//! Milestone 0.5 end to end: the JSON API with scoped tokens, webhooks
//! delivered to a local receiver with signatures and retries, checks on a
//! projected state that gate landing, and the proposal event stream.

use axum::body::Body;
use axum::http::{header, Request, StatusCode};
use axum::routing::post;
use axum::Router;
use http_body_util::BodyExt;
use oxy_core::repo::Repo;
use oxygenhub::config::Config;
use oxygenhub::db;
use oxygenhub::repos::RepoName;
use oxygenhub::Shared;
use std::path::Path;
use std::sync::{Arc, Mutex};
use tower::ServiceExt;

fn hermetic() {
    static ONCE: std::sync::Once = std::sync::Once::new();
    static DIR: std::sync::OnceLock<tempfile::TempDir> = std::sync::OnceLock::new();
    ONCE.call_once(|| {
        let d = tempfile::tempdir().unwrap();
        std::env::set_var("OXY_HOME", d.path());
        DIR.set(d).ok();
    });
}

fn write(root: &Path, rel: &str, content: &[u8]) {
    let p = root.join(rel);
    std::fs::create_dir_all(p.parent().unwrap()).unwrap();
    std::fs::write(p, content).unwrap();
}

struct Hub {
    app: Shared,
    base: String,
    _dir: tempfile::TempDir,
}

async fn hub() -> Hub {
    hermetic();
    let dir = tempfile::tempdir().unwrap();
    let mut config = Config::load(dir.path()).unwrap();
    config.auth.push_tokens = vec!["site".into()];
    config.registration.mode = "open".into();
    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
    let port = listener.local_addr().unwrap().port();
    config.server.base_url = format!("http://127.0.0.1:{port}");
    let app = oxygenhub::build(config).await.unwrap();
    let router = oxygenhub::router(app.clone());
    tokio::spawn(async move { axum::serve(listener, router).await.unwrap() });
    Hub { app, base: format!("http://127.0.0.1:{port}"), _dir: dir }
}

struct Res {
    status: StatusCode,
    body: String,
    cookie: Option<String>,
}

async fn call(
    app: &Shared,
    method: &str,
    path: &str,
    bearer: Option<&str>,
    cookie: Option<&str>,
    json: Option<&str>,
    form: Option<&str>,
) -> Res {
    let mut req = Request::builder().method(method).uri(path);
    if let Some(b) = bearer {
        req = req.header(header::AUTHORIZATION, format!("Bearer {b}"));
    }
    if let Some(c) = cookie {
        req = req.header(header::COOKIE, format!("oxyhub={c}"));
    }
    let body = if let Some(j) = json {
        req = req.header(header::CONTENT_TYPE, "application/json");
        Body::from(j.to_string())
    } else if let Some(f) = form {
        req = req.header(header::CONTENT_TYPE, "application/x-www-form-urlencoded");
        Body::from(f.to_string())
    } else {
        Body::empty()
    };
    let res = oxygenhub::router(app.clone()).oneshot(req.body(body).unwrap()).await.unwrap();
    let status = res.status();
    let cookie = res
        .headers()
        .get(header::SET_COOKIE)
        .and_then(|v| v.to_str().ok())
        .and_then(|v| v.split(';').next())
        .and_then(|kv| kv.split_once('='))
        .map(|(_, v)| v.to_string());
    let bytes = res.into_body().collect().await.unwrap().to_bytes();
    Res { status, body: String::from_utf8_lossy(&bytes).into_owned(), cookie }
}

async fn api(app: &Shared, method: &str, path: &str, bearer: Option<&str>, json: Option<&str>) -> (StatusCode, serde_json::Value) {
    let r = call(app, method, path, bearer, None, json, None).await;
    let v = serde_json::from_str(&r.body).unwrap_or(serde_json::Value::String(r.body.clone()));
    (r.status, v)
}

fn csrf_of(page: &str) -> String {
    let i = page.find("name=\"_csrf\" value=\"").expect("csrf field") + "name=\"_csrf\" value=\"".len();
    page[i..].split('"').next().unwrap().to_string()
}

/// A webhook receiver that records what it gets and fails the first time.
struct Receiver {
    url: String,
    seen: Arc<Mutex<Vec<(String, String, String)>>>,
    fail_first: Arc<Mutex<bool>>,
}

async fn receiver() -> Receiver {
    let seen: Arc<Mutex<Vec<(String, String, String)>>> = Arc::new(Mutex::new(vec![]));
    let fail_first = Arc::new(Mutex::new(true));
    let (s2, f2) = (seen.clone(), fail_first.clone());
    let router = Router::new().route(
        "/hook",
        post(move |headers: header::HeaderMap, body: String| {
            let (s2, f2) = (s2.clone(), f2.clone());
            async move {
                let event = headers.get("x-oxyhub-event").and_then(|v| v.to_str().ok()).unwrap_or("").to_string();
                let sig = headers.get("x-oxyhub-signature").and_then(|v| v.to_str().ok()).unwrap_or("").to_string();
                let mut f = f2.lock().unwrap();
                if *f {
                    *f = false;
                    return (StatusCode::INTERNAL_SERVER_ERROR, "flaky");
                }
                s2.lock().unwrap().push((event, sig, body));
                (StatusCode::OK, "ok")
            }
        }),
    );
    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
    let port = listener.local_addr().unwrap().port();
    tokio::spawn(async move { axum::serve(listener, router).await.unwrap() });
    Receiver { url: format!("http://127.0.0.1:{port}/hook"), seen, fail_first }
}

#[tokio::test(flavor = "multi_thread")]
async fn api_webhooks_and_checks() {
    let h = hub().await;
    let app = &h.app;
    // Accounts and tokens through the pages.
    let r =
        call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery")).await;
    let andy = r.cookie.unwrap();
    let r =
        call(app, "POST", "/register", None, None, None, Some("username=bob&email=b%40example.com&password=correct-horse-battery")).await;
    let bob = r.cookie.unwrap();
    let mint = |cookie: String, scopes: &'static str| {
        let app = app.clone();
        async move {
            let page = call(&app, "GET", "/settings/tokens", None, Some(&cookie), None, None).await;
            let csrf = csrf_of(&page.body);
            let r = call(&app, "POST", "/settings/tokens", None, Some(&cookie), None, Some(&format!("_csrf={csrf}&name=t&{scopes}"))).await;
            r.body.split("oxyhub_").nth(1).map(|s| format!("oxyhub_{}", s.split('<').next().unwrap().trim())).unwrap()
        }
    };
    let andy_admin = mint(andy.clone(), "scopes=repo%3Aadmin").await;
    let andy_ro = mint(andy.clone(), "scopes=repo%3Aread").await;
    let bob_rw = mint(bob.clone(), "scopes=repo%3Aread&scopes=repo%3Awrite").await;

    // Create a repository through the API; the read-only token cannot.
    let (st, _) = api(app, "POST", "/api/v1/repos", Some(&andy_ro), Some(r#"{"owner":"andy","name":"x"}"#)).await;
    assert_eq!(st, StatusCode::FORBIDDEN);
    let (st, v) = api(
        app,
        "POST",
        "/api/v1/repos",
        Some(&andy_admin),
        Some(r#"{"owner":"andy","name":"demo","description":"d","visibility":"public"}"#),
    )
    .await;
    assert_eq!(st, StatusCode::CREATED, "{v}");
    assert_eq!(v["clone_url"], format!("{}/andy/demo", h.base));
    let (st, _) = api(app, "POST", "/api/v1/repos", Some(&andy_admin), Some(r#"{"owner":"andy","name":"demo"}"#)).await;
    assert_eq!(st, StatusCode::CONFLICT);
    let (st, _) = api(app, "GET", "/api/v1/user", Some(&andy_ro), None).await;
    assert_eq!(st, StatusCode::FORBIDDEN, "user:read is a scope of its own");
    let (st, v) = api(app, "GET", "/api/v1/users/andy", None, None).await;
    assert_eq!(st, StatusCode::OK);
    assert_eq!(v["username"], "andy");

    // A webhook on the repository; push, then see the delivery with a valid signature after a retry.
    let rx = receiver().await;
    let (st, v) = api(
        app,
        "POST",
        "/api/v1/repos/andy/demo/hooks",
        Some(&andy_admin),
        Some(&format!(r#"{{"url":"{}","secret":"s3","events":"push,proposal,check"}}"#, rx.url)),
    )
    .await;
    assert_eq!(st, StatusCode::CREATED, "{v}");
    let work = tempfile::tempdir().unwrap();
    let mut client = Repo::init(work.path()).unwrap();
    client.config.set("remote.origin.url", &format!("{}/andy/demo", h.base)).unwrap();
    client.config.set("remote.origin.token", "site").unwrap();
    client.save_config().unwrap();
    write(work.path(), "a.txt", b"a\n");
    client.snapshot("t").unwrap();
    let base = client.commit("base", &[]).unwrap();
    assert!(client.push("origin", false).unwrap().iter().all(|r| r.ok));
    // The worker retries with backoff; drive it directly for the retry.
    tokio::time::sleep(std::time::Duration::from_millis(400)).await;
    assert!(rx.seen.lock().unwrap().is_empty(), "the first attempt failed");
    sqlx::query("UPDATE deliveries SET next_ms = 0").execute(&app.db).await.unwrap();
    oxygenhub::hooks::deliver_due(app).await;
    let seen = rx.seen.lock().unwrap().clone();
    assert_eq!(seen.len(), 1, "{seen:?}");
    assert_eq!(seen[0].0, "push");
    assert_eq!(seen[0].1, oxygenhub::hooks::signature("s3", seen[0].2.as_bytes()));
    let payload: serde_json::Value = serde_json::from_str(&seen[0].2).unwrap();
    assert_eq!(payload["repository"]["name"], "demo");
    assert_eq!(payload["data"]["updates"][0]["reference"], "main");
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/hooks", Some(&andy_admin), None).await;
    assert_eq!(v.as_array().unwrap().len(), 1);

