package edge

// Task 2: the store door — the ACL is the whole security story, so it is
// tested as a matrix BEFORE any HTTP shape exists: every key class from the
// spec's #73 inventory × operation × own/other tenancy, with the exact keys a
// real box uses. A row that flips here is a tenancy breach, not a test nit.

import (
	"context"
	"encoding/json"
	"errors"
	"fmt"
	"go/ast"
	"go/parser"
	"go/token"
	"io"
	"net/http"
	"net/http/httptest"
	"os"
	"path/filepath"
	"slices"
	"strings"
	"testing"

	"github.com/carlosframework/platform/internal/domains"
	"github.com/carlosframework/platform/internal/plans"
	"github.com/carlosframework/platform/internal/registry"
	"github.com/carlosframework/platform/internal/release"
	"time"
)

// The two identities every row is judged against: fleet "pi" owned by account
// sqid "ab12". "OTHER"/"zz99" is any other tenant.
const (
	testSqid  = "ab12"
	testFleet = "pi"
)

type aclOp int

const (
	opRead aclOp = iota
	opWrite
	opDelete
)

func (o aclOp) String() string {
	switch o {
	case opRead:
		return "read"
	case opWrite:
		return "write"
	default:
		return "delete"
	}
}

// aclAllows is the door's decision for one (key, op), canonicalization
// included — exactly the order the handler runs it in: canonicalKey first, so
// a traversal key is refused before any ACL string ever sees it.
func aclAllows(key string, op aclOp) bool {
	k, ok := canonicalKey(key)
	if !ok {
		return false
	}
	if op == opRead {
		return aclRead(testSqid, testFleet, k)
	}
	return aclWrite(testSqid, testFleet, k)
}

func TestEntitlementsAreNotReadableThroughTheEdgeDoor(t *testing.T) {
	for _, key := range []string{
		"store/entitlements/" + testSqid + ".json",
		"store/entitlements/other.json",
		"accounts/" + testSqid + "/../../store/entitlements/" + testSqid + ".json",
		"apps/" + testSqid + "/../../store/entitlements/" + testSqid + ".json",
	} {
		for _, op := range []aclOp{opRead, opWrite, opDelete} {
			if aclAllows(key, op) {
				t.Errorf("%s allowed for %q", op, key)
			}
		}
	}
	for _, prefix := range []string{"store/", "store/entitlements/", "store/entitlements/" + testSqid} {
		if _, ok := aclListScope(testSqid, testFleet, prefix); ok {
			t.Errorf("listing allowed for %q", prefix)
		}
		if aclDir(testSqid, testFleet, prefix) {
			t.Errorf("directory visible: %q", prefix)
		}
	}
}

func TestStoreDoorACLMatrix(t *testing.T) {
	rows := []struct {
		key  string
		op   aclOp
		want bool
		why  string
	}{
		// --- the shared platform reads the spec allowlists (F3, F7) ---
		{"control/serial", opRead, true, "the 2s convergence poll"},
		{"control/serial", opWrite, false, "a box must never bump the platform serial"},
		{"control/serial", opDelete, false, "nor delete it"},
		{"bootstrap/carlos", opRead, true, "F7: the sanctioned self-update path"},
		{"bootstrap/carlos", opWrite, false, "a box must never publish the platform binary"},
		{"control/serial2", opRead, false, "the allowlist is exact, not a prefix"},
		{"control/", opRead, false, "no listing-shaped key stands in for the allowlist"},
		{"bootstrap/carlos.sig", opRead, false, "exact key only"},
		{"control/system/router/stable.json", opRead, true, "the platform channel pointer (system update spec §3)"},
		{"control/system/router/canary.json", opRead, true, "…and the canary one"},
		{"control/system/router/stable.json", opWrite, false, "a box never writes a pointer"},
		{"control/system/router", opRead, false, "the pointer shape is exactly three segments ending .json"},
		{"control/system/router/stable.json/x", opRead, false, "…not four"},
		{"control/system/router/stable.txt", opRead, false, "…and .json"},
		{"bootstrap/router/v0.18.0/carlos-linux-arm64", opRead, true, "a mirrored platform artifact"},
		{"bootstrap/router/v0.18.0/carlos-linux-arm64", opWrite, false, "a box must never publish the platform binary"},
		{"bootstrap/router/v0.18.0", opRead, false, "the artifact shape is exactly three segments"},
		{"bootstrap/router/v0.18.0/a/b", opRead, false, "…not four"},
		{"bootstrap/router.sig", opRead, false, "nothing else under bootstrap/"},
		{"bootstrap/router/../../x", opRead, false, "traversal is refused by canonicalKey before the ACL"},
		{"control/system/../serial", opRead, false, "…on both prefixes"},
		{release.LayoutIntentKey(), opRead, true, "every box needs the fleet's layout intent to converge"},
		{release.LayoutIntentKey(), opWrite, false, "a box must never author the fleet's layout intent"},
		{release.LayoutIntentKey(), opDelete, false, "nor delete it"},
		{"control/layout.json2", opRead, false, "the allowlist is exact, not a prefix"},

