//! Milestone 0.4 end to end: issues with labels, assignees and
//! milestones, cross references, closing keywords on landing, the inbox,
//! watching, mentions and search.

use axum::body::Body;
use axum::http::{header, Request, StatusCode};
use http_body_util::BodyExt;
use oxy_core::repo::Repo;
use oxygenhub::config::Config;
use oxygenhub::db;
use oxygenhub::repos::RepoName;
use oxygenhub::Shared;
use std::path::Path;
use tower::ServiceExt;

fn hermetic() {
    static ONCE: std::sync::Once = std::sync::Once::new();
    static DIR: std::sync::OnceLock<tempfile::TempDir> = std::sync::OnceLock::new();
    ONCE.call_once(|| {
        let d = tempfile::tempdir().unwrap();
        std::env::set_var("OXY_HOME", d.path());
        DIR.set(d).ok();
    });
}

fn write(root: &Path, rel: &str, content: &[u8]) {
    let p = root.join(rel);
    std::fs::create_dir_all(p.parent().unwrap()).unwrap();
    std::fs::write(p, content).unwrap();
}

struct Hub {
    app: Shared,
    base: String,
    _dir: tempfile::TempDir,
}

async fn hub() -> Hub {
    hermetic();
    let dir = tempfile::tempdir().unwrap();
    let mut config = Config::load(dir.path()).unwrap();
    // The first account's setup code (oxygenhub#245).
    config.registration.setup_code = "test-setup".into();
    config.auth.push_tokens = vec!["site".into()];
    config.registration.mode = "open".into();
    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
    let port = listener.local_addr().unwrap().port();
    config.server.base_url = format!("http://127.0.0.1:{port}");
    let app = oxygenhub::build(config).await.unwrap();
    let router = oxygenhub::router(app.clone());
    tokio::spawn(async move { axum::serve(listener, router).await.unwrap() });
    Hub { app, base: format!("http://127.0.0.1:{port}"), _dir: dir }
}

struct Res {
    status: StatusCode,
    body: String,
    cookie: Option<String>,
    location: Option<String>,
}

async fn send(app: &Shared, method: &str, path: &str, cookie: Option<&str>, form: Option<&str>) -> Res {
    let mut req = Request::builder().method(method).uri(path);
    if let Some(c) = cookie {
        req = req.header(header::COOKIE, format!("oxyhub={c}"));
    }
    let body = match form {
        Some(f) => {
            req = req.header(header::CONTENT_TYPE, "application/x-www-form-urlencoded");
            Body::from(f.to_string())
        }
        None => Body::empty(),
    };
    let res = oxygenhub::router(app.clone()).oneshot(req.body(body).unwrap()).await.unwrap();
    let status = res.status();
    let cookie = res
        .headers()
        .get(header::SET_COOKIE)
        .and_then(|v| v.to_str().ok())
        .and_then(|v| v.split(';').next())
        .and_then(|kv| kv.split_once('='))
        .map(|(_, v)| v.to_string());
    let location = res.headers().get(header::LOCATION).and_then(|v| v.to_str().ok()).map(String::from);
    let bytes = res.into_body().collect().await.unwrap().to_bytes();
    Res { status, body: String::from_utf8_lossy(&bytes).into_owned(), cookie, location }
}

async fn get(app: &Shared, path: &str, cookie: Option<&str>) -> Res {
    send(app, "GET", path, cookie, None).await
}

async fn post(app: &Shared, path: &str, cookie: Option<&str>, form: &str) -> Res {
    send(app, "POST", path, cookie, Some(form)).await
}

async fn register(app: &Shared, user: &str) -> String {
    let r = post(
        app,
        "/register",
        None,
        &format!("username={user}&email={user}%40example.com&password=correct-horse-battery&setup=test-setup"),
    )
    .await;
    assert_eq!(r.status, StatusCode::SEE_OTHER, "{}", r.body);
    r.cookie.unwrap()
}

/// A repository settings form's answer (#278): a redirect to the page that
/// holds the form, followed.
async fn settled(app: &Shared, r: Res, cookie: Option<&str>, page: &str) -> Res {
    assert_eq!(r.status, StatusCode::SEE_OTHER, "{}", r.body);
    let to = r.location.expect("a redirect");
    assert!(to.starts_with(&format!("{page}?")), "{to} is not {page}");
    get(app, &to, cookie).await
}

fn csrf_of(page: &str) -> String {
    let i = page.find("name=\"_csrf\" value=\"").expect("csrf field") + "name=\"_csrf\" value=\"".len();
    page[i..].split('"').next().unwrap().to_string()
}

#[tokio::test(flavor = "multi_thread")]
async fn issues_notifications_and_search() {
    let h = hub().await;
    let app = &h.app;
    let andy = register(app, "andy").await;
    let bob = register(app, "bob").await;
    let repo = RepoName::parse("andy/demo").unwrap();
    app.repos.create(&repo, None).unwrap();
    db::repos::create(&app.db, "andy", "demo", "", hub_api::Visibility::Public).await.unwrap();

    // Labels and a milestone, by the owner.
    let labels_page = get(app, "/andy/demo/labels", Some(&andy)).await;
    let csrf_a = csrf_of(&labels_page.body);
    assert!(post(app, "/andy/demo/labels", Some(&andy), &format!("_csrf={csrf_a}&name=bug&colour=%23ff0000&description=Something+broke"))
        .await
        .body
        .contains("Saved bug"));
    assert!(post(app, "/andy/demo/milestones", Some(&andy), &format!("_csrf={csrf_a}&title=v1&description=First&due=2027-01-01"))
        .await
        .body
        .contains("v1"));
    assert_eq!(get(app, "/andy/demo/labels", Some(&bob)).await.status, StatusCode::OK, "readers see labels");
    assert!(!get(app, "/andy/demo/labels", Some(&bob)).await.body.contains("Add or change"), "but cannot edit them");

    // Bob watches the repository, then Andy opens an issue mentioning @bob: Bob is told twice at most once.
    let overview = get(app, "/andy/demo", Some(&bob)).await;
    let csrf_b = csrf_of(&overview.body);
    assert_eq!(post(app, "/andy/demo/watch", Some(&bob), &format!("_csrf={csrf_b}")).await.status, StatusCode::SEE_OTHER);
    assert!(get(app, "/andy/demo", Some(&bob)).await.body.contains("UNWATCH"));
    let new_page = get(app, "/andy/demo/issues/new", Some(&andy)).await;
    let csrf_a = csrf_of(&new_page.body);
    let r = post(
        app,
        "/andy/demo/issues/new",
        Some(&andy),
        &format!("_csrf={csrf_a}&title=Crash+on+start&body=cc+%40bob+see+%23999+and+deadbeefcafe1234"),
    )
    .await;
    assert_eq!(r.status, StatusCode::SEE_OTHER, "{}", r.body);
    assert_eq!(r.location.as_deref(), Some("/andy/demo/issue/1"));
    let page = get(app, "/andy/demo/issue/1", Some(&bob)).await;
    assert!(page.body.contains("Crash on start"));
    assert!(page.body.contains("href=\"/bob\""), "mention linked: {}", page.body);
    assert!(page.body.contains("/andy/demo/change/deadbeefcafe1234"), "hash linked: {}", page.body);
    assert!(page.body.contains("#999") && !page.body.contains("issue/999"), "unknown numbers are not linked");
    let unread = db::notify::unread(&app.db, db::accounts::account_by_name(&app.db, "bob").await.unwrap().unwrap().id).await.unwrap();
    assert_eq!(unread, 1, "one notification, not one per reason");
    // The inbox's thread counts it unread (the SQL is portable now:
    // oxygenhub#211).
    let bob_id = db::accounts::account_by_name(&app.db, "bob").await.unwrap().unwrap().id;
    let filter = db::notify::Filter { done: false, unread_only: false, reason: None, kind: None, repo_id: None };
    let t = db::notify::threads(&app.db, bob_id, &filter, 10).await.unwrap();
    assert_eq!((t[0].count, t[0].unread), (1, 1));
    let unread_only = db::notify::Filter { unread_only: true, ..filter.clone() };
    assert_eq!(db::notify::threads(&app.db, bob_id, &unread_only, 10).await.unwrap().len(), 1);
    let inbox = get(app, "/notifications", Some(&bob)).await;
    assert!(inbox.body.contains("andy/demo#1: Crash on start"), "{}", inbox.body);
    assert!(get(app, "/andy/demo", Some(&bob)).await.body.contains("class=\"count\">1<"), "bell shows the count");

    // Triage: labels, assignee, milestone, pin, lock.
    let page = get(app, "/andy/demo/issue/1", Some(&andy)).await;
    let csrf_a = csrf_of(&page.body);
    let label_id: i64 = sqlx::query_scalar("SELECT id FROM labels WHERE name = 'bug'").fetch_one(&app.db).await.unwrap();
    let r = post(app, "/andy/demo/issue/1/labels", Some(&andy), &format!("_csrf={csrf_a}&label={label_id}")).await;
    assert!(r.body.contains(">bug<"), "{}", r.body);
    let r = post(app, "/andy/demo/issue/1/assign", Some(&andy), &format!("_csrf={csrf_a}&username=bob&action=add")).await;
    assert!(r.body.contains("<li><a href=\"/bob\"><img class=\"avatar xs\""), "{}", r.body);
    // oxygenhub#82: the sidebar's menu sets the whole list at once.
    assert!(r.body.contains("Assign people to this issue") && r.body.contains("data-menu-filter"), "the assignees menu");
    let r = post(app, "/andy/demo/issue/1/assign", Some(&andy), &format!("_csrf={csrf_a}&action=set&username=andy&username=bob")).await;
    let assigned = |db: oxygenhub::db::Pool| async move {
        let id: i64 = sqlx::query_scalar("SELECT id FROM issues WHERE number = 1").fetch_one(&db).await.unwrap();
        let mut a = db::issues::assignees(&db, id).await.unwrap();
        a.sort();
        a
    };
    assert_eq!(assigned(app.db.clone()).await, ["andy", "bob"], "{}", r.status);
    post(app, "/andy/demo/issue/1/assign", Some(&andy), &format!("_csrf={csrf_a}&action=set&username=bob")).await;
    assert_eq!(assigned(app.db.clone()).await, ["bob"], "set takes off who is not listed");
    let ms_id: i64 = sqlx::query_scalar("SELECT id FROM milestones WHERE title = 'v1'").fetch_one(&app.db).await.unwrap();
    let r = post(app, "/andy/demo/issue/1/milestone", Some(&andy), &format!("_csrf={csrf_a}&milestone={ms_id}")).await;
    assert!(r.body.contains(">v1<"), "{}", r.body);
    assert!(post(app, "/andy/demo/issue/1/state", Some(&andy), &format!("_csrf={csrf_a}&action=pin")).await.body.contains("Unpin issue"));
    assert_eq!(
        post(
            app,
            "/andy/demo/issue/1/state",
            Some(&bob),
            &format!("_csrf={}&action=lock", csrf_of(&get(app, "/andy/demo/issue/1", Some(&bob)).await.body))
        )
        .await
        .status,
        StatusCode::NOT_FOUND,
        "bob cannot lock"
    );
    // Filters on the list.
    let list = get(app, "/andy/demo/issues?q=label:bug+assignee:bob+milestone:v1", None).await;
    assert!(list.body.contains("Crash on start"), "{}", list.body);
    assert!(!get(app, "/andy/demo/issues?q=label:feature", None).await.body.contains("Crash on start"));
    assert!(get(app, "/andy/demo/milestones", None).await.body.contains("1 open, 0 closed"));

