package console

// Door keys (#175 P7, apidoorkeys.go): the console's database is the
// authority, and the bucket holds a signed, revisioned, expiring projection
// of it that one serialized publisher rebuilds from the database every time.

import (
	"context"
	"encoding/json"
	"errors"
	"net/http"
	"os"
	"strings"
	"sync"
	"sync/atomic"
	"testing"
	"time"

	"github.com/carlosframework/platform/internal/doorkey"
	"github.com/carlosframework/platform/internal/release"
	"github.com/carlosframework/platform/internal/svcrole"
)

func doorKeysURL(fx *consoleFixture) string { return fx.ts.URL + "/api/cli/apps/bab/titogo/door-keys" }

func readDoorRecord(t *testing.T, fx *consoleFixture) doorkey.Record {
	t.Helper()
	wire, _, err := fx.rel.Get(context.Background(), doorkey.RecordKey("bab", "titogo"))
	if err != nil {
		t.Fatal(err)
	}
	rec, err := doorkey.Verify(fx.pub, wire, time.Now())
	if err != nil {
		t.Fatal(err)
	}
	return rec
}

// mintDoorKey mints one key through the door and returns the parsed token.
func mintDoorKey(t *testing.T, fx *consoleFixture, token string) doorkey.Token {
	t.Helper()
	code, _, out := rawReq(t, http.MethodPost, doorKeysURL(fx), token, `{"label":"router"}`)
	if code != http.StatusCreated {
		t.Fatalf("mint = %d %s", code, out)
	}
	var minted struct{ Key, ID string }
	if err := json.Unmarshal([]byte(out), &minted); err != nil {
		t.Fatal(err)
	}
	tok, err := doorkey.ParseToken(minted.Key)
	if err != nil || tok.ID != minted.ID {
		t.Fatalf("minted key %q: %v", minted.Key, err)
	}
	return tok
}

// putDoorObject overwrites whatever sits at the app's record key.
func putDoorObject(t *testing.T, fx *consoleFixture, body []byte) {
	t.Helper()
	key := doorkey.RecordKey("bab", "titogo")
	_, etag, err := fx.rel.Get(context.Background(), key)
	if err != nil && !errors.Is(err, os.ErrNotExist) {
		t.Fatal(err)
	}
	if _, err := fx.rel.Put(context.Background(), key, body, etag); err != nil {
		t.Fatal(err)
	}
}

func signedDoorRecord(t *testing.T, fx *consoleFixture, rev uint64, keys []doorkey.Entry) []byte {
	t.Helper()
	now := time.Now().UTC()
	wire, err := doorkey.Sign(fx.priv, doorkey.Record{V: 1, Account: "bab", App: "titogo", Revision: rev,
		Keys: keys, SignedAt: now, ExpiresAt: now.Add(time.Hour)})
	if err != nil {
		t.Fatal(err)
	}
	return wire
}

func TestDoorKeysMintListRevoke(t *testing.T) {
	fx, token := instanceFixture(t, "code-door-keys")
	code, _, out := rawReq(t, http.MethodPost, doorKeysURL(fx), token, `{"label":"router"}`)
	if code != http.StatusCreated {
		t.Fatalf("mint = %d %s", code, out)
	}
	var minted struct{ Key, ID, Account, App string }
	json.Unmarshal([]byte(out), &minted)
	tok, err := doorkey.ParseToken(minted.Key)
	if err != nil || tok.ID != minted.ID {
		t.Fatalf("minted key %q: %v", minted.Key, err)
	}
	if minted.Account != "bab" || minted.App != "titogo" {
		t.Fatalf("mint answered account/app %q/%q", minted.Account, minted.App)
	}
	rec := readDoorRecord(t, fx)
	if !rec.Admits(tok) || rec.Revision != 1 {
		t.Fatalf("record %+v does not admit the minted key at revision 1", rec)
	}
	code, _, out = rawReq(t, http.MethodGet, doorKeysURL(fx), token, "")
	if code != http.StatusOK || !strings.Contains(out, minted.ID) || strings.Contains(out, "sha256") ||
		!strings.Contains(out, "router") {
		t.Fatalf("list = %d %s", code, out)
	}
	if code, _, out = rawReq(t, http.MethodPost, doorKeysURL(fx)+"/"+minted.ID+"/revoke", token, ""); code != http.StatusOK {
		t.Fatalf("revoke = %d %s", code, out)
	}
	if rec := readDoorRecord(t, fx); rec.Admits(tok) || rec.Revision != 2 {
		t.Fatalf("after revoke: %+v", rec)
	}
	// Revoked is gone from the list, and a second revoke is an unknown id.
	if code, _, out = rawReq(t, http.MethodGet, doorKeysURL(fx), token, ""); code != http.StatusOK || strings.Contains(out, minted.ID) {
		t.Fatalf("list after revoke = %d %s", code, out)
	}
	if code, _, out = rawReq(t, http.MethodPost, doorKeysURL(fx)+"/"+minted.ID+"/revoke", token, ""); code != http.StatusNotFound {
		t.Fatalf("second revoke = %d %s, want 404", code, out)
	}
	if code, _, out = rawReq(t, http.MethodPost, doorKeysURL(fx)+"/0123456789abcdef/revoke", token, ""); code != http.StatusNotFound {
		t.Fatalf("unknown id revoke = %d %s, want 404", code, out)
	}
}

