//! Milestone 0.5 end to end: the JSON API with scoped tokens, webhooks
//! delivered to a local receiver with signatures and retries, checks on a
//! projected state that gate landing, and the proposal event stream.

use axum::body::Body;
use axum::http::{header, Request, StatusCode};
use axum::routing::post;
use axum::Router;
use http_body_util::BodyExt;
use oxy_core::repo::Repo;
use oxygenhub::config::Config;
use oxygenhub::db;
use oxygenhub::repos::RepoName;
use oxygenhub::Shared;
use std::path::Path;
use std::sync::{Arc, Mutex};
use tower::ServiceExt;

fn hermetic() {
    static ONCE: std::sync::Once = std::sync::Once::new();
    static DIR: std::sync::OnceLock<tempfile::TempDir> = std::sync::OnceLock::new();
    ONCE.call_once(|| {
        let d = tempfile::tempdir().unwrap();
        std::env::set_var("OXY_HOME", d.path());
        DIR.set(d).ok();
    });
}

fn write(root: &Path, rel: &str, content: &[u8]) {
    let p = root.join(rel);
    std::fs::create_dir_all(p.parent().unwrap()).unwrap();
    std::fs::write(p, content).unwrap();
}

struct Hub {
    app: Shared,
    base: String,
    _dir: tempfile::TempDir,
}

async fn hub() -> Hub {
    hermetic();
    let dir = tempfile::tempdir().unwrap();
    let mut config = Config::load(dir.path()).unwrap();
    config.auth.push_tokens = vec!["site".into()];
    config.registration.mode = "open".into();
    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
    let port = listener.local_addr().unwrap().port();
    config.server.base_url = format!("http://127.0.0.1:{port}");
    let app = oxygenhub::build(config).await.unwrap();
    let router = oxygenhub::router(app.clone());
    tokio::spawn(async move { axum::serve(listener, router).await.unwrap() });
    Hub { app, base: format!("http://127.0.0.1:{port}"), _dir: dir }
}

struct Res {
    status: StatusCode,
    body: String,
    cookie: Option<String>,
}

async fn call(
    app: &Shared,
    method: &str,
    path: &str,
    bearer: Option<&str>,
    cookie: Option<&str>,
    json: Option<&str>,
    form: Option<&str>,
) -> Res {
    let mut req = Request::builder().method(method).uri(path);
    if let Some(b) = bearer {
        req = req.header(header::AUTHORIZATION, format!("Bearer {b}"));
    }
    if let Some(c) = cookie {
        req = req.header(header::COOKIE, format!("oxyhub={c}"));
    }
    let body = if let Some(j) = json {
        req = req.header(header::CONTENT_TYPE, "application/json");
        Body::from(j.to_string())
    } else if let Some(f) = form {
        req = req.header(header::CONTENT_TYPE, "application/x-www-form-urlencoded");
        Body::from(f.to_string())
    } else {
        Body::empty()
    };
    let res = oxygenhub::router(app.clone()).oneshot(req.body(body).unwrap()).await.unwrap();
    let status = res.status();
    let cookie = res
        .headers()
        .get(header::SET_COOKIE)
        .and_then(|v| v.to_str().ok())
        .and_then(|v| v.split(';').next())
        .and_then(|kv| kv.split_once('='))
        .map(|(_, v)| v.to_string());
    let bytes = res.into_body().collect().await.unwrap().to_bytes();
    Res { status, body: String::from_utf8_lossy(&bytes).into_owned(), cookie }
}

async fn api(app: &Shared, method: &str, path: &str, bearer: Option<&str>, json: Option<&str>) -> (StatusCode, serde_json::Value) {
    let r = call(app, method, path, bearer, None, json, None).await;
    let v = serde_json::from_str(&r.body).unwrap_or(serde_json::Value::String(r.body.clone()));
    (r.status, v)
}

fn csrf_of(page: &str) -> String {
    let i = page.find("name=\"_csrf\" value=\"").expect("csrf field") + "name=\"_csrf\" value=\"".len();
    page[i..].split('"').next().unwrap().to_string()
}

/// A webhook receiver that records what it gets and fails the first time.
struct Receiver {
    url: String,
    seen: Arc<Mutex<Vec<(String, String, String)>>>,
    fail_first: Arc<Mutex<bool>>,
}

async fn receiver() -> Receiver {
    let seen: Arc<Mutex<Vec<(String, String, String)>>> = Arc::new(Mutex::new(vec![]));
    let fail_first = Arc::new(Mutex::new(true));
    let (s2, f2) = (seen.clone(), fail_first.clone());
    let router = Router::new().route(
        "/hook",
        post(move |headers: header::HeaderMap, body: String| {
            let (s2, f2) = (s2.clone(), f2.clone());
            async move {
                let event = headers.get("x-oxyhub-event").and_then(|v| v.to_str().ok()).unwrap_or("").to_string();
                let sig = headers.get("x-oxyhub-signature").and_then(|v| v.to_str().ok()).unwrap_or("").to_string();
                let mut f = f2.lock().unwrap();
                if *f {
                    *f = false;
                    return (StatusCode::INTERNAL_SERVER_ERROR, "flaky");
                }
                s2.lock().unwrap().push((event, sig, body));
                (StatusCode::OK, "ok")
            }
        }),
    );
    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
    let port = listener.local_addr().unwrap().port();
    tokio::spawn(async move { axum::serve(listener, router).await.unwrap() });
    Receiver { url: format!("http://127.0.0.1:{port}/hook"), seen, fail_first }
}

#[tokio::test(flavor = "multi_thread")]
async fn api_webhooks_and_checks() {
    let h = hub().await;
    let app = &h.app;
    // Accounts and tokens through the pages.
    let r =
        call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery")).await;
    let andy = r.cookie.unwrap();
    let r =
        call(app, "POST", "/register", None, None, None, Some("username=bob&email=b%40example.com&password=correct-horse-battery")).await;
    let bob = r.cookie.unwrap();
    let mint = |cookie: String, scopes: &'static str| {
        let app = app.clone();
        async move {
            let page = call(&app, "GET", "/settings/tokens", None, Some(&cookie), None, None).await;
            let csrf = csrf_of(&page.body);
            let r = call(&app, "POST", "/settings/tokens", None, Some(&cookie), None, Some(&format!("_csrf={csrf}&name=t&{scopes}"))).await;
            r.body.split("oxyhub_").nth(1).map(|s| format!("oxyhub_{}", s.split('<').next().unwrap().trim())).unwrap()
        }
    };
    let andy_admin = mint(andy.clone(), "scopes=repo%3Aadmin").await;
    let andy_ro = mint(andy.clone(), "scopes=repo%3Aread").await;
    let bob_rw = mint(bob.clone(), "scopes=repo%3Aread&scopes=repo%3Awrite").await;

