex"
        "io"
        "os"
        "path/filepath"
        "strings"

        "github.com/pkg/errors"
        "golang.org/x/crypto/openpgp"           //nolint
        "golang.org/x/crypto/openpgp/clearsign" //nolint
        "golang.org/x/crypto/openpgp/packet"    //nolint
        "sigs.k8s.io/yaml"

        hapi "helm.sh/helm/v3/pkg/chart"
        "helm.sh/helm/v3/pkg/chart/loader"
)

var defaultPGPConfig = packet.Config{
        DefaultHash: crypto.SHA512,
}

// SumCollection represents a collection of file and image checksums.
//
// Files are of the form:
//
//        FILENAME: "sha256:SUM"
//
// Images are of the form:
//
//        "IMAGE:TAG": "sha256:SUM"
//
// Docker optionally supports sha512, and if this is the case, the hash marker
// will be 'sha512' instead of 'sha256'.
type SumCollection struct {
        Files  map[string]string `json:"files"`
        Images map[string]string `json:"images,omitempty"`
}

// Verification contains information about a verification operation.
type Verification struct {
        // SignedBy contains the entity that signed a chart.
        SignedBy *openpgp.Entity
        // FileHash is the hash, prepended with the scheme, for the file that was verified.
        FileHash string
        // FileName is the name of the file that FileHash verifies.
        FileName string
}

// Signatory signs things.
//
// Signatories can be constructed from a PGP private key file using NewFromFiles
// or they can be constructed manually by setting the Entity to a valid
// PGP entity.
//
// The same Signatory can be used to sign or validate multiple charts.
type Signatory struct {
        // The signatory for this instance of Helm. This is used for signing.
        Entity *openpgp.Entity
        // The keyring for this instance of Helm. This is used for verification.
        KeyRing openpgp.EntityList
}

// NewFromFiles constructs a new Signatory from the PGP key in the given filename.
//
// This will emit an error if it cannot find a valid GPG keyfile (entity) at the
// given location.
//
// Note that the keyfile may have just a public key, just a private key, or
// both. The Signatory methods may have different requirements of the keys. For
// example, ClearSign must have a valid `openpgp.Entity.PrivateKey` before it
// can sign something.
func NewFromFiles(keyfile, keyringfile string) (*Signatory, error) {
        e, err := loadKey(keyfile)
        if err != nil {
                return nil, err
        }

        ring, err := loadKeyRing(keyringfile)
        if err != nil {
                return nil, err
        }

        return &Signatory{
                Entity:  e,
                KeyRing: ring,
        }, nil
}

// NewFromKeyring reads a keyring file and creates a Signatory.
//
// If id is not the empty string, this will also try to find an Entity in the
// keyring whose name matches, and set that as the signing entity. It will return
// an error if the id is not empty and also not found.
func NewFromKeyring(keyringfile, id string) (*Signatory, error) {
        ring, err := loadKeyRing(keyringfile)
        if err != nil {
                return nil, err
        }

        s := &Signatory{KeyRing: ring}

        // If the ID is empty, we can return now.
        if id == "" {
                return s, nil
        }

        // We're gonna go all GnuPG on this and look for a string that _contains_. If
        // two or more keys contain the string and none are a direct match, we error
        // out.
        var candidate *openpgp.Entity
        vague := false
        for _, e := range ring {
                for n := range e.Identities {
                        if n == id {
                                s.Entity = e
                                return s, nil
                        }
                        if strings.Contains(n, id) {
                                if candidate != nil {
                                        vague = true
                                }
                                candidate = e
                        }
                }
        }
        if vague {
                return s, errors.Errorf("more than one key contain the id %q", id)
        }

        s.Entity = candidate
        return s, nil
}

// PassphraseFetcher returns a passphrase for decrypting keys.
//
// This is used as a callback to read a passphrase from some other location. The
// given name is the Name field on the key, typically of the form:
//
//        USER_NAME (COMMENT) <EMAIL>
type PassphraseFetcher func(name string) ([]byte, error)

// DecryptKey decrypts a private key in the Signatory.
//
// If the key is not encrypted, this will return without error.
//
// If the key does not exist, this will return an error.
//
// If the key exists, but cannot be unlocked with the passphrase returned by
// the PassphraseFetcher, this will return an error.
//
// If the key is successfully unlocked, it will return nil.
func (s *Signatory) DecryptKey(fn PassphraseFetcher) error {
        if s.Entity == nil {
                return errors.New("private key not found")
        } else if s.Entity.PrivateKey == nil {
                return errors.New("provided key is not a private key. Try providing a keyring with secret keys")
        }

        // Nothing else to do if key is not encrypted.
        if !s.Entity.PrivateKey.Encrypted {
                return nil
        }

        fname := "Unknown"
        for i := range s.Entity.Identities {
                if i != "" {
                        fname = i
                        break
                }
        }

        p, err := fn(fname)
        if err != nil {
                return err
        }

        return s.Entity.PrivateKey.Decrypt(p)
}

// ClearSign signs a chart with the given key.
//
// This takes the path to a chart archive file and a key, and it returns a clear signature.
//
// The Signatory must have a valid Entity.PrivateKey for this to work. If it does
// not, an error will be returned.
func (s *Signatory) ClearSign(chartpath string) (string, error) {
        if s.Entity == nil {
                return "", errors.New("private key not found")
        } else if s.Entity.PrivateKey == nil {
                return "", errors.New("provided key is not a private key. Try providing a keyring with secret keys")
        }

        if fi, err := os.Stat(chartpath); err != nil {
                return "", err
        } else if fi.IsDir() {
                return "", errors.New("cannot sign a directory")
        }

        out := bytes.NewBuffer(nil)

        b, err := messageBlock(chartpath)
        if err != nil {
                return "", err
        }

        // Sign the buffer
        w, err := clearsign.Encode(out, s.Entity.PrivateKey, &defaultPGPConfig)
        if err != nil {
                return "", err
        }

        _, err = io.Copy(w, b)

        if err != nil {
                // NB: We intentionally don't call `w.Close()` here! `w.Close()` is the method which
                // actually does the PGP signing, and therefore is the part which uses the private key.
                // In other words, if we call Close here, there's a risk that there's an attempt to use the
                // private key to sign garbage data (since we know that io.Copy failed, `w` won't contain
                // anything useful).
                return "", errors.Wrap(err, "failed to write to clearsign encoder")
        }

        err = w.Close()
        if err != nil {
                return "", errors.Wrap(err, "failed to either sign or armor message block")
        }

        return out.String(), nil
}

// Verify checks a signature and verifies that it is legit for a chart.
func (s *Signatory) Verify(chartpath, sigpath string) (*Verification, error) {
        ver := &Verification{}
        for _, fname := range []string{chartpath, sigpath} {
                if fi, err := os.Stat(fname); err != nil {
                        return ver, err
                } else if fi.IsDir() {
                        return ver, errors.Errorf("%s cannot be a directory", fname)
                }
        }

        // First verify the signature
        sig, err := s.decodeSignature(sigpath)
        if err != nil {
                return ver, errors.Wrap(err, "failed to decode signature")
        }

        by, err := s.verifySignature(sig)
        if err != nil {
                return ver, err
        }
        ver.SignedBy = by

        // Second, verify the hash of the tarball.
        sum, err := DigestFile(chartpath)
        if err != nil {
                return ver, err
        }
        _, sums, err := parseMessageBlock(sig.Plaintext)
        if err != nil {
                return ver, err
        }

        sum = "sha256:" + sum
        basename := filepath.Base(chartpath)
        if sha, ok := sums.Files[basename]; !ok {
                return ver, errors.Errorf("provenance does not contain a SHA for a file named %q", basename)
        } else if sha != sum {
                return ver, errors.Errorf("sha256 sum does not match for %s: %q != %q", basename, sha, sum)
        }
        ver.FileHash = sum
        ver.FileName = basename

        // TODO: when image signing is added, verify that here.

        return ver, nil
}

func (s *Signatory) decodeSignature(filename string) (*clearsign.Block, error) {
        data, err := os.ReadFile(filename)
        if err != nil {
                return nil, err
        }

        block, _ := clearsign.Decode(data)
        if block == nil {
                // There was no sig in the file.
                return nil, errors.New("signature block not found")
        }

        return block, nil
}

// verifySignature verifies that the given block is validly signed, and returns the signer.
func (s *Signatory) verifySignature(block *clearsign.Block) (*openpgp.Entity, error) {
        return openpgp.CheckDetachedSignature(
                s.KeyRing,
                bytes.NewBuffer(block.Bytes),
                block.ArmoredSignature.Body,
        )
}

func messageBlock(chartpath string) (*bytes.Buffer, error) {
        var b *bytes.Buffer
        // Checksum the archive
        chash, err := DigestFile(chartpath)
        if err != nil {
                return b, err
        }

        base := filepath.Base(chartpath)
        sums := &SumCollection{
                Files: map[string]string{
                        base: "sha256:" + chash,
                },
        }

        // Load the archive into memory.
        chart, err := loader.LoadFile(chartpath)
        if err != nil {
                return b, err
        }

        // Buffer a hash + checksums YAML file
        data, err := yaml.Marshal(chart.Metadata)
        if err != nil {
                return b, err
        }

        // FIXME: YAML uses ---\n as a file start indicator, but this is not legal in a PGP
        // clearsign block. So we use ...\n, which is the YAML document end marker.
        // http://yaml.org/spec/1.2/spec.html#id2800168
        b = bytes.NewBuffer(data)
        b.WriteString("\n...\n")

        data, err = yaml.Marshal(sums)
        if err != nil {
                return b, err
        }
        b.Write(data)

        return b, nil
}

// parseMessageBlock
func parseMessageBlock(data []byte) (*hapi.Metadata, *SumCollection, error) {
        // This sucks.
        parts := bytes.Split(data, []byte("\n...\n"))
        if len(parts) < 2 {
                return nil, nil, errors.New("message block must have at least two parts")
        }

        md := &hapi.Metadata{}
        sc := &SumCollection{}

        if err := yaml.Unmarshal(parts[0], md); err != nil {
                return md, sc, err
        }
        err := yaml.Unmarshal(parts[1], sc)
        return md, sc, err
}

// loadKey loads a GPG key found at a particular path.
func loadKey(keypath string) (*openpgp.Entity, error) {
        f, err := os.Open(keypath)
        if err != nil {
                return nil, err
        }
        defer f.Close()

        pr := packet.NewReader(f)
        return openpgp.ReadEntity(pr)
}

func loadKeyRing(ringpath string) (openpgp.EntityList, error) {
        f, err := os.Open(ringpath)
        if err != nil {
                return nil, err
        }
        defer f.Close()
        return openpgp.ReadKeyRing(f)
}

// DigestFile calculates a SHA256 hash (like Docker) for a given file.
//
// It takes the path to the archive file, and returns a string representation of
// the SHA256 sum.
//
// The intended use of this function is to generate a sum of a chart TGZ file.
func DigestFile(filename string) (string, error) {
        f, err := os.Open(filename)
        if err != nil {
                return "", err
        }
        defer f.Close()
        return Digest(f)
}

// Digest hashes a reader and returns a SHA256 digest.
//
// Helm uses SHA256 as its default hash for all non-cryptographic applications.
func Digest(in io.Reader) (string, error) {
        hash := crypto.SHA256.New()
        if _, err := io.Copy(hash, in); err != nil {
                return "", nil
        }
        return hex.EncodeToString(hash.Sum(nil)), nil
}

/*
Copyright The Helm Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package pusher

import (
        "fmt"
        "net"
        "net/http"
        "os"
        "path"
        "strings"
        "time"

        "github.com/pkg/errors"

        "helm.sh/helm/v3/internal/tlsutil"
        "helm.sh/helm/v3/pkg/chart/loader"
        "helm.sh/helm/v3/pkg/registry"
)

// OCIPusher is the default OCI backend handler
type OCIPusher struct {
        opts options
}

// Push performs a Push from repo.Pusher.
func (pusher *OCIPusher) Push(chartRef, href string, options ...Option) error {
        for _, opt := range options {
                opt(&pusher.opts)
        }
        return pusher.push(chartRef, href)
}

func (pusher *OCIPusher) push(chartRef, href string) error {
        stat, err := os.Stat(chartRef)
        if err != nil {
                if os.IsNotExist(err) {
                        return errors.Errorf("%s: no such file", chartRef)
                }
                return err
        }
        if stat.IsDir() {
                return errors.New("cannot push directory, must provide chart archive (.tgz)")
        }

        meta, err := loader.Load(chartRef)
        if err != nil {
                return err
        }

        client := pusher.opts.registryClient
        if client == nil {
                c, err := pusher.newRegistryClient()
                if err != nil {
                        return err
                }
                client = c
        }

        chartBytes, err := os.ReadFile(chartRef)
        if err != nil {
                return err
        }

        var pushOpts []registry.PushOption
        provRef := fmt.Sprintf("%s.prov", chartRef)
        if _, err := os.Stat(provRef); err == nil {
                provBytes, err := os.ReadFile(provRef)
                if err != nil {
                        return err
                }
                pushOpts = append(pushOpts, registry.PushOptProvData(provBytes))
        }

        ref := fmt.Sprintf("%s:%s",
                path.Join(strings.TrimPrefix(href, fmt.Sprintf("%s://", registry.OCIScheme)), meta.Metadata.Name),
                meta.Metadata.Version)

        _, err = client.Push(chartBytes, ref, pushOpts...)
        return err
}

// NewOCIPusher constructs a valid OCI client as a Pusher
func NewOCIPusher(ops ...Option) (Pusher, error) {
        var client OCIPusher

        for _, opt := range ops {
                opt(&client.opts)
        }

        return &client, nil
}

func (pusher *OCIPusher) newRegistryClient() (*registry.Client, error) {
        if (pusher.opts.certFile != "" && pusher.opts.keyFile != "") || pusher.opts.caFile != "" || pusher.opts.insecureSkipTLSverify {
                tlsConf, err := tlsutil.NewClientTLS(pusher.opts.certFile, pusher.opts.keyFile, pusher.opts.caFile, pusher.opts.insecureSkipTLSverify)
                if err != nil {
                        return nil, errors.Wrap(err, "can't create TLS config for client")
                }

                registryClient, err := registry.NewClient(
                        registry.ClientOptHTTPClient(&http.Client{
                                // From https://github.com/google/go-containerregistry/blob/31786c6cbb82d6ec4fb8eb79cd9387905130534e/pkg/v1/remote/options.go#L87
                                Transport: &http.Transport{
                                        Proxy: http.ProxyFromEnvironment,
                                        DialContext: (&net.Dialer{
                                                // By default we wrap the transport in retries, so reduce the
                                                // default dial timeout to 5s to avoid 5x 30s of connection
                                                // timeouts when doing the "ping" on certain http registries.
                                                Timeout:   5 * time.Second,
                                                KeepAlive: 30 * time.Second,
                                        }).DialContext,
                                        ForceAttemptHTTP2:     true,
                                        MaxIdleConns:          100,
                                        IdleConnTimeout:       90 * time.Second,
                                        TLSHandshakeTimeout:   10 * time.Second,
                                        ExpectContinueTimeout: 1 * time.Second,
                                        TLSClientConfig:       tlsConf,
                                },
                        }),
                        registry.ClientOptEnableCache(true),
                )
                if err != nil {
                        return nil, err
                }
                return registryClient, nil
        }

        opts := []registry.ClientOption{registry.ClientOptEnableCache(true)}
        if pusher.opts.plainHTTP {
                opts = append(opts, registry.ClientOptPlainHTTP())
        }

        registryClient, err := registry.NewClient(opts...)
        if err != nil {
                return nil, err
        }
        return registryClient, nil
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package pusher

import (
        "github.com/pkg/errors"

        "helm.sh/helm/v3/pkg/cli"
        "helm.sh/helm/v3/pkg/registry"
)

// options are generic parameters to be provided to the pusher during instantiation.
//
// Pushers may or may not ignore these parameters as they are passed in.
type options struct {
        registryClient        *registry.Client
        certFile              string
        keyFile               string
        caFile                string
        insecureSkipTLSverify bool
        plainHTTP             bool
}

// Option allows specifying various settings configurable by the user for overriding the defaults
// used when performing Push operations with the Pusher.
type Option func(*options)

// WithRegistryClient sets the registryClient option.
func WithRegistryClient(client *registry.Client) Option {
        return func(opts *options) {
                opts.registryClient = client
        }
}

// WithTLSClientConfig sets the client auth with the provided credentials.
func WithTLSClientConfig(certFile, keyFile, caFile string) Option {
        return func(opts *options) {
                opts.certFile = certFile
                opts.keyFile = keyFile
                opts.caFile = caFile
        }
}

// WithInsecureSkipTLSVerify determines if a TLS Certificate will be checked
func WithInsecureSkipTLSVerify(insecureSkipTLSVerify bool) Option {
        return func(opts *options) {
                opts.insecureSkipTLSverify = insecureSkipTLSVerify
        }
}

func WithPlainHTTP(plainHTTP bool) Option {
        return func(opts *options) {
                opts.plainHTTP = plainHTTP
        }
}

// Pusher is an interface to support upload to the specified URL.
type Pusher interface {
        // Push file content by url string
        Push(chartRef, url string, options ...Option) error
}

// Constructor is the function for every pusher which creates a specific instance
// according to the configuration
type Constructor func(options ...Option) (Pusher, error)

// Provider represents any pusher and the schemes that it supports.
type Provider struct {
        Schemes []string
        New     Constructor
}

// Provides returns true if the given scheme is supported by this Provider.
func (p Provider) Provides(scheme string) bool {
        for _, i := range p.Schemes {
                if i == scheme {
                        return true
                }
        }
        return false
}

// Providers is a collection of Provider objects.
type Providers []Provider

// ByScheme returns a Provider that handles the given scheme.
//
// If no provider handles this scheme, this will return an error.
func (p Providers) ByScheme(scheme string) (Pusher, error) {
        for _, pp := range p {
                if pp.Provides(scheme) {
                        return pp.New()
                }
        }
        return nil, errors.Errorf("scheme %q not supported", scheme)
}

var ociProvider = Provider{
        Schemes: []string{registry.OCIScheme},
        New:     NewOCIPusher,
}

// All finds all of the registered pushers as a list of Provider instances.
// Currently, just the built-in pushers are collected.
func All(settings *cli.EnvSettings) Providers {
        result := Providers{ociProvider}
        return result
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package registry // import "helm.sh/helm/v3/pkg/registry"

import (
        "context"
        "encoding/json"
        "fmt"
        "io"
        "net/http"
        "sort"
        "strings"

        "github.com/Masterminds/semver/v3"
        "github.com/containerd/containerd/remotes"
        ocispec "github.com/opencontainers/image-spec/specs-go/v1"
        "github.com/pkg/errors"
        "oras.land/oras-go/pkg/auth"
        dockerauth "oras.land/oras-go/pkg/auth/docker"
        "oras.land/oras-go/pkg/content"
        "oras.land/oras-go/pkg/oras"
        "oras.land/oras-go/pkg/registry"
        registryremote "oras.land/oras-go/pkg/registry/remote"
        registryauth "oras.land/oras-go/pkg/registry/remote/auth"

        "helm.sh/helm/v3/internal/version"
        "helm.sh/helm/v3/pkg/chart"
        "helm.sh/helm/v3/pkg/helmpath"
)

// See https://github.com/helm/helm/issues/10166
const registryUnderscoreMessage = `
OCI artifact references (e.g. tags) do not support the plus sign (+). To support
storing semantic versions, Helm adopts the convention of changing plus (+) to
an underscore (_) in chart version tags when pushing to a registry and back to
a plus (+) when pulling from a registry.`

type (
        // Client works with OCI-compliant registries
        Client struct {
                debug       bool
                enableCache bool
                // path to repository config file e.g. ~/.docker/config.json
                credentialsFile    string
                out                io.Writer
                authorizer         auth.Client
                registryAuthorizer *registryauth.Client
                resolver           func(ref registry.Reference) (remotes.Resolver, error)
                httpClient         *http.Client
                plainHTTP          bool
        }

        // ClientOption allows specifying various settings configurable by the user for overriding the defaults
        // used when creating a new default client
        ClientOption func(*Client)
)

// NewClient returns a new registry client with config
func NewClient(options ...ClientOption) (*Client, error) {
        client := &Client{
                out: io.Discard,
        }
        for _, option := range options {
                option(client)
        }
        if client.credentialsFile == "" {
                client.credentialsFile = helmpath.ConfigPath(CredentialsFileBasename)
        }
        if client.authorizer == nil {
                authClient, err := dockerauth.NewClientWithDockerFallback(client.credentialsFile)
                if err != nil {
                        return nil, err
                }
                client.authorizer = authClient
        }

        resolverFn := client.resolver // copy for avoiding recursive call
        client.resolver = func(ref registry.Reference) (remotes.Resolver, error) {
                if resolverFn != nil {
                        // validate if the resolverFn returns a valid resolver
                        if resolver, err := resolverFn(ref); resolver != nil && err == nil {
                                return resolver, nil
                        }
                }
                headers := http.Header{}
                headers.Set("User-Agent", version.GetUserAgent())
                opts := []auth.ResolverOption{auth.WithResolverHeaders(headers)}
                if client.httpClient != nil {
                        opts = append(opts, auth.WithResolverClient(client.httpClient))
                }
                if client.plainHTTP {
                        opts = append(opts, auth.WithResolverPlainHTTP())
                }
                resolver, err := client.authorizer.ResolverWithOpts(opts...)
                if err != nil {
                        return nil, err
                }
                return resolver, nil
        }

        // allocate a cache if option is set
        var cache registryauth.Cache
        if client.enableCache {
                cache = registryauth.DefaultCache
        }
        if client.registryAuthorizer == nil {
                client.registryAuthorizer = &registryauth.Client{
                        Client: client.httpClient,
                        Header: http.Header{
                                "User-Agent": {version.GetUserAgent()},
                        },
                        Cache: cache,
                        Credential: func(ctx context.Context, reg string) (registryauth.Credential, error) {
                                dockerClient, ok := client.authorizer.(*dockerauth.Client)
                                if !ok {
                                        return registryauth.EmptyCredential, errors.New("unable to obtain docker client")
                                }

                                username, password, err := dockerClient.Credential(reg)
                                if err != nil {
                                        return registryauth.EmptyCredential, errors.New("unable to retrieve credentials")
                                }

                                // A blank returned username and password value is a bearer token
                                if username == "" && password != "" {
                                        return registryauth.Credential{
                                                RefreshToken: password,
                                        }, nil
                                }

                                return registryauth.Credential{
                                        Username: username,
                                        Password: password,
                                }, nil

                        },
                }

        }
        return client, nil
}

// ClientOptDebug returns a function that sets the debug setting on client options set
func ClientOptDebug(debug bool) ClientOption {
        return func(client *Client) {
                client.debug = debug
        }
}

// ClientOptEnableCache returns a function that sets the enableCache setting on a client options set
func ClientOptEnableCache(enableCache bool) ClientOption {
        return func(client *Client) {
                client.enableCache = enableCache
        }
}

// ClientOptWriter returns a function that sets the writer setting on client options set
func ClientOptWriter(out io.Writer) ClientOption {
        return func(client *Client) {
                client.out = out
        }
}

// ClientOptCredentialsFile returns a function that sets the credentialsFile setting on a client options set
func ClientOptCredentialsFile(credentialsFile string) ClientOption {
        return func(client *Client) {
                client.credentialsFile = credentialsFile
        }
}

// ClientOptHTTPClient returns a function that sets the httpClient setting on a client options set
func ClientOptHTTPClient(httpClient *http.Client) ClientOption {
        return func(client *Client) {
                client.httpClient = httpClient
        }
}

func ClientOptPlainHTTP() ClientOption {
        return func(c *Client) {
                c.plainHTTP = true
        }
}

// ClientOptResolver returns a function that sets the resolver setting on a client options set
func ClientOptResolver(resolver remotes.Resolver) ClientOption {
        return func(client *Client) {
                client.resolver = func(ref registry.Reference) (remotes.Resolver, error) {
                        return resolver, nil
                }
        }
}

type (
        // LoginOption allows specifying various settings on login
        LoginOption func(*loginOperation)

        loginOperation struct {
                username string
                password string
                insecure bool
                certFile string
                keyFile  string
                caFile   string
        }
)

// Login logs into a registry
func (c *Client) Login(host string, options ...LoginOption) error {
        operation := &loginOperation{}
        for _, option := range options {
                option(operation)
        }
        authorizerLoginOpts := []auth.LoginOption{
                auth.WithLoginContext(ctx(c.out, c.debug)),
                auth.WithLoginHostname(host),
                auth.WithLoginUsername(operation.username),
                auth.WithLoginSecret(operation.password),
                auth.WithLoginUserAgent(version.GetUserAgent()),
                auth.WithLoginTLS(operation.certFile, operation.keyFile, operation.caFile),
        }
        if operation.insecure {
                authorizerLoginOpts = append(authorizerLoginOpts, auth.WithLoginInsecure())
        }
        if err := c.authorizer.LoginWithOpts(authorizerLoginOpts...); err != nil {
                return err
        }
        fmt.Fprintln(c.out, "Login Succeeded")
        return nil
}

// LoginOptBasicAuth returns a function that sets the username/password settings on login
func LoginOptBasicAuth(username string, password string) LoginOption {
        return func(operation *loginOperation) {
                operation.username = username
                operation.password = password
        }
}

// LoginOptInsecure returns a function that sets the insecure setting on login
func LoginOptInsecure(insecure bool) LoginOption {
        return func(operation *loginOperation) {
                operation.insecure = insecure
        }
}

// LoginOptTLSClientConfig returns a function that sets the TLS settings on login.
func LoginOptTLSClientConfig(certFile, keyFile, caFile string) LoginOption {
        return func(operation *loginOperation) {
                operation.certFile = certFile
                operation.keyFile = keyFile
                operation.caFile = caFile
        }
}

type (
        // LogoutOption allows specifying various settings on logout
        LogoutOption func(*logoutOperation)

        logoutOperation struct{}
)

// Logout logs out of a registry
func (c *Client) Logout(host string, opts ...LogoutOption) error {
        operation := &logoutOperation{}
        for _, opt := range opts {
                opt(operation)
        }
        if err := c.authorizer.Logout(ctx(c.out, c.debug), host); err != nil {
                return err
        }
        fmt.Fprintf(c.out, "Removing login credentials for %s\n", host)
        return nil
}

type (
        // PullOption allows specifying various settings on pull
        PullOption func(*pullOperation)

        // PullResult is the result returned upon successful pull.
        PullResult struct {
                Manifest *DescriptorPullSummary         `json:"manifest"`
                Config   *DescriptorPullSummary         `json:"config"`
                Chart    *DescriptorPullSummaryWithMeta `json:"chart"`
                Prov     *DescriptorPullSummary         `json:"prov"`
                Ref      string                         `json:"ref"`
        }

        DescriptorPullSummary struct {
                Data   []byte `json:"-"`
                Digest string `json:"digest"`
                Size   int64  `json:"size"`
        }

        DescriptorPullSummaryWithMeta struct {
                DescriptorPullSummary
                Meta *chart.Metadata `json:"meta"`
        }

        pullOperation struct {
                withChart         bool
                withProv          bool
                ignoreMissingProv bool
        }
)

