//go:build livelab

// Live-verifies the NodeGoat deterministic chains against a running, SEEDED
// NodeGoat lab (build-tagged `livelab`, never runs in CI). The lab must have
// its DB reset (users 1–3 present) — the one-command lab does this on boot.
//
//	LAB_NODEGOAT=http://127.0.0.1:4000 go test -tags livelab \
//	    -run TestNodeGoatChainsLive ./internal/agent/recon/ -v
package recon

import (
	"context"
	"os"
	"testing"

	"github.com/Armur-Ai/Pentest-Swarm-AI/internal/agent/exploit"
	"github.com/Armur-Ai/Pentest-Swarm-AI/internal/scope"
	"github.com/google/uuid"
)

func TestNodeGoatChainsLive(t *testing.T) {
	base := os.Getenv("LAB_NODEGOAT")
	if base == "" {
		base = "http://127.0.0.1:4000"
	}
	sc := &scope.ScopeDefinition{AllowedCIDRs: []string{"127.0.0.1/32"}, AllowedDomains: []string{"localhost"}}
	ex := exploit.NewExecutor(sc, nil, false)
	for _, path := range nodegoatChains(base) {
		results, _, err := ex.ExecuteChainCapturing(context.Background(), path.Steps, uuid.New())
		if err != nil {
			t.Fatalf("%s: executor error: %v", path.Name, err)
		}
		for _, r := range results {
			status := "PASS"
			if !r.Success {
				status = "FAIL"
			}
			t.Logf("[%s] %s\n  cmd: %s\n  out: %.200s", status, path.Name, r.CommandExecuted, r.Output)
			if !r.Success {
				t.Errorf("step did not fire for %q", path.Name)
			}
		}
	}
}