    // Create a repository through the API; the read-only token cannot.
    let (st, _) = api(app, "POST", "/api/v1/repos", Some(&andy_ro), Some(r#"{"owner":"andy","name":"x"}"#)).await;
    assert_eq!(st, StatusCode::FORBIDDEN);
    let (st, v) = api(
        app,
        "POST",
        "/api/v1/repos",
        Some(&andy_admin),
        Some(r#"{"owner":"andy","name":"demo","description":"d","visibility":"public"}"#),
    )
    .await;
    assert_eq!(st, StatusCode::CREATED, "{v}");
    assert_eq!(v["clone_url"], format!("{}/andy/demo", h.base));
    let (st, _) = api(app, "POST", "/api/v1/repos", Some(&andy_admin), Some(r#"{"owner":"andy","name":"demo"}"#)).await;
    assert_eq!(st, StatusCode::CONFLICT);
    let (st, _) = api(app, "GET", "/api/v1/user", Some(&andy_ro), None).await;
    assert_eq!(st, StatusCode::FORBIDDEN, "user:read is a scope of its own");
    let (st, v) = api(app, "GET", "/api/v1/users/andy", None, None).await;
    assert_eq!(st, StatusCode::OK);
    assert_eq!(v["username"], "andy");

    // A webhook on the repository; push, then see the delivery with a valid signature after a retry.
    let rx = receiver().await;
    let (st, v) = api(
        app,
        "POST",
        "/api/v1/repos/andy/demo/hooks",
        Some(&andy_admin),
        Some(&format!(r#"{{"url":"{}","secret":"s3","events":"push,proposal,check"}}"#, rx.url)),
    )
    .await;
    assert_eq!(st, StatusCode::CREATED, "{v}");
    let work = tempfile::tempdir().unwrap();
    let mut client = Repo::init(work.path()).unwrap();
    client.config.set("remote.origin.url", &format!("{}/andy/demo", h.base)).unwrap();
    client.config.set("remote.origin.token", "site").unwrap();
    client.save_config().unwrap();
    write(work.path(), "a.txt", b"a\n");
    client.snapshot("t").unwrap();
    let base = client.commit("base", &[]).unwrap();
    assert!(client.push("origin", false).unwrap().iter().all(|r| r.ok));
    // The worker retries with backoff; drive it directly for the retry.
    tokio::time::sleep(std::time::Duration::from_millis(400)).await;
    assert!(rx.seen.lock().unwrap().is_empty(), "the first attempt failed");
    sqlx::query("UPDATE deliveries SET next_ms = 0").execute(&app.db).await.unwrap();
    oxygenhub::hooks::deliver_due(app).await;
    let seen = rx.seen.lock().unwrap().clone();
    assert_eq!(seen.len(), 1, "{seen:?}");
    assert_eq!(seen[0].0, "push");
    assert_eq!(seen[0].1, oxygenhub::hooks::signature("s3", seen[0].2.as_bytes()));
    let payload: serde_json::Value = serde_json::from_str(&seen[0].2).unwrap();
    assert_eq!(payload["repository"]["name"], "demo");
    assert_eq!(payload["data"]["updates"][0]["reference"], "main");
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/hooks", Some(&andy_admin), None).await;
    assert_eq!(v.as_array().unwrap().len(), 1);

    // History, tree, file, blame, bookmarks, trust, pushes through the API.
    let (st, v) = api(app, "GET", "/api/v1/repos/andy/demo/history/main", None, None).await;
    assert_eq!(st, StatusCode::OK);
    assert_eq!(v["changes"][0]["hash"], base.to_hex());
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/tree/main", None, None).await;
    assert_eq!(v[0]["name"], "a.txt");
    let r = call(app, "GET", "/api/v1/repos/andy/demo/file/main/a.txt", None, None, None, None).await;
    assert_eq!(r.body, "a\n");
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/blame/main/a.txt", None, None).await;
    assert_eq!(v[0]["change"], base.to_hex());
    let (_, v) = api(app, "GET", &format!("/api/v1/repos/andy/demo/changes/{}", base.to_hex()), None, None).await;
    assert_eq!(v["files"][0]["path"], "a.txt");
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/trust", None, None).await;
    assert!(v["policy"].is_null());
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/pushes", None, None).await;
    assert_eq!(v[0]["reference"], "main");

    // Issues through the API: Bob opens one, comments, and closes it.
    let (st, v) = api(app, "POST", "/api/v1/repos/andy/demo/issues", Some(&bob_rw), Some(r#"{"title":"Bug","body":"it broke"}"#)).await;
    assert_eq!(st, StatusCode::CREATED, "{v}");
    assert_eq!(v["number"], 1);
    let (st, _) = api(app, "POST", "/api/v1/repos/andy/demo/issues/1/comments", Some(&bob_rw), Some(r#"{"body":"more"}"#)).await;
    assert_eq!(st, StatusCode::CREATED);
    let (st, v) = api(app, "POST", "/api/v1/repos/andy/demo/issues/1", Some(&bob_rw), Some(r#"{"state":"closed"}"#)).await;
    assert_eq!(st, StatusCode::OK, "{v}");
    assert_eq!(v["state"], "closed");
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/issues?state=all", None, None).await;
    assert_eq!(v[0]["comments"], 1);
    let (_, v) = api(app, "GET", "/api/v1/search?q=broke", None, None).await;
    assert_eq!(v[0]["number"], 1);

