From 13ea2d7d3ea83fde9e1747037733b2cba3dbf10d Mon Sep 17 00:00:00 2001
From: Frank <frank@dankware>
Date: Sun, 23 Aug 2026 12:32:18 -0700
Subject: [PATCH] Homepage (TDD slice 5): the Caddyfile auth split

Red tests first.
- tests/homepage_caddy.bats: the homepage site block carries a root hash and
  a distinct /admin/-scoped admin hash (Q18/Q38), and serves /srv/homepage.
- dankclaw/Caddyfile: the homepage block now uses named matchers -
  @user (not /admin/*) with the shared hash, @admin (/admin/*) with the
  operator-only hash (REPLACE_WITH_ADMIN_HASH, rendered from CADDY_ADMIN_HASH
  at deploy). Both placeholders are distinct.
---
 dankclaw/Caddyfile        |  7 ++++++-
 tests/homepage_caddy.bats | 26 ++++++++++++++++++++++++++
 2 files changed, 32 insertions(+), 1 deletion(-)
 create mode 100644 tests/homepage_caddy.bats

diff --git a/dankclaw/Caddyfile b/dankclaw/Caddyfile
index 44db366..fc6ca9c 100644
--- a/dankclaw/Caddyfile
+++ b/dankclaw/Caddyfile
@@ -46,9 +46,14 @@
 
 # --- Homepage (password protected) ---
 dankclaw.franksdank.cloud {
-	basicauth {
+	@admin path /admin/*
+	@user not path /admin/*
+	basicauth @user {
 		dank REPLACE_WITH_HASH
 	}
+	basicauth @admin {
+		frank REPLACE_WITH_ADMIN_HASH
+	}
 	root * /srv/homepage
 	file_server
 }
diff --git a/tests/homepage_caddy.bats b/tests/homepage_caddy.bats
new file mode 100644
index 0000000..fb39d1f
--- /dev/null
+++ b/tests/homepage_caddy.bats
@@ -0,0 +1,26 @@
+#!/usr/bin/env bats
+# Seam: the homepage site block in dankclaw/Caddyfile. It must carry a root
+# basicauth hash and a distinct /admin/-scoped admin hash (Q18/Q19), and serve
+# /srv/homepage. caddy is not on the dev box, so the tests assert the
+# structure statically; the deploy renders the two real hashes from the .env.
+
+load helpers
+
+setup() {
+    CADDY="$REPO_ROOT/dankclaw/Caddyfile"
+}
+
+@test "the homepage has a root hash and a distinct admin hash (Q18/Q38)" {
+    grep -q "REPLACE_WITH_HASH" "$CADDY"
+    grep -q "REPLACE_WITH_ADMIN_HASH" "$CADDY"
+}
+
+@test "the admin basicauth is scoped to /admin/ (Q19)" {
+    grep -qE "@admin[[:space:]]+path[[:space:]]+/admin/" "$CADDY"
+    grep -qE "basicauth[[:space:]]+@admin" "$CADDY"
+}
+
+@test "the homepage serves /srv/homepage" {
+    grep -q "root \* /srv/homepage" "$CADDY"
+    grep -q "file_server" "$CADDY"
+}