    // History, tree, file, blame, bookmarks, trust, pushes through the API.
    let (st, v) = api(app, "GET", "/api/v1/repos/andy/demo/history/main", None, None).await;
    assert_eq!(st, StatusCode::OK);
    assert_eq!(v["changes"][0]["hash"], base.to_hex());
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/tree/main", None, None).await;
    assert_eq!(v[0]["name"], "a.txt");
    let r = call(app, "GET", "/api/v1/repos/andy/demo/file/main/a.txt", None, None, None, None).await;
    assert_eq!(r.body, "a\n");
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/blame/main/a.txt", None, None).await;
    assert_eq!(v[0]["change"], base.to_hex());
    let (_, v) = api(app, "GET", &format!("/api/v1/repos/andy/demo/changes/{}", base.to_hex()), None, None).await;
    assert_eq!(v["files"][0]["path"], "a.txt");
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/trust", None, None).await;
    assert!(v["policy"].is_null());
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/pushes", None, None).await;
    assert_eq!(v[0]["reference"], "main");

    // Issues through the API: Bob opens one, comments, and closes it.
    let (st, v) = api(app, "POST", "/api/v1/repos/andy/demo/issues", Some(&bob_rw), Some(r#"{"title":"Bug","body":"it broke"}"#)).await;
    assert_eq!(st, StatusCode::CREATED, "{v}");
    assert_eq!(v["number"], 1);
    let (st, _) = api(app, "POST", "/api/v1/repos/andy/demo/issues/1/comments", Some(&bob_rw), Some(r#"{"body":"more"}"#)).await;
    assert_eq!(st, StatusCode::CREATED);
    let (st, v) = api(app, "POST", "/api/v1/repos/andy/demo/issues/1", Some(&bob_rw), Some(r#"{"state":"closed"}"#)).await;
    assert_eq!(st, StatusCode::OK, "{v}");
    assert_eq!(v["state"], "closed");
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/issues?state=all", None, None).await;
    assert_eq!(v[0]["comments"], 1);
    let (_, v) = api(app, "GET", "/api/v1/search?q=broke", None, None).await;
    assert_eq!(v[0]["number"], 1);

    // A proposal through the API, then a required check gates its landing.
    client.bookmark_create("feat", Some(&[base])).unwrap();
    client.bookmark_switch("feat", false).unwrap();
    write(work.path(), "b.txt", b"b\n");
    write(work.path(), "a.txt", b"a\nA\n");
    client.snapshot("t").unwrap();
    let feat = client.commit("feat", &[]).unwrap();
    assert!(client.push_bookmark("origin", "feat", false).unwrap().iter().all(|r| r.ok));
    let (st, v) =
        api(app, "POST", "/api/v1/repos/andy/demo/proposals", Some(&bob_rw), Some(r#"{"title":"Feat","target":"main","source":"feat"}"#))
            .await;
    assert_eq!(st, StatusCode::CREATED, "{v}");
    assert_eq!(v["number"], 2);
    let state = v["projected_state"].as_str().unwrap().to_string();
    assert_eq!(v["landable"], true);
    // Its files, and each side's bytes, for editors' diff views.
    let (st, v) = api(app, "GET", "/api/v1/repos/andy/demo/proposals/2/files", None, None).await;
    assert_eq!(st, StatusCode::OK, "{v}");
    let files: Vec<(String, String)> =
        v.as_array().unwrap().iter().map(|f| (f["path"].as_str().unwrap().to_string(), f["kind"].as_str().unwrap().to_string())).collect();
    assert_eq!(files, vec![("a.txt".into(), "modified".into()), ("b.txt".into(), "added".into())], "{v}");
    assert_eq!(v[0]["added"], 1);
    let side = |s: &str, p: &str| format!("/api/v1/repos/andy/demo/proposals/2/content/{s}/{p}");
    assert_eq!(call(app, "GET", &side("base", "a.txt"), None, None, None, None).await.body, "a\n");
    assert_eq!(call(app, "GET", &side("head", "a.txt"), None, None, None, None).await.body, "a\nA\n");
    assert_eq!(call(app, "GET", &side("head", "b.txt"), None, None, None, None).await.body, "b\n");
    assert_eq!(call(app, "GET", &side("base", "b.txt"), None, None, None, None).await.status, StatusCode::NOT_FOUND, "b.txt is new");
    assert_eq!(call(app, "GET", &side("middle", "a.txt"), None, None, None, None).await.status, StatusCode::BAD_REQUEST);
    // Require the "build" check.
    let settings = call(app, "GET", "/andy/demo/settings", None, Some(&andy), None, None).await;
    let csrf = csrf_of(&settings.body);
    assert_eq!(
        call(app, "POST", "/andy/demo/settings/checks", None, Some(&andy), None, Some(&format!("_csrf={csrf}&required_checks=build")))
            .await
            .status,
        StatusCode::OK
    );
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/proposals/2", None, None).await;
    assert_eq!(v["landable"], false);
    assert!(v["blockers"][0].as_str().unwrap().contains("build"), "{v}");
    // A checker reports on the projected state: first running, then passed; the page streams it.
    let (st, v) = api(
        app,
        "POST",
        "/api/v1/repos/andy/demo/checks",
        Some(&andy_ro),
        Some(&format!(r#"{{"state":"{state}","name":"build","status":"running"}}"#)),
    )
    .await;
    assert_eq!(st, StatusCode::FORBIDDEN, "{v}");
    let mut events = app.events.proposals.subscribe();
    let (st, v) = api(
        app,
        "POST",
        "/api/v1/repos/andy/demo/checks",
        Some(&bob_rw),
        Some(&format!(r#"{{"state":"{state}","name":"build","status":"passed","summary":"42 tests","url":"https://ci.example/1"}}"#)),
    )
    .await;
    assert_eq!(st, StatusCode::CREATED, "{v}");
    let (_, ev) = events.recv().await.unwrap();
    assert_eq!(ev.kind, "check");
    assert_eq!(ev.check.unwrap().name, "build");
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/proposals/2/checks", None, None).await;
    assert_eq!(v[0]["status"], "passed");
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/proposals/2", None, None).await;
    assert_eq!(v["landable"], true, "{v}");
    let page = call(app, "GET", "/andy/demo/proposal/2", None, Some(&andy), None, None).await;
    assert!(page.body.contains("42 tests"), "{}", page.body);
    // The check and the proposal reached the webhook too.
    sqlx::query("UPDATE deliveries SET next_ms = 0").execute(&app.db).await.unwrap();
    oxygenhub::hooks::deliver_due(app).await;
    let kinds: Vec<String> = rx.seen.lock().unwrap().iter().map(|s| s.0.clone()).collect();
    assert!(kinds.contains(&"proposal.opened".to_string()) && kinds.contains(&"check".to_string()), "{kinds:?}");
    let _ = feat;
    let _ = rx.fail_first;

    // The inbox through the API: count, list, mark one read, mark all read.
    let bob_user = mint(bob.clone(), "scopes=user%3Aread").await;
    let bob_id = oxygenhub::db::accounts::account_by_name(&app.db, "bob").await.unwrap().unwrap().id;
    oxygenhub::db::notify::mark_read(&app.db, bob_id, None).await.unwrap();
    oxygenhub::db::notify::add(
        &app.db,
        oxygenhub::db::notify::New {
            account_id: bob_id,
            repo_id: None,
            reason: oxygenhub::db::notify::Reason::Participating,
            kind: "mention",
            title: "andy/demo#1: Bug",
            url: "/andy/demo/issue/1",
            actor: "andy",
        },
    )
    .await
    .unwrap();
    oxygenhub::db::notify::add(
        &app.db,
        oxygenhub::db::notify::New {
            account_id: bob_id,
            repo_id: None,
            reason: oxygenhub::db::notify::Reason::Participating,
            kind: "review",
            title: "andy/demo#2: Feat",
            url: "/andy/demo/proposal/2",
            actor: "andy",
        },
    )
    .await
    .unwrap();
    let (st, v) = api(app, "GET", "/api/v1/notifications", Some(&bob_user), None).await;
    assert_eq!(st, StatusCode::OK, "{v}");
    assert_eq!(v["unread"], 2);
    assert_eq!(v["items"][0]["read"], false);
    assert!(v["items"][0]["url"].as_str().unwrap().starts_with(&h.base), "absolute urls: {v}");
    let first = v["items"][0]["id"].as_i64().unwrap();
    let (st, _) = api(app, "POST", &format!("/api/v1/notifications/{first}/read"), Some(&bob_user), None).await;
    assert_eq!(st, StatusCode::NO_CONTENT);
    assert_eq!(api(app, "GET", "/api/v1/notifications", Some(&bob_user), None).await.1["unread"], 1);
    assert_eq!(api(app, "POST", "/api/v1/notifications/read", Some(&bob_user), None).await.0, StatusCode::NO_CONTENT);
    assert_eq!(api(app, "GET", "/api/v1/notifications", Some(&bob_user), None).await.1["unread"], 0);
    // Another account's notification is not the caller's to clear, and a token without user:read sees nothing.
    assert_eq!(api(app, "GET", "/api/v1/notifications", Some(&bob_rw), None).await.0, StatusCode::FORBIDDEN);

