//! Settings, driven through the router against a real database.
//!
//! Same standard as the screens before it: no Tauri runtime and no window, the
//! description asserted, and the markup only where the markup is the point.
//! Every workaround this port had to take is asserted here rather than left to
//! be noticed, so closing a finding is a test that has to change.

use std::sync::Arc;

use quasi_http::Serves as _;
use quasi_router::Outcome;
use quasi_router::{Params, Request, Response};

use super::super::router;
use crate::state::AppState;

async fn state() -> Arc<AppState> {
    let (state, _) = crate::test_utils::setup_test_state().await;
    state
}

fn get(state: &AppState, path: &str) -> Response {
    router()
        .handle(state, Request::get(path))
        .expect("the route answers")
}

fn post(state: &AppState, path: &str, params: Params) -> Response {
    router()
        .handle(state, Request::post(path).sending(params))
        .expect("the route answers")
}

fn html(response: Response) -> String {
    match response.outcome {
        Outcome::Screen(screen) => quasi_webview::Webview::new().screen(&screen),
        Outcome::Fragment { node, .. } => quasi_webview::Webview::new().fragment(&node),
        Outcome::Goto(action) => panic!("expected content, got a redirect to {action:?}"),
        // Same reasoning one step along: an overlay is a screen, but it is not
        // the screen this route was asked for. Rendering it here would let a
        // route that answered with the command palette pass as the page.
        Outcome::Over(_) => panic!("expected content, got a screen drawn over it"),
        Outcome::Anchored { .. } => {
            panic!("expected content, got a screen drawn at a point on it")
        }
        Outcome::Suggestions { field, .. } => {
            panic!("expected content, got a suggestion list for `{field}`")
        }
        Outcome::File { name, .. } => panic!("expected content, got the file `{name}`"),
        Outcome::Locate(_) => panic!("expected content, got a place on a map"),
        // `cb62a9dc`. Work that runs somewhere else and a region that says so:
        // not content, and not a place either.
        Outcome::Started { region, .. } => {
            panic!("expected content, got work started in `{region}`")
        }
    }
}

/// What the settings key holds right now, read the way the command does.
fn stored(state: &AppState, key: &str) -> Option<String> {
    crate::commands::all_config(state)
        .unwrap()
        .get(key)
        .cloned()
}

#[tokio::test]
async fn settings_opens_on_appearance_the_way_the_js_does() {
    let state = state().await;
    let page = html(get(&state, "/settings"));

    assert!(page.contains("Appearance"));
    assert!(page.contains("Theme"));
    // And the same screen is reachable under its own address.
    assert_eq!(page, html(get(&state, "/settings/appearance")));
}

#[tokio::test]
async fn the_sidebar_offers_the_described_sections_and_points_at_the_open_one() {
    let state = state().await;
    let page = html(get(&state, "/settings/planning"));

    assert!(page.contains("Appearance"));
    assert!(page.contains("Notifications"));
    assert!(page.contains("Planning &amp; Review"));
    // The app's own pointer, not the user's tick.
    assert!(page.contains("aria-current"));
    // About joined them on 2026-08-22, once `AppState` held the two host facts
    // it needed.
    assert!(page.contains("About"));

    // Sync joined them on 2026-08-22, once somebody measured `commands/sync.rs`
    // per command rather than per file: its reads are local.
    assert!(page.contains("Sync"));

    // Sharing joined them on 2026-08-24, and it is the only one of the five
    // whose stated reason was right: its reads were remote, so there was no
    // local state to draw a section from at all. synckit 0.9.0 writes the group
    // directory down, so the reads are local now. quasicoherent `82273265`.
    assert!(page.contains("Sharing"));

    // Which leaves none of the eight absent, and the header's single-cause
    // explanation wrong about four of its five.
    assert_eq!(super::SECTIONS.len(), 8);
}

#[tokio::test]
async fn import_and_export_is_a_sidebar_row_that_leaves_for_the_screen_it_lives_on() {
    // The section is described in full and lives at `/data`, so the row goes
    // there rather than swapping this screen's pane. See `Section::at`.
    let state = state().await;
    let page = html(get(&state, "/settings/planning"));

    assert!(page.contains("Import &amp; Export"), "{page}");
    assert!(page.contains("/data"), "{page}");
}

#[tokio::test]
async fn the_row_that_leaves_has_no_section_of_its_own_to_open() {
    // Without this, `/settings/data` falls through `screen`'s match and draws
    // Appearance under the Import & Export heading.
    let state = state().await;
    let error = router()
        .handle(&state, Request::get("/settings/data"))
        .expect_err("data is a screen, not a section here");
    assert_eq!(error.class.http_status(), 404);

    // And it never reads as the open one, on any section.
    let page = html(get(&state, "/settings/planning"));
    let at = page.find("Import &amp; Export").expect("the row is drawn");
    let row = &page[page[..at].rfind('<').unwrap_or(0)..at];
    assert!(!row.contains("aria-current"), "{row}");
}

