// 🤖 Hermetic run of deploy/hardening-posture.sh — the box-side hardening
// collector — through its documented fixture seams. This exists because the
// collector shipped fixture-checked but never run, and its first FOUR real-box
// encounters failed (lost merge #1155, ReadWritePaths namespacing #1159,
// AF_NETLINK #1171, IAM prefix scope #1176): the parsing was always right and
// the plumbing always wrong. This test at least pins the whole script path —
// enumerate → probe/merge → sort → output JSON — end to end in one process.
// Requires bash + jq (same toolchain the status-contract fixtures assume).
// node test/hardening-posture.test.mjs
import assert from "node:assert/strict";
import { execFileSync } from "node:child_process";
import { mkdtempSync, mkdirSync, writeFileSync, readFileSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";

let failures = 0;
function test(name, fn) {
  try {
    fn();
    console.log("PASS  " + name);
  } catch (e) {
    console.log("FAIL  " + name + "  —  " + (e && e.message));
    failures++;
  }
}

const script = new URL("../deploy/hardening-posture.sh", import.meta.url).pathname;

// Run the collector against fixtures; return the parsed hardening.json.
// members: TSV rows; posture: {label: rowObject} self-reports peers published.
// The default ufw fixture proves "wireguard-only": active, a 22-on-wg0 allow,
// and NO bare public 22 — the shape firewall_ssh_scope requires for a hardened
// (false) self verdict rather than the loud unknown.
const UFW_HARDENED = [
  "Status: active",
  "",
  "To                         Action      From",
  "--                         ------      ----",
  "80,443/tcp                 ALLOW       Anywhere",
  "22/tcp on wg0              ALLOW       Anywhere",
  "51820/udp                  ALLOW       Anywhere",
].join("\n");

function collect({ members, posture = {}, ufw = UFW_HARDENED }) {
  const dir = mkdtempSync(join(tmpdir(), "hardening-test-"));
  const state = join(dir, "state"), pages = join(dir, "pages"), postures = join(dir, "posture");
  mkdirSync(state); mkdirSync(pages); mkdirSync(postures);
  writeFileSync(join(dir, "members.tsv"), members);
  writeFileSync(join(dir, "router.env"),
    "LCHAT_MESH_SELF=https://self.example\nLCHAT_BOX_REGION=EU · Finland\n");
  writeFileSync(join(dir, "ufw.txt"), ufw + "\n");
  writeFileSync(join(dir, "sshd.txt"), "permitrootlogin no\npasswordauthentication no\n");
  writeFileSync(join(dir, "au.txt"), "active\n");
  writeFileSync(join(dir, "wg0.txt"), "42: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP>\n");
  for (const [label, row] of Object.entries(posture)) {
    writeFileSync(join(postures, label + ".json"), JSON.stringify(row));
  }
  execFileSync("bash", [script], {
    env: {
      ...process.env,
      HARDENING_UFW_CMD: `cat ${join(dir, "ufw.txt")}`,
      HARDENING_SSHD_CMD: `cat ${join(dir, "sshd.txt")}`,
      HARDENING_SYSTEMCTL_CMD: `cat ${join(dir, "au.txt")}`,
      HARDENING_IP_CMD: `cat ${join(dir, "wg0.txt")}`,
      HARDENING_ROUTER_ENV: join(dir, "router.env"),
      HARDENING_MEMBERS_FILE: join(dir, "members.tsv"),
      HARDENING_POSTURE_DIR: postures,
      HARDENING_STATE_DIR: state,
      HARDENING_PAGES_DIR: pages,
      HARDENING_NO_UPLOAD: "1",
    },
  });
  return JSON.parse(readFileSync(join(pages, "hardening.json"), "utf8"));
}

const SELF_ROW = "https://self.example\t\t\t\n";
const kepler = (probe) => `https://198.51.100.7\tkepler-conducting\tUK · London\t${probe}\n`;

test("probe-only peer renders unknowns, sorted by exposure", () => {
  const out = collect({ members: SELF_ROW + kepler("serving-ssh") });
  assert.equal(out.boxes.length, 2);
  const [first, second] = out.boxes;
  assert.equal(first.label, "kepler-conducting");            // exposed sorts first
  assert.equal(first.ssh_internet_facing, true);
  assert.equal(first.source, "probe");
  assert.equal(first.root_login, "unknown");
  assert.equal(second.is_self, true);
  assert.equal(second.ssh_internet_facing, false);           // wg up + no public 22 in ufw
  assert.equal(second.firewall_active, true);
});

test("fresh peer self-report replaces the probe row's unknowns", () => {
  const out = collect({
    members: SELF_ROW + kepler("not-reachable"),
    posture: {
      "kepler-conducting": {
        label: "kepler-conducting", is_self: true, source: "local",
        ssh_internet_facing: false, detail: "wireguard-only",
        root_login: "no", password_auth: "no", auto_updates: "active",
        wireguard: "up", firewall_active: true, region: "UK · London",
        generated: new Date().toISOString().replace(/\.\d+Z$/, "Z"),
      },
    },
  });
  const peer = out.boxes.find((b) => b.label === "kepler-conducting");
  assert.equal(peer.source, "self-reported");
  assert.equal(peer.is_self, false);                         // reader's perspective wins
  assert.equal(peer.root_login, "no");
  assert.equal(peer.wireguard, "up");
  assert.equal(peer.firewall_active, true);
  assert.equal(peer.ssh_internet_facing, false);
  assert.equal(peer.generated, undefined);                   // stamp stays in posture/, not the page
});

test("an outside SSH banner vetoes a self-report claiming closed", () => {
  const out = collect({
    members: SELF_ROW + kepler("serving-ssh"),
    posture: {
      "kepler-conducting": {
        label: "kepler-conducting", is_self: true, source: "local",
        ssh_internet_facing: false, detail: "wireguard-only",
        root_login: "no", password_auth: "no", auto_updates: "active",
        wireguard: "up", firewall_active: true,
        generated: new Date().toISOString().replace(/\.\d+Z$/, "Z"),
      },
    },
  });
  const peer = out.boxes.find((b) => b.label === "kepler-conducting");
  assert.equal(peer.source, "self-reported");
  assert.equal(peer.ssh_internet_facing, true);              // the banner we saw wins
  assert.match(peer.detail, /serving SSH/);
  assert.equal(peer.root_login, "no");                       // the rest stays self-reported
  assert.equal(out.boxes[0].label, "kepler-conducting");     // and it still sorts as exposed
});

process.exit(failures ? 1 : 0);