    // Bob comments and closes; the author is told; search finds the comment.
    let csrf_b = csrf_of(&get(app, "/andy/demo/issue/1", Some(&bob)).await.body);
    let r = post(app, "/andy/demo/issue/1/comment", Some(&bob), &format!("_csrf={csrf_b}&body=Reproduced+with+the+flux+capacitor")).await;
    assert!(r.body.contains("flux capacitor"), "{}", r.body);
    assert!(get(app, "/notifications", Some(&andy)).await.body.contains("andy/demo#1"));
    let s = get(app, "/search?q=capacitor", None).await;
    assert!(s.body.contains("Crash on start") && s.body.contains("<mark>capacitor</mark>"), "{}", s.body);
    let s = get(app, "/search?q=demo", None).await;
    assert!(s.body.contains("/andy/demo\""), "repository hit: {}", s.body);
    // Bob is not triage, but as an assignee of an open issue he can comment-and-close? No: only the author or triage.
    let r = post(app, "/andy/demo/issue/1/comment", Some(&bob), &format!("_csrf={csrf_b}&body=closing&close=completed")).await;
    assert!(r.body.contains(">open<") || r.body.contains("head\">open"), "still open: {}", r.body);
    let r = post(app, "/andy/demo/issue/1/comment", Some(&andy), &format!("_csrf={csrf_a}&body=fixed&close=completed")).await;
    assert!(r.body.contains("closed"), "{}", r.body);
    assert!(get(app, "/andy/demo/issues?state=closed", None).await.body.contains("Crash on start"));

    // A second issue closed by a change message pushed to the default bookmark.
    let csrf_a = csrf_of(&get(app, "/andy/demo/issues/new", Some(&andy)).await.body);
    assert_eq!(
        post(app, "/andy/demo/issues/new", Some(&andy), &format!("_csrf={csrf_a}&title=Typo&body=")).await.location.as_deref(),
        Some("/andy/demo/issue/2")
    );
    let work = tempfile::tempdir().unwrap();
    let mut client = Repo::init(work.path()).unwrap();
    client.config.set("remote.origin.url", &format!("{}/andy/demo", h.base)).unwrap();
    client.config.set("remote.origin.token", "site").unwrap();
    client.save_config().unwrap();
    write(work.path(), "a.txt", b"a\n");
    client.snapshot("t").unwrap();
    client.commit("Fix the typo\n\nCloses #2", &[]).unwrap();
    assert!(client.push("origin", false).unwrap().iter().all(|r| r.ok));
    // The push hook closes it after the push answers: wait, up to ten seconds (#121).
    let repo_id = db::repos::get(&app.db, "andy", "demo").await.unwrap().unwrap().id;
    let mut issue2 = db::issues::get(&app.db, repo_id, 2).await.unwrap().unwrap();
    for _ in 0..200 {
        if issue2.state == "closed" {
            break;
        }
        tokio::time::sleep(std::time::Duration::from_millis(50)).await;
        issue2 = db::issues::get(&app.db, repo_id, 2).await.unwrap().unwrap();
    }
    assert_eq!(issue2.state, "closed", "closed by the landed change");
    assert!(get(app, "/andy/demo/issue/2", None).await.body.contains("closed by change"));

    // Numbers are shared: the next proposal is #3, and /issue/3 redirects to it.
    client.bookmark_create("feat", None).unwrap();
    client.bookmark_switch("feat", false).unwrap();
    write(work.path(), "b.txt", b"b\n");
    client.snapshot("t").unwrap();
    client.commit("feat", &[]).unwrap();
    assert!(client.push_bookmark("origin", "feat", false).unwrap().iter().all(|r| r.ok));
    let csrf_a = csrf_of(&get(app, "/andy/demo/proposals/new?source=feat&target=main", Some(&andy)).await.body);
    let r = post(app, "/andy/demo/proposals/new", Some(&andy), &format!("_csrf={csrf_a}&title=Feat&target=main&source=feat")).await;
    assert_eq!(r.location.as_deref(), Some("/andy/demo/proposal/3"), "{}", r.body);
    assert_eq!(get(app, "/andy/demo/issue/3", None).await.location.as_deref(), Some("/andy/demo/proposal/3"));
    // A comment on the issue referencing #3 links to the proposal.
    let r = post(app, "/andy/demo/issue/2/comment", Some(&andy), &format!("_csrf={csrf_a}&body=see+%233")).await;
    assert!(r.body.contains("href=\"/andy/demo/proposal/3\""), "{}", r.body);
    // `#N` in a pushed change's message lands on those timelines (hub spec §8).
    client.bookmark_switch("main", false).unwrap();
    write(work.path(), "c.txt", b"c\n");
    client.snapshot("t").unwrap();
    let r = client.commit("Tidy up (refs #1, see #3)", &[]).unwrap();
    assert!(client.push("origin", false).unwrap().iter().all(|r| r.ok));
    let short = &r.to_hex()[..12];
    // The push hook records the references after the push answers: wait, up
    // to ten seconds (#121).
    let mut one = get(app, "/andy/demo/issue/1", None).await.body;
    for _ in 0..200 {
        if one.contains("referenced by change") {
            break;
        }
        tokio::time::sleep(std::time::Duration::from_millis(50)).await;
        one = get(app, "/andy/demo/issue/1", None).await.body;
    }
    assert!(
        one.contains("referenced by change") && one.contains(&format!("href=\"/andy/demo/change/{short}\"")) && one.contains(" on main"),
        "{one}"
    );
    let three = get(app, "/andy/demo/proposal/3", Some(&andy)).await.body;
    assert!(three.contains("referenced by change") && three.contains(short), "proposals too");
    assert!(!get(app, "/andy/demo/issue/2", None).await.body.contains("referenced by change"), "a closing change records only that");
    // #318: the same change pushed on another bookmark is no new reference.
    client.bookmark_create("again", None).unwrap();
    assert!(client.push_bookmark("origin", "again", false).unwrap().iter().all(|r| r.ok));
    tokio::time::sleep(std::time::Duration::from_millis(1500)).await;
    let recorded: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM issue_events WHERE event = 'referenced by change' AND detail LIKE $1")
        .bind(format!("{short} %"))
        .fetch_one(&app.db)
        .await
        .unwrap();
    assert_eq!(recorded, 1, "once per change, whichever bookmarks it is on");

    // #292: many references on one day are one box, wrapping, the newest
    // day's open; a lone one stays a line.
    let issue1 = db::issues::get(&app.db, repo_id, 1).await.unwrap().unwrap();
    let day = 1_792_540_800_000i64; // 21 Oct 2026, 00:00 UTC
    for (i, at) in [day + 1_000, day + 2_000, day + 3_000, day - 86_400_000].into_iter().enumerate() {
        sqlx::query("INSERT INTO issue_events (issue_id, at_ms, actor, event, detail) VALUES ($1, $2, 'andy', 'referenced by change', $3)")
            .bind(issue1.id)
            .bind(at)
            .bind(format!("{:012x} on main", 0xabc000 + i))
            .execute(&app.db)
            .await
            .unwrap();
    }
    // One recorded again for another bookmark before #318: shown once.
    sqlx::query("INSERT INTO issue_events (issue_id, at_ms, actor, event, detail) VALUES ($1, $2, 'andy', 'referenced by change', $3)")
        .bind(issue1.id)
        .bind(day + 4_000)
        .bind(format!("{:012x} on develop", 0xabc000))
        .execute(&app.db)
        .await
        .unwrap();
    let one = get(app, "/andy/demo/issue/1", None).await.body;
    assert!(one.contains("referenced by 3 changes on 21 Oct 2026"), "{one}");
    assert_eq!(one.matches(&format!("change/{:012x}\"", 0xabc000)).count(), 1, "each change once");
    assert!(!one.contains("mute timeline"), "the events have no rule of their own (#318)");
    assert!(one.contains("refs-day\" open><summary>referenced by 3 changes"), "the newest box is open: {one}");
    assert!(!one.contains("changes on 20 Oct 2026"), "a lone reference is a line");
    assert!(one.contains(&format!("href=\"/andy/demo/change/{short}\"")), "today's own stays");

    // Bob takes part in #1 (mentioned, assigned, commented) and only watches #3.
    let part = get(app, "/notifications?reason=participating", Some(&bob)).await.body;
    assert!(part.contains("andy/demo#1") && !part.contains("andy/demo#3: Feat"), "{part}");
    let watch = get(app, "/notifications?reason=watching", Some(&bob)).await.body;
    assert!(watch.contains("andy/demo#3: Feat") && !watch.contains("Crash on start"), "{watch}");
    let props = get(app, "/notifications?kind=proposal", Some(&bob)).await.body;
    assert!(props.contains("andy/demo#3: Feat") && !props.contains("andy/demo#1"), "kind filter");
    assert!(get(app, "/notifications?repo=andy/demo", Some(&bob)).await.body.contains("andy/demo#3: Feat"));
    assert!(get(app, "/notifications?repo=nobody/none", Some(&bob)).await.body.contains("Nothing matches these filters"));
    // One row per thread, however many events it had.
    let inbox = get(app, "/notifications", Some(&bob)).await.body;
    assert_eq!(inbox.matches("data-row-thread=\"/andy/demo/issue/1\"").count(), 1, "{inbox}");
    assert!(inbox.contains(" updates"), "the count of a busy thread");
    // Opening a thread marks it read and goes there.
    let bob_id = db::accounts::account_by_name(&app.db, "bob").await.unwrap().unwrap().id;
    let newest: i64 = sqlx::query_scalar(
        "SELECT id FROM notifications WHERE account_id = $1 AND thread = '/andy/demo/proposal/3' ORDER BY id DESC LIMIT 1",
    )
    .bind(bob_id)
    .fetch_one(&app.db)
    .await
    .unwrap();
    let before = db::notify::unread(&app.db, bob_id).await.unwrap();
    let r = get(app, &format!("/notifications/open/{newest}"), Some(&bob)).await;
    assert_eq!(r.location.as_deref(), Some("/andy/demo/proposal/3"));
    assert!(db::notify::unread(&app.db, bob_id).await.unwrap() < before);
    assert_eq!(get(app, &format!("/notifications/open/{newest}"), Some(&andy)).await.status, StatusCode::NOT_FOUND, "only your own");
    // Done sets a thread aside until something new happens in it.
    let csrf_b = csrf_of(&get(app, "/notifications", Some(&bob)).await.body);
    let r = post(
        app,
        "/notifications/thread",
        Some(&bob),
        &format!("_csrf={csrf_b}&thread=%2Fandy%2Fdemo%2Fissue%2F1&action=done&back=%2Fnotifications"),
    )
    .await;
    assert_eq!(r.location.as_deref(), Some("/notifications"));
    assert!(!get(app, "/notifications", Some(&bob)).await.body.contains("Crash on start"));
    assert!(get(app, "/notifications?view=done", Some(&bob)).await.body.contains("Crash on start"));
    post(app, "/andy/demo/issue/1/comment", Some(&andy), &format!("_csrf={csrf_a}&body=one+more+thing")).await;
    assert!(get(app, "/notifications", Some(&bob)).await.body.contains("Crash on start"), "back with the new comment");
    let r = post(
        app,
        "/notifications/thread",
        Some(&bob),
        &format!("_csrf={csrf_b}&thread=%2Fandy%2Fdemo%2Fissue%2F1&action=read&back=https%3A%2F%2Fevil.example"),
    )
    .await;
    assert_eq!(r.location.as_deref(), Some("/notifications"), "only back to the inbox");