#[tokio::test]
async fn a_section_that_is_not_described_is_a_not_found() {
    // Every section in `SECTIONS` is described now, so the case wants a name
    // that never will be rather than the last one to be built. It held
    // `/settings/sharing` until 2026-08-24.
    let state = state().await;
    let error = router()
        .handle(&state, Request::get("/settings/nonesuch"))
        .expect_err("an unknown section is not a section");
    assert_eq!(error.class.http_status(), 404);
}

#[tokio::test]
async fn a_control_writes_as_soon_as_it_changes_with_no_form_around_it() {
    // What finding 14612ed8 was closed for, and this screen is its first
    // consumer: Node::Field plus Field::writes, which is a bare control with a
    // route on it. A Node::Form here would describe a submit that does not
    // exist.
    let state = state().await;
    let page = html(get(&state, "/settings/notifications"));

    assert!(page.contains("Event indicator lead time"));
    assert!(page.contains("/settings/config/event_lead_minutes"));
    // No submit, because there is no form.
    assert!(!page.contains("type=\"submit\""));
}

#[tokio::test]
async fn every_control_on_the_screen_writes_through_the_one_route() {
    let state = state().await;

    for (key, value, section) in [
        ("event_lead_minutes", "30", "notifications"),
        ("work_start_hour", "7", "planning"),
        ("work_end_hour", "19", "planning"),
        ("plan_nudges", "disabled", "planning"),
        ("review_nudges", "disabled", "planning"),
    ] {
        let page = html(post(
            &state,
            &format!("/settings/config/{key}"),
            Params::new().with("value", value),
        ));
        assert_eq!(stored(&state, key).as_deref(), Some(value));
        // And the write answers with the section the setting lives in, re-read,
        // which the handler works out from the key rather than being told.
        assert!(
            page.contains(&format!("/settings/{section}")),
            "{key} should answer in {section}"
        );
    }
}

#[tokio::test]
async fn the_notifications_section_is_generated_from_the_registry() {
    // Adoption's proof: the controls come from `crate::notifs::NOTIFS` rather
    // than from a list in the screen, so a kind added there appears here with
    // nothing edited in `settings.rs`.
    let state = state().await;
    let page = html(get(&state, "/settings/notifications"));

    for kind in crate::notifs::NOTIFS.kinds() {
        assert!(page.contains(kind.title), "{} is missing", kind.id);
        assert!(
            page.contains(&quasi_notifs::config::enabled_key(kind.id)),
            "{} does not carry its generated key",
            kind.id
        );
    }
    // The whole pane posts to one route, and every control names its own key.
    assert!(page.contains("/settings/notifications"));
}

#[tokio::test]
async fn a_kind_that_ships_on_is_drawn_on_before_anyone_has_chosen() {
    // The migration fact: adopting the framework must not silently stop a
    // notification that fires today. A checkbox is on by presence.
    let state = state().await;
    let page = html(get(&state, "/settings/notifications"));

    let checkbox = page
        .split("<input")
        .find(|chunk| chunk.contains("snooze-expiry.enabled"))
        .expect("the snooze-expiry toggle is drawn");
    assert!(checkbox.contains("checked"), "{checkbox}");
}

#[tokio::test]
async fn turning_a_kind_off_stores_false_and_leaves_the_others_alone() {
    let state = state().await;

    // A checkbox that is off sends nothing, which is how HTML submits one. So
    // a post carrying only the other two turns this one off.
    let page = html(post(
        &state,
        "/settings/notifications",
        Params::new()
            .with("response-overdue.enabled", "true")
            .with("event-reminder.enabled", "true"),
    ));

    assert_eq!(
        stored(&state, "snooze-expiry.enabled").as_deref(),
        Some("false")
    );
    assert_eq!(
        stored(&state, "response-overdue.enabled").as_deref(),
        Some("true")
    );
    assert_eq!(
        stored(&state, "event-reminder.enabled").as_deref(),
        Some("true")
    );
    // Answered with the section, re-read, like every other write on this screen.
    assert!(page.contains("Snoozed items resurface"));

    // And the pane now draws it off.
    let page = html(get(&state, "/settings/notifications"));
    let checkbox = page
        .split("<input")
        .find(|chunk| chunk.contains("snooze-expiry.enabled"))
        .expect("the toggle is still drawn");
    assert!(!checkbox.contains("checked"), "{checkbox}");
}

#[tokio::test]
async fn the_events_tab_lead_time_is_not_one_of_the_notification_kinds() {
    // The trap `07830eb5` named: `event_lead_minutes` colours a dot on a tab
    // and is not a delivery setting. It keeps its own key, its own route, and
    // its own heading; the generated keys are dotted and it is not.
    let state = state().await;
    let page = html(get(&state, "/settings/notifications"));

    assert!(page.contains("/settings/config/event_lead_minutes"));
    assert!(!page.contains("event-reminder.lead"));
    assert!(page.contains("Events tab"));
    assert!(
        page.contains("This is the indicator, not a notification."),
        "the pane owes the distinction in words"
    );
}

#[tokio::test]
async fn a_key_the_spec_does_not_declare_is_refused_by_the_same_check_the_command_uses() {
    let state = state().await;
    let error = router()
        .handle(
            &state,
            Request::post("/settings/config/not_a_setting")
                .sending(Params::new().with("value", "x")),
        )
        .expect_err("the spec's closed set holds");
    assert_eq!(error.class.http_status(), 500);
    assert!(stored(&state, "not_a_setting").is_none());
}

