#!/usr/bin/env bats
# Seam: open-webui on dankclaw, boot-persistent via Quadlet.
#
# The old open-webui was a bare container on dankserver (port 3000) pointing at a
# dead LLM backend (:9090). This unit stands one up on dankclaw on a free port
# (3005), on the CPU image (dankclaw is CPU-only), wired to the live
# llama.cpp backend (192.168.0.143:7770, model frank-large).

load helpers

QDIR="$REPO_ROOT/dankclaw/open-webui/quadlet"

@test "the open-webui quadlet file exists" {
    [ -f "$QDIR/open-webui.container" ]
}

@test "open-webui uses the CPU image, not :cuda (dankclaw is CPU-only)" {
    grep -qE '^Image=ghcr\.io/open-webui/open-webui:main$' "$QDIR/open-webui.container" \
        || { echo "open-webui.container must use the :main (CPU) image"; return 1; }
    if grep -qE '^Image=.*:cuda' "$QDIR/open-webui.container"; then
        echo "open-webui.container must not use the :cuda image on a CPU-only host"
        return 1
    fi
    return 0
}

@test "open-webui is on a private bridge network (not slirp4netns)" {
    # slirp4netns runs a user-space helper per container. When the helper
    # dies, the container keeps running but loses its tap interface: a
    # zombie that accepts TCP and resets every request (2026-08-22: chat
    # returned empty responses for ~2 days). A bridge network has no
    # per-container helper, so the failure mode cannot occur.
    grep -qE '^Network=open-webui\.network' "$QDIR/open-webui.container" \
        || { echo "open-webui.container must set Network=open-webui.network"; return 1; }
    ! grep -qE '^Network=slirp4netns' "$QDIR/open-webui.container"
    [ -f "$QDIR/open-webui.network" ]
}

@test "open-webui network pins a deterministic subnet and gateway" {
    # The LLM endpoint is reached via the bridge gateway, so the subnet
    # must be pinned (an auto-assigned subnet is not a promise).
    grep -qE '^Subnet=10\.89\.3\.0/24' "$QDIR/open-webui.network"
    grep -qE '^Gateway=10\.89\.3\.1' "$QDIR/open-webui.network"
}

@test "open-webui has a healthcheck that sees the app AND the network" {
    # The /health probe catches app hangs; the non-loopback interface check
    # catches the dead-tap zombie state (only "lo" left in the netns).
    grep -qE '^HealthCmd=CMD-SHELL .*/health.*' "$QDIR/open-webui.container"
    grep -qE '^HealthCmd=.*sys/class/net.*' "$QDIR/open-webui.container"
    grep -qE '^HealthInterval=30s' "$QDIR/open-webui.container"
    grep -qE '^HealthRetries=3' "$QDIR/open-webui.container"
    grep -qE '^HealthStartPeriod=' "$QDIR/open-webui.container"
}

@test "open-webui publishes 3005:8080 (a free port; 3000 is Gitea)" {
    grep -qE '^PublishPort=3005:8080' "$QDIR/open-webui.container" \
        || { echo "open-webui.container must publish 3005:8080"; return 1; }
}

@test "open-webui points its LLM at the live backend (:7770) via the host LAN IP" {
    # host.containers.internal is a slirp4netns-only name. The bridge
    # gateway (10.89.3.1) lives in the rootless netns, NOT the host netns
    # where llama-server runs -- it refuses. The host's LAN IP reaches it
    # through the rootless NAT (verified from the container, 2026-08-22).
    # 2026-08-22: frank-large moved from :52625 to :7770.
    grep -qE '^Environment=OPENAI_API_BASE_URL=http://192\.168\.0\.143:7770' \
        "$QDIR/open-webui.container" \
        || { echo "open-webui.container must set OPENAI_API_BASE_URL to the LLM at 192.168.0.143:7770"; return 1; }
}

@test "open-webui persists its data under /home/dank/Containers/open-webui/data" {
    grep -qE '^Volume=/home/dank/Containers/open-webui/data:/app/backend/data' \
        "$QDIR/open-webui.container" \
        || { echo "open-webui.container must mount the data dir at /app/backend/data"; return 1; }
}

@test "open-webui is installed for boot (WantedBy=default.target)" {
    grep -qE '^WantedBy=default\.target' "$QDIR/open-webui.container" \
        || { echo "open-webui.container: [Install] must set WantedBy=default.target"; return 1; }
}

@test "no secret material in the quadlet file" {
    # The LLM backend is a local LAN endpoint; no key is required. No 44-char
    # base64 secret-like value may appear in the tracked file.
    if grep -qE '[A-Za-z0-9+/]{44}=' "$QDIR/open-webui.container"; then
        echo "open-webui.container: contains a secret-like value"
        return 1
    fi
    has_no_leaked_secret "$QDIR/open-webui.container"
}