    // Review requests: the author asks andy; andy is told, reviews, and the
    // request is answered; the author hears of the review.
    let andy_user = mint(andy.clone(), "scopes=user%3Aread").await;
    let andy_pw = mint(andy.clone(), "scopes=proposals%3Awrite").await;
    oxygenhub::db::notify::mark_read(&app.db, oxygenhub::db::accounts::account_by_name(&app.db, "andy").await.unwrap().unwrap().id, None)
        .await
        .unwrap();
    let path = "/api/v1/repos/andy/demo/proposals/2/reviewers";
    let (st, v) = api(app, "POST", path, Some(&bob_rw), Some(r#"{"reviewers":["nobody"]}"#)).await;
    assert_eq!(st, StatusCode::UNPROCESSABLE_ENTITY, "{v}");
    let (st, v) = api(app, "POST", path, Some(&bob_rw), Some(r#"{"reviewers":["bob"]}"#)).await;
    assert_eq!(st, StatusCode::UNPROCESSABLE_ENTITY, "the author cannot review: {v}");
    let (st, v) = api(app, "POST", path, Some(&bob_rw), Some(r#"{"reviewers":["@andy"]}"#)).await;
    assert_eq!((st, v.clone()), (StatusCode::OK, serde_json::json!(["andy"])));
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/proposals/2", None, None).await;
    assert_eq!(v["requested_reviewers"], serde_json::json!(["andy"]));
    let (_, v) = api(app, "GET", "/api/v1/notifications", Some(&andy_user), None).await;
    assert!(v["items"].as_array().unwrap().iter().any(|n| n["kind"] == "proposal.review_requested" && n["read"] == false), "{v}");
    let page = call(app, "GET", "/andy/demo/proposal/2", None, Some(&andy), None, None).await;
    assert!(page.body.contains("Reviewers") && page.body.contains("review requested"), "{}", page.body);
    let (st, _) =
        api(app, "POST", "/api/v1/repos/andy/demo/proposals/2/reviews", Some(&andy_pw), Some(r#"{"verdict":"comment","body":"ok"}"#)).await;
    assert_eq!(st, StatusCode::CREATED);
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/proposals/2", None, None).await;
    assert_eq!(v["requested_reviewers"], serde_json::json!([]), "answered by the review");
    let (_, v) = api(app, "GET", "/api/v1/notifications", Some(&bob_user), None).await;
    assert!(v["items"].as_array().unwrap().iter().any(|n| n["kind"] == "proposal.review" && n["read"] == false), "{v}");
    // Asking again and withdrawing it.
    api(app, "POST", path, Some(&bob_rw), Some(r#"{"reviewers":["andy"]}"#)).await;
    let (st, _) = api(app, "DELETE", &format!("{path}/andy"), Some(&bob_rw), None).await;
    assert_eq!(st, StatusCode::NO_CONTENT);
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/proposals/2", None, None).await;
    assert_eq!(v["requested_reviewers"], serde_json::json!([]));
    // oxygenhub#84: the page's menu sets who is asked, all at once.
    let page = call(app, "GET", "/andy/demo/proposal/2", None, Some(&bob), None, None).await;
    assert!(
        page.body.contains("Request reviews") && page.body.contains("name=\"username\" value=\"andy\""),
        "the reviewers menu lists andy"
    );
    let csrf = csrf_of(&page.body);
    let form = |list: &str| format!("_csrf={csrf}&action=set{list}");
    call(app, "POST", "/andy/demo/proposal/2/reviewers", None, Some(&bob), None, Some(&form("&username=andy"))).await;
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/proposals/2", None, None).await;
    assert_eq!(v["requested_reviewers"], serde_json::json!(["andy"]));
    call(app, "POST", "/andy/demo/proposal/2/reviewers", None, Some(&bob), None, Some(&form(""))).await;
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/proposals/2", None, None).await;
    assert_eq!(v["requested_reviewers"], serde_json::json!([]), "an empty menu withdraws them");

    // A source bookmark with `/` in its name, as a feature/N-name workflow
    // makes them: by name, and as this repository's owner/name:bookmark.
    for (b, file) in [("feature/1-one", "c.txt"), ("feature/2-two", "d.txt")] {
        client.bookmark_create(b, Some(&[base])).unwrap();
        client.bookmark_switch(b, false).unwrap();
        write(work.path(), file, b"c\n");
        client.snapshot("t").unwrap();
        client.commit(b, &[]).unwrap();
        assert!(client.push_bookmark("origin", b, false).unwrap().iter().all(|r| r.ok));
    }
    for source in ["feature/1-one", "andy/demo:feature/2-two"] {
        let body = format!(r#"{{"title":"Slash","target":"main","source":"{source}"}}"#);
        let (st, v) = api(app, "POST", "/api/v1/repos/andy/demo/proposals", Some(&bob_rw), Some(&body)).await;
        assert_eq!(st, StatusCode::CREATED, "{source}: {v}");
        let n = v["number"].as_i64().unwrap();
        let page = call(app, "GET", &format!("/andy/demo/proposal/{n}"), None, None, None, None).await;
        assert_eq!(page.status, StatusCode::OK);
        assert!(page.body.contains("feature/"), "the page names its source");
    }
    let body = r#"{"title":"None","target":"main","source":"feature/3-none"}"#;
    let (st, v) = api(app, "POST", "/api/v1/repos/andy/demo/proposals", Some(&bob_rw), Some(body)).await;
    assert!(st.is_client_error() && v.to_string().contains("no bookmark feature/3-none"), "{st} {v}");

    // oxygenhub#76: a proposal's title and description are edited through
    // the API by its author or a maintainer; what is not given stays.
    let edit = |token: &str, number: i64, body: &str| {
        let (app, token, body) = (app.clone(), token.to_string(), body.to_string());
        async move { api(&app, "PATCH", &format!("/api/v1/repos/andy/demo/proposals/{number}"), Some(&token), Some(&body)).await }
    };
    let (st, v) = edit(&bob_rw, 2, r#"{"body":"8 of 8, not 9 of 9"}"#).await;
    assert_eq!(st, StatusCode::OK, "{v}");
    assert_eq!((v["title"].as_str(), v["body"].as_str()), (Some("Feat"), Some("8 of 8, not 9 of 9")), "{v}");
    let (st, v) = edit(&andy_pw, 2, r#"{"title":"Feat, renamed"}"#).await;
    assert_eq!(st, StatusCode::OK, "a maintainer edits another's proposal: {v}");
    assert_eq!((v["title"].as_str(), v["body"].as_str()), (Some("Feat, renamed"), Some("8 of 8, not 9 of 9")));
    assert_eq!(edit(&bob_rw, 2, r#"{"title":"  "}"#).await.0, StatusCode::BAD_REQUEST, "a title is required");
    assert_eq!(edit(&bob_rw, 99, r#"{"body":"x"}"#).await.0, StatusCode::NOT_FOUND);
    // Andy's own proposal: Bob, a writer but not a maintainer, cannot edit it.
    let (st, v) = api(
        app,
        "POST",
        "/api/v1/repos/andy/demo/proposals",
        Some(&andy_pw),
        Some(r#"{"title":"Andy's","target":"main","source":"feature/1-one"}"#),
    )
    .await;
    assert_eq!(st, StatusCode::CREATED, "{v}");
    let n = v["number"].as_i64().unwrap();
    assert_eq!(edit(&bob_rw, n, r#"{"body":"mine now"}"#).await.0, StatusCode::FORBIDDEN);
    assert_eq!(edit(&andy_ro, 2, r#"{"body":"x"}"#).await.0, StatusCode::FORBIDDEN, "a read-only token cannot edit");

    // oxygenhub#80: labels on a proposal, the whole set by name, checked
    // before anything changes, shown in its JSON.
    for l in ["ui", "flow"] {
        let body = format!(r#"{{"name":"{l}"}}"#);
        assert_eq!(api(app, "POST", "/api/v1/repos/andy/demo/labels", Some(&andy_admin), Some(&body)).await.0, StatusCode::CREATED);
    }
    assert_eq!(edit(&bob_rw, 2, r#"{"labels":["ui"]}"#).await.0, StatusCode::FORBIDDEN, "labels need triage, not authorship");
    let (st, v) = edit(&andy_pw, 2, r#"{"labels":["ui","flow"]}"#).await;
    assert_eq!(st, StatusCode::OK, "{v}");
    let names = |v: &serde_json::Value| -> Vec<String> {
        v["labels"].as_array().unwrap().iter().map(|l| l["name"].as_str().unwrap().to_string()).collect()
    };
    assert_eq!(names(&v), ["flow", "ui"]);
    assert_eq!(v["title"], "Feat, renamed", "labels alone leave the text");
    let (st, _) = edit(&andy_pw, 2, r#"{"labels":["ui","nope"]}"#).await;
    assert_eq!(st, StatusCode::BAD_REQUEST, "an unknown label is refused");
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/proposals/2", None, None).await;
    assert_eq!(names(&v), ["flow", "ui"], "and nothing changed");
    let (_, v) = edit(&andy_pw, 2, r#"{"labels":["flow"]}"#).await;
    assert_eq!(names(&v), ["flow"]);
    assert_eq!(edit(&andy_ro, 2, r#"{"labels":[]}"#).await.0, StatusCode::FORBIDDEN);
}

#[tokio::test(flavor = "multi_thread")]
async fn api_issue_triage_and_labels() {
    let h = hub().await;
    let app = &h.app;
    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))
        .await
        .cookie
        .unwrap();
    let bob = call(app, "POST", "/register", None, None, None, Some("username=bob&email=b%40example.com&password=correct-horse-battery"))
        .await
        .cookie
        .unwrap();
    let mint = |cookie: String, scopes: &'static str| {
        let app = app.clone();
        async move {
            let page = call(&app, "GET", "/settings/tokens", None, Some(&cookie), None, None).await;
            let csrf = csrf_of(&page.body);
            let r = call(&app, "POST", "/settings/tokens", None, Some(&cookie), None, Some(&format!("_csrf={csrf}&name=t&{scopes}"))).await;
            r.body.split("oxyhub_").nth(1).map(|s| format!("oxyhub_{}", s.split('<').next().unwrap().trim())).unwrap()
        }
    };
    let andy_t = mint(andy, "scopes=repo%3Aadmin").await;
    let bob_t = mint(bob, "scopes=repo%3Aread&scopes=repo%3Awrite").await;
    let (st, _) = api(app, "POST", "/api/v1/repos", Some(&andy_t), Some(r#"{"owner":"andy","name":"demo","visibility":"public"}"#)).await;
    assert_eq!(st, StatusCode::CREATED);

