//! Radar end to end (spec §17, §8.3, §21.2): the owner signs in with a

//! one-time link their CLI signed, every page renders and none shows

//! without the session, a post needs the session's CSRF token and our own

//! origin and is recorded as a verified session event.

mod common;

use common::{add_agent, hermetic, run, setup, text, Serving};

use serde_json::json;

use spectra_mcp::client::Client;

fn link(d: &std::path::Path) -> String {

    let o = hermetic(d).args(["open", "--no-browser"]).output().unwrap();

    let t = text(&o);

    let url = t.split_whitespace().find(|w| w.starts_with("http://")).unwrap_or_else(|| panic!("no link in {t}")).to_string();

    url.split_once("7350")

        .or_else(|| url.split_once(":0"))

        .map(|(_, p)| p.to_string())

        .unwrap_or_else(|| format!("/{}", url.splitn(4, '/').nth(3).unwrap()))

}

#[tokio::test]

async fn the_owner_signs_in_reads_every_page_and_posts() {

    let dir = setup();

    let d = dir.path();

    let agent = add_agent(d, "claude-oxygen", &[]);

    let srv = Serving::start(d);

    let a = Client::new(&srv.socket, Some(agent));

    let say = json!({ "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "say", "arguments": { "body": "@andy **ready** for review", "channel": "humans" } } });

    assert_eq!(a.mcp("2025-11-25", &say).await.unwrap().status, 200);

    let web = Client::new(&srv.socket, None);

    for path in ["/", "/channels", "/c/general", "/log"] {

        let r = web.send("GET", path, &[], vec![]).await.unwrap();

        assert_eq!(r.status, 401, "{path} without a session");

        assert!(String::from_utf8_lossy(&r.body).contains("spectra open"));

    }

    let path = link(d);

    let r = web.send("GET", &path, &[], vec![]).await.unwrap();

    assert_eq!(r.status, 303, "{}", String::from_utf8_lossy(&r.body));

    let cookie = r.header("set-cookie").unwrap().split(';').next().unwrap().to_string();

    assert!(r.header("set-cookie").unwrap().contains("HttpOnly"));

    assert_eq!(web.send("GET", &path, &[], vec![]).await.unwrap().status, 401, "a link works once");

    let get = |p: &'static str| {

        let (web, cookie) = (&web, cookie.clone());

        async move {

            let r = web.send("GET", p, &[("cookie", cookie)], vec![]).await.unwrap();

            assert_eq!(r.status, 200, "{p}: {}", String::from_utf8_lossy(&r.body));

            assert!(r.header("content-security-policy").unwrap().contains("default-src 'self'"));

            String::from_utf8_lossy(&r.body).to_string()

        }

    };

    let live = get("/").await;

    assert!(live.contains("claude-oxygen") && live.contains("Andy McCall's agent"), "escaped by askama: {live}");

    assert!(live.contains("1 unread"));

    assert!(get("/channels").await.contains("#humans"));

    let humans = get("/c/humans").await;

    assert!(humans.contains("<strong>ready</strong>"), "Markdown rendered: {humans}");

    let log = get("/log").await;

    assert!(log.contains("message.posted") && log.contains("signature · level 2"));

    let csrf = humans.split("name=\"_csrf\" value=\"").nth(1).unwrap().split('"').next().unwrap().to_string();

    let form = |csrf: &str| format!("_csrf={csrf}&body=Looks+good%2C+%40claude-oxygen").into_bytes();

    let h = |origin: &str| {

        vec![("cookie", cookie.clone()), ("content-type", "application/x-www-form-urlencoded".to_string()), ("origin", origin.to_string())]

    };

    assert_eq!(web.send("POST", "/c/humans", &h("http://evil.example"), form(&csrf)).await.unwrap().status, 403);

    // Without an Origin header (not a browser) the CSRF token alone guards

    // the form; a browser's Origin must also be the daemon's own address.

    let no_origin = vec![("cookie", cookie.clone()), ("content-type", "application/x-www-form-urlencoded".to_string())];

    assert_eq!(web.send("POST", "/c/humans", &no_origin, form("stale")).await.unwrap().status, 403);

    assert_eq!(web.send("POST", "/c/humans", &no_origin, form(&csrf)).await.unwrap().status, 303);

    assert!(get("/c/humans").await.contains("Looks good"));

    assert_eq!(web.send("POST", "/log/verify", &no_origin, format!("_csrf={csrf}").into_bytes()).await.unwrap().status, 303);

    assert!(get("/log").await.contains("clean at"));

    srv.stop();

    let v: serde_json::Value = serde_json::from_slice(&run(d, &["admin", "verify", "--json"]).stdout).unwrap();

    assert!(v["findings"].as_array().unwrap().is_empty(), "the session post verifies: {v}");

    let pool = sqlx::SqlitePool::connect(&format!("sqlite://{}", d.join("data/spectra.db").display())).await.unwrap();

    let m: (String, i64) = sqlx::query_as("SELECT actor, auth_method FROM events WHERE kind = 'message.posted' ORDER BY seq DESC LIMIT 1")

        .fetch_one(&pool)

        .await

        .unwrap();

    assert_eq!(m, ("human".to_string(), 4), "recorded as the owner, through a session");

}