"use strict";

const test = require("node:test");
const assert = require("node:assert/strict");
const fs = require("node:fs");
const path = require("node:path");

const script = fs.readFileSync(path.join(__dirname, "..", "enroll-bs-sg-001-from-console.sh"), "utf8");

test("BS-SG-001 enrollment is fixed to one node, source and public key", () => {
  assert.match(script, /NODE_ID=BS-SG-001/);
  assert.match(script, /EXPECTED_HOSTNAME=guanghu-lang-sg-001/);
  assert.match(script, /JD_SOURCE_CIDR=111\.228\.0\.139\/32/);
  assert.match(script, /jd_ops_to_bs_sg_001/);
  assert.match(script, /no-port-forwarding/);
  assert.match(script, /no-agent-forwarding/);
  assert.doesNotMatch(script, /eval|bash\s+-c|\$\{cmd\}/);
});

test("enrollment validates Gatekeeper identity and provides a narrow rollback", () => {
  assert.match(script, /127\.0\.0\.1:3911\/status/);
  assert.match(script, /Gatekeeper identity mismatch/);
  assert.match(script, /--rollback/);
  assert.match(script, /grep -vF/);
  assert.match(script, /other authorized keys were preserved/);
});