//go:build livelab

// This harness live-verifies the DVGA deterministic chains against a running
// DVGA lab. It is build-tagged `livelab` so it never runs in CI (which has no
// lab); it documents exactly how the chains were confirmed and lets anyone
// re-verify after a DVGA image bump.
//
// Run it with the lab up:
//
//	pentestswarm scan --lab --lab-target dvga --list   # (or boot dvga yourself)
//	LAB_DVGA=http://127.0.0.1:5013 go test -tags livelab -run TestDVGAChainsLive \
//	    ./internal/agent/recon/ -v
package recon

import (
	"context"
	"os"
	"testing"

	"github.com/Armur-Ai/Pentest-Swarm-AI/internal/agent/exploit"
	"github.com/Armur-Ai/Pentest-Swarm-AI/internal/scope"
	"github.com/google/uuid"
)

func TestDVGAChainsLive(t *testing.T) {
	base := os.Getenv("LAB_DVGA")
	if base == "" {
		base = "http://127.0.0.1:5013"
	}
	sc := &scope.ScopeDefinition{AllowedCIDRs: []string{"127.0.0.1/32"}, AllowedDomains: []string{"localhost"}}
	ex := exploit.NewExecutor(sc, nil, false)
	for _, path := range dvgaChains(base) {
		results, _, err := ex.ExecuteChainCapturing(context.Background(), path.Steps, uuid.New())
		if err != nil {
			t.Fatalf("%s: executor error: %v", path.Name, err)
		}
		for _, r := range results {
			status := "PASS"
			if !r.Success {
				status = "FAIL"
			}
			t.Logf("[%s] %s\n  cmd: %s\n  out: %.200s", status, path.Name, r.CommandExecuted, r.Output)
			if !r.Success {
				t.Errorf("step did not fire for %q", path.Name)
			}
		}
	}
}