// Finding 1: whatever sits in the bucket, the console publishes from its
// database. A record copied in from another app's path is overwritten, not
// extended.
func TestDoorKeysPublishFromTheDatabaseNotTheBucket(t *testing.T) {
	fx, token := instanceFixture(t, "code-door-keys-copy")
	_, planted, _ := doorkey.NewToken("bab", "titogo")
	now := time.Now().UTC()
	forged, _ := doorkey.Sign(fx.priv, doorkey.Record{V: 1, Account: "bab", App: "titogo", Revision: 99,
		Keys: []doorkey.Entry{planted}, SignedAt: now, ExpiresAt: now.Add(time.Hour)})
	fx.rel.Put(context.Background(), doorkey.RecordKey("bab", "titogo"), forged, "")
	if code, _, out := rawReq(t, http.MethodPost, doorKeysURL(fx), token, `{}`); code != http.StatusCreated {
		t.Fatalf("mint = %d %s", code, out)
	}
	rec := readDoorRecord(t, fx)
	for _, e := range rec.Keys {
		if e.ID == planted.ID {
			t.Fatal("the console carried a key it never minted into its signed record")
		}
	}
	if len(rec.Keys) != 1 {
		t.Fatalf("record carries %d keys, want the one minted", len(rec.Keys))
	}
}

func TestDoorKeysRefuseServiceCredentialsAndReadOnlyConsoles(t *testing.T) {
	fx, _ := instanceFixture(t, "code-door-keys-svc")
	admin := serviceToken(t, fx.st, OpsAccountID, "root", "", svcrole.Admin)
	for _, c := range []struct{ method, url, body string }{
		{http.MethodPost, doorKeysURL(fx), `{}`},
		{http.MethodGet, doorKeysURL(fx), ""},
		{http.MethodPost, doorKeysURL(fx) + "/0123456789abcdef/revoke", ""},
	} {
		if code, _, out := rawReq(t, c.method, c.url, admin, c.body); code != http.StatusForbidden {
			t.Errorf("%s %s with an admin service credential = %d %s, want 403", c.method, c.url, code, out)
		}
	}
	if _, _, err := fx.rel.Get(context.Background(), doorkey.RecordKey("bab", "titogo")); err == nil {
		t.Fatal("a refused service credential left a door-key record")
	}

	ro := newConsoleFixtureKeyed(t, false)
	now := time.Now()
	if _, err := ro.st.CreateAppIn(OpsAccountID, "titogo", "paul@keymail.dev", now); err != nil {
		t.Fatal(err)
	}
	if err := ro.st.AddMember(OpsAccountID, "alice@keymail.dev", RoleMember, now); err != nil {
		t.Fatal(err)
	}
	member := cliToken(t, ro, "alice@keymail.dev", "code-door-keys-ro")
	if code, _, out := rawReq(t, http.MethodPost, doorKeysURL(ro), member, `{}`); code != http.StatusServiceUnavailable {
		t.Fatalf("mint on a read-only console = %d %s, want 503", code, out)
	}
	if code, _, out := rawReq(t, http.MethodPost, doorKeysURL(ro)+"/0123456789abcdef/revoke", member, ""); code != http.StatusServiceUnavailable {
		t.Fatalf("revoke on a read-only console = %d %s, want 503", code, out)
	}
	if _, _, err := ro.rel.Get(context.Background(), doorkey.RecordKey("bab", "titogo")); err == nil {
		t.Fatal("a read-only console wrote a door-key record")
	}
	if keys, _, err := ro.st.DoorKeysLive(OpsAccountID, "titogo"); err != nil || len(keys) != 0 {
		t.Fatalf("a read-only console stored keys: %v %v", keys, err)
	}
}