    // Bob (watcher) heard about the proposal; the inbox marks all read.
    assert!(get(app, "/notifications", Some(&bob)).await.body.contains("andy/demo#3: Feat"));
    let csrf_b = csrf_of(&get(app, "/notifications", Some(&bob)).await.body);
    let r = post(app, "/notifications/read", Some(&bob), &format!("_csrf={csrf_b}")).await;
    assert!(r.body.contains("0 unread"), "{}", r.body);
    // Email preference and the unsubscribe link.
    let r = post(app, "/settings/notifications", Some(&bob), &format!("_csrf={csrf_b}&email=1")).await;
    assert!(r.body.contains("Email notifications are on"));
    let key: String = sqlx::query_scalar("SELECT unsubscribe_key FROM accounts WHERE username = 'bob'").fetch_one(&app.db).await.unwrap();
    assert_eq!(get(app, &format!("/settings/notifications?unsubscribe={key}"), None).await.status, StatusCode::OK);
    let on: bool = sqlx::query_scalar("SELECT email_notifications FROM accounts WHERE username = 'bob'").fetch_one(&app.db).await.unwrap();
    assert!(!on);
}

#[tokio::test(flavor = "multi_thread")]
async fn dashboard_shows_what_needs_the_viewer() {
    let h = hub().await;
    let app = &h.app;
    let andy = register(app, "andy").await;
    let bob = register(app, "bob").await;
    for (name, vis) in [("demo", hub_api::Visibility::Public), ("secret", hub_api::Visibility::Private)] {
        app.repos.create(&RepoName::parse(&format!("andy/{name}")).unwrap(), None).unwrap();
        db::repos::create(&app.db, "andy", name, "", vis).await.unwrap();
    }
    let demo = db::repos::get(&app.db, "andy", "demo").await.unwrap().unwrap();
    let secret = db::repos::get(&app.db, "andy", "secret").await.unwrap().unwrap();
    let bob_id = db::accounts::account_by_name(&app.db, "bob").await.unwrap().unwrap().id;
    for (repo, title) in [(demo.id, "Faster startup"), (secret.id, "Hidden work")] {
        let p = db::proposals::create(
            &app.db,
            db::proposals::NewProposal {
                repo_id: repo,
                title,
                body: "",
                author_id: Some(bob_id),
                author: "bob",
                draft: false,
                target: "main",
                source_kind: "bookmark",
                source_repo_id: Some(repo),
                source_bookmark: "fast",
                source_changes: "",
            },
        )
        .await
        .unwrap();
        db::proposals::add_event(&app.db, p.id, "bob", "opened", "").await.unwrap();
    }

    // Signed out, `/` is still the repository list.
    let anon = get(app, "/", None).await;
    assert!(anon.body.contains("andy /") && !anon.body.contains("Dashboard <small>"), "{}", anon.body);

    // Andy owns both repositories: both proposals wait for his review.
    let page = get(app, "/", Some(&andy)).await;
    assert_eq!(page.status, StatusCode::OK);
    assert!(page.body.contains("Waiting for your review</h2><span class=\"count-chip\">2</span>"), "{}", page.body);
    assert!(page.body.contains("/andy/demo/proposal/1") && page.body.contains("/andy/secret/proposal/1"));
    assert!(page.body.contains("Your repositories"));
    assert!(page.body.contains("opened proposal"), "activity feed: {}", page.body);

    // Your sky (#157, docs/backgrounds.md §5): the canvas, and its data from
    // the database: his repositories and their events, safe in a script.
    assert!(page.body.contains(r#"<canvas id="backdrop" aria-hidden="true">"#));
    let start = page.body.find(r#"id="backdrop-data">"#).unwrap() + r#"id="backdrop-data">"#.len();
    let data: serde_json::Value = serde_json::from_str(&page.body[start..start + page.body[start..].find("</script>").unwrap()]).unwrap();
    let repos: Vec<&str> = data["repos"].as_array().unwrap().iter().filter_map(|r| r.as_str()).collect();
    assert!(repos.contains(&"andy/demo") && repos.contains(&"andy/secret"), "{data}");
    let events = data["events"].as_array().unwrap();
    assert!(events.iter().any(|e| e[1] == 1), "the proposals opened are marks: {data}");
    assert!(events.iter().all(|e| e[0].as_u64().unwrap() < repos.len() as u64));
    // His page is his alone: no shared cache may keep it (#157).
    let res = oxygenhub::router(app.clone())
        .oneshot(Request::builder().uri("/").header(header::COOKIE, format!("oxyhub={andy}")).body(Body::empty()).unwrap())
        .await
        .unwrap();
    assert_eq!(res.headers()[header::CACHE_CONTROL], "private, no-store");
    // The mark on sign in; adrift on a page not found, not on a refusal.
    assert!(get(app, "/login", None)
        .await
        .body
        .contains(r#"<script type="application/json" id="backdrop-data">{"scene":"mark"}</script>"#));
    let lost = get(app, "/no/such/page/here", None).await;
    assert_eq!(lost.status, StatusCode::NOT_FOUND);
    assert!(lost.body.contains(r#"{"scene":"adrift"}"#));
    // Signed out, `/` has the hub's sky (#165): public repositories only.
    let sky_of = |body: &str| {
        let start = body.find(r#"id="backdrop-data">"#).unwrap() + r#"id="backdrop-data">"#.len();
        body[start..start + body[start..].find("</script>").unwrap()].to_string()
    };
    let hub_sky = sky_of(&anon.body);
    assert!(hub_sky.contains("andy/demo") && !hub_sky.contains("andy/secret"), "{hub_sky}");
    // Explore's sky is the hub's, public only, even for the owner of a
    // private repository; an owner's listing has none.
    let explore = get(app, "/explore", Some(&andy)).await;
    assert!(explore.body.contains("andy/secret"), "the list shows him his private repository");
    let hub_sky = sky_of(&explore.body);
    assert!(hub_sky.contains("andy/demo") && !hub_sky.contains("andy/secret"), "{hub_sky}");
    assert!(!get(app, "/andy", None).await.body.contains("backdrop-data"));
    // The engine is served as WebAssembly.
    let res = oxygenhub::router(app.clone())
        .oneshot(Request::builder().uri("/static/backdrop/backdrop_bg.wasm").body(Body::empty()).unwrap())
        .await
        .unwrap();
    assert_eq!(res.headers()[header::CONTENT_TYPE], "application/wasm");
    assert!(res.into_body().collect().await.unwrap().to_bytes().starts_with(b"\0asm"));
    // Live arrivals (#172): what happened since, by the sky's own rule.
    assert!(sky_of(&page.body).contains(r#""live":"mine""#) && hub_sky.contains(r#""live":"hub""#));
    let since = db::now_ms() - 3_600_000;
    let arrivals = |res: Res| -> Vec<String> {
        assert_eq!(res.status, StatusCode::OK, "{}", res.body);
        let v: serde_json::Value = serde_json::from_str(&res.body).unwrap();
        v["events"].as_array().unwrap().iter().map(|e| e[0].as_str().unwrap().to_string()).collect()
    };
    let mine = arrivals(get(app, &format!("/sky/arrivals?scene=mine&since={since}"), Some(&andy)).await);
    assert!(mine.iter().any(|r| r == "andy/demo") && mine.iter().any(|r| r == "andy/secret"), "{mine:?}");
    let hub = arrivals(get(app, &format!("/sky/arrivals?scene=hub&since={since}"), Some(&andy)).await);
    assert!(hub.iter().any(|r| r == "andy/demo") && !hub.iter().any(|r| r == "andy/secret"), "the hub's sky is public only: {hub:?}");
    let anon_hub = arrivals(get(app, &format!("/sky/arrivals?scene=hub&since={since}"), None).await);
    assert!(!anon_hub.iter().any(|r| r == "andy/secret"), "{anon_hub:?}");
    assert!(arrivals(get(app, &format!("/sky/arrivals?scene=mine&since={since}"), None).await).is_empty(), "signed out has no `mine`");
    assert!(
        arrivals(get(app, &format!("/sky/arrivals?scene=mine&since={since}"), Some(&bob)).await).is_empty(),
        "Bob's sky has none of Andy's"
    );
    assert!(
        arrivals(get(app, &format!("/sky/arrivals?scene=mine&since={}", db::now_ms()), Some(&andy)).await).is_empty(),
        "nothing since now"
    );

    // Once he reviews one, it leaves his queue.
    let andy_id = db::accounts::account_by_name(&app.db, "andy").await.unwrap().unwrap().id;
    let p = db::proposals::get(&app.db, demo.id, 1).await.unwrap().unwrap();
    db::proposals::add_review(&app.db, p.id, andy_id, "andy", "approve", "").await.unwrap();
    assert!(get(app, "/", Some(&andy)).await.body.contains("Waiting for your review</h2><span class=\"count-chip\">1</span>"));

    // Bob sees his own proposal on the public repository, never the private one's.
    let page = get(app, "/", Some(&bob)).await;
    // His sky holds only his own repositories: never Andy's, public or
    // private, and nothing of the private one (#157).
    let start = page.body.find(r#"id="backdrop-data">"#).unwrap() + r#"id="backdrop-data">"#.len();
    let sky = &page.body[start..start + page.body[start..].find("</script>").unwrap()];
    assert!(!sky.contains("andy/secret") && !sky.contains("andy/demo"), "{sky}");
    assert!(page.body.contains("Your proposals</h2><span class=\"count-chip\">1</span>"), "{}", page.body);
    assert!(!page.body.contains("Hidden work"));
    assert!(page.body.contains("Waiting for your review</h2><span class=\"count-chip\">0</span>"));
    assert!(page.body.contains("Faster startup"));
    let feed = &page.body[page.body.find("Recent activity").unwrap()..];
    assert!(!feed.contains("andy/secret"), "private activity leaked: {feed}");

    // Explore still lists every visible repository.
    assert!(get(app, "/explore", Some(&bob)).await.body.contains("andy /"));
}

#[tokio::test(flavor = "multi_thread")]
async fn empty_repository_shows_a_quickstart() {
    let h = hub().await;
    let app = &h.app;
    let andy = register(app, "andy").await;
    let bob = register(app, "bob").await;
    app.repos.create(&RepoName::parse("andy/fresh").unwrap(), None).unwrap();
    db::repos::create(&app.db, "andy", "fresh", "", hub_api::Visibility::Public).await.unwrap();

    let page = get(app, "/andy/fresh", Some(&andy)).await;
    assert!(page.body.contains("This repository is empty"), "{}", page.body);
    let clone_url = format!("{}/andy/fresh", h.base);
    assert!(page.body.contains(&format!("oxy remote add hub {clone_url}")), "{}", page.body);
    assert!(page.body.contains("oxy config remote.hub.token YOUR-TOKEN"));
    assert!(page.body.contains("oxy push hub"));
    assert!(
        page.body.contains("mkdir fresh &amp;&amp; cd fresh") || page.body.contains("mkdir fresh &#38;&#38; cd fresh"),
        "{}",
        page.body
    );
    assert!(page.body.contains("oxy git import --branch main"));
    assert!(!page.body.contains("oxyhub-ca.pem"), "no certificate step without a self-signed certificate");

