brain-of-reese/tests/integration/test_api.py

"""Integration tests: HTTP API surface (no database required)."""
from __future__ import annotations

import json

import pytest

from app.config import get_settings


def test_health_reports_ok(client) -> None:
    r = client.get("/api/health")
    assert r.status_code == 200
    body = r.json()
    assert body["status"] == "ok"
    assert body["db"] in {"up", "down"}
    assert body["version"]


def test_config_returns_default_app_metadata(client) -> None:
    """GET /api/config is public (anonymous) and returns exactly six
    keys — the phase-39 app metadata, the phase-59 docs flag (inert
    false while BOR_DOCS_REPO is empty — the "Save as doc" gating),
    and the phase-62 UI customization strings (composer placeholder,
    footer line, theme file name)."""
    r = client.get("/api/config")
    assert r.status_code == 200
    body = r.json()
    assert set(body) == {
        "app_name", "version", "docs_repo_configured",
        "input_placeholder", "footer_text", "theme",
    }
    assert body["app_name"] == "Brain of Reese"
    assert body["version"] == get_settings().app_version
    assert body["docs_repo_configured"] is False
    # Phase 62: UNSET => the phase-61 neutral copy stands (the
    # byte-identical contract); an empty theme = the built-in palette.
    assert body["input_placeholder"] == "Ask me anything…"
    assert body["footer_text"] == "Powered by self-hosted models"
    assert body["theme"] == ""


def test_config_follows_overridden_app_name(client) -> None:
    """GET /api/config reflects a Settings override (e.g. BOR_APP_NAME)."""
    from app.config import Settings
    from app.main import app as fastapi_app

    fastapi_app.dependency_overrides[get_settings] = lambda: Settings(
        app_name="Brain of Testy"
    )
    try:
        r = client.get("/api/config")
        assert r.status_code == 200
        body = r.json()
        assert set(body) == {
            "app_name", "version", "docs_repo_configured",
            "input_placeholder", "footer_text", "theme",
        }
        assert body["app_name"] == "Brain of Testy"
        assert body["version"] == "0.1.0"
        assert body["docs_repo_configured"] is False
    finally:
        fastapi_app.dependency_overrides.clear()


def test_config_serves_ui_customization_overrides(client) -> None:
    """Phase 62: the three UI customization keys mirror Settings
    overrides (``BOR_INPUT_PLACEHOLDER`` / ``BOR_FOOTER_TEXT`` /
    ``BOR_THEME``) verbatim — the values the frontend brand layer
    applies at boot, so this dict is the whole contract."""
    from app.config import Settings
    from app.main import app as fastapi_app

    fastapi_app.dependency_overrides[get_settings] = lambda: Settings(
        input_placeholder="Ask the vault…",
        footer_text="Powered by my own models",
        theme="indigo.css",
    )
    try:
        r = client.get("/api/config")
        assert r.status_code == 200
        body = r.json()
        assert set(body) == {
            "app_name", "version", "docs_repo_configured",
            "input_placeholder", "footer_text", "theme",
        }
        assert body["input_placeholder"] == "Ask the vault…"
        assert body["footer_text"] == "Powered by my own models"
        assert body["theme"] == "indigo.css"
    finally:
        fastapi_app.dependency_overrides.clear()


def test_config_docs_flag_tracks_settings(client) -> None:
    """Phase 59 (task 05): ``docs_repo_configured`` mirrors
    ``settings.docs_configured`` — a real bool (never a truthy string)
    that flips true the moment BOR_DOCS_REPO is non-empty: that flag is
    the entire frontend gating of the "Save as doc" button."""
    from app.config import Settings
    from app.main import app as fastapi_app

    fastapi_app.dependency_overrides[get_settings] = lambda: Settings(
        app_name="Brain of Testy",
        docs_repo="/srv/docs-repo",
    )
    try:
        r = client.get("/api/config")
        assert r.status_code == 200
        body = r.json()
        assert isinstance(body["docs_repo_configured"], bool)
        assert body["docs_repo_configured"] is True
    finally:
        fastapi_app.dependency_overrides.clear()