    // A proposal through the API, then a required check gates its landing.
    client.bookmark_create("feat", Some(&[base])).unwrap();
    client.bookmark_switch("feat", false).unwrap();
    write(work.path(), "b.txt", b"b\n");
    write(work.path(), "a.txt", b"a\nA\n");
    client.snapshot("t").unwrap();
    let feat = client.commit("feat", &[]).unwrap();
    assert!(client.push_bookmark("origin", "feat", false).unwrap().iter().all(|r| r.ok));
    let (st, v) =
        api(app, "POST", "/api/v1/repos/andy/demo/proposals", Some(&bob_rw), Some(r#"{"title":"Feat","target":"main","source":"feat"}"#))
            .await;
    assert_eq!(st, StatusCode::CREATED, "{v}");
    assert_eq!(v["number"], 2);
    let state = v["projected_state"].as_str().unwrap().to_string();
    assert_eq!(v["landable"], true);
    // Its files, and each side's bytes, for editors' diff views.
    let (st, v) = api(app, "GET", "/api/v1/repos/andy/demo/proposals/2/files", None, None).await;
    assert_eq!(st, StatusCode::OK, "{v}");
    let files: Vec<(String, String)> =
        v.as_array().unwrap().iter().map(|f| (f["path"].as_str().unwrap().to_string(), f["kind"].as_str().unwrap().to_string())).collect();
    assert_eq!(files, vec![("a.txt".into(), "modified".into()), ("b.txt".into(), "added".into())], "{v}");
    assert_eq!(v[0]["added"], 1);
    let side = |s: &str, p: &str| format!("/api/v1/repos/andy/demo/proposals/2/content/{s}/{p}");
    assert_eq!(call(app, "GET", &side("base", "a.txt"), None, None, None, None).await.body, "a\n");
    assert_eq!(call(app, "GET", &side("head", "a.txt"), None, None, None, None).await.body, "a\nA\n");
    assert_eq!(call(app, "GET", &side("head", "b.txt"), None, None, None, None).await.body, "b\n");
    assert_eq!(call(app, "GET", &side("base", "b.txt"), None, None, None, None).await.status, StatusCode::NOT_FOUND, "b.txt is new");
    assert_eq!(call(app, "GET", &side("middle", "a.txt"), None, None, None, None).await.status, StatusCode::BAD_REQUEST);
    // Require the "build" check.
    let settings = call(app, "GET", "/andy/demo/settings", None, Some(&andy), None, None).await;
    let csrf = csrf_of(&settings.body);
    assert_eq!(
        call(app, "POST", "/andy/demo/settings/checks", None, Some(&andy), None, Some(&format!("_csrf={csrf}&required_checks=build")))
            .await
            .status,
        StatusCode::OK
    );
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/proposals/2", None, None).await;
    assert_eq!(v["landable"], false);
    assert!(v["blockers"][0].as_str().unwrap().contains("build"), "{v}");
    // A checker reports on the projected state: first running, then passed; the page streams it.
    let (st, v) = api(
        app,
        "POST",
        "/api/v1/repos/andy/demo/checks",
        Some(&andy_ro),
        Some(&format!(r#"{{"state":"{state}","name":"build","status":"running"}}"#)),
    )
    .await;
    assert_eq!(st, StatusCode::FORBIDDEN, "{v}");
    let mut events = app.events.proposals.subscribe();
    let (st, v) = api(
        app,
        "POST",
        "/api/v1/repos/andy/demo/checks",
        Some(&bob_rw),
        Some(&format!(r#"{{"state":"{state}","name":"build","status":"passed","summary":"42 tests","url":"https://ci.example/1"}}"#)),
    )
    .await;
    assert_eq!(st, StatusCode::CREATED, "{v}");
    let (_, ev) = events.recv().await.unwrap();
    assert_eq!(ev.kind, "check");
    assert_eq!(ev.check.unwrap().name, "build");
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/proposals/2/checks", None, None).await;
    assert_eq!(v[0]["status"], "passed");
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/proposals/2", None, None).await;
    assert_eq!(v["landable"], true, "{v}");
    let page = call(app, "GET", "/andy/demo/proposal/2", None, Some(&andy), None, None).await;
    assert!(page.body.contains("42 tests"), "{}", page.body);
    // The check and the proposal reached the webhook too.
    sqlx::query("UPDATE deliveries SET next_ms = 0").execute(&app.db).await.unwrap();
    oxygenhub::hooks::deliver_due(app).await;
    let kinds: Vec<String> = rx.seen.lock().unwrap().iter().map(|s| s.0.clone()).collect();
    assert!(kinds.contains(&"proposal.opened".to_string()) && kinds.contains(&"check".to_string()), "{kinds:?}");
    let _ = feat;
    let _ = rx.fail_first;

    // The inbox through the API: count, list, mark one read, mark all read.
    let bob_user = mint(bob.clone(), "scopes=user%3Aread").await;
    let bob_id = oxygenhub::db::accounts::account_by_name(&app.db, "bob").await.unwrap().unwrap().id;
    oxygenhub::db::notify::mark_read(&app.db, bob_id, None).await.unwrap();
    oxygenhub::db::notify::add(
        &app.db,
        oxygenhub::db::notify::New {
            account_id: bob_id,
            repo_id: None,
            reason: oxygenhub::db::notify::Reason::Participating,
            kind: "mention",
            title: "andy/demo#1: Bug",
            url: "/andy/demo/issue/1",
            actor: "andy",
        },
    )
    .await
    .unwrap();
    oxygenhub::db::notify::add(
        &app.db,
        oxygenhub::db::notify::New {
            account_id: bob_id,
            repo_id: None,
            reason: oxygenhub::db::notify::Reason::Participating,
            kind: "review",
            title: "andy/demo#2: Feat",
            url: "/andy/demo/proposal/2",
            actor: "andy",
        },
    )
    .await
    .unwrap();
    let (st, v) = api(app, "GET", "/api/v1/notifications", Some(&bob_user), None).await;
    assert_eq!(st, StatusCode::OK, "{v}");
    assert_eq!(v["unread"], 2);
    assert_eq!(v["items"][0]["read"], false);
    assert!(v["items"][0]["url"].as_str().unwrap().starts_with(&h.base), "absolute urls: {v}");
    let first = v["items"][0]["id"].as_i64().unwrap();
    let (st, _) = api(app, "POST", &format!("/api/v1/notifications/{first}/read"), Some(&bob_user), None).await;
    assert_eq!(st, StatusCode::NO_CONTENT);
    assert_eq!(api(app, "GET", "/api/v1/notifications", Some(&bob_user), None).await.1["unread"], 1);
    assert_eq!(api(app, "POST", "/api/v1/notifications/read", Some(&bob_user), None).await.0, StatusCode::NO_CONTENT);
    assert_eq!(api(app, "GET", "/api/v1/notifications", Some(&bob_user), None).await.1["unread"], 0);
    // Another account's notification is not the caller's to clear, and a token without user:read sees nothing.
    assert_eq!(api(app, "GET", "/api/v1/notifications", Some(&bob_rw), None).await.0, StatusCode::FORBIDDEN);
}