    // Labels through the API; bad colours and non-triage callers are refused.
    let (st, v) = api(
        app,
        "POST",
        "/api/v1/repos/andy/demo/labels",
        Some(&andy_t),
        Some(r##"{"name":"bug","colour":"#ff0000","description":"Broken"}"##),
    )
    .await;
    assert_eq!((st, v["name"].as_str()), (StatusCode::CREATED, Some("bug")));
    assert_eq!(api(app, "POST", "/api/v1/repos/andy/demo/labels", Some(&andy_t), Some(r#"{"name":"flow"}"#)).await.0, StatusCode::CREATED);
    assert_eq!(
        api(app, "POST", "/api/v1/repos/andy/demo/labels", Some(&andy_t), Some(r##"{"name":"x","colour":"red"}"##)).await.0,
        StatusCode::BAD_REQUEST
    );
    assert_eq!(api(app, "POST", "/api/v1/repos/andy/demo/labels", Some(&bob_t), Some(r#"{"name":"mine"}"#)).await.0, StatusCode::FORBIDDEN);
    let (_, labels) = api(app, "GET", "/api/v1/repos/andy/demo/labels", None, None).await;
    assert_eq!(labels.as_array().unwrap().len(), 2);

    // An issue created with its labels and assignee in one call.
    let (st, v) = api(
        app,
        "POST",
        "/api/v1/repos/andy/demo/issues",
        Some(&andy_t),
        Some(r#"{"title":"Crash","body":"b","labels":["bug"],"assignees":["bob"]}"#),
    )
    .await;
    assert_eq!(st, StatusCode::CREATED, "{v}");
    assert_eq!(v["labels"][0]["name"], "bug");
    assert_eq!(v["assignees"], serde_json::json!(["bob"]));
    let n = v["number"].as_i64().unwrap();
    // Unknown names are refused before anything is created.
    let (st, v) = api(app, "POST", "/api/v1/repos/andy/demo/issues", Some(&andy_t), Some(r#"{"title":"X","labels":["nope"]}"#)).await;
    assert_eq!(st, StatusCode::BAD_REQUEST);
    assert!(v["detail"].as_str().unwrap().contains("no label"));
    let (_, list) = api(app, "GET", "/api/v1/repos/andy/demo/issues?state=all", None, None).await;
    assert_eq!(list.as_array().unwrap().len(), 1, "nothing half-made");
    // Without triage, labels cannot be set, but a plain issue can be opened.
    assert_eq!(
        api(app, "POST", "/api/v1/repos/andy/demo/issues", Some(&bob_t), Some(r#"{"title":"Y","labels":["bug"]}"#)).await.0,
        StatusCode::FORBIDDEN
    );
    let (st, bobs) = api(app, "POST", "/api/v1/repos/andy/demo/issues", Some(&bob_t), Some(r#"{"title":"From Bob"}"#)).await;
    assert_eq!(st, StatusCode::CREATED);
    let bob_n = bobs["number"].as_i64().unwrap();

    // PATCH: the whole label set, assignees and milestone, with events.
    let (st, v) =
        api(app, "PATCH", &format!("/api/v1/repos/andy/demo/issues/{n}"), Some(&andy_t), Some(r#"{"labels":["flow"],"assignees":[]}"#))
            .await;
    assert_eq!(st, StatusCode::OK, "{v}");
    assert_eq!(v["labels"].as_array().unwrap().iter().map(|l| l["name"].as_str().unwrap()).collect::<Vec<_>>(), ["flow"]);
    assert_eq!(v["assignees"], serde_json::json!([]));
    let (st, _) = api(app, "PATCH", &format!("/api/v1/repos/andy/demo/issues/{n}"), Some(&andy_t), Some(r#"{"milestone":"v9"}"#)).await;
    assert_eq!(st, StatusCode::BAD_REQUEST, "no such milestone");
    let issue_page = call(app, "GET", &format!("/andy/demo/issue/{n}"), None, None, None, None).await.body;
    assert!(issue_page.contains("set labels") && issue_page.contains("unassigned"), "timeline events");
    // The author edits their own title; others cannot; nobody but triage sets labels.
    let (st, v) =
        api(app, "PATCH", &format!("/api/v1/repos/andy/demo/issues/{bob_n}"), Some(&bob_t), Some(r#"{"title":"From Bob, clearer"}"#)).await;
    assert_eq!((st, v["title"].as_str()), (StatusCode::OK, Some("From Bob, clearer")));
    assert_eq!(
        api(app, "PATCH", &format!("/api/v1/repos/andy/demo/issues/{n}"), Some(&bob_t), Some(r#"{"title":"mine now"}"#)).await.0,
        StatusCode::FORBIDDEN
    );
    assert_eq!(
        api(app, "PATCH", &format!("/api/v1/repos/andy/demo/issues/{bob_n}"), Some(&bob_t), Some(r#"{"labels":["bug"]}"#)).await.0,
        StatusCode::FORBIDDEN
    );
    assert_eq!(
        api(app, "PATCH", &format!("/api/v1/repos/andy/demo/issues/{n}"), Some(&andy_t), Some(r#"{"title":"  "}"#)).await.0,
        StatusCode::BAD_REQUEST
    );

    // Deleting a label takes it off the issues.
    assert_eq!(api(app, "DELETE", "/api/v1/repos/andy/demo/labels/flow", Some(&andy_t), None).await.0, StatusCode::NO_CONTENT);
    let (_, v) = api(app, "GET", &format!("/api/v1/repos/andy/demo/issues/{n}"), None, None).await;
    assert_eq!(v["labels"], serde_json::json!([]));
    assert_eq!(api(app, "DELETE", "/api/v1/repos/andy/demo/labels/flow", Some(&andy_t), None).await.0, StatusCode::NOT_FOUND);
}

#[tokio::test(flavor = "multi_thread")]
async fn webhook_formats_editing_and_web_issue_events() {
    let h = hub().await;
    let app = &h.app;
    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))
        .await
        .cookie
        .unwrap();
    let page = call(app, "GET", "/settings/tokens", None, Some(&andy), None, None).await;
    let r = call(
        app,
        "POST",
        "/settings/tokens",
        None,
        Some(&andy),
        None,
        Some(&format!("_csrf={}&name=t&scopes=repo%3Aadmin", csrf_of(&page.body))),
    )
    .await;
    let token = r.body.split("oxyhub_").nth(1).map(|s| format!("oxyhub_{}", s.split('<').next().unwrap().trim())).unwrap();
    assert_eq!(
        api(app, "POST", "/api/v1/repos", Some(&token), Some(r#"{"owner":"andy","name":"demo","visibility":"public"}"#)).await.0,
        StatusCode::CREATED
    );
    let rx = receiver().await;
    *rx.fail_first.lock().unwrap() = false;
    let settings = call(app, "GET", "/andy/demo/settings", None, Some(&andy), None, None).await.body;
    let csrf = csrf_of(&settings);
    let form = |f: String| {
        let andy = andy.clone();
        async move { call(app, "POST", "/andy/demo/settings/hooks", None, Some(&andy), None, Some(&f)).await.body }
    };
    let url = rx.url.replace(':', "%3A").replace('/', "%2F");
    assert!(form(format!("_csrf={csrf}&url={url}&format=discord&events=*")).await.contains("Webhook added"));
    let hook = oxygenhub::db::hooks::hooks_for_repo(&app.db, 1).await.unwrap().remove(0);
    assert_eq!(hook.format, "discord");
    // Ping arrives as a Discord message.
    form(format!("_csrf={csrf}&id={}&action=ping", hook.id)).await;
    let mut got = String::new();
    for _ in 0..100 {
        if let Some((_, _, body)) = rx.seen.lock().unwrap().first() {
            got = body.clone();
        }
        if !got.is_empty() {
            break;
        }
        tokio::time::sleep(std::time::Duration::from_millis(50)).await;
    }
    let v: serde_json::Value = serde_json::from_str(&got).unwrap();
    assert_eq!(v["embeds"][0]["title"], "OxygenHub is connected");
    assert_eq!(v["allowed_mentions"]["parse"], serde_json::json!([]));
    let page = call(app, "GET", "/andy/demo/settings", None, Some(&andy), None, None).await.body;
    assert!(page.contains("last delivery <span class=\"sig sig-valid\">✔</span> 200"), "the table shows how it went");

    // Editing: a blank URL and secret keep theirs; format, events and active change.
    assert!(form(format!("_csrf={csrf}&id={}&action=update&url=&secret=&events=issue&format=oxygenhub&active=1", hook.id))
        .await
        .contains("Webhook saved"));
    let edited = oxygenhub::db::hooks::hook(&app.db, hook.id).await.unwrap().unwrap();
    assert_eq!(
        (edited.url.as_str(), edited.events.as_str(), edited.format.as_str(), edited.active),
        (rx.url.as_str(), "issue", "oxygenhub", true)
    );
    assert!(form(format!("_csrf={csrf}&id={}&action=update&url=ftp%3A%2F%2Fx&events=*", hook.id)).await.contains("starts with http"));

