Initial curated RAGcore source from c16667f0c9397e2bfc8dd0255b114fba23c8d05e

tests/unit/test_main_server.py

@@ -0,0 +1,28 @@
+"""Production server wiring for the reverse-proxy trust boundary."""
+
+from types import SimpleNamespace
+from typing import Any
+
+import ragcore.main as main
+
+
+def test_run_passes_only_configured_trusted_proxies_to_uvicorn(monkeypatch: Any) -> None:
+    captured: dict[str, Any] = {}
+
+    def fake_run(application: str, **kwargs: Any) -> None:
+        captured["application"] = application
+        captured.update(kwargs)
+
+    monkeypatch.setattr(
+        main,
+        "get_settings",
+        lambda: SimpleNamespace(trusted_proxy_ips=("172.30.50.2",)),
+    )
+    monkeypatch.setattr(main.uvicorn, "run", fake_run)
+
+    main.run()
+
+    assert captured["application"] == "ragcore.main:app"
+    assert captured["proxy_headers"] is True
+    assert captured["forwarded_allow_ips"] == ["172.30.50.2"]
+    assert "*" not in captured["forwarded_allow_ips"]