import assert from "node:assert/strict"
import { pool } from "../../db/index.js"
import { MikrotikClient } from "../../services/mikrotik.js"
import { executeRosStep } from "./resources.js"
import { McpError } from "./security.js"

// Retired generic steps may exist in old sealed inverse plans. Refuse them
// before even resolving a device, instead of relying only on a UI/tool alias.
const query = pool.query, fromServer = MikrotikClient.fromServer
let attempts = 0
pool.query = (() => { attempts++; throw Error("unexpected SQL") }) as typeof pool.query
MikrotikClient.fromServer = (() => { attempts++; throw Error("unexpected native client") }) as typeof MikrotikClient.fromServer
try {
  for (const resource of ["certificate", "ipsec_peer"]) for (const action of ["create", "update", "delete"] as const) {
    await assert.rejects(executeRosStep({ serverId: 1, resource, action, ...(action === "create" ? {} : { id: "*a" }), fields: {} }), error => error instanceof McpError && error.code === "UNSUPPORTED_CAPABILITY")
  }
  assert.equal(attempts, 0)
} finally { pool.query = query; MikrotikClient.fromServer = fromServer }
console.log("Retired generic IPsec writes and inverses refuse before SQL/native access; full private service proofs are mandatory")