$repositoryRoot = (Resolve-Path (Join-Path $PSScriptRoot '..')).Path
$serverBootstrapPath = Join-Path $repositoryRoot 'scripts\Initialize-SguDomainController.ps1'
$clientBootstrapPath = Join-Path $repositoryRoot 'scripts\Invoke-SguClientBootstrap.ps1'
$azureClientPath = Join-Path $repositoryRoot 'scripts\Install-SguAzureP2sClient.ps1'
$bicepPath = Join-Path $repositoryRoot 'infra\azure\main.bicep'

$tokens = $null
$parseErrors = $null
$serverAst = [Management.Automation.Language.Parser]::ParseFile(
    $serverBootstrapPath,
    [ref]$tokens,
    [ref]$parseErrors)
if ($parseErrors.Count -gt 0) {
    throw ($parseErrors -join [Environment]::NewLine)
}
$networkFunctionNames = @(
    'Test-PrivateIPv4Address',
    'ConvertTo-NetworkCidr',
    'ConvertTo-PrivateNetworkCidr'
)
$networkFunctions = $serverAst.FindAll({
        param($node)
        $node -is [Management.Automation.Language.FunctionDefinitionAst] -and
            $networkFunctionNames -contains $node.Name
    }, $true)
Invoke-Expression (($networkFunctions | ForEach-Object { $_.Extent.Text }) -join [Environment]::NewLine)

Describe 'SGU public-cloud network safety' {
    It 'canonicalizes a host address to its IPv4 network' {
        ConvertTo-NetworkCidr -Address ([ipaddress]'10.77.0.4') `
            -NetworkPrefixLength 24 | Should Be '10.77.0.0/24'
    }

    It 'canonicalizes the trusted P2S pool' {
        ConvertTo-PrivateNetworkCidr -Cidr '172.30.4.19/16' |
            Should Be '172.30.0.0/16'
    }

    It 'rejects a public trusted-client CIDR' {
        $wasRejected = $false
        try {
            ConvertTo-PrivateNetworkCidr -Cidr '8.8.8.0/24' | Out-Null
        }
        catch {
            $wasRejected = $true
        }
        $wasRejected | Should Be $true
    }

    It 'exposes explicit Azure modes on both bootstraps' {
        ((Get-Command $serverBootstrapPath).Parameters.Keys -contains
            'NetworkConfigurationMode') | Should Be $true
        ((Get-Command $serverBootstrapPath).Parameters.Keys -contains
            'TrustedClientNetworks') | Should Be $true
        ((Get-Command $clientBootstrapPath).Parameters.Keys -contains
            'ConnectivityMode') | Should Be $true
        ((Get-Command $clientBootstrapPath).Parameters.Keys -contains
            'VpnProfilePackagePath') | Should Be $true
    }

    It 'uses an all-user machine-certificate VPN profile' {
        $source = Get-Content -LiteralPath $azureClientPath -Raw
        $source | Should Match '-AuthenticationMethod MachineCertificate'
        $source | Should Match '-AllUserConnection'
        $source | Should Match 'Add-DnsClientNrptRule'
    }

    It 'limits optional public administration to RDP' {
        $template = Get-Content -LiteralPath $bicepPath -Raw
        $template | Should Match "name: 'Allow-RDP-from-administrator'"
        $template | Should Match "destinationPortRange: '3389'"
        $template | Should Not Match "sourceAddressPrefix: '0\.0\.0\.0/0'"
    }
}