#[tokio::test(flavor = "multi_thread")]
async fn api_issue_triage_and_labels() {
    let h = hub().await;
    let app = &h.app;
    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))
        .await
        .cookie
        .unwrap();
    let bob = call(app, "POST", "/register", None, None, None, Some("username=bob&email=b%40example.com&password=correct-horse-battery"))
        .await
        .cookie
        .unwrap();
    let mint = |cookie: String, scopes: &'static str| {
        let app = app.clone();
        async move {
            let page = call(&app, "GET", "/settings/tokens", None, Some(&cookie), None, None).await;
            let csrf = csrf_of(&page.body);
            let r = call(&app, "POST", "/settings/tokens", None, Some(&cookie), None, Some(&format!("_csrf={csrf}&name=t&{scopes}"))).await;
            r.body.split("oxyhub_").nth(1).map(|s| format!("oxyhub_{}", s.split('<').next().unwrap().trim())).unwrap()
        }
    };
    let andy_t = mint(andy, "scopes=repo%3Aadmin").await;
    let bob_t = mint(bob, "scopes=repo%3Aread&scopes=repo%3Awrite").await;
    let (st, _) = api(app, "POST", "/api/v1/repos", Some(&andy_t), Some(r#"{"owner":"andy","name":"demo","visibility":"public"}"#)).await;
    assert_eq!(st, StatusCode::CREATED);

    // Labels through the API; bad colours and non-triage callers are refused.
    let (st, v) = api(
        app,
        "POST",
        "/api/v1/repos/andy/demo/labels",
        Some(&andy_t),
        Some(r##"{"name":"bug","colour":"#ff0000","description":"Broken"}"##),
    )
    .await;
    assert_eq!((st, v["name"].as_str()), (StatusCode::CREATED, Some("bug")));
    assert_eq!(api(app, "POST", "/api/v1/repos/andy/demo/labels", Some(&andy_t), Some(r#"{"name":"flow"}"#)).await.0, StatusCode::CREATED);
    assert_eq!(
        api(app, "POST", "/api/v1/repos/andy/demo/labels", Some(&andy_t), Some(r##"{"name":"x","colour":"red"}"##)).await.0,
        StatusCode::BAD_REQUEST
    );
    assert_eq!(api(app, "POST", "/api/v1/repos/andy/demo/labels", Some(&bob_t), Some(r#"{"name":"mine"}"#)).await.0, StatusCode::FORBIDDEN);
    let (_, labels) = api(app, "GET", "/api/v1/repos/andy/demo/labels", None, None).await;
    assert_eq!(labels.as_array().unwrap().len(), 2);

    // An issue created with its labels and assignee in one call.
    let (st, v) = api(
        app,
        "POST",
        "/api/v1/repos/andy/demo/issues",
        Some(&andy_t),
        Some(r#"{"title":"Crash","body":"b","labels":["bug"],"assignees":["bob"]}"#),
    )
    .await;
    assert_eq!(st, StatusCode::CREATED, "{v}");
    assert_eq!(v["labels"][0]["name"], "bug");
    assert_eq!(v["assignees"], serde_json::json!(["bob"]));
    let n = v["number"].as_i64().unwrap();
    // Unknown names are refused before anything is created.
    let (st, v) = api(app, "POST", "/api/v1/repos/andy/demo/issues", Some(&andy_t), Some(r#"{"title":"X","labels":["nope"]}"#)).await;
    assert_eq!(st, StatusCode::BAD_REQUEST);
    assert!(v["detail"].as_str().unwrap().contains("no label"));
    let (_, list) = api(app, "GET", "/api/v1/repos/andy/demo/issues?state=all", None, None).await;
    assert_eq!(list.as_array().unwrap().len(), 1, "nothing half-made");
    // Without triage, labels cannot be set, but a plain issue can be opened.
    assert_eq!(
        api(app, "POST", "/api/v1/repos/andy/demo/issues", Some(&bob_t), Some(r#"{"title":"Y","labels":["bug"]}"#)).await.0,
        StatusCode::FORBIDDEN
    );
    let (st, bobs) = api(app, "POST", "/api/v1/repos/andy/demo/issues", Some(&bob_t), Some(r#"{"title":"From Bob"}"#)).await;
    assert_eq!(st, StatusCode::CREATED);
    let bob_n = bobs["number"].as_i64().unwrap();

    // PATCH: the whole label set, assignees and milestone, with events.
    let (st, v) =
        api(app, "PATCH", &format!("/api/v1/repos/andy/demo/issues/{n}"), Some(&andy_t), Some(r#"{"labels":["flow"],"assignees":[]}"#))
            .await;
    assert_eq!(st, StatusCode::OK, "{v}");
    assert_eq!(v["labels"].as_array().unwrap().iter().map(|l| l["name"].as_str().unwrap()).collect::<Vec<_>>(), ["flow"]);
    assert_eq!(v["assignees"], serde_json::json!([]));
    let (st, _) = api(app, "PATCH", &format!("/api/v1/repos/andy/demo/issues/{n}"), Some(&andy_t), Some(r#"{"milestone":"v9"}"#)).await;
    assert_eq!(st, StatusCode::BAD_REQUEST, "no such milestone");
    let issue_page = call(app, "GET", &format!("/andy/demo/issue/{n}"), None, None, None, None).await.body;
    assert!(issue_page.contains("set labels") && issue_page.contains("unassigned"), "timeline events");
    // The author edits their own title; others cannot; nobody but triage sets labels.
    let (st, v) =
        api(app, "PATCH", &format!("/api/v1/repos/andy/demo/issues/{bob_n}"), Some(&bob_t), Some(r#"{"title":"From Bob, clearer"}"#)).await;
    assert_eq!((st, v["title"].as_str()), (StatusCode::OK, Some("From Bob, clearer")));
    assert_eq!(
        api(app, "PATCH", &format!("/api/v1/repos/andy/demo/issues/{n}"), Some(&bob_t), Some(r#"{"title":"mine now"}"#)).await.0,
        StatusCode::FORBIDDEN
    );
    assert_eq!(
        api(app, "PATCH", &format!("/api/v1/repos/andy/demo/issues/{bob_n}"), Some(&bob_t), Some(r#"{"labels":["bug"]}"#)).await.0,
        StatusCode::FORBIDDEN
    );
    assert_eq!(
        api(app, "PATCH", &format!("/api/v1/repos/andy/demo/issues/{n}"), Some(&andy_t), Some(r#"{"title":"  "}"#)).await.0,
        StatusCode::BAD_REQUEST
    );

