//go:build windows

package deploy

import (
	"errors"
	"strings"
	"testing"
)

func TestDisableDefenderRealtimeSuccess(t *testing.T) {
	SetHiddenCombinedOutputFn(func(name string, arg ...string) ([]byte, error) {
		if name != "powershell" {
			t.Fatalf("expected powershell, got %q", name)
		}
		joined := strings.Join(arg, " ")
		if !strings.Contains(joined, "DisableRealtimeMonitoring") {
			t.Fatalf("missing DisableRealtimeMonitoring in %q", joined)
		}
		return []byte(""), nil
	})
	defer SetHiddenCombinedOutputFn(nil)

	msg, err := DisableDefenderRealtime()
	if err != nil {
		t.Fatalf("unexpected error: %v msg=%q", err, msg)
	}
	if !strings.Contains(msg, "real-time monitoring disabled") {
		t.Fatalf("expected success message, got %q", msg)
	}
}

func TestDisableDefenderRealtimeAdminRequiredError(t *testing.T) {
	SetHiddenCombinedOutputFn(func(name string, arg ...string) ([]byte, error) {
		return []byte("access denied"), errors.New("exit status 1")
	})
	defer SetHiddenCombinedOutputFn(nil)

	msg, err := DisableDefenderRealtime()
	if err == nil {
		t.Fatalf("expected error, got msg=%q", msg)
	}
	if !strings.Contains(err.Error(), "defender disable failed") {
		t.Fatalf("unexpected error: %v", err)
	}
	if !strings.Contains(err.Error(), "admin required") {
		t.Fatalf("expected admin hint in error: %v", err)
	}
	if !strings.Contains(msg, "access denied") {
		t.Fatalf("expected stderr in message, got %q", msg)
	}
}