#[tokio::test]
async fn a_setting_nobody_has_touched_shows_its_default_rather_than_nothing() {
    let state = state().await;
    let page = html(get(&state, "/settings/planning"));

    // 9am to 5pm, which is what the JS falls back to at each of its call sites.
    assert!(page.contains(r#"value="9" selected"#) || page.contains(r#"selected value="9""#));
    assert!(page.contains("5:00 PM"));
    // And the written value wins over the default once there is one.
    post(
        &state,
        "/settings/config/work_start_hour",
        Params::new().with("value", "6"),
    );
    let page = html(get(&state, "/settings/planning"));
    assert!(page.contains(r#"value="6" selected"#) || page.contains(r#"selected value="6""#));
}

#[tokio::test]
async fn the_theme_list_comes_from_the_state_and_keeps_its_grouping() {
    // The first finding, closed. This asserted the loss: the shipped JS grouped
    // the themes in four optgroups, `Choice` is a value and a label, so the
    // variant went into the label and the structure was gone - and the old
    // assertion was `!page.contains("optgroup")`.
    //
    // makeover-layout 0.38.0's `Field::theme` is what gave it back. The
    // grouping is a described fact now rather than markup this app writes, and
    // the contrast tier arrives with it, which this screen never had at all.
    //
    // It is still the assertion that the host fact reached the handler: the
    // search path is built from an AppHandle the handler never sees, and
    // AppState holds the result.
    let state = state().await;
    let page = html(get(&state, "/settings/appearance"));

    assert!(page.contains("Follow System"), "{page}");
    assert!(page.contains("optgroup"), "{page}");
    assert!(page.contains(r#"<optgroup label="Light""#), "{page}");
    assert!(page.contains(r#"<optgroup label="Dark""#), "{page}");
    // The variant is no longer bracketed onto the name; the badge is what sits
    // there now, and it is the fact the flat list could not carry.
    assert!(!page.contains("(Dark)"), "{page}");
    assert!(page.contains("data-contrast="), "{page}");
}

#[tokio::test]
async fn the_theme_picker_orders_each_group_by_measured_contrast() {
    // The sort no app can do for itself: the tier comes off the resolved
    // colours, so a screen holding only names cannot produce this order. It is
    // `makeover::theme_options`' and this asserts it survived the description.
    let state = state().await;
    let page = html(get(&state, "/settings/appearance"));

    let light = page
        .find(r#"<optgroup label="Light""#)
        .expect("light group");
    let dark = page.find(r#"<optgroup label="Dark""#).expect("dark group");
    assert!(light < dark, "light comes first");

    // Within the light group, AA before OK before low.
    let group = &page[light..dark];
    let tier = |mark: &str| group.find(mark);
    if let (Some(aa), Some(low)) = (
        tier(r#"data-contrast="high""#),
        tier(r#"data-contrast="low""#),
    ) {
        assert!(aa < low, "the most legible theme leads its group: {group}");
    }
}

#[tokio::test]
async fn the_theme_writes_through_the_same_route_as_everything_else() {
    let state = state().await;
    let page = html(post(
        &state,
        "/settings/config/theme",
        Params::new().with("value", "catppuccin-mocha"),
    ));
    assert_eq!(stored(&state, "theme").as_deref(), Some("catppuccin-mocha"));
    assert!(page.contains("Appearance"));
}

#[tokio::test]
async fn work_hours_are_two_labelled_controls_rather_than_one_row_reading_to() {
    // The third finding, asserted as written. The JS draws one labelled row -
    // a select, the word "to", a select. The description has one label per
    // field, so it says which is which and loses the pairing. Expected to be
    // refused as furniture; the test exists so the loss is visible.
    let state = state().await;
    let page = html(get(&state, "/settings/planning"));

    assert!(page.contains("Work day starts"));
    assert!(page.contains("Work day ends"));
    assert!(!page.contains(">to<"));
}

#[tokio::test]
async fn a_theme_name_cannot_become_markup() {
    // Theme names come off disk, which is a place the app does not control:
    // importing a theme writes whatever the file says into the custom
    // directory, and the name inside it is never seen by anything that
    // validates. The renderer is what makes that safe, and this is the only
    // untrusted string on the screen.
    let dir = tempfile::tempdir().unwrap();
    std::fs::write(
        dir.path().join("hostile.toml"),
        "[meta]\nname = \"<script>alert(1)</script>\"\n",
    )
    .unwrap();

    let (mut state, _) = crate::test_utils::setup_test_state().await;
    Arc::get_mut(&mut state).expect("sole owner").theme_dirs =
        vec![(dir.path().to_path_buf(), true)];

    let page = html(get(&state, "/settings/appearance"));

    assert!(page.contains("&lt;script&gt;"));
    assert!(!page.contains("<script>alert"));
}