    // Deleting a label takes it off the issues.
    assert_eq!(api(app, "DELETE", "/api/v1/repos/andy/demo/labels/flow", Some(&andy_t), None).await.0, StatusCode::NO_CONTENT);
    let (_, v) = api(app, "GET", &format!("/api/v1/repos/andy/demo/issues/{n}"), None, None).await;
    assert_eq!(v["labels"], serde_json::json!([]));
    assert_eq!(api(app, "DELETE", "/api/v1/repos/andy/demo/labels/flow", Some(&andy_t), None).await.0, StatusCode::NOT_FOUND);
}

#[tokio::test(flavor = "multi_thread")]
async fn webhook_formats_editing_and_web_issue_events() {
    let h = hub().await;
    let app = &h.app;
    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))
        .await
        .cookie
        .unwrap();
    let page = call(app, "GET", "/settings/tokens", None, Some(&andy), None, None).await;
    let r = call(
        app,
        "POST",
        "/settings/tokens",
        None,
        Some(&andy),
        None,
        Some(&format!("_csrf={}&name=t&scopes=repo%3Aadmin", csrf_of(&page.body))),
    )
    .await;
    let token = r.body.split("oxyhub_").nth(1).map(|s| format!("oxyhub_{}", s.split('<').next().unwrap().trim())).unwrap();
    assert_eq!(
        api(app, "POST", "/api/v1/repos", Some(&token), Some(r#"{"owner":"andy","name":"demo","visibility":"public"}"#)).await.0,
        StatusCode::CREATED
    );
    let rx = receiver().await;
    *rx.fail_first.lock().unwrap() = false;
    let settings = call(app, "GET", "/andy/demo/settings", None, Some(&andy), None, None).await.body;
    let csrf = csrf_of(&settings);
    let form = |f: String| {
        let andy = andy.clone();
        async move { call(app, "POST", "/andy/demo/settings/hooks", None, Some(&andy), None, Some(&f)).await.body }
    };
    let url = rx.url.replace(':', "%3A").replace('/', "%2F");
    assert!(form(format!("_csrf={csrf}&url={url}&format=discord&events=*")).await.contains("Webhook added"));
    let hook = oxygenhub::db::hooks::hooks_for_repo(&app.db, 1).await.unwrap().remove(0);
    assert_eq!(hook.format, "discord");
    // Ping arrives as a Discord message.
    form(format!("_csrf={csrf}&id={}&action=ping", hook.id)).await;
    let mut got = String::new();
    for _ in 0..100 {
        if let Some((_, _, body)) = rx.seen.lock().unwrap().first() {
            got = body.clone();
        }
        if !got.is_empty() {
            break;
        }
        tokio::time::sleep(std::time::Duration::from_millis(50)).await;
    }
    let v: serde_json::Value = serde_json::from_str(&got).unwrap();
    assert_eq!(v["embeds"][0]["title"], "OxygenHub is connected");
    assert_eq!(v["allowed_mentions"]["parse"], serde_json::json!([]));
    let page = call(app, "GET", "/andy/demo/settings", None, Some(&andy), None, None).await.body;
    assert!(page.contains("last delivery <span class=\"sig sig-valid\">✔</span> 200"), "the table shows how it went");

    // Editing: a blank URL and secret keep theirs; format, events and active change.
    assert!(form(format!("_csrf={csrf}&id={}&action=update&url=&secret=&events=issue&format=oxygenhub&active=1", hook.id))
        .await
        .contains("Webhook saved"));
    let edited = oxygenhub::db::hooks::hook(&app.db, hook.id).await.unwrap().unwrap();
    assert_eq!(
        (edited.url.as_str(), edited.events.as_str(), edited.format.as_str(), edited.active),
        (rx.url.as_str(), "issue", "oxygenhub", true)
    );
    assert!(form(format!("_csrf={csrf}&id={}&action=update&url=ftp%3A%2F%2Fx&events=*", hook.id)).await.contains("starts with http"));

    // An issue opened on the web now reaches the hook, as the signed envelope.
    let new = call(app, "GET", "/andy/demo/issues/new", None, Some(&andy), None, None).await.body;
    call(
        app,
        "POST",
        "/andy/demo/issues/new",
        None,
        Some(&andy),
        None,
        Some(&format!("_csrf={}&title=From+the+web&body=hello", csrf_of(&new))),
    )
    .await;
    let mut envelope = None;
    for _ in 0..100 {
        envelope = rx.seen.lock().unwrap().iter().find(|(e, _, _)| e == "issue.opened").cloned();
        if envelope.is_some() {
            break;
        }
        tokio::time::sleep(std::time::Duration::from_millis(50)).await;
    }
    let (_, sig, body) = envelope.expect("issue.opened delivered");
    let v: serde_json::Value = serde_json::from_str(&body).unwrap();
    assert_eq!(v["data"]["issue"]["title"], "From the web");
    assert!(sig.starts_with("blake3-keyed="));
    // A disabled hook through the edit form (no active box).
    form(format!("_csrf={csrf}&id={}&action=update&url=&events=*&format=oxygenhub", hook.id)).await;
    assert!(!oxygenhub::db::hooks::hook(&app.db, hook.id).await.unwrap().unwrap().active);
}