func TestDoorKeysRefuseANinthKey(t *testing.T) {
	fx, token := instanceFixture(t, "code-door-keys-full")
	for i := 0; i < doorkey.MaxKeys; i++ {
		mintDoorKey(t, fx, token)
	}
	if code, _, out := rawReq(t, http.MethodPost, doorKeysURL(fx), token, `{}`); code != http.StatusConflict {
		t.Fatalf("ninth mint = %d %s, want 409", code, out)
	}
	rec := readDoorRecord(t, fx)
	if len(rec.Keys) != doorkey.MaxKeys || rec.Revision != doorkey.MaxKeys {
		t.Fatalf("record after a refused ninth: %d keys at revision %d", len(rec.Keys), rec.Revision)
	}
}

func TestDoorKeyResignRefreshesExpiry(t *testing.T) {
	fx, token := instanceFixture(t, "code-door-keys-resign")
	tok := mintDoorKey(t, fx, token)
	before := readDoorRecord(t, fx)
	acct, err := fx.st.AccountByID(OpsAccountID)
	if err != nil {
		t.Fatal(err)
	}
	time.Sleep(2 * time.Millisecond)
	if err := fx.srv.publishDoorKeys(context.Background(), acct, "titogo"); err != nil {
		t.Fatal(err)
	}
	after := readDoorRecord(t, fx)
	if after.Revision != before.Revision {
		t.Fatalf("a renewal moved the revision %d -> %d", before.Revision, after.Revision)
	}
	if !after.ExpiresAt.After(before.ExpiresAt) || !after.SignedAt.After(before.SignedAt) {
		t.Fatalf("a renewal did not refresh the expiry: %v -> %v", before.ExpiresAt, after.ExpiresAt)
	}
	if !after.Admits(tok) {
		t.Fatal("a renewal dropped a live key")
	}
	if _, rev, _ := fx.st.DoorKeysLive(OpsAccountID, "titogo"); rev != before.Revision {
		t.Fatalf("a renewal moved the database's revision to %d", rev)
	}
}

// blockingStore holds the first Put to one key until release is closed,
// signalling entered when it gets there.
type blockingStore struct {
	release.Store
	key     string
	once    sync.Once
	entered chan struct{}
	release chan struct{}
	puts    atomic.Int32 // Puts to key, counted before any blocking
}

func (b *blockingStore) Put(ctx context.Context, key string, body []byte, ifMatch string) (string, error) {
	if key == b.key {
		b.puts.Add(1)
		first := false
		b.once.Do(func() { first = true })
		if first {
			close(b.entered)
			<-b.release
		}
	}
	return b.Store.Put(ctx, key, body, ifMatch)
}

// Round 2 finding 5: a renewal that read revision N must not land after a
// revoke published N+1. The renewal is held inside its Put, under the
// publication lock, while the revoke writes the database and queues behind
// the lock. The bucket must end on the revoke's revision.
func TestDoorKeyRevokeIsNotOverwrittenByARacingRenewal(t *testing.T) {
	fx, token := instanceFixture(t, "code-door-keys-race")
	tok := mintDoorKey(t, fx, token)
	acct, err := fx.st.AccountByID(OpsAccountID)
	if err != nil {
		t.Fatal(err)
	}
	bs := &blockingStore{Store: fx.rel, key: doorkey.RecordKey("bab", "titogo"),
		entered: make(chan struct{}), release: make(chan struct{})}
	fx.srv.cfg.Releases = bs

	var wg sync.WaitGroup
	var renewErr error
	wg.Add(1)
	go func() {
		defer wg.Done()
		renewErr = fx.srv.publishDoorKeys(context.Background(), acct, "titogo")
	}()
	<-bs.entered // the renewal has signed revision 1 and is holding the lock