/// Put a group in the directory the way the sync loop does. That the loop
/// writes it is synckit's test; what is under test here is a section reading it.
fn known_group(state: &AppState, id: u128, name: &str, is_admin: bool) {
    let mut conn = state.db.conn().unwrap();
    synckit_client::store::directory::ensure_tables(&conn).unwrap();
    synckit_client::store::directory::add_group(
        &mut conn,
        &synckit_client::store::directory::KnownGroup {
            id: synckit_client::GroupId::new(uuid::Uuid::from_u128(id)),
            name: name.to_owned(),
            gck_version: 1,
            is_admin,
        },
    )
    .unwrap();
}

fn sharing(state: &AppState) -> String {
    html(get(state, "/settings/sharing"))
}

#[tokio::test]
async fn sharing_is_a_section_in_the_sidebar() {
    let state = state().await;
    let page = html(get(&state, "/settings"));
    assert!(page.contains("Sharing"), "{page}");
    assert!(page.contains("/settings/sharing"), "{page}");
}

/// A device that has not synced since the user joined a group knows of none,
/// which is a statement about what has reached it rather than about the user.
#[tokio::test]
async fn a_device_that_has_not_synced_says_what_it_does_not_know() {
    let state = state().await;
    let pane = sharing(&state);
    assert!(pane.contains("knows of no groups"), "{pane}");
}

#[tokio::test]
async fn the_groups_this_device_knows_are_listed() {
    let state = state().await;
    known_group(&state, 1, "The Firm", false);
    known_group(&state, 2, "Book club", true);

    let pane = sharing(&state);
    assert!(pane.contains("The Firm"), "{pane}");
    assert!(pane.contains("Book club"), "{pane}");
}

/// Administering a group and belonging to one are different facts, and only one
/// of them is about permission. The badge comes from `is_admin`, never from the
/// member list being empty.
#[tokio::test]
async fn administering_a_group_is_marked_and_merely_belonging_is_not() {
    let theirs = state().await;
    known_group(&theirs, 1, "Someone elses", false);
    let pane = sharing(&theirs);
    assert!(pane.contains("Someone elses"), "{pane}");
    assert!(!pane.contains("You administer this"), "{pane}");

    let mine = state().await;
    known_group(&mine, 2, "Mine", true);
    let pane = sharing(&mine);
    assert!(pane.contains("You administer this"), "{pane}");
}

/// The list is a copy of the server's answer, and how old the copy is decides
/// how much to trust it.
#[tokio::test]
async fn the_section_says_how_old_its_group_list_is() {
    let state = state().await;
    known_group(&state, 1, "The Firm", false);
    let pane = sharing(&state);
    assert!(pane.contains("Group list last updated"), "{pane}");
}

/// Offered only where they can mean something. Without sync configured there is
/// no client to reach a server with, so a create form would be a control that
/// cannot act, which is the thing this section spends its design not doing.
#[tokio::test]
async fn the_admin_forms_are_withheld_when_there_is_no_sync_to_use_them() {
    let state = state().await;
    known_group(&state, 1, "The Firm", true);
    let pane = sharing(&state);
    assert!(!pane.contains("Make a group"), "{pane}");
}

/// A described handler cannot await, so the act is a local insert and the
/// drainer does the talking. What the user is told has to say so.
#[tokio::test]
async fn queueing_a_group_writes_a_row_and_says_it_is_not_immediate() {
    let state = state().await;
    let mut params = Params::new();
    params.insert("name".to_owned(), "The Firm".to_owned());
    let response = router()
        .handle(
            &state,
            Request::post("/settings/sharing/groups").sending(params),
        )
        .expect("the route answers");

    let queued = crate::group_queue::pending(&state).unwrap();
    assert_eq!(queued.len(), 1);
    assert_eq!(queued[0].kind, "create_group");
    assert_eq!(queued[0].name.as_deref(), Some("The Firm"));
    assert!(queued[0].done_at.is_none(), "nothing reached a server");

    let said = format!("{:?}", response.notice);
    assert!(said.contains("within a minute"), "{said}");
}

#[tokio::test]
async fn a_group_with_no_name_is_refused_rather_than_queued() {
    let state = state().await;
    let mut params = Params::new();
    params.insert("name".to_owned(), "   ".to_owned());
    let error = router()
        .handle(
            &state,
            Request::post("/settings/sharing/groups").sending(params),
        )
        .expect_err("a nameless group is refused");
    assert_eq!(error.class, quasi_router::Class::Conflict);
    assert!(crate::group_queue::pending(&state).unwrap().is_empty());
}

/// A key that is not a key can never be sealed to, and the person who pasted it
/// is on screen now. Refused here rather than queued to fail a minute later.
#[tokio::test]
async fn a_public_key_that_is_not_one_is_refused_before_it_is_queued() {
    let state = state().await;
    let mut params = Params::new();
    params.insert(
        "group_id".to_owned(),
        "00000000-0000-0000-0000-000000000001".to_owned(),
    );
    params.insert("email".to_owned(), "them@localhost".to_owned());
    params.insert("pubkey".to_owned(), "not a key".to_owned());

    let error = router()
        .handle(
            &state,
            Request::post("/settings/sharing/members").sending(params),
        )
        .expect_err("a bad key is refused");
    assert_eq!(error.class, quasi_router::Class::Conflict);
    assert!(crate::group_queue::pending(&state).unwrap().is_empty());
}