#[tokio::test(flavor = "multi_thread")]
async fn api_projects() {
    let h = hub().await;
    let app = &h.app;
    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))
        .await
        .cookie
        .unwrap();
    let bob = call(app, "POST", "/register", None, None, None, Some("username=bob&email=b%40example.com&password=correct-horse-battery"))
        .await
        .cookie
        .unwrap();
    let mint = |cookie: String, scopes: &'static str| {
        let app = app.clone();
        async move {
            let page = call(&app, "GET", "/settings/tokens", None, Some(&cookie), None, None).await;
            let csrf = csrf_of(&page.body);
            let r = call(&app, "POST", "/settings/tokens", None, Some(&cookie), None, Some(&format!("_csrf={csrf}&name=t&{scopes}"))).await;
            r.body.split("oxyhub_").nth(1).map(|s| format!("oxyhub_{}", s.split('<').next().unwrap().trim())).unwrap()
        }
    };
    let a = mint(andy, "scopes=repo%3Aadmin").await;
    let b = mint(bob, "scopes=repo%3Aread&scopes=repo%3Awrite").await;
    api(app, "POST", "/api/v1/repos", Some(&a), Some(r#"{"owner":"andy","name":"demo","visibility":"public"}"#)).await;
    api(app, "POST", "/api/v1/repos/andy/demo/issues", Some(&a), Some(r#"{"title":"Crash"}"#)).await;

    let (st, p) = api(app, "POST", "/api/v1/projects/andy", Some(&a), Some(r#"{"title":"Roadmap","description":"Next"}"#)).await;
    assert_eq!((st, p["number"].as_i64()), (StatusCode::CREATED, Some(1)), "{p}");
    assert!(p["url"].as_str().unwrap().ends_with("/projects/andy/1"));
    assert_eq!(api(app, "POST", "/api/v1/projects/andy", Some(&b), Some(r#"{"title":"Mine"}"#)).await.0, StatusCode::FORBIDDEN);
    assert_eq!(api(app, "POST", "/api/v1/projects/nobody", Some(&a), Some(r#"{"title":"X"}"#)).await.0, StatusCode::NOT_FOUND);

    // Cards by reference, into a column by name, and a note into the first column.
    let (st, card) = api(app, "POST", "/api/v1/projects/andy/1/cards", Some(&a), Some(r#"{"reference":"demo#1","column":"doing"}"#)).await;
    assert_eq!(st, StatusCode::CREATED, "{card}");
    assert_eq!(
        (card["kind"].as_str(), card["reference"].as_str(), card["title"].as_str(), card["state"].as_str()),
        (Some("issue"), Some("andy/demo#1"), Some("Crash"), Some("open"))
    );
    let (st, v) = api(app, "POST", "/api/v1/projects/andy/1/cards", Some(&a), Some(r#"{"reference":"demo#1"}"#)).await;
    assert_eq!(st, StatusCode::BAD_REQUEST);
    assert!(v["detail"].as_str().unwrap().contains("already on this project"));
    assert_eq!(
        api(app, "POST", "/api/v1/projects/andy/1/cards", Some(&a), Some(r#"{"reference":"demo#1","column":"nope"}"#)).await.0,
        StatusCode::BAD_REQUEST
    );
    let (st, note) = api(app, "POST", "/api/v1/projects/andy/1/cards", Some(&a), Some(r#"{"note":"Write docs"}"#)).await;
    assert_eq!((st, note["kind"].as_str()), (StatusCode::CREATED, Some("note")));
    assert_eq!(api(app, "POST", "/api/v1/projects/andy/1/cards", Some(&b), Some(r#"{"note":"hi"}"#)).await.0, StatusCode::FORBIDDEN);

    // Move and read the board.
    let id = card["id"].as_i64().unwrap();
    assert_eq!(
        api(app, "PATCH", &format!("/api/v1/projects/andy/1/cards/{id}"), Some(&a), Some(r#"{"column":"Done"}"#)).await.0,
        StatusCode::NO_CONTENT
    );
    let (_, board) = api(app, "GET", "/api/v1/projects/andy/1", None, None).await;
    let names: Vec<(&str, usize)> =
        board["columns"].as_array().unwrap().iter().map(|c| (c["name"].as_str().unwrap(), c["cards"].as_array().unwrap().len())).collect();
    assert_eq!(names, [("Backlog", 1), ("Doing", 0), ("Done", 1)]);
    assert_eq!(board["columns"][2]["cards"][0]["reference"], "andy/demo#1");

    // Private: hidden from others; closed: read-only; then remove a card.
    let (_, edited) = api(app, "PATCH", "/api/v1/projects/andy/1", Some(&a), Some(r#"{"private":true}"#)).await;
    assert_eq!(edited["public"], false);
    assert_eq!(api(app, "GET", "/api/v1/projects/andy/1", Some(&b), None).await.0, StatusCode::NOT_FOUND);
    assert_eq!(api(app, "GET", "/api/v1/projects/andy", None, None).await.1, serde_json::json!([]));
    api(app, "PATCH", "/api/v1/projects/andy/1", Some(&a), Some(r#"{"closed":true}"#)).await;
    assert_eq!(api(app, "POST", "/api/v1/projects/andy/1/cards", Some(&a), Some(r#"{"note":"late"}"#)).await.0, StatusCode::CONFLICT);
    api(app, "PATCH", "/api/v1/projects/andy/1", Some(&a), Some(r#"{"closed":false}"#)).await;
    assert_eq!(api(app, "DELETE", &format!("/api/v1/projects/andy/1/cards/{id}"), Some(&a), None).await.0, StatusCode::NO_CONTENT);
    assert_eq!(api(app, "DELETE", &format!("/api/v1/projects/andy/1/cards/{id}"), Some(&a), None).await.0, StatusCode::NOT_FOUND);
}

#[tokio::test(flavor = "multi_thread")]
async fn api_required_checks() {
    let h = hub().await;
    let app = &h.app;
    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))
        .await
        .cookie
        .unwrap();
    let page = call(app, "GET", "/settings/tokens", None, Some(&andy), None, None).await;
    let csrf = csrf_of(&page.body);
    let mint = |scopes: &'static str| {
        let (app, andy, csrf) = (app.clone(), andy.clone(), csrf.clone());
        async move {
            let r = call(&app, "POST", "/settings/tokens", None, Some(&andy), None, Some(&format!("_csrf={csrf}&name=t&{scopes}"))).await;
            r.body.split("oxyhub_").nth(1).map(|s| format!("oxyhub_{}", s.split('<').next().unwrap().trim())).unwrap()
        }
    };
    let admin = mint("scopes=repo%3Aadmin").await;
    let write = mint("scopes=repo%3Aread&scopes=repo%3Awrite").await;
    api(app, "POST", "/api/v1/repos", Some(&admin), Some(r#"{"owner":"andy","name":"demo","visibility":"public"}"#)).await;