// Pull downloads a chart from a registry
func (c *Client) Pull(ref string, options ...PullOption) (*PullResult, error) {
        parsedRef, err := parseReference(ref)
        if err != nil {
                return nil, err
        }

        operation := &pullOperation{
                withChart: true, // By default, always download the chart layer
        }
        for _, option := range options {
                option(operation)
        }
        if !operation.withChart && !operation.withProv {
                return nil, errors.New(
                        "must specify at least one layer to pull (chart/prov)")
        }
        memoryStore := content.NewMemory()
        allowedMediaTypes := []string{
                ConfigMediaType,
        }
        minNumDescriptors := 1 // 1 for the config
        if operation.withChart {
                minNumDescriptors++
                allowedMediaTypes = append(allowedMediaTypes, ChartLayerMediaType, LegacyChartLayerMediaType)
        }
        if operation.withProv {
                if !operation.ignoreMissingProv {
                        minNumDescriptors++
                }
                allowedMediaTypes = append(allowedMediaTypes, ProvLayerMediaType)
        }

        var descriptors, layers []ocispec.Descriptor
        remotesResolver, err := c.resolver(parsedRef)
        if err != nil {
                return nil, err
        }
        registryStore := content.Registry{Resolver: remotesResolver}

        manifest, err := oras.Copy(ctx(c.out, c.debug), registryStore, parsedRef.String(), memoryStore, "",
                oras.WithPullEmptyNameAllowed(),
                oras.WithAllowedMediaTypes(allowedMediaTypes),
                oras.WithLayerDescriptors(func(l []ocispec.Descriptor) {
                        layers = l
                }))
        if err != nil {
                return nil, err
        }

        descriptors = append(descriptors, manifest)
        descriptors = append(descriptors, layers...)

        numDescriptors := len(descriptors)
        if numDescriptors < minNumDescriptors {
                return nil, fmt.Errorf("manifest does not contain minimum number of descriptors (%d), descriptors found: %d",
                        minNumDescriptors, numDescriptors)
        }
        var configDescriptor *ocispec.Descriptor
        var chartDescriptor *ocispec.Descriptor
        var provDescriptor *ocispec.Descriptor
        for _, descriptor := range descriptors {
                d := descriptor
                switch d.MediaType {
                case ConfigMediaType:
                        configDescriptor = &d
                case ChartLayerMediaType:
                        chartDescriptor = &d
                case ProvLayerMediaType:
                        provDescriptor = &d
                case LegacyChartLayerMediaType:
                        chartDescriptor = &d
                        fmt.Fprintf(c.out, "Warning: chart media type %s is deprecated\n", LegacyChartLayerMediaType)
                }
        }
        if configDescriptor == nil {
                return nil, fmt.Errorf("could not load config with mediatype %s", ConfigMediaType)
        }
        if operation.withChart && chartDescriptor == nil {
                return nil, fmt.Errorf("manifest does not contain a layer with mediatype %s",
                        ChartLayerMediaType)
        }
        var provMissing bool
        if operation.withProv && provDescriptor == nil {
                if operation.ignoreMissingProv {
                        provMissing = true
                } else {
                        return nil, fmt.Errorf("manifest does not contain a layer with mediatype %s",
                                ProvLayerMediaType)
                }
        }
        result := &PullResult{
                Manifest: &DescriptorPullSummary{
                        Digest: manifest.Digest.String(),
                        Size:   manifest.Size,
                },
                Config: &DescriptorPullSummary{
                        Digest: configDescriptor.Digest.String(),
                        Size:   configDescriptor.Size,
                },
                Chart: &DescriptorPullSummaryWithMeta{},
                Prov:  &DescriptorPullSummary{},
                Ref:   parsedRef.String(),
        }
        var getManifestErr error
        if _, manifestData, ok := memoryStore.Get(manifest); !ok {
                getManifestErr = errors.Errorf("Unable to retrieve blob with digest %s", manifest.Digest)
        } else {
                result.Manifest.Data = manifestData
        }
        if getManifestErr != nil {
                return nil, getManifestErr
        }
        var getConfigDescriptorErr error
        if _, configData, ok := memoryStore.Get(*configDescriptor); !ok {
                getConfigDescriptorErr = errors.Errorf("Unable to retrieve blob with digest %s", configDescriptor.Digest)
        } else {
                result.Config.Data = configData
                var meta *chart.Metadata
                if err := json.Unmarshal(configData, &meta); err != nil {
                        return nil, err
                }
                result.Chart.Meta = meta
        }
        if getConfigDescriptorErr != nil {
                return nil, getConfigDescriptorErr
        }
        if operation.withChart {
                var getChartDescriptorErr error
                if _, chartData, ok := memoryStore.Get(*chartDescriptor); !ok {
                        getChartDescriptorErr = errors.Errorf("Unable to retrieve blob with digest %s", chartDescriptor.Digest)
                } else {
                        result.Chart.Data = chartData
                        result.Chart.Digest = chartDescriptor.Digest.String()
                        result.Chart.Size = chartDescriptor.Size
                }
                if getChartDescriptorErr != nil {
                        return nil, getChartDescriptorErr
                }
        }
        if operation.withProv && !provMissing {
                var getProvDescriptorErr error
                if _, provData, ok := memoryStore.Get(*provDescriptor); !ok {
                        getProvDescriptorErr = errors.Errorf("Unable to retrieve blob with digest %s", provDescriptor.Digest)
                } else {
                        result.Prov.Data = provData
                        result.Prov.Digest = provDescriptor.Digest.String()
                        result.Prov.Size = provDescriptor.Size
                }
                if getProvDescriptorErr != nil {
                        return nil, getProvDescriptorErr
                }
        }

        fmt.Fprintf(c.out, "Pulled: %s\n", result.Ref)
        fmt.Fprintf(c.out, "Digest: %s\n", result.Manifest.Digest)

        if strings.Contains(result.Ref, "_") {
                fmt.Fprintf(c.out, "%s contains an underscore.\n", result.Ref)
                fmt.Fprint(c.out, registryUnderscoreMessage+"\n")
        }

        return result, nil
}

// PullOptWithChart returns a function that sets the withChart setting on pull
func PullOptWithChart(withChart bool) PullOption {
        return func(operation *pullOperation) {
                operation.withChart = withChart
        }
}

// PullOptWithProv returns a function that sets the withProv setting on pull
func PullOptWithProv(withProv bool) PullOption {
        return func(operation *pullOperation) {
                operation.withProv = withProv
        }
}

// PullOptIgnoreMissingProv returns a function that sets the ignoreMissingProv setting on pull
func PullOptIgnoreMissingProv(ignoreMissingProv bool) PullOption {
        return func(operation *pullOperation) {
                operation.ignoreMissingProv = ignoreMissingProv
        }
}

type (
        // PushOption allows specifying various settings on push
        PushOption func(*pushOperation)

        // PushResult is the result returned upon successful push.
        PushResult struct {
                Manifest *descriptorPushSummary         `json:"manifest"`
                Config   *descriptorPushSummary         `json:"config"`
                Chart    *descriptorPushSummaryWithMeta `json:"chart"`
                Prov     *descriptorPushSummary         `json:"prov"`
                Ref      string                         `json:"ref"`
        }

        descriptorPushSummary struct {
                Digest string `json:"digest"`
                Size   int64  `json:"size"`
        }

        descriptorPushSummaryWithMeta struct {
                descriptorPushSummary
                Meta *chart.Metadata `json:"meta"`
        }

        pushOperation struct {
                provData   []byte
                strictMode bool
                test       bool
        }
)

// Push uploads a chart to a registry.
func (c *Client) Push(data []byte, ref string, options ...PushOption) (*PushResult, error) {
        parsedRef, err := parseReference(ref)
        if err != nil {
                return nil, err
        }

        operation := &pushOperation{
                strictMode: true, // By default, enable strict mode
        }
        for _, option := range options {
                option(operation)
        }
        meta, err := extractChartMeta(data)
        if err != nil {
                return nil, err
        }
        if operation.strictMode {
                if !strings.HasSuffix(ref, fmt.Sprintf("/%s:%s", meta.Name, meta.Version)) {
                        return nil, errors.New(
                                "strict mode enabled, ref basename and tag must match the chart name and version")
                }
        }
        memoryStore := content.NewMemory()
        chartDescriptor, err := memoryStore.Add("", ChartLayerMediaType, data)
        if err != nil {
                return nil, err
        }

        configData, err := json.Marshal(meta)
        if err != nil {
                return nil, err
        }

        configDescriptor, err := memoryStore.Add("", ConfigMediaType, configData)
        if err != nil {
                return nil, err
        }

        descriptors := []ocispec.Descriptor{chartDescriptor}
        var provDescriptor ocispec.Descriptor
        if operation.provData != nil {
                provDescriptor, err = memoryStore.Add("", ProvLayerMediaType, operation.provData)
                if err != nil {
                        return nil, err
                }

                descriptors = append(descriptors, provDescriptor)
        }

        ociAnnotations := generateOCIAnnotations(meta, operation.test)

        manifestData, manifest, err := content.GenerateManifest(&configDescriptor, ociAnnotations, descriptors...)
        if err != nil {
                return nil, err
        }

        if err := memoryStore.StoreManifest(parsedRef.String(), manifest, manifestData); err != nil {
                return nil, err
        }

        remotesResolver, err := c.resolver(parsedRef)
        if err != nil {
                return nil, err
        }
        registryStore := content.Registry{Resolver: remotesResolver}
        _, err = oras.Copy(ctx(c.out, c.debug), memoryStore, parsedRef.String(), registryStore, "",
                oras.WithNameValidation(nil))
        if err != nil {
                return nil, err
        }
        chartSummary := &descriptorPushSummaryWithMeta{
                Meta: meta,
        }
        chartSummary.Digest = chartDescriptor.Digest.String()
        chartSummary.Size = chartDescriptor.Size
        result := &PushResult{
                Manifest: &descriptorPushSummary{
                        Digest: manifest.Digest.String(),
                        Size:   manifest.Size,
                },
                Config: &descriptorPushSummary{
                        Digest: configDescriptor.Digest.String(),
                        Size:   configDescriptor.Size,
                },
                Chart: chartSummary,
                Prov:  &descriptorPushSummary{}, // prevent nil references
                Ref:   parsedRef.String(),
        }
        if operation.provData != nil {
                result.Prov = &descriptorPushSummary{
                        Digest: provDescriptor.Digest.String(),
                        Size:   provDescriptor.Size,
                }
        }
        fmt.Fprintf(c.out, "Pushed: %s\n", result.Ref)
        fmt.Fprintf(c.out, "Digest: %s\n", result.Manifest.Digest)
        if strings.Contains(parsedRef.Reference, "_") {
                fmt.Fprintf(c.out, "%s contains an underscore.\n", result.Ref)
                fmt.Fprint(c.out, registryUnderscoreMessage+"\n")
        }

        return result, err
}

// PushOptProvData returns a function that sets the prov bytes setting on push
func PushOptProvData(provData []byte) PushOption {
        return func(operation *pushOperation) {
                operation.provData = provData
        }
}

// PushOptStrictMode returns a function that sets the strictMode setting on push
func PushOptStrictMode(strictMode bool) PushOption {
        return func(operation *pushOperation) {
                operation.strictMode = strictMode
        }
}

// PushOptTest returns a function that sets whether test setting on push
func PushOptTest(test bool) PushOption {
        return func(operation *pushOperation) {
                operation.test = test
        }
}

// Tags provides a sorted list all semver compliant tags for a given repository
func (c *Client) Tags(ref string) ([]string, error) {
        parsedReference, err := registry.ParseReference(ref)
        if err != nil {
                return nil, err
        }

        repository := registryremote.Repository{
                Reference: parsedReference,
                Client:    c.registryAuthorizer,
                PlainHTTP: c.plainHTTP,
        }

        var registryTags []string

        registryTags, err = registry.Tags(ctx(c.out, c.debug), &repository)
        if err != nil {
                return nil, err
        }

        var tagVersions []*semver.Version
        for _, tag := range registryTags {
                // Change underscore (_) back to plus (+) for Helm
                // See https://github.com/helm/helm/issues/10166
                tagVersion, err := semver.StrictNewVersion(strings.ReplaceAll(tag, "_", "+"))
                if err == nil {
                        tagVersions = append(tagVersions, tagVersion)
                }
        }

        // Sort the collection
        sort.Sort(sort.Reverse(semver.Collection(tagVersions)))

        tags := make([]string, len(tagVersions))

        for iTv, tv := range tagVersions {
                tags[iTv] = tv.String()
        }

        return tags, nil

}

//go:build gofuzz
// +build gofuzz

// Copyright 2022 ADA Logics Ltd
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

package registry

import (
        "bytes"
        "context"
        "fmt"
        fuzz "github.com/AdaLogics/go-fuzz-headers"
        "github.com/distribution/distribution/v3/configuration"
        "github.com/distribution/distribution/v3/registry"
        _ "github.com/distribution/distribution/v3/registry/storage/driver/inmemory"
        _ "github.com/distribution/distribution/v3/registry/auth/htpasswd"
        "github.com/phayes/freeport"
        "golang.org/x/crypto/bcrypt"
        "io/ioutil"
        "os"
        "path/filepath"
        "time"
)

var (
        fuzzWorkspaceDir         = "helm-registry-test"
        fuzzHtpasswdFileBasename = "authtest.htpasswd"
        fuzzUsername             = "myuser"
        fuzzPassword             = "mypass"
        quit                     = make(chan os.Signal, 1)
)

func FuzzGetTagMatchingVersionOrConstraint(data []byte) int {
        f := fuzz.NewConsumer(data)
        var tags []string
        err := f.CreateSlice(&tags)
        if err != nil {
                return 0
        }
        versionString, err := f.GetString()
        if err != nil {
                return 0
        }
        _, _ = GetTagMatchingVersionOrConstraint(tags, versionString)
        return 1

}

func FuzzparseReference(data []byte) int {
        _, _ = parseReference(string(data))
        return 1
}

func setupRegistry() (*registry.Registry, *Client, string, error) {
        os.RemoveAll(fuzzWorkspaceDir)
        os.Mkdir(fuzzWorkspaceDir, 0700)

        var out bytes.Buffer
        credentialsFile := filepath.Join(fuzzWorkspaceDir, CredentialsFileBasename)

        // init test client
        var err error
        registryClient, err := NewClient(
                ClientOptDebug(true),
                ClientOptWriter(&out),
                ClientOptCredentialsFile(credentialsFile),
        )
        if err != nil {
                return nil, nil, "", err
        }

        // create htpasswd file (w BCrypt, which is required)
        pwBytes, err := bcrypt.GenerateFromPassword([]byte(fuzzPassword), bcrypt.DefaultCost)
        if err != nil {
                return nil, nil, "", err
        }
        htpasswdPath := filepath.Join(fuzzWorkspaceDir, fuzzHtpasswdFileBasename)
        err = ioutil.WriteFile(htpasswdPath, []byte(fmt.Sprintf("%s:%s\n", fuzzUsername, string(pwBytes))), 0644)
        if err != nil {
                return nil, nil, "", err
        }

        // Registry config
        config := &configuration.Configuration{}
        port, err := freeport.GetFreePort()
        if err != nil {
                return nil, nil, "", err
        }
        dockerRegistryHost := fmt.Sprintf("localhost:%d", port)
        config.HTTP.Addr = fmt.Sprintf("127.0.0.1:%d", port)
        config.HTTP.DrainTimeout = time.Duration(10) * time.Second
        config.Storage = map[string]configuration.Parameters{"inmemory": map[string]interface{}{}}
        config.Auth = configuration.Auth{
                "htpasswd": configuration.Parameters{
                        "realm": "localhost",
                        "path":  htpasswdPath,
                },
        }
        config.Log.Level = "panic"
        dockerRegistry, err := registry.NewRegistry(context.Background(), config)
        if err != nil {
                return nil, nil, "", err
        }

        return dockerRegistry, registryClient, dockerRegistryHost, nil
}

func FuzzRegistryClient(data []byte) int {
        dockerRegistry, registryClient, dockerRegistryHost, err := setupRegistry()
        if err != nil {
                return 0
        }
        defer os.RemoveAll(fuzzWorkspaceDir)

        var errchan chan error
        go func() {
                errchan <- dockerRegistry.ListenAndServe()
        }()

        ref := fmt.Sprintf("%s/testrepo/testchart:1.2.3", dockerRegistryHost)
        _, _ = registryClient.Push(data, ref)
        _, _ = registryClient.Pull(ref)

        return 1
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package registry // import "helm.sh/helm/v3/pkg/registry"

import (
        "bytes"
        "context"
        "fmt"
        "io"
        "net/http"
        "strings"
        "time"

        helmtime "helm.sh/helm/v3/pkg/time"

        "github.com/Masterminds/semver/v3"
        ocispec "github.com/opencontainers/image-spec/specs-go/v1"
        "github.com/pkg/errors"
        "github.com/sirupsen/logrus"
        orascontext "oras.land/oras-go/pkg/context"
        "oras.land/oras-go/pkg/registry"

        "helm.sh/helm/v3/internal/tlsutil"
        "helm.sh/helm/v3/pkg/chart"
        "helm.sh/helm/v3/pkg/chart/loader"
)

var immutableOciAnnotations = []string{
        ocispec.AnnotationVersion,
        ocispec.AnnotationTitle,
}

// IsOCI determines whether or not a URL is to be treated as an OCI URL
func IsOCI(url string) bool {
        return strings.HasPrefix(url, fmt.Sprintf("%s://", OCIScheme))
}

// ContainsTag determines whether a tag is found in a provided list of tags
func ContainsTag(tags []string, tag string) bool {
        for _, t := range tags {
                if tag == t {
                        return true
                }
        }
        return false
}

func GetTagMatchingVersionOrConstraint(tags []string, versionString string) (string, error) {
        var constraint *semver.Constraints
        if versionString == "" {
                // If string is empty, set wildcard constraint
                constraint, _ = semver.NewConstraint("*")
        } else {
                // when customer input exact version, check whether have exact match
                // one first
                for _, v := range tags {
                        if versionString == v {
                                return v, nil
                        }
                }

                // Otherwise set constraint to the string given
                var err error
                constraint, err = semver.NewConstraint(versionString)
                if err != nil {
                        return "", err
                }
        }

        // Otherwise try to find the first available version matching the string,
        // in case it is a constraint
        for _, v := range tags {
                test, err := semver.NewVersion(v)
                if err != nil {
                        continue
                }
                if constraint.Check(test) {
                        return v, nil
                }
        }

        return "", errors.Errorf("Could not locate a version matching provided version string %s", versionString)
}

// extractChartMeta is used to extract a chart metadata from a byte array
func extractChartMeta(chartData []byte) (*chart.Metadata, error) {
        ch, err := loader.LoadArchive(bytes.NewReader(chartData))
        if err != nil {
                return nil, err
        }
        return ch.Metadata, nil
}

// ctx retrieves a fresh context.
// disable verbose logging coming from ORAS (unless debug is enabled)
func ctx(out io.Writer, debug bool) context.Context {
        if !debug {
                return orascontext.Background()
        }
        ctx := orascontext.WithLoggerFromWriter(context.Background(), out)
        orascontext.GetLogger(ctx).Logger.SetLevel(logrus.DebugLevel)
        return ctx
}

// parseReference will parse and validate the reference, and clean tags when
// applicable tags are only cleaned when plus (+) signs are present, and are
// converted to underscores (_) before pushing
// See https://github.com/helm/helm/issues/10166
func parseReference(raw string) (registry.Reference, error) {
        // The sole possible reference modification is replacing plus (+) signs
        // present in tags with underscores (_). To do this properly, we first
        // need to identify a tag, and then pass it on to the reference parser
        // NOTE: Passing immediately to the reference parser will fail since (+)
        // signs are an invalid tag character, and simply replacing all plus (+)
        // occurrences could invalidate other portions of the URI
        parts := strings.Split(raw, ":")
        if len(parts) > 1 && !strings.Contains(parts[len(parts)-1], "/") {
                tag := parts[len(parts)-1]

                if tag != "" {
                        // Replace any plus (+) signs with known underscore (_) conversion
                        newTag := strings.ReplaceAll(tag, "+", "_")
                        raw = strings.ReplaceAll(raw, tag, newTag)
                }
        }

        return registry.ParseReference(raw)
}

// NewRegistryClientWithTLS is a helper function to create a new registry client with TLS enabled.
func NewRegistryClientWithTLS(out io.Writer, certFile, keyFile, caFile string, insecureSkipTLSverify bool, registryConfig string, debug bool) (*Client, error) {
        tlsConf, err := tlsutil.NewClientTLS(certFile, keyFile, caFile, insecureSkipTLSverify)
        if err != nil {
                return nil, fmt.Errorf("can't create TLS config for client: %s", err)
        }
        // Create a new registry client
        registryClient, err := NewClient(
                ClientOptDebug(debug),
                ClientOptEnableCache(true),
                ClientOptWriter(out),
                ClientOptCredentialsFile(registryConfig),
                ClientOptHTTPClient(&http.Client{
                        Transport: &http.Transport{
                                TLSClientConfig: tlsConf,
                        },
                }),
        )
        if err != nil {
                return nil, err
        }
        return registryClient, nil
}

// generateOCIAnnotations will generate OCI annotations to include within the OCI manifest
func generateOCIAnnotations(meta *chart.Metadata, test bool) map[string]string {

        // Get annotations from Chart attributes
        ociAnnotations := generateChartOCIAnnotations(meta, test)

        // Copy Chart annotations
annotations:
        for chartAnnotationKey, chartAnnotationValue := range meta.Annotations {

                // Avoid overriding key properties
                for _, immutableOciKey := range immutableOciAnnotations {
                        if immutableOciKey == chartAnnotationKey {
                                continue annotations
                        }
                }

                // Add chart annotation
                ociAnnotations[chartAnnotationKey] = chartAnnotationValue
        }

        return ociAnnotations
}

// getChartOCIAnnotations will generate OCI annotations from the provided chart
func generateChartOCIAnnotations(meta *chart.Metadata, test bool) map[string]string {
        chartOCIAnnotations := map[string]string{}

        chartOCIAnnotations = addToMap(chartOCIAnnotations, ocispec.AnnotationDescription, meta.Description)
        chartOCIAnnotations = addToMap(chartOCIAnnotations, ocispec.AnnotationTitle, meta.Name)
        chartOCIAnnotations = addToMap(chartOCIAnnotations, ocispec.AnnotationVersion, meta.Version)
        chartOCIAnnotations = addToMap(chartOCIAnnotations, ocispec.AnnotationURL, meta.Home)

        if !test {
                chartOCIAnnotations = addToMap(chartOCIAnnotations, ocispec.AnnotationCreated, helmtime.Now().UTC().Format(time.RFC3339))
        }

        if len(meta.Sources) > 0 {
                chartOCIAnnotations = addToMap(chartOCIAnnotations, ocispec.AnnotationSource, meta.Sources[0])
        }

        if meta.Maintainers != nil && len(meta.Maintainers) > 0 {
                var maintainerSb strings.Builder

                for maintainerIdx, maintainer := range meta.Maintainers {

                        if len(maintainer.Name) > 0 {
                                maintainerSb.WriteString(maintainer.Name)
                        }

                        if len(maintainer.Email) > 0 {
                                maintainerSb.WriteString(" (")
                                maintainerSb.WriteString(maintainer.Email)
                                maintainerSb.WriteString(")")
                        }

                        if maintainerIdx < len(meta.Maintainers)-1 {
                                maintainerSb.WriteString(", ")
                        }

                }

                chartOCIAnnotations = addToMap(chartOCIAnnotations, ocispec.AnnotationAuthors, maintainerSb.String())

        }

        return chartOCIAnnotations
}

// addToMap takes an existing map and adds an item if the value is not empty
func addToMap(inputMap map[string]string, newKey string, newValue string) map[string]string {

        // Add item to map if its
        if len(strings.TrimSpace(newValue)) > 0 {
                inputMap[newKey] = newValue
        }

        return inputMap

}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package release

import (
        "helm.sh/helm/v3/pkg/time"
)

// HookEvent specifies the hook event
type HookEvent string

// Hook event types
const (
        HookPreInstall   HookEvent = "pre-install"
        HookPostInstall  HookEvent = "post-install"
        HookPreDelete    HookEvent = "pre-delete"
        HookPostDelete   HookEvent = "post-delete"
        HookPreUpgrade   HookEvent = "pre-upgrade"
        HookPostUpgrade  HookEvent = "post-upgrade"
        HookPreRollback  HookEvent = "pre-rollback"
        HookPostRollback HookEvent = "post-rollback"
        HookTest         HookEvent = "test"
)

func (x HookEvent) String() string { return string(x) }

// HookDeletePolicy specifies the hook delete policy
type HookDeletePolicy string

// Hook delete policy types
const (
        HookSucceeded          HookDeletePolicy = "hook-succeeded"
        HookFailed             HookDeletePolicy = "hook-failed"
        HookBeforeHookCreation HookDeletePolicy = "before-hook-creation"
)

func (x HookDeletePolicy) String() string { return string(x) }

// HookAnnotation is the label name for a hook
const HookAnnotation = "helm.sh/hook"

// HookWeightAnnotation is the label name for a hook weight
const HookWeightAnnotation = "helm.sh/hook-weight"

// HookDeleteAnnotation is the label name for the delete policy for a hook
const HookDeleteAnnotation = "helm.sh/hook-delete-policy"

// Hook defines a hook object.
type Hook struct {
        Name string `json:"name,omitempty"`
        // Kind is the Kubernetes kind.
        Kind string `json:"kind,omitempty"`
        // Path is the chart-relative path to the template.
        Path string `json:"path,omitempty"`
        // Manifest is the manifest contents.
        Manifest string `json:"manifest,omitempty"`
        // Events are the events that this hook fires on.
        Events []HookEvent `json:"events,omitempty"`
        // LastRun indicates the date/time this was last run.
        LastRun HookExecution `json:"last_run,omitempty"`
        // Weight indicates the sort order for execution among similar Hook type
        Weight int `json:"weight,omitempty"`
        // DeletePolicies are the policies that indicate when to delete the hook
        DeletePolicies []HookDeletePolicy `json:"delete_policies,omitempty"`
}

// A HookExecution records the result for the last execution of a hook for a given release.
type HookExecution struct {
        // StartedAt indicates the date/time this hook was started
        StartedAt time.Time `json:"started_at,omitempty"`
        // CompletedAt indicates the date/time this hook was completed.
        CompletedAt time.Time `json:"completed_at,omitempty"`
        // Phase indicates whether the hook completed successfully
        Phase HookPhase `json:"phase"`
}

// A HookPhase indicates the state of a hook execution
type HookPhase string

const (
        // HookPhaseUnknown indicates that a hook is in an unknown state
        HookPhaseUnknown HookPhase = "Unknown"
        // HookPhaseRunning indicates that a hook is currently executing
        HookPhaseRunning HookPhase = "Running"
        // HookPhaseSucceeded indicates that hook execution succeeded
        HookPhaseSucceeded HookPhase = "Succeeded"
        // HookPhaseFailed indicates that hook execution failed
        HookPhaseFailed HookPhase = "Failed"
)