/// A control whose effect is a minute away has to be visible, or the section
/// looks like it lost the request.
#[tokio::test]
async fn the_queue_is_shown_with_what_each_row_will_do() {
    let state = state().await;
    crate::group_queue::enqueue(
        &state,
        &crate::group_queue::QueuedOp {
            id: "q1".to_owned(),
            kind: "create_group".to_owned(),
            group_id: None,
            name: Some("The Firm".to_owned()),
            email: None,
            pubkey: None,
            member_user_id: None,
            ..Default::default()
        },
    )
    .unwrap();

    let pane = sharing(&state);
    assert!(pane.contains("Waiting to reach the server"), "{pane}");
    assert!(pane.contains("Create the group The Firm"), "{pane}");
    assert!(pane.contains("Waiting"), "{pane}");
}

/// The whole reason a queue beats a toast here: the server's own words, still on
/// screen, where the person who caused them will look.
#[tokio::test]
async fn a_failed_row_carries_the_reason_it_failed() {
    let state = state().await;
    crate::group_queue::enqueue(
        &state,
        &crate::group_queue::QueuedOp {
            id: "q1".to_owned(),
            kind: "add_member".to_owned(),
            group_id: Some("00000000-0000-0000-0000-000000000001".to_owned()),
            name: None,
            email: Some("them@localhost".to_owned()),
            pubkey: Some("k".to_owned()),
            member_user_id: None,
            ..Default::default()
        },
    )
    .unwrap();
    state
        .db
        .conn()
        .unwrap()
        .execute(
            "UPDATE group_admin_queue SET attempts = 3, last_error = 'No such account.'",
            [],
        )
        .unwrap();

    let pane = sharing(&state);
    assert!(pane.contains("Add them@localhost to a group"), "{pane}");
    assert!(pane.contains("No such account."), "{pane}");
    assert!(pane.contains("Tried 3 times"), "{pane}");
}

/// The way out of a row that will never succeed, which is why a failure is held
/// rather than deleted: the person who queued it decides, not the drainer.
#[tokio::test]
async fn a_queued_action_can_be_taken_back_out() {
    let state = state().await;
    crate::group_queue::enqueue(
        &state,
        &crate::group_queue::QueuedOp {
            id: "q1".to_owned(),
            kind: "create_group".to_owned(),
            group_id: None,
            name: Some("Mistake".to_owned()),
            email: None,
            pubkey: None,
            member_user_id: None,
            ..Default::default()
        },
    )
    .unwrap();

    router()
        .handle(&state, Request::post("/settings/sharing/queue/q1/cancel"))
        .expect("the route answers");
    assert!(crate::group_queue::pending(&state).unwrap().is_empty());
}

/// A cancel that raced the drainer must not claim it undid anything.
#[tokio::test]
async fn cancelling_something_that_already_went_is_a_not_found() {
    let state = state().await;
    let error = router()
        .handle(&state, Request::post("/settings/sharing/queue/gone/cancel"))
        .expect_err("there is nothing to cancel");
    assert_eq!(error.class, quasi_router::Class::NotFound);
}

/// Being added to a group takes no write from the person being added, so the
/// whole member side is describable. Without sync configured there is no key,
/// and that is said rather than left blank.
#[tokio::test]
async fn the_identity_key_says_why_it_is_missing_when_sync_is_not_set_up() {
    let state = state().await;
    let pane = sharing(&state);
    assert!(pane.contains("Your identity key"), "{pane}");
    assert!(pane.contains("no identity key"), "{pane}");
}

// The invitation flow. Every test below writes the directory the way the sync
// loop does and then reads the pane, on `known_group`'s reasoning: that the
// loop writes it is synckit's test, and what is under test here is a section
// reading it.

/// Put an invitation in the directory. `token` is the issued code, which only
/// the device that issued it ever holds.
fn known_invitation(
    state: &AppState,
    group: u128,
    id: u128,
    invitation_state: synckit_client::InvitationState,
    fingerprint: Option<&str>,
    token: Option<&str>,
    expires_at: &str,
) {
    let mut conn = state.db.conn().unwrap();
    synckit_client::store::directory::ensure_tables(&conn).unwrap();
    let known = synckit_client::store::directory::KnownInvitation {
        id: synckit_client::InvitationId::new(uuid::Uuid::from_u128(id)),
        group_id: synckit_client::GroupId::new(uuid::Uuid::from_u128(group)),
        state: invitation_state,
        invitee_email: Some("them@localhost".to_owned()),
        invitee_fingerprint: fingerprint.map(ToOwned::to_owned),
        token: None,
        expires_at: expires_at.to_owned(),
        created_at: "2026-08-24T09:00:00.000Z".to_owned(),
    };
    synckit_client::store::directory::write_invitations(
        &mut conn,
        synckit_client::GroupId::new(uuid::Uuid::from_u128(group)),
        std::slice::from_ref(&known),
    )
    .unwrap();
    // The token is not part of the server's answer, so it goes in the way the
    // drainer puts it there rather than through the refresh.
    if let Some(token) = token {
        conn.execute(
            "UPDATE sync_invitations SET token = ?1 WHERE invitation_id = ?2",
            rusqlite::params![token, uuid::Uuid::from_u128(id).to_string()],
        )
        .unwrap();
    }
}