    // A reader without write access is not told to push.
    let page = get(app, "/andy/fresh", Some(&bob)).await;
    assert!(page.body.contains("Nothing has been pushed yet") && !page.body.contains("oxy push hub"), "{}", page.body);

    // After a first push the quickstart gives way to the tree.
    let work = tempfile::tempdir().unwrap();
    let mut client = Repo::init(work.path()).unwrap();
    client.config.set("remote.hub.url", &clone_url).unwrap();
    client.config.set("remote.hub.token", "site").unwrap();
    client.save_config().unwrap();
    write(work.path(), "README.md", b"# fresh\n");
    client.commit("First change", &[]).unwrap();
    assert!(client.push("hub", false).unwrap().iter().all(|r| r.ok));
    let page = get(app, "/andy/fresh", Some(&andy)).await;
    assert!(!page.body.contains("This repository is empty") && page.body.contains("README.md"), "{}", page.body);
}

#[tokio::test(flavor = "multi_thread")]
async fn theme_is_chosen_in_settings_and_remembered_in_a_cookie() {
    let h = hub().await;
    let app = &h.app;
    let andy = register(app, "andy").await;
    let page = get(app, "/settings", Some(&andy)).await;
    assert!(page.body.contains("Appearance"));
    assert!(page.body.contains(r#"value="light" checked"#), "light by default: {}", page.body);
    assert!(page.body.contains("data-theme-toggle"), "the header has the switch");
    let csrf = csrf_of(&page.body);
    let r = post(app, "/settings/appearance", Some(&andy), &format!("_csrf={csrf}&theme=dark")).await;
    assert_eq!(r.status, StatusCode::SEE_OTHER);
    assert_eq!(r.cookie.as_deref(), Some("dark"));
    assert_eq!(r.location.as_deref(), Some("/settings"));
    let page = send_with_theme(app, &andy, "dark").await;
    assert!(page.contains(r#"value="dark" checked"#), "the form shows the cookie's theme");
    assert_eq!(post(app, "/settings/appearance", Some(&andy), &format!("_csrf={csrf}&theme=purple")).await.status, StatusCode::BAD_REQUEST);

    // The background (docs/backgrounds.md §7): moving by default, kept in
    // its own cookie beside the theme.
    assert!(get(app, "/settings", Some(&andy)).await.body.contains(r#"name="backdrop" value="moving" checked"#));
    let res = oxygenhub::router(app.clone())
        .oneshot(
            Request::builder()
                .method("POST")
                .uri("/settings/appearance")
                .header(header::COOKIE, format!("oxyhub={andy}"))
                .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
                .body(Body::from(format!("_csrf={csrf}&theme=light&backdrop=still")))
                .unwrap(),
        )
        .await
        .unwrap();
    let cookies: Vec<&str> = res.headers().get_all(header::SET_COOKIE).iter().filter_map(|v| v.to_str().ok()).collect();
    assert!(
        cookies.iter().any(|c| c.starts_with("theme=light;")) && cookies.iter().any(|c| c.starts_with("backdrop=still;")),
        "{cookies:?}"
    );
    assert_eq!(
        post(app, "/settings/appearance", Some(&andy), &format!("_csrf={csrf}&theme=light&backdrop=wild")).await.status,
        StatusCode::BAD_REQUEST
    );
    assert_eq!(post(app, "/settings/appearance", Some(&andy), "_csrf=nope&theme=light").await.status, StatusCode::BAD_REQUEST);
}

async fn send_with_theme(app: &Shared, session: &str, theme: &str) -> String {
    let req =
        Request::builder().uri("/settings").header(header::COOKIE, format!("oxyhub={session}; theme={theme}")).body(Body::empty()).unwrap();
    let res = oxygenhub::router(app.clone()).oneshot(req).await.unwrap();
    String::from_utf8_lossy(&res.into_body().collect().await.unwrap().to_bytes()).into_owned()
}

#[tokio::test(flavor = "multi_thread")]
async fn profile_and_organisation_pages() {
    let h = hub().await;
    let app = &h.app;
    let andy = register(app, "andy").await;
    let bob = register(app, "bob").await;
    let andy_id = db::accounts::account_by_name(&app.db, "andy").await.unwrap().unwrap().id;
    let bob_id = db::accounts::account_by_name(&app.db, "bob").await.unwrap().unwrap().id;
    app.repos.create(&RepoName::parse("andy/demo").unwrap(), None).unwrap();
    db::repos::create(&app.db, "andy", "demo", "A demo", hub_api::Visibility::Public).await.unwrap();
    app.repos.create(&RepoName::parse("andy/hidden").unwrap(), None).unwrap();
    db::repos::create(&app.db, "andy", "hidden", "", hub_api::Visibility::Private).await.unwrap();

    // Andy fills in his profile; a script URL and markup are refused or escaped.
    let csrf = csrf_of(&get(app, "/settings", Some(&andy)).await.body);
    let r = post(app, "/settings", Some(&andy), &format!("_csrf={csrf}&display_name=Andy+McCall&email=a%40example.com&bio=Builds+%3Cb%3Eoxy%3C%2Fb%3E&website=javascript%3Aalert(1)&location=Earth")).await;
    assert!(r.body.contains("must be an http"), "{}", r.body);
    let r = post(app, "/settings", Some(&andy), &format!("_csrf={csrf}&display_name=Andy+McCall&email=a%40example.com&bio=Builds+%3Cb%3Eoxy%3C%2Fb%3E&website=https%3A%2F%2Fexample.org&location=Earth")).await;
    assert!(r.body.contains("Profile saved"), "{}", r.body);

    let org = db::accounts::create_org(&app.db, "retro", "Retro Club", andy_id).await.unwrap();
    db::accounts::set_org_member(&app.db, org.id, bob_id, "member").await.unwrap();
    let team = db::accounts::create_team(&app.db, org.id, "core").await.unwrap();
    db::accounts::add_team_member(&app.db, team.id, bob_id).await.unwrap();

    let page = get(app, "/andy", Some(&bob)).await;
    assert_eq!(page.status, StatusCode::OK);
    for want in ["Andy McCall", "Earth", r#"href="https://example.org""#, "/avatar/andy", "Signing keys", "/retro", "demo"] {
        assert!(page.body.contains(want), "profile lacks {want}: {}", page.body);
    }
    assert!(!page.body.contains("<b>oxy</b>"), "the bio is escaped");
    assert!(!page.body.contains("a@example.com"), "the email stays private");
    assert!(!page.body.contains("/andy/hidden"), "bob cannot see the private repository");
    assert!(!page.body.contains("edit profile"), "only the owner gets the edit link");
    assert!(get(app, "/andy", Some(&andy)).await.body.contains("/andy/hidden"), "andy sees his own private repository");

    let page = get(app, "/retro", Some(&bob)).await;
    assert_eq!(page.status, StatusCode::OK);
    for want in ["Retro Club", "organisation", r#"Members <span class="count-chip">2</span>"#, "core", "1 member"] {
        assert!(page.body.contains(want), "org page lacks {want}: {}", page.body);
    }
    assert!(!page.body.contains("/orgs/retro/settings"), "bob is not an owner");
    assert!(get(app, "/retro", Some(&andy)).await.body.contains("/orgs/retro/settings"));

    let svg = get(app, "/avatar/andy", None).await;
    assert_eq!(svg.status, StatusCode::OK);
    assert!(svg.body.starts_with("<svg"));
    assert_eq!(svg.body, get(app, "/avatar/ANDY", None).await.body);
    assert_eq!(get(app, "/nobody-here", None).await.status, StatusCode::NOT_FOUND);
}

#[tokio::test(flavor = "multi_thread")]
async fn diffs_mark_words_hide_whitespace_and_collapse() {
    let h = hub().await;
    let app = &h.app;
    let andy = register(app, "andy").await;
    app.repos.create(&RepoName::parse("andy/demo").unwrap(), None).unwrap();
    db::repos::create(&app.db, "andy", "demo", "", hub_api::Visibility::Public).await.unwrap();
    let work = tempfile::tempdir().unwrap();
    let mut client = Repo::init(work.path()).unwrap();
    client.config.set("remote.hub.url", &format!("{}/andy/demo", h.base)).unwrap();
    client.config.set("remote.hub.token", "site").unwrap();
    client.save_config().unwrap();
    write(work.path(), "main.rs", b"fn main() {\n  setup();\n  let answer = 42;\n}\n");
    client.commit("first", &[]).unwrap();
    write(work.path(), "main.rs", b"fn main() {\n    setup();\n  let answer = 43;\n}\n");
    let second = client.commit("reindent and change the answer", &[]).unwrap();
    assert!(client.push("hub", false).unwrap().iter().all(|r| r.ok));

    let url = format!("/andy/demo/change/{}", second.to_hex());
    let page = get(app, &url, Some(&andy)).await;
    assert_eq!(page.status, StatusCode::OK);
    assert!(page.body.contains(r#"<details class="file-diff""#), "files collapse: {}", page.body);
    assert!(page.body.contains(r#"<span class="wx">43</span>"#), "the changed word is marked: {}", page.body);
    assert!(page.body.contains("hide whitespace changes"));
    assert!(page.body.contains("data-diff-mode=\"split\""));
    let adds = |b: &str| b.matches(r#"<tr class="add">"#).count();
    assert_eq!(adds(&page.body), 2, "re-indent and answer both changed");

    let quiet = get(app, &format!("{url}?w=1"), Some(&andy)).await;
    assert_eq!(adds(&quiet.body), 1, "only the answer changed ignoring whitespace: {}", quiet.body);
    assert!(quiet.body.contains("show whitespace changes"));

    assert!(quiet.body.contains("?w=0"), "the toggle leads back");
}

#[tokio::test(flavor = "multi_thread")]
async fn fork_and_propose_upstream() {
    let h = hub().await;
    let app = &h.app;
    let andy = register(app, "andy").await;
    let bob = register(app, "bob").await;
    app.repos.create(&RepoName::parse("andy/demo").unwrap(), None).unwrap();
    db::repos::create(&app.db, "andy", "demo", "The demo", hub_api::Visibility::Public).await.unwrap();
    let work = tempfile::tempdir().unwrap();
    let mut client = Repo::init(work.path()).unwrap();
    client.config.set("remote.hub.url", &format!("{}/andy/demo", h.base)).unwrap();
    client.config.set("remote.hub.token", "site").unwrap();
    client.save_config().unwrap();
    write(work.path(), "README.md", b"# demo\n");
    client.commit("first", &[]).unwrap();
    assert!(client.push("hub", false).unwrap().iter().all(|r| r.ok));