// String converts a hook phase to a printable string
func (x HookPhase) String() string { return string(x) }

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package release

import (
        "fmt"
        "math/rand"

        "helm.sh/helm/v3/pkg/chart"
        "helm.sh/helm/v3/pkg/time"
)

// MockHookTemplate is the hook template used for all mock release objects.
var MockHookTemplate = `apiVersion: v1
kind: Job
metadata:
  annotations:
    "helm.sh/hook": pre-install
`

// MockManifest is the manifest used for all mock release objects.
var MockManifest = `apiVersion: v1
kind: Secret
metadata:
  name: fixture
`

// MockReleaseOptions allows for user-configurable options on mock release objects.
type MockReleaseOptions struct {
        Name      string
        Version   int
        Chart     *chart.Chart
        Status    Status
        Namespace string
}

// Mock creates a mock release object based on options set by MockReleaseOptions. This function should typically not be used outside of testing.
func Mock(opts *MockReleaseOptions) *Release {
        date := time.Unix(242085845, 0).UTC()

        name := opts.Name
        if name == "" {
                name = "testrelease-" + fmt.Sprint(rand.Intn(100))
        }

        version := 1
        if opts.Version != 0 {
                version = opts.Version
        }

        namespace := opts.Namespace
        if namespace == "" {
                namespace = "default"
        }

        ch := opts.Chart
        if opts.Chart == nil {
                ch = &chart.Chart{
                        Metadata: &chart.Metadata{
                                Name:       "foo",
                                Version:    "0.1.0-beta.1",
                                AppVersion: "1.0",
                        },
                        Templates: []*chart.File{
                                {Name: "templates/foo.tpl", Data: []byte(MockManifest)},
                        },
                }
        }

        scode := StatusDeployed
        if len(opts.Status) > 0 {
                scode = opts.Status
        }

        info := &Info{
                FirstDeployed: date,
                LastDeployed:  date,
                Status:        scode,
                Description:   "Release mock",
                Notes:         "Some mock release notes!",
        }

        return &Release{
                Name:      name,
                Info:      info,
                Chart:     ch,
                Config:    map[string]interface{}{"name": "value"},
                Version:   version,
                Namespace: namespace,
                Hooks: []*Hook{
                        {
                                Name:     "pre-install-hook",
                                Kind:     "Job",
                                Path:     "pre-install-hook.yaml",
                                Manifest: MockHookTemplate,
                                LastRun:  HookExecution{},
                                Events:   []HookEvent{HookPreInstall},
                        },
                },
                Manifest: MockManifest,
        }
}

/*
Copyright The Helm Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package release

import "helm.sh/helm/v3/pkg/chart"

// Release describes a deployment of a chart, together with the chart
// and the variables used to deploy that chart.
type Release struct {
        // Name is the name of the release
        Name string `json:"name,omitempty"`
        // Info provides information about a release
        Info *Info `json:"info,omitempty"`
        // Chart is the chart that was released.
        Chart *chart.Chart `json:"chart,omitempty"`
        // Config is the set of extra Values added to the chart.
        // These values override the default values inside of the chart.
        Config map[string]interface{} `json:"config,omitempty"`
        // Manifest is the string representation of the rendered template.
        Manifest string `json:"manifest,omitempty"`
        // Hooks are all of the hooks declared for this release.
        Hooks []*Hook `json:"hooks,omitempty"`
        // Version is an int which represents the revision of the release.
        Version int `json:"version,omitempty"`
        // Namespace is the kubernetes namespace of the release.
        Namespace string `json:"namespace,omitempty"`
        // Labels of the release.
        // Disabled encoding into Json cause labels are stored in storage driver metadata field.
        Labels map[string]string `json:"-"`
}

// SetStatus is a helper for setting the status on a release.
func (r *Release) SetStatus(status Status, msg string) {
        r.Info.Status = status
        r.Info.Description = msg
}

/*
Copyright The Helm Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package release

// Status is the status of a release
type Status string

// Describe the status of a release
// NOTE: Make sure to update cmd/helm/status.go when adding or modifying any of these statuses.
const (
        // StatusUnknown indicates that a release is in an uncertain state.
        StatusUnknown Status = "unknown"
        // StatusDeployed indicates that the release has been pushed to Kubernetes.
        StatusDeployed Status = "deployed"
        // StatusUninstalled indicates that a release has been uninstalled from Kubernetes.
        StatusUninstalled Status = "uninstalled"
        // StatusSuperseded indicates that this release object is outdated and a newer one exists.
        StatusSuperseded Status = "superseded"
        // StatusFailed indicates that the release was not successfully deployed.
        StatusFailed Status = "failed"
        // StatusUninstalling indicates that a uninstall operation is underway.
        StatusUninstalling Status = "uninstalling"
        // StatusPendingInstall indicates that an install operation is underway.
        StatusPendingInstall Status = "pending-install"
        // StatusPendingUpgrade indicates that an upgrade operation is underway.
        StatusPendingUpgrade Status = "pending-upgrade"
        // StatusPendingRollback indicates that an rollback operation is underway.
        StatusPendingRollback Status = "pending-rollback"
)

func (x Status) String() string { return string(x) }

// IsPending determines if this status is a state or a transition.
func (x Status) IsPending() bool {
        return x == StatusPendingInstall || x == StatusPendingUpgrade || x == StatusPendingRollback
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package releaseutil // import "helm.sh/helm/v3/pkg/releaseutil"

import rspb "helm.sh/helm/v3/pkg/release"

// FilterFunc returns true if the release object satisfies
// the predicate of the underlying filter func.
type FilterFunc func(*rspb.Release) bool

// Check applies the FilterFunc to the release object.
func (fn FilterFunc) Check(rls *rspb.Release) bool {
        if rls == nil {
                return false
        }
        return fn(rls)
}

// Filter applies the filter(s) to the list of provided releases
// returning the list that satisfies the filtering predicate.
func (fn FilterFunc) Filter(rels []*rspb.Release) (rets []*rspb.Release) {
        for _, rel := range rels {
                if fn.Check(rel) {
                        rets = append(rets, rel)
                }
        }
        return
}

// Any returns a FilterFunc that filters a list of releases
// determined by the predicate 'f0 || f1 || ... || fn'.
func Any(filters ...FilterFunc) FilterFunc {
        return func(rls *rspb.Release) bool {
                for _, filter := range filters {
                        if filter(rls) {
                                return true
                        }
                }
                return false
        }
}

// All returns a FilterFunc that filters a list of releases
// determined by the predicate 'f0 && f1 && ... && fn'.
func All(filters ...FilterFunc) FilterFunc {
        return func(rls *rspb.Release) bool {
                for _, filter := range filters {
                        if !filter(rls) {
                                return false
                        }
                }
                return true
        }
}

// StatusFilter filters a set of releases by status code.
func StatusFilter(status rspb.Status) FilterFunc {
        return FilterFunc(func(rls *rspb.Release) bool {
                if rls == nil {
                        return true
                }
                return rls.Info.Status == status
        })
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package releaseutil

import (
        "sort"

        "helm.sh/helm/v3/pkg/release"
)

// KindSortOrder is an ordering of Kinds.
type KindSortOrder []string

// InstallOrder is the order in which manifests should be installed (by Kind).
//
// Those occurring earlier in the list get installed before those occurring later in the list.
var InstallOrder KindSortOrder = []string{
        "PriorityClass",
        "Namespace",
        "NetworkPolicy",
        "ResourceQuota",
        "LimitRange",
        "PodSecurityPolicy",
        "PodDisruptionBudget",
        "ServiceAccount",
        "Secret",
        "SecretList",
        "ConfigMap",
        "StorageClass",
        "PersistentVolume",
        "PersistentVolumeClaim",
        "CustomResourceDefinition",
        "ClusterRole",
        "ClusterRoleList",
        "ClusterRoleBinding",
        "ClusterRoleBindingList",
        "Role",
        "RoleList",
        "RoleBinding",
        "RoleBindingList",
        "Service",
        "DaemonSet",
        "Pod",
        "ReplicationController",
        "ReplicaSet",
        "Deployment",
        "HorizontalPodAutoscaler",
        "StatefulSet",
        "Job",
        "CronJob",
        "IngressClass",
        "Ingress",
        "APIService",
}

// UninstallOrder is the order in which manifests should be uninstalled (by Kind).
//
// Those occurring earlier in the list get uninstalled before those occurring later in the list.
var UninstallOrder KindSortOrder = []string{
        "APIService",
        "Ingress",
        "IngressClass",
        "Service",
        "CronJob",
        "Job",
        "StatefulSet",
        "HorizontalPodAutoscaler",
        "Deployment",
        "ReplicaSet",
        "ReplicationController",
        "Pod",
        "DaemonSet",
        "RoleBindingList",
        "RoleBinding",
        "RoleList",
        "Role",
        "ClusterRoleBindingList",
        "ClusterRoleBinding",
        "ClusterRoleList",
        "ClusterRole",
        "CustomResourceDefinition",
        "PersistentVolumeClaim",
        "PersistentVolume",
        "StorageClass",
        "ConfigMap",
        "SecretList",
        "Secret",
        "ServiceAccount",
        "PodDisruptionBudget",
        "PodSecurityPolicy",
        "LimitRange",
        "ResourceQuota",
        "NetworkPolicy",
        "Namespace",
        "PriorityClass",
}

// sort manifests by kind.
//
// Results are sorted by 'ordering', keeping order of items with equal kind/priority
func sortManifestsByKind(manifests []Manifest, ordering KindSortOrder) []Manifest {
        sort.SliceStable(manifests, func(i, j int) bool {
                return lessByKind(manifests[i], manifests[j], manifests[i].Head.Kind, manifests[j].Head.Kind, ordering)
        })

        return manifests
}

// sort hooks by kind, using an out-of-place sort to preserve the input parameters.
//
// Results are sorted by 'ordering', keeping order of items with equal kind/priority
func sortHooksByKind(hooks []*release.Hook, ordering KindSortOrder) []*release.Hook {
        h := hooks
        sort.SliceStable(h, func(i, j int) bool {
                return lessByKind(h[i], h[j], h[i].Kind, h[j].Kind, ordering)
        })

        return h
}

func lessByKind(a interface{}, b interface{}, kindA string, kindB string, o KindSortOrder) bool {
        ordering := make(map[string]int, len(o))
        for v, k := range o {
                ordering[k] = v
        }

        first, aok := ordering[kindA]
        second, bok := ordering[kindB]

        if !aok && !bok {
                // if both are unknown then sort alphabetically by kind, keep original order if same kind
                if kindA != kindB {
                        return kindA < kindB
                }
                return first < second
        }
        // unknown kind is last
        if !aok {
                return false
        }
        if !bok {
                return true
        }
        // sort different kinds, keep original order if same priority
        return first < second
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package releaseutil

import (
        "fmt"
        "regexp"
        "strconv"
        "strings"
)

// SimpleHead defines what the structure of the head of a manifest file
type SimpleHead struct {
        Version  string `json:"apiVersion"`
        Kind     string `json:"kind,omitempty"`
        Metadata *struct {
                Name        string            `json:"name"`
                Annotations map[string]string `json:"annotations"`
        } `json:"metadata,omitempty"`
}

var sep = regexp.MustCompile("(?:^|\\s*\n)---\\s*")

// SplitManifests takes a string of manifest and returns a map contains individual manifests
func SplitManifests(bigFile string) map[string]string {
        // Basically, we're quickly splitting a stream of YAML documents into an
        // array of YAML docs. The file name is just a place holder, but should be
        // integer-sortable so that manifests get output in the same order as the
        // input (see `BySplitManifestsOrder`).
        tpl := "manifest-%d"
        res := map[string]string{}
        // Making sure that any extra whitespace in YAML stream doesn't interfere in splitting documents correctly.
        bigFileTmp := strings.TrimSpace(bigFile)
        docs := sep.Split(bigFileTmp, -1)
        var count int
        for _, d := range docs {
                if d == "" {
                        continue
                }

                d = strings.TrimSpace(d)
                res[fmt.Sprintf(tpl, count)] = d
                count = count + 1
        }
        return res
}

// BySplitManifestsOrder sorts by in-file manifest order, as provided in function `SplitManifests`
type BySplitManifestsOrder []string

func (a BySplitManifestsOrder) Len() int { return len(a) }
func (a BySplitManifestsOrder) Less(i, j int) bool {
        // Split `manifest-%d`
        anum, _ := strconv.ParseInt(a[i][len("manifest-"):], 10, 0)
        bnum, _ := strconv.ParseInt(a[j][len("manifest-"):], 10, 0)
        return anum < bnum
}
func (a BySplitManifestsOrder) Swap(i, j int) { a[i], a[j] = a[j], a[i] }

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package releaseutil

import (
        "log"
        "path"
        "sort"
        "strconv"
        "strings"

        "github.com/pkg/errors"
        "sigs.k8s.io/yaml"

        "helm.sh/helm/v3/pkg/chartutil"
        "helm.sh/helm/v3/pkg/release"
)

// Manifest represents a manifest file, which has a name and some content.
type Manifest struct {
        Name    string
        Content string
        Head    *SimpleHead
}

// manifestFile represents a file that contains a manifest.
type manifestFile struct {
        entries map[string]string
        path    string
        apis    chartutil.VersionSet
}

// result is an intermediate structure used during sorting.
type result struct {
        hooks   []*release.Hook
        generic []Manifest
}

// TODO: Refactor this out. It's here because naming conventions were not followed through.
// So fix the Test hook names and then remove this.
var events = map[string]release.HookEvent{
        release.HookPreInstall.String():   release.HookPreInstall,
        release.HookPostInstall.String():  release.HookPostInstall,
        release.HookPreDelete.String():    release.HookPreDelete,
        release.HookPostDelete.String():   release.HookPostDelete,
        release.HookPreUpgrade.String():   release.HookPreUpgrade,
        release.HookPostUpgrade.String():  release.HookPostUpgrade,
        release.HookPreRollback.String():  release.HookPreRollback,
        release.HookPostRollback.String(): release.HookPostRollback,
        release.HookTest.String():         release.HookTest,
        // Support test-success for backward compatibility with Helm 2 tests
        "test-success": release.HookTest,
}

// SortManifests takes a map of filename/YAML contents, splits the file
// by manifest entries, and sorts the entries into hook types.
//
// The resulting hooks struct will be populated with all of the generated hooks.
// Any file that does not declare one of the hook types will be placed in the
// 'generic' bucket.
//
// Files that do not parse into the expected format are simply placed into a map and
// returned.
func SortManifests(files map[string]string, apis chartutil.VersionSet, ordering KindSortOrder) ([]*release.Hook, []Manifest, error) {
        result := &result{}

        var sortedFilePaths []string
        for filePath := range files {
                sortedFilePaths = append(sortedFilePaths, filePath)
        }
        sort.Strings(sortedFilePaths)

        for _, filePath := range sortedFilePaths {
                content := files[filePath]

                // Skip partials. We could return these as a separate map, but there doesn't
                // seem to be any need for that at this time.
                if strings.HasPrefix(path.Base(filePath), "_") {
                        continue
                }
                // Skip empty files and log this.
                if strings.TrimSpace(content) == "" {
                        continue
                }

                manifestFile := &manifestFile{
                        entries: SplitManifests(content),
                        path:    filePath,
                        apis:    apis,
                }

                if err := manifestFile.sort(result); err != nil {
                        return result.hooks, result.generic, err
                }
        }

        return sortHooksByKind(result.hooks, ordering), sortManifestsByKind(result.generic, ordering), nil
}

// sort takes a manifestFile object which may contain multiple resource definition
// entries and sorts each entry by hook types, and saves the resulting hooks and
// generic manifests (or non-hooks) to the result struct.
//
// To determine hook type, it looks for a YAML structure like this:
//
//         kind: SomeKind
//         apiVersion: v1
//                metadata:
//                        annotations:
//                                helm.sh/hook: pre-install
//
// To determine the policy to delete the hook, it looks for a YAML structure like this:
//
//         kind: SomeKind
//         apiVersion: v1
//         metadata:
//                        annotations:
//                                helm.sh/hook-delete-policy: hook-succeeded
func (file *manifestFile) sort(result *result) error {
        // Go through manifests in order found in file (function `SplitManifests` creates integer-sortable keys)
        var sortedEntryKeys []string
        for entryKey := range file.entries {
                sortedEntryKeys = append(sortedEntryKeys, entryKey)
        }
        sort.Sort(BySplitManifestsOrder(sortedEntryKeys))

        for _, entryKey := range sortedEntryKeys {
                m := file.entries[entryKey]

                var entry SimpleHead
                if err := yaml.Unmarshal([]byte(m), &entry); err != nil {
                        return errors.Wrapf(err, "YAML parse error on %s", file.path)
                }

                if !hasAnyAnnotation(entry) {
                        result.generic = append(result.generic, Manifest{
                                Name:    file.path,
                                Content: m,
                                Head:    &entry,
                        })
                        continue
                }

                hookTypes, ok := entry.Metadata.Annotations[release.HookAnnotation]
                if !ok {
                        result.generic = append(result.generic, Manifest{
                                Name:    file.path,
                                Content: m,
                                Head:    &entry,
                        })
                        continue
                }

                hw := calculateHookWeight(entry)

                h := &release.Hook{
                        Name:           entry.Metadata.Name,
                        Kind:           entry.Kind,
                        Path:           file.path,
                        Manifest:       m,
                        Events:         []release.HookEvent{},
                        Weight:         hw,
                        DeletePolicies: []release.HookDeletePolicy{},
                }

                isUnknownHook := false
                for _, hookType := range strings.Split(hookTypes, ",") {
                        hookType = strings.ToLower(strings.TrimSpace(hookType))
                        e, ok := events[hookType]
                        if !ok {
                                isUnknownHook = true
                                break
                        }
                        h.Events = append(h.Events, e)
                }

                if isUnknownHook {
                        log.Printf("info: skipping unknown hook: %q", hookTypes)
                        continue
                }

                result.hooks = append(result.hooks, h)

                operateAnnotationValues(entry, release.HookDeleteAnnotation, func(value string) {
                        h.DeletePolicies = append(h.DeletePolicies, release.HookDeletePolicy(value))
                })
        }

        return nil
}

// hasAnyAnnotation returns true if the given entry has any annotations at all.
func hasAnyAnnotation(entry SimpleHead) bool {
        return entry.Metadata != nil &&
                entry.Metadata.Annotations != nil &&
                len(entry.Metadata.Annotations) != 0
}

// calculateHookWeight finds the weight in the hook weight annotation.
//
// If no weight is found, the assigned weight is 0
func calculateHookWeight(entry SimpleHead) int {
        hws := entry.Metadata.Annotations[release.HookWeightAnnotation]
        hw, err := strconv.Atoi(hws)
        if err != nil {
                hw = 0
        }
        return hw
}

// operateAnnotationValues finds the given annotation and runs the operate function with the value of that annotation
func operateAnnotationValues(entry SimpleHead, annotation string, operate func(p string)) {
        if dps, ok := entry.Metadata.Annotations[annotation]; ok {
                for _, dp := range strings.Split(dps, ",") {
                        dp = strings.ToLower(strings.TrimSpace(dp))
                        operate(dp)
                }
        }
}

//go:build gofuzz
// +build gofuzz

// Copyright 2022 ADA Logics Ltd
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

package releaseutil

import (
        "helm.sh/helm/v3/pkg/chartutil"
        fuzz "github.com/AdaLogics/go-fuzz-headers"
)

func FuzzSplitManifests(data []byte) int {
        _ = SplitManifests(string(data))
        return 1
}

func FuzzSortManifests(data []byte) int {
        f := fuzz.NewConsumer(data)
        files := make(map[string]string)
        err := f.FuzzMap(&files)
        if err != nil {
                return 0
        }
        _, _, _ = SortManifests(files, chartutil.VersionSet{"v1", "v1beta1"}, InstallOrder)
        return 1
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package releaseutil // import "helm.sh/helm/v3/pkg/releaseutil"

import (
        "sort"

        rspb "helm.sh/helm/v3/pkg/release"
)

type list []*rspb.Release

func (s list) Len() int      { return len(s) }
func (s list) Swap(i, j int) { s[i], s[j] = s[j], s[i] }

// ByName sorts releases by name
type ByName struct{ list }

// Less compares to releases
func (s ByName) Less(i, j int) bool { return s.list[i].Name < s.list[j].Name }

// ByDate sorts releases by date
type ByDate struct{ list }

// Less compares to releases
func (s ByDate) Less(i, j int) bool {
        ti := s.list[i].Info.LastDeployed.Unix()
        tj := s.list[j].Info.LastDeployed.Unix()
        return ti < tj
}

// ByRevision sorts releases by revision number
type ByRevision struct{ list }

// Less compares to releases
func (s ByRevision) Less(i, j int) bool {
        return s.list[i].Version < s.list[j].Version
}

// Reverse reverses the list of releases sorted by the sort func.
func Reverse(list []*rspb.Release, sortFn func([]*rspb.Release)) {
        sortFn(list)
        for i, j := 0, len(list)-1; i < j; i, j = i+1, j-1 {
                list[i], list[j] = list[j], list[i]
        }
}

// SortByName returns the list of releases sorted
// in lexicographical order.
func SortByName(list []*rspb.Release) {
        sort.Sort(ByName{list})
}

// SortByDate returns the list of releases sorted by a
// release's last deployed time (in seconds).
func SortByDate(list []*rspb.Release) {
        sort.Sort(ByDate{list})
}

// SortByRevision returns the list of releases sorted by a
// release's revision number (release.Version).
func SortByRevision(list []*rspb.Release) {
        sort.Sort(ByRevision{list})
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package repo // import "helm.sh/helm/v3/pkg/repo"

import (
        "crypto/rand"
        "encoding/base64"
        "encoding/json"
        "fmt"
        "io"
        "log"
        "net/url"
        "os"
        "path/filepath"
        "strings"

        "github.com/pkg/errors"
        "sigs.k8s.io/yaml"

        "helm.sh/helm/v3/pkg/chart/loader"
        "helm.sh/helm/v3/pkg/getter"
        "helm.sh/helm/v3/pkg/helmpath"
        "helm.sh/helm/v3/pkg/provenance"
)

// Entry represents a collection of parameters for chart repository
type Entry struct {
        Name                  string `json:"name"`
        URL                   string `json:"url"`
        Username              string `json:"username"`
        Password              string `json:"password"`
        CertFile              string `json:"certFile"`
        KeyFile               string `json:"keyFile"`
        CAFile                string `json:"caFile"`
        InsecureSkipTLSverify bool   `json:"insecure_skip_tls_verify"`
        PassCredentialsAll    bool   `json:"pass_credentials_all"`
}

// ChartRepository represents a chart repository
type ChartRepository struct {
        Config     *Entry
        ChartPaths []string
        IndexFile  *IndexFile
        Client     getter.Getter
        CachePath  string
}

// NewChartRepository constructs ChartRepository
func NewChartRepository(cfg *Entry, getters getter.Providers) (*ChartRepository, error) {
        u, err := url.Parse(cfg.URL)
        if err != nil {
                return nil, errors.Errorf("invalid chart URL format: %s", cfg.URL)
        }

        client, err := getters.ByScheme(u.Scheme)
        if err != nil {
                return nil, errors.Errorf("could not find protocol handler for: %s", u.Scheme)
        }

        return &ChartRepository{
                Config:    cfg,
                IndexFile: NewIndexFile(),
                Client:    client,
                CachePath: helmpath.CachePath("repository"),
        }, nil
}

// Load loads a directory of charts as if it were a repository.
//
// It requires the presence of an index.yaml file in the directory.
//
// Deprecated: remove in Helm 4.
func (r *ChartRepository) Load() error {
        dirInfo, err := os.Stat(r.Config.Name)
        if err != nil {
                return err
        }
        if !dirInfo.IsDir() {
                return errors.Errorf("%q is not a directory", r.Config.Name)
        }

        // FIXME: Why are we recursively walking directories?
        // FIXME: Why are we not reading the repositories.yaml to figure out
        // what repos to use?
        filepath.Walk(r.Config.Name, func(path string, f os.FileInfo, err error) error {
                if !f.IsDir() {
                        if strings.Contains(f.Name(), "-index.yaml") {
                                i, err := LoadIndexFile(path)
                                if err != nil {
                                        return err
                                }
                                r.IndexFile = i
                        } else if strings.HasSuffix(f.Name(), ".tgz") {
                                r.ChartPaths = append(r.ChartPaths, path)
                        }
                }
                return nil
        })
        return nil
}

// DownloadIndexFile fetches the index from a repository.
func (r *ChartRepository) DownloadIndexFile() (string, error) {
        indexURL, err := ResolveReferenceURL(r.Config.URL, "index.yaml")
        if err != nil {
                return "", err
        }

        resp, err := r.Client.Get(indexURL,
                getter.WithURL(r.Config.URL),
                getter.WithInsecureSkipVerifyTLS(r.Config.InsecureSkipTLSverify),
                getter.WithTLSClientConfig(r.Config.CertFile, r.Config.KeyFile, r.Config.CAFile),
                getter.WithBasicAuth(r.Config.Username, r.Config.Password),
                getter.WithPassCredentialsAll(r.Config.PassCredentialsAll),
        )
        if err != nil {
                return "", err
        }

        index, err := io.ReadAll(resp)
        if err != nil {
                return "", err
        }

        indexFile, err := loadIndex(index, r.Config.URL)
        if err != nil {
                return "", err
        }

        // Create the chart list file in the cache directory
        var charts strings.Builder
        for name := range indexFile.Entries {
                fmt.Fprintln(&charts, name)
        }
        chartsFile := filepath.Join(r.CachePath, helmpath.CacheChartsFile(r.Config.Name))
        os.MkdirAll(filepath.Dir(chartsFile), 0755)
        os.WriteFile(chartsFile, []byte(charts.String()), 0644)

        // Create the index file in the cache directory
        fname := filepath.Join(r.CachePath, helmpath.CacheIndexFile(r.Config.Name))
        os.MkdirAll(filepath.Dir(fname), 0755)
        return fname, os.WriteFile(fname, index, 0644)
}

// Index generates an index for the chart repository and writes an index.yaml file.
func (r *ChartRepository) Index() error {
        err := r.generateIndex()
        if err != nil {
                return err
        }
        return r.saveIndexFile()
}

func (r *ChartRepository) saveIndexFile() error {
        index, err := yaml.Marshal(r.IndexFile)
        if err != nil {
                return err
        }
        return os.WriteFile(filepath.Join(r.Config.Name, indexPath), index, 0644)
}

func (r *ChartRepository) generateIndex() error {
        for _, path := range r.ChartPaths {
                ch, err := loader.Load(path)
                if err != nil {
                        return err
                }

                digest, err := provenance.DigestFile(path)
                if err != nil {
                        return err
                }

                if !r.IndexFile.Has(ch.Name(), ch.Metadata.Version) {
                        if err := r.IndexFile.MustAdd(ch.Metadata, path, r.Config.URL, digest); err != nil {
                                return errors.Wrapf(err, "failed adding to %s to index", path)
                        }
                }
                // TODO: If a chart exists, but has a different Digest, should we error?
        }
        r.IndexFile.SortEntries()
        return nil
}