fn far_future() -> String {
    "2099-01-01T00:00:00.000Z".to_owned()
}

fn long_past() -> String {
    "2020-01-01T00:00:00.000Z".to_owned()
}

/// Only while pending. Once somebody has accepted, the code has done its whole
/// job and holding it on screen is exposure with no use.
#[tokio::test]
async fn a_pending_invitation_shows_its_code_and_an_accepted_one_does_not() {
    let pending = state().await;
    known_group(&pending, 1, "The Firm", true);
    known_invitation(
        &pending,
        1,
        11,
        synckit_client::InvitationState::Pending,
        None,
        Some("CODE-ALPHA"),
        &far_future(),
    );

    let pane = sharing(&pending);
    assert!(pane.contains("CODE-ALPHA"), "{pane}");

    let accepted = state().await;
    known_group(&accepted, 1, "The Firm", true);
    known_invitation(
        &accepted,
        1,
        11,
        synckit_client::InvitationState::Accepted,
        Some("aa:bb:cc"),
        Some("CODE-ALPHA"),
        &far_future(),
    );
    let pane = sharing(&accepted);
    assert!(!pane.contains("CODE-ALPHA"), "{pane}");
}

/// A deadline passes on its own between two refreshes, so the stored state says
/// `pending` for a code that stopped working. Reading `effective_state` is what
/// keeps a dead code from being offered as a live one, and it costs no request.
#[tokio::test]
async fn a_code_past_its_deadline_reads_as_expired_before_any_refresh() {
    let state = state().await;
    known_group(&state, 1, "The Firm", true);
    known_invitation(
        &state,
        1,
        11,
        synckit_client::InvitationState::Pending,
        None,
        Some("CODE-STALE"),
        &long_past(),
    );

    let pane = sharing(&state);
    assert!(pane.contains("Expired"), "{pane}");
    assert!(
        !pane.contains("CODE-STALE"),
        "the token goes with it: {pane}"
    );
    assert!(!pane.contains("Cancel it"), "and so does the act: {pane}");
}

/// The security-bearing step, and the only one where a person is waiting. It is
/// drawn above the group list rather than found by opening each group in turn.
#[tokio::test]
async fn an_accepted_invitation_waits_at_the_top_with_its_fingerprint() {
    let state = state().await;
    known_group(&state, 1, "The Firm", true);
    known_invitation(
        &state,
        1,
        11,
        synckit_client::InvitationState::Accepted,
        Some("aa:bb:cc:dd"),
        None,
        &far_future(),
    );

    let pane = sharing(&state);
    assert!(pane.contains("Waiting on you to admit them"), "{pane}");
    assert!(pane.contains("aa:bb:cc:dd"), "{pane}");
    assert!(pane.contains("read it out over a channel"), "{pane}");

    let top = pane.find("Waiting on you to admit them").unwrap();
    let groups = pane.find("The Firm").unwrap();
    assert!(top < groups, "above the group list: {pane}");
}

/// A key that yields no fingerprint must never be confirmable. The comparison is
/// the whole security of the step, and offering Confirm beside "unavailable"
/// invites approving something nobody read.
#[tokio::test]
async fn an_invitation_with_no_readable_fingerprint_cannot_be_confirmed() {
    let state = state().await;
    known_group(&state, 1, "The Firm", true);
    known_invitation(
        &state,
        1,
        11,
        synckit_client::InvitationState::Accepted,
        None,
        None,
        &far_future(),
    );

    let pane = sharing(&state);
    assert!(pane.contains("Cannot be checked"), "{pane}");
    assert!(!pane.contains("It matches, admit them"), "{pane}");
}

#[tokio::test]
async fn queueing_an_invite_records_the_group_and_the_expiry() {
    let state = state().await;
    let mut params = Params::new();
    params.insert("group_id".to_owned(), uuid::Uuid::from_u128(1).to_string());
    params.insert("expires_in_hours".to_owned(), "48".to_owned());

    router()
        .handle(
            &state,
            Request::post("/settings/sharing/invites").sending(params),
        )
        .expect("the route answers");

    let queued = crate::group_queue::pending(&state).unwrap();
    assert_eq!(queued.len(), 1);
    assert_eq!(queued[0].kind, "create_invite");
    assert_eq!(queued[0].expires_in_hours, Some(48));
    assert!(
        queued[0].invite_token.is_none(),
        "the issued code is not on the row; it does not exist yet"
    );
}

/// Blank is a real answer: the server has a default and saying nothing takes it.
#[tokio::test]
async fn an_invite_with_no_expiry_takes_the_servers_default() {
    let state = state().await;
    let mut params = Params::new();
    params.insert("group_id".to_owned(), uuid::Uuid::from_u128(1).to_string());
    params.insert("expires_in_hours".to_owned(), String::new());

    router()
        .handle(
            &state,
            Request::post("/settings/sharing/invites").sending(params),
        )
        .expect("the route answers");

    assert_eq!(
        crate::group_queue::pending(&state).unwrap()[0].expires_in_hours,
        None
    );
}

