#!/usr/bin/env bats
# Seam: tests/e2e — Playwright suite structure. The suite drives the LIVE
# fleet (homepage + Anubis/Authentik guard chain) and is deliberately not
# part of ./tests/run.sh; this seam only asserts the scaffold is present,
# well-formed, and that no credentials or browser auth state are tracked.

load helpers

@test "e2e: runner, config, lib, and specs exist" {
    for f in run.sh package.json playwright.config.ts .env.local.example \
             lib/env.ts lib/login.ts \
             specs/00-auth.setup.ts specs/10-homepage.spec.ts specs/11-admin.spec.ts \
             specs/12-crawl.spec.ts specs/13-sso.spec.ts specs/14-guard.spec.ts; do
        [ -f "$REPO_ROOT/tests/e2e/$f" ] || {
            echo "missing tests/e2e/$f"
            return 1
        }
    done
}

@test "e2e: package.json is valid JSON with the playwright dependency" {
    python3 - "$REPO_ROOT/tests/e2e/package.json" <<'PY'
import json, sys
pkg = json.load(open(sys.argv[1]))
assert "@playwright/test" in pkg.get("devDependencies", {}), "missing @playwright/test"
PY
}

@test "e2e: run.sh parses" {
    bash -n "$REPO_ROOT/tests/e2e/run.sh"
}

@test "e2e: example env file carries only placeholders" {
    if grep -E '^E2E_[A-Z_]*PASS=' "$REPO_ROOT/tests/e2e/.env.local.example" | grep -vq REPLACE_ME; then
        echo ".env.local.example must hold REPLACE_ME placeholders, never real passwords"
        return 1
    fi
}

@test "e2e: no credentials or auth state are tracked" {
    cd "$REPO_ROOT"
    tracked="$(git ls-files tests/e2e)"
    if echo "$tracked" | grep -Eq '(^|/)\.env\.local$|(^|/)\.auth(/|$)|node_modules'; then
        echo "tracked files must not include creds or auth state:"
        echo "$tracked" | grep -E '(^|/)\.env\.local$|(^|/)\.auth(/|$)|node_modules'
        return 1
    fi
}