	var revokeCode int
	var revokeOut string
	wg.Add(1)
	go func() {
		defer wg.Done()
		revokeCode, _, revokeOut = rawReq(t, http.MethodPost, doorKeysURL(fx)+"/"+tok.ID+"/revoke", token, "")
	}()
	// The revoke's database write lands before it reaches the lock.
	deadline := time.Now().Add(5 * time.Second)
	for {
		if _, rev, _ := fx.st.DoorKeysLive(OpsAccountID, "titogo"); rev == 2 {
			break
		}
		if time.Now().After(deadline) {
			t.Fatal("the revoke never wrote the database")
		}
		time.Sleep(time.Millisecond)
	}
	close(bs.release)
	wg.Wait()
	if renewErr != nil {
		t.Fatalf("renewal: %v", renewErr)
	}
	if revokeCode != http.StatusOK {
		t.Fatalf("revoke = %d %s", revokeCode, revokeOut)
	}
	// Exactly two writes pins the per-app lock itself, not just the outcome
	// (Fable's final review): without the lock the revoke writes while the
	// renewal is held, the renewal's stale-ETag Put then fails, and its retry
	// makes a third. The ETag check alone would still land revision 2.
	if n := bs.puts.Load(); n != 2 {
		t.Fatalf("%d Puts to the record, want 2: the revoke did not wait for the renewal's lock", n)
	}
	rec := readDoorRecord(t, fx)
	if rec.Revision != 2 || rec.Admits(tok) {
		t.Fatalf("bucket after the race: revision %d, admits the revoked key %v", rec.Revision, rec.Admits(tok))
	}
}

// Round 2 finding 6: a database whose counter is behind the bucket (a
// restore) publishes above the bucket's revision, never at or below it.
func TestDoorKeyPublishAdvancesPastTheBucketRevision(t *testing.T) {
	fx, token := instanceFixture(t, "code-door-keys-advance")
	first := mintDoorKey(t, fx, token)
	if rec := readDoorRecord(t, fx); rec.Revision != 1 {
		t.Fatalf("first publish at revision %d", rec.Revision)
	}
	putDoorObject(t, fx, signedDoorRecord(t, fx, 7, nil))
	second := mintDoorKey(t, fx, token)
	rec := readDoorRecord(t, fx)
	if rec.Revision != 8 {
		t.Fatalf("published revision %d over a bucket at 7, want 8", rec.Revision)
	}
	if !rec.Admits(first) || !rec.Admits(second) || len(rec.Keys) != 2 {
		t.Fatalf("advanced record lost the database's keys: %+v", rec.Keys)
	}
	if _, rev, err := fx.st.DoorKeysLive(OpsAccountID, "titogo"); err != nil || rev != 8 {
		t.Fatalf("database counter = %d %v, want 8", rev, err)
	}
	// An equal revision is the renewal case: republished as it is.
	acct, _ := fx.st.AccountByID(OpsAccountID)
	if err := fx.srv.publishDoorKeys(context.Background(), acct, "titogo"); err != nil {
		t.Fatal(err)
	}
	if rec := readDoorRecord(t, fx); rec.Revision != 8 {
		t.Fatalf("renewal at an equal revision published %d, want 8", rec.Revision)
	}
}

// Round 2 finding 4: replacing an existing object works, and a tampered
// object is overwritten rather than trusted.
func TestDoorKeyPublishReplacesExistingAndTamperedObjects(t *testing.T) {
	fx, token := instanceFixture(t, "code-door-keys-replace")
	a := mintDoorKey(t, fx, token)
	b := mintDoorKey(t, fx, token) // the second Put replaces the first object
	if rec := readDoorRecord(t, fx); rec.Revision != 2 || !rec.Admits(a) || !rec.Admits(b) {
		t.Fatalf("after two mints: %+v", rec)
	}
	putDoorObject(t, fx, []byte("not a door-key record"))
	if code, _, out := rawReq(t, http.MethodPost, doorKeysURL(fx)+"/"+a.ID+"/revoke", token, ""); code != http.StatusOK {
		t.Fatalf("revoke over a tampered object = %d %s", code, out)
	}
	rec := readDoorRecord(t, fx)
	if rec.Revision != 3 || rec.Admits(a) || !rec.Admits(b) {
		t.Fatalf("after revoking over garbage: revision %d, keys %+v", rec.Revision, rec.Keys)
	}
	// A validly shaped record signed by some other key is tampering too.
	other := newConsoleFixture(t) // a different signing key
	now := time.Now().UTC()
	foreign, _ := doorkey.Sign(other.priv, doorkey.Record{V: 1, Account: "bab", App: "titogo", Revision: 50,
		SignedAt: now, ExpiresAt: now.Add(time.Hour)})
	putDoorObject(t, fx, foreign)
	acct, _ := fx.st.AccountByID(OpsAccountID)
	if err := fx.srv.publishDoorKeys(context.Background(), acct, "titogo"); err != nil {
		t.Fatal(err)
	}
	if rec := readDoorRecord(t, fx); rec.Revision != 3 || !rec.Admits(b) {
		t.Fatalf("a foreign-signed revision was trusted: revision %d", rec.Revision)
	}
}