    // Bob forks it; he cannot fork into Andy's name.
    let page = get(app, "/andy/demo", Some(&bob)).await;
    assert!(page.body.contains("/andy/demo/fork"), "a fork button: {}", page.body);
    let csrf = csrf_of(&get(app, "/andy/demo/fork", Some(&bob)).await.body);
    let r = post(app, "/andy/demo/fork", Some(&bob), &format!("_csrf={csrf}&owner=andy&name=other")).await;
    assert!(r.body.contains("cannot create repositories under that owner"), "{}", r.body);
    let r = post(app, "/andy/demo/fork", Some(&bob), &format!("_csrf={csrf}&owner=bob&name=demo")).await;
    assert_eq!(r.status, StatusCode::SEE_OTHER, "{}", r.body);
    assert_eq!(r.location.as_deref(), Some("/bob/demo"));
    let forked = get(app, "/bob/demo", Some(&bob)).await;
    assert!(forked.body.contains("README.md") && forked.body.contains("forked from"), "{}", forked.body);
    assert!(forked.body.contains("propose to andy/demo"));
    assert!(get(app, "/andy/demo", None).await.body.contains("1 fork"));
    assert!(get(app, "/andy/demo/forks", None).await.body.contains("/bob/demo"));
    let fork_row = db::repos::get(&app.db, "bob", "demo").await.unwrap().unwrap();
    let up_row = db::repos::get(&app.db, "andy", "demo").await.unwrap().unwrap();
    assert_eq!(fork_row.forked_from, Some(up_row.id));
    assert_eq!(fork_row.description, "The demo");
    let fork_repo = app.repos.open(&RepoName::parse("bob/demo").unwrap()).unwrap();
    let up_repo = app.repos.open(&RepoName::parse("andy/demo").unwrap()).unwrap();
    assert_ne!(fork_repo.id().unwrap(), up_repo.id().unwrap(), "a fork is a repository of its own");
    assert_eq!(fork_repo.bookmark_heads().unwrap(), up_repo.bookmark_heads().unwrap());
    assert_eq!(fork_repo.fsck().unwrap().errors(), 0);

    // Bob works in a clone of his fork, pushes a bookmark, and proposes it upstream.
    let bw = tempfile::tempdir().unwrap();
    let mut mine = Repo::clone(&format!("{}/bob/demo", h.base), &bw.path().join("c")).unwrap();
    mine.config.set("remote.origin.token", "site").unwrap();
    mine.save_config().unwrap();
    mine.bookmark_create("feat", None).unwrap();
    mine.bookmark_switch("feat", false).unwrap();
    write(&bw.path().join("c"), "feature.txt", b"new\n");
    mine.commit("Add a feature", &[]).unwrap();
    assert!(mine.push_bookmark("origin", "feat", false).unwrap().iter().all(|r| r.ok));
    let csrf = csrf_of(&get(app, "/andy/demo/proposals/new?source=bob/demo:feat", Some(&bob)).await.body);
    let r =
        post(app, "/andy/demo/proposals/new", Some(&bob), &format!("_csrf={csrf}&title=From+my+fork&target=main&source=bob%2Fdemo%3Afeat"))
            .await;
    assert_eq!(r.status, StatusCode::SEE_OTHER, "{}", r.body);
    let p = get(app, &r.location.unwrap(), Some(&andy)).await;
    assert!(p.body.contains("From my fork") && p.body.contains("fork bob/demo"), "{}", p.body);
    let files = get(app, "/andy/demo/proposal/1?tab=files", Some(&andy)).await;
    assert!(files.body.contains("feature.txt"), "{}", files.body);
}

#[tokio::test(flavor = "multi_thread")]
async fn stars_topics_and_explore() {
    let h = hub().await;
    let app = &h.app;
    let andy = register(app, "andy").await;
    let bob = register(app, "bob").await;
    for (name, desc) in [("alpha", "An emulator"), ("beta", "A compiler"), ("gamma", "Retro games")] {
        app.repos.create(&RepoName::parse(&format!("andy/{name}")).unwrap(), None).unwrap();
        db::repos::create(&app.db, "andy", name, desc, hub_api::Visibility::Public).await.unwrap();
    }

    // Topics through settings; bad ones are refused.
    let csrf = csrf_of(&get(app, "/andy/gamma/settings", Some(&andy)).await.body);
    let r = post(
        app,
        "/andy/gamma/settings",
        Some(&andy),
        &format!("_csrf={csrf}&description=Retro+games&default_bookmark=main&visibility=public&topics=c%2B%2B"),
    )
    .await;
    let r = settled(app, r, Some(&andy), "/andy/gamma/settings/general").await;
    assert!(r.body.contains("is not a topic"), "{}", r.body);
    let r = post(
        app,
        "/andy/gamma/settings",
        Some(&andy),
        &format!("_csrf={csrf}&description=Retro+games&default_bookmark=main&visibility=public&topics=Retro%2C+6502"),
    )
    .await;
    let r = settled(app, r, Some(&andy), "/andy/gamma/settings/general").await;
    assert!(r.body.contains("Saved"), "{}", r.body);
    assert_eq!(db::repos::get(&app.db, "andy", "gamma").await.unwrap().unwrap().topics, "retro 6502");
    let page = get(app, "/andy/gamma", None).await;
    assert!(page.body.contains(r#"href="/explore?topic=retro""#), "{}", page.body);

    // Stars: bob stars beta and gamma, andy stars gamma; toggling unstars.
    for (who, repo) in [(&bob, "beta"), (&bob, "gamma"), (&andy, "gamma"), (&andy, "alpha")] {
        let csrf = csrf_of(&get(app, &format!("/andy/{repo}"), Some(who)).await.body);
        assert_eq!(post(app, &format!("/andy/{repo}/star"), Some(who), &format!("_csrf={csrf}")).await.status, StatusCode::SEE_OTHER);
    }
    let csrf = csrf_of(&get(app, "/andy/alpha", Some(&andy)).await.body);
    post(app, "/andy/alpha/star", Some(&andy), &format!("_csrf={csrf}")).await;
    assert!(get(app, "/andy/gamma", Some(&bob)).await.body.contains("★ UNSTAR"));
    assert!(get(app, "/andy/gamma", None).await.body.contains(r#"title="2 stars">"#));
    assert!(get(app, "/andy/alpha", None).await.body.contains(r#"title="0 stars">"#), "unstarred again");

    // Explore: sort by stars, by name, filter by text and by topic.
    let order = |b: &str| {
        ["alpha", "beta", "gamma"]
            .into_iter()
            .map(|n| (b.find(&format!("/andy/{n}\"")).unwrap_or(usize::MAX), n))
            .collect::<std::collections::BTreeMap<_, _>>()
            .into_values()
            .collect::<Vec<_>>()
    };
    assert_eq!(order(&get(app, "/explore?sort=stars", None).await.body)[..2], ["gamma", "beta"]);
    assert_eq!(order(&get(app, "/explore?sort=name", None).await.body), ["alpha", "beta", "gamma"]);
    let filtered = get(app, "/explore?q=compiler", None).await.body;
    assert!(filtered.contains("/andy/beta\"") && !filtered.contains("/andy/alpha\""), "{filtered}");
    let by_topic = get(app, "/explore?topic=6502", None).await.body;
    assert!(by_topic.contains("/andy/gamma\"") && !by_topic.contains("/andy/beta\""), "{by_topic}");
}

#[tokio::test(flavor = "multi_thread")]
async fn lists_filter_sort_page_and_count() {
    let h = hub().await;
    let app = &h.app;
    let andy = register(app, "andy").await;
    let _bob = register(app, "bob").await;
    app.repos.create(&RepoName::parse("andy/demo").unwrap(), None).unwrap();
    let repo = db::repos::create(&app.db, "andy", "demo", "", hub_api::Visibility::Public).await.unwrap();
    for n in 0..30 {
        let author = if n % 3 == 0 { "bob" } else { "andy" };
        db::issues::create(
            &app.db,
            db::issues::NewIssue { repo_id: repo.id, title: &format!("Issue number {n}"), body: "", author_id: None, author },
        )
        .await
        .unwrap();
    }
    let ui = db::issues::upsert_label(&app.db, repo.id, "ui", "#00f0ff", "").await.unwrap();
    for (title, author, target) in [("Faster menus", "bob", "main"), ("New theme", "andy", "main"), ("Release prep", "andy", "stable")] {
        let p = db::proposals::create(
            &app.db,
            db::proposals::NewProposal {
                repo_id: repo.id,
                title,
                body: "",
                author_id: None,
                author,
                draft: false,
                target,
                source_kind: "changes",
                source_repo_id: None,
                source_bookmark: "",
                source_changes: "",
            },
        )
        .await
        .unwrap();
        if title == "New theme" {
            db::issues::set_proposal_label(&app.db, p.id, ui.id, true).await.unwrap();
        }
    }

    // The tabs count what is open.
    let page = get(app, "/andy/demo/issues", Some(&andy)).await;
    assert!(page.body.contains(r#"Issues <span class="count-chip">30</span>"#), "{}", page.body);
    assert!(page.body.contains(r#"Proposals <span class="count-chip">3</span>"#));

    // Pages of 25, newest first; the second page holds the rest.
    let rows = |b: &str| b.matches("/andy/demo/issue/").count();
    assert_eq!(rows(&page.body), 25);
    assert!(page.body.contains("page 1 of 2") && page.body.contains("page=2"), "a pager");
    let second = get(app, "/andy/demo/issues?page=2", Some(&andy)).await;
    assert_eq!(rows(&second.body), 5);
    assert!(second.body.contains("Issue number 0<"), "the oldest are last");
    let oldest = get(app, "/andy/demo/issues?sort=oldest", Some(&andy)).await;
    assert!(oldest.body.find("Issue number 0<").unwrap() < oldest.body.find("Issue number 1<").unwrap());
    let bobs = get(app, "/andy/demo/issues?q=author:bob", Some(&andy)).await;
    assert_eq!(rows(&bobs.body), 10, "{}", bobs.body);

    // Proposals: by author, label and target.
    let by_bob = get(app, "/andy/demo/proposals?q=author:bob", Some(&andy)).await.body;
    assert!(by_bob.contains("Faster menus") && !by_bob.contains("New theme"));
    let ui_only = get(app, "/andy/demo/proposals?q=label:ui", Some(&andy)).await.body;
    assert!(ui_only.contains("New theme") && !ui_only.contains("Faster menus") && ui_only.contains(r#"class="label""#));
    let stable = get(app, "/andy/demo/proposals?q=target:stable", Some(&andy)).await.body;
    assert!(stable.contains("Release prep") && !stable.contains("New theme"));
}

