nordisk/holger-ui

crates/holger-ui-server/tests/public_site_feature.rs

//! **The default build is the AIRGAP install** (TASKS-12 S-6, the owner's SLIM
//! and AIRGAP rules, 2026-10-25): `holger-public-site` is in this crate's tree
//! ONLY under the `public-site` feature, the default build serves none of its
//! routes, and the feature build serves them without a login.

use std::process::Command;

use axum::body::Body;
use holger_ui_server::{router, Upstreams};
use http::{Request, StatusCode};

fn tree(features: &[&str]) -> String {
    let cargo = std::env::var("CARGO").unwrap_or_else(|_| "cargo".to_owned());
    let manifest = concat!(env!("CARGO_MANIFEST_DIR"), "/Cargo.toml");
    let mut cmd = Command::new(cargo);
    cmd.args(["tree", "--offline", "--locked", "--manifest-path", manifest, "-p", "holger-ui-server", "-e", "normal", "--prefix", "none"]);
    if !features.is_empty() {
        cmd.args(["--features", &features.join(",")]);
    }
    let out = cmd.output().expect("cargo tree runs");
    assert!(out.status.success(), "cargo tree failed: {}", String::from_utf8_lossy(&out.stderr));
    String::from_utf8_lossy(&out.stdout).into_owned()
}

#[test]
fn the_default_build_does_not_contain_the_public_site() {
    let t = tree(&[]);
    assert!(t.contains("holger-ui-server"), "{t}");
    assert!(!t.contains("holger-public-site"), "the default build links the public site:\n{t}");
    assert!(!tree(&["metered"]).contains("holger-public-site"), "the metered build links it");
}

#[test]
fn the_public_site_build_does() {
    assert!(tree(&["public-site"]).contains("holger-public-site"));
}

#[test]
fn the_feature_is_off_by_default_in_the_manifest() {
    let manifest = std::fs::read_to_string(concat!(env!("CARGO_MANIFEST_DIR"), "/Cargo.toml")).unwrap();
    let default = manifest.lines().find(|l| l.starts_with("default = ")).expect("a default line");
    assert!(!default.contains("public-site"), "{default}");
}

/// The site's paths through this crate's own router. The default build serves
/// none of them. A `public-site` build with `HOLGER_UI_PUBLIC_SITE` unset is
/// OFF (owner 2026-10-25: a sold private Holger is never indexed): robots.txt
/// says `Disallow: /` and nothing else is served; switched on, all of them are.
/// Holger is unreachable here (port 9), so nothing is passed through.
#[tokio::test]
async fn the_routes_are_the_features_alone_and_off_unless_told_on() {
    use tower::ServiceExt;
    let app = router(None, Upstreams::new("127.0.0.1:9", "127.0.0.1:9", None));
    let ask = |path: &'static str| {
        let app = app.clone();
        async move {
            let r = app.oneshot(Request::get(path).header("host", "holger.example").body(Body::empty()).unwrap()).await.unwrap();
            let status = r.status();
            let body = axum::body::to_bytes(r.into_body(), 1 << 20).await.unwrap();
            (status, String::from_utf8_lossy(&body).into_owned())
        }
    };
    let paths = ["/robots.txt", "/sitemap.xml", "/llms.txt", "/llms-full.txt"];
    if !holger_ui_server::PUBLIC_SITE {
        for path in paths {
            assert_ne!(ask(path).await.0, StatusCode::OK, "{path} is served by the default build");
        }
        return;
    }
    #[cfg(feature = "public-site")]
    {
        assert!(std::env::var(holger_public_site::ENV_SWITCH).is_err(), "the test environment sets the switch");
        assert_eq!(ask("/robots.txt").await, (StatusCode::OK, "User-agent: *\nDisallow: /\n".to_owned()));
        for path in &paths[1..] {
            assert_ne!(ask(path).await.0, StatusCode::OK, "{path} is served with the switch unset");
        }
        holger_ui_server::public_site().switch().set(true);
        for path in paths {
            assert_eq!(ask(path).await.0, StatusCode::OK, "{path} with the switch on");
        }
    }
}