    // An issue opened on the web now reaches the hook, as the signed envelope.
    let new = call(app, "GET", "/andy/demo/issues/new", None, Some(&andy), None, None).await.body;
    call(
        app,
        "POST",
        "/andy/demo/issues/new",
        None,
        Some(&andy),
        None,
        Some(&format!("_csrf={}&title=From+the+web&body=hello", csrf_of(&new))),
    )
    .await;
    let mut envelope = None;
    for _ in 0..100 {
        envelope = rx.seen.lock().unwrap().iter().find(|(e, _, _)| e == "issue.opened").cloned();
        if envelope.is_some() {
            break;
        }
        tokio::time::sleep(std::time::Duration::from_millis(50)).await;
    }
    let (_, sig, body) = envelope.expect("issue.opened delivered");
    let v: serde_json::Value = serde_json::from_str(&body).unwrap();
    assert_eq!(v["data"]["issue"]["title"], "From the web");
    assert!(sig.starts_with("blake3-keyed="));
    // A disabled hook through the edit form (no active box).
    form(format!("_csrf={csrf}&id={}&action=update&url=&events=*&format=oxygenhub", hook.id)).await;
    assert!(!oxygenhub::db::hooks::hook(&app.db, hook.id).await.unwrap().unwrap().active);
}

#[tokio::test(flavor = "multi_thread")]
async fn api_projects() {
    let h = hub().await;
    let app = &h.app;
    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))
        .await
        .cookie
        .unwrap();
    let bob = call(app, "POST", "/register", None, None, None, Some("username=bob&email=b%40example.com&password=correct-horse-battery"))
        .await
        .cookie
        .unwrap();
    let mint = |cookie: String, scopes: &'static str| {
        let app = app.clone();
        async move {
            let page = call(&app, "GET", "/settings/tokens", None, Some(&cookie), None, None).await;
            let csrf = csrf_of(&page.body);
            let r = call(&app, "POST", "/settings/tokens", None, Some(&cookie), None, Some(&format!("_csrf={csrf}&name=t&{scopes}"))).await;
            r.body.split("oxyhub_").nth(1).map(|s| format!("oxyhub_{}", s.split('<').next().unwrap().trim())).unwrap()
        }
    };
    let a = mint(andy, "scopes=repo%3Aadmin").await;
    let b = mint(bob, "scopes=repo%3Aread&scopes=repo%3Awrite").await;
    api(app, "POST", "/api/v1/repos", Some(&a), Some(r#"{"owner":"andy","name":"demo","visibility":"public"}"#)).await;
    api(app, "POST", "/api/v1/repos/andy/demo/issues", Some(&a), Some(r#"{"title":"Crash"}"#)).await;

    let (st, p) = api(app, "POST", "/api/v1/projects/andy", Some(&a), Some(r#"{"title":"Roadmap","description":"Next"}"#)).await;
    assert_eq!((st, p["number"].as_i64()), (StatusCode::CREATED, Some(1)), "{p}");
    assert!(p["url"].as_str().unwrap().ends_with("/projects/andy/1"));
    assert_eq!(api(app, "POST", "/api/v1/projects/andy", Some(&b), Some(r#"{"title":"Mine"}"#)).await.0, StatusCode::FORBIDDEN);
    assert_eq!(api(app, "POST", "/api/v1/projects/nobody", Some(&a), Some(r#"{"title":"X"}"#)).await.0, StatusCode::NOT_FOUND);

    // Cards by reference, into a column by name, and a note into the first column.
    let (st, card) = api(app, "POST", "/api/v1/projects/andy/1/cards", Some(&a), Some(r#"{"reference":"demo#1","column":"doing"}"#)).await;
    assert_eq!(st, StatusCode::CREATED, "{card}");
    assert_eq!(
        (card["kind"].as_str(), card["reference"].as_str(), card["title"].as_str(), card["state"].as_str()),
        (Some("issue"), Some("andy/demo#1"), Some("Crash"), Some("open"))
    );
    let (st, v) = api(app, "POST", "/api/v1/projects/andy/1/cards", Some(&a), Some(r#"{"reference":"demo#1"}"#)).await;
    assert_eq!(st, StatusCode::BAD_REQUEST);
    assert!(v["detail"].as_str().unwrap().contains("already on this project"));
    assert_eq!(
        api(app, "POST", "/api/v1/projects/andy/1/cards", Some(&a), Some(r#"{"reference":"demo#1","column":"nope"}"#)).await.0,
        StatusCode::BAD_REQUEST
    );
    let (st, note) = api(app, "POST", "/api/v1/projects/andy/1/cards", Some(&a), Some(r#"{"note":"Write docs"}"#)).await;
    assert_eq!((st, note["kind"].as_str()), (StatusCode::CREATED, Some("note")));
    assert_eq!(api(app, "POST", "/api/v1/projects/andy/1/cards", Some(&b), Some(r#"{"note":"hi"}"#)).await.0, StatusCode::FORBIDDEN);

    // Move and read the board.
    let id = card["id"].as_i64().unwrap();
    assert_eq!(
        api(app, "PATCH", &format!("/api/v1/projects/andy/1/cards/{id}"), Some(&a), Some(r#"{"column":"Done"}"#)).await.0,
        StatusCode::NO_CONTENT
    );
    let (_, board) = api(app, "GET", "/api/v1/projects/andy/1", None, None).await;
    let names: Vec<(&str, usize)> =
        board["columns"].as_array().unwrap().iter().map(|c| (c["name"].as_str().unwrap(), c["cards"].as_array().unwrap().len())).collect();
    assert_eq!(names, [("Backlog", 1), ("Doing", 0), ("Done", 1)]);
    assert_eq!(board["columns"][2]["cards"][0]["reference"], "andy/demo#1");

    // Private: hidden from others; closed: read-only; then remove a card.
    let (_, edited) = api(app, "PATCH", "/api/v1/projects/andy/1", Some(&a), Some(r#"{"private":true}"#)).await;
    assert_eq!(edited["public"], false);
    assert_eq!(api(app, "GET", "/api/v1/projects/andy/1", Some(&b), None).await.0, StatusCode::NOT_FOUND);
    assert_eq!(api(app, "GET", "/api/v1/projects/andy", None, None).await.1, serde_json::json!([]));
    api(app, "PATCH", "/api/v1/projects/andy/1", Some(&a), Some(r#"{"closed":true}"#)).await;
    assert_eq!(api(app, "POST", "/api/v1/projects/andy/1/cards", Some(&a), Some(r#"{"note":"late"}"#)).await.0, StatusCode::CONFLICT);
    api(app, "PATCH", "/api/v1/projects/andy/1", Some(&a), Some(r#"{"closed":false}"#)).await;
    assert_eq!(api(app, "DELETE", &format!("/api/v1/projects/andy/1/cards/{id}"), Some(&a), None).await.0, StatusCode::NO_CONTENT);
    assert_eq!(api(app, "DELETE", &format!("/api/v1/projects/andy/1/cards/{id}"), Some(&a), None).await.0, StatusCode::NOT_FOUND);
}

#[tokio::test(flavor = "multi_thread")]
async fn api_required_checks() {
    let h = hub().await;
    let app = &h.app;
    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))
        .await
        .cookie
        .unwrap();
    let page = call(app, "GET", "/settings/tokens", None, Some(&andy), None, None).await;
    let csrf = csrf_of(&page.body);
    let mint = |scopes: &'static str| {
        let (app, andy, csrf) = (app.clone(), andy.clone(), csrf.clone());
        async move {
            let r = call(&app, "POST", "/settings/tokens", None, Some(&andy), None, Some(&format!("_csrf={csrf}&name=t&{scopes}"))).await;
            r.body.split("oxyhub_").nth(1).map(|s| format!("oxyhub_{}", s.split('<').next().unwrap().trim())).unwrap()
        }
    };
    let admin = mint("scopes=repo%3Aadmin").await;
    let write = mint("scopes=repo%3Aread&scopes=repo%3Awrite").await;
    api(app, "POST", "/api/v1/repos", Some(&admin), Some(r#"{"owner":"andy","name":"demo","visibility":"public"}"#)).await;

    let (st, v) = api(app, "GET", "/api/v1/repos/andy/demo/checks/required", None, None).await;
    assert_eq!((st, v["names"].clone()), (StatusCode::OK, serde_json::json!([])));
    let (st, v) = api(
        app,
        "PUT",
        "/api/v1/repos/andy/demo/checks/required",
        Some(&admin),
        Some(r#"{"names":["flow/test"," flow/fmt ","flow/test",""]}"#),
    )
    .await;
    assert_eq!((st, v["names"].clone()), (StatusCode::OK, serde_json::json!(["flow/fmt", "flow/test"])), "trimmed, sorted, once each");
    assert_eq!(oxygenhub::db::hooks::required_checks(&app.db, 1).await.unwrap(), ["flow/fmt", "flow/test"]);
    assert_eq!(
        api(app, "GET", "/api/v1/repos/andy/demo/checks/required", None, None).await.1["names"],
        serde_json::json!(["flow/fmt", "flow/test"])
    );
    assert_eq!(
        api(app, "PUT", "/api/v1/repos/andy/demo/checks/required", Some(&write), Some(r#"{"names":[]}"#)).await.0,
        StatusCode::FORBIDDEN,
        "repo:admin only"
    );
    assert_eq!(
        api(app, "PUT", "/api/v1/repos/andy/demo/checks/required", Some(&admin), Some(r#"{"names":["a,b"]}"#)).await.0,
        StatusCode::BAD_REQUEST
    );
    // The settings page shows the same list.
    assert!(call(app, "GET", "/andy/demo/settings", None, Some(&andy), None, None).await.body.contains("flow/fmt, flow/test"));
}