#[tokio::test(flavor = "multi_thread")]
async fn project_boards() {
    let h = hub().await;
    let app = &h.app;
    let andy = register(app, "andy").await;
    let bob = register(app, "bob").await;
    for (name, vis) in [("demo", hub_api::Visibility::Public), ("secret", hub_api::Visibility::Private)] {
        app.repos.create(&RepoName::parse(&format!("andy/{name}")).unwrap(), None).unwrap();
        let row = db::repos::create(&app.db, "andy", name, "", vis).await.unwrap();
        db::issues::create(
            &app.db,
            db::issues::NewIssue { repo_id: row.id, title: &format!("{name} issue"), body: "", author_id: None, author: "andy" },
        )
        .await
        .unwrap();
    }
    // Found from anywhere (#119): the site bar and the owner's profile (no
    // longer the repository's tabs, #254), and a New project button on the
    // list; a stranger is told who can make one.
    let home = get(app, "/andy/demo", Some(&andy)).await.body;
    assert!(home.contains("href=\"/projects/andy\"><svg class=\"ic\""), "site bar");
    assert!(!home.contains("project boards\">Projects</a>"), "not a repository tab");
    assert!(get(app, "/andy", Some(&bob)).await.body.contains("href=\"/projects/andy\">Projects</a>"), "the owner's profile");
    let list = get(app, "/projects/andy", Some(&andy)).await.body;
    assert!(list.contains("href=\"#new\">+ NEW PROJECT</a>") && list.contains("id=\"new\""), "the button and the form");
    assert!(get(app, "/projects/andy", Some(&bob)).await.body.contains("Only andy"), "who can make one");
    let csrf = csrf_of(&list);
    let r = post(app, "/projects/andy", Some(&andy), &format!("_csrf={csrf}&title=Roadmap&description=Next+steps")).await;
    assert_eq!(r.location.as_deref(), Some("/projects/andy/1"), "{}", r.body);
    // The list (#124): a row per project, counted under Open, and a filter.
    let list = get(app, "/projects/andy", Some(&andy)).await.body;
    assert!(
        list.contains(">Roadmap</a>") && list.contains("Next steps") && list.contains("Open <span class=\"count-chip\">1</span>"),
        "{list}"
    );
    let filtered = get(app, "/projects/andy?q=roadm", Some(&andy)).await.body;
    assert!(filtered.contains(">Roadmap</a>"), "a filter matches part of the title, any case");
    let none = get(app, "/projects/andy?q=nothing+like+it", Some(&andy)).await.body;
    assert!(none.contains("No open project matches") && !none.contains(">Roadmap</a>"), "{none}");
    let closed = get(app, "/projects/andy?state=closed", Some(&andy)).await.body;
    assert!(closed.contains("No closed projects.") && closed.contains("Closed <span class=\"count-chip\">0</span>"), "{closed}");
    let board = get(app, "/projects/andy/1", Some(&andy)).await.body;
    for col in ["Backlog", "Doing", "Done"] {
        assert!(board.contains(&format!(">{col} <span")), "{col}");
    }
    let cols: Vec<i64> = sqlx::query_scalar("SELECT id FROM project_columns ORDER BY position").fetch_all(&app.db).await.unwrap();
    let act = |form: String| {
        let andy = andy.clone();
        async move { post(app, "/projects/andy/1", Some(&andy), &form).await }
    };
    // Cards: by reference, by repository and number, a note; duplicates and strangers refused.
    assert_eq!(
        act(format!("_csrf={csrf}&action=add&column={}&reference=demo%231", cols[0])).await.location.as_deref(),
        Some("/projects/andy/1")
    );
    act(format!("_csrf={csrf}&action=add&column={}&repo=secret&reference=%231", cols[0])).await;
    act(format!("_csrf={csrf}&action=add&column={}&note=Write+the+docs", cols[1])).await;
    assert!(act(format!("_csrf={csrf}&action=add&column={}&reference=demo%231", cols[1])).await.body.contains("already on this project"));
    assert!(act(format!("_csrf={csrf}&action=add&column={}&reference=demo%2399", cols[0])).await.body.contains("no issue or proposal #99"));
    assert!(act(format!("_csrf={csrf}&action=add&column={}&reference=nothere%231", cols[0])).await.body.contains("no repository nothere"));
    // Move demo#1 to Done.
    let demo_card: i64 =
        sqlx::query_scalar("SELECT c.id FROM project_cards c JOIN repositories r ON r.id = c.repo_id WHERE r.name = 'demo'")
            .fetch_one(&app.db)
            .await
            .unwrap();
    act(format!("_csrf={csrf}&action=move&card={demo_card}&column={}", cols[2])).await;
    let issue = get(app, "/andy/demo/issue/1", None).await.body;
    assert!(issue.contains("href=\"/projects/andy/1\">Roadmap</a> <span class=\"mute\">· Done"), "the issue shows where it is");

    // Readers see public cards, never those of repositories they cannot read.
    let anon = get(app, "/projects/andy/1", None).await.body;
    assert!(anon.contains("demo issue") && anon.contains("Write the docs") && !anon.contains("secret issue"), "{anon}");
    assert!(!anon.contains("name=\"action\""), "and cannot change anything");
    assert!(get(app, "/projects/andy/1", Some(&andy)).await.body.contains("secret issue"));
    // Only the owner changes it; a private project is invisible to others.
    let csrf_b = csrf_of(&get(app, "/settings", Some(&bob)).await.body);
    assert_eq!(
        post(app, "/projects/andy/1", Some(&bob), &format!("_csrf={csrf_b}&action=remove&card={demo_card}")).await.status,
        StatusCode::NOT_FOUND
    );
    act(format!("_csrf={csrf}&action=settings&title=Roadmap&description=&private=1")).await;
    assert_eq!(get(app, "/projects/andy/1", Some(&bob)).await.status, StatusCode::NOT_FOUND);
    assert!(!get(app, "/projects/andy", None).await.body.contains("Roadmap"), "not even listed");
    assert!(!get(app, "/andy/demo/issue/1", None).await.body.contains("Roadmap"), "nor on the issue");

    // Columns: removing one moves its cards to the first column; the last one stays.
    act(format!("_csrf={csrf}&action=remove_column&column={}", cols[1])).await;
    let note_col: i64 = sqlx::query_scalar("SELECT column_id FROM project_cards WHERE kind = 'note'").fetch_one(&app.db).await.unwrap();
    assert_eq!(note_col, cols[0]);
    act(format!("_csrf={csrf}&action=remove_column&column={}", cols[2])).await;
    assert!(act(format!("_csrf={csrf}&action=remove_column&column={}", cols[0])).await.body.contains("at least one column"));
    // Closed projects are read-only until reopened; then deleted, the issues remain.
    act(format!("_csrf={csrf}&action=settings&title=Roadmap&closed=1")).await;
    assert!(act(format!("_csrf={csrf}&action=add&column={}&note=late", cols[0])).await.body.contains("This project is closed"));
    let r = act(format!("_csrf={csrf}&action=delete")).await;
    assert_eq!(r.location.as_deref(), Some("/projects/andy"));
    assert_eq!(get(app, "/projects/andy/1", Some(&andy)).await.status, StatusCode::NOT_FOUND);
    assert_eq!(get(app, "/andy/demo/issue/1", None).await.status, StatusCode::OK);
    assert_eq!(get(app, "/projects/nobody", None).await.status, StatusCode::NOT_FOUND);
}

/// #293: a long column shows its newest cards, says how many older ones it
/// leaves out and links to them all; a filter finds cards in any column.
#[tokio::test(flavor = "multi_thread")]
async fn a_long_column_shows_its_newest_cards() {
    let h = hub().await;
    let app = &h.app;
    let andy = register(app, "andy").await;
    let csrf = csrf_of(&get(app, "/projects/andy", Some(&andy)).await.body);
    post(app, "/projects/andy", Some(&andy), &format!("_csrf={csrf}&title=Roadmap")).await;
    let (project, done): (i64, i64) =
        sqlx::query_as("SELECT p.id, c.id FROM projects p JOIN project_columns c ON c.project_id = p.id WHERE c.name = 'Done'")
            .fetch_one(&app.db)
            .await
            .unwrap();
    for i in 1..=35 {
        sqlx::query(
            "INSERT INTO project_cards (project_id, column_id, position, kind, note, created_ms) VALUES ($1, $2, $3, 'note', $4, 0)",
        )
        .bind(project)
        .bind(done)
        .bind(i)
        .bind(format!("card-{i:03}"))
        .execute(&app.db)
        .await
        .unwrap();
    }
    let board = get(app, "/projects/andy/1", Some(&andy)).await.body;
    assert!(board.contains("5 older cards not shown") && board.contains(&format!("?all={done}#col-{done}\">show all 35</a>")), "{board}");
    assert!(board.contains("card-006") && board.contains("card-035") && !board.contains("card-005"), "the newest 30");
    assert!(board.contains(">35</span></h2>"), "the count is the column's");
    let all = get(app, &format!("/projects/andy/1?all={done}"), Some(&andy)).await.body;
    assert!(all.contains("card-001") && !all.contains("older cards not shown"), "show all");
    let found = get(app, "/projects/andy/1?q=CARD-002", Some(&andy)).await.body;
    assert!(found.contains("card-002") && !found.contains("card-030") && found.contains("1 of 35"), "{found}");
    assert!(found.contains(">clear</a>"));
    let open = get(app, "/projects/andy/1?state=open", Some(&andy)).await.body;
    assert!(!open.contains("card-0"), "notes have no state");
}

/// #293: a card shows its issue's labels and assignees, each a link to
/// the board filtered by it, and the filter takes `label:`, `assignee:`
/// and `state:` with words, every term holding.
#[tokio::test(flavor = "multi_thread")]
async fn a_board_filters_by_label_and_assignee() {
    let h = hub().await;
    let app = &h.app;
    let andy = register(app, "andy").await;
    let csrf = csrf_of(&get(app, "/projects/andy", Some(&andy)).await.body);
    post(app, "/projects/andy", Some(&andy), &format!("_csrf={csrf}&title=Roadmap")).await;
    app.repos.create(&RepoName::parse("andy/game").unwrap(), None).unwrap();
    let row = db::repos::create(&app.db, "andy", "game", "", hub_api::Visibility::Public).await.unwrap();
    let mut ids = Vec::new();
    for title in ["Sound crackles", "Jump is floaty", "Title screen"] {
        let i = db::issues::create(&app.db, db::issues::NewIssue { repo_id: row.id, title, body: "", author_id: None, author: "andy" })
            .await
            .unwrap();
        ids.push(i.id);
    }
    let bug = db::issues::upsert_label(&app.db, row.id, "bug", "#d73a4a", "Something is wrong").await.unwrap();
    let feel = db::issues::upsert_label(&app.db, row.id, "feel", "#0e8a16", "").await.unwrap();
    db::issues::set_issue_label(&app.db, ids[0], bug.id, true).await.unwrap();
    db::issues::set_issue_label(&app.db, ids[1], bug.id, true).await.unwrap();
    db::issues::set_issue_label(&app.db, ids[1], feel.id, true).await.unwrap();
    let (andy_id,): (i64,) = sqlx::query_as("SELECT id FROM accounts WHERE username = 'andy'").fetch_one(&app.db).await.unwrap();
    db::issues::set_assignee(&app.db, ids[1], andy_id, true).await.unwrap();
    let (project, todo): (i64, i64) =
        sqlx::query_as("SELECT p.id, c.id FROM projects p JOIN project_columns c ON c.project_id = p.id ORDER BY c.position LIMIT 1")
            .fetch_one(&app.db)
            .await
            .unwrap();
    for n in 1..=3i64 {
        sqlx::query(
            "INSERT INTO project_cards (project_id, column_id, position, kind, repo_id, number, note, created_ms) VALUES ($1, $2, $3, 'issue', $4, $5, '', 0)",
        )
        .bind(project)
        .bind(todo)
        .bind(n)
        .bind(row.id)
        .bind(n)
        .execute(&app.db)
        .await
        .unwrap();
    }
    let board = get(app, "/projects/andy/1", Some(&andy)).await.body;
    assert!(board.contains("href=\"/projects/andy/1?q=label:bug\""), "{board}");
    assert!(board.contains("title=\"Something is wrong\">bug</a>"), "a label's description is its title");
    assert!(board.contains(">@andy</a>"), "{board}");
    let bugs = get(app, "/projects/andy/1?q=label:bug", Some(&andy)).await.body;
    assert!(bugs.contains("Sound crackles") && bugs.contains("Jump is floaty") && !bugs.contains("Title screen"), "{bugs}");
    assert!(bugs.contains("2 of 3"));
    let both = get(app, "/projects/andy/1?q=label:BUG+label:feel", Some(&andy)).await.body;
    assert!(!both.contains("Sound crackles") && both.contains("Jump is floaty"), "every label must hold");
    let mine = get(app, "/projects/andy/1?q=assignee:%40andy", Some(&andy)).await.body;
    assert!(mine.contains("Jump is floaty") && !mine.contains("Sound crackles"), "{mine}");
    let words = get(app, "/projects/andy/1?q=label:bug+sound", Some(&andy)).await.body;
    assert!(words.contains("Sound crackles") && !words.contains("Jump is floaty"));
    let closed = get(app, "/projects/andy/1?q=state:closed", Some(&andy)).await.body;
    assert!(closed.contains("0 of 3"), "{closed}");
}