		// --- own account estate ---
		// The account manifest is accounts/<sqid>/account.json
		// (domains.AccountManifestKey), NOT accounts/<sqid>.json: a box that
		// cannot read it sees zero accounts, and provision.Reconcile then
		// retires every provisioned route on the box.
		{"accounts/ab12/account.json", opRead, true, "own account manifest"},
		{"accounts/zz99/account.json", opRead, false, "another tenant's account manifest"},
		{"accounts/ab12/account.json", opWrite, false, "reads only, even of its own account"},
		{"accounts/ab12.json", opRead, false, "the manifest is a directory deeper; this key is not the account"},
		{"accounts/ab12x/account.json", opRead, false, "sqid prefix must not match a longer sqid"},
		{"accounts/ab12", opRead, false, "the account prefix itself is not an object"},
		{"apps/ab12/web/channels/stable.json", opRead, true, "own app channel pointer"},
		{"apps/ab12/web/releases/v1.2.3/manifest.json", opRead, true, "own release manifest"},
		{"apps/ab12/web/releases/v1.2.3/app.tar.gz", opRead, true, "own artifact (F8: streamed, not presigned)"},
		{"apps/ab12/web/config/production.json", opRead, true, "own config bundle"},
		{"apps/ab12/web/restart-gen.json", opRead, true, "own restart generation"},
		{"apps/ab12/web/channels/stable.json", opWrite, false, "a box never promotes"},
		{"apps/ab12/web/releases/v1.2.3/app.tar.gz", opDelete, false, "retention is not a box's job (F6)"},

		// --- own account's app LOGS: the second (and only other) write scope ---
		// applog.ChunkKey's shape, which is what logshipLoop PUTs and what its
		// hourly prune DELETEs. The rows below the allows are the regression
		// pins that keep this from becoming a blanket apps/<sqid>/** grant.
		{"apps/ab12/web/logs/box-a/2026081108/0000000000000001-42.jsonl.gz", opWrite, true, "own app's log chunk"},
		{"apps/ab12/web/logs/box-a/2026081108/0000000000000001-42.jsonl.gz", opDelete, true, "logship prunes its own subtree hourly"},
		{"apps/ab12/web/logs/box-a/2026081108/0000000000000001-42.jsonl.gz", opRead, true, "reads already covered by the app estate"},
		{"apps/zz99/web/logs/box-a/2026081108/x.jsonl.gz", opWrite, false, "another account's app logs"},
		{"apps/zz99/web/logs/box-a/2026081108/x.jsonl.gz", opDelete, false, "nor delete them"},
		{"apps/ab12x/web/logs/box-a/x.jsonl.gz", opWrite, false, "sqid prefix must not match a longer sqid"},
		{"apps/ab12/web/instances/h.example.json", opWrite, false, "REGRESSION: the logs grant must not mint instance records"},
		{"apps/ab12/web/config/production.json", opWrite, false, "REGRESSION: nor rewrite config"},
		{"apps/ab12/web/restart-gen.json", opWrite, false, "REGRESSION: nor request its own restarts"},
		{"apps/ab12/web/releases/v1.2.3/manifest.json", opWrite, false, "REGRESSION: nor publish a release"},
		{"apps/ab12/logs/box-a/x.jsonl.gz", opWrite, false, "logs must sit under an app segment, not the account root"},
		{"apps/ab12/web/logs", opWrite, false, "the logs prefix itself is not an object"},
		{"apps/ab12/web/logs/", opWrite, false, "nor is the bare prefix with a slash"},
		{"apps/ab12/web/channels/logs/stable.json", opWrite, false, "\"logs\" deeper in the key grants nothing"},
		{"apps/ab12/weblogs/box-a/x.jsonl.gz", opWrite, false, "the segment is logs/, not a suffix of the app name"},
		{"apps/ab12/web/logs/../../zz99/web/logs/x.jsonl.gz", opWrite, false, "traversal out of the logs subtree"},
		{"apps/ab12/web/logs/../channels/stable.json", opWrite, false, "traversal out of logs into channels"},

		// --- sibling chunk families (errors-and-analytics spec §3.2) ---
		{"apps/ab12/web/errors/box-a/2026090710/0000000000000001-42.jsonl.gz", opWrite, true, "own app's error chunk"},
		{"apps/ab12/web/errors/box-a/2026090710/0000000000000001-42.jsonl.gz", opDelete, true, "errship prunes its own subtree hourly"},
		{"apps/ab12/web/analytics/box-a/days/2026-09-07.json", opWrite, true, "own app's analytics day file"},
		{"apps/zz99/web/errors/box-a/x.jsonl.gz", opWrite, false, "another account's error chunks"},
		{"apps/ab12/errors/box-a/x.jsonl.gz", opWrite, false, "errors must sit under an app segment"},
		{"apps/ab12/web/errors", opWrite, false, "the bare family segment is not a chunk"},
		{"apps/ab12/web/errors/", opWrite, false, "nor with a slash"},
		{"apps/ab12/web/other/box-a/x.jsonl.gz", opWrite, false, "the family list is exact: logs, errors, analytics"},
		{"apps/ab12/web/channels/errors/stable.json", opWrite, false, "\"errors\" deeper in the key grants nothing"},
		{"apps/ab12/web/errorsx/box-a/x.jsonl.gz", opWrite, false, "the segment is errors/, not a prefix of a longer name"},

