#!/usr/bin/env bats
# Seam: the Seerr quadlet on dankclaw. Pins boot persistence, self-healing,
# the pinned image tag, the guard chain's port posture (loopback-only
# publish — the guard chain is the only user path), the Containers data
# root, and zero env-carried secret material in the tracked unit.

load helpers

SEERR_UNIT="$REPO_ROOT/dankclaw/seerr/quadlet/seerr.container"

@test "seerr quadlet exists under dankclaw/seerr/quadlet/" {
    [ -f "$SEERR_UNIT" ]
}

@test "seerr unit is boot-persistent (WantedBy=default.target)" {
    grep -q '^WantedBy=default.target$' "$SEERR_UNIT"
}

@test "seerr unit is self-healing (Restart=always)" {
    grep -q '^Restart=always$' "$SEERR_UNIT"
}

@test "seerr image is pinned to an exact version tag" {
    grep -Eq '^Image=ghcr\.io/seerr-team/seerr:v[0-9]+\.[0-9]+\.[0-9]+$' "$SEERR_UNIT"
}

@test "seerr publishes 5055 on loopback only (guard chain is the user path)" {
    grep -q '^PublishPort=127.0.0.1:5055:5055$' "$SEERR_UNIT"
    if grep -Eq '^PublishPort=' "$SEERR_UNIT"; then
        grep -Eq '^PublishPort=127\.0\.0\.1:5055:5055$' "$SEERR_UNIT"
        [ "$(grep -c '^PublishPort=' "$SEERR_UNIT")" -eq 1 ]
    fi
}

@test "seerr data lives under the Containers data root" {
    grep -q '^Volume=/home/dank/Containers/seerr/data:/app/config$' "$SEERR_UNIT"
}

@test "seerr joins the app network for the post-auth route" {
    grep -q '^Network=dankclaw_default$' "$SEERR_UNIT"
}

@test "seerr unit carries no env or env-file secret material" {
    ! grep -Eq '^(Environment|EnvironmentFile)=' "$SEERR_UNIT"
}