/// OxygenFlow per repository: site administrators turn it on or off in
/// the repository's settings; hub.toml's `[flow] repos` is the default.
#[tokio::test(flavor = "multi_thread")]
async fn flow_is_switched_per_repository_by_site_admins() {
    let h = hub().await;
    let app = &h.app;
    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))
        .await
        .cookie
        .unwrap();
    let page = call(app, "GET", "/new", None, Some(&andy), None, None).await;
    call(app, "POST", "/new", None, Some(&andy), None, Some(&format!("_csrf={}&owner=andy&name=demo", csrf_of(&page.body)))).await;
    let row = || async { oxygenhub::db::repos::get(&app.db, "andy", "demo").await.unwrap().unwrap() };
    assert!(!oxygenhub::flow::enabled(app, &row().await), "not in [flow] repos");
    let tab = call(app, "GET", "/andy/demo/flow", None, Some(&andy), None, None).await;
    assert!(tab.body.contains("not enabled") && tab.body.contains("/andy/demo/settings#flow"));

    let set = |value: &'static str| {
        let (app, andy) = (app.clone(), andy.clone());
        async move {
            let settings = call(&app, "GET", "/andy/demo/settings", None, Some(&andy), None, None).await;
            call(
                &app,
                "POST",
                "/andy/demo/settings/flow",
                None,
                Some(&andy),
                None,
                Some(&format!("_csrf={}&flow={value}", csrf_of(&settings.body))),
            )
            .await
        }
    };
    // A repository admin who is not a site admin sees the state but cannot change it.
    let id = oxygenhub::db::accounts::account_by_name(&app.db, "andy").await.unwrap().unwrap().id;
    oxygenhub::db::accounts::set_admin(&app.db, id, false).await.unwrap();
    let settings = call(app, "GET", "/andy/demo/settings", None, Some(&andy), None, None).await;
    assert!(settings.body.contains("do not start runs") && !settings.body.contains("name=\"flow\""));
    let r = set("on").await;
    assert!(r.body.contains("Only site administrators"), "{}", r.body);
    assert_eq!(row().await.flow, "");

    oxygenhub::db::accounts::set_admin(&app.db, id, true).await.unwrap();
    let r = set("on").await;
    assert!(r.body.contains("OxygenFlow is on"), "{}", r.body);
    assert_eq!(row().await.flow, "on");
    assert!(oxygenhub::flow::enabled(app, &row().await));
    assert!(!call(app, "GET", "/andy/demo/flow", None, Some(&andy), None, None).await.body.contains("not enabled"));
    set("off").await;
    assert!(!oxygenhub::flow::enabled(app, &row().await));
    set("default").await;
    assert_eq!(row().await.flow, "");
    assert!(set("sometimes").await.body.contains("Pick on, off"));
}

/// Deleting bookmarks (hub spec §6.4): pushed deletions and the delete
/// button, never the repository's default bookmark as the hub sets it.
#[tokio::test(flavor = "multi_thread")]
async fn bookmarks_are_deleted_by_push_and_on_the_web() {
    let h = hub().await;
    let app = &h.app;
    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))
        .await
        .cookie
        .unwrap();
    let page = call(app, "GET", "/new", None, Some(&andy), None, None).await;
    call(app, "POST", "/new", None, Some(&andy), None, Some(&format!("_csrf={}&owner=andy&name=demo", csrf_of(&page.body)))).await;
    let url = format!("{}/andy/demo", h.base);
    let work = tempfile::tempdir().unwrap();
    let (w, u) = (work.path().to_path_buf(), url.clone());
    let client = tokio::task::spawn_blocking(move || {
        let mut c = Repo::init(&w).unwrap();
        c.config.set("remote.origin.url", &u).unwrap();
        c.config.set("remote.origin.token", "site").unwrap();
        c.save_config().unwrap();
        write(&w, "a.txt", b"a\n");
        c.commit("a", &[]).unwrap();
        assert!(c.push("origin", false).unwrap()[0].ok);
        for b in ["develop", "feature/x", "stray"] {
            c.bookmark_create(b, None).unwrap();
            assert!(c.push_bookmark("origin", b, false).unwrap()[0].ok);
        }
        // A pushed deletion.
        let r = c.push_delete("origin", "feature/x").unwrap();
        assert!(r[0].ok, "{r:?}");
        c
    })
    .await
    .unwrap();
    let page = call(app, "GET", "/andy/demo/bookmarks", None, Some(&andy), None, None).await;
    assert!(!page.body.contains(">feature/x<") && page.body.contains(">stray<"), "{}", page.body);
    assert!(page.body.contains("/andy/demo/bookmarks/delete"), "writers see delete buttons");
    let anon = call(app, "GET", "/andy/demo/bookmarks", None, None, None, None).await;
    assert!(!anon.body.contains("/bookmarks/delete"));

    // The hub's default, not the repository's config, is protected: make
    // develop the default, then main can go and develop cannot.
    let row = oxygenhub::db::repos::get(&app.db, "andy", "demo").await.unwrap().unwrap();
    oxygenhub::db::repos::set_default_bookmark(&app.db, row.id, "develop").await.unwrap();
    let client = tokio::task::spawn_blocking(move || {
        let r = client.push_delete("origin", "develop").unwrap();
        assert!(!r[0].ok && r[0].reason.contains("default bookmark"), "{r:?}");
        let r = client.push_delete("origin", "main").unwrap();
        assert!(r[0].ok, "{r:?}");
        client
    })
    .await
    .unwrap();
    drop(client);

    // On the web: a writer deletes stray; the default is refused.
    let form = |b: &'static str| {
        let (app, andy) = (app.clone(), andy.clone());
        async move {
            let page = call(&app, "GET", "/andy/demo/bookmarks", None, Some(&andy), None, None).await;
            call(
                &app,
                "POST",
                "/andy/demo/bookmarks/delete",
                None,
                Some(&andy),
                None,
                Some(&format!("_csrf={}&bookmark={b}", csrf_of(&page.body))),
            )
            .await
        }
    };
    let r = form("stray").await;
    assert!(r.body.contains("Deleted stray"), "{}", r.body);
    assert!(!r.body.contains(">stray<"));
    let r = form("develop").await;
    assert!(r.body.contains("is the default bookmark"), "{}", r.body);
    let r = form("nope").await;
    assert!(r.body.contains("There is no bookmark nope"), "{}", r.body);
    let pushes = call(app, "GET", "/andy/demo/pushes", None, Some(&andy), None, None).await;
    assert!(pushes.body.contains("deleted on the web"), "logged like a push");
    // Anonymous visitors cannot.
    assert_ne!(
        call(app, "POST", "/andy/demo/bookmarks/delete", None, None, None, Some("_csrf=x&bookmark=develop")).await.status,
        StatusCode::OK
    );
}

/// A change signed by a key no account has linked says so, on its page
/// and in the API (feedback 14).
#[tokio::test(flavor = "multi_thread")]
async fn changes_signed_by_unlinked_keys_say_so() {
    let h = hub().await;
    let app = &h.app;
    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))
        .await
        .cookie
        .unwrap();
    let page = call(app, "GET", "/new", None, Some(&andy), None, None).await;
    call(app, "POST", "/new", None, Some(&andy), None, Some(&format!("_csrf={}&owner=andy&name=demo", csrf_of(&page.body)))).await;
    let url = format!("{}/andy/demo", h.base);
    let work = tempfile::tempdir().unwrap();
    let (w, u, home) = (work.path().to_path_buf(), url.clone(), work.path().join(".home"));
    let hash = tokio::task::spawn_blocking(move || {
        let mut c = Repo::init(&w.join("r")).unwrap().with_home(home);
        c.config.set("remote.origin.url", &u).unwrap();
        c.config.set("remote.origin.token", "site").unwrap();
        c.save_config().unwrap();
        c.create_identity("Ada", "ada@example.org", oxy_core::repo::IdentityScope::Repo).unwrap();
        write(&w.join("r"), "a.txt", b"a\n");
        let h = c.commit("signed by Ada", &[]).unwrap();
        assert!(c.push("origin", false).unwrap()[0].ok);
        h.to_hex()
    })
    .await
    .unwrap();
    let (st, v) = api(app, "GET", &format!("/api/v1/repos/andy/demo/changes/{hash}"), None, None).await;
    assert_eq!(st, StatusCode::OK, "{v}");
    assert!(v["change"]["author"]["account"].is_null(), "{v}");
    assert!(v["change"]["author"]["note"].as_str().unwrap().contains("not linked"), "{v}");
    let page = call(app, "GET", &format!("/andy/demo/change/{hash}"), None, Some(&andy), None, None).await;
    assert!(page.body.contains("key not linked") && page.body.contains("/settings/keys"), "a signed-in viewer is pointed at Settings");
    let anon = call(app, "GET", &format!("/andy/demo/change/{hash}"), None, None, None, None).await;
    assert!(anon.body.contains("key not linked") && !anon.body.contains("link your key"));
}

