import { readFileSync } from 'node:fs';
import { resolve } from 'node:path';

const root = resolve(import.meta.dirname, '..', '..');
const read = (relativePath) => readFileSync(resolve(root, relativePath), 'utf8');
const installer = read('tools/security/install-security-agent.sh');
const service = read('deploy/security/cmpp-security-agent.service');
const action = read('deploy/security/cmpp-report-only.conf');
const placeholder = '@CMPP_SECURITY_AGENT_BIN@';

for (const [label, source] of [['systemd service', service], ['Fail2ban action', action]]) {
  if (!source.includes(placeholder)) throw new Error(`${label} is missing the security-agent executable placeholder`);
  if (source.includes('/opt/cmpp-platform/current/bin/cmpp-security-agent')) {
    throw new Error(`${label} still references the removed current/bin deployment layout`);
  }
}

if (!installer.includes('agent_binary="$APP_DIR/dist/cmpp-security-agent"')) {
  throw new Error('installer does not bind the security agent to the built dist executable');
}
for (const target of ['cmpp-security-agent.service', 'cmpp-report-only.conf']) {
  if (!installer.includes(`sed "s#${placeholder}#$agent_binary#g"`) || !installer.includes(target)) {
    throw new Error(`installer does not render ${target} with the built security-agent executable`);
  }
}
if (!installer.includes("grep -Rqs '@CMPP_SECURITY_AGENT_BIN@'")) {
  throw new Error('installer does not fail closed when an executable placeholder remains');
}

console.log('Security deployment verified: systemd and Fail2ban use the built dist security-agent executable.');