		// --- own account's promotion records (settings spec §4.1, ruling R17) ---
		// Signed digests of the account's own builds, which HeldAuthorized
		// reads on a fleet box. One shape, exactly five segments; nothing else
		// under releases/ and never a write.
		{"releases/ab12/web/promoted/v1.2.3", opRead, true, "own account's promotion record"},
		{"releases/zz99/web/promoted/v1.2.3", opRead, false, "another account's promotion record"},
		{"releases/ab12x/web/promoted/v1.2.3", opRead, false, "sqid must match exactly, not as a prefix"},
		{"releases/ab12/web/promoted/v1.2.3/x", opRead, false, "a sixth segment"},
		{"releases/ab12/web/promoted", opRead, false, "a missing version"},
		{"releases/ab12/web/promoted/", opRead, false, "an empty version"},
		{"releases/ab12/pointer-digests", opRead, false, "the account's digest marker is not granted"},
		{"releases/ab12/web/other/v1.2.3", opRead, false, "segment 3 is exactly promoted"},
		{"releases/ab12/Web!/promoted/v1.2.3", opRead, false, "an invalid app"},
		{"releases/ab12/web/promoted/v1~bad", opRead, false, "an invalid version"},
		{"releases/ab12/web/promoted/v1.2.3", opWrite, false, "a box never writes a promotion record"},
		{"releases/ab12/web/promoted/v1.2.3", opDelete, false, "nor deletes one"},
		{"releases/ab12/web/promoted/../../zz99/web/promoted/v1", opRead, false, "traversal out of own account"},

		// --- other tenants ---
		{"apps/zz99/web/channels/stable.json", opRead, false, "another account's app"},
		{"apps/ab12x/web/channels/stable.json", opRead, false, "sqid prefix must not match a longer sqid"},
		{"apps/ab1/web/channels/stable.json", opRead, false, "nor a shorter one"},
		{"apps/ab12", opRead, false, "the account prefix itself is not an object"},

		// --- own fleet corner: the only writable place there is ---
		{"fleets/pi/bindings/app.example.json", opRead, true, "the binding takeover guard reads before it CASes"},
		{"fleets/pi/bindings/app.example.json", opWrite, true, "fleet bindings are the box's own message"},
		{"fleets/pi/status/boxes/box-a.json", opWrite, true, "own heartbeat"},
		{"fleets/pi/metrics/boxes/box-a/raw/1699.json", opWrite, true, "own metrics"},
		{"fleets/pi/metrics/boxes/box-a/raw/1699.json", opDelete, true, "own 48h metrics prune"},
		{"fleets/other/status/boxes/box-a.json", opRead, false, "another fleet's corner"},
		{"fleets/other/status/boxes/box-a.json", opWrite, false, "and it cannot write there"},
		{"fleets/other/status/boxes/box-a.json", opDelete, false, "nor delete there"},
		{"fleets/pix/status/boxes/box-a.json", opWrite, false, "fleet prefix must not match a longer fleet name"},
		{"fleets/pi", opWrite, false, "the fleet prefix itself is not an object"},

		// --- domains/ claims: never through aclRead (#215) — serveClaim
		// decides per claim body, own account and verified only (see
		// TestStoreDoorClaimsAreOwnAccountAndRedacted); console-only write ---
		{"domains/app.example.com.json", opRead, false, "claims are served by serveClaim, not the prefix ACL"},
		{"domains/app.example.com.json", opWrite, false, "boxes read claims, only the console writes them"},
		{"domains/app.example.com.json", opDelete, false, "nor delete them"},
		{"domains", opRead, false, "an object AT the bare name, not the claims prefix"},

		// --- the self-serve storage entitlement is console-only (#381) ---
		// store/entitlements/<sqid>.json carries the applicant's note, the
		// deciding operator's address and the decline REASON — an operator's
		// commentary about a tenant. It lives outside accounts/ precisely so
		// that no fleet credential can read it; had it gone to the obvious
		// accounts/<sqid>/store.json, the account's own boxes could.
		{"store/entitlements/" + testSqid + ".json", opRead, false, "a box never reads its account's entitlement, own sqid or not"},
		{"store/entitlements/zz99.json", opRead, false, "still less another account's"},
		{"store/entitlements/" + testSqid + ".json", opWrite, false, "and never writes one"},
		{"store/entitlements/" + testSqid + ".json", opDelete, false, "nor deletes one"},
		{"store/", opRead, false, "no listing-shaped key reaches the prefix either"},
		{"store", opRead, false, "nor an object at the bare name"},