/// Function history (hub spec §6.6): the file page lists a file's
/// functions, and a function's page lists exactly the changes to its lines.
#[tokio::test(flavor = "multi_thread")]
async fn a_function_has_its_own_history() {
    let h = hub().await;
    let app = &h.app;
    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))
        .await
        .cookie
        .unwrap();
    let page = call(app, "GET", "/new", None, Some(&andy), None, None).await;
    call(app, "POST", "/new", None, Some(&andy), None, Some(&format!("_csrf={}&owner=andy&name=demo", csrf_of(&page.body)))).await;
    let url = format!("{}/andy/demo", h.base);
    let work = tempfile::tempdir().unwrap();
    let w = work.path().to_path_buf();
    tokio::task::spawn_blocking(move || {
        let mut c = Repo::init(&w).unwrap();
        c.config.set("remote.origin.url", &url).unwrap();
        c.config.set("remote.origin.token", "site").unwrap();
        c.save_config().unwrap();
        let steps = [
            ("add lib", "use x;\n\nimpl Repo {\n    fn log(&self) {\n        one();\n    }\n}\n"),
            ("change the import", "use y;\n\nimpl Repo {\n    fn log(&self) {\n        one();\n    }\n}\n"),
            ("log twice", "use y;\n\nimpl Repo {\n    fn log(&self) {\n        one();\n        one();\n    }\n}\n"),
        ];
        for (msg, text) in steps {
            write(&w, "src/lib.rs", text.as_bytes());
            c.commit(msg, &[]).unwrap();
        }
        assert!(c.push("origin", false).unwrap()[0].ok);
    })
    .await
    .unwrap();
    let file = call(app, "GET", "/andy/demo/file/main/src/lib.rs", None, None, None, None).await.body;
    assert!(file.contains("Functions") && file.contains("/andy/demo/function/main/src/lib.rs?start=4&end=7&name=Repo%3A%3Alog"), "{file}");
    let r = call(app, "GET", "/andy/demo/function/main/src/lib.rs?start=4&end=7&name=Repo%3A%3Alog", None, None, None, None).await;
    assert_eq!(r.status, StatusCode::OK, "{}", r.body);
    assert!(r.body.contains("History of <code>Repo::log</code>") && r.body.contains("2 changes"), "{}", r.body);
    assert!(r.body.contains("log twice") && r.body.contains("add lib") && !r.body.contains("change the import"));
    let bad = call(app, "GET", "/andy/demo/function/main/src/lib.rs?start=4&end=99", None, None, None, None).await;
    assert_ne!(bad.status, StatusCode::OK);
}

/// Swimlanes (hub spec §6.7): independent changes in their own lanes,
/// dependency edges, linked cards.
#[tokio::test(flavor = "multi_thread")]
async fn a_bookmark_shows_as_swimlanes() {
    let h = hub().await;
    let app = &h.app;
    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))
        .await
        .cookie
        .unwrap();
    let page = call(app, "GET", "/new", None, Some(&andy), None, None).await;
    call(app, "POST", "/new", None, Some(&andy), None, Some(&format!("_csrf={}&owner=andy&name=demo", csrf_of(&page.body)))).await;
    let url = format!("{}/andy/demo", h.base);
    let work = tempfile::tempdir().unwrap();
    let w = work.path().to_path_buf();
    tokio::task::spawn_blocking(move || {
        let mut c = Repo::init(&w).unwrap();
        c.config.set("remote.origin.url", &url).unwrap();
        c.config.set("remote.origin.token", "site").unwrap();
        c.save_config().unwrap();
        // Two files edited independently: two lanes.
        write(&w, "a.txt", b"a\n");
        c.commit("add a", &[]).unwrap();
        write(&w, "b.txt", b"b\n");
        c.commit("add b", &[]).unwrap();
        write(&w, "a.txt", b"a\na2\n");
        c.commit("grow a", &[]).unwrap();
        assert!(c.push("origin", false).unwrap()[0].ok);
    })
    .await
    .unwrap();
    let hist = call(app, "GET", "/andy/demo/changes/main", None, None, None, None).await.body;
    assert!(hist.contains("/andy/demo/lanes/main"), "the history page links the board");
    let r = call(app, "GET", "/andy/demo/lanes/main", None, None, None, None).await;
    assert_eq!(r.status, StatusCode::OK, "{}", r.body);
    assert!(r.body.contains("3 changes in 2 lanes"), "{}", r.body);
    let start = r.body.find("<div class=\"lanes-board\"").unwrap();
    let board = &r.body[start..start + r.body[start..].find("</svg>").unwrap()];
    assert_eq!(board.matches("<rect ").count(), 3);
    assert_eq!(board.matches("<path d=\"M").count(), 1, "grow a depends on add a only");
    assert!(r.body.contains("grow a") && r.body.contains("/andy/demo/change/"));
}

/// Planning rewrites from a proposal's swimlanes (hub spec §6.7): the hub
/// offers only what makes sense and rewrites nothing itself.
#[tokio::test(flavor = "multi_thread")]
async fn a_proposal_board_plans_squashes_and_rebases() {
    let h = hub().await;
    let app = &h.app;
    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))
        .await
        .cookie
        .unwrap();
    let page = call(app, "GET", "/new", None, Some(&andy), None, None).await;
    call(app, "POST", "/new", None, Some(&andy), None, Some(&format!("_csrf={}&owner=andy&name=demo", csrf_of(&page.body)))).await;
    let url = format!("{}/andy/demo", h.base);
    let work = tempfile::tempdir().unwrap();
    let w = work.path().to_path_buf();
    let (base, first, second, apart) = tokio::task::spawn_blocking(move || {
        let mut c = Repo::init(&w).unwrap();
        c.config.set("remote.origin.url", &url).unwrap();
        c.config.set("remote.origin.token", "site").unwrap();
        c.save_config().unwrap();
        write(&w, "a.txt", b"a\n");
        let base = c.commit("base", &[]).unwrap();
        assert!(c.push("origin", false).unwrap()[0].ok);
        c.bookmark_create("feature", None).unwrap();
        c.bookmark_switch("feature", false).unwrap();
        write(&w, "a.txt", b"a\nfirst\n");
        let first = c.commit("first", &[]).unwrap();
        write(&w, "a.txt", b"a\nfirst\nsecond\n");
        let second = c.commit("second", &[]).unwrap();
        write(&w, "b.txt", b"apart\n");
        let apart = c.commit("apart", &[]).unwrap();
        assert!(c.push_bookmark("origin", "feature", false).unwrap()[0].ok);
        (base.to_hex(), first.to_hex(), second.to_hex(), apart.to_hex())
    })
    .await
    .unwrap();
    // No proposal yet: the board is read-only.
    let board = call(app, "GET", "/andy/demo/lanes/feature", None, Some(&andy), None, None).await.body;
    assert!(!board.contains("data-plan="));
    let (st, _) = api(
        app,
        "POST",
        "/api/v1/repos/andy/demo/proposals",
        Some("site"),
        Some(r#"{"title":"Feature","target":"main","source":"feature"}"#),
    )
    .await;
    assert!(st.is_success(), "{st}");
    let board = call(app, "GET", "/andy/demo/lanes/feature", None, Some(&andy), None, None).await.body;
    assert!(board.contains("data-plan=\"/andy/demo/lanes/feature/plan\""), "{board}");
    let csrf = csrf_of(&board);
    let plan = |c: &str, t: &str| {
        let (app, andy, csrf) = (app.clone(), andy.clone(), csrf.clone());
        let form = format!("_csrf={csrf}&change={c}&target={t}");
        async move {
            let r = call(&app, "POST", "/andy/demo/lanes/feature/plan", None, Some(&andy), None, Some(&form)).await;
            serde_json::from_str::<serde_json::Value>(&r.body).unwrap()
        }
    };
    let kinds = |v: &serde_json::Value| {
        v["options"].as_array().map(|a| a.iter().map(|o| o["kind"].as_str().unwrap().to_string()).collect::<Vec<_>>()).unwrap_or_default()
    };
    // second already depends on first: squash, no rebase.
    let v = plan(&second, &first).await;
    assert_eq!(kinds(&v), ["squash"], "{v}");
    assert!(v["options"][0]["command"].as_str().unwrap().contains(&format!("oxy squash #{second} --into #{first}")));
    assert!(v["options"][0]["vscode"].as_str().unwrap().starts_with("vscode://oxygen.oxygen-vscode/plan?"));
    // apart is independent of second: either.
    assert_eq!(kinds(&plan(&apart, &second).await), ["squash", "rebase"]);
    // first under second: nothing (second depends on first).
    assert!(plan(&first, &second).await["error"].is_string());
    // What has landed on main is not rearranged.
    assert!(plan(&second, &base).await["error"].as_str().unwrap().contains("already on main"));
}

/// Issues and proposals share a number space, so every number says what it
/// is, and the chain of work shows from both ends (hub spec §8).
#[tokio::test(flavor = "multi_thread")]
async fn proposals_and_issues_show_their_chain() {
    let h = hub().await;
    let app = &h.app;
    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))
        .await
        .cookie
        .unwrap();
    let page = call(app, "GET", "/new", None, Some(&andy), None, None).await;
    call(app, "POST", "/new", None, Some(&andy), None, Some(&format!("_csrf={}&owner=andy&name=demo", csrf_of(&page.body)))).await;
    let url = format!("{}/andy/demo", h.base);
    let work = tempfile::tempdir().unwrap();
    let w = work.path().to_path_buf();
    tokio::task::spawn_blocking(move || {
        let mut c = Repo::init(&w).unwrap();
        c.config.set("remote.origin.url", &url).unwrap();
        c.config.set("remote.origin.token", "site").unwrap();
        c.save_config().unwrap();
        write(&w, "a.txt", b"a\n");
        c.commit("base", &[]).unwrap();
        assert!(c.push("origin", false).unwrap()[0].ok);
        c.bookmark_create("feature", None).unwrap();
        c.bookmark_switch("feature", false).unwrap();
        write(&w, "a.txt", b"a\nfixed\n");
        c.commit("Fix the crash\n\nfixes #2", &[]).unwrap();
        assert!(c.push_bookmark("origin", "feature", false).unwrap()[0].ok);
    })
    .await
    .unwrap();
    for title in ["Slow start", "Crash on save"] {
        let (st, _) = api(app, "POST", "/api/v1/repos/andy/demo/issues", Some("site"), Some(&format!(r#"{{"title":"{title}"}}"#))).await;
        assert!(st.is_success());
    }
    let (st, v) = api(
        app,
        "POST",
        "/api/v1/repos/andy/demo/proposals",
        Some("site"),
        Some(r#"{"title":"Faster, safer","body":"Closes #1. See also #2.","target":"main","source":"feature"}"#),
    )
    .await;
    assert!(st.is_success(), "{st} {v}");
    assert_eq!(v["number"], 3, "one number space: issues 1 and 2, then proposal 3");

