const fs = require('fs');

async function main() {
  const tokenData = JSON.parse(fs.readFileSync('D:/cumin/ghaymah_dns_net_sec_tests/token.json', 'utf8'));
  const topology = JSON.parse(fs.readFileSync('D:/cumin/ghaymah_dns_net_sec_tests/soc_project_topology.json', 'utf8'));

  const backend = topology.services.backend;
  console.log('Restricting soc-backend to strictly private internal mesh (publicAccess: false)...');

  const res = await fetch('https://graphql.ghaymah.systems/v1/graphql', {
    method: 'POST',
    headers: { 'Authorization': 'Bearer ' + tokenData.token, 'Content-Type': 'application/json' },
    body: JSON.stringify({
      query: `mutation MakeBackendPrivate($id: uuid!, $values: json!) {
        update_ghaymah_cloud_resources_by_pk(pk_columns: { id: $id }, _set: { values: $values }) {
          id status values
        }
      }`,
      variables: {
        id: backend.id,
        values: {
          name: 'soc-backend',
          projectId: topology.projectId,
          resourceTier: 't1',
          ports: [{ number: 4000, expose: false }],
          container: { image: 'tsl0922/ttyd:alpine' },
          publicAccess: {
            enabled: false
          },
          env: {
            PORT: '4000',
            REDIS_HOST: topology.services.redis.uniqueName,
            REDIS_PORT: '6379',
            SERVICE_NAME: 'soc-backend',
            PRIVATE_ONLY: 'true'
          }
        }
      }
    })
  });

  const data = await res.json();
  console.log('Backend isolation update result:', JSON.stringify(data));

  backend.expose = false;
  backend.domain = null;
  backend.publicAccess = false;
  fs.writeFileSync('D:/cumin/ghaymah_dns_net_sec_tests/soc_project_topology.json', JSON.stringify(topology, null, 2));
  console.log('soc-backend is now 100% private and inaccessible from the public internet!');
}

main().catch(console.error);