		// --- shapes canonicalKey must kill before the ACL is consulted ---
		{"apps/ab12/../zz99/web/channels/stable.json", opRead, false, "traversal out of own account"},
		{"fleets/pi/../other/status/boxes/box-a.json", opWrite, false, "traversal out of own fleet"},
		{"../etc/passwd", opRead, false, "traversal below the keyspace"},
		{"/control/serial", opRead, false, "leading slash"},
		{"apps//ab12/web/channels/stable.json", opRead, false, "empty segment"},
		{"apps/ab12/./web/channels/stable.json", opRead, false, "dot segment"},
		{"", opRead, false, "empty key"},
	}
	for _, row := range rows {
		got := aclAllows(row.key, row.op)
		if got != row.want {
			t.Errorf("acl %s %q = %v, want %v (%s)", row.op, row.key, got, row.want, row.why)
		}
	}
}

// TestAclReadLayoutIntentNeedsBothIdentities pins the same empty-sqid,
// empty-fleet guard aclRead already applies to every other key: an
// authenticated identity is required before the allowlist is even
// consulted, so a request that never resolved a fleet row cannot read the
// layout intent either.
func TestAclReadLayoutIntentNeedsBothIdentities(t *testing.T) {
	key := release.LayoutIntentKey()
	if !aclRead(testSqid, testFleet, key) {
		t.Errorf("aclRead(%q, %q, %q) = false, want true", testSqid, testFleet, key)
	}
	if aclRead("", testFleet, key) {
		t.Errorf("aclRead(\"\", %q, %q) = true, want false", testFleet, key)
	}
	if aclRead(testSqid, "", key) {
		t.Errorf("aclRead(%q, \"\", %q) = true, want false", testSqid, key)
	}
	if aclWrite(testSqid, testFleet, key) {
		t.Errorf("aclWrite(%q, %q, %q) = true, want false", testSqid, testFleet, key)
	}
}

// TestCanonicalKeyRefusesShapes pins the pre-ACL gate on its own: the ACL is
// prefix-string exact, which is only safe because nothing that could re-point
// a prefix ever reaches it.
func TestCanonicalKeyRefusesShapes(t *testing.T) {
	bad := []string{
		"",
		"/apps/ab12/x",
		"apps//ab12/x",
		"apps/ab12/../zz99/x",
		"..",
		"../x",
		"apps/ab12/x/..",
		"apps/./ab12/x",
		"apps/ab12/x/",
		"apps/ab12/\x00x",
		"apps/ab12/x\ny",
		strings.Repeat("a", 1025),
	}
	for _, k := range bad {
		if got, ok := canonicalKey(k); ok {
			t.Errorf("canonicalKey(%q) = (%q, true), want refused", k, got)
		}
	}
	good := []string{
		"control/serial",
		"bootstrap/carlos",
		"accounts/ab12.json",
		"apps/ab12/web/releases/v1.2.3/app.tar.gz",
		"fleets/pi/bindings/app.example.json",
		strings.Repeat("a", 1024),
	}
	for _, k := range good {
		got, ok := canonicalKey(k)
		if !ok || got != k {
			t.Errorf("canonicalKey(%q) = (%q, %v), want (%q, true)", k, got, ok, k)
		}
	}
}

// TestACLListScope: a listing is scope-MAPPED, never scope-checked — asking
// for "apps/" gets you your own account's subtree, not a refusal, because
// that is what makes an unmodified release.Store caller work through the door.
func TestACLListScope(t *testing.T) {
	cases := []struct {
		prefix string
		want   string
		ok     bool
	}{
		{"apps/", "apps/ab12/", true},
		{"apps", "apps/ab12/", true},
		{"apps/ab12", "apps/ab12/", true},
		{"apps/ab12/", "apps/ab12/", true},
		{"apps/ab12/web/releases/", "apps/ab12/web/releases/", true},
		{"apps/zz99/", "", false},
		{"apps/ab1", "", false},
		{"apps/ab12x/", "", false},
		{"accounts/", "accounts/", true},
		{"accounts", "accounts/", true},
		{"accounts/zz99.json", "", false},
		// DELIBERATE, and the trap worth naming: aclDir is STRICTER than
		// aclRead here. aclRead admits accounts/<own-sqid>/** as an object
		// read, but the listing scope map admits only the bare, SHARED
		// accounts/ prefix — a caller narrowing its listing to its own
		// account directory is refused. That is not an oversight to "fix":
		// every real caller of this prefix lists accounts/ whole
		// (provision.knownAccounts, domains.Reconcile, console.materialize)
		// and takes the per-tenant filter serveListing applies, so a
		// per-tenant mapping row here would widen the scope map for no
		// caller. If one ever appears, adding the row is the deliberate act
		// this pin makes visible.
		{"accounts/" + testSqid + "/", "", false},
		{"accounts/" + testSqid, "", false},
		// domains/ (#151): the OTHER shared scope — every claim is
		// cross-tenant-readable, so (unlike apps/ and fleets/) there is no
		// per-tenant subtree to narrow into; only the bare prefix maps.
		{"domains/", "domains/", true},
		{"domains", "domains/", true},
		{"domains/app.example.com.json", "", false},
		{"fleets/", "fleets/pi/", true},
		{"fleets/pi/status/boxes/", "fleets/pi/status/boxes/", true},
		{"fleets/other/", "", false},
		{"control/", "", false},
		{"bootstrap/", "", false},
		{"", "", false},
		{"status/", "", false},
	}
	for _, c := range cases {
		got, ok := aclListScope(testSqid, testFleet, c.prefix)
		if got != c.want || ok != c.ok {
			t.Errorf("aclListScope(%q) = (%q, %v), want (%q, %v)", c.prefix, got, ok, c.want, c.ok)
		}
	}
}