def test_suggestions_returns_list(client) -> None:
    r = client.get("/api/suggestions")
    assert r.status_code == 200
    suggestions = r.json()["suggestions"]
    assert isinstance(suggestions, list)
    assert len(suggestions) >= 3
    assert all(isinstance(s, str) and s.strip() for s in suggestions)


def test_suggestions_honors_bor_suggestions_env_override(monkeypatch) -> None:
    """GET /api/suggestions reflects the BOR_SUGGESTIONS JSON env override."""
    from fastapi.testclient import TestClient

    from app.main import create_app

    override = [
        "How do I back up with Borg?",
        "How is my K3S cluster set up?",
        "How do I deploy a service?",
        "What proxy fronts reeseapps.com?",
    ]
    get_settings.cache_clear()
    try:
        monkeypatch.setenv("BOR_SUGGESTIONS", json.dumps(override))
        fresh_client = TestClient(create_app())
    finally:
        get_settings.cache_clear()

    r = fresh_client.get("/api/suggestions")
    assert r.status_code == 200
    assert r.json() == {"suggestions": override}


@pytest.mark.parametrize(
    ("path", "marker"),
    [
        ("/", "Brain of Reese"),
        ("/sources.html", "Knowledge base"),
        ("/document.html", "Brain of Reese"),  # phase 10: viewer page
        ("/login.html", "Sign in"),  # phase 16: admin sign-in page
        ("/tuning.html", "Global Tuning"),  # phase 27: global tuning page
        ("/git-sources.html", "Git sources"),  # phase 35: admin git sources page
        ("/history.html", "Saved chats"),  # phase 50: admin saved-chats page
        ("/shared.html", "Shared conversation"),  # phase 51: anonymous shared page
    ],
)
def test_html_pages_served_locally_no_cdn(client, path: str, marker: str) -> None:
    """No-CDN check (PLAN §7.3, re-verified on BOTH pages in phase 07 and
    on the viewer page in phase 10): each page is served by FastAPI and
    references only same-origin assets (no https:// script/link tags)."""
    r = client.get(path)
    assert r.status_code == 200
    assert marker in r.text
    assert 'src="https://' not in r.text
    assert 'href="https://' not in r.text


# Phase 33 (cache busting): the five HTML pages revalidate (no-cache) with
# ?v=<token> asset refs; /assets/* is immutable for a year; /api/* is
# untouched. The token itself is unit-tested in tests/unit/test_caching.py.


def test_index_page_no_cache_with_versioned_asset_refs(client) -> None:
    """GET / — always revalidated, and the stylesheet reference carries
    the process version token (non-empty, matching asset_version())."""
    from app.core.caching import asset_version

    token = asset_version()
    assert token  # non-empty in every supported environment

    r = client.get("/")
    assert r.status_code == 200
    assert r.headers["cache-control"] == "no-cache"
    assert f'href="/assets/styles.css?v={token}"' in r.text
    # The unversioned reference is gone from the served body.
    assert 'href="/assets/styles.css">' not in r.text


@pytest.mark.parametrize(
    "path",
    ["/sources.html", "/document.html", "/login.html", "/tuning.html",
     "/git-sources.html", "/history.html",  # phase 50: + the History page
     "/shared.html"],  # phase 51: + the anonymous shared page
)
def test_html_pages_no_cache_with_versioned_refs(client, path: str) -> None:
    """Each of the other four pages revalidates and carries at least one
    versioned asset reference."""
    from app.core.caching import asset_version

    r = client.get(path)
    assert r.status_code == 200
    assert r.headers["cache-control"] == "no-cache"
    assert f"?v={asset_version()}" in r.text


def test_index_html_variant_no_cache_versioned(client) -> None:
    """/index.html is the same page as / — same caching treatment."""
    from app.core.caching import asset_version

    r = client.get("/index.html")
    assert r.status_code == 200
    assert r.headers["cache-control"] == "no-cache"
    assert f"?v={asset_version()}" in r.text