#[tokio::test]
async fn an_expiry_that_is_not_a_positive_whole_number_is_refused_now() {
    let state = state().await;
    for bad in ["nope", "0", "-3"] {
        let mut params = Params::new();
        params.insert("group_id".to_owned(), uuid::Uuid::from_u128(1).to_string());
        params.insert("expires_in_hours".to_owned(), bad.to_owned());
        let error = router()
            .handle(
                &state,
                Request::post("/settings/sharing/invites").sending(params),
            )
            .expect_err("refused rather than queued to fail later");
        assert_eq!(error.class, quasi_router::Class::Conflict, "{bad}");
    }
    assert!(crate::group_queue::pending(&state).unwrap().is_empty());
}

/// The fingerprint is the thing being authorized, so it is never copied onto the
/// row: the drainer re-reads the server's current answer. A key swapped between
/// the reading and the drain is refused by the same comparison rather than waved
/// through by a copy of it.
#[tokio::test]
async fn a_queued_confirm_carries_the_invitation_and_not_the_fingerprint() {
    let state = state().await;
    known_group(&state, 1, "The Firm", true);
    known_invitation(
        &state,
        1,
        11,
        synckit_client::InvitationState::Accepted,
        Some("aa:bb:cc:dd"),
        None,
        &far_future(),
    );

    router()
        .handle(
            &state,
            Request::post(format!(
                "/settings/sharing/invites/{}/{}/confirm",
                uuid::Uuid::from_u128(1),
                uuid::Uuid::from_u128(11)
            )),
        )
        .expect("the route answers");

    let queued = crate::group_queue::pending(&state).unwrap();
    assert_eq!(queued[0].kind, "confirm_invite");
    assert_eq!(
        queued[0].invitation_id.as_deref(),
        Some(uuid::Uuid::from_u128(11).to_string().as_str())
    );
    assert!(
        !format!("{:?}", queued[0]).contains("aa:bb:cc:dd"),
        "no fingerprint anywhere on the row: {:?}",
        queued[0]
    );
}

/// "Confirm an invitation" authorizes nothing legible, so the queued row names
/// the fingerprint. It is resolved from the directory as the row is drawn, which
/// is a display of the current answer rather than a second copy of it.
#[tokio::test]
async fn a_queued_confirm_names_the_fingerprint_it_is_authorizing() {
    let state = state().await;
    known_group(&state, 1, "The Firm", true);
    known_invitation(
        &state,
        1,
        11,
        synckit_client::InvitationState::Accepted,
        Some("aa:bb:cc:dd"),
        None,
        &far_future(),
    );
    crate::group_queue::enqueue(
        &state,
        &crate::group_queue::QueuedOp {
            id: "q1".to_owned(),
            kind: "confirm_invite".to_owned(),
            group_id: Some(uuid::Uuid::from_u128(1).to_string()),
            invitation_id: Some(uuid::Uuid::from_u128(11).to_string()),
            ..Default::default()
        },
    )
    .unwrap();

    let pane = sharing(&state);
    assert!(pane.contains("Admit the holder of aa:bb:cc:dd"), "{pane}");
}

/// The invitation has left `accepted` since it was queued, or the directory has
/// not caught up. Both are honest reasons not to name a fingerprint, and neither
/// is a reason to name a stale one.
#[tokio::test]
async fn a_queued_confirm_the_directory_cannot_place_says_so_rather_than_guessing() {
    let state = state().await;
    crate::group_queue::enqueue(
        &state,
        &crate::group_queue::QueuedOp {
            id: "q1".to_owned(),
            kind: "confirm_invite".to_owned(),
            group_id: Some(uuid::Uuid::from_u128(1).to_string()),
            invitation_id: Some(uuid::Uuid::from_u128(99).to_string()),
            ..Default::default()
        },
    )
    .unwrap();

    let pane = sharing(&state);
    assert!(pane.contains("once their fingerprint is checked"), "{pane}");
}

/// Reading a code and accepting it are two queued writes. Collapsing them would
/// delete the step where a person reads what they are joining.
#[tokio::test]
async fn pasting_a_code_queues_a_read_and_sends_nothing() {
    let state = state().await;
    let mut params = Params::new();
    params.insert("token".to_owned(), "  CODE-BETA  ".to_owned());

    router()
        .handle(
            &state,
            Request::post("/settings/sharing/invites/preview").sending(params),
        )
        .expect("the route answers");

    let queued = crate::group_queue::pending(&state).unwrap();
    assert_eq!(queued[0].kind, "preview_invite");
    assert_eq!(
        queued[0].invite_token.as_deref(),
        Some("CODE-BETA"),
        "normalised where the one accepted spelling lives"
    );
}

/// One accepted spelling of a code, owned by `normalize_invite_token`, so a
/// paste that works in the Tauri command works here.
#[tokio::test]
async fn a_pasted_url_is_normalised_to_the_bare_code() {
    let state = state().await;
    let mut params = Params::new();
    params.insert(
        "token".to_owned(),
        "https://makenot.work/invite/CODE-GAMMA?from=mail".to_owned(),
    );

    router()
        .handle(
            &state,
            Request::post("/settings/sharing/invites/preview").sending(params),
        )
        .expect("the route answers");

    assert_eq!(
        crate::group_queue::pending(&state).unwrap()[0]
            .invite_token
            .as_deref(),
        Some("CODE-GAMMA")
    );
}