// TestACLDirIsPerTenant pins the ListDirs predicate on its own. A child
// prefix cannot be judged by aclRead (it is a directory, not an object), and
// judging it by "is it under the prefix we listed" would enumerate every
// account on the platform the moment accounts/ is listed.
func TestACLDirIsPerTenant(t *testing.T) {
	cases := map[string]bool{
		"accounts/" + testSqid + "/":       true,
		"accounts/zz99/":                   false,
		"accounts/" + testSqid + "x/":      false,
		"accounts/":                        false,
		"apps/" + testSqid + "/web/":       true,
		"apps/zz99/web/":                   false,
		"apps/" + testSqid + "x/web/":      false,
		"fleets/" + testFleet + "/status/": true,
		"fleets/other/status/":             false,
		"fleets/" + testFleet + "x/y/":     false,
		"control/":                         false,
		// domains/ (#215): no longer a shared read scope; claims are flat
		// and serveClaimListing answers dirs with nothing.
		"domains/anything/": false,
	}
	for dir, want := range cases {
		if got := aclDir(testSqid, testFleet, dir); got != want {
			t.Errorf("aclDir(%q) = %v, want %v", dir, got, want)
		}
	}
}

// The promotion-record grant (ruling R17) is a read of one exact object
// shape: no prefix under releases/ maps to a listing scope or shows as a
// directory, the box's own account's included.
func TestPromotionRecordsAreNotListable(t *testing.T) {
	for _, prefix := range []string{
		"releases/",
		"releases",
		"releases/" + testSqid + "/",
		"releases/" + testSqid + "/web/",
		"releases/" + testSqid + "/web/promoted/",
		"releases/" + testSqid + "/web/promoted",
	} {
		if got, ok := aclListScope(testSqid, testFleet, prefix); ok {
			t.Errorf("aclListScope(%q) = (%q, true), want refused", prefix, got)
		}
		if aclDir(testSqid, testFleet, strings.TrimSuffix(prefix, "/")+"/") {
			t.Errorf("aclDir(%q) = true, want false", prefix)
		}
	}
	key := "releases/" + testSqid + "/web/promoted/v1"
	if aclRead("", testFleet, key) || aclRead(testSqid, "", key) {
		t.Errorf("aclRead(%q) without both identities = true, want false", key)
	}
}

// ---- handler tests ------------------------------------------------------

// The credentials every handler test runs with: a fleet channel
// "<fleet>/<label>" whose token hash sits in the hub's dynamic table (the
// registry-backed source), alongside a STATIC client which must never open
// this door.
const (
	testChannel     = testFleet + "/box-a"
	testToken       = "box-a-bearer-token"
	staticName      = "hq"
	staticToken     = "static-client-token"
	ownKey          = "apps/" + testSqid + "/web/channels/stable.json"
	ownFleetKey     = "fleets/" + testFleet + "/status/boxes/box-a.json"
	otherAccountKey = "apps/zz99/web/channels/stable.json"
)

// newTestDoor builds a door over a DirStore with the identities above — the
// same wiring edge.go does in production (hub + the edge's own store handle +
// the reload-time fleet→account snapshot).
func newTestDoor(t *testing.T) (*storeDoor, *release.DirStore) {
	t.Helper()
	hub := NewTunnelHub("tunnel.test", map[string]string{staticName: staticToken})
	hub.SetDynamicAuth(map[string]string{testChannel: sha256Hex(testToken)})
	store := release.NewDirStore(t.TempDir())
	return &storeDoor{hub: hub, store: store, fleetAccount: func(fleet string) (string, bool) {
		if fleet == testFleet {
			return testSqid, true
		}
		return "", false
	}}, store
}

// doorReq builds a request with the given credentials; an empty token sends
// no Authorization header at all, an empty name no Carlos-Tunnel-Name.
func doorReq(method, target, name, token, body string) *http.Request {
	var r *http.Request
	if body == "" {
		r = httptest.NewRequest(method, target, nil)
	} else {
		r = httptest.NewRequest(method, target, strings.NewReader(body))
	}
	if name != "" {
		r.Header.Set("Carlos-Tunnel-Name", name)
	}
	if token != "" {
		r.Header.Set("Authorization", "Bearer "+token)
	}
	return r
}

