"""Production server wiring for the reverse-proxy trust boundary."""

from types import SimpleNamespace
from typing import Any

import ragcore.main as main


def test_run_passes_only_configured_trusted_proxies_to_uvicorn(monkeypatch: Any) -> None:
    captured: dict[str, Any] = {}

    def fake_run(application: str, **kwargs: Any) -> None:
        captured["application"] = application
        captured.update(kwargs)

    monkeypatch.setattr(
        main,
        "get_settings",
        lambda: SimpleNamespace(trusted_proxy_ips=("172.30.50.2",)),
    )
    monkeypatch.setattr(main.uvicorn, "run", fake_run)

    main.run()

    assert captured["application"] == "ragcore.main:app"
    assert captured["proxy_headers"] is True
    assert captured["forwarded_allow_ips"] == ["172.30.50.2"]
    assert "*" not in captured["forwarded_allow_ips"]