#!/usr/bin/env bats
# Seam: open-webui on dankclaw, boot-persistent via Quadlet.
#
# The old open-webui was a bare container on dankserver (port 3000) pointing at a
# dead LLM backend (:9090). This unit stands one up on dankclaw on a free port
# (3005), on the CPU image (dankclaw is CPU-only), wired to the live vLLM
# backend (host.containers.internal:52625, model frank-default-large).

load helpers

QDIR="$REPO_ROOT/dankclaw/open-webui/quadlet"

@test "the open-webui quadlet file exists" {
    [ -f "$QDIR/open-webui.container" ]
}

@test "open-webui uses the CPU image, not :cuda (dankclaw is CPU-only)" {
    grep -qE '^Image=ghcr\.io/open-webui/open-webui:main$' "$QDIR/open-webui.container" \
        || { echo "open-webui.container must use the :main (CPU) image"; return 1; }
    if grep -qE '^Image=.*:cuda' "$QDIR/open-webui.container"; then
        echo "open-webui.container must not use the :cuda image on a CPU-only host"
        return 1
    fi
    return 0
}

@test "open-webui is isolated on slirp4netns" {
    grep -qE '^Network=slirp4netns' "$QDIR/open-webui.container" \
        || { echo "open-webui.container must set Network=slirp4netns"; return 1; }
}

@test "open-webui publishes 3005:8080 (a free port; 3000 is Gitea)" {
    grep -qE '^PublishPort=3005:8080' "$QDIR/open-webui.container" \
        || { echo "open-webui.container must publish 3005:8080"; return 1; }
}

@test "open-webui points its LLM at the live vLLM backend (52625)" {
    grep -qE '^Environment=OPENAI_API_BASE_URL=http://host\.containers\.internal:52625' \
        "$QDIR/open-webui.container" \
        || { echo "open-webui.container must set OPENAI_API_BASE_URL to the vLLM on 52625"; return 1; }
}

@test "open-webui persists its data under /home/dank/Containers/open-webui/data" {
    grep -qE '^Volume=/home/dank/Containers/open-webui/data:/app/backend/data' \
        "$QDIR/open-webui.container" \
        || { echo "open-webui.container must mount the data dir at /app/backend/data"; return 1; }
}

@test "open-webui is installed for boot (WantedBy=default.target)" {
    grep -qE '^WantedBy=default\.target' "$QDIR/open-webui.container" \
        || { echo "open-webui.container: [Install] must set WantedBy=default.target"; return 1; }
}

@test "no secret material in the quadlet file" {
    # The LLM backend is a local LAN endpoint; no key is required. No 44-char
    # base64 secret-like value may appear in the tracked file.
    if grep -qE '[A-Za-z0-9+/]{44}=' "$QDIR/open-webui.container"; then
        echo "open-webui.container: contains a secret-like value"
        return 1
    fi
    has_no_leaked_secret "$QDIR/open-webui.container"
}