    // The proposal names its kind, links its references by kind, and shows
    // the chain: the issues it closes (description and changes) → it → main.
    let p = call(app, "GET", "/andy/demo/proposal/3", None, None, None, None).await.body;
    assert!(p.contains(">proposal #3</small>"), "header");
    assert!(p.contains(">issue #1</a>") && p.contains(">issue #2</a>"), "links in the description say what they point at");
    let chain = &p[p.find("class=\"chain\"").expect("a chain")..];
    let chain = &chain[..chain.find("</p>").unwrap()];
    for want in ["issue #1</span> Slow start", "issue #2</span> Crash on save", "proposal #3", ">main<"] {
        assert!(chain.contains(want), "chain lacks {want:?}: {chain}");
    }
    assert!(p.contains("<h3>Closes</h3>"));

    // The issue shows the proposal that closes it, and names its own kind.
    let i = call(app, "GET", "/andy/demo/issue/1", None, None, None, None).await.body;
    assert!(i.contains(">issue #1</small>"));
    let chain = &i[i.find("class=\"chain\"").expect("a chain on the issue")..];
    assert!(chain.contains("closed by") && chain.contains("proposal #3</span> Faster, safer"), "{chain}");
    // The conversation is a timeline with avatars; editing sits with the
    // content, not in the sidebar, and labels and projects are editable.
    let p = call(app, "GET", "/andy/demo/proposal/3", None, Some(&andy), None, None).await.body;
    assert!(p.contains("class=\"tl-avatar\" src=\"/avatar/"), "avatars");
    assert!(p.contains("id=\"edit\"") && !p.contains("<h3>Edit</h3>"), "the editor is inline, not in the sidebar");
    assert!(p.contains("no labels yet") && p.contains("/andy/demo/labels"), "a way to make labels");
    let (st, _) = api(app, "POST", "/api/v1/projects/andy", Some("site"), Some(r#"{"title":"Board"}"#)).await;
    assert!(st.is_success(), "{st}");
    let p = call(app, "GET", "/andy/demo/proposal/3", None, Some(&andy), None, None).await.body;
    assert!(
        p.contains("name=\"project\" value=\"1\"") && p.contains("Add to a project") && p.contains("Board<small>"),
        "the owner's projects to add to, in a menu"
    );
    let csrf = csrf_of(&p);
    call(app, "POST", "/andy/demo/proposal/3/project", None, Some(&andy), None, Some(&format!("_csrf={csrf}&project=1&action=add"))).await;
    let p = call(app, "GET", "/andy/demo/proposal/3", None, Some(&andy), None, None).await.body;
    assert!(p.contains("/projects/andy/1\">Board</a>") && p.contains("value=\"remove\""), "on the project, removable");
    call(app, "POST", "/andy/demo/proposal/3/project", None, Some(&andy), None, Some(&format!("_csrf={csrf}&project=1&action=remove")))
        .await;
    let p = call(app, "GET", "/andy/demo/proposal/3", None, Some(&andy), None, None).await.body;
    assert!(!p.contains("/projects/andy/1\">Board</a>"), "taken off again");

    // Closed by the proposal's change, not its description: still shown.
    let two = call(app, "GET", "/andy/demo/issue/2", None, None, None, None).await.body;
    let chain = &two[two.find("class=\"chain\"").expect("a chain on issue 2")..];
    assert!(chain.contains("proposal #3"), "{chain}");
}

/// What the hub is: its version and build, and the libraries it is built on,
/// on /about, in the API and in /health (hub spec §15).
#[tokio::test(flavor = "multi_thread")]
async fn the_hub_says_what_version_it_is() {
    let h = hub().await;
    let app = &h.app;
    let (st, v) = api(app, "GET", "/api/v1/version", None, None).await;
    assert_eq!(st, StatusCode::OK);
    assert_eq!(v["oxygenhub"]["version"], env!("CARGO_PKG_VERSION"));
    assert!(v["oxygenhub"]["build"].as_str().is_some_and(|b| !b.is_empty()), "{v}");
    assert!(v["oxy_core"].as_str().is_some() && v["flow_core"].as_str().is_some());
    let health = call(app, "GET", "/health", None, None, None, None).await.body;
    assert!(health.contains("\"build\""), "{health}");
    let about = call(app, "GET", "/about", None, None, None, None).await.body;
    assert!(about.contains(&format!("<strong>{}</strong>", env!("CARGO_PKG_VERSION"))) && about.contains("oxy-core"), "{about}");
    assert!(about.contains("href=\"/about\""), "the footer links here");
}

#[tokio::test(flavor = "multi_thread")]
async fn device_sign_in() {
    let h = hub().await;
    let app = &h.app;
    let r =
        call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery")).await;
    let andy = r.cookie.unwrap();

    // An unknown scope is refused.
    let (st, v) = api(app, "POST", "/api/v1/device/code", None, Some(r#"{"client":"x","scopes":["root"]}"#)).await;
    assert_eq!((st, v["error"].as_str()), (StatusCode::BAD_REQUEST, Some("invalid_scope")));

    // The app asks for a code and polls; nobody has approved it yet.
    let (st, v) = api(app, "POST", "/api/v1/device/code", None, Some(r#"{"client":"Phone app","scopes":["repo:read","user:read"]}"#)).await;
    assert_eq!(st, StatusCode::OK, "{v}");
    let device = v["device_code"].as_str().unwrap().to_string();
    let user = v["user_code"].as_str().unwrap().to_string();
    assert_eq!(v["verification_uri_complete"], format!("{}/device?code={user}", h.base));
    let poll = format!(r#"{{"device_code":"{device}"}}"#);
    let (st, v) = api(app, "POST", "/api/v1/device/token", None, Some(&poll)).await;
    assert_eq!((st, v["error"].as_str()), (StatusCode::BAD_REQUEST, Some("authorization_pending")));
    let (_, v) = api(app, "POST", "/api/v1/device/token", None, Some(&poll)).await;
    assert_eq!(v["error"], "slow_down", "polled too soon");

    // The user approves it on the web, allowing less than it asked for.
    let page = call(app, "GET", &format!("/device?code={}", user.to_lowercase().replace('-', "")), None, Some(&andy), None, None).await;
    assert!(page.body.contains("Phone app") && page.body.contains("repo:read"), "{}", page.body);
    let csrf = csrf_of(&page.body);
    let r =
        call(app, "POST", "/device", None, Some(&andy), None, Some(&format!("_csrf={csrf}&code={user}&action=approve&scopes=user%3Aread")))
            .await;
    // oxygenhub#83: the answer page says it is done, with no code form.
    assert!(r.body.contains("Signed in") && r.body.contains("nothing to copy or enter"), "{}", r.body);
    assert!(!r.body.contains("The code your app shows"), "no code form after approving");

    // The next poll gets a token with what was allowed, once.
    let (st, v) = api(app, "POST", "/api/v1/device/token", None, Some(&poll)).await;
    assert_eq!(st, StatusCode::OK, "{v}");
    assert_eq!((v["scope"].as_str(), v["username"].as_str()), (Some("user:read"), Some("andy")));
    let token = v["access_token"].as_str().unwrap().to_string();
    let (st, v) = api(app, "GET", "/api/v1/user", Some(&token), None).await;
    assert_eq!((st, v["username"].as_str()), (StatusCode::OK, Some("andy")));
    let (_, v) = api(app, "POST", "/api/v1/device/token", None, Some(&poll)).await;
    assert_eq!(v["error"], "expired_token", "a code gives one token");
    let tokens = call(app, "GET", "/settings/tokens", None, Some(&andy), None, None).await;
    assert!(tokens.body.contains("device: Phone app"));
    // oxygenhub#70: a device's token expires, and each use renews it.
    assert!(tokens.body.contains("renewed on use"), "{}", tokens.body);

    // The token can revoke itself (oxy auth logout), and is then refused.
    let (st, _) = api(app, "DELETE", "/api/v1/user/token", Some(&token), None).await;
    assert_eq!(st, StatusCode::NO_CONTENT);
    let (st, _) = api(app, "GET", "/api/v1/user", Some(&token), None).await;
    assert_eq!(st, StatusCode::UNAUTHORIZED);
    let (st, _) = api(app, "DELETE", "/api/v1/user/token", None, None).await;
    assert_eq!(st, StatusCode::UNAUTHORIZED, "revoking needs a token");

    // A denied code says so.
    let (_, v) = api(app, "POST", "/api/v1/device/code", None, Some(r#"{"client":"Other"}"#)).await;
    let (device, user) = (v["device_code"].as_str().unwrap().to_string(), v["user_code"].as_str().unwrap().to_string());
    let page = call(app, "GET", &format!("/device?code={user}"), None, Some(&andy), None, None).await;
    let csrf = csrf_of(&page.body);
    call(app, "POST", "/device", None, Some(&andy), None, Some(&format!("_csrf={csrf}&code={user}&action=deny"))).await;
    let (_, v) = api(app, "POST", "/api/v1/device/token", None, Some(&format!(r#"{{"device_code":"{device}"}}"#))).await;
    assert_eq!(v["error"], "access_denied");

    // Signed out, the page asks for a sign-in first.
    let r = call(app, "GET", "/device", None, None, None, None).await;
    assert!(r.status.is_redirection(), "{}", r.status);
}