// doorDo runs one correctly authenticated request through the door.
func doorDo(d *storeDoor, method, target, body string, hdr map[string]string) *httptest.ResponseRecorder {
	r := doorReq(method, target, testChannel, testToken, body)
	for k, v := range hdr {
		r.Header.Set(k, v)
	}
	w := httptest.NewRecorder()
	d.ServeHTTP(w, r)
	return w
}

func seedObject(t *testing.T, s *release.DirStore, key, body string) string {
	t.Helper()
	etag, err := s.Put(context.Background(), key, []byte(body), "")
	if err != nil {
		t.Fatalf("seed %s: %v", key, err)
	}
	return etag
}

func TestStoreDoorGetServesOwnEstate(t *testing.T) {
	d, store := newTestDoor(t)
	etag := seedObject(t, store, ownKey, `{"version":"v1"}`)
	seedObject(t, store, "control/serial", "42")
	seedObject(t, store, "bootstrap/carlos", "ELF...")
	seedObject(t, store, "control/system/router/stable.json", `{"payload":"x"}`)
	seedObject(t, store, "bootstrap/router/v1/carlos-linux-arm64", "ELF")

	for _, key := range []string{ownKey, "control/serial", "bootstrap/carlos", "control/system/router/stable.json", "bootstrap/router/v1/carlos-linux-arm64"} {
		w := doorDo(d, "GET", "/store/o/"+key, "", nil)
		if w.Code != http.StatusOK {
			t.Fatalf("GET %s = %d, want 200", key, w.Code)
		}
	}
	w := doorDo(d, "GET", "/store/o/"+ownKey, "", nil)
	if got := w.Body.String(); got != `{"version":"v1"}` {
		t.Errorf("body = %q, want the stored object", got)
	}
	if got := w.Header().Get("ETag"); got != etag {
		t.Errorf("ETag = %q, want the backing store's %q (etags are opaque, passed through)", got, etag)
	}
}

// TestStoreDoorCASRoundTrip pins F4 on the wire: there is no unconditional
// Put, a lost race is 412, and a won race hands back the new etag.
func TestStoreDoorCASRoundTrip(t *testing.T) {
	d, store := newTestDoor(t)
	path := "/store/o/" + ownFleetKey

	if w := doorDo(d, "PUT", path, "first", nil); w.Code != http.StatusBadRequest {
		t.Fatalf("PUT with no precondition = %d, want 400 (the Store contract has no blind write)", w.Code)
	}
	if _, _, err := store.Get(context.Background(), ownFleetKey); !errors.Is(err, os.ErrNotExist) {
		t.Fatal("a refused PUT still created the object")
	}
	if w := doorDo(d, "PUT", path, "x", map[string]string{"If-Match": "abc", "If-None-Match": "*"}); w.Code != http.StatusBadRequest {
		t.Errorf("PUT with both preconditions = %d, want 400", w.Code)
	}

	w := doorDo(d, "PUT", path, "first", map[string]string{"If-None-Match": "*"})
	if w.Code != http.StatusOK {
		t.Fatalf("create-only PUT = %d, want 200", w.Code)
	}
	e1 := w.Header().Get("ETag")
	if e1 == "" {
		t.Fatal("create-only PUT returned no ETag")
	}
	if w := doorDo(d, "PUT", path, "again", map[string]string{"If-None-Match": "*"}); w.Code != http.StatusPreconditionFailed {
		t.Errorf("create-only PUT over an existing object = %d, want 412", w.Code)
	}
	if w := doorDo(d, "PUT", path, "stale", map[string]string{"If-Match": "0000"}); w.Code != http.StatusPreconditionFailed {
		t.Errorf("replace-only PUT with a stale etag = %d, want 412", w.Code)
	}
	w2 := doorDo(d, "PUT", path, "second", map[string]string{"If-Match": e1})
	if w2.Code != http.StatusOK {
		t.Fatalf("replace-only PUT with the fresh etag = %d, want 200", w2.Code)
	}
	if e2 := w2.Header().Get("ETag"); e2 == "" || e2 == e1 {
		t.Errorf("ETag after replace = %q, want a new one (was %q)", e2, e1)
	}
	body, _, err := store.Get(context.Background(), ownFleetKey)
	if err != nil || string(body) != "second" {
		t.Fatalf("stored body = %q, %v; want \"second\"", body, err)
	}
}

func TestStoreDoorDeleteIsScopedAndIdempotent(t *testing.T) {
	d, store := newTestDoor(t)
	seedObject(t, store, ownFleetKey, "{}")
	seedObject(t, store, ownKey, "{}")

	for i := 0; i < 2; i++ {
		if w := doorDo(d, "DELETE", "/store/o/"+ownFleetKey, "", nil); w.Code != http.StatusNoContent {
			t.Fatalf("DELETE own fleet key (attempt %d) = %d, want 204", i+1, w.Code)
		}
	}
	if w := doorDo(d, "DELETE", "/store/o/"+ownKey, "", nil); w.Code != http.StatusNotFound {
		t.Fatalf("DELETE a release object = %d, want 404 (retention is not a box's job)", w.Code)
	}
	if _, _, err := store.Get(context.Background(), ownKey); err != nil {
		t.Fatalf("the refused DELETE removed the object anyway: %v", err)
	}
}