/// Terminal states are drawn without an Accept control, so reaching the handler
/// with one is a stale screen rather than a misuse. Refused rather than queued:
/// it can only fail, and failing here says so now instead of in a minute.
///
/// What the *pane* says about a dead code -- which kind of dead, read off
/// `state`, because "expired" and "cancelled" send a person to different places
/// -- is not asserted here. The join section is withheld without sync
/// configured, and a test state has none.
#[tokio::test]
async fn a_terminal_code_is_refused_now_rather_than_queued_to_fail() {
    let state = state().await;
    let mut conn = state.db.conn().unwrap();
    synckit_client::store::directory::ensure_tables(&conn).unwrap();
    synckit_client::store::directory::write_preview(
        &mut conn,
        &synckit_client::store::directory::KnownPreview {
            token: "CODE-DEAD".to_owned(),
            group_name: "The Firm".to_owned(),
            inviter_email: "boss@localhost".to_owned(),
            redeemable: false,
            state: synckit_client::InvitationState::Revoked,
            expires_at: far_future(),
        },
    )
    .unwrap();
    drop(conn);

    let error = router()
        .handle(&state, Request::post("/settings/sharing/invites/accept"))
        .expect_err("a terminal code cannot be accepted");
    assert_eq!(error.class, quasi_router::Class::Conflict);
}

/// Accepting reads the token from the stored preview rather than from the
/// request: the control appears only because a preview is on screen, and
/// re-sending the code through the form would let the two disagree.
#[tokio::test]
async fn accepting_with_nothing_previewed_is_a_not_found() {
    let state = state().await;
    let error = router()
        .handle(&state, Request::post("/settings/sharing/invites/accept"))
        .expect_err("there is no code to accept");
    assert_eq!(error.class, quasi_router::Class::NotFound);
}

/// A preview was a read, so dropping the answer to it is this device's business
/// alone and there is nothing to tell a server.
#[tokio::test]
async fn dismissing_a_preview_queues_nothing() {
    let state = state().await;
    let mut conn = state.db.conn().unwrap();
    synckit_client::store::directory::ensure_tables(&conn).unwrap();
    synckit_client::store::directory::write_preview(
        &mut conn,
        &synckit_client::store::directory::KnownPreview {
            token: "CODE-DELTA".to_owned(),
            group_name: "The Firm".to_owned(),
            inviter_email: "boss@localhost".to_owned(),
            redeemable: true,
            state: synckit_client::InvitationState::Pending,
            expires_at: far_future(),
        },
    )
    .unwrap();
    drop(conn);

    router()
        .handle(&state, Request::post("/settings/sharing/invites/dismiss"))
        .expect("the route answers");

    let conn = state.db.conn().unwrap();
    assert!(
        synckit_client::store::directory::preview(&conn)
            .unwrap()
            .is_none()
    );
    assert!(crate::group_queue::pending(&state).unwrap().is_empty());
}

/// Accepting posts this device's identity key, and there is no key without sync
/// set up, so the control could not act and is not drawn.
#[tokio::test]
async fn the_join_section_is_withheld_when_there_is_no_sync_to_use_it() {
    let state = state().await;
    let pane = sharing(&state);
    assert!(
        !pane.contains("Joining a group you were invited to"),
        "{pane}"
    );
}

/// The section dates the list it is drawing. `pending_confirmations_refreshed_at`
/// is the freshness of exactly the rows above it, so the sentence is about them
/// and not about the group list, which refreshes on a different schedule.
#[tokio::test]
async fn the_confirmations_section_dates_the_list_it_is_drawing() {
    let state = state().await;
    known_group(&state, 1, "The Firm", true);
    known_invitation(
        &state,
        1,
        11,
        synckit_client::InvitationState::Accepted,
        Some("aa:bb:cc:dd"),
        None,
        &far_future(),
    );

    let pane = sharing(&state);
    assert!(pane.contains("This list was last refreshed"), "{pane}");
    assert!(
        !pane.contains("The group directory was last refreshed"),
        "the group list is a different list on a different schedule: {pane}"
    );
}

/// The case the per-list reader exists for: the group list refreshed on a cycle
/// where this group's invitation fetch failed. The section must report the older
/// number, because that is how old what it is drawing actually is.
#[tokio::test]
async fn the_confirmations_timestamp_is_the_invitation_lists_not_the_groups() {
    let state = state().await;
    known_group(&state, 1, "The Firm", true);
    known_invitation(
        &state,
        1,
        11,
        synckit_client::InvitationState::Accepted,
        Some("aa:bb:cc:dd"),
        None,
        &far_future(),
    );
    {
        let conn = state.db.conn().unwrap();
        conn.execute(
            "UPDATE sync_invitations SET refreshed_at = '2026-01-01T00:00:00.000Z'",
            [],
        )
        .unwrap();
    }

    let pane = sharing(&state);
    assert!(
        pane.contains("This list was last refreshed 2026-01-01T00:00:00.000Z"),
        "{pane}"
    );
}