"use strict";

const assert = require("node:assert/strict");
const test = require("node:test");
const {
  execute,
  RESTORE_OWNER_PASSWORD_LOGIN,
  RESTORE_CODE_CHANNEL_OWNER_LOGIN,
} = require("./owner-access-broker");

test("owner-access executor keeps SSH and code-channel recovery distinct", async () => {
  assert.match(RESTORE_OWNER_PASSWORD_LOGIN, /PasswordAuthentication yes/);
  assert.match(RESTORE_OWNER_PASSWORD_LOGIN, /sshd -t/);
  assert.match(RESTORE_OWNER_PASSWORD_LOGIN, /systemctl reload ssh/);
  assert.doesNotMatch(RESTORE_OWNER_PASSWORD_LOGIN, /PermitRootLogin yes/);
  assert.match(RESTORE_CODE_CHANNEL_OWNER_LOGIN, /legacy owner credential unavailable/);
  assert.match(RESTORE_CODE_CHANNEL_OWNER_LOGIN, /pragma wal_checkpoint\(truncate\)/);
  assert.match(RESTORE_CODE_CHANNEL_OWNER_LOGIN, /channel\.backup\(snapshot\)/);
  assert.match(RESTORE_CODE_CHANNEL_OWNER_LOGIN, /prohibit_login=0/);
  assert.match(RESTORE_CODE_CHANNEL_OWNER_LOGIN, /hlcc-jd-candidate\.service/);
  assert.doesNotMatch(RESTORE_CODE_CHANNEL_OWNER_LOGIN, /PasswordAuthentication/);
  assert.match(require("node:fs").readFileSync(require.resolve("./owner-access-broker"), "utf8"), /150000/);
  assert.deepEqual(await execute({ target: "JD-FD-PRIMARY", action: "unknown" }), { ok: false, error: "action_not_registered" });
  assert.deepEqual(await execute({ target: "JD-FD-PRIMARY", action: "restore-owner-password-login", cmd: "id" }), { ok: false, error: "arbitrary_command_forbidden" });
  assert.deepEqual(await execute({ target: "JD-FD-PRIMARY", action: "restore-code-channel-owner-login", shell: "id" }), { ok: false, error: "arbitrary_command_forbidden" });
});