// TestStoreDoorRefusalsAreByteIdentical is the spec's central security
// invariant: bad auth, a static (non-fleet) name, another tenant's key, a
// missing in-scope key and a malformed key must be INDISTINGUISHABLE — same
// status, same headers, same bytes — or the door becomes a keyspace oracle.
func TestStoreDoorRefusalsAreByteIdentical(t *testing.T) {
	d, store := newTestDoor(t)
	seedObject(t, store, otherAccountKey, "someone else's")
	seedObject(t, store, "fleets/other/status/boxes/box-a.json", "another fleet's")
	// Seeded so the account-manifest row below refuses a key that really
	// EXISTS: the refusal must not be distinguishable from the missing-key
	// one, which is only proved against an object that is actually there.
	seedObject(t, store, "accounts/zz99/account.json", "another tenant's account")

	req := func(name, token, method, target string) *http.Request {
		return doorReq(method, target, name, token, "")
	}
	cases := map[string]*http.Request{
		"wrong token":          req(testChannel, "not-the-token", "GET", "/store/o/"+ownKey),
		"no auth at all":       req("", "", "GET", "/store/o/"+ownKey),
		"static name + token":  req(staticName, staticToken, "GET", "/store/o/control/serial"),
		"unknown fleet":        req("nosuch/box", testToken, "GET", "/store/o/control/serial"),
		"other account's key":  req(testChannel, testToken, "GET", "/store/o/"+otherAccountKey),
		"other fleet's key":    req(testChannel, testToken, "GET", "/store/o/fleets/other/status/boxes/box-a.json"),
		"missing in-scope key": req(testChannel, testToken, "GET", "/store/o/apps/"+testSqid+"/web/nope.json"),
		"traversal key":        req(testChannel, testToken, "GET", "/store/o/apps/"+testSqid+"/../zz99/x"),
		"empty key":            req(testChannel, testToken, "GET", "/store/o/"),
		"write out of scope":   req(testChannel, testToken, "DELETE", "/store/o/"+otherAccountKey),
		"list out of scope":    req(testChannel, testToken, "GET", "/store/list?prefix=apps/zz99/"),
		"unknown path":         req(testChannel, testToken, "GET", "/store/nope"),
		"wrong method":         req(testChannel, testToken, "POST", "/store/o/"+ownKey),
		// The two classes Task 2 deferred. The account manifest is the key a
		// tenant-enumeration probe would reach for FIRST (accounts/<sqid>/
		// account.json is the one object whose presence answers "does this
		// account exist"), and /store/dirs is the whole second listing route
		// — its refusals were never pinned to the same shape as /store/list's.
		"other account's manifest": req(testChannel, testToken, "GET", "/store/o/accounts/zz99/account.json"),
		"dirs out of scope":        req(testChannel, testToken, "GET", "/store/dirs?prefix=accounts/zz99/"),
		"dirs of another fleet":    req(testChannel, testToken, "GET", "/store/dirs?prefix=fleets/other/"),
		"dirs unauthenticated":     req(testChannel, "not-the-token", "GET", "/store/dirs?prefix=fleets/"),
	}
	type shape struct {
		code   int
		header string
		body   string
	}
	var want *shape
	var wantName string
	for name, r := range cases {
		w := httptest.NewRecorder()
		d.ServeHTTP(w, r)
		got := shape{w.Code, fmt.Sprintf("%v", w.Header()), w.Body.String()}
		if got.code != http.StatusNotFound {
			t.Errorf("%s: status = %d, want 404", name, got.code)
		}
		if strings.Contains(got.body, testToken) || strings.Contains(got.header, testToken) {
			t.Errorf("%s: response echoes the bearer token", name)
		}
		if want == nil {
			g := got
			want, wantName = &g, name
			continue
		}
		if got != *want {
			t.Errorf("%q answers %+v but %q answers %+v — the two refusals are distinguishable", name, got, wantName, *want)
		}
	}
}