// casConflictStore loses the first n Puts to one key.
type casConflictStore struct {
	release.Store
	key  string
	mu   sync.Mutex
	lose int
	puts int
}

func (c *casConflictStore) Put(ctx context.Context, key string, body []byte, ifMatch string) (string, error) {
	if key == c.key {
		c.mu.Lock()
		c.puts++
		lose := c.puts <= c.lose
		c.mu.Unlock()
		if lose {
			return "", release.ErrCASConflict
		}
	}
	return c.Store.Put(ctx, key, body, ifMatch)
}

// Step 5: a lost compare-and-swap rebuilds and retries, at most three times.
func TestDoorKeyPublishRetriesAConflictAtMostThreeTimes(t *testing.T) {
	fx, token := instanceFixture(t, "code-door-keys-cas")
	mintDoorKey(t, fx, token)
	acct, _ := fx.st.AccountByID(OpsAccountID)

	cs := &casConflictStore{Store: fx.rel, key: doorkey.RecordKey("bab", "titogo"), lose: 2}
	fx.srv.cfg.Releases = cs
	if err := fx.srv.publishDoorKeys(context.Background(), acct, "titogo"); err != nil {
		t.Fatalf("two conflicts then a win: %v", err)
	}
	if cs.puts != 3 {
		t.Fatalf("%d puts, want 3", cs.puts)
	}

	cs = &casConflictStore{Store: fx.rel, key: doorkey.RecordKey("bab", "titogo"), lose: 100}
	fx.srv.cfg.Releases = cs
	if err := fx.srv.publishDoorKeys(context.Background(), acct, "titogo"); !errors.Is(err, release.ErrCASConflict) {
		t.Fatalf("persistent conflict = %v, want ErrCASConflict", err)
	}
	if cs.puts != 3 {
		t.Fatalf("%d puts under a persistent conflict, want 3", cs.puts)
	}
}

// The re-sign pass covers every app with a revision row.
func TestDoorKeyResignPassCoversEveryApp(t *testing.T) {
	fx, token := instanceFixture(t, "code-door-keys-pass")
	mintDoorKey(t, fx, token)
	apps, err := fx.st.DoorKeyApps()
	if err != nil || len(apps) != 1 || apps[0].App != "titogo" || apps[0].Sqid != "bab" || apps[0].AccountID != OpsAccountID {
		t.Fatalf("DoorKeyApps = %+v %v", apps, err)
	}
	before := readDoorRecord(t, fx)
	time.Sleep(2 * time.Millisecond)
	fx.srv.resignDoorKeys(context.Background())
	if after := readDoorRecord(t, fx); !after.ExpiresAt.After(before.ExpiresAt) {
		t.Fatal("the re-sign pass did not renew the record")
	}
}

// mintTestDoorKey stores one live door key for (account, app) directly.
func mintTestDoorKey(t *testing.T, s *Store, accountID int64, app, id string) {
	t.Helper()
	if _, err := s.DoorKeyInsert(accountID, app, doorkey.Entry{ID: id, SHA256: strings.Repeat("a", 64)}); err != nil {
		t.Fatalf("DoorKeyInsert(%d, %s): %v", accountID, app, err)
	}
}

// TestPurgeAppRowLeavesNoCredentialsForTheName (#219 item 1): purging frees
// the name, so a later app of that name must not inherit the purged app's
// tokens (either kind) or door keys. Before the fix all three survived the
// purge: the tokens still authenticated, and the door keys stayed live and
// were re-signed every 12 hours.
func TestPurgeAppRowLeavesNoCredentialsForTheName(t *testing.T) {
	s := openTestStore(t)
	now := time.Now()
	acct := mustAccount(t, s, "amadan")
	if _, err := s.CreateAppIn(acct.ID, "titogo", "paul@keymail.dev", now); err != nil {
		t.Fatal(err)
	}
	appTok, err := s.NewAppToken(acct.ID, "titogo", "paul@keymail.dev", "router", now)
	if err != nil {
		t.Fatal(err)
	}
	svcTok, err := s.NewServicePrincipal(acct.ID, "hub", "titogo", svcrole.Publish, "paul@keymail.dev", now)
	if err != nil {
		t.Fatal(err)
	}
	mintTestDoorKey(t, s, acct.ID, "titogo", "0123456789abcdef")
	_, revBefore, err := s.DoorKeysLive(acct.ID, "titogo")
	if err != nil {
		t.Fatal(err)
	}