// FindChartInRepoURL finds chart in chart repository pointed by repoURL
// without adding repo to repositories
func FindChartInRepoURL(repoURL, chartName, chartVersion, certFile, keyFile, caFile string, getters getter.Providers) (string, error) {
        return FindChartInAuthRepoURL(repoURL, "", "", chartName, chartVersion, certFile, keyFile, caFile, getters)
}

// FindChartInAuthRepoURL finds chart in chart repository pointed by repoURL
// without adding repo to repositories, like FindChartInRepoURL,
// but it also receives credentials for the chart repository.
func FindChartInAuthRepoURL(repoURL, username, password, chartName, chartVersion, certFile, keyFile, caFile string, getters getter.Providers) (string, error) {
        return FindChartInAuthAndTLSRepoURL(repoURL, username, password, chartName, chartVersion, certFile, keyFile, caFile, false, getters)
}

// FindChartInAuthAndTLSRepoURL finds chart in chart repository pointed by repoURL
// without adding repo to repositories, like FindChartInRepoURL,
// but it also receives credentials and TLS verify flag for the chart repository.
// TODO Helm 4, FindChartInAuthAndTLSRepoURL should be integrated into FindChartInAuthRepoURL.
func FindChartInAuthAndTLSRepoURL(repoURL, username, password, chartName, chartVersion, certFile, keyFile, caFile string, insecureSkipTLSverify bool, getters getter.Providers) (string, error) {
        return FindChartInAuthAndTLSAndPassRepoURL(repoURL, username, password, chartName, chartVersion, certFile, keyFile, caFile, insecureSkipTLSverify, false, getters)
}

// FindChartInAuthAndTLSAndPassRepoURL finds chart in chart repository pointed by repoURL
// without adding repo to repositories, like FindChartInRepoURL,
// but it also receives credentials, TLS verify flag, and if credentials should
// be passed on to other domains.
// TODO Helm 4, FindChartInAuthAndTLSAndPassRepoURL should be integrated into FindChartInAuthRepoURL.
func FindChartInAuthAndTLSAndPassRepoURL(repoURL, username, password, chartName, chartVersion, certFile, keyFile, caFile string, insecureSkipTLSverify, passCredentialsAll bool, getters getter.Providers) (string, error) {

        // Download and write the index file to a temporary location
        buf := make([]byte, 20)
        rand.Read(buf)
        name := strings.ReplaceAll(base64.StdEncoding.EncodeToString(buf), "/", "-")

        c := Entry{
                URL:                   repoURL,
                Username:              username,
                Password:              password,
                PassCredentialsAll:    passCredentialsAll,
                CertFile:              certFile,
                KeyFile:               keyFile,
                CAFile:                caFile,
                Name:                  name,
                InsecureSkipTLSverify: insecureSkipTLSverify,
        }
        r, err := NewChartRepository(&c, getters)
        if err != nil {
                return "", err
        }
        idx, err := r.DownloadIndexFile()
        if err != nil {
                return "", errors.Wrapf(err, "looks like %q is not a valid chart repository or cannot be reached", repoURL)
        }
        defer func() {
                os.RemoveAll(filepath.Join(r.CachePath, helmpath.CacheChartsFile(r.Config.Name)))
                os.RemoveAll(filepath.Join(r.CachePath, helmpath.CacheIndexFile(r.Config.Name)))
        }()

        // Read the index file for the repository to get chart information and return chart URL
        repoIndex, err := LoadIndexFile(idx)
        if err != nil {
                return "", err
        }

        errMsg := fmt.Sprintf("chart %q", chartName)
        if chartVersion != "" {
                errMsg = fmt.Sprintf("%s version %q", errMsg, chartVersion)
        }
        cv, err := repoIndex.Get(chartName, chartVersion)
        if err != nil {
                return "", errors.Errorf("%s not found in %s repository", errMsg, repoURL)
        }

        if len(cv.URLs) == 0 {
                return "", errors.Errorf("%s has no downloadable URLs", errMsg)
        }

        chartURL := cv.URLs[0]

        absoluteChartURL, err := ResolveReferenceURL(repoURL, chartURL)
        if err != nil {
                return "", errors.Wrap(err, "failed to make chart URL absolute")
        }

        return absoluteChartURL, nil
}

// ResolveReferenceURL resolves refURL relative to baseURL.
// If refURL is absolute, it simply returns refURL.
func ResolveReferenceURL(baseURL, refURL string) (string, error) {
        parsedRefURL, err := url.Parse(refURL)
        if err != nil {
                return "", errors.Wrapf(err, "failed to parse %s as URL", refURL)
        }

        if parsedRefURL.IsAbs() {
                return refURL, nil
        }

        parsedBaseURL, err := url.Parse(baseURL)
        if err != nil {
                return "", errors.Wrapf(err, "failed to parse %s as URL", baseURL)
        }

        // We need a trailing slash for ResolveReference to work, but make sure there isn't already one
        parsedBaseURL.RawPath = strings.TrimSuffix(parsedBaseURL.RawPath, "/") + "/"
        parsedBaseURL.Path = strings.TrimSuffix(parsedBaseURL.Path, "/") + "/"

        resolvedURL := parsedBaseURL.ResolveReference(parsedRefURL)
        resolvedURL.RawQuery = parsedBaseURL.RawQuery
        return resolvedURL.String(), nil
}

func (e *Entry) String() string {
        buf, err := json.Marshal(e)
        if err != nil {
                log.Panic(err)
        }
        return string(buf)
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package repo

import (
        "bytes"
        "encoding/json"
        "log"
        "os"
        "path"
        "path/filepath"
        "sort"
        "strings"
        "time"

        "github.com/Masterminds/semver/v3"
        "github.com/pkg/errors"
        "sigs.k8s.io/yaml"

        "helm.sh/helm/v3/internal/fileutil"
        "helm.sh/helm/v3/internal/urlutil"
        "helm.sh/helm/v3/pkg/chart"
        "helm.sh/helm/v3/pkg/chart/loader"
        "helm.sh/helm/v3/pkg/provenance"
)

var indexPath = "index.yaml"

// APIVersionV1 is the v1 API version for index and repository files.
const APIVersionV1 = "v1"

var (
        // ErrNoAPIVersion indicates that an API version was not specified.
        ErrNoAPIVersion = errors.New("no API version specified")
        // ErrNoChartVersion indicates that a chart with the given version is not found.
        ErrNoChartVersion = errors.New("no chart version found")
        // ErrNoChartName indicates that a chart with the given name is not found.
        ErrNoChartName = errors.New("no chart name found")
        // ErrEmptyIndexYaml indicates that the content of index.yaml is empty.
        ErrEmptyIndexYaml = errors.New("empty index.yaml file")
)

// ChartVersions is a list of versioned chart references.
// Implements a sorter on Version.
type ChartVersions []*ChartVersion

// Len returns the length.
func (c ChartVersions) Len() int { return len(c) }

// Swap swaps the position of two items in the versions slice.
func (c ChartVersions) Swap(i, j int) { c[i], c[j] = c[j], c[i] }

// Less returns true if the version of entry a is less than the version of entry b.
func (c ChartVersions) Less(a, b int) bool {
        // Failed parse pushes to the back.
        i, err := semver.NewVersion(c[a].Version)
        if err != nil {
                return true
        }
        j, err := semver.NewVersion(c[b].Version)
        if err != nil {
                return false
        }
        return i.LessThan(j)
}

// IndexFile represents the index file in a chart repository
type IndexFile struct {
        // This is used ONLY for validation against chartmuseum's index files and is discarded after validation.
        ServerInfo map[string]interface{}   `json:"serverInfo,omitempty"`
        APIVersion string                   `json:"apiVersion"`
        Generated  time.Time                `json:"generated"`
        Entries    map[string]ChartVersions `json:"entries"`
        PublicKeys []string                 `json:"publicKeys,omitempty"`

        // Annotations are additional mappings uninterpreted by Helm. They are made available for
        // other applications to add information to the index file.
        Annotations map[string]string `json:"annotations,omitempty"`
}

// NewIndexFile initializes an index.
func NewIndexFile() *IndexFile {
        return &IndexFile{
                APIVersion: APIVersionV1,
                Generated:  time.Now(),
                Entries:    map[string]ChartVersions{},
                PublicKeys: []string{},
        }
}

// LoadIndexFile takes a file at the given path and returns an IndexFile object
func LoadIndexFile(path string) (*IndexFile, error) {
        b, err := os.ReadFile(path)
        if err != nil {
                return nil, err
        }
        i, err := loadIndex(b, path)
        if err != nil {
                return nil, errors.Wrapf(err, "error loading %s", path)
        }
        return i, nil
}

// MustAdd adds a file to the index
// This can leave the index in an unsorted state
func (i IndexFile) MustAdd(md *chart.Metadata, filename, baseURL, digest string) error {
        if i.Entries == nil {
                return errors.New("entries not initialized")
        }

        if md.APIVersion == "" {
                md.APIVersion = chart.APIVersionV1
        }
        if err := md.Validate(); err != nil {
                return errors.Wrapf(err, "validate failed for %s", filename)
        }

        u := filename
        if baseURL != "" {
                _, file := filepath.Split(filename)
                var err error
                u, err = urlutil.URLJoin(baseURL, file)
                if err != nil {
                        u = path.Join(baseURL, file)
                }
        }
        cr := &ChartVersion{
                URLs:     []string{u},
                Metadata: md,
                Digest:   digest,
                Created:  time.Now(),
        }
        ee := i.Entries[md.Name]
        i.Entries[md.Name] = append(ee, cr)
        return nil
}

// Add adds a file to the index and logs an error.
//
// Deprecated: Use index.MustAdd instead.
func (i IndexFile) Add(md *chart.Metadata, filename, baseURL, digest string) {
        if err := i.MustAdd(md, filename, baseURL, digest); err != nil {
                log.Printf("skipping loading invalid entry for chart %q %q from %s: %s", md.Name, md.Version, filename, err)
        }
}

// Has returns true if the index has an entry for a chart with the given name and exact version.
func (i IndexFile) Has(name, version string) bool {
        _, err := i.Get(name, version)
        return err == nil
}

// SortEntries sorts the entries by version in descending order.
//
// In canonical form, the individual version records should be sorted so that
// the most recent release for every version is in the 0th slot in the
// Entries.ChartVersions array. That way, tooling can predict the newest
// version without needing to parse SemVers.
func (i IndexFile) SortEntries() {
        for _, versions := range i.Entries {
                sort.Sort(sort.Reverse(versions))
        }
}

// Get returns the ChartVersion for the given name.
//
// If version is empty, this will return the chart with the latest stable version,
// prerelease versions will be skipped.
func (i IndexFile) Get(name, version string) (*ChartVersion, error) {
        vs, ok := i.Entries[name]
        if !ok {
                return nil, ErrNoChartName
        }
        if len(vs) == 0 {
                return nil, ErrNoChartVersion
        }

        var constraint *semver.Constraints
        if version == "" {
                constraint, _ = semver.NewConstraint("*")
        } else {
                var err error
                constraint, err = semver.NewConstraint(version)
                if err != nil {
                        return nil, err
                }
        }

        // when customer input exact version, check whether have exact match one first
        if len(version) != 0 {
                for _, ver := range vs {
                        if version == ver.Version {
                                return ver, nil
                        }
                }
        }

        for _, ver := range vs {
                test, err := semver.NewVersion(ver.Version)
                if err != nil {
                        continue
                }

                if constraint.Check(test) {
                        return ver, nil
                }
        }
        return nil, errors.Errorf("no chart version found for %s-%s", name, version)
}

// WriteFile writes an index file to the given destination path.
//
// The mode on the file is set to 'mode'.
func (i IndexFile) WriteFile(dest string, mode os.FileMode) error {
        b, err := yaml.Marshal(i)
        if err != nil {
                return err
        }
        return fileutil.AtomicWriteFile(dest, bytes.NewReader(b), mode)
}

// WriteJSONFile writes an index file in JSON format to the given destination
// path.
//
// The mode on the file is set to 'mode'.
func (i IndexFile) WriteJSONFile(dest string, mode os.FileMode) error {
        b, err := json.MarshalIndent(i, "", "  ")
        if err != nil {
                return err
        }
        return fileutil.AtomicWriteFile(dest, bytes.NewReader(b), mode)
}

// Merge merges the given index file into this index.
//
// This merges by name and version.
//
// If one of the entries in the given index does _not_ already exist, it is added.
// In all other cases, the existing record is preserved.
//
// This can leave the index in an unsorted state
func (i *IndexFile) Merge(f *IndexFile) {
        for _, cvs := range f.Entries {
                for _, cv := range cvs {
                        if !i.Has(cv.Name, cv.Version) {
                                e := i.Entries[cv.Name]
                                i.Entries[cv.Name] = append(e, cv)
                        }
                }
        }
}

// ChartVersion represents a chart entry in the IndexFile
type ChartVersion struct {
        *chart.Metadata
        URLs    []string  `json:"urls"`
        Created time.Time `json:"created,omitempty"`
        Removed bool      `json:"removed,omitempty"`
        Digest  string    `json:"digest,omitempty"`

        // ChecksumDeprecated is deprecated in Helm 3, and therefore ignored. Helm 3 replaced
        // this with Digest. However, with a strict YAML parser enabled, a field must be
        // present on the struct for backwards compatibility.
        ChecksumDeprecated string `json:"checksum,omitempty"`

        // EngineDeprecated is deprecated in Helm 3, and therefore ignored. However, with a strict
        // YAML parser enabled, this field must be present.
        EngineDeprecated string `json:"engine,omitempty"`

        // TillerVersionDeprecated is deprecated in Helm 3, and therefore ignored. However, with a strict
        // YAML parser enabled, this field must be present.
        TillerVersionDeprecated string `json:"tillerVersion,omitempty"`

        // URLDeprecated is deprecated in Helm 3, superseded by URLs. It is ignored. However,
        // with a strict YAML parser enabled, this must be present on the struct.
        URLDeprecated string `json:"url,omitempty"`
}

// IndexDirectory reads a (flat) directory and generates an index.
//
// It indexes only charts that have been packaged (*.tgz).
//
// The index returned will be in an unsorted state
func IndexDirectory(dir, baseURL string) (*IndexFile, error) {
        archives, err := filepath.Glob(filepath.Join(dir, "*.tgz"))
        if err != nil {
                return nil, err
        }
        moreArchives, err := filepath.Glob(filepath.Join(dir, "**/*.tgz"))
        if err != nil {
                return nil, err
        }
        archives = append(archives, moreArchives...)

        index := NewIndexFile()
        for _, arch := range archives {
                fname, err := filepath.Rel(dir, arch)
                if err != nil {
                        return index, err
                }

                var parentDir string
                parentDir, fname = filepath.Split(fname)
                // filepath.Split appends an extra slash to the end of parentDir. We want to strip that out.
                parentDir = strings.TrimSuffix(parentDir, string(os.PathSeparator))
                parentURL, err := urlutil.URLJoin(baseURL, parentDir)
                if err != nil {
                        parentURL = path.Join(baseURL, parentDir)
                }

                c, err := loader.Load(arch)
                if err != nil {
                        // Assume this is not a chart.
                        continue
                }
                hash, err := provenance.DigestFile(arch)
                if err != nil {
                        return index, err
                }
                if err := index.MustAdd(c.Metadata, fname, parentURL, hash); err != nil {
                        return index, errors.Wrapf(err, "failed adding to %s to index", fname)
                }
        }
        return index, nil
}

// loadIndex loads an index file and does minimal validity checking.
//
// The source parameter is only used for logging.
// This will fail if API Version is not set (ErrNoAPIVersion) or if the unmarshal fails.
func loadIndex(data []byte, source string) (*IndexFile, error) {
        i := &IndexFile{}

        if len(data) == 0 {
                return i, ErrEmptyIndexYaml
        }

        if err := jsonOrYamlUnmarshal(data, i); err != nil {
                return i, err
        }

        for name, cvs := range i.Entries {
                for idx := len(cvs) - 1; idx >= 0; idx-- {
                        if cvs[idx] == nil {
                                log.Printf("skipping loading invalid entry for chart %q from %s: empty entry", name, source)
                                continue
                        }
                        if cvs[idx].APIVersion == "" {
                                cvs[idx].APIVersion = chart.APIVersionV1
                        }
                        if err := cvs[idx].Validate(); err != nil {
                                log.Printf("skipping loading invalid entry for chart %q %q from %s: %s", name, cvs[idx].Version, source, err)
                                cvs = append(cvs[:idx], cvs[idx+1:]...)
                        }
                }
        }
        i.SortEntries()
        if i.APIVersion == "" {
                return i, ErrNoAPIVersion
        }
        return i, nil
}

// jsonOrYamlUnmarshal unmarshals the given byte slice containing JSON or YAML
// into the provided interface.
//
// It automatically detects whether the data is in JSON or YAML format by
// checking its validity as JSON. If the data is valid JSON, it will use the
// `encoding/json` package to unmarshal it. Otherwise, it will use the
// `sigs.k8s.io/yaml` package to unmarshal the YAML data.
func jsonOrYamlUnmarshal(b []byte, i interface{}) error {
        if json.Valid(b) {
                return json.Unmarshal(b, i)
        }
        return yaml.UnmarshalStrict(b, i)
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package repo // import "helm.sh/helm/v3/pkg/repo"

import (
        "os"
        "path/filepath"
        "time"

        "github.com/pkg/errors"
        "sigs.k8s.io/yaml"
)

// File represents the repositories.yaml file
type File struct {
        APIVersion   string    `json:"apiVersion"`
        Generated    time.Time `json:"generated"`
        Repositories []*Entry  `json:"repositories"`
}

// NewFile generates an empty repositories file.
//
// Generated and APIVersion are automatically set.
func NewFile() *File {
        return &File{
                APIVersion:   APIVersionV1,
                Generated:    time.Now(),
                Repositories: []*Entry{},
        }
}

// LoadFile takes a file at the given path and returns a File object
func LoadFile(path string) (*File, error) {
        r := new(File)
        b, err := os.ReadFile(path)
        if err != nil {
                return r, errors.Wrapf(err, "couldn't load repositories file (%s)", path)
        }

        err = yaml.Unmarshal(b, r)
        return r, err
}

// Add adds one or more repo entries to a repo file.
func (r *File) Add(re ...*Entry) {
        r.Repositories = append(r.Repositories, re...)
}

// Update attempts to replace one or more repo entries in a repo file. If an
// entry with the same name doesn't exist in the repo file it will add it.
func (r *File) Update(re ...*Entry) {
        for _, target := range re {
                r.update(target)
        }
}

func (r *File) update(e *Entry) {
        for j, repo := range r.Repositories {
                if repo.Name == e.Name {
                        r.Repositories[j] = e
                        return
                }
        }
        r.Add(e)
}

// Has returns true if the given name is already a repository name.
func (r *File) Has(name string) bool {
        entry := r.Get(name)
        return entry != nil
}

// Get returns an entry with the given name if it exists, otherwise returns nil
func (r *File) Get(name string) *Entry {
        for _, entry := range r.Repositories {
                if entry.Name == name {
                        return entry
                }
        }
        return nil
}

// Remove removes the entry from the list of repositories.
func (r *File) Remove(name string) bool {
        cp := []*Entry{}
        found := false
        for _, rf := range r.Repositories {
                if rf == nil {
                        continue
                }
                if rf.Name == name {
                        found = true
                        continue
                }
                cp = append(cp, rf)
        }
        r.Repositories = cp
        return found
}

// WriteFile writes a repositories file to the given path.
func (r *File) WriteFile(path string, perm os.FileMode) error {
        data, err := yaml.Marshal(r)
        if err != nil {
                return err
        }
        if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
                return err
        }
        return os.WriteFile(path, data, perm)
}

//go:build gofuzz
// +build gofuzz

// Copyright 2022 ADA Logics Ltd
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

package repo

import (
        "bufio"
        "bytes"
        "fmt"
        "helm.sh/helm/v3/pkg/cli"
        "helm.sh/helm/v3/pkg/getter"
        "helm.sh/helm/v3/pkg/helmpath"
        "io/ioutil"
        "net/http"
        "net/http/httptest"
        "os"
        "path/filepath"
        "sort"
        "strings"

        fuzz "github.com/AdaLogics/go-fuzz-headers"

        "helm.sh/helm/v3/pkg/chart"
)

func FuzzIndex(data []byte) int {
        f := fuzz.NewConsumer(data)
        indexFileBytes, err := f.GetBytes()
        if err != nil {
                return 0
        }
        md := &chart.Metadata{}
        err = f.GenerateStruct(md)
        if err != nil {
                return 0
        }
        filename, err := f.GetString()
        if err != nil {
                return 0
        }
        baseURL, err := f.GetString()
        if err != nil {
                return 0
        }
        name, err := f.GetString()
        if err != nil {
                return 0
        }
        version, err := f.GetString()
        if err != nil {
                return 0
        }
        digest, err := f.GetString()
        if err != nil {
                return 0
        }
        indf, err := os.Create("indexfile")
        if err != nil {
                return 0
        }
        defer indf.Close()
        defer os.Remove("indexfile")
        _, err = indf.Write(indexFileBytes)
        if err != nil {
                return 0
        }
        ind, err := LoadIndexFile("indexfile")
        if err != nil {
                return 0
        }
        ind.MustAdd(md, filename, baseURL, digest)
        ind.Get(name, version)


        indexFileBytes, err = f.GetBytes()
        if err != nil {
                return 0
        }
        indf2, err := os.Create("indexfile2")
        if err != nil {
                return 0
        }
        defer indf2.Close()
        defer os.Remove("indexfile2")
        ind2, err := LoadIndexFile("indexfile2")
        if err != nil {
                return 0
        }
        ind.Merge(ind2)

        return 1
}

func FuzzWriteFile(data []byte) int {
        f := fuzz.NewConsumer(data)
        fileContents, err := f.GetBytes()
        if err != nil {
                return 0
        }
        md := &chart.Metadata{}
        err = f.GenerateStruct(md)
        if err != nil {
                return 0
        }
        baseURL, err := f.GetString()
        if err != nil {
                return 0
        }
        digest, err := f.GetString()
        if err != nil {
                return 0
        }
        repeatBytesTimes, err := f.GetInt()
        if err != nil {
                return 0
        }
        fileContents = bytes.Repeat(fileContents, repeatBytesTimes%20000)
        fuzzFile, err := os.Create("fuzz-file")
        if err != nil {
                return 0
        }
        defer fuzzFile.Close()
        defer os.Remove("fuzz-file")
        _, err = fuzzFile.Write(fileContents)
        if err != nil {
                return 0
        }
        i := NewIndexFile()
        err = i.MustAdd(md, "fuzz-file", baseURL, digest)
        if err != nil {
                return 0
        }
        i.WriteFile("write-to-file", 0600)
        defer os.Remove("write-to-file")
        return 1
}

func FuzzIndexDirectory(data []byte) int {
        f := fuzz.NewConsumer(data)
        baseURL, err := f.GetString()
        if err != nil {
                return 0
        }

        err = os.Mkdir("indexdir", 0755)
        if err != nil {
                return 0
        }
        defer os.RemoveAll("indexdir")
        err = f.CreateFiles("indexdir")
        if err != nil {
                return 0
        }
        _, _ = IndexDirectory("indexdir", baseURL)
        return 1
}

func FuzzDownloadIndexFile(data []byte) int {
        srv, err := startLocalServerForFuzzing(nil)
        if err != nil {
                return 0
        }
        defer srv.Close()
        r, err := NewChartRepository(&Entry{
                Name: "test-repo",
                URL:  srv.URL,
        }, getter.All(&cli.EnvSettings{}))
        if err != nil {
                return 0
        }

        idx, err := r.DownloadIndexFile()
        if err != nil {
                return 0
        }
        if _, err := os.Stat(idx); err != nil {
                return 0
        }
        i, err := LoadIndexFile(idx)
        if err != nil {
                return 0
        }
        // Check that charts file is also created
        idx = filepath.Join(r.CachePath, helmpath.CacheChartsFile(r.Config.Name))
        if _, err := os.Stat(idx); err != nil {
                panic(fmt.Sprintf("error finding created charts file: %#v", err))
        }

        b, err := ioutil.ReadFile(idx)
        if err != nil {
                panic(fmt.Sprintf("error reading charts file: %#v", err))
        }
        verifyLocalChartsFileFuzz(b, i)
        return 1
}

func startLocalServerForFuzzing(fileBytes []byte) (*httptest.Server, error) {
        handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
                w.Write(fileBytes)
        })
        return httptest.NewServer(handler), nil
}

func verifyLocalChartsFileFuzz(chartsContent []byte, indexContent *IndexFile) {
        var expected, real []string
        for chart := range indexContent.Entries {
                expected = append(expected, chart)
        }
        sort.Strings(expected)

        scanner := bufio.NewScanner(bytes.NewReader(chartsContent))
        for scanner.Scan() {
                real = append(real, scanner.Text())
        }
        sort.Strings(real)

        if strings.Join(expected, " ") != strings.Join(real, " ") {
                panic(fmt.Sprintf("Cached charts file content unexpected. Expected:\n%s\ngot:\n%s", expected, real))
        }
}

func FuzzChartRepositoryLoad(data []byte) int {
        f := fuzz.NewConsumer(data)
        testRepository := "fuzzDir"
        err := os.Mkdir(testRepository, 0755)
        if err != nil {
                return 0
        }
        defer os.RemoveAll(testRepository)
        err = f.CreateFiles(testRepository)
        if err != nil {
                return 0
        }
        testURL := "http://example-charts.com"

        r, err := NewChartRepository(&Entry{
                Name: testRepository,
                URL:  testURL,
        }, getter.All(&cli.EnvSettings{}))
        if err != nil {
                return 0
        }
        _ = r.Load()
        return 1
}

func FuzzRepoFileUtils(data []byte) int {
        f := fuzz.NewConsumer(data)
        fileContents, err := f.GetBytes()
        if err != nil {
                return 0
        }
        fuzzFile, err := os.Create("fuzzFile")
        if err != nil {
                return 0
        }
        defer fuzzFile.Close()
        defer os.Remove("fuzzFile")
        _, err = fuzzFile.Write(fileContents)
        if err != nil {
                return 0
        }
        repoFile, err := LoadFile("fuzzFile")
        if err != nil {
                return 0
        }
        noOfOperations, err := f.GetInt()
        if err != nil {
                return 0
        }
        for i:=0;i<noOfOperations%5;i++ {
                opType, err := f.GetInt()
                if err != nil {
                        return 0
                }
                switch opType%5 {
                case 0:
                        e := &Entry{}
                        err = f.GenerateStruct(e)
                        if err != nil {
                                return 0
                        }
                        repoFile.Add(e)
                case 1:
                        e := &Entry{}
                        err = f.GenerateStruct(e)
                        if err != nil {
                                return 0
                        }
                        repoFile.Update(e)
                case 2:
                        name, err := f.GetString()
                        if err != nil {
                                return 0
                        }
                        repoFile.Has(name)
                case 3:
                        name, err := f.GetString()
                        if err != nil {
                                return 0
                        }
                        _ = repoFile.Get(name)
                case 4:
                        name, err := f.GetString()
                        if err != nil {
                                return 0
                        }
                        _ = repoFile.Remove(name)
                }
        }
        return 1
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package driver // import "helm.sh/helm/v3/pkg/storage/driver"

import (
        "context"
        "strconv"
        "strings"
        "time"

