$repositoryRoot = (Resolve-Path (Join-Path $PSScriptRoot '..')).Path
$synchronizerPath = Join-Path $repositoryRoot 'src\SGU.AuthBroker\Services\ActiveDirectorySynchronizer.cs'
$deployPath = Join-Path $repositoryRoot 'scripts\Deploy-AuthBroker.ps1'
$userPolicyPath = Join-Path $repositoryRoot 'scripts\Set-SguDomainUserPolicies.ps1'
$synchronizer = Get-Content -LiteralPath $synchronizerPath -Raw
$deploy = Get-Content -LiteralPath $deployPath -Raw
$userPolicy = Get-Content -LiteralPath $userPolicyPath -Raw

Describe 'SGU Auth Broker password authority' {
    It 'denies the Change Password extended right to SELF and Everyone before SetPassword' {
        $synchronizer | Should Match 'AB721A53-1E2F-11D0-9819-00AA0040529B'
        $synchronizer | Should Match 'WellKnownSidType\.WorldSid'
        $synchronizer | Should Match 'WellKnownSidType\.SelfSid'
        $synchronizer | Should Match 'AccessControlType\.Deny'
        $synchronizer.IndexOf('EnsureCannotChangePassword(user', [StringComparison]::Ordinal) |
            Should BeLessThan $synchronizer.IndexOf('user.Invoke("SetPassword"', [StringComparison]::Ordinal)
    }

    It 'repairs every existing account below Usuarios-SGU during broker deployment' {
        $deploy | Should Match 'Get-ADUser.*-SearchBase \$usersOuDn.*-SearchScope Subtree'
        $deploy | Should Match '(?s)Set-ADAccountControl.*-CannotChangePassword \$true'
    }

    It 'removes Change Password from the Windows security screen for managed users' {
        $userPolicy | Should Match "disableChangePasswordValueName = 'DisableChangePassword'"
        $userPolicy | Should Match '(?s)-ValueName \$disableChangePasswordValueName.*-Type DWord.*-Value 1'
    }
}