def test_assets_served_immutable_for_a_year(client) -> None:
    r = client.get("/assets/styles.css")
    assert r.status_code == 200
    cc = r.headers["cache-control"]
    assert "public" in cc
    assert "max-age=31536000" in cc
    assert "immutable" in cc
    # The asset body is untouched (header-only middleware).
    assert client.get("/assets/app.js?v=whichever").status_code == 200


def test_api_health_gets_no_cache_control_injected(client) -> None:
    """Baseline (pre-middleware) behavior for /api/*: FastAPI's JSON
    responses ship no Cache-Control header — the middleware must not
    inject one."""
    r = client.get("/api/health")
    assert r.status_code == 200
    assert "cache-control" not in r.headers


def test_styles_and_js_served(client) -> None:
    assert client.get("/assets/styles.css").status_code == 200
    assert client.get("/assets/app.js").status_code == 200
    assert client.get("/assets/sources.js").status_code == 200
    assert client.get("/assets/markdown.js").status_code == 200  # phase 10: shared renderer
    assert client.get("/assets/document.js").status_code == 200  # phase 10: viewer page
    assert client.get("/assets/login.js").status_code == 200  # phase 16: login page
    assert client.get("/assets/document-modal.js").status_code == 200  # phase 26: modal module
    assert client.get("/assets/tuning.js").status_code == 200  # phase 27: tuning page
    assert client.get("/assets/git-sources.js").status_code == 200  # phase 35: git sources page
    assert client.get("/assets/shared.js").status_code == 200  # phase 51: shared page module


# Emoji code points banned from UI chrome (phase 08): the pictograph
# blocks, VS-16/ZWJ, plus the exact glyphs the old light theme used
# (🧠 🧑 👋 📂 ⚠).
_EMOJI_GLYPHS = "\U0001F9E0\U0001F9D1\U0001F44B\U0001F4C2\u26A0"


def _find_emoji(text: str) -> list[str]:
    hits: list[str] = []
    for ch in text:
        cp = ord(ch)
        if (
            0x1F300 <= cp <= 0x1FAFF
            or 0x2600 <= cp <= 0x27BF
            or 0x2B00 <= cp <= 0x2BFF
            or cp in (0xFE0F, 0x200D)
            or ch in _EMOJI_GLYPHS
        ):
            hits.append(ch)
    return hits


@pytest.mark.parametrize(
    "path",
    [
        "/",
        "/sources.html",
        "/document.html",
        "/login.html",  # phase 16
        "/tuning.html",  # phase 27
        "/git-sources.html",  # phase 35
        "/assets/app.js",
        "/assets/sources.js",
        "/assets/markdown.js",
        "/assets/document.js",
        "/assets/login.js",  # phase 16
        "/assets/document-modal.js",  # phase 26: the document modal module
        "/assets/git-sources.js",  # phase 35: the git sources page module
        "/shared.html",  # phase 51: the anonymous shared page
        "/assets/shared.js",  # phase 51: the shared page module
        "/assets/styles.css",
    ],
)
def test_ui_chrome_has_no_emoji(client, path: str) -> None:
    """Permanent regression guard (phase 08): the UI chrome — all pages,
    the JS that renders it, and the stylesheet — is emoji-free.

    Phase 37 revision (owner permission 2026-08-26, PLAN §4): the agent's
    ``.tool-call`` line carries the CONTENT marks — 🔎 (list) and 📄
    (read) — the only emoji in the whole frontend, and only as the exact
    tool-line template strings in app.js. Phase 68 revision: the
    ``search_documents`` tool line adds the third template literal
    ("🔎 Searching for "). The guard strips precisely those three
    literals; any other emoji, or those marks anywhere else, still
    fails."""
    r = client.get(path)
    assert r.status_code == 200
    text = r.text
    if path in ("/assets/app.js", "/assets/shared.js"):
        text = text.replace('"🔎 Listing documents"', "")
        text = text.replace('"📄 Reading "', "")
        text = text.replace('"🔎 Searching for "', "")
    assert _find_emoji(text) == [], f"emoji found in {path}: {_find_emoji(text)!r}"


def test_chat_requires_message(client) -> None:
    r = client.post("/api/chat", json={"message": ""})
    assert r.status_code == 422