#!/usr/bin/env bats
# Seam: the homepage site block in dankclaw/Caddyfile. It serves /srv/homepage
# from the naked domain (franksdank.cloud) and www. Authentication is via
# Caddy forward_auth (Authentik SSO) — the basicauth hashes were retired in
# favor of the unified Authentik login. caddy is not on the dev box, so the
# tests assert the structure statically.

load helpers

setup() {
    CADDY="$REPO_ROOT/dankclaw/Caddyfile"
}

@test "the homepage serves /srv/homepage" {
    grep -q "root \* /srv/homepage" "$CADDY"
    grep -q "file_server" "$CADDY"
}

@test "the /admin/ page serves admin.html and / serves index.html" {
    # Each page is served by its own 'handle' block via 'try_files'.
    grep -qE "handle[[:space:]]+/admin\*" "$CADDY"
    grep -qE "try_files[[:space:]]+/admin.html" "$CADDY"
    grep -qE "try_files[[:space:]]+/index.html" "$CADDY"
}

@test "the shared data + assets are served to any authenticated user" {
    # The data (services.json, status.json) and assets are fetched by both the
    # user page and the admin page. With forward_auth, any authenticated user
    # can access them (the browser's Authentik session covers the fetch).
    grep -qE "@data[[:space:]]+path[[:space:]]+/services\.json[[:space:]]+/status\.json" "$CADDY"
    grep -qE "handle[[:space:]]+@data" "$CADDY"
}

@test "the homepage vhost uses forward_auth (Authentik SSO)" {
    local block
    block=$(awk '/^franksdank\.cloud[[:space:]]/,/^}/' "$CADDY")
    echo "$block" | grep -q 'forward_auth'
}