serverAppConfigs/tests/deployment_flow.bats

#!/usr/bin/env bats
# Seam: target reachability and deployment flow integrity.
# These tests assert the service-scoped deployment contract:
#   - deploy.sh accepts a target, optional service scope, and --dry-run
#   - deploy-remote.sh owns per-service handlers and deployment state
#   - no host-wide inference restart is hidden in the dispatcher
#   - every host referenced in the repo is reachable over SSH (dank@host)
#   - the local git remote is configured before deploy is attempted
# Reachability tests are SKIPPED when the target is unreachable so the suite
# still runs during offline development.

load helpers

@test "deploy.sh exists and is executable" {
    [ -x "$REPO_ROOT/scripts/deploy.sh" ]
}

@test "deploy.sh accepts the two known targets" {
    run bash "$REPO_ROOT/scripts/deploy.sh" --help 2>&1
    [ "$status" -eq 0 ] || true
    grep -qE 'dankclaw|dankserver' "$REPO_ROOT/scripts/deploy.sh"
}

@test "git remote origin is configured" {
    git -C "$REPO_ROOT" remote get-url origin >/dev/null 2>&1 \
        || skip "no origin remote configured yet"
}

@test "dankclaw is reachable over ssh" {
    timeout 8 ssh -o BatchMode=yes -o ConnectTimeout=5 dank@dankclaw 'true' 2>/dev/null \
        || skip "dankclaw not reachable from this host"
}

@test "dankserver is reachable over ssh" {
    timeout 8 ssh -o BatchMode=yes -o ConnectTimeout=5 dank@dankserver 'true' 2>/dev/null \
        || skip "dankserver not reachable from this host"
}

# Regression: the Caddyfile render step in deploy.sh must survive a bcrypt
# hash (which contains '/' characters). Reproduce the sed expression with a
# slash-bearing hash and confirm the placeholder is replaced.
@test "scoped remote runner owns Caddy reload and safe fallback" {
    # Caddy is handled only when selected by the planner. A failed reload may
    # restart Caddy, but must not restart the whole compose project.
    grep -q 'caddy reload' "$REPO_ROOT/scripts/deploy-remote.sh"
    grep -q 'podman restart caddy' "$REPO_ROOT/scripts/deploy-remote.sh"
    ! grep -qE 'podman-compose.*(up|restart).*\$\(' "$REPO_ROOT/scripts/deploy-remote.sh"
}

@test "Caddy migration retires the standalone Gitea proxy" {
    grep -q 'retire_legacy_gitea_caddy' "$REPO_ROOT/scripts/deploy-remote.sh"
    grep -q 'systemctl --user stop gitea-caddy.service' "$REPO_ROOT/scripts/deploy-remote.sh"
    grep -q 'systemctl --user disable gitea-caddy.service' "$REPO_ROOT/scripts/deploy-remote.sh"
    ! grep -q 'deploy_gitea_unit gitea-caddy' "$REPO_ROOT/scripts/deploy-remote.sh"
}

@test "canonical Caddy deployment installs its boot-persistent quadlet" {
    # 2026-08-26: a bare compose container never came back after reboot.
    # deploy_caddy must install and start the quadlet unit instead of
    # `podman-compose up`. Boot persistence comes from the quadlet generator's
    # default.target.wants symlink (is-enabled reports "generated"), so there
    # is no explicit systemctl enable — it fails on generated units.
    grep -q 'install_quadlet caddy dankclaw/caddy/quadlet caddy' "$REPO_ROOT/scripts/deploy-remote.sh"
    grep -q 'systemctl --user restart caddy.service' "$REPO_ROOT/scripts/deploy-remote.sh"
    ! grep -q 'systemctl --user enable caddy.service' "$REPO_ROOT/scripts/deploy-remote.sh"
    ! grep -q 'podman-compose -f dankclaw/compose.yaml up -d --no-deps caddy' "$REPO_ROOT/scripts/deploy-remote.sh"
    ! grep -q 'no proxy was stopped or replaced' "$REPO_ROOT/scripts/deploy-remote.sh"
}

@test "remote runner has a handler per inference service" {
    grep -q 'deploy_llm_dragoon' "$REPO_ROOT/scripts/deploy-remote.sh"
    grep -q 'deploy_llm_archon' "$REPO_ROOT/scripts/deploy-remote.sh"
    grep -q 'deploy_llm_zealot' "$REPO_ROOT/scripts/deploy-remote.sh"
}

@test "inference restarts are absent from the top-level dispatcher" {
    ! grep -qE 'systemctl .*restart (frank-medium|frank-dragoon|frank-npu)' "$REPO_ROOT/scripts/deploy.sh"
}