/// #293: a card is archived off the board, kept and found on the archive
/// view, and restored; a column archives its cards older than some days
/// at once, or on its own once set to; an issue's page says its card is
/// archived.
#[tokio::test(flavor = "multi_thread")]
async fn board_cards_are_archived_and_restored() {
    let h = hub().await;
    let app = &h.app;
    let andy = register(app, "andy").await;
    let csrf = csrf_of(&get(app, "/projects/andy", Some(&andy)).await.body);
    post(app, "/projects/andy", Some(&andy), &format!("_csrf={csrf}&title=Roadmap")).await;
    let (project, done): (i64, i64) =
        sqlx::query_as("SELECT p.id, c.id FROM projects p JOIN project_columns c ON c.project_id = p.id WHERE c.name = 'Done'")
            .fetch_one(&app.db)
            .await
            .unwrap();
    let day = 86_400_000i64;
    let now = db::now_ms();
    for (i, age) in [40, 20, 10, 1].iter().enumerate() {
        sqlx::query(
            "INSERT INTO project_cards (project_id, column_id, position, kind, note, created_ms, moved_ms) VALUES ($1, $2, $3, 'note', $4, 0, $5)",
        )
        .bind(project)
        .bind(done)
        .bind(i as i64)
        .bind(format!("aged-{age}"))
        .bind(now - age * day)
        .execute(&app.db)
        .await
        .unwrap();
    }
    let id_of = |note: &'static str| async move {
        sqlx::query_scalar::<_, i64>("SELECT id FROM project_cards WHERE note = $1").bind(note).fetch_one(&app.db).await.unwrap()
    };
    let board = "/projects/andy/1";
    let (who, token) = (&andy, &csrf);
    let act = |body: String| async move { post(app, board, Some(who), &format!("_csrf={token}&{body}")).await };

    // One card by hand: off the board, on the archive view, restorable.
    let forty = id_of("aged-40").await;
    act(format!("action=archive&card={forty}")).await;
    let page = get(app, board, Some(&andy)).await.body;
    assert!(!page.contains("aged-40") && page.contains("aged-20"), "{page}");
    assert!(page.contains("?archived=1\">1 archived card</a>"), "{page}");
    let archived = get(app, &format!("{board}?archived=1"), Some(&andy)).await.body;
    assert!(archived.contains("aged-40") && !archived.contains("aged-20"), "{archived}");
    assert!(archived.contains("value=\"restore\"") && archived.contains("Back to the board"));
    assert!(!archived.contains("add a card"), "the archive view adds nothing");
    let found = get(app, &format!("{board}?archived=1&q=aged-40"), Some(&andy)).await.body;
    assert!(found.contains("1 of 1") && found.contains("name=\"archived\" value=\"1\""), "{found}");
    act(format!("action=restore&card={forty}")).await;
    assert!(get(app, board, Some(&andy)).await.body.contains("aged-40"));

    // The column's cards there more than 15 days, at once: 40 (just
    // restored, so it joined again now) stays, 20 goes.
    let r = act(format!("action=archive_older&column={done}&days=15")).await;
    assert!(r.body.contains("Archived 1 card from Done."), "{}", r.body);
    let page = get(app, board, Some(&andy)).await.body;
    assert!(page.contains("aged-40") && !page.contains("aged-20") && page.contains("aged-10"));
    let r = act(format!("action=archive_older&column={done}&days=soon")).await;
    assert!(r.body.contains("Give a number of days"), "{}", r.body);

    // On its own: Done after 5 days; the hourly pass takes aged-10 only.
    let r = act(format!("action=archive_after&column={done}&days=5")).await;
    assert!(r.body.contains("Done archives its cards 5 days after they reach it."), "{}", r.body);
    assert!(get(app, board, Some(&andy)).await.body.contains("archives cards 5 days after they reach it"));
    assert_eq!(db::projects::archive_due(&app.db, db::now_ms()).await.unwrap(), 1);
    let page = get(app, board, Some(&andy)).await.body;
    assert!(page.contains("aged-40") && !page.contains("aged-10") && page.contains("aged-1<"), "{page}");
    assert!(page.contains("2 archived cards"));
    let r = act(format!("action=archive_after&column={done}&mode=never")).await;
    assert!(r.body.contains("Done keeps its cards until you archive them."));
    assert_eq!(db::projects::archive_due(&app.db, db::now_ms() + 100 * day).await.unwrap(), 0, "never, now");

    // The default (#293, Andy 2026-10-25): finished work, a closed issue,
    // goes a fortnight after it reached its column; open work and notes stay.
    let r = act(format!("action=archive_after&column={done}&mode=finished")).await;
    assert!(r.body.contains("Done archives finished cards 14 days after they reach it."), "{}", r.body);
    db::repos::create(&app.db, "andy", "demo", "", hub_api::Visibility::Public).await.unwrap();
    let repo = db::repos::get(&app.db, "andy", "demo").await.unwrap().unwrap();
    let mut cards = vec![];
    for title in ["shipped", "still open"] {
        let i = db::issues::create(&app.db, db::issues::NewIssue { repo_id: repo.id, title, body: "", author_id: None, author: "andy" })
            .await
            .unwrap();
        if title == "shipped" {
            db::issues::set_state(&app.db, i.id, "closed", "completed").await.unwrap();
        }
        let id: i64 = sqlx::query_scalar(
            "INSERT INTO project_cards (project_id, column_id, position, kind, repo_id, number, note, created_ms, moved_ms) \
             VALUES ($1, $2, 10, 'issue', $3, $4, '', 0, $5) RETURNING id",
        )
        .bind(project)
        .bind(done)
        .bind(repo.id)
        .bind(i.number)
        .bind(now - 20 * day)
        .fetch_one(&app.db)
        .await
        .unwrap();
        cards.push(id);
    }
    assert_eq!(db::projects::archive_due(&app.db, db::now_ms()).await.unwrap(), 1, "the closed issue only");
    let archived_ms = |id: i64| async move {
        sqlx::query_scalar::<_, Option<i64>>("SELECT archived_ms FROM project_cards WHERE id = $1")
            .bind(id)
            .fetch_one(&app.db)
            .await
            .unwrap()
    };
    assert!(archived_ms(cards[0]).await.is_some() && archived_ms(cards[1]).await.is_none());
    let page = get(app, board, Some(&andy)).await.body;
    assert!(page.contains("value=\"finished\" selected"), "the column says so");
}

#[tokio::test(flavor = "multi_thread")]
async fn issue_markdown_follows_the_default_bookmark() {
    let h = hub().await;
    let app = &h.app;
    register(app, "andy").await;
    app.repos.create(&RepoName::parse("andy/trunky").unwrap(), None).unwrap();
    let row = db::repos::create(&app.db, "andy", "trunky", "", hub_api::Visibility::Public).await.unwrap();
    sqlx::query("UPDATE repositories SET default_bookmark = 'trunk' WHERE id = $1").bind(row.id).execute(&app.db).await.unwrap();
    db::issues::create(
        &app.db,
        db::issues::NewIssue {
            repo_id: row.id,
            title: "Docs",
            body: "See [the guide](docs/guide.md) and ![shot](img/a.png).",
            author_id: None,
            author: "andy",
        },
    )
    .await
    .unwrap();
    let page = get(app, "/andy/trunky/issue/1", None).await.body;
    assert!(page.contains("href=\"/andy/trunky/file/trunk/docs/guide.md\""), "{page}");
    assert!(page.contains("src=\"/andy/trunky/raw/trunk/img/a.png\""));
    assert!(!page.contains("/file/main/"));
}

/// #125: a board moves to an owner its user may make boards under, takes the
/// next number there with its cards, and its old address redirects to it; a
/// new board at the old address takes it over.
#[tokio::test(flavor = "multi_thread")]
async fn a_project_transfers_to_an_organisation() {
    let h = hub().await;
    let app = &h.app;
    // The first account is the site's administrator, who may make boards
    // anywhere: Andy is an ordinary user here.
    let _first = register(app, "ada").await;
    let andy = register(app, "andy").await;
    let _bob = register(app, "bob").await;
    let andy_id = db::accounts::account_by_name(&app.db, "andy").await.unwrap().unwrap().id;
    let bob_id = db::accounts::account_by_name(&app.db, "bob").await.unwrap().unwrap().id;
    db::accounts::create_org(&app.db, "retro", "Retro Club", andy_id).await.unwrap();
    db::accounts::create_org(&app.db, "other", "Someone else's", bob_id).await.unwrap();
    let list = get(app, "/projects/andy", Some(&andy)).await.body;
    let csrf = csrf_of(&list);
    let r = post(app, "/projects/andy", Some(&andy), &format!("_csrf={csrf}&title=Roadmap")).await;
    assert_eq!(r.location.as_deref(), Some("/projects/andy/1"));
    post(app, "/projects/andy/1", Some(&andy), &format!("_csrf={csrf}&action=add&note=Keep+me")).await;

    // Settings offer the organisations Andy belongs to, not other people's.
    let board = get(app, "/projects/andy/1", Some(&andy)).await.body;
    assert!(board.contains("<option value=\"retro\">retro</option>") && !board.contains("value=\"other\""), "{board}");
    let refused = post(app, "/projects/andy/1", Some(&andy), &format!("_csrf={csrf}&action=transfer&to=other")).await;
    assert!(refused.body.contains("You cannot make projects under other"), "{}", refused.body);

    let r = post(app, "/projects/andy/1", Some(&andy), &format!("_csrf={csrf}&action=transfer&to=retro")).await;
    assert_eq!(r.location.as_deref(), Some("/projects/retro/1"), "{}", r.body);
    let moved = get(app, "/projects/retro/1", Some(&andy)).await.body;
    assert!(moved.contains("Roadmap") && moved.contains("Keep me"), "the cards come too");
    let old = get(app, "/projects/andy/1", Some(&andy)).await;
    assert_eq!(old.status, StatusCode::PERMANENT_REDIRECT);
    assert_eq!(old.location.as_deref(), Some("/projects/retro/1"));

