#!/usr/bin/env bats
# Seam: the homepage site block in dankclaw/Caddyfile. It must carry a root
# basicauth hash and a distinct /admin/-scoped admin hash (Q18/Q19), and serve
# /srv/homepage. caddy is not on the dev box, so the tests assert the
# structure statically; the deploy renders the two real hashes from the .env.

load helpers

setup() {
    CADDY="$REPO_ROOT/dankclaw/Caddyfile"
}

@test "the homepage has its own hash and a distinct admin hash" {
    grep -q "REPLACE_WITH_HOMEPAGE_HASH" "$CADDY"
    grep -q "REPLACE_WITH_ADMIN_HASH" "$CADDY"
}

@test "the admin basicauth is scoped to /admin/ (Q19)" {
    # The admin page is a 'handle /admin*' block with the operator (frank)
    # credential. Caddy sorts a top-level 'rewrite' before 'basicauth', which
    # would change the path and break the path-based auth matcher; 'handle'
    # preserves order, so the auth is checked on the original path.
    grep -qE "handle[[:space:]]+/admin\*" "$CADDY"
    grep -qE "frank[[:space:]]+REPLACE_WITH_ADMIN_HASH" "$CADDY"
}

@test "the homepage serves /srv/homepage" {
    grep -q "root \* /srv/homepage" "$CADDY"
    grep -q "file_server" "$CADDY"
}

@test "the /admin/ page serves admin.html and / serves index.html" {
    # Each page is served by its own 'handle' block via 'try_files' (which
    # serves the named file without a top-level 'rewrite' that Caddy would
    # sort before the basicauth).
    grep -qE "try_files[[:space:]]+/admin.html" "$CADDY"
    grep -qE "try_files[[:space:]]+/index.html" "$CADDY"
}

@test "the shared data + assets accept both the family and the operator" {
    # The admin page (frank) and the user page (dank) both fetch the shared
    # data (services.json, status.json) and assets. The browser reuses the
    # page's credential for these, so the block must accept both users.
    grep -qE "@data[[:space:]]+path[[:space:]]+/services\.json[[:space:]]+/status\.json" "$CADDY"
    grep -qE "handle[[:space:]]+@data" "$CADDY"
    grep -qE "dankuser[[:space:]]+REPLACE_WITH_HOMEPAGE_HASH" "$CADDY"
}