"use strict";

const test = require("node:test");
const assert = require("node:assert/strict");
const fs = require("node:fs");
const path = require("node:path");

const source = fs.readFileSync(
  path.join(__dirname, "install-architecture-provisioner.sh"),
  "utf8",
);

test("bootstrap installer preserves secrets and deploys the complete HoloLake capability set", () => {
  for (const file of [
    "server.js",
    "guanghu-router.js",
    "repo-push-broker.js",
    "hololake-session.js",
    "hololake-capabilities.js",
  ]) {
    assert.match(source, new RegExp(`\\b${file.replaceAll(".", "\\.")}\\b`));
  }
  assert.match(source, /HOLOLAKE_SESSION_PEPPER/);
  assert.match(source, /openssl rand -hex 32/);
  assert.match(source, /manual-backups\/lake-lamp-authz-/);
  assert.match(source, /rollback\(\)/);
  assert.match(source, /command -v setfacl/);
  assert.match(source, /setfacl is required for private knowledge repository access/);
  assert.match(source, /setfacl -R -m u:guanghu-authz:rX/);
  assert.doesNotMatch(source, /cat ["']?\$authorization_env/);
  assert.doesNotMatch(source, /set -x/);
});

test("provider migration writes only a private registry and never prints API keys", () => {
  assert.match(source, /DEEPSEEK_API_KEY/);
  assert.match(source, /OPENAI_API_KEY/);
  assert.match(source, /DASHSCOPE_API_KEY/);
  assert.match(source, /chmod 0640 "\$provider_registry"/);
  assert.match(source, /chown root:guanghu-authz "\$provider_registry"/);
  assert.doesNotMatch(source, /echo .*API_KEY/);
  assert.doesNotMatch(source, /printf .*API_KEY/);
});