        "github.com/pkg/errors"
        v1 "k8s.io/api/core/v1"
        apierrors "k8s.io/apimachinery/pkg/api/errors"
        metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
        kblabels "k8s.io/apimachinery/pkg/labels"
        "k8s.io/apimachinery/pkg/util/validation"
        corev1 "k8s.io/client-go/kubernetes/typed/core/v1"

        rspb "helm.sh/helm/v3/pkg/release"
)

var _ Driver = (*ConfigMaps)(nil)

// ConfigMapsDriverName is the string name of the driver.
const ConfigMapsDriverName = "ConfigMap"

// ConfigMaps is a wrapper around an implementation of a kubernetes
// ConfigMapsInterface.
type ConfigMaps struct {
        impl corev1.ConfigMapInterface
        Log  func(string, ...interface{})
}

// NewConfigMaps initializes a new ConfigMaps wrapping an implementation of
// the kubernetes ConfigMapsInterface.
func NewConfigMaps(impl corev1.ConfigMapInterface) *ConfigMaps {
        return &ConfigMaps{
                impl: impl,
                Log:  func(_ string, _ ...interface{}) {},
        }
}

// Name returns the name of the driver.
func (cfgmaps *ConfigMaps) Name() string {
        return ConfigMapsDriverName
}

// Get fetches the release named by key. The corresponding release is returned
// or error if not found.
func (cfgmaps *ConfigMaps) Get(key string) (*rspb.Release, error) {
        // fetch the configmap holding the release named by key
        obj, err := cfgmaps.impl.Get(context.Background(), key, metav1.GetOptions{})
        if err != nil {
                if apierrors.IsNotFound(err) {
                        return nil, ErrReleaseNotFound
                }

                cfgmaps.Log("get: failed to get %q: %s", key, err)
                return nil, err
        }
        // found the configmap, decode the base64 data string
        r, err := decodeRelease(obj.Data["release"])
        if err != nil {
                cfgmaps.Log("get: failed to decode data %q: %s", key, err)
                return nil, err
        }
        r.Labels = filterSystemLabels(obj.ObjectMeta.Labels)
        // return the release object
        return r, nil
}

// List fetches all releases and returns the list releases such
// that filter(release) == true. An error is returned if the
// configmap fails to retrieve the releases.
func (cfgmaps *ConfigMaps) List(filter func(*rspb.Release) bool) ([]*rspb.Release, error) {
        lsel := kblabels.Set{"owner": "helm"}.AsSelector()
        opts := metav1.ListOptions{LabelSelector: lsel.String()}

        list, err := cfgmaps.impl.List(context.Background(), opts)
        if err != nil {
                cfgmaps.Log("list: failed to list: %s", err)
                return nil, err
        }

        var results []*rspb.Release

        // iterate over the configmaps object list
        // and decode each release
        for _, item := range list.Items {
                rls, err := decodeRelease(item.Data["release"])
                if err != nil {
                        cfgmaps.Log("list: failed to decode release: %v: %s", item, err)
                        continue
                }

                rls.Labels = item.ObjectMeta.Labels

                if filter(rls) {
                        results = append(results, rls)
                }
        }
        return results, nil
}

// Query fetches all releases that match the provided map of labels.
// An error is returned if the configmap fails to retrieve the releases.
func (cfgmaps *ConfigMaps) Query(labels map[string]string) ([]*rspb.Release, error) {
        ls := kblabels.Set{}
        for k, v := range labels {
                if errs := validation.IsValidLabelValue(v); len(errs) != 0 {
                        return nil, errors.Errorf("invalid label value: %q: %s", v, strings.Join(errs, "; "))
                }
                ls[k] = v
        }

        opts := metav1.ListOptions{LabelSelector: ls.AsSelector().String()}

        list, err := cfgmaps.impl.List(context.Background(), opts)
        if err != nil {
                cfgmaps.Log("query: failed to query with labels: %s", err)
                return nil, err
        }

        if len(list.Items) == 0 {
                return nil, ErrReleaseNotFound
        }

        var results []*rspb.Release
        for _, item := range list.Items {
                rls, err := decodeRelease(item.Data["release"])
                if err != nil {
                        cfgmaps.Log("query: failed to decode release: %s", err)
                        continue
                }
                rls.Labels = item.ObjectMeta.Labels
                results = append(results, rls)
        }
        return results, nil
}

// Create creates a new ConfigMap holding the release. If the
// ConfigMap already exists, ErrReleaseExists is returned.
func (cfgmaps *ConfigMaps) Create(key string, rls *rspb.Release) error {
        // set labels for configmaps object meta data
        var lbs labels

        lbs.init()
        lbs.fromMap(rls.Labels)
        lbs.set("createdAt", strconv.Itoa(int(time.Now().Unix())))

        // create a new configmap to hold the release
        obj, err := newConfigMapsObject(key, rls, lbs)
        if err != nil {
                cfgmaps.Log("create: failed to encode release %q: %s", rls.Name, err)
                return err
        }
        // push the configmap object out into the kubiverse
        if _, err := cfgmaps.impl.Create(context.Background(), obj, metav1.CreateOptions{}); err != nil {
                if apierrors.IsAlreadyExists(err) {
                        return ErrReleaseExists
                }

                cfgmaps.Log("create: failed to create: %s", err)
                return err
        }
        return nil
}

// Update updates the ConfigMap holding the release. If not found
// the ConfigMap is created to hold the release.
func (cfgmaps *ConfigMaps) Update(key string, rls *rspb.Release) error {
        // set labels for configmaps object meta data
        var lbs labels

        lbs.init()
        lbs.fromMap(rls.Labels)
        lbs.set("modifiedAt", strconv.Itoa(int(time.Now().Unix())))

        // create a new configmap object to hold the release
        obj, err := newConfigMapsObject(key, rls, lbs)
        if err != nil {
                cfgmaps.Log("update: failed to encode release %q: %s", rls.Name, err)
                return err
        }
        // push the configmap object out into the kubiverse
        _, err = cfgmaps.impl.Update(context.Background(), obj, metav1.UpdateOptions{})
        if err != nil {
                cfgmaps.Log("update: failed to update: %s", err)
                return err
        }
        return nil
}

// Delete deletes the ConfigMap holding the release named by key.
func (cfgmaps *ConfigMaps) Delete(key string) (rls *rspb.Release, err error) {
        // fetch the release to check existence
        if rls, err = cfgmaps.Get(key); err != nil {
                return nil, err
        }
        // delete the release
        if err = cfgmaps.impl.Delete(context.Background(), key, metav1.DeleteOptions{}); err != nil {
                return rls, err
        }
        return rls, nil
}

// newConfigMapsObject constructs a kubernetes ConfigMap object
// to store a release. Each configmap data entry is the base64
// encoded gzipped string of a release.
//
// The following labels are used within each configmap:
//
//        "modifiedAt"     - timestamp indicating when this configmap was last modified. (set in Update)
//        "createdAt"      - timestamp indicating when this configmap was created. (set in Create)
//        "version"        - version of the release.
//        "status"         - status of the release (see pkg/release/status.go for variants)
//        "owner"          - owner of the configmap, currently "helm".
//        "name"           - name of the release.
func newConfigMapsObject(key string, rls *rspb.Release, lbs labels) (*v1.ConfigMap, error) {
        const owner = "helm"

        // encode the release
        s, err := encodeRelease(rls)
        if err != nil {
                return nil, err
        }

        if lbs == nil {
                lbs.init()
        }

        // apply custom labels
        lbs.fromMap(rls.Labels)

        // apply labels
        lbs.set("name", rls.Name)
        lbs.set("owner", owner)
        lbs.set("status", rls.Info.Status.String())
        lbs.set("version", strconv.Itoa(rls.Version))

        // create and return configmap object
        return &v1.ConfigMap{
                ObjectMeta: metav1.ObjectMeta{
                        Name:   key,
                        Labels: lbs.toMap(),
                },
                Data: map[string]string{"release": s},
        }, nil
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package driver // import "helm.sh/helm/v3/pkg/storage/driver"

import (
        "fmt"

        "github.com/pkg/errors"

        rspb "helm.sh/helm/v3/pkg/release"
)

var (
        // ErrReleaseNotFound indicates that a release is not found.
        ErrReleaseNotFound = errors.New("release: not found")
        // ErrReleaseExists indicates that a release already exists.
        ErrReleaseExists = errors.New("release: already exists")
        // ErrInvalidKey indicates that a release key could not be parsed.
        ErrInvalidKey = errors.New("release: invalid key")
        // ErrNoDeployedReleases indicates that there are no releases with the given key in the deployed state
        ErrNoDeployedReleases = errors.New("has no deployed releases")
)

// StorageDriverError records an error and the release name that caused it
type StorageDriverError struct {
        ReleaseName string
        Err         error
}

func (e *StorageDriverError) Error() string {
        return fmt.Sprintf("%q %s", e.ReleaseName, e.Err.Error())
}

func (e *StorageDriverError) Unwrap() error { return e.Err }

func NewErrNoDeployedReleases(releaseName string) error {
        return &StorageDriverError{
                ReleaseName: releaseName,
                Err:         ErrNoDeployedReleases,
        }
}

// Creator is the interface that wraps the Create method.
//
// Create stores the release or returns ErrReleaseExists
// if an identical release already exists.
type Creator interface {
        Create(key string, rls *rspb.Release) error
}

// Updator is the interface that wraps the Update method.
//
// Update updates an existing release or returns
// ErrReleaseNotFound if the release does not exist.
type Updator interface {
        Update(key string, rls *rspb.Release) error
}

// Deletor is the interface that wraps the Delete method.
//
// Delete deletes the release named by key or returns
// ErrReleaseNotFound if the release does not exist.
type Deletor interface {
        Delete(key string) (*rspb.Release, error)
}

// Queryor is the interface that wraps the Get and List methods.
//
// Get returns the release named by key or returns ErrReleaseNotFound
// if the release does not exist.
//
// List returns the set of all releases that satisfy the filter predicate.
//
// Query returns the set of all releases that match the provided label set.
type Queryor interface {
        Get(key string) (*rspb.Release, error)
        List(filter func(*rspb.Release) bool) ([]*rspb.Release, error)
        Query(labels map[string]string) ([]*rspb.Release, error)
}

// Driver is the interface composed of Creator, Updator, Deletor, and Queryor
// interfaces. It defines the behavior for storing, updating, deleted,
// and retrieving Helm releases from some underlying storage mechanism,
// e.g. memory, configmaps.
type Driver interface {
        Creator
        Updator
        Deletor
        Queryor
        Name() string
}

//go:build gofuzz
// +build gofuzz

// Copyright 2022 ADA Logics Ltd
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

package driver

import (
        "fmt"
        "testing"
        rspb "helm.sh/helm/v3/pkg/release"
        fuzz "github.com/AdaLogics/go-fuzz-headers"
)

func FuzzSqlDriver(data []byte) int {
        f := fuzz.NewConsumer(data)

        noOfCalls, err := f.GetInt()
        if err != nil {
                return 0
        }        
        t := &testing.T{}
        sqlDriver, _ := newTestFixtureSQL(t)
        defer sqlDriver.db.Close()
        for i:=0;i<noOfCalls%10;i++ {
                callType, err := f.GetInt()
                if err != nil {
                        return 0
                }
                switch callType%6 {
                case 0:
                        rel := &rspb.Release{}
                        err := f.GenerateStruct(rel)
                        if err != nil {
                                return 0
                        }
                        relName, err := f.GetStringFrom("abcdefghijklmnopqrstuvwxyz0123456789-.", 52)
                    if err != nil {
                            return 0
                    }
                    rel.Name = relName
                    rel.Info.Status = rspb.StatusDeployed
                        key, err := f.GetString()
                        if err != nil {
                                return 0
                        }
                        sqlDriver.Create(key, rel)
                case 1:                        
                        key, err := f.GetString()
                        if err != nil {
                                return 0
                        }
                        sqlDriver.Get(key)
                case 2:                        
                        rel := &rspb.Release{}
                        err = f.GenerateStruct(rel)
                        if err != nil {
                                return 0
                        }
                        key, err := f.GetString()
                        if err != nil {
                                return 0
                        }
                        sqlDriver.Update(key, rel)
                case 3:
                        labels := make(map[string]string)
                        err = f.FuzzMap(&labels)
                        if err != nil {
                                return 0
                        }
                        sqlDriver.Query(labels)
                case 4:
                        key, err := f.GetString()
                        if err != nil {
                                return 0
                        }
                        sqlDriver.Delete(key)
                case 5:
                        _, _ = sqlDriver.List(func(rel *rspb.Release) bool {
                                if rel.Info == nil {
                                        return false
                                }
                                return rel.Info.Status == rspb.StatusUninstalled
                        })
                }
        }        
        return 1
}

func FuzzRecords(data []byte) int {
        f := fuzz.NewConsumer(data)
        rls1 := &rspb.Release{}
        err := f.GenerateStruct(rls1)
        if err != nil {
                return 0
        }
        key1, err := f.GetString()
        if err != nil {
                return 0
        }
        rls2 := &rspb.Release{}
        err = f.GenerateStruct(rls2)
        if err != nil {
                return 0
        }
        key2, err := f.GetString()
        if err != nil {
                return 0
        }
        noOfCalls, err := f.GetInt()
        if err != nil {
                return 0
        }
        r1 := newRecord(key1, rls1)
        r2 := newRecord(key2, rls2)
        rs := records([]*record{r1, r2})
        for i:=0;i<noOfCalls%10;i++ {
                callType, err := f.GetInt()
                if err != nil {
                        return 0
                }
                switch callType%6 {
                case 0:
                        key, err := f.GetString()
                        if err != nil {
                                return 0
                        }
                        _ = rs.Get(key)
                case 1:
                        key, err := f.GetString()
                        if err != nil {
                                return 0
                        }
                        _ = rs.Exists(key)
                case 2:
                        key1, err := f.GetString()
                        if err != nil {
                                return 0
                        }
                        key2, err := f.GetString()
                        if err != nil {
                                return 0
                        }
                        rls := &rspb.Release{}
                        err = f.GenerateStruct(rls)
                        if err != nil {
                                return 0
                        }

                        _ = rs.Replace(key1, newRecord(key2, rls))
                case 3:
                        key, err := f.GetString()
                        if err != nil {
                                return 0
                        }
                        _ = rs.Remove(key)
                case 4:
                        _ = rs.Len()
                case 5:
                        key, err := f.GetString()
                        if err != nil {
                                return 0
                        }
                        rls := &rspb.Release{}
                        err = f.GenerateStruct(rls)
                        if err != nil {
                                return 0
                        }
                        _ = rs.Add(newRecord(key, rls))
                }
        }
        return 1
}

func FuzzSecrets(data []byte) int {
        f := fuzz.NewConsumer(data)
        rls1 := &rspb.Release{}
        err := f.GenerateStruct(rls1)
        if err != nil {
                return 0
        }
        rls2 := &rspb.Release{}
        err = f.GenerateStruct(rls2)
        if err != nil {
                return 0
        }

        noOfCalls, err := f.GetInt()
        if err != nil {
                return 0
        }

        t := &testing.T{}
        secrets := newTestFixtureSecrets(t, rls1, rls2)

        for i:=0;i<noOfCalls%10;i++ {
                callType, err := f.GetInt()
                if err != nil {
                        return 0
                }
                switch callType%6 {
                case 0:
                        rls := &rspb.Release{}
                        err = f.GenerateStruct(rls)
                        if err != nil {
                                return 0
                        }
                        key, err := f.GetString()
                        if err != nil {
                                return 0
                        }
                        secrets.Create(key, rls)
                case 1:
                        key, err := f.GetString()
                        if err != nil {
                                return 0
                        }
                        _, _ = secrets.Get(key)
                case 2:
                        rls := &rspb.Release{}
                        err = f.GenerateStruct(rls)
                        if err != nil {
                                return 0
                        }
                        key, err := f.GetString()
                        if err != nil {
                                return 0
                        }
                        secrets.Update(key, rls)
                case 3:
                        key, err := f.GetString()
                        if err != nil {
                                return 0
                        }
                        _, _ = secrets.Delete(key)
                case 4:
                        _, _ = secrets.List(func(rel *rspb.Release) bool {
                                return rel.Info.Status == rspb.StatusUninstalled
                        })
                case 5:
                        labels := make(map[string]string)
                        err := f.FuzzMap(&labels)
                        if err != nil {
                                return 0
                        }
                        _, _ = secrets.Query(labels)
                }
        }
        return 1
}

func FuzzMemory(data []byte) int {
        f := fuzz.NewConsumer(data)
        noOfCalls, err := f.GetInt()
        if err != nil {
                return 0
        }
        mem := NewMemory()
        for i:=0;i<noOfCalls%10;i++ {
                callType, err := f.GetInt()
                if err != nil {
                        return 0
                }
                switch callType%6 {
                case 0:
                        rs := &rspb.Release{}
                        err := f.GenerateStruct(rs)
                        if err != nil {
                                return 0
                        }
                        mem.Create(testFuzzKey(rs.Name, rs.Version), rs)
                case 1:
                        newNameSpace, err := f.GetString()
                        if err != nil {
                                return 0
                        }
                        mem.SetNamespace(newNameSpace)
                case 2:
                        key, err := f.GetString()
                        if err != nil {
                                return 0
                        }
                        _, _ = mem.Delete(key)
                case 3:
                        keyvals := make(map[string]string)
                        err := f.FuzzMap(&keyvals)
                        if err != nil {
                                return 0
                        }
                        _, _ = mem.Query(keyvals)
                case 4:
                        rs := &rspb.Release{}
                        err := f.GenerateStruct(rs)
                        if err != nil {
                                return 0
                        }
                        key, err := f.GetString()
                        if err != nil {
                                return 0
                        }
                        mem.Update(key, rs)
                case 5:
                        key, err := f.GetString()
                        if err != nil {
                                return 0
                        }
                        _, _ = mem.Get(key)
                }
        }
        return 1
}

func testFuzzKey(name string, vers int) string {
        return fmt.Sprintf("%s.v%d", name, vers)
}

func FuzzCfgmaps(data []byte) int {
        f := fuzz.NewConsumer(data)
        rls1 := &rspb.Release{}
        err := f.GenerateStruct(rls1)
        if err != nil {
                return 0
        }
        rls2 := &rspb.Release{}
        err = f.GenerateStruct(rls2)
        if err != nil {
                return 0
        }
        noOfCalls, err := f.GetInt()
        if err != nil {
                return 0
        }
        t := &testing.T{}
        cfgmaps := newTestFixtureCfgMaps(t, rls1, rls2)
        for i:=0;i<noOfCalls%10;i++ {
                callType, err := f.GetInt()
                if err != nil {
                        return 0
                }
                switch callType%6 {
                case 0:
                        _, _ = cfgmaps.List(func(rel *rspb.Release) bool {
                                return rel.Info.Status == rspb.StatusUninstalled
                        })
                case 1:
                        labels := make(map[string]string)
                        err := f.FuzzMap(&labels)
                        if err != nil {
                                return 0
                        }
                        _, _ = cfgmaps.Query(labels)
                case 2:
                        rls := &rspb.Release{}
                        err := f.GenerateStruct(rls)
                        if err != nil {
                                return 0
                        }
                        key, err := f.GetString()
                        if err != nil {
                                return 0
                        }
                        cfgmaps.Create(key, rls)
                case 3:
                        rls := &rspb.Release{}
                        err := f.GenerateStruct(rls)
                        if err != nil {
                                return 0
                        }
                        key, err := f.GetString()
                        if err != nil {
                                return 0
                        }
                        cfgmaps.Update(key, rls)
                case 4:
                        key, err := f.GetString()
                        if err != nil {
                                return 0
                        }
                        cfgmaps.Delete(key)
                case 5:
                        key, err := f.GetString()
                        if err != nil {
                                return 0
                        }
                        cfgmaps.Get(key)
                }
        }
        return 1
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package driver

// labels is a map of key value pairs to be included as metadata in a configmap object.
type labels map[string]string

func (lbs *labels) init()                { *lbs = labels(make(map[string]string)) }
func (lbs labels) get(key string) string { return lbs[key] }
func (lbs labels) set(key, val string)   { lbs[key] = val }

func (lbs labels) keys() (ls []string) {
        for key := range lbs {
                ls = append(ls, key)
        }
        return
}

func (lbs labels) match(set labels) bool {
        for _, key := range set.keys() {
                if lbs.get(key) != set.get(key) {
                        return false
                }
        }
        return true
}

func (lbs labels) toMap() map[string]string { return lbs }

func (lbs *labels) fromMap(kvs map[string]string) {
        for k, v := range kvs {
                lbs.set(k, v)
        }
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package driver

import (
        "strconv"
        "strings"
        "sync"

        rspb "helm.sh/helm/v3/pkg/release"
)

var _ Driver = (*Memory)(nil)

const (
        // MemoryDriverName is the string name of this driver.
        MemoryDriverName = "Memory"

        defaultNamespace = "default"
)

// A map of release names to list of release records
type memReleases map[string]records

// Memory is the in-memory storage driver implementation.
type Memory struct {
        sync.RWMutex
        namespace string
        // A map of namespaces to releases
        cache map[string]memReleases
}

// NewMemory initializes a new memory driver.
func NewMemory() *Memory {
        return &Memory{cache: map[string]memReleases{}, namespace: "default"}
}

// SetNamespace sets a specific namespace in which releases will be accessed.
// An empty string indicates all namespaces (for the list operation)
func (mem *Memory) SetNamespace(ns string) {
        mem.namespace = ns
}

// Name returns the name of the driver.
func (mem *Memory) Name() string {
        return MemoryDriverName
}

// Get returns the release named by key or returns ErrReleaseNotFound.
func (mem *Memory) Get(key string) (*rspb.Release, error) {
        defer unlock(mem.rlock())

        keyWithoutPrefix := strings.TrimPrefix(key, "sh.helm.release.v1.")
        switch elems := strings.Split(keyWithoutPrefix, ".v"); len(elems) {
        case 2:
                name, ver := elems[0], elems[1]
                if _, err := strconv.Atoi(ver); err != nil {
                        return nil, ErrInvalidKey
                }
                if recs, ok := mem.cache[mem.namespace][name]; ok {
                        if r := recs.Get(key); r != nil {
                                return r.rls, nil
                        }
                }
                return nil, ErrReleaseNotFound
        default:
                return nil, ErrInvalidKey
        }
}

// List returns the list of all releases such that filter(release) == true
func (mem *Memory) List(filter func(*rspb.Release) bool) ([]*rspb.Release, error) {
        defer unlock(mem.rlock())

        var ls []*rspb.Release
        for namespace := range mem.cache {
                if mem.namespace != "" {
                        // Should only list releases of this namespace
                        namespace = mem.namespace
                }
                for _, recs := range mem.cache[namespace] {
                        recs.Iter(func(_ int, rec *record) bool {
                                if filter(rec.rls) {
                                        ls = append(ls, rec.rls)
                                }
                                return true
                        })
                }
                if mem.namespace != "" {
                        // Should only list releases of this namespace
                        break
                }
        }
        return ls, nil
}

// Query returns the set of releases that match the provided set of labels
func (mem *Memory) Query(keyvals map[string]string) ([]*rspb.Release, error) {
        defer unlock(mem.rlock())

        var lbs labels

        lbs.init()
        lbs.fromMap(keyvals)

        var ls []*rspb.Release
        for namespace := range mem.cache {
                if mem.namespace != "" {
                        // Should only query releases of this namespace
                        namespace = mem.namespace
                }
                for _, recs := range mem.cache[namespace] {
                        recs.Iter(func(_ int, rec *record) bool {
                                // A query for a release name that doesn't exist (has been deleted)
                                // can cause rec to be nil.
                                if rec == nil {
                                        return false
                                }
                                if rec.lbs.match(lbs) {
                                        ls = append(ls, rec.rls)
                                }
                                return true
                        })
                }
                if mem.namespace != "" {
                        // Should only query releases of this namespace
                        break
                }
        }

        if len(ls) == 0 {
                return nil, ErrReleaseNotFound
        }

        return ls, nil
}

// Create creates a new release or returns ErrReleaseExists.
func (mem *Memory) Create(key string, rls *rspb.Release) error {
        defer unlock(mem.wlock())

        // For backwards compatibility, we protect against an unset namespace
        namespace := rls.Namespace
        if namespace == "" {
                namespace = defaultNamespace
        }
        mem.SetNamespace(namespace)

        if _, ok := mem.cache[namespace]; !ok {
                mem.cache[namespace] = memReleases{}
        }

        if recs, ok := mem.cache[namespace][rls.Name]; ok {
                if err := recs.Add(newRecord(key, rls)); err != nil {
                        return err
                }
                mem.cache[namespace][rls.Name] = recs
                return nil
        }
        mem.cache[namespace][rls.Name] = records{newRecord(key, rls)}
        return nil
}

// Update updates a release or returns ErrReleaseNotFound.
func (mem *Memory) Update(key string, rls *rspb.Release) error {
        defer unlock(mem.wlock())

        // For backwards compatibility, we protect against an unset namespace
        namespace := rls.Namespace
        if namespace == "" {
                namespace = defaultNamespace
        }
        mem.SetNamespace(namespace)

        if _, ok := mem.cache[namespace]; ok {
                if rs, ok := mem.cache[namespace][rls.Name]; ok && rs.Exists(key) {
                        rs.Replace(key, newRecord(key, rls))
                        return nil
                }
        }
        return ErrReleaseNotFound
}

// Delete deletes a release or returns ErrReleaseNotFound.
func (mem *Memory) Delete(key string) (*rspb.Release, error) {
        defer unlock(mem.wlock())

        keyWithoutPrefix := strings.TrimPrefix(key, "sh.helm.release.v1.")
        elems := strings.Split(keyWithoutPrefix, ".v")

        if len(elems) != 2 {
                return nil, ErrInvalidKey
        }

        name, ver := elems[0], elems[1]
        if _, err := strconv.Atoi(ver); err != nil {
                return nil, ErrInvalidKey
        }
        if _, ok := mem.cache[mem.namespace]; ok {
                if recs, ok := mem.cache[mem.namespace][name]; ok {
                        if r := recs.Remove(key); r != nil {
                                // recs.Remove changes the slice reference, so we have to re-assign it.
                                mem.cache[mem.namespace][name] = recs
                                return r.rls, nil
                        }
                }
        }
        return nil, ErrReleaseNotFound
}

// wlock locks mem for writing
func (mem *Memory) wlock() func() {
        mem.Lock()
        return func() { mem.Unlock() }
}

// rlock locks mem for reading
func (mem *Memory) rlock() func() {
        mem.RLock()
        return func() { mem.RUnlock() }
}

// unlock calls fn which reverses a mem.rlock or mem.wlock. e.g:
// ```defer unlock(mem.rlock())```, locks mem for reading at the
// call point of defer and unlocks upon exiting the block.
func unlock(fn func()) { fn() }

