#!/usr/bin/env bash
# Exercises the hosted-LLM proxy path with a local fake OpenAI-compatible server (no real key needed).
set -euo pipefail
cd "$(dirname "$0")/.."
D=$(mktemp -d)
python3 tests/mock_llm.py 18798 & M=$!
AGENT_MARKET_PORT=18799 AGENT_MARKET_DATA=$D AGENT_MARKET_LLM_API_KEY=test-dummy-key \
  AGENT_MARKET_LLM_BASE_URL=http://127.0.0.1:18798/v1 AGENT_MARKET_LLM_MODEL=mock-model python3 server.py >/dev/null 2>&1 & S=$!
trap 'kill $M $S 2>/dev/null; rm -rf $D' EXIT
sleep 1.2
OUT=$(curl -s localhost:18799/api/chat -H 'Content-Type: application/json' -d '{"message":"show me bikes"}')
echo "$OUT" | python3 -c '
import json,sys; d=json.load(sys.stdin)
assert d["agent"]!="fallback", d
types=[a["type"] for a in d["actions"]]
assert types==["show_cards"], types  # unknown component from the LLM is dropped
assert all("bike" in l["title"].lower() for l in d["actions"][0]["payload"]["listings"])
print("PASS LLM proxy path: tool call -> hydrated cards; disallowed component dropped")'
if echo "$OUT" | grep -q test-dummy-key; then echo "FAIL key leaked to browser"; exit 1; else echo "PASS key never sent to browser"; fi
test "$(curl -s localhost:18798/ | python3 -c 'import json,sys;print(json.load(sys.stdin)["auth_ok"])')" -ge 2 && echo "PASS server sent key to LLM upstream only"