"use strict";

const assert = require("node:assert/strict");
const test = require("node:test");
const { execute, RESTORE_OWNER_PASSWORD_LOGIN } = require("./owner-access-broker");

test("owner-access executor exposes one bounded recovery action", async () => {
  assert.match(RESTORE_OWNER_PASSWORD_LOGIN, /PasswordAuthentication yes/);
  assert.match(RESTORE_OWNER_PASSWORD_LOGIN, /sshd -t/);
  assert.match(RESTORE_OWNER_PASSWORD_LOGIN, /systemctl reload ssh/);
  assert.doesNotMatch(RESTORE_OWNER_PASSWORD_LOGIN, /PermitRootLogin yes/);
  assert.deepEqual(await execute({ target: "JD-FD-PRIMARY", action: "unknown" }), { ok: false, error: "action_not_registered" });
  assert.deepEqual(await execute({ target: "JD-FD-PRIMARY", action: "restore-owner-password-login", cmd: "id" }), { ok: false, error: "arbitrary_command_forbidden" });
});