'use strict';
const assert=require('assert/strict');
const fs=require('fs');
const os=require('os');
const path=require('path');
const {spawnSync}=require('child_process');

if(process.platform!=='win32'){
  console.log('Windows host-hardening smoke test skipped on this platform');
  process.exit(0);
}

const root=fs.mkdtempSync(path.join(os.tmpdir(),'linkfield-host-hardening-'));
try{
  const apacheRoot=path.join(root,'Apache24'),apacheConfig=path.join(apacheRoot,'conf','httpd.conf'),phpIni=path.join(root,'php.ini');
  fs.mkdirSync(path.dirname(apacheConfig),{recursive:true});
  fs.writeFileSync(apacheConfig,'Listen 80\nServerSignature On\n');
  fs.writeFileSync(phpIni,'expose_php = On\n');
  const script=path.join(__dirname,'..','scripts','harden-windows-host.ps1');
  const args=['-NoProfile','-NonInteractive','-ExecutionPolicy','Bypass','-File',script,'-ApacheConfig',apacheConfig,'-PhpIni',phpIni,'-Apply','-SkipApacheSyntaxCheck'];
  const first=spawnSync('powershell.exe',args,{encoding:'utf8'});assert.equal(first.status,0,first.stderr||first.stdout);
  const apache=fs.readFileSync(apacheConfig,'utf8'),php=fs.readFileSync(phpIni,'utf8');
  assert.match(apache,/BEGIN LINKFIELD HOST HARDENING[\s\S]*ServerTokens Prod[\s\S]*ServerSignature Off/);
  assert.match(php,/BEGIN LINKFIELD HOST HARDENING[\s\S]*expose_php = Off/);
  assert.equal((apache.match(/BEGIN LINKFIELD HOST HARDENING/g)||[]).length,1);
  assert.equal((php.match(/BEGIN LINKFIELD HOST HARDENING/g)||[]).length,1);
  assert(fs.readdirSync(path.dirname(apacheConfig)).some(name=>name.startsWith('httpd.conf.linkfield-backup-')));
  assert(fs.readdirSync(root).some(name=>name.startsWith('php.ini.linkfield-backup-')));
  const second=spawnSync('powershell.exe',args,{encoding:'utf8'});assert.equal(second.status,0,second.stderr||second.stdout);
  assert.equal((fs.readFileSync(apacheConfig,'utf8').match(/BEGIN LINKFIELD HOST HARDENING/g)||[]).length,1);
  assert.equal((fs.readFileSync(phpIni,'utf8').match(/BEGIN LINKFIELD HOST HARDENING/g)||[]).length,1);
}finally{fs.rmSync(root,{recursive:true,force:true})}
console.log('Windows Apache/PHP host hardening smoke test passed');