    let (st, v) = api(app, "GET", "/api/v1/repos/andy/demo/checks/required", None, None).await;
    assert_eq!((st, v["names"].clone()), (StatusCode::OK, serde_json::json!([])));
    let (st, v) = api(
        app,
        "PUT",
        "/api/v1/repos/andy/demo/checks/required",
        Some(&admin),
        Some(r#"{"names":["flow/test"," flow/fmt ","flow/test",""]}"#),
    )
    .await;
    assert_eq!((st, v["names"].clone()), (StatusCode::OK, serde_json::json!(["flow/fmt", "flow/test"])), "trimmed, sorted, once each");
    assert_eq!(oxygenhub::db::hooks::required_checks(&app.db, 1).await.unwrap(), ["flow/fmt", "flow/test"]);
    assert_eq!(
        api(app, "GET", "/api/v1/repos/andy/demo/checks/required", None, None).await.1["names"],
        serde_json::json!(["flow/fmt", "flow/test"])
    );
    assert_eq!(
        api(app, "PUT", "/api/v1/repos/andy/demo/checks/required", Some(&write), Some(r#"{"names":[]}"#)).await.0,
        StatusCode::FORBIDDEN,
        "repo:admin only"
    );
    assert_eq!(
        api(app, "PUT", "/api/v1/repos/andy/demo/checks/required", Some(&admin), Some(r#"{"names":["a,b"]}"#)).await.0,
        StatusCode::BAD_REQUEST
    );
    // The settings page shows the same list.
    assert!(call(app, "GET", "/andy/demo/settings", None, Some(&andy), None, None).await.body.contains("flow/fmt, flow/test"));
}

/// OxygenFlow per repository: site administrators turn it on or off in
/// the repository's settings; hub.toml's `[flow] repos` is the default.
#[tokio::test(flavor = "multi_thread")]
async fn flow_is_switched_per_repository_by_site_admins() {
    let h = hub().await;
    let app = &h.app;
    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))
        .await
        .cookie
        .unwrap();
    let page = call(app, "GET", "/new", None, Some(&andy), None, None).await;
    call(app, "POST", "/new", None, Some(&andy), None, Some(&format!("_csrf={}&owner=andy&name=demo", csrf_of(&page.body)))).await;
    let row = || async { oxygenhub::db::repos::get(&app.db, "andy", "demo").await.unwrap().unwrap() };
    assert!(!oxygenhub::flow::enabled(app, &row().await), "not in [flow] repos");
    let tab = call(app, "GET", "/andy/demo/flow", None, Some(&andy), None, None).await;
    assert!(tab.body.contains("not enabled") && tab.body.contains("/andy/demo/settings#flow"));

    let set = |value: &'static str| {
        let (app, andy) = (app.clone(), andy.clone());
        async move {
            let settings = call(&app, "GET", "/andy/demo/settings", None, Some(&andy), None, None).await;
            call(
                &app,
                "POST",
                "/andy/demo/settings/flow",
                None,
                Some(&andy),
                None,
                Some(&format!("_csrf={}&flow={value}", csrf_of(&settings.body))),
            )
            .await
        }
    };
    // A repository admin who is not a site admin sees the state but cannot change it.
    let id = oxygenhub::db::accounts::account_by_name(&app.db, "andy").await.unwrap().unwrap().id;
    oxygenhub::db::accounts::set_admin(&app.db, id, false).await.unwrap();
    let settings = call(app, "GET", "/andy/demo/settings", None, Some(&andy), None, None).await;
    assert!(settings.body.contains("do not start runs") && !settings.body.contains("name=\"flow\""));
    let r = set("on").await;
    assert!(r.body.contains("Only site administrators"), "{}", r.body);
    assert_eq!(row().await.flow, "");

    oxygenhub::db::accounts::set_admin(&app.db, id, true).await.unwrap();
    let r = set("on").await;
    assert!(r.body.contains("OxygenFlow is on"), "{}", r.body);
    assert_eq!(row().await.flow, "on");
    assert!(oxygenhub::flow::enabled(app, &row().await));
    assert!(!call(app, "GET", "/andy/demo/flow", None, Some(&andy), None, None).await.body.contains("not enabled"));
    set("off").await;
    assert!(!oxygenhub::flow::enabled(app, &row().await));
    set("default").await;
    assert_eq!(row().await.flow, "");
    assert!(set("sometimes").await.body.contains("Pick on, off"));
}

/// Deleting bookmarks (hub spec §6.4): pushed deletions and the delete
/// button, never the repository's default bookmark as the hub sets it.
#[tokio::test(flavor = "multi_thread")]
async fn bookmarks_are_deleted_by_push_and_on_the_web() {
    let h = hub().await;
    let app = &h.app;
    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))
        .await
        .cookie
        .unwrap();
    let page = call(app, "GET", "/new", None, Some(&andy), None, None).await;
    call(app, "POST", "/new", None, Some(&andy), None, Some(&format!("_csrf={}&owner=andy&name=demo", csrf_of(&page.body)))).await;
    let url = format!("{}/andy/demo", h.base);
    let work = tempfile::tempdir().unwrap();
    let (w, u) = (work.path().to_path_buf(), url.clone());
    let client = tokio::task::spawn_blocking(move || {
        let mut c = Repo::init(&w).unwrap();
        c.config.set("remote.origin.url", &u).unwrap();
        c.config.set("remote.origin.token", "site").unwrap();
        c.save_config().unwrap();
        write(&w, "a.txt", b"a\n");
        c.commit("a", &[]).unwrap();
        assert!(c.push("origin", false).unwrap()[0].ok);
        for b in ["develop", "feature/x", "stray"] {
            c.bookmark_create(b, None).unwrap();
            assert!(c.push_bookmark("origin", b, false).unwrap()[0].ok);
        }
        // A pushed deletion.
        let r = c.push_delete("origin", "feature/x").unwrap();
        assert!(r[0].ok, "{r:?}");
        c
    })
    .await
    .unwrap();
    let page = call(app, "GET", "/andy/demo/bookmarks", None, Some(&andy), None, None).await;
    assert!(!page.body.contains(">feature/x<") && page.body.contains(">stray<"), "{}", page.body);
    assert!(page.body.contains("/andy/demo/bookmarks/delete"), "writers see delete buttons");
    let anon = call(app, "GET", "/andy/demo/bookmarks", None, None, None, None).await;
    assert!(!anon.body.contains("/bookmarks/delete"));

    // The hub's default, not the repository's config, is protected: make
    // develop the default, then main can go and develop cannot.
    let row = oxygenhub::db::repos::get(&app.db, "andy", "demo").await.unwrap().unwrap();
    oxygenhub::db::repos::set_default_bookmark(&app.db, row.id, "develop").await.unwrap();
    let client = tokio::task::spawn_blocking(move || {
        let r = client.push_delete("origin", "develop").unwrap();
        assert!(!r[0].ok && r[0].reason.contains("default bookmark"), "{r:?}");
        let r = client.push_delete("origin", "main").unwrap();
        assert!(r[0].ok, "{r:?}");
        client
    })
    .await
    .unwrap();
    drop(client);

