import ./make-test-python.nix (
  { pkgs, ... }:
  {
    name = "usbguard";
    meta = with pkgs.lib.maintainers; {
      maintainers = [ tnias ];
    };

    nodes.machine =
      { ... }:
      {
        services.usbguard = {
          enable = true;
          IPCAllowedUsers = [
            "alice"
            "root"
          ];

          # As virtual USB devices get attached to the "QEMU USB Hub" we need to
          # allow Hubs. Otherwise we would have to explicitly allow them too.
          rules = ''
            allow with-interface equals { 09:00:00 }
          '';
        };
        imports = [ ./common/user-account.nix ];
      };

    testScript = ''
      # create a blank disk image for our fake USB stick
      with open(machine.state_dir / "usbstick.img", "wb") as stick:
          stick.write(b"\x00" * (1024 * 1024))

      # wait for machine to have started and the usbguard service to be up
      machine.wait_for_unit("usbguard.service")

      with subtest("IPC access control"):
          # User "alice" is allowed to access the IPC interface
          machine.succeed("su alice -c 'usbguard list-devices'")

          # User "bob" is not allowed to access the IPC interface
          machine.fail("su bob -c 'usbguard list-devices'")

      with subtest("check basic functionality"):
          # at this point we expect that no USB HDD is connected
          machine.fail("usbguard list-devices | grep -E 'QEMU USB HARDDRIVE'")

          # insert usb device
          machine.send_monitor_command(
              f"drive_add 0 id=stick,if=none,file={stick.name},format=raw"
          )
          machine.send_monitor_command("device_add usb-storage,id=stick,drive=stick")

          # the attached USB HDD should show up after a short while
          machine.wait_until_succeeds("usbguard list-devices | grep -E 'QEMU USB HARDDRIVE'")

          # at this point there should be a **blocked** USB HDD
          machine.succeed("usbguard list-devices | grep -E 'block.*QEMU USB HARDDRIVE'")
          machine.fail("usbguard list-devices | grep -E ' allow .*QEMU USB HARDDRIVE'")

          # allow storage devices
          machine.succeed("usbguard allow-device 'with-interface { 08:*:* }'")

          # at this point there should be an **allowed** USB HDD
          machine.succeed("usbguard list-devices | grep -E ' allow .*QEMU USB HARDDRIVE'")
          machine.fail("usbguard list-devices | grep -E ' block .*QEMU USB HARDDRIVE'")
    '';
  }
)