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package driver // import "helm.sh/helm/v3/pkg/storage/driver"

import (
        "context"
        "fmt"
        "testing"

        sqlmock "github.com/DATA-DOG/go-sqlmock"
        sq "github.com/Masterminds/squirrel"
        "github.com/jmoiron/sqlx"

        v1 "k8s.io/api/core/v1"
        apierrors "k8s.io/apimachinery/pkg/api/errors"
        metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
        kblabels "k8s.io/apimachinery/pkg/labels"
        corev1 "k8s.io/client-go/kubernetes/typed/core/v1"

        rspb "helm.sh/helm/v3/pkg/release"
)

func releaseStub(name string, vers int, namespace string, status rspb.Status) *rspb.Release {
        return &rspb.Release{
                Name:      name,
                Version:   vers,
                Namespace: namespace,
                Info:      &rspb.Info{Status: status},
                Labels: map[string]string{
                        "key1": "val1",
                        "key2": "val2",
                },
        }
}

func testKey(name string, vers int) string {
        return fmt.Sprintf("%s.v%d", name, vers)
}

func tsFixtureMemory(t *testing.T) *Memory {
        hs := []*rspb.Release{
                // rls-a
                releaseStub("rls-a", 4, "default", rspb.StatusDeployed),
                releaseStub("rls-a", 1, "default", rspb.StatusSuperseded),
                releaseStub("rls-a", 3, "default", rspb.StatusSuperseded),
                releaseStub("rls-a", 2, "default", rspb.StatusSuperseded),
                // rls-b
                releaseStub("rls-b", 4, "default", rspb.StatusDeployed),
                releaseStub("rls-b", 1, "default", rspb.StatusSuperseded),
                releaseStub("rls-b", 3, "default", rspb.StatusSuperseded),
                releaseStub("rls-b", 2, "default", rspb.StatusSuperseded),
                // rls-c in other namespace
                releaseStub("rls-c", 4, "mynamespace", rspb.StatusDeployed),
                releaseStub("rls-c", 1, "mynamespace", rspb.StatusSuperseded),
                releaseStub("rls-c", 3, "mynamespace", rspb.StatusSuperseded),
                releaseStub("rls-c", 2, "mynamespace", rspb.StatusSuperseded),
        }

        mem := NewMemory()
        for _, tt := range hs {
                err := mem.Create(testKey(tt.Name, tt.Version), tt)
                if err != nil {
                        t.Fatalf("Test setup failed to create: %s\n", err)
                }
        }
        return mem
}

// newTestFixture initializes a MockConfigMapsInterface.
// ConfigMaps are created for each release provided.
func newTestFixtureCfgMaps(t *testing.T, releases ...*rspb.Release) *ConfigMaps {
        var mock MockConfigMapsInterface
        mock.Init(t, releases...)

        return NewConfigMaps(&mock)
}

// MockConfigMapsInterface mocks a kubernetes ConfigMapsInterface
type MockConfigMapsInterface struct {
        corev1.ConfigMapInterface

        objects map[string]*v1.ConfigMap
}

// Init initializes the MockConfigMapsInterface with the set of releases.
func (mock *MockConfigMapsInterface) Init(t *testing.T, releases ...*rspb.Release) {
        mock.objects = map[string]*v1.ConfigMap{}

        for _, rls := range releases {
                objkey := testKey(rls.Name, rls.Version)

                cfgmap, err := newConfigMapsObject(objkey, rls, nil)
                if err != nil {
                        t.Fatalf("Failed to create configmap: %s", err)
                }
                mock.objects[objkey] = cfgmap
        }
}

// Get returns the ConfigMap by name.
func (mock *MockConfigMapsInterface) Get(_ context.Context, name string, _ metav1.GetOptions) (*v1.ConfigMap, error) {
        object, ok := mock.objects[name]
        if !ok {
                return nil, apierrors.NewNotFound(v1.Resource("tests"), name)
        }
        return object, nil
}

// List returns the a of ConfigMaps.
func (mock *MockConfigMapsInterface) List(_ context.Context, opts metav1.ListOptions) (*v1.ConfigMapList, error) {
        var list v1.ConfigMapList

        labelSelector, err := kblabels.Parse(opts.LabelSelector)
        if err != nil {
                return nil, err
        }

        for _, cfgmap := range mock.objects {
                if labelSelector.Matches(kblabels.Set(cfgmap.ObjectMeta.Labels)) {
                        list.Items = append(list.Items, *cfgmap)
                }
        }
        return &list, nil
}

// Create creates a new ConfigMap.
func (mock *MockConfigMapsInterface) Create(_ context.Context, cfgmap *v1.ConfigMap, _ metav1.CreateOptions) (*v1.ConfigMap, error) {
        name := cfgmap.ObjectMeta.Name
        if object, ok := mock.objects[name]; ok {
                return object, apierrors.NewAlreadyExists(v1.Resource("tests"), name)
        }
        mock.objects[name] = cfgmap
        return cfgmap, nil
}

// Update updates a ConfigMap.
func (mock *MockConfigMapsInterface) Update(_ context.Context, cfgmap *v1.ConfigMap, _ metav1.UpdateOptions) (*v1.ConfigMap, error) {
        name := cfgmap.ObjectMeta.Name
        if _, ok := mock.objects[name]; !ok {
                return nil, apierrors.NewNotFound(v1.Resource("tests"), name)
        }
        mock.objects[name] = cfgmap
        return cfgmap, nil
}

// Delete deletes a ConfigMap by name.
func (mock *MockConfigMapsInterface) Delete(_ context.Context, name string, _ metav1.DeleteOptions) error {
        if _, ok := mock.objects[name]; !ok {
                return apierrors.NewNotFound(v1.Resource("tests"), name)
        }
        delete(mock.objects, name)
        return nil
}

// newTestFixture initializes a MockSecretsInterface.
// Secrets are created for each release provided.
func newTestFixtureSecrets(t *testing.T, releases ...*rspb.Release) *Secrets {
        var mock MockSecretsInterface
        mock.Init(t, releases...)

        return NewSecrets(&mock)
}

// MockSecretsInterface mocks a kubernetes SecretsInterface
type MockSecretsInterface struct {
        corev1.SecretInterface

        objects map[string]*v1.Secret
}

// Init initializes the MockSecretsInterface with the set of releases.
func (mock *MockSecretsInterface) Init(t *testing.T, releases ...*rspb.Release) {
        mock.objects = map[string]*v1.Secret{}

        for _, rls := range releases {
                objkey := testKey(rls.Name, rls.Version)

                secret, err := newSecretsObject(objkey, rls, nil)
                if err != nil {
                        t.Fatalf("Failed to create secret: %s", err)
                }
                mock.objects[objkey] = secret
        }
}

// Get returns the Secret by name.
func (mock *MockSecretsInterface) Get(_ context.Context, name string, _ metav1.GetOptions) (*v1.Secret, error) {
        object, ok := mock.objects[name]
        if !ok {
                return nil, apierrors.NewNotFound(v1.Resource("tests"), name)
        }
        return object, nil
}

// List returns the a of Secret.
func (mock *MockSecretsInterface) List(_ context.Context, opts metav1.ListOptions) (*v1.SecretList, error) {
        var list v1.SecretList

        labelSelector, err := kblabels.Parse(opts.LabelSelector)
        if err != nil {
                return nil, err
        }

        for _, secret := range mock.objects {
                if labelSelector.Matches(kblabels.Set(secret.ObjectMeta.Labels)) {
                        list.Items = append(list.Items, *secret)
                }
        }
        return &list, nil
}

// Create creates a new Secret.
func (mock *MockSecretsInterface) Create(_ context.Context, secret *v1.Secret, _ metav1.CreateOptions) (*v1.Secret, error) {
        name := secret.ObjectMeta.Name
        if object, ok := mock.objects[name]; ok {
                return object, apierrors.NewAlreadyExists(v1.Resource("tests"), name)
        }
        mock.objects[name] = secret
        return secret, nil
}

// Update updates a Secret.
func (mock *MockSecretsInterface) Update(_ context.Context, secret *v1.Secret, _ metav1.UpdateOptions) (*v1.Secret, error) {
        name := secret.ObjectMeta.Name
        if _, ok := mock.objects[name]; !ok {
                return nil, apierrors.NewNotFound(v1.Resource("tests"), name)
        }
        mock.objects[name] = secret
        return secret, nil
}

// Delete deletes a Secret by name.
func (mock *MockSecretsInterface) Delete(_ context.Context, name string, _ metav1.DeleteOptions) error {
        if _, ok := mock.objects[name]; !ok {
                return apierrors.NewNotFound(v1.Resource("tests"), name)
        }
        delete(mock.objects, name)
        return nil
}

// newTestFixtureSQL mocks the SQL database (for testing purposes)
func newTestFixtureSQL(t *testing.T, releases ...*rspb.Release) (*SQL, sqlmock.Sqlmock) {
        sqlDB, mock, err := sqlmock.New()
        if err != nil {
                t.Fatalf("error when opening stub database connection: %v", err)
        }

        sqlxDB := sqlx.NewDb(sqlDB, "sqlmock")
        return &SQL{
                db:               sqlxDB,
                Log:              func(a string, b ...interface{}) {},
                namespace:        "default",
                statementBuilder: sq.StatementBuilder.PlaceholderFormat(sq.Dollar),
        }, mock
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package driver // import "helm.sh/helm/v3/pkg/storage/driver"

import (
        "sort"
        "strconv"

        rspb "helm.sh/helm/v3/pkg/release"
)

// records holds a list of in-memory release records
type records []*record

func (rs records) Len() int           { return len(rs) }
func (rs records) Swap(i, j int)      { rs[i], rs[j] = rs[j], rs[i] }
func (rs records) Less(i, j int) bool { return rs[i].rls.Version < rs[j].rls.Version }

func (rs *records) Add(r *record) error {
        if r == nil {
                return nil
        }

        if rs.Exists(r.key) {
                return ErrReleaseExists
        }

        *rs = append(*rs, r)
        sort.Sort(*rs)

        return nil
}

func (rs records) Get(key string) *record {
        if i, ok := rs.Index(key); ok {
                return rs[i]
        }
        return nil
}

func (rs *records) Iter(fn func(int, *record) bool) {
        cp := make([]*record, len(*rs))
        copy(cp, *rs)

        for i, r := range cp {
                if !fn(i, r) {
                        return
                }
        }
}

func (rs *records) Index(key string) (int, bool) {
        for i, r := range *rs {
                if r.key == key {
                        return i, true
                }
        }
        return -1, false
}

func (rs records) Exists(key string) bool {
        _, ok := rs.Index(key)
        return ok
}

func (rs *records) Remove(key string) (r *record) {
        if i, ok := rs.Index(key); ok {
                return rs.removeAt(i)
        }
        return nil
}

func (rs *records) Replace(key string, rec *record) *record {
        if i, ok := rs.Index(key); ok {
                old := (*rs)[i]
                (*rs)[i] = rec
                return old
        }
        return nil
}

func (rs *records) removeAt(index int) *record {
        r := (*rs)[index]
        (*rs)[index] = nil
        copy((*rs)[index:], (*rs)[index+1:])
        *rs = (*rs)[:len(*rs)-1]
        return r
}

// record is the data structure used to cache releases
// for the in-memory storage driver
type record struct {
        key string
        lbs labels
        rls *rspb.Release
}

// newRecord creates a new in-memory release record
func newRecord(key string, rls *rspb.Release) *record {
        var lbs labels

        lbs.init()
        lbs.set("name", rls.Name)
        lbs.set("owner", "helm")
        lbs.set("status", rls.Info.Status.String())
        lbs.set("version", strconv.Itoa(rls.Version))

        // return &record{key: key, lbs: lbs, rls: proto.Clone(rls).(*rspb.Release)}
        return &record{key: key, lbs: lbs, rls: rls}
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package driver // import "helm.sh/helm/v3/pkg/storage/driver"

import (
        "context"
        "strconv"
        "strings"
        "time"

        "github.com/pkg/errors"
        v1 "k8s.io/api/core/v1"
        apierrors "k8s.io/apimachinery/pkg/api/errors"
        metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
        kblabels "k8s.io/apimachinery/pkg/labels"
        "k8s.io/apimachinery/pkg/util/validation"
        corev1 "k8s.io/client-go/kubernetes/typed/core/v1"

        rspb "helm.sh/helm/v3/pkg/release"
)

var _ Driver = (*Secrets)(nil)

// SecretsDriverName is the string name of the driver.
const SecretsDriverName = "Secret"

// Secrets is a wrapper around an implementation of a kubernetes
// SecretsInterface.
type Secrets struct {
        impl corev1.SecretInterface
        Log  func(string, ...interface{})
}

// NewSecrets initializes a new Secrets wrapping an implementation of
// the kubernetes SecretsInterface.
func NewSecrets(impl corev1.SecretInterface) *Secrets {
        return &Secrets{
                impl: impl,
                Log:  func(_ string, _ ...interface{}) {},
        }
}

// Name returns the name of the driver.
func (secrets *Secrets) Name() string {
        return SecretsDriverName
}

// Get fetches the release named by key. The corresponding release is returned
// or error if not found.
func (secrets *Secrets) Get(key string) (*rspb.Release, error) {
        // fetch the secret holding the release named by key
        obj, err := secrets.impl.Get(context.Background(), key, metav1.GetOptions{})
        if err != nil {
                if apierrors.IsNotFound(err) {
                        return nil, ErrReleaseNotFound
                }
                return nil, errors.Wrapf(err, "get: failed to get %q", key)
        }
        // found the secret, decode the base64 data string
        r, err := decodeRelease(string(obj.Data["release"]))
        r.Labels = filterSystemLabels(obj.ObjectMeta.Labels)
        return r, errors.Wrapf(err, "get: failed to decode data %q", key)
}

// List fetches all releases and returns the list releases such
// that filter(release) == true. An error is returned if the
// secret fails to retrieve the releases.
func (secrets *Secrets) List(filter func(*rspb.Release) bool) ([]*rspb.Release, error) {
        lsel := kblabels.Set{"owner": "helm"}.AsSelector()
        opts := metav1.ListOptions{LabelSelector: lsel.String()}

        list, err := secrets.impl.List(context.Background(), opts)
        if err != nil {
                return nil, errors.Wrap(err, "list: failed to list")
        }

        var results []*rspb.Release

        // iterate over the secrets object list
        // and decode each release
        for _, item := range list.Items {
                rls, err := decodeRelease(string(item.Data["release"]))
                if err != nil {
                        secrets.Log("list: failed to decode release: %v: %s", item, err)
                        continue
                }

                rls.Labels = item.ObjectMeta.Labels

                if filter(rls) {
                        results = append(results, rls)
                }
        }
        return results, nil
}

// Query fetches all releases that match the provided map of labels.
// An error is returned if the secret fails to retrieve the releases.
func (secrets *Secrets) Query(labels map[string]string) ([]*rspb.Release, error) {
        ls := kblabels.Set{}
        for k, v := range labels {
                if errs := validation.IsValidLabelValue(v); len(errs) != 0 {
                        return nil, errors.Errorf("invalid label value: %q: %s", v, strings.Join(errs, "; "))
                }
                ls[k] = v
        }

        opts := metav1.ListOptions{LabelSelector: ls.AsSelector().String()}

        list, err := secrets.impl.List(context.Background(), opts)
        if err != nil {
                return nil, errors.Wrap(err, "query: failed to query with labels")
        }

        if len(list.Items) == 0 {
                return nil, ErrReleaseNotFound
        }

        var results []*rspb.Release
        for _, item := range list.Items {
                rls, err := decodeRelease(string(item.Data["release"]))
                if err != nil {
                        secrets.Log("query: failed to decode release: %s", err)
                        continue
                }
                rls.Labels = item.ObjectMeta.Labels
                results = append(results, rls)
        }
        return results, nil
}

// Create creates a new Secret holding the release. If the
// Secret already exists, ErrReleaseExists is returned.
func (secrets *Secrets) Create(key string, rls *rspb.Release) error {
        // set labels for secrets object meta data
        var lbs labels

        lbs.init()
        lbs.fromMap(rls.Labels)
        lbs.set("createdAt", strconv.Itoa(int(time.Now().Unix())))

        // create a new secret to hold the release
        obj, err := newSecretsObject(key, rls, lbs)
        if err != nil {
                return errors.Wrapf(err, "create: failed to encode release %q", rls.Name)
        }
        // push the secret object out into the kubiverse
        if _, err := secrets.impl.Create(context.Background(), obj, metav1.CreateOptions{}); err != nil {
                if apierrors.IsAlreadyExists(err) {
                        return ErrReleaseExists
                }

                return errors.Wrap(err, "create: failed to create")
        }
        return nil
}

// Update updates the Secret holding the release. If not found
// the Secret is created to hold the release.
func (secrets *Secrets) Update(key string, rls *rspb.Release) error {
        // set labels for secrets object meta data
        var lbs labels

        lbs.init()
        lbs.fromMap(rls.Labels)
        lbs.set("modifiedAt", strconv.Itoa(int(time.Now().Unix())))

        // create a new secret object to hold the release
        obj, err := newSecretsObject(key, rls, lbs)
        if err != nil {
                return errors.Wrapf(err, "update: failed to encode release %q", rls.Name)
        }
        // push the secret object out into the kubiverse
        _, err = secrets.impl.Update(context.Background(), obj, metav1.UpdateOptions{})
        return errors.Wrap(err, "update: failed to update")
}

// Delete deletes the Secret holding the release named by key.
func (secrets *Secrets) Delete(key string) (rls *rspb.Release, err error) {
        // fetch the release to check existence
        if rls, err = secrets.Get(key); err != nil {
                return nil, err
        }
        // delete the release
        err = secrets.impl.Delete(context.Background(), key, metav1.DeleteOptions{})
        return rls, err
}

// newSecretsObject constructs a kubernetes Secret object
// to store a release. Each secret data entry is the base64
// encoded gzipped string of a release.
//
// The following labels are used within each secret:
//
//        "modifiedAt"    - timestamp indicating when this secret was last modified. (set in Update)
//        "createdAt"     - timestamp indicating when this secret was created. (set in Create)
//        "version"        - version of the release.
//        "status"         - status of the release (see pkg/release/status.go for variants)
//        "owner"          - owner of the secret, currently "helm".
//        "name"           - name of the release.
func newSecretsObject(key string, rls *rspb.Release, lbs labels) (*v1.Secret, error) {
        const owner = "helm"

        // encode the release
        s, err := encodeRelease(rls)
        if err != nil {
                return nil, err
        }

        if lbs == nil {
                lbs.init()
        }

        // apply custom labels
        lbs.fromMap(rls.Labels)

        // apply labels
        lbs.set("name", rls.Name)
        lbs.set("owner", owner)
        lbs.set("status", rls.Info.Status.String())
        lbs.set("version", strconv.Itoa(rls.Version))

        // create and return secret object.
        // Helm 3 introduced setting the 'Type' field
        // in the Kubernetes storage object.
        // Helm defines the field content as follows:
        // <helm_domain>/<helm_object>.v<helm_object_version>
        // Type field for Helm 3: helm.sh/release.v1
        // Note: Version starts at 'v1' for Helm 3 and
        // should be incremented if the release object
        // metadata is modified.
        // This would potentially be a breaking change
        // and should only happen between major versions.
        return &v1.Secret{
                ObjectMeta: metav1.ObjectMeta{
                        Name:   key,
                        Labels: lbs.toMap(),
                },
                Type: "helm.sh/release.v1",
                Data: map[string][]byte{"release": []byte(s)},
        }, nil
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package driver // import "helm.sh/helm/v3/pkg/storage/driver"

import (
        "fmt"
        "sort"
        "strconv"
        "time"

        "github.com/jmoiron/sqlx"
        migrate "github.com/rubenv/sql-migrate"

        sq "github.com/Masterminds/squirrel"

        // Import pq for postgres dialect
        _ "github.com/lib/pq"

        rspb "helm.sh/helm/v3/pkg/release"
)

var _ Driver = (*SQL)(nil)

var labelMap = map[string]struct{}{
        "modifiedAt": {},
        "createdAt":  {},
        "version":    {},
        "status":     {},
        "owner":      {},
        "name":       {},
}

const postgreSQLDialect = "postgres"

// SQLDriverName is the string name of this driver.
const SQLDriverName = "SQL"

const sqlReleaseTableName = "releases_v1"
const sqlCustomLabelsTableName = "custom_labels_v1"

const (
        sqlReleaseTableKeyColumn        = "key"
        sqlReleaseTableTypeColumn       = "type"
        sqlReleaseTableBodyColumn       = "body"
        sqlReleaseTableNameColumn       = "name"
        sqlReleaseTableNamespaceColumn  = "namespace"
        sqlReleaseTableVersionColumn    = "version"
        sqlReleaseTableStatusColumn     = "status"
        sqlReleaseTableOwnerColumn      = "owner"
        sqlReleaseTableCreatedAtColumn  = "createdAt"
        sqlReleaseTableModifiedAtColumn = "modifiedAt"

        sqlCustomLabelsTableReleaseKeyColumn       = "releaseKey"
        sqlCustomLabelsTableReleaseNamespaceColumn = "releaseNamespace"
        sqlCustomLabelsTableKeyColumn              = "key"
        sqlCustomLabelsTableValueColumn            = "value"
)

// Following limits based on k8s labels limits - https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set
const (
        sqlCustomLabelsTableKeyMaxLenght   = 253 + 1 + 63
        sqlCustomLabelsTableValueMaxLenght = 63
)

const (
        sqlReleaseDefaultOwner = "helm"
        sqlReleaseDefaultType  = "helm.sh/release.v1"
)

// SQL is the sql storage driver implementation.
type SQL struct {
        db               *sqlx.DB
        namespace        string
        statementBuilder sq.StatementBuilderType

        Log func(string, ...interface{})
}

// Name returns the name of the driver.
func (s *SQL) Name() string {
        return SQLDriverName
}

// Check if all migrations al
func (s *SQL) checkAlreadyApplied(migrations []*migrate.Migration) bool {
        // make map (set) of ids for fast search
        migrationsIds := make(map[string]struct{})
        for _, migration := range migrations {
                migrationsIds[migration.Id] = struct{}{}
        }

        // get list of applied migrations
        migrate.SetDisableCreateTable(true)
        records, err := migrate.GetMigrationRecords(s.db.DB, postgreSQLDialect)
        migrate.SetDisableCreateTable(false)
        if err != nil {
                s.Log("checkAlreadyApplied: failed to get migration records: %v", err)
                return false
        }

        for _, record := range records {
                if _, ok := migrationsIds[record.Id]; ok {
                        s.Log("checkAlreadyApplied: found previous migration (Id: %v) applied at %v", record.Id, record.AppliedAt)
                        delete(migrationsIds, record.Id)
                }
        }

        // check if all migrations appliyed
        if len(migrationsIds) != 0 {
                for id := range migrationsIds {
                        s.Log("checkAlreadyApplied: find unapplied migration (id: %v)", id)
                }
                return false
        }
        return true
}

func (s *SQL) ensureDBSetup() error {

        migrations := &migrate.MemoryMigrationSource{
                Migrations: []*migrate.Migration{
                        {
                                Id: "init",
                                Up: []string{
                                        fmt.Sprintf(`
                                                CREATE TABLE %s (
                                                        %s VARCHAR(90),
                                                        %s VARCHAR(64) NOT NULL,
                                                        %s TEXT NOT NULL,
                                                        %s VARCHAR(64) NOT NULL,
                                                        %s VARCHAR(64) NOT NULL,
                                                        %s INTEGER NOT NULL,
                                                        %s TEXT NOT NULL,
                                                        %s TEXT NOT NULL,
                                                        %s INTEGER NOT NULL,
                                                        %s INTEGER NOT NULL DEFAULT 0,
                                                        PRIMARY KEY(%s, %s)
                                                );
                                                CREATE INDEX ON %s (%s, %s);
                                                CREATE INDEX ON %s (%s);
                                                CREATE INDEX ON %s (%s);
                                                CREATE INDEX ON %s (%s);
                                                CREATE INDEX ON %s (%s);
                                                CREATE INDEX ON %s (%s);
        
                                                GRANT ALL ON %s TO PUBLIC;
        
                                                ALTER TABLE %s ENABLE ROW LEVEL SECURITY;
                                        `,
                                                sqlReleaseTableName,
                                                sqlReleaseTableKeyColumn,
                                                sqlReleaseTableTypeColumn,
                                                sqlReleaseTableBodyColumn,
                                                sqlReleaseTableNameColumn,
                                                sqlReleaseTableNamespaceColumn,
                                                sqlReleaseTableVersionColumn,
                                                sqlReleaseTableStatusColumn,
                                                sqlReleaseTableOwnerColumn,
                                                sqlReleaseTableCreatedAtColumn,
                                                sqlReleaseTableModifiedAtColumn,
                                                sqlReleaseTableKeyColumn,
                                                sqlReleaseTableNamespaceColumn,
                                                sqlReleaseTableName,
                                                sqlReleaseTableKeyColumn,
                                                sqlReleaseTableNamespaceColumn,
                                                sqlReleaseTableName,
                                                sqlReleaseTableVersionColumn,
                                                sqlReleaseTableName,
                                                sqlReleaseTableStatusColumn,
                                                sqlReleaseTableName,
                                                sqlReleaseTableOwnerColumn,
                                                sqlReleaseTableName,
                                                sqlReleaseTableCreatedAtColumn,
                                                sqlReleaseTableName,
                                                sqlReleaseTableModifiedAtColumn,
                                                sqlReleaseTableName,
                                                sqlReleaseTableName,
                                        ),
                                },
                                Down: []string{
                                        fmt.Sprintf(`
                                                DROP TABLE %s;
                                        `, sqlReleaseTableName),
                                },
                        },
                        {
                                Id: "custom_labels",
                                Up: []string{
                                        fmt.Sprintf(`
                                                CREATE TABLE %s (
                                                        %s VARCHAR(64),
                                                        %s VARCHAR(67),
                                                        %s VARCHAR(%d), 
                                                        %s VARCHAR(%d)
                                                );
                                                CREATE INDEX ON %s (%s, %s);
                                                
                                                GRANT ALL ON %s TO PUBLIC;
                                                ALTER TABLE %s ENABLE ROW LEVEL SECURITY;
                                        `,
                                                sqlCustomLabelsTableName,
                                                sqlCustomLabelsTableReleaseKeyColumn,
                                                sqlCustomLabelsTableReleaseNamespaceColumn,
                                                sqlCustomLabelsTableKeyColumn,
                                                sqlCustomLabelsTableKeyMaxLenght,
                                                sqlCustomLabelsTableValueColumn,
                                                sqlCustomLabelsTableValueMaxLenght,
                                                sqlCustomLabelsTableName,
                                                sqlCustomLabelsTableReleaseKeyColumn,
                                                sqlCustomLabelsTableReleaseNamespaceColumn,
                                                sqlCustomLabelsTableName,
                                                sqlCustomLabelsTableName,
                                        ),
                                },
                                Down: []string{
                                        fmt.Sprintf(`
                                                DELETE TABLE %s;
                                        `, sqlCustomLabelsTableName),
                                },
                        },
                },
        }

