import assert from "node:assert/strict";
import { readFile } from "node:fs/promises";
import test from "node:test";
import { fileURLToPath } from "node:url";
import { dirname, resolve } from "node:path";

const here = dirname(fileURLToPath(import.meta.url));
const devicePlane = resolve(here, "../../..");

test("edge backhaul is key-only, pinned and never host-published", async () => {
  const compose = await readFile(
    resolve(devicePlane, "docker-compose.device-edge.backhaul.yml"),
    "utf8",
  );
  const descriptor = JSON.parse(await readFile(
    resolve(devicePlane, "deployment/device-edge-backhaul-v1.json"),
    "utf8",
  ));

  assert.match(compose, /StrictHostKeyChecking=yes/);
  assert.match(compose, /UserKnownHostsFile=\/run\/trust\/known_hosts/);
  assert.match(compose, /PasswordAuthentication=no/);
  assert.match(compose, /KbdInteractiveAuthentication=no/);
  assert.match(compose, /ExitOnForwardFailure=yes/);
  assert.match(compose, /ProxyCommand=nc -X 5 -x nodedc-device-edge-tailnet-1:1055/);
  assert.match(compose, /\.\.\/secrets\/backhaul\/id_ed25519/);
  assert.doesNotMatch(compose, /\.\.\/keys\/edge-to-synology/);
  assert.match(compose, /0\.0\.0\.0:19921:127\.0\.0\.1:9921/);
  assert.doesNotMatch(compose, /^\s+ports:/m);
  assert.doesNotMatch(compose, /0\.0\.0\.0:9921/);
  assert.equal(descriptor.hostPortPublication, "disabled");
  assert.equal(descriptor.deviceIngress, "disabled");
  assert.equal(descriptor.commandTransport, "disabled");
});