#!/usr/bin/env bats
# Seam: the entropy helper unlocks the known LUKS-on-md device and mounts via
# the host's fstab entry, preserving the existing mount options and directory
# ownership rather than inventing a second mount configuration.

load helpers

@test "entropy helper is executable and has the expected safe shell shape" {
    run bash -c "test -x '$REPO_ROOT/scripts/mount-entropy.sh'"
    [ "$status" -eq 0 ]

    run grep -E '^set -euo pipefail$' "$REPO_ROOT/scripts/mount-entropy.sh"
    [ "$status" -eq 0 ]

    run grep -F 'udisksctl unlock --block-device /dev/md0' "$REPO_ROOT/scripts/mount-entropy.sh"
    [ "$status" -eq 0 ]

    run grep -F 'sudo mount "$MOUNTPOINT"' "$REPO_ROOT/scripts/mount-entropy.sh"
    [ "$status" -eq 0 ]
}

@test "entropy helper does not embed a secret or alter mount ownership" {
    run grep -Eiq 'password|secret|chmod|chown' "$REPO_ROOT/scripts/mount-entropy.sh"
    [ "$status" -eq 1 ]
}