        // Check that init migration already applied
        if s.checkAlreadyApplied(migrations.Migrations) {
                return nil
        }

        // Populate the database with the relations we need if they don't exist yet
        _, err := migrate.Exec(s.db.DB, postgreSQLDialect, migrations, migrate.Up)
        return err
}

// SQLReleaseWrapper describes how Helm releases are stored in an SQL database
type SQLReleaseWrapper struct {
        // The primary key, made of {release-name}.{release-version}
        Key string `db:"key"`

        // See https://github.com/helm/helm/blob/c9fe3d118caec699eb2565df9838673af379ce12/pkg/storage/driver/secrets.go#L231
        Type string `db:"type"`

        // The rspb.Release body, as a base64-encoded string
        Body string `db:"body"`

        // Release "labels" that can be used as filters in the storage.Query(labels map[string]string)
        // we implemented. Note that allowing Helm users to filter against new dimensions will require a
        // new migration to be added, and the Create and/or update functions to be updated accordingly.
        Name       string `db:"name"`
        Namespace  string `db:"namespace"`
        Version    int    `db:"version"`
        Status     string `db:"status"`
        Owner      string `db:"owner"`
        CreatedAt  int    `db:"createdAt"`
        ModifiedAt int    `db:"modifiedAt"`
}

type SQLReleaseCustomLabelWrapper struct {
        ReleaseKey       string `db:"release_key"`
        ReleaseNamespace string `db:"release_namespace"`
        Key              string `db:"key"`
        Value            string `db:"value"`
}

// NewSQL initializes a new sql driver.
func NewSQL(connectionString string, logger func(string, ...interface{}), namespace string) (*SQL, error) {
        db, err := sqlx.Connect(postgreSQLDialect, connectionString)
        if err != nil {
                return nil, err
        }

        driver := &SQL{
                db:               db,
                Log:              logger,
                statementBuilder: sq.StatementBuilder.PlaceholderFormat(sq.Dollar),
        }

        if err := driver.ensureDBSetup(); err != nil {
                return nil, err
        }

        driver.namespace = namespace

        return driver, nil
}

// Get returns the release named by key.
func (s *SQL) Get(key string) (*rspb.Release, error) {
        var record SQLReleaseWrapper

        qb := s.statementBuilder.
                Select(sqlReleaseTableBodyColumn).
                From(sqlReleaseTableName).
                Where(sq.Eq{sqlReleaseTableKeyColumn: key}).
                Where(sq.Eq{sqlReleaseTableNamespaceColumn: s.namespace})

        query, args, err := qb.ToSql()
        if err != nil {
                s.Log("failed to build query: %v", err)
                return nil, err
        }

        // Get will return an error if the result is empty
        if err := s.db.Get(&record, query, args...); err != nil {
                s.Log("got SQL error when getting release %s: %v", key, err)
                return nil, ErrReleaseNotFound
        }

        release, err := decodeRelease(record.Body)
        if err != nil {
                s.Log("get: failed to decode data %q: %v", key, err)
                return nil, err
        }

        if release.Labels, err = s.getReleaseCustomLabels(key, s.namespace); err != nil {
                s.Log("failed to get release %s/%s custom labels: %v", s.namespace, key, err)
                return nil, err
        }

        return release, nil
}

// List returns the list of all releases such that filter(release) == true
func (s *SQL) List(filter func(*rspb.Release) bool) ([]*rspb.Release, error) {
        sb := s.statementBuilder.
                Select(sqlReleaseTableKeyColumn, sqlReleaseTableNamespaceColumn, sqlReleaseTableBodyColumn).
                From(sqlReleaseTableName).
                Where(sq.Eq{sqlReleaseTableOwnerColumn: sqlReleaseDefaultOwner})

        // If a namespace was specified, we only list releases from that namespace
        if s.namespace != "" {
                sb = sb.Where(sq.Eq{sqlReleaseTableNamespaceColumn: s.namespace})
        }

        query, args, err := sb.ToSql()
        if err != nil {
                s.Log("failed to build query: %v", err)
                return nil, err
        }

        var records = []SQLReleaseWrapper{}
        if err := s.db.Select(&records, query, args...); err != nil {
                s.Log("list: failed to list: %v", err)
                return nil, err
        }

        var releases []*rspb.Release
        for _, record := range records {
                release, err := decodeRelease(record.Body)
                if err != nil {
                        s.Log("list: failed to decode release: %v: %v", record, err)
                        continue
                }

                if release.Labels, err = s.getReleaseCustomLabels(record.Key, record.Namespace); err != nil {
                        s.Log("failed to get release %s/%s custom labels: %v", record.Namespace, record.Key, err)
                        return nil, err
                }
                for k, v := range getReleaseSystemLabels(release) {
                        release.Labels[k] = v
                }

                if filter(release) {
                        releases = append(releases, release)
                }
        }

        return releases, nil
}

// Query returns the set of releases that match the provided set of labels.
func (s *SQL) Query(labels map[string]string) ([]*rspb.Release, error) {
        sb := s.statementBuilder.
                Select(sqlReleaseTableKeyColumn, sqlReleaseTableNamespaceColumn, sqlReleaseTableBodyColumn).
                From(sqlReleaseTableName)

        keys := make([]string, 0, len(labels))
        for key := range labels {
                keys = append(keys, key)
        }
        sort.Strings(keys)
        for _, key := range keys {
                if _, ok := labelMap[key]; ok {
                        sb = sb.Where(sq.Eq{key: labels[key]})
                } else {
                        s.Log("unknown label %s", key)
                        return nil, fmt.Errorf("unknown label %s", key)
                }
        }

        // If a namespace was specified, we only list releases from that namespace
        if s.namespace != "" {
                sb = sb.Where(sq.Eq{sqlReleaseTableNamespaceColumn: s.namespace})
        }

        // Build our query
        query, args, err := sb.ToSql()
        if err != nil {
                s.Log("failed to build query: %v", err)
                return nil, err
        }

        var records = []SQLReleaseWrapper{}
        if err := s.db.Select(&records, query, args...); err != nil {
                s.Log("list: failed to query with labels: %v", err)
                return nil, err
        }

        if len(records) == 0 {
                return nil, ErrReleaseNotFound
        }

        var releases []*rspb.Release
        for _, record := range records {
                release, err := decodeRelease(record.Body)
                if err != nil {
                        s.Log("list: failed to decode release: %v: %v", record, err)
                        continue
                }

                if release.Labels, err = s.getReleaseCustomLabels(record.Key, record.Namespace); err != nil {
                        s.Log("failed to get release %s/%s custom labels: %v", record.Namespace, record.Key, err)
                        return nil, err
                }

                releases = append(releases, release)
        }

        if len(releases) == 0 {
                return nil, ErrReleaseNotFound
        }

        return releases, nil
}

// Create creates a new release.
func (s *SQL) Create(key string, rls *rspb.Release) error {
        namespace := rls.Namespace
        if namespace == "" {
                namespace = defaultNamespace
        }
        s.namespace = namespace

        body, err := encodeRelease(rls)
        if err != nil {
                s.Log("failed to encode release: %v", err)
                return err
        }

        transaction, err := s.db.Beginx()
        if err != nil {
                s.Log("failed to start SQL transaction: %v", err)
                return fmt.Errorf("error beginning transaction: %v", err)
        }

        insertQuery, args, err := s.statementBuilder.
                Insert(sqlReleaseTableName).
                Columns(
                        sqlReleaseTableKeyColumn,
                        sqlReleaseTableTypeColumn,
                        sqlReleaseTableBodyColumn,
                        sqlReleaseTableNameColumn,
                        sqlReleaseTableNamespaceColumn,
                        sqlReleaseTableVersionColumn,
                        sqlReleaseTableStatusColumn,
                        sqlReleaseTableOwnerColumn,
                        sqlReleaseTableCreatedAtColumn,
                ).
                Values(
                        key,
                        sqlReleaseDefaultType,
                        body,
                        rls.Name,
                        namespace,
                        int(rls.Version),
                        rls.Info.Status.String(),
                        sqlReleaseDefaultOwner,
                        int(time.Now().Unix()),
                ).ToSql()
        if err != nil {
                s.Log("failed to build insert query: %v", err)
                return err
        }

        if _, err := transaction.Exec(insertQuery, args...); err != nil {
                defer transaction.Rollback()

                selectQuery, args, buildErr := s.statementBuilder.
                        Select(sqlReleaseTableKeyColumn).
                        From(sqlReleaseTableName).
                        Where(sq.Eq{sqlReleaseTableKeyColumn: key}).
                        Where(sq.Eq{sqlReleaseTableNamespaceColumn: s.namespace}).
                        ToSql()
                if buildErr != nil {
                        s.Log("failed to build select query: %v", buildErr)
                        return err
                }

                var record SQLReleaseWrapper
                if err := transaction.Get(&record, selectQuery, args...); err == nil {
                        s.Log("release %s already exists", key)
                        return ErrReleaseExists
                }

                s.Log("failed to store release %s in SQL database: %v", key, err)
                return err
        }

        // Filtering labels before insert cause in SQL storage driver system releases are stored in separate columns of release table
        for k, v := range filterSystemLabels(rls.Labels) {
                insertLabelsQuery, args, err := s.statementBuilder.
                        Insert(sqlCustomLabelsTableName).
                        Columns(
                                sqlCustomLabelsTableReleaseKeyColumn,
                                sqlCustomLabelsTableReleaseNamespaceColumn,
                                sqlCustomLabelsTableKeyColumn,
                                sqlCustomLabelsTableValueColumn,
                        ).
                        Values(
                                key,
                                namespace,
                                k,
                                v,
                        ).ToSql()

                if err != nil {
                        defer transaction.Rollback()
                        s.Log("failed to build insert query: %v", err)
                        return err
                }

                if _, err := transaction.Exec(insertLabelsQuery, args...); err != nil {
                        defer transaction.Rollback()
                        s.Log("failed to write Labels: %v", err)
                        return err
                }
        }
        defer transaction.Commit()

        return nil
}

// Update updates a release.
func (s *SQL) Update(key string, rls *rspb.Release) error {
        namespace := rls.Namespace
        if namespace == "" {
                namespace = defaultNamespace
        }
        s.namespace = namespace

        body, err := encodeRelease(rls)
        if err != nil {
                s.Log("failed to encode release: %v", err)
                return err
        }

        query, args, err := s.statementBuilder.
                Update(sqlReleaseTableName).
                Set(sqlReleaseTableBodyColumn, body).
                Set(sqlReleaseTableNameColumn, rls.Name).
                Set(sqlReleaseTableVersionColumn, int(rls.Version)).
                Set(sqlReleaseTableStatusColumn, rls.Info.Status.String()).
                Set(sqlReleaseTableOwnerColumn, sqlReleaseDefaultOwner).
                Set(sqlReleaseTableModifiedAtColumn, int(time.Now().Unix())).
                Where(sq.Eq{sqlReleaseTableKeyColumn: key}).
                Where(sq.Eq{sqlReleaseTableNamespaceColumn: namespace}).
                ToSql()

        if err != nil {
                s.Log("failed to build update query: %v", err)
                return err
        }

        if _, err := s.db.Exec(query, args...); err != nil {
                s.Log("failed to update release %s in SQL database: %v", key, err)
                return err
        }

        return nil
}

// Delete deletes a release or returns ErrReleaseNotFound.
func (s *SQL) Delete(key string) (*rspb.Release, error) {
        transaction, err := s.db.Beginx()
        if err != nil {
                s.Log("failed to start SQL transaction: %v", err)
                return nil, fmt.Errorf("error beginning transaction: %v", err)
        }

        selectQuery, args, err := s.statementBuilder.
                Select(sqlReleaseTableBodyColumn).
                From(sqlReleaseTableName).
                Where(sq.Eq{sqlReleaseTableKeyColumn: key}).
                Where(sq.Eq{sqlReleaseTableNamespaceColumn: s.namespace}).
                ToSql()
        if err != nil {
                s.Log("failed to build select query: %v", err)
                return nil, err
        }

        var record SQLReleaseWrapper
        err = transaction.Get(&record, selectQuery, args...)
        if err != nil {
                s.Log("release %s not found: %v", key, err)
                return nil, ErrReleaseNotFound
        }

        release, err := decodeRelease(record.Body)
        if err != nil {
                s.Log("failed to decode release %s: %v", key, err)
                transaction.Rollback()
                return nil, err
        }
        defer transaction.Commit()

        deleteQuery, args, err := s.statementBuilder.
                Delete(sqlReleaseTableName).
                Where(sq.Eq{sqlReleaseTableKeyColumn: key}).
                Where(sq.Eq{sqlReleaseTableNamespaceColumn: s.namespace}).
                ToSql()
        if err != nil {
                s.Log("failed to build delete query: %v", err)
                return nil, err
        }

        _, err = transaction.Exec(deleteQuery, args...)
        if err != nil {
                s.Log("failed perform delete query: %v", err)
                return release, err
        }

        if release.Labels, err = s.getReleaseCustomLabels(key, s.namespace); err != nil {
                s.Log("failed to get release %s/%s custom labels: %v", s.namespace, key, err)
                return nil, err
        }

        deleteCustomLabelsQuery, args, err := s.statementBuilder.
                Delete(sqlCustomLabelsTableName).
                Where(sq.Eq{sqlCustomLabelsTableReleaseKeyColumn: key}).
                Where(sq.Eq{sqlCustomLabelsTableReleaseNamespaceColumn: s.namespace}).
                ToSql()

        if err != nil {
                s.Log("failed to build delete Labels query: %v", err)
                return nil, err
        }
        _, err = transaction.Exec(deleteCustomLabelsQuery, args...)
        return release, err
}

// Get release custom labels from database
func (s *SQL) getReleaseCustomLabels(key string, namespace string) (map[string]string, error) {
        query, args, err := s.statementBuilder.
                Select(sqlCustomLabelsTableKeyColumn, sqlCustomLabelsTableValueColumn).
                From(sqlCustomLabelsTableName).
                Where(sq.Eq{sqlCustomLabelsTableReleaseKeyColumn: key,
                        sqlCustomLabelsTableReleaseNamespaceColumn: s.namespace}).
                ToSql()
        if err != nil {
                return nil, err
        }

        var labelsList = []SQLReleaseCustomLabelWrapper{}
        if err := s.db.Select(&labelsList, query, args...); err != nil {
                return nil, err
        }

        labelsMap := make(map[string]string)
        for _, i := range labelsList {
                labelsMap[i.Key] = i.Value
        }

        return filterSystemLabels(labelsMap), nil
}

// Rebuild system labels from release object
func getReleaseSystemLabels(rls *rspb.Release) map[string]string {
        return map[string]string{
                "name":    rls.Name,
                "owner":   sqlReleaseDefaultOwner,
                "status":  rls.Info.Status.String(),
                "version": strconv.Itoa(rls.Version),
        }
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package driver // import "helm.sh/helm/v3/pkg/storage/driver"

import (
        "bytes"
        "compress/gzip"
        "encoding/base64"
        "encoding/json"
        "io"

        rspb "helm.sh/helm/v3/pkg/release"
)

var b64 = base64.StdEncoding

var magicGzip = []byte{0x1f, 0x8b, 0x08}

var systemLabels = []string{"name", "owner", "status", "version", "createdAt", "modifiedAt"}

// encodeRelease encodes a release returning a base64 encoded
// gzipped string representation, or error.
func encodeRelease(rls *rspb.Release) (string, error) {
        b, err := json.Marshal(rls)
        if err != nil {
                return "", err
        }
        var buf bytes.Buffer
        w, err := gzip.NewWriterLevel(&buf, gzip.BestCompression)
        if err != nil {
                return "", err
        }
        if _, err = w.Write(b); err != nil {
                return "", err
        }
        w.Close()

        return b64.EncodeToString(buf.Bytes()), nil
}

// decodeRelease decodes the bytes of data into a release
// type. Data must contain a base64 encoded gzipped string of a
// valid release, otherwise an error is returned.
func decodeRelease(data string) (*rspb.Release, error) {
        // base64 decode string
        b, err := b64.DecodeString(data)
        if err != nil {
                return nil, err
        }

        // For backwards compatibility with releases that were stored before
        // compression was introduced we skip decompression if the
        // gzip magic header is not found
        if len(b) > 3 && bytes.Equal(b[0:3], magicGzip) {
                r, err := gzip.NewReader(bytes.NewReader(b))
                if err != nil {
                        return nil, err
                }
                defer r.Close()
                b2, err := io.ReadAll(r)
                if err != nil {
                        return nil, err
                }
                b = b2
        }

        var rls rspb.Release
        // unmarshal release object bytes
        if err := json.Unmarshal(b, &rls); err != nil {
                return nil, err
        }
        return &rls, nil
}

// Checks if label is system
func isSystemLabel(key string) bool {
        for _, v := range GetSystemLabels() {
                if key == v {
                        return true
                }
        }
        return false
}

// Removes system labels from labels map
func filterSystemLabels(lbs map[string]string) map[string]string {
        result := make(map[string]string)
        for k, v := range lbs {
                if !isSystemLabel(k) {
                        result[k] = v
                }
        }
        return result
}

// Checks if labels array contains system labels
func ContainsSystemLabels(lbs map[string]string) bool {
        for k := range lbs {
                if isSystemLabel(k) {
                        return true
                }
        }
        return false
}

func GetSystemLabels() []string {
        return systemLabels
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package storage // import "helm.sh/helm/v3/pkg/storage"

import (
        "fmt"
        "strings"

        "github.com/pkg/errors"

        rspb "helm.sh/helm/v3/pkg/release"
        relutil "helm.sh/helm/v3/pkg/releaseutil"
        "helm.sh/helm/v3/pkg/storage/driver"
)

// HelmStorageType is the type field of the Kubernetes storage object which stores the Helm release
// version. It is modified slightly replacing the '/': sh.helm/release.v1
// Note: The version 'v1' is incremented if the release object metadata is
// modified between major releases.
// This constant is used as a prefix for the Kubernetes storage object name.
const HelmStorageType = "sh.helm.release.v1"

// Storage represents a storage engine for a Release.
type Storage struct {
        driver.Driver

        // MaxHistory specifies the maximum number of historical releases that will
        // be retained, including the most recent release. Values of 0 or less are
        // ignored (meaning no limits are imposed).
        MaxHistory int

        Log func(string, ...interface{})
}

// Get retrieves the release from storage. An error is returned
// if the storage driver failed to fetch the release, or the
// release identified by the key, version pair does not exist.
func (s *Storage) Get(name string, version int) (*rspb.Release, error) {
        s.Log("getting release %q", makeKey(name, version))
        return s.Driver.Get(makeKey(name, version))
}

// Create creates a new storage entry holding the release. An
// error is returned if the storage driver fails to store the
// release, or a release with an identical key already exists.
func (s *Storage) Create(rls *rspb.Release) error {
        s.Log("creating release %q", makeKey(rls.Name, rls.Version))
        if s.MaxHistory > 0 {
                // Want to make space for one more release.
                if err := s.removeLeastRecent(rls.Name, s.MaxHistory-1); err != nil &&
                        !errors.Is(err, driver.ErrReleaseNotFound) {
                        return err
                }
        }
        return s.Driver.Create(makeKey(rls.Name, rls.Version), rls)
}

// Update updates the release in storage. An error is returned if the
// storage backend fails to update the release or if the release
// does not exist.
func (s *Storage) Update(rls *rspb.Release) error {
        s.Log("updating release %q", makeKey(rls.Name, rls.Version))
        return s.Driver.Update(makeKey(rls.Name, rls.Version), rls)
}

// Delete deletes the release from storage. An error is returned if
// the storage backend fails to delete the release or if the release
// does not exist.
func (s *Storage) Delete(name string, version int) (*rspb.Release, error) {
        s.Log("deleting release %q", makeKey(name, version))
        return s.Driver.Delete(makeKey(name, version))
}

// ListReleases returns all releases from storage. An error is returned if the
// storage backend fails to retrieve the releases.
func (s *Storage) ListReleases() ([]*rspb.Release, error) {
        s.Log("listing all releases in storage")
        return s.Driver.List(func(_ *rspb.Release) bool { return true })
}

// ListUninstalled returns all releases with Status == UNINSTALLED. An error is returned
// if the storage backend fails to retrieve the releases.
func (s *Storage) ListUninstalled() ([]*rspb.Release, error) {
        s.Log("listing uninstalled releases in storage")
        return s.Driver.List(func(rls *rspb.Release) bool {
                return relutil.StatusFilter(rspb.StatusUninstalled).Check(rls)
        })
}

// ListDeployed returns all releases with Status == DEPLOYED. An error is returned
// if the storage backend fails to retrieve the releases.
func (s *Storage) ListDeployed() ([]*rspb.Release, error) {
        s.Log("listing all deployed releases in storage")
        return s.Driver.List(func(rls *rspb.Release) bool {
                return relutil.StatusFilter(rspb.StatusDeployed).Check(rls)
        })
}

// Deployed returns the last deployed release with the provided release name, or
// returns ErrReleaseNotFound if not found.
func (s *Storage) Deployed(name string) (*rspb.Release, error) {
        ls, err := s.DeployedAll(name)
        if err != nil {
                return nil, err
        }

        if len(ls) == 0 {
                return nil, driver.NewErrNoDeployedReleases(name)
        }

        // If executed concurrently, Helm's database gets corrupted
        // and multiple releases are DEPLOYED. Take the latest.
        relutil.Reverse(ls, relutil.SortByRevision)

        return ls[0], nil
}

// DeployedAll returns all deployed releases with the provided name, or
// returns ErrReleaseNotFound if not found.
func (s *Storage) DeployedAll(name string) ([]*rspb.Release, error) {
        s.Log("getting deployed releases from %q history", name)

        ls, err := s.Driver.Query(map[string]string{
                "name":   name,
                "owner":  "helm",
                "status": "deployed",
        })
        if err == nil {
                return ls, nil
        }
        if strings.Contains(err.Error(), "not found") {
                return nil, driver.NewErrNoDeployedReleases(name)
        }
        return nil, err
}

// History returns the revision history for the release with the provided name, or
// returns ErrReleaseNotFound if no such release name exists.
func (s *Storage) History(name string) ([]*rspb.Release, error) {
        s.Log("getting release history for %q", name)

        return s.Driver.Query(map[string]string{"name": name, "owner": "helm"})
}

// removeLeastRecent removes items from history until the length number of releases
// does not exceed max.
//
// We allow max to be set explicitly so that calling functions can "make space"
// for the new records they are going to write.
func (s *Storage) removeLeastRecent(name string, max int) error {
        if max < 0 {
                return nil
        }
        h, err := s.History(name)
        if err != nil {
                return err
        }
        if len(h) <= max {
                return nil
        }

        // We want oldest to newest
        relutil.SortByRevision(h)

        lastDeployed, err := s.Deployed(name)
        if err != nil && !errors.Is(err, driver.ErrNoDeployedReleases) {
                return err
        }

        var toDelete []*rspb.Release
        for _, rel := range h {
                // once we have enough releases to delete to reach the max, stop
                if len(h)-len(toDelete) == max {
                        break
                }
                if lastDeployed != nil {
                        if rel.Version != lastDeployed.Version {
                                toDelete = append(toDelete, rel)
                        }
                } else {
                        toDelete = append(toDelete, rel)
                }
        }

        // Delete as many as possible. In the case of API throughput limitations,
        // multiple invocations of this function will eventually delete them all.
        errs := []error{}
        for _, rel := range toDelete {
                err = s.deleteReleaseVersion(name, rel.Version)
                if err != nil {
                        errs = append(errs, err)
                }
        }

        s.Log("Pruned %d record(s) from %s with %d error(s)", len(toDelete), name, len(errs))
        switch c := len(errs); c {
        case 0:
                return nil
        case 1:
                return errs[0]
        default:
                return errors.Errorf("encountered %d deletion errors. First is: %s", c, errs[0])
        }
}

func (s *Storage) deleteReleaseVersion(name string, version int) error {
        key := makeKey(name, version)
        _, err := s.Delete(name, version)
        if err != nil {
                s.Log("error pruning %s from release history: %s", key, err)
                return err
        }
        return nil
}

// Last fetches the last revision of the named release.
func (s *Storage) Last(name string) (*rspb.Release, error) {
        s.Log("getting last revision of %q", name)
        h, err := s.History(name)
        if err != nil {
                return nil, err
        }
        if len(h) == 0 {
                return nil, errors.Errorf("no revision for release %q", name)
        }

        relutil.Reverse(h, relutil.SortByRevision)
        return h[0], nil
}

// makeKey concatenates the Kubernetes storage object type, a release name and version
// into a string with format:```<helm_storage_type>.<release_name>.v<release_version>```.
// The storage type is prepended to keep name uniqueness between different
// release storage types. An example of clash when not using the type:
// https://github.com/helm/helm/issues/6435.
// This key is used to uniquely identify storage objects.
func makeKey(rlsname string, version int) string {
        return fmt.Sprintf("%s.%s.v%d", HelmStorageType, rlsname, version)
}

// Init initializes a new storage backend with the driver d.
// If d is nil, the default in-memory driver is used.
func Init(d driver.Driver) *Storage {
        // default driver is in memory
        if d == nil {
                d = driver.NewMemory()
        }
        return &Storage{
                Driver: d,
                Log:    func(_ string, _ ...interface{}) {},
        }
}

package storage

import (
        "helm.sh/helm/v3/pkg/storage/driver"
        rspb "helm.sh/helm/v3/pkg/release"
        fuzz "github.com/AdaLogics/go-fuzz-headers"
)

func FuzzStorage(data []byte) int {
        f := fuzz.NewConsumer(data)
        noOfCalls, err := f.GetInt()
        if err != nil {
                return 0
        }
        storage := Init(driver.NewMemory())
        for i:=0;i<noOfCalls%10;i++ {
                callType, err := f.GetInt()
                if err != nil {
                        return 0
                }
                switch callType%11 {
                case 0:
                        storageCreate(storage, f)
                case 1:
                        storageUpdate(storage, f)
                case 2:
                        storageGet(storage, f)
                case 3:
                        storageDelete(storage, f)
                case 4:
                        storageHistory(storage, f)
                case 5:
                        storageListReleases(storage)
                case 6:
                        storageListUninstalled(storage)
                case 7:
                        storageListDeployed(storage)
                case 8:
                        storageDeployed(storage, f)
                case 9:
                        storageDeployedAll(storage, f)
                case 10:
                        storageLast(storage, f)
                }
        }
        return 1
}

func storageCreate(s *Storage, f *fuzz.ConsumeFuzzer) error {
        rls := &rspb.Release{}
        err := f.GenerateStruct(rls)
        if err != nil {
                return err
        }
        s.Create(rls)
        return nil
}

func storageUpdate(s *Storage, f *fuzz.ConsumeFuzzer) error {
        rls := &rspb.Release{}
        err := f.GenerateStruct(rls)
        if err != nil {
                return err
        }
        s.Update(rls)
        return nil
}

func storageGet(s *Storage, f *fuzz.ConsumeFuzzer) error {
        name, err := f.GetString()
        if err != nil {
                return err
        }
        version, err := f.GetInt()
        if err != nil {
                return err
        }
        _, _ = s.Get(name, version)
        return nil
}

func storageDelete(s *Storage, f *fuzz.ConsumeFuzzer) error {
        name, err := f.GetString()
        if err != nil {
                return err
        }
        version, err := f.GetInt()
        if err != nil {
                return err
        }
        _, _ = s.Delete(name, version)
        return nil
}

func storageHistory(s *Storage, f *fuzz.ConsumeFuzzer) error {
        name, err := f.GetString()
        if err != nil {
                return err
        }
        _, _ = s.History(name)
        return nil
}

func storageListReleases(s *Storage) error {
        _, _ = s.ListReleases()
        return nil
}

func storageListUninstalled(s *Storage) error {
        _, _ = s.ListUninstalled()
        return nil
}

func storageListDeployed(s *Storage) error {
        _, _ = s.ListDeployed()
        return nil
}

func storageDeployed(s *Storage, f *fuzz.ConsumeFuzzer) error {
        name, err := f.GetString()
        if err != nil {
                return err
        }
        _, _ = s.Deployed(name)
        return nil
}

func storageDeployedAll(s *Storage, f *fuzz.ConsumeFuzzer) error {
        name, err := f.GetString()
        if err != nil {
                return err
        }
        _, _ = s.DeployedAll(name)
        return nil
}

func storageLast(s *Storage, f *fuzz.ConsumeFuzzer) error {
        name, err := f.GetString()
        if err != nil {
                return err
        }
        _, _ = s.Last(name)
        return nil
}