    // On the web: a writer deletes stray; the default is refused.
    let form = |b: &'static str| {
        let (app, andy) = (app.clone(), andy.clone());
        async move {
            let page = call(&app, "GET", "/andy/demo/bookmarks", None, Some(&andy), None, None).await;
            call(
                &app,
                "POST",
                "/andy/demo/bookmarks/delete",
                None,
                Some(&andy),
                None,
                Some(&format!("_csrf={}&bookmark={b}", csrf_of(&page.body))),
            )
            .await
        }
    };
    let r = form("stray").await;
    assert!(r.body.contains("Deleted stray"), "{}", r.body);
    assert!(!r.body.contains(">stray<"));
    let r = form("develop").await;
    assert!(r.body.contains("is the default bookmark"), "{}", r.body);
    let r = form("nope").await;
    assert!(r.body.contains("There is no bookmark nope"), "{}", r.body);
    let pushes = call(app, "GET", "/andy/demo/pushes", None, Some(&andy), None, None).await;
    assert!(pushes.body.contains("deleted on the web"), "logged like a push");
    // Anonymous visitors cannot.
    assert_ne!(
        call(app, "POST", "/andy/demo/bookmarks/delete", None, None, None, Some("_csrf=x&bookmark=develop")).await.status,
        StatusCode::OK
    );
}

/// A change signed by a key no account has linked says so, on its page
/// and in the API (feedback 14).
#[tokio::test(flavor = "multi_thread")]
async fn changes_signed_by_unlinked_keys_say_so() {
    let h = hub().await;
    let app = &h.app;
    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))
        .await
        .cookie
        .unwrap();
    let page = call(app, "GET", "/new", None, Some(&andy), None, None).await;
    call(app, "POST", "/new", None, Some(&andy), None, Some(&format!("_csrf={}&owner=andy&name=demo", csrf_of(&page.body)))).await;
    let url = format!("{}/andy/demo", h.base);
    let work = tempfile::tempdir().unwrap();
    let (w, u, home) = (work.path().to_path_buf(), url.clone(), work.path().join(".home"));
    let hash = tokio::task::spawn_blocking(move || {
        let mut c = Repo::init(&w.join("r")).unwrap().with_home(home);
        c.config.set("remote.origin.url", &u).unwrap();
        c.config.set("remote.origin.token", "site").unwrap();
        c.save_config().unwrap();
        c.create_identity("Ada", "ada@example.org", oxy_core::repo::IdentityScope::Repo).unwrap();
        write(&w.join("r"), "a.txt", b"a\n");
        let h = c.commit("signed by Ada", &[]).unwrap();
        assert!(c.push("origin", false).unwrap()[0].ok);
        h.to_hex()
    })
    .await
    .unwrap();
    let (st, v) = api(app, "GET", &format!("/api/v1/repos/andy/demo/changes/{hash}"), None, None).await;
    assert_eq!(st, StatusCode::OK, "{v}");
    assert!(v["change"]["author"]["account"].is_null(), "{v}");
    assert!(v["change"]["author"]["note"].as_str().unwrap().contains("not linked"), "{v}");
    let page = call(app, "GET", &format!("/andy/demo/change/{hash}"), None, Some(&andy), None, None).await;
    assert!(page.body.contains("key not linked") && page.body.contains("/settings/keys"), "a signed-in viewer is pointed at Settings");
    let anon = call(app, "GET", &format!("/andy/demo/change/{hash}"), None, None, None, None).await;
    assert!(anon.body.contains("key not linked") && !anon.body.contains("link your key"));
}

/// Function history (hub spec §6.6): the file page lists a file's
/// functions, and a function's page lists exactly the changes to its lines.
#[tokio::test(flavor = "multi_thread")]
async fn a_function_has_its_own_history() {
    let h = hub().await;
    let app = &h.app;
    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))
        .await
        .cookie
        .unwrap();
    let page = call(app, "GET", "/new", None, Some(&andy), None, None).await;
    call(app, "POST", "/new", None, Some(&andy), None, Some(&format!("_csrf={}&owner=andy&name=demo", csrf_of(&page.body)))).await;
    let url = format!("{}/andy/demo", h.base);
    let work = tempfile::tempdir().unwrap();
    let w = work.path().to_path_buf();
    tokio::task::spawn_blocking(move || {
        let mut c = Repo::init(&w).unwrap();
        c.config.set("remote.origin.url", &url).unwrap();
        c.config.set("remote.origin.token", "site").unwrap();
        c.save_config().unwrap();
        let steps = [
            ("add lib", "use x;\n\nimpl Repo {\n    fn log(&self) {\n        one();\n    }\n}\n"),
            ("change the import", "use y;\n\nimpl Repo {\n    fn log(&self) {\n        one();\n    }\n}\n"),
            ("log twice", "use y;\n\nimpl Repo {\n    fn log(&self) {\n        one();\n        one();\n    }\n}\n"),
        ];
        for (msg, text) in steps {
            write(&w, "src/lib.rs", text.as_bytes());
            c.commit(msg, &[]).unwrap();
        }
        assert!(c.push("origin", false).unwrap()[0].ok);
    })
    .await
    .unwrap();
    let file = call(app, "GET", "/andy/demo/file/main/src/lib.rs", None, None, None, None).await.body;
    assert!(file.contains("Functions") && file.contains("/andy/demo/function/main/src/lib.rs?start=4&end=7&name=Repo%3A%3Alog"), "{file}");
    let r = call(app, "GET", "/andy/demo/function/main/src/lib.rs?start=4&end=7&name=Repo%3A%3Alog", None, None, None, None).await;
    assert_eq!(r.status, StatusCode::OK, "{}", r.body);
    assert!(r.body.contains("History of <code>Repo::log</code>") && r.body.contains("2 changes"), "{}", r.body);
    assert!(r.body.contains("log twice") && r.body.contains("add lib") && !r.body.contains("change the import"));
    let bad = call(app, "GET", "/andy/demo/function/main/src/lib.rs?start=4&end=99", None, None, None, None).await;
    assert_ne!(bad.status, StatusCode::OK);
}