#!/usr/bin/env bats
# Seam: open-webui on dankclaw, boot-persistent via Quadlet.
#
# The old open-webui was a bare container on dankserver (port 3000) pointing at a
# dead LLM backend (:9090). This unit stands one up on dankclaw on a free port
# (3005), on the CPU image (dankclaw is CPU-only), wired to the live
# llama.cpp backend (192.168.0.143:7770, model frank-dragoon).

load helpers

QDIR="$REPO_ROOT/dankclaw/open-webui/quadlet"

@test "the open-webui quadlet file exists" {
    [ -f "$QDIR/open-webui.container" ]
}

@test "open-webui uses the CPU image, not :cuda (dankclaw is CPU-only)" {
    grep -qE '^Image=ghcr\.io/open-webui/open-webui:main$' "$QDIR/open-webui.container" \
        || { echo "open-webui.container must use the :main (CPU) image"; return 1; }
    if grep -qE '^Image=.*:cuda' "$QDIR/open-webui.container"; then
        echo "open-webui.container must not use the :cuda image on a CPU-only host"
        return 1
    fi
    return 0
}

@test "open-webui is on a private bridge network (not slirp4netns)" {
    # slirp4netns runs a user-space helper per container. When the helper
    # dies, the container keeps running but loses its tap interface: a
    # zombie that accepts TCP and resets every request (2026-08-22: chat
    # returned empty responses for ~2 days). A bridge network has no
    # per-container helper, so the failure mode cannot occur.
    grep -qE '^Network=open-webui\.network' "$QDIR/open-webui.container" \
        || { echo "open-webui.container must set Network=open-webui.network"; return 1; }
    ! grep -qE '^Network=slirp4netns' "$QDIR/open-webui.container"
    [ -f "$QDIR/open-webui.network" ]
}

@test "open-webui network pins a deterministic subnet and gateway" {
    # The LLM endpoint is reached via the bridge gateway, so the subnet
    # must be pinned (an auto-assigned subnet is not a promise).
    grep -qE '^Subnet=10\.89\.3\.0/24' "$QDIR/open-webui.network"
    grep -qE '^Gateway=10\.89\.3\.1' "$QDIR/open-webui.network"
}

@test "open-webui has a healthcheck that sees the app AND the network" {
    # The /health probe catches app hangs; the non-loopback interface check
    # catches the dead-tap zombie state (only "lo" left in the netns).
    grep -qE '^HealthCmd=CMD-SHELL .*/health.*' "$QDIR/open-webui.container"
    grep -qE '^HealthCmd=.*sys/class/net.*' "$QDIR/open-webui.container"
    grep -qE '^HealthInterval=30s' "$QDIR/open-webui.container"
    grep -qE '^HealthRetries=3' "$QDIR/open-webui.container"
    grep -qE '^HealthStartPeriod=' "$QDIR/open-webui.container"
}

@test "open-webui publishes 3005:8080 (a free port; 3000 is Gitea)" {
    grep -qE '^PublishPort=3005:8080' "$QDIR/open-webui.container" \
        || { echo "open-webui.container must publish 3005:8080"; return 1; }
}

@test "open-webui points its LLM at the live backend (:7770) via the host LAN IP" {
    # host.containers.internal is a slirp4netns-only name. The bridge
    # gateway (10.89.3.1) lives in the rootless netns, NOT the host netns
    # where llama-server runs -- it refuses. The host's LAN IP reaches it
    # through the rootless NAT (verified from the container, 2026-08-22).
    # 2026-08-22: frank-dragoon moved from :52625 to :7770.
    grep -qE '^Environment=OPENAI_API_BASE_URL=http://192\.168\.0\.143:7770' \
        "$QDIR/open-webui.container" \
        || { echo "open-webui.container must set OPENAI_API_BASE_URL to the LLM at 192.168.0.143:7770"; return 1; }
}

@test "open-webui persists its data under /home/dank/Containers/open-webui/data" {
    grep -qE '^Volume=/home/dank/Containers/open-webui/data:/app/backend/data' \
        "$QDIR/open-webui.container" \
        || { echo "open-webui.container must mount the data dir at /app/backend/data"; return 1; }
}

@test "open-webui is installed for boot (WantedBy=default.target)" {
    grep -qE '^WantedBy=default\.target' "$QDIR/open-webui.container" \
        || { echo "open-webui.container: [Install] must set WantedBy=default.target"; return 1; }
}

@test "no secret material in the quadlet file" {
    # The LLM backend is a local LAN endpoint; no key is required. No 44-char
    # base64 secret-like value may appear in the tracked file.
    if grep -qE '[A-Za-z0-9+/]{44}=' "$QDIR/open-webui.container"; then
        echo "open-webui.container: contains a secret-like value"
        return 1
    fi
    has_no_leaked_secret "$QDIR/open-webui.container"
}

@test "open-webui OIDC: provider URL points at the open-webui application on auth.franksdank.cloud" {
    # The OAuth client lives in authentik (application slug "open-webui");
    # the container reaches the IdP over the public URL (Caddy publishes
    # 0.0.0.0:443, Pi-hole resolves the name to the host LAN IP).
    grep -qE '^Environment=OPENID_PROVIDER_URL=https://auth\.franksdank\.cloud/application/o/open-webui/\.well-known/openid-configuration$' \
        "$QDIR/open-webui.container" \
        || { echo "open-webui.container: OPENID_PROVIDER_URL must point at the open-webui application on auth.franksdank.cloud"; return 1; }
}

@test "open-webui OIDC: redirect URI matches the ai.franksdank.cloud vhost" {
    # The browser-side callback must land on the published vhost; the
    # authentik provider allows exactly this URI (Strict).
    grep -qE '^Environment=OPENID_REDIRECT_URI=https://ai\.franksdank\.cloud/oauth/oidc/callback$' \
        "$QDIR/open-webui.container" \
        || { echo "open-webui.container: OPENID_REDIRECT_URI must be the ai.franksdank.cloud callback"; return 1; }
}

@test "open-webui OIDC: WEBUI_URL, signup, email merge, and role management" {
    grep -qE '^Environment=WEBUI_URL=https://ai\.franksdank\.cloud$' "$QDIR/open-webui.container"
    grep -qE '^Environment=ENABLE_OAUTH_SIGNUP=true' "$QDIR/open-webui.container"
    grep -qE '^Environment=OAUTH_MERGE_ACCOUNTS_BY_EMAIL=true' "$QDIR/open-webui.container"
    grep -qE '^Environment=ENABLE_OAUTH_ROLE_MANAGEMENT=true' "$QDIR/open-webui.container"
    grep -qE '^Environment="OAUTH_SCOPES=openid email profile roles"$' "$QDIR/open-webui.container"
}

@test "open-webui OIDC: client secret lives in the host env file, not the unit" {
    # The client ID is a public identifier and may be tracked; the secret
    # must come from the git-ignored host env file (mode 600).
    grep -qE '^EnvironmentFile=/home/dank/Containers/open-webui/env$' "$QDIR/open-webui.container" \
        || { echo "open-webui.container: must load the client secret from the host env file"; return 1; }
    ! grep -q 'OAUTH_CLIENT_SECRET' "$QDIR/open-webui.container"
}