@test "remote runner health-checks an inference endpoint" {
    grep -q '127.0.0.1:7770/health' "$REPO_ROOT/scripts/deploy-remote.sh"
}

@test "deploy.sh pulls the merged checkout on the target" {
    grep -q 'git pull --ff-only origin main' "$REPO_ROOT/scripts/deploy.sh"
    grep -q '/home/dank/serverAppConfigs' "$REPO_ROOT/scripts/deploy.sh"
}

@test "deploy.sh Caddyfile render survives a slash-bearing bcrypt hash" {
    local hash='$2a$14$dndiQ9EaycJv0w3Gp2oAYO/xH6O9x2ZRhMLJdCxrgi9rMn1te9D/spy'
    local rendered
    rendered=$(sed "s|REPLACE_WITH_HASH|${hash}|g" "$REPO_ROOT/dankclaw/Caddyfile")
    [ -n "$rendered" ]
    [[ "$rendered" == *"${hash}"* ]]
    ! grep -q 'REPLACE_WITH_HASH' <<< "$rendered"
    # The rendered line must be exactly "dankuser <hash>". A template that
    # keeps its own $2a$14$ prefix renders an invalid double-prefixed hash
    # and every basicauth vhost returns 401 (2026-08-22 incident).
    grep -qF "dankuser ${hash}" <<< "$rendered"
    ! grep -qF '$2a$14$$2a$14$' <<< "$rendered"
}

@test "the pending pass prunes retired-service state instead of blocking the run" {
    # Regression: a pending state entry for frank-default-sightsound (an
    # endpoint retired 2026-09-11) made every --pending run exit 2 at the
    # dispatcher before the Playwright e2e gate could execute. The pending
    # pass must drop entries the target no longer allows into the trash and
    # still deploy the services that remain.
    local sandbox="$BATS_TEST_TMPDIR/st"
    mkdir -p "$sandbox"
    printf 'revision=deadbeef\nstatus=pending\n' > "$sandbox/frank-default-sightsound"
    printf 'revision=deadbeef\nstatus=pending\n' > "$sandbox/searxng"
    run env HOME="$BATS_TEST_TMPDIR" STATE_DIR="$sandbox" bash -c '
        set -euo pipefail
        SERVICES=()
        REVISION=cafebabe
        TARGET=dankclaw
        service_is_allowed() { [[ "$1" == searxng ]]; }
        eval "$(sed -n "/^state_revision()/,/^}/p" "$1/scripts/deploy-remote.sh"; sed -n "/^state_status()/,/^}/p" "$1/scripts/deploy-remote.sh"; sed -n "/^add_pending_services()/,/^}/p" "$1/scripts/deploy-remote.sh")"
        add_pending_services >/dev/null 2>&1
        printf "%s\n" "${SERVICES[@]:-}"
    ' _ "$REPO_ROOT"
    [ "$status" -eq 0 ]
    [ "$output" = "searxng" ]
    [ ! -e "$sandbox/frank-default-sightsound" ]
    [ -e "$BATS_TEST_TMPDIR/.AGENTTRASH/$(date +%Y%m%d)-retired-deploy-state/frank-default-sightsound" ]
}

@test "the client and remote allowlists agree per target" {
    # Two gates guard `deploy.sh --service X`: the client's valid_service and
    # the remote runner's service_is_allowed. When only one side gained a
    # service the other answered "is not deployed on <target>" and the only
    # repair path was a fleet-wide drain — cadvisor and gpu-exporter both fell
    # through this crack within a day of each other. The lists MUST agree;
    # searxng-network is the one sanctioned exception (client-only network
    # unit, no remote dispatch handler).
    run env OUT="$BATS_TEST_TMPDIR" bash -c '
        grep -oE "dank(claw|server):[a-z0-9-]+" \
            <(sed -n "/^valid_service()/,/^}/p" "$1/scripts/deploy.sh") \
            | grep -v "dankclaw:searxng-network" | sort -u > "$OUT/cli"
        grep -oE "dank(claw|server):[a-z0-9-]+" \
            <(sed -n "/^service_is_allowed()/,/^}/p" "$1/scripts/deploy-remote.sh") \
            | sort -u > "$OUT/rem"
        diff "$OUT/cli" "$OUT/rem"
    ' _ "$REPO_ROOT"
    [ "$status" -eq 0 ] || { echo "deploy.sh vs deploy-remote.sh allowlist drift:"; echo "$output"; return 1; }
    # Drift aside, the gate must actually know the host-process exporters —
    # their first-ever deploy has to pass the client gate.
    for pair in dankclaw:cadvisor dankclaw:gpu-exporter dankserver:cadvisor dankserver:gpu-exporter; do
        grep -q "$pair" "$BATS_TEST_TMPDIR/cli" || { echo "client gate missing $pair"; return 1; }
    done
}