import assert from 'node:assert/strict';
import test from 'node:test';
import { setGatewayInterception } from '../../dist/server/gatewayRouting.js';

test('gateway switches only the TProxy PREROUTING jump', () => {
  const calls = [];
  const missing = (command, args) => {
    calls.push([command, args]);
    return { status: args.includes('-C') ? 1 : 0, stderr: '' };
  };

  setGatewayInterception(true, 'VPN_PROXY_TPROXY', missing);
  assert.deepEqual(calls.map(([, args]) => args), [
    ['-w', '-t', 'mangle', '-C', 'PREROUTING', '-j', 'VPN_PROXY_TPROXY'],
    ['-w', '-t', 'mangle', '-I', 'PREROUTING', '1', '-j', 'VPN_PROXY_TPROXY'],
  ]);

  calls.length = 0;
  const existing = (command, args, commandOptions) => {
    calls.push([command, args, commandOptions]);
    return { status: 0, stderr: '' };
  };
  setGatewayInterception(false, 'VPN_PROXY_TPROXY', existing);
  assert.deepEqual(calls.map(([, args]) => args), [
    ['-w', '-t', 'mangle', '-C', 'PREROUTING', '-j', 'VPN_PROXY_TPROXY'],
    ['-w', '-t', 'mangle', '-D', 'PREROUTING', '-j', 'VPN_PROXY_TPROXY'],
  ]);

  calls.length = 0;
  setGatewayInterception(true, 'VPN_PROXY_TPROXY', existing);
  assert.deepEqual(calls.map(([command, args]) => [command, args]), [
    ['iptables', ['-w', '-t', 'mangle', '-C', 'PREROUTING', '-j', 'VPN_PROXY_TPROXY']],
    ['iptables-restore', ['-w', '--noflush']],
  ]);
  assert.match(calls[1][2].input, /-D PREROUTING -j VPN_PROXY_TPROXY\n-I PREROUTING 1 -j VPN_PROXY_TPROXY/);

  assert.doesNotThrow(() => setGatewayInterception(true, 'VPN_PROXY_TPROXY', (_command, args) => ({
    status: args.includes('-C') ? 0 : 1,
    stderr: args.includes('-C') ? '' : 'atomic reorder failed',
  })));

  assert.throws(
    () => setGatewayInterception(true, 'VPN_PROXY_TPROXY\nCOMMIT', () => assert.fail('iptables must not run')),
    /Некорректная TProxy chain/,
  );
});