	if err := s.TrashAppRow(acct.ID, "titogo", now); err != nil {
		t.Fatal(err)
	}
	if err := s.PurgeAppRow(acct.ID, "titogo"); err != nil {
		t.Fatal(err)
	}

	if _, ok := s.CLIPrincipal(appTok, now); ok {
		t.Error("the purged app's app token still authenticates")
	}
	if _, ok := s.CLIPrincipal(svcTok, now); ok {
		t.Error("the purged app's service credential still authenticates")
	}
	keys, rev, err := s.DoorKeysLive(acct.ID, "titogo")
	if err != nil {
		t.Fatal(err)
	}
	if len(keys) != 0 {
		t.Errorf("door keys after purge = %+v, want none live", keys)
	}
	// The revision climbs, so the empty record outranks what boxes admitted.
	if rev <= revBefore {
		t.Errorf("door-key revision after purge = %d, want above %d", rev, revBefore)
	}

	// The name is clean for its next owner: a new app of the same name, and
	// a rename onto it, are not refused over leftovers.
	if _, err := s.CreateAppIn(acct.ID, "titogo", "paul@keymail.dev", now); err != nil {
		t.Fatal(err)
	}
	if _, err := s.CreateAppIn(acct.ID, "other", "paul@keymail.dev", now); err != nil {
		t.Fatal(err)
	}
	if err := s.TrashAppRow(acct.ID, "titogo", now); err != nil {
		t.Fatal(err)
	}
	if err := s.PurgeAppRow(acct.ID, "titogo"); err != nil {
		t.Fatal(err)
	}
	if err := s.RenameAppIn(acct.ID, "other", "titogo"); err != nil {
		t.Errorf("RenameAppIn onto a purged name = %v, want it allowed", err)
	}
}

// TestPurgeAppRowKeepsALiveAppsCredentials: the credential sweep rides on the
// row delete, so a live (untrashed) app, which PurgeAppRow refuses, keeps
// everything.
func TestPurgeAppRowKeepsALiveAppsCredentials(t *testing.T) {
	s := openTestStore(t)
	now := time.Now()
	acct := mustAccount(t, s, "amadan")
	if _, err := s.CreateAppIn(acct.ID, "titogo", "paul@keymail.dev", now); err != nil {
		t.Fatal(err)
	}
	appTok, err := s.NewAppToken(acct.ID, "titogo", "paul@keymail.dev", "router", now)
	if err != nil {
		t.Fatal(err)
	}
	mintTestDoorKey(t, s, acct.ID, "titogo", "0123456789abcdef")
	if err := s.PurgeAppRow(acct.ID, "titogo"); err != nil {
		t.Fatal(err)
	}
	if _, ok := s.CLIPrincipal(appTok, now); !ok {
		t.Error("a refused purge of a live app revoked its token")
	}
	if keys, _, _ := s.DoorKeysLive(acct.ID, "titogo"); len(keys) != 1 {
		t.Errorf("a refused purge of a live app touched its door keys: %+v", keys)
	}
}

// TestMoveAppLeavesNoLiveDoorKeysForTheName (#219 item 1): door keys name
// their account, so they cannot follow a moved app. The source's must not
// stay live for a later app of that name, and a purged predecessor's keys at
// the destination must not answer for the app that moved in.
func TestMoveAppLeavesNoLiveDoorKeysForTheName(t *testing.T) {
	s := openTestStore(t)
	now := time.Now()
	from := mustAccount(t, s, "amadan")
	to := mustAccount(t, s, "other")
	if _, err := s.CreateAppIn(from.ID, "titogo", "paul@keymail.dev", now); err != nil {
		t.Fatal(err)
	}
	mintTestDoorKey(t, s, from.ID, "titogo", "0123456789abcdef")
	// A leftover at the destination, the shape a purge before this fix left.
	mintTestDoorKey(t, s, to.ID, "titogo", "fedcba9876543210")
	if err := s.MoveApp("titogo", from.ID, to.ID); err != nil {
		t.Fatalf("MoveApp: %v", err)
	}
	for _, side := range []*Account{from, to} {
		keys, _, err := s.DoorKeysLive(side.ID, "titogo")
		if err != nil {
			t.Fatal(err)
		}
		if len(keys) != 0 {
			t.Errorf("%s: live door keys for titogo after the move = %+v, want none", side.Sqid, keys)
		}
	}
}