    // A new board of Andy's takes number 1 again, and its own address back.
    let r = post(app, "/projects/andy", Some(&andy), &format!("_csrf={csrf}&title=Fresh")).await;
    assert_eq!(r.location.as_deref(), Some("/projects/andy/1"));
    let fresh = get(app, "/projects/andy/1", Some(&andy)).await;
    assert_eq!(fresh.status, StatusCode::OK);
    assert!(fresh.body.contains("Fresh"));
}

/// Backups' settings (#169): a user's page, its checks, and an
/// organisation's page for its owners only.
#[tokio::test(flavor = "multi_thread")]
async fn backups_are_set_up_in_settings() {
    let h = hub().await;
    let app = &h.app;
    let andy = register(app, "andy").await;
    let page = get(app, "/settings/backups", Some(&andy)).await;
    assert_eq!(page.status, StatusCode::OK);
    assert!(page.body.contains("href=\"/settings/backups\" class=\"on\"") && page.body.contains("No runs yet."), "{}", page.body);
    let csrf = csrf_of(&page.body);
    // This hub allows no directory: only a bucket, and a real provider name.
    let bad = post(
        app,
        "/settings/backups",
        Some(&andy),
        &format!("_csrf={csrf}&every=hourly&destination=gcs&bucket=andy-backup&provider=nope&keep_days=30"),
    )
    .await;
    assert!(bad.body.contains("workload identity provider"), "{}", bad.body);
    let dir =
        post(app, "/settings/backups", Some(&andy), &format!("_csrf={csrf}&every=hourly&destination=dir&dir=%2Ftmp&keep_days=30")).await;
    assert!(dir.body.contains("Pick one of the directories this hub allows."));
    let provider =
        "%2F%2Fiam.googleapis.com%2Fprojects%2F1%2Flocations%2Fglobal%2FworkloadIdentityPools%2Foxygenhub%2Fproviders%2Foxygenhub-io";
    let ok = post(
        app,
        "/settings/backups",
        Some(&andy),
        &format!("_csrf={csrf}&every=hourly&destination=gcs&bucket=gs%3A%2F%2Fandy-backup&provider={provider}&keep_days=7"),
    )
    .await;
    assert!(ok.body.contains("Saved."), "{}", ok.body);
    let s = oxygenhub::backups::setting(&app.db, "andy").await.unwrap().unwrap();
    assert_eq!((s.target.as_str(), s.keep_days, s.every.as_str()), ("andy-backup", 7, "hourly"));
    // An S3 bucket (BP4): its region and the role the hub assumes.
    let bad = post(
        app,
        "/settings/backups",
        Some(&andy),
        &format!("_csrf={csrf}&every=hourly&destination=s3&s3_bucket=andy-backup&s3_region=eu-west-2&s3_role=admin&keep_days=30"),
    )
    .await;
    assert!(bad.body.contains("the IAM role"), "{}", bad.body);
    let role = "arn%3Aaws%3Aiam%3A%3A123456789012%3Arole%2Foxygenhub-backup";
    let ok = post(
        app,
        "/settings/backups",
        Some(&andy),
        &format!(
            "_csrf={csrf}&every=daily&destination=s3&s3_bucket=s3%3A%2F%2Fandy-backup&s3_region=eu-west-2&s3_role={role}&keep_days=30"
        ),
    )
    .await;
    assert!(ok.body.contains("Saved.") && ok.body.contains(r#"value="s3" checked"#), "{}", ok.body);
    let s = oxygenhub::backups::setting(&app.db, "andy").await.unwrap().unwrap();
    assert_eq!((s.destination.as_str(), s.target.as_str(), s.region.as_str()), ("s3", "andy-backup", "eu-west-2"));
    assert_eq!(s.provider, "arn:aws:iam::123456789012:role/oxygenhub-backup");
    // Back to GCS for what follows.
    let ok = post(
        app,
        "/settings/backups",
        Some(&andy),
        &format!("_csrf={csrf}&every=hourly&destination=gcs&bucket=gs%3A%2F%2Fandy-backup&provider={provider}&keep_days=7"),
    )
    .await;
    assert!(ok.body.contains("Saved."));
    // An organisation's backups are its owners' business only.
    let bob = register(app, "bob").await;
    let andy_id = db::accounts::account_by_name(&app.db, "andy").await.unwrap().unwrap().id;
    db::accounts::create_org(&app.db, "club", "Club", andy_id).await.unwrap();
    assert_eq!(get(app, "/orgs/club/settings/backups", Some(&bob)).await.status, StatusCode::NOT_FOUND);
    let club = get(app, "/orgs/club/settings/backups", Some(&andy)).await;
    assert!(club.body.contains("club</a>'s repositories"), "{}", club.body);
    assert!(get(app, "/orgs/club/settings", Some(&andy)).await.body.contains("/orgs/club/settings/backups"));

    // Admin › Backups (docs/backups.md §5): whether each ran, and who has
    // none; administrators only.
    sqlx::query("UPDATE accounts SET is_admin = (username = 'andy')").execute(&app.db).await.unwrap();
    app.repos.create(&oxygenhub::repos::RepoName::parse("bob/game").unwrap(), None).unwrap();
    db::repos::create(&app.db, "bob", "game", "", hub_api::Visibility::Public).await.unwrap();
    assert_eq!(get(app, "/admin/backups", Some(&bob)).await.status, StatusCode::NOT_FOUND);
    let admin = get(app, "/admin/backups", Some(&andy)).await;
    assert_eq!(admin.status, StatusCode::OK);
    assert!(admin.body.contains("gs://andy-backup") && admin.body.contains("hourly") && admin.body.contains("never"), "{}", admin.body);
    let missing = &admin.body[admin.body.find("Not backed up").unwrap()..];
    assert!(missing.contains("href=\"/bob\"") && missing.contains("1 repository"), "{missing}");
    assert!(get(app, "/admin", Some(&andy)).await.body.contains("/admin/backups"));
    // A repository chooses its own (BP3): its owners decide.
    let game = get(app, "/bob/game/settings/backup", Some(&bob)).await;
    assert!(game.body.contains("bob has no backup set up yet") && game.body.contains(r#"name="backup" value="" checked"#), "{}", game.body);
    let csrf = csrf_of(&game.body);
    let saved = post(app, "/bob/game/settings/backup", Some(&bob), &format!("_csrf={csrf}&backup=off")).await;
    let saved = settled(app, saved, Some(&bob), "/bob/game/settings/backup").await;
    assert!(saved.body.contains("left out of its owner"), "{}", saved.body);
    assert_eq!(db::repos::get(&app.db, "bob", "game").await.unwrap().unwrap().backup, "off");
    let bad = post(app, "/bob/game/settings/backup", Some(&bob), &format!("_csrf={csrf}&backup=weekly")).await;
    let bad = settled(app, bad, Some(&bob), "/bob/game/settings/backup").await;
    assert!(bad.body.contains("Pick how this repository is backed up."));
}

/// oxygenhub#183: an owner hears about their repository by default, until
/// they mute it; what an agent does with a token its owner marked is told
/// to that owner; the administrators hear of each new account.
#[tokio::test(flavor = "multi_thread")]
async fn owners_hear_by_default_and_agents_tell_their_owner() {
    let h = hub().await;
    let app = &h.app;
    let andy = register(app, "andy").await;
    let bob = register(app, "bob").await;
    let andy_id = db::accounts::account_by_name(&app.db, "andy").await.unwrap().unwrap().id;
    let kinds = |id: i64| {
        let db = app.db.clone();
        async move { db::notify::inbox(&db, id, 50).await.unwrap().into_iter().map(|n| (n.kind, n.title, n.actor)).collect::<Vec<_>>() }
    };
    assert!(kinds(andy_id).await.iter().any(|(k, t, _)| k == "account.registered" && t.contains("bob")), "the administrator hears of bob");
    let repo = RepoName::parse("andy/demo").unwrap();
    app.repos.create(&repo, None).unwrap();
    db::repos::create(&app.db, "andy", "demo", "", hub_api::Visibility::Public).await.unwrap();
    let open = |who: &'static str, title: &'static str| {
        let (app, cookie) = (app.clone(), if who == "bob" { bob.clone() } else { andy.clone() });
        async move {
            let csrf = csrf_of(&get(&app, "/andy/demo/issues/new", Some(&cookie)).await.body);
            post(&app, "/andy/demo/issues/new", Some(&cookie), &format!("_csrf={csrf}&title={title}&body=x")).await
        }
    };
    // Andy never pressed Watch, but owns it: he hears of bob's issue.
    assert!(get(app, "/andy/demo", Some(&andy)).await.body.contains("UNWATCH"), "an owner watches by default");
    open("bob", "First").await;
    assert!(kinds(andy_id).await.iter().any(|(k, t, _)| k == "issue.opened" && t.contains("First")));
    // Muted, he does not.
    let csrf = csrf_of(&get(app, "/andy/demo", Some(&andy)).await.body);
    post(app, "/andy/demo/watch", Some(&andy), &format!("_csrf={csrf}")).await;
    assert!(get(app, "/andy/demo", Some(&andy)).await.body.contains(">WATCH<"), "muted");
    open("bob", "Second").await;
    assert!(!kinds(andy_id).await.iter().any(|(_, t, _)| t.contains("Second")));
    post(app, "/andy/demo/watch", Some(&andy), &format!("_csrf={csrf}")).await;

    // His own doing is not told to him; his agent's is.
    let token = |agent: bool| {
        let db = app.db.clone();
        async move {
            let (t, hash) = oxygenhub::auth::new_token();
            db::accounts::create_token(&db, andy_id, if agent { "Claude" } else { "laptop" }, &hash, "repo:read,repo:write", "", None)
                .await
                .unwrap();
            if agent {
                let id = db::accounts::token_by_hash(&db, &hash).await.unwrap().unwrap().id;
                db::accounts::set_token_agent(&db, andy_id, id, true).await.unwrap();
            }
            t
        }
    };
    let api_issue = |t: String, title: &'static str| {
        let app = app.clone();
        async move {
            use tower::ServiceExt;
            let req = axum::http::Request::post("/api/v1/repos/andy/demo/issues")
                .header("authorization", format!("Bearer {t}"))
                .header("content-type", "application/json")
                .body(axum::body::Body::from(serde_json::json!({ "title": title, "body": "" }).to_string()))
                .unwrap();
            oxygenhub::router(app).oneshot(req).await.unwrap().status()
        }
    };
    assert_eq!(api_issue(token(false).await, "By hand").await, StatusCode::CREATED);
    assert!(!kinds(andy_id).await.iter().any(|(_, t, _)| t.contains("By hand")), "his own doing");
    assert_eq!(api_issue(token(true).await, "By the agent").await, StatusCode::CREATED);
    let told = kinds(andy_id).await;
    let agent = told.iter().find(|(_, t, _)| t.contains("By the agent")).expect("told of his agent's issue");
    assert_eq!(agent.2, "andy (agent token Claude)");
    // The tokens page marks and unmarks one.
    let page = get(app, "/settings/tokens", Some(&andy)).await;
    assert!(page.body.contains("Not an agent") && page.body.contains("Mark as agent"), "{}", page.body);
    assert!(page.body.contains(r#"<span class="pill agent-pill""#), "the agent's token says so");
}