// Withholding node-login-shell's `execute` on one machine (novox/hq ADR 0268). It runs any command as the
// operator account, which can become root without a person, so the operator withholds it on the
// control-node until a call to it needs a person's approval. The machine's choice is the module's
// setting `execute`, written by the mesh into a root-owned file the tools bundle reads at start; the
// bundle then registers the verb or not, so the machine's runtime does not offer it at all.
import { test } from "node:test";
import assert from "node:assert/strict";
import { mkdtempSync, writeFileSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { executeServed, readExecuteSetting, TOOLS_CONF_WORD } from "../shell.ts";

test("execute is served only when the machine's setting says serve", () => {
  assert.equal(executeServed("execute=serve\n").served, true);
  assert.equal(executeServed("# the mesh's\nexecute = serve \n").served, true);
  const withheld = executeServed("execute=withhold\n");
  assert.equal(withheld.served, false);
  assert.match(withheld.why, /withhold/);
});

test("anything but serve withholds it: a wrong value, no line, no file", () => {
  for (const text of ["execute=yes\n", "execute=\n", "", "other=serve\n", "execute=serve-ish\n"]) {
    const got = executeServed(text);
    assert.equal(got.served, false, JSON.stringify(text));
    assert.ok(got.why.length > 0, "it says why");
  }
  const none = executeServed(undefined);
  assert.equal(none.served, false);
  assert.match(none.why, /no setting/);
});

test("the setting is read from the file the bundle's word names", () => {
  const dir = mkdtempSync(join(tmpdir(), "zsh-tools-"));
  const file = join(dir, "tools.conf");
  writeFileSync(file, "execute=serve\n");
  assert.equal(readExecuteSetting({ [TOOLS_CONF_WORD]: file }).served, true);
  writeFileSync(file, "execute=withhold\n");
  assert.equal(readExecuteSetting({ [TOOLS_CONF_WORD]: file }).served, false);
  const missing = readExecuteSetting({ [TOOLS_CONF_WORD]: join(dir, "absent.conf") });
  assert.equal(missing.served, false);
  assert.match(missing.why, /cannot read/);
  const unnamed = readExecuteSetting({});
  assert.equal(unnamed.served, false);
  assert.match(unnamed.why, new RegExp(TOOLS_CONF_WORD));
});