#!/usr/bin/env bats
# Seam: SearXNG limiter / trusted-group configuration.
# The trusted group lives in shared/searxng/limiter.toml (NOT in settings.yml).
# It must be valid TOML, trust the homelab LAN, and be copied into place by
# deploy.sh so the deployed /etc/searxng/limiter.toml matches the repo.

load helpers

@test "shared/searxng/limiter.toml exists" {
    [ -f "$REPO_ROOT/shared/searxng/limiter.toml" ]
}

@test "limiter.toml is valid TOML" {
    python3 - "$REPO_ROOT/shared/searxng/limiter.toml" <<'PYEOF'
import sys, tomllib
with open(sys.argv[1], "rb") as fh:
    tomllib.load(fh)
PYEOF
}

@test "limiter.toml trusts the homelab LAN in pass_ip" {
    python3 - "$REPO_ROOT/shared/searxng/limiter.toml" <<'PYEOF'
import sys, tomllib
with open(sys.argv[1], "rb") as fh:
    data = tomllib.load(fh)
ip_lists = data.get("botdetection", {}).get("ip_lists", {})
pass_ip = ip_lists.get("pass_ip", [])
assert "192.168.0.0/24" in pass_ip, f"LAN missing from pass_ip; got {pass_ip}"
PYEOF
}

@test "limiter.toml trusts the LAN as a proxy for X-Forwarded-For" {
    python3 - "$REPO_ROOT/shared/searxng/limiter.toml" <<'PYEOF'
import sys, tomllib
with open(sys.argv[1], "rb") as fh:
    data = tomllib.load(fh)
bd = data.get("botdetection", {})
proxies = bd.get("trusted_proxies", [])
assert "192.168.0.0/24" in proxies, f"LAN missing from trusted_proxies; got {proxies}"
PYEOF
}

@test "deploy.sh copies limiter.toml into /opt/searxng/config" {
    grep -q "shared/searxng/limiter.toml" "$REPO_ROOT/scripts/deploy.sh" \
        || { echo "deploy.sh does not copy shared/searxng/limiter.toml"; return 1; }
    grep -q "/opt/searxng/config/limiter.toml" "$REPO_ROOT/scripts/deploy.sh" \
        || { echo "deploy.sh does not place limiter.toml at /opt/searxng/config"; return 1; }
}