/*
Copyright The Helm Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package strvals

import (
        "bytes"
        "fmt"
        "io"
        "strconv"

        "github.com/pkg/errors"
)

// ParseLiteral parses a set line interpreting the value as a literal string.
//
// A set line is of the form name1=value1
func ParseLiteral(s string) (map[string]interface{}, error) {
        vals := map[string]interface{}{}
        scanner := bytes.NewBufferString(s)
        t := newLiteralParser(scanner, vals)
        err := t.parse()
        return vals, err
}

// ParseLiteralInto parses a strvals line and merges the result into dest.
// The value is interpreted as a literal string.
//
// If the strval string has a key that exists in dest, it overwrites the
// dest version.
func ParseLiteralInto(s string, dest map[string]interface{}) error {
        scanner := bytes.NewBufferString(s)
        t := newLiteralParser(scanner, dest)
        return t.parse()
}

// literalParser is a simple parser that takes a strvals line and parses
// it into a map representation.
//
// Values are interpreted as a literal string.
//
// where sc is the source of the original data being parsed
// where data is the final parsed data from the parses with correct types
type literalParser struct {
        sc   *bytes.Buffer
        data map[string]interface{}
}

func newLiteralParser(sc *bytes.Buffer, data map[string]interface{}) *literalParser {
        return &literalParser{sc: sc, data: data}
}

func (t *literalParser) parse() error {
        for {
                err := t.key(t.data, 0)
                if err == nil {
                        continue
                }
                if err == io.EOF {
                        return nil
                }
                return err
        }
}

func runesUntilLiteral(in io.RuneReader, stop map[rune]bool) ([]rune, rune, error) {
        v := []rune{}
        for {
                switch r, _, e := in.ReadRune(); {
                case e != nil:
                        return v, r, e
                case inMap(r, stop):
                        return v, r, nil
                default:
                        v = append(v, r)
                }
        }
}

func (t *literalParser) key(data map[string]interface{}, nestedNameLevel int) (reterr error) {
        defer func() {
                if r := recover(); r != nil {
                        reterr = fmt.Errorf("unable to parse key: %s", r)
                }
        }()
        stop := runeSet([]rune{'=', '[', '.'})
        for {
                switch key, lastRune, err := runesUntilLiteral(t.sc, stop); {
                case err != nil:
                        if len(key) == 0 {
                                return err
                        }
                        return errors.Errorf("key %q has no value", string(key))

                case lastRune == '=':
                        // found end of key: swallow the '=' and get the value
                        value, err := t.val()
                        if err == nil && err != io.EOF {
                                return err
                        }
                        set(data, string(key), string(value))
                        return nil

                case lastRune == '.':
                        // Check value name is within the maximum nested name level
                        nestedNameLevel++
                        if nestedNameLevel > MaxNestedNameLevel {
                                return fmt.Errorf("value name nested level is greater than maximum supported nested level of %d", MaxNestedNameLevel)
                        }

                        // first, create or find the target map in the given data
                        inner := map[string]interface{}{}
                        if _, ok := data[string(key)]; ok {
                                inner = data[string(key)].(map[string]interface{})
                        }

                        // recurse on sub-tree with remaining data
                        err := t.key(inner, nestedNameLevel)
                        if err == nil && len(inner) == 0 {
                                return errors.Errorf("key map %q has no value", string(key))
                        }
                        if len(inner) != 0 {
                                set(data, string(key), inner)
                        }
                        return err

                case lastRune == '[':
                        // We are in a list index context, so we need to set an index.
                        i, err := t.keyIndex()
                        if err != nil {
                                return errors.Wrap(err, "error parsing index")
                        }
                        kk := string(key)

                        // find or create target list
                        list := []interface{}{}
                        if _, ok := data[kk]; ok {
                                list = data[kk].([]interface{})
                        }

                        // now we need to get the value after the ]
                        list, err = t.listItem(list, i, nestedNameLevel)
                        set(data, kk, list)
                        return err
                }
        }
}

func (t *literalParser) keyIndex() (int, error) {
        // First, get the key.
        stop := runeSet([]rune{']'})
        v, _, err := runesUntilLiteral(t.sc, stop)
        if err != nil {
                return 0, err
        }

        // v should be the index
        return strconv.Atoi(string(v))
}

func (t *literalParser) listItem(list []interface{}, i, nestedNameLevel int) ([]interface{}, error) {
        if i < 0 {
                return list, fmt.Errorf("negative %d index not allowed", i)
        }
        stop := runeSet([]rune{'[', '.', '='})

        switch key, lastRune, err := runesUntilLiteral(t.sc, stop); {
        case len(key) > 0:
                return list, errors.Errorf("unexpected data at end of array index: %q", key)

        case err != nil:
                return list, err

        case lastRune == '=':
                value, err := t.val()
                if err != nil && err != io.EOF {
                        return list, err
                }
                return setIndex(list, i, string(value))

        case lastRune == '.':
                // we have a nested object. Send to t.key
                inner := map[string]interface{}{}
                if len(list) > i {
                        var ok bool
                        inner, ok = list[i].(map[string]interface{})
                        if !ok {
                                // We have indices out of order. Initialize empty value.
                                list[i] = map[string]interface{}{}
                                inner = list[i].(map[string]interface{})
                        }
                }

                // recurse
                err := t.key(inner, nestedNameLevel)
                if err != nil {
                        return list, err
                }
                return setIndex(list, i, inner)

        case lastRune == '[':
                // now we have a nested list. Read the index and handle.
                nextI, err := t.keyIndex()
                if err != nil {
                        return list, errors.Wrap(err, "error parsing index")
                }
                var crtList []interface{}
                if len(list) > i {
                        // If nested list already exists, take the value of list to next cycle.
                        existed := list[i]
                        if existed != nil {
                                crtList = list[i].([]interface{})
                        }
                }

                // Now we need to get the value after the ].
                list2, err := t.listItem(crtList, nextI, nestedNameLevel)
                if err != nil {
                        return list, err
                }
                return setIndex(list, i, list2)

        default:
                return nil, errors.Errorf("parse error: unexpected token %v", lastRune)
        }
}

func (t *literalParser) val() ([]rune, error) {
        stop := runeSet([]rune{})
        v, _, err := runesUntilLiteral(t.sc, stop)
        return v, err
}

/*
Copyright The Helm Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package strvals

import (
        "bytes"
        "encoding/json"
        "fmt"
        "io"
        "strconv"
        "strings"
        "unicode"

        "github.com/pkg/errors"
        "sigs.k8s.io/yaml"
)

// ErrNotList indicates that a non-list was treated as a list.
var ErrNotList = errors.New("not a list")

// MaxIndex is the maximum index that will be allowed by setIndex.
// The default value 65536 = 1024 * 64
var MaxIndex = 65536

// MaxNestedNameLevel is the maximum level of nesting for a value name that
// will be allowed.
var MaxNestedNameLevel = 30

// ToYAML takes a string of arguments and converts to a YAML document.
func ToYAML(s string) (string, error) {
        m, err := Parse(s)
        if err != nil {
                return "", err
        }
        d, err := yaml.Marshal(m)
        return strings.TrimSuffix(string(d), "\n"), err
}

// Parse parses a set line.
//
// A set line is of the form name1=value1,name2=value2
func Parse(s string) (map[string]interface{}, error) {
        vals := map[string]interface{}{}
        scanner := bytes.NewBufferString(s)
        t := newParser(scanner, vals, false)
        err := t.parse()
        return vals, err
}

// ParseString parses a set line and forces a string value.
//
// A set line is of the form name1=value1,name2=value2
func ParseString(s string) (map[string]interface{}, error) {
        vals := map[string]interface{}{}
        scanner := bytes.NewBufferString(s)
        t := newParser(scanner, vals, true)
        err := t.parse()
        return vals, err
}

// ParseInto parses a strvals line and merges the result into dest.
//
// If the strval string has a key that exists in dest, it overwrites the
// dest version.
func ParseInto(s string, dest map[string]interface{}) error {
        scanner := bytes.NewBufferString(s)
        t := newParser(scanner, dest, false)
        return t.parse()
}

// ParseFile parses a set line, but its final value is loaded from the file at the path specified by the original value.
//
// A set line is of the form name1=path1,name2=path2
//
// When the files at path1 and path2 contained "val1" and "val2" respectively, the set line is consumed as
// name1=val1,name2=val2
func ParseFile(s string, reader RunesValueReader) (map[string]interface{}, error) {
        vals := map[string]interface{}{}
        scanner := bytes.NewBufferString(s)
        t := newFileParser(scanner, vals, reader)
        err := t.parse()
        return vals, err
}

// ParseIntoString parses a strvals line and merges the result into dest.
//
// This method always returns a string as the value.
func ParseIntoString(s string, dest map[string]interface{}) error {
        scanner := bytes.NewBufferString(s)
        t := newParser(scanner, dest, true)
        return t.parse()
}

// ParseJSON parses a string with format key1=val1, key2=val2, ...
// where values are json strings (null, or scalars, or arrays, or objects).
// An empty val is treated as null.
//
// If a key exists in dest, the new value overwrites the dest version.
func ParseJSON(s string, dest map[string]interface{}) error {
        scanner := bytes.NewBufferString(s)
        t := newJSONParser(scanner, dest)
        return t.parse()
}

// ParseIntoFile parses a filevals line and merges the result into dest.
//
// This method always returns a string as the value.
func ParseIntoFile(s string, dest map[string]interface{}, reader RunesValueReader) error {
        scanner := bytes.NewBufferString(s)
        t := newFileParser(scanner, dest, reader)
        return t.parse()
}

// RunesValueReader is a function that takes the given value (a slice of runes)
// and returns the parsed value
type RunesValueReader func([]rune) (interface{}, error)

// parser is a simple parser that takes a strvals line and parses it into a
// map representation.
//
// where sc is the source of the original data being parsed
// where data is the final parsed data from the parses with correct types
type parser struct {
        sc        *bytes.Buffer
        data      map[string]interface{}
        reader    RunesValueReader
        isjsonval bool
}

func newParser(sc *bytes.Buffer, data map[string]interface{}, stringBool bool) *parser {
        stringConverter := func(rs []rune) (interface{}, error) {
                return typedVal(rs, stringBool), nil
        }
        return &parser{sc: sc, data: data, reader: stringConverter}
}

func newJSONParser(sc *bytes.Buffer, data map[string]interface{}) *parser {
        return &parser{sc: sc, data: data, reader: nil, isjsonval: true}
}

func newFileParser(sc *bytes.Buffer, data map[string]interface{}, reader RunesValueReader) *parser {
        return &parser{sc: sc, data: data, reader: reader}
}

func (t *parser) parse() error {
        for {
                err := t.key(t.data, 0)
                if err == nil {
                        continue
                }
                if err == io.EOF {
                        return nil
                }
                return err
        }
}

func runeSet(r []rune) map[rune]bool {
        s := make(map[rune]bool, len(r))
        for _, rr := range r {
                s[rr] = true
        }
        return s
}

func (t *parser) key(data map[string]interface{}, nestedNameLevel int) (reterr error) {
        defer func() {
                if r := recover(); r != nil {
                        reterr = fmt.Errorf("unable to parse key: %s", r)
                }
        }()
        stop := runeSet([]rune{'=', '[', ',', '.'})
        for {
                switch k, last, err := runesUntil(t.sc, stop); {
                case err != nil:
                        if len(k) == 0 {
                                return err
                        }
                        return errors.Errorf("key %q has no value", string(k))
                        //set(data, string(k), "")
                        //return err
                case last == '[':
                        // We are in a list index context, so we need to set an index.
                        i, err := t.keyIndex()
                        if err != nil {
                                return errors.Wrap(err, "error parsing index")
                        }
                        kk := string(k)
                        // Find or create target list
                        list := []interface{}{}
                        if _, ok := data[kk]; ok {
                                list = data[kk].([]interface{})
                        }

                        // Now we need to get the value after the ].
                        list, err = t.listItem(list, i, nestedNameLevel)
                        set(data, kk, list)
                        return err
                case last == '=':
                        if t.isjsonval {
                                empval, err := t.emptyVal()
                                if err != nil {
                                        return err
                                }
                                if empval {
                                        set(data, string(k), nil)
                                        return nil
                                }
                                // parse jsonvals by using Go’s JSON standard library
                                // Decode is preferred to Unmarshal in order to parse just the json parts of the list key1=jsonval1,key2=jsonval2,...
                                // Since Decode has its own buffer that consumes more characters (from underlying t.sc) than the ones actually decoded,
                                // we invoke Decode on a separate reader built with a copy of what is left in t.sc. After Decode is executed, we
                                // discard in t.sc the chars of the decoded json value (the number of those characters is returned by InputOffset).
                                var jsonval interface{}
                                dec := json.NewDecoder(strings.NewReader(t.sc.String()))
                                if err = dec.Decode(&jsonval); err != nil {
                                        return err
                                }
                                set(data, string(k), jsonval)
                                if _, err = io.CopyN(io.Discard, t.sc, dec.InputOffset()); err != nil {
                                        return err
                                }
                                // skip possible blanks and comma
                                _, err = t.emptyVal()
                                return err
                        }
                        //End of key. Consume =, Get value.
                        // FIXME: Get value list first
                        vl, e := t.valList()
                        switch e {
                        case nil:
                                set(data, string(k), vl)
                                return nil
                        case io.EOF:
                                set(data, string(k), "")
                                return e
                        case ErrNotList:
                                rs, e := t.val()
                                if e != nil && e != io.EOF {
                                        return e
                                }
                                v, e := t.reader(rs)
                                set(data, string(k), v)
                                return e
                        default:
                                return e
                        }
                case last == ',':
                        // No value given. Set the value to empty string. Return error.
                        set(data, string(k), "")
                        return errors.Errorf("key %q has no value (cannot end with ,)", string(k))
                case last == '.':
                        // Check value name is within the maximum nested name level
                        nestedNameLevel++
                        if nestedNameLevel > MaxNestedNameLevel {
                                return fmt.Errorf("value name nested level is greater than maximum supported nested level of %d", MaxNestedNameLevel)
                        }

                        // First, create or find the target map.
                        inner := map[string]interface{}{}
                        if _, ok := data[string(k)]; ok {
                                inner = data[string(k)].(map[string]interface{})
                        }

                        // Recurse
                        e := t.key(inner, nestedNameLevel)
                        if e == nil && len(inner) == 0 {
                                return errors.Errorf("key map %q has no value", string(k))
                        }
                        if len(inner) != 0 {
                                set(data, string(k), inner)
                        }
                        return e
                }
        }
}

func set(data map[string]interface{}, key string, val interface{}) {
        // If key is empty, don't set it.
        if len(key) == 0 {
                return
        }
        data[key] = val
}

func setIndex(list []interface{}, index int, val interface{}) (l2 []interface{}, err error) {
        // There are possible index values that are out of range on a target system
        // causing a panic. This will catch the panic and return an error instead.
        // The value of the index that causes a panic varies from system to system.
        defer func() {
                if r := recover(); r != nil {
                        err = fmt.Errorf("error processing index %d: %s", index, r)
                }
        }()

        if index < 0 {
                return list, fmt.Errorf("negative %d index not allowed", index)
        }
        if index > MaxIndex {
                return list, fmt.Errorf("index of %d is greater than maximum supported index of %d", index, MaxIndex)
        }
        if len(list) <= index {
                newlist := make([]interface{}, index+1)
                copy(newlist, list)
                list = newlist
        }
        list[index] = val
        return list, nil
}

func (t *parser) keyIndex() (int, error) {
        // First, get the key.
        stop := runeSet([]rune{']'})
        v, _, err := runesUntil(t.sc, stop)
        if err != nil {
                return 0, err
        }
        // v should be the index
        return strconv.Atoi(string(v))

}
func (t *parser) listItem(list []interface{}, i, nestedNameLevel int) ([]interface{}, error) {
        if i < 0 {
                return list, fmt.Errorf("negative %d index not allowed", i)
        }
        stop := runeSet([]rune{'[', '.', '='})
        switch k, last, err := runesUntil(t.sc, stop); {
        case len(k) > 0:
                return list, errors.Errorf("unexpected data at end of array index: %q", k)
        case err != nil:
                return list, err
        case last == '=':
                if t.isjsonval {
                        empval, err := t.emptyVal()
                        if err != nil {
                                return list, err
                        }
                        if empval {
                                return setIndex(list, i, nil)
                        }
                        // parse jsonvals by using Go’s JSON standard library
                        // Decode is preferred to Unmarshal in order to parse just the json parts of the list key1=jsonval1,key2=jsonval2,...
                        // Since Decode has its own buffer that consumes more characters (from underlying t.sc) than the ones actually decoded,
                        // we invoke Decode on a separate reader built with a copy of what is left in t.sc. After Decode is executed, we
                        // discard in t.sc the chars of the decoded json value (the number of those characters is returned by InputOffset).
                        var jsonval interface{}
                        dec := json.NewDecoder(strings.NewReader(t.sc.String()))
                        if err = dec.Decode(&jsonval); err != nil {
                                return list, err
                        }
                        if list, err = setIndex(list, i, jsonval); err != nil {
                                return list, err
                        }
                        if _, err = io.CopyN(io.Discard, t.sc, dec.InputOffset()); err != nil {
                                return list, err
                        }
                        // skip possible blanks and comma
                        _, err = t.emptyVal()
                        return list, err
                }
                vl, e := t.valList()
                switch e {
                case nil:
                        return setIndex(list, i, vl)
                case io.EOF:
                        return setIndex(list, i, "")
                case ErrNotList:
                        rs, e := t.val()
                        if e != nil && e != io.EOF {
                                return list, e
                        }
                        v, e := t.reader(rs)
                        if e != nil {
                                return list, e
                        }
                        return setIndex(list, i, v)
                default:
                        return list, e
                }
        case last == '[':
                // now we have a nested list. Read the index and handle.
                nextI, err := t.keyIndex()
                if err != nil {
                        return list, errors.Wrap(err, "error parsing index")
                }
                var crtList []interface{}
                if len(list) > i {
                        // If nested list already exists, take the value of list to next cycle.
                        existed := list[i]
                        if existed != nil {
                                crtList = list[i].([]interface{})
                        }
                }
                // Now we need to get the value after the ].
                list2, err := t.listItem(crtList, nextI, nestedNameLevel)
                if err != nil {
                        return list, err
                }
                return setIndex(list, i, list2)
        case last == '.':
                // We have a nested object. Send to t.key
                inner := map[string]interface{}{}
                if len(list) > i {
                        var ok bool
                        inner, ok = list[i].(map[string]interface{})
                        if !ok {
                                // We have indices out of order. Initialize empty value.
                                list[i] = map[string]interface{}{}
                                inner = list[i].(map[string]interface{})
                        }
                }

                // Recurse
                e := t.key(inner, nestedNameLevel)
                if e != nil {
                        return list, e
                }
                return setIndex(list, i, inner)
        default:
                return nil, errors.Errorf("parse error: unexpected token %v", last)
        }
}

// check for an empty value
// read and consume optional spaces until comma or EOF (empty val) or any other char (not empty val)
// comma and spaces are consumed, while any other char is not cosumed
func (t *parser) emptyVal() (bool, error) {
        for {
                r, _, e := t.sc.ReadRune()
                if e == io.EOF {
                        return true, nil
                }
                if e != nil {
                        return false, e
                }
                if r == ',' {
                        return true, nil
                }
                if !unicode.IsSpace(r) {
                        t.sc.UnreadRune()
                        return false, nil
                }
        }
}

func (t *parser) val() ([]rune, error) {
        stop := runeSet([]rune{','})
        v, _, err := runesUntil(t.sc, stop)
        return v, err
}

func (t *parser) valList() ([]interface{}, error) {
        r, _, e := t.sc.ReadRune()
        if e != nil {
                return []interface{}{}, e
        }

        if r != '{' {
                t.sc.UnreadRune()
                return []interface{}{}, ErrNotList
        }

        list := []interface{}{}
        stop := runeSet([]rune{',', '}'})
        for {
                switch rs, last, err := runesUntil(t.sc, stop); {
                case err != nil:
                        if err == io.EOF {
                                err = errors.New("list must terminate with '}'")
                        }
                        return list, err
                case last == '}':
                        // If this is followed by ',', consume it.
                        if r, _, e := t.sc.ReadRune(); e == nil && r != ',' {
                                t.sc.UnreadRune()
                        }
                        v, e := t.reader(rs)
                        list = append(list, v)
                        return list, e
                case last == ',':
                        v, e := t.reader(rs)
                        if e != nil {
                                return list, e
                        }
                        list = append(list, v)
                }
        }
}

func runesUntil(in io.RuneReader, stop map[rune]bool) ([]rune, rune, error) {
        v := []rune{}
        for {
                switch r, _, e := in.ReadRune(); {
                case e != nil:
                        return v, r, e
                case inMap(r, stop):
                        return v, r, nil
                case r == '\\':
                        next, _, e := in.ReadRune()
                        if e != nil {
                                return v, next, e
                        }
                        v = append(v, next)
                default:
                        v = append(v, r)
                }
        }
}

func inMap(k rune, m map[rune]bool) bool {
        _, ok := m[k]
        return ok
}

func typedVal(v []rune, st bool) interface{} {
        val := string(v)

        if st {
                return val
        }

        if strings.EqualFold(val, "true") {
                return true
        }

        if strings.EqualFold(val, "false") {
                return false
        }

        if strings.EqualFold(val, "null") {
                return nil
        }

        if strings.EqualFold(val, "0") {
                return int64(0)
        }

        // If this value does not start with zero, try parsing it to an int
        if len(val) != 0 && val[0] != '0' {
                if iv, err := strconv.ParseInt(val, 10, 64); err == nil {
                        return iv
                }
        }

        return val
}

// Copyright 2022 ADA Logics Ltd
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

package strvals

func FuzzStrvalsParse(data []byte) {
        _, _ = Parse(string(data))
}

/*
Copyright The Helm Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

// Package time contains a wrapper for time.Time in the standard library and
// associated methods. This package mainly exists to workaround an issue in Go
// where the serializer doesn't omit an empty value for time:
// https://github.com/golang/go/issues/11939. As such, this can be removed if a
// proposal is ever accepted for Go
package time

import (
        "bytes"
        "time"
)

// emptyString contains an empty JSON string value to be used as output
var emptyString = `""`

// Time is a convenience wrapper around stdlib time, but with different
// marshalling and unmarshaling for zero values
type Time struct {
        time.Time
}

// Now returns the current time. It is a convenience wrapper around time.Now()
func Now() Time {
        return Time{time.Now()}
}

func (t Time) MarshalJSON() ([]byte, error) {
        if t.Time.IsZero() {
                return []byte(emptyString), nil
        }

        return t.Time.MarshalJSON()
}

func (t *Time) UnmarshalJSON(b []byte) error {
        if bytes.Equal(b, []byte("null")) {
                return nil
        }
        // If it is empty, we don't have to set anything since time.Time is not a
        // pointer and will be set to the zero value
        if bytes.Equal([]byte(emptyString), b) {
                return nil
        }

        return t.Time.UnmarshalJSON(b)
}

func Parse(layout, value string) (Time, error) {
        t, err := time.Parse(layout, value)
        return Time{Time: t}, err
}
func ParseInLocation(layout, value string, loc *time.Location) (Time, error) {
        t, err := time.ParseInLocation(layout, value, loc)
        return Time{Time: t}, err
}

func Date(year int, month time.Month, day, hour, min, sec, nsec int, loc *time.Location) Time {
        return Time{Time: time.Date(year, month, day, hour, min, sec, nsec, loc)}
}

func Unix(sec int64, nsec int64) Time { return Time{Time: time.Unix(sec, nsec)} }

func (t Time) Add(d time.Duration) Time { return Time{Time: t.Time.Add(d)} }
func (t Time) AddDate(years int, months int, days int) Time {
        return Time{Time: t.Time.AddDate(years, months, days)}
}
func (t Time) After(u Time) bool             { return t.Time.After(u.Time) }
func (t Time) Before(u Time) bool            { return t.Time.Before(u.Time) }
func (t Time) Equal(u Time) bool             { return t.Time.Equal(u.Time) }
func (t Time) In(loc *time.Location) Time    { return Time{Time: t.Time.In(loc)} }
func (t Time) Local() Time                   { return Time{Time: t.Time.Local()} }
func (t Time) Round(d time.Duration) Time    { return Time{Time: t.Time.Round(d)} }
func (t Time) Sub(u Time) time.Duration      { return t.Time.Sub(u.Time) }
func (t Time) Truncate(d time.Duration) Time { return Time{Time: t.Time.Truncate(d)} }
func (t Time) UTC() Time                     { return Time{Time: t.Time.UTC()} }

/*
Copyright The Helm Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package uploader

import (
        "fmt"
        "io"
        "net/url"

        "github.com/pkg/errors"

        "helm.sh/helm/v3/pkg/pusher"
        "helm.sh/helm/v3/pkg/registry"
)

// ChartUploader handles uploading a chart.
type ChartUploader struct {
        // Out is the location to write warning and info messages.
        Out io.Writer
        // Pusher collection for the operation
        Pushers pusher.Providers
        // Options provide parameters to be passed along to the Pusher being initialized.
        Options []pusher.Option
        // RegistryClient is a client for interacting with registries.
        RegistryClient *registry.Client
}

// UploadTo uploads a chart. Depending on the settings, it may also upload a provenance file.
func (c *ChartUploader) UploadTo(ref, remote string) error {
        u, err := url.Parse(remote)
        if err != nil {
                return errors.Errorf("invalid chart URL format: %s", remote)
        }

        if u.Scheme == "" {
                return fmt.Errorf("scheme prefix missing from remote (e.g. \"%s://\")", registry.OCIScheme)
        }

        p, err := c.Pushers.ByScheme(u.Scheme)
        if err != nil {
                return err
        }

        return p.Push(ref, u.String(), c.Options...)
}