// TestDoorNeverServesCertMaterial is the permanent tripwire for the
// multi-region ingress design's central promise (bucket-writer-audit.md):
// control/certs/**, control/edge-mesh-key and the housekeeper's own lease
// object are NOT in aclRead's allowlist (compare the doc comment above
// aclRead — control/serial, bootstrap/carlos, domains/, accounts/<sqid>/,
// apps/<sqid>/, fleets/<fleet>/, control/system/<c>/<ch>.json,
// bootstrap/router/<v>/<asset>, and nothing else), so no fleet box can ever
// read a private key, an ACME account key, a challenge token or the
// housekeeper's coordination lock through this door, however it authenticates.
//
// It runs as an AUTHENTICATED fleet client (own sqid/fleet, real bearer
// token) — an unauthenticated 404 would prove nothing about the ACL — across
// all three verbs the door exposes on a single object (GET/PUT/DELETE) plus
// both listing verbs, and it proves the refusal is byte-identical whether the
// key exists in the backing store or not: two of the seven keys below are
// seeded with plausible cert bytes before the loop runs, the rest are left
// absent, and every response — seeded or not — is folded into the same
// byte-identical comparison TestStoreDoorRefusalsAreByteIdentical uses, so an
// existence oracle on cert material would fail exactly the same way a status
// mismatch would.
func TestDoorNeverServesCertMaterial(t *testing.T) {
	d, store := newTestDoor(t)

	// The real Task 4/5 key shapes (certsync.go's certKey naming: bare host,
	// the autocert account key, an HTTP-01 token response, a tls-alpn-01
	// token cert, a wildcard account key) plus the four other control/
	// entries the multi-region design reserves for the housekeeper alone
	// (bucket-writer-audit.md, "Not yet built" table): the mesh key, its
	// rotation successor (Task 2's dual-accept — control/edge-mesh-key.next,
	// mirrored only while a rotation is in flight, but readable through this
	// door at every other time too and refused just as hard), and the
	// housekeeper's own election lock.
	certKeys := []string{
		"control/certs/example.com",
		"control/certs/acme_account+key",
		"control/certs/wildcard-account.key",
		"control/certs/tok+http-01",
		"control/certs/example.com+token",
		"control/edge-mesh-key",
		"control/edge-mesh-key.next",
		"control/housekeeper-lease/lock.json",
		// The cert warm's outcome records (#299 §3e, internal/certwarm).
		// They carry no key material, so the leak they would be is not the
		// same one as the entries above — it is the EXISTENCE oracle this
		// test's identical-shape check is really about. A door that answered
		// differently for a record that exists would let anyone with a fleet
		// token enumerate which of the deployment's custom domains are
		// currently failing to get a certificate, tenant boundary and all.
		"control/cert-warm/example.com.json",
	}
	// Seed three of the nine with plausible-looking secret bytes: if the ACL
	// ever let a Get through, these are the ones that would leak real
	// material instead of a "not found" — and mixing seeded with unseeded
	// keys through the identical-shape check below is what proves the door
	// isn't just refusing absent keys, it's refusing to distinguish "exists"
	// from "doesn't" at all for this whole prefix. The mesh key and its
	// rotation successor are seeded as a pair, same secret shape, since a
	// leak of either is the same failure.
	seedObject(t, store, "control/certs/example.com", "-----BEGIN CERTIFICATE-----\nfake\n-----END CERTIFICATE-----")
	seedObject(t, store, "control/edge-mesh-key", "fake-mesh-shared-secret")
	seedObject(t, store, "control/edge-mesh-key.next", "fake-mesh-shared-secret")

	type shape struct {
		code   int
		header string
		body   string
	}
	var want *shape
	var wantName string
	check := func(name string, w *httptest.ResponseRecorder) {
		t.Helper()
		if w.Code != http.StatusNotFound {
			t.Errorf("%s: status = %d, want 404 — cert material must never transit the door", name, w.Code)
			return
		}
		if strings.Contains(w.Body.String(), "BEGIN CERTIFICATE") || strings.Contains(w.Body.String(), "fake-mesh-shared-secret") {
			t.Errorf("%s: response body carries seeded secret bytes", name)
		}
		got := shape{w.Code, fmt.Sprintf("%v", w.Header()), w.Body.String()}
		if want == nil {
			g := got
			want, wantName = &g, name
			return
		}
		if got != *want {
			t.Errorf("%q answers %+v but %q answers %+v — cert refusal is distinguishable from an ordinary refusal (existence oracle)", name, got, wantName, *want)
		}
	}

	for _, key := range certKeys {
		check("GET "+key, doorDo(d, "GET", "/store/o/"+key, "", nil))
		check("DELETE "+key, doorDo(d, "DELETE", "/store/o/"+key, "", nil))
		check("PUT "+key, doorDo(d, "PUT", "/store/o/"+key, "x", map[string]string{"If-None-Match": "*"}))
	}
	// The listing verbs: a fleet box must never enumerate the cert prefix
	// either, whether asking for objects (list) or child directories (dirs).
	check("list prefix=control/certs/", doorDo(d, "GET", "/store/list?prefix=control/certs/", "", nil))
	check("dirs prefix=control/certs/", doorDo(d, "GET", "/store/dirs?prefix=control/certs/", "", nil))

	// The seeded keys must still be untouched in the backing store — a
	// refused DELETE that quietly deleted anyway would be worse than a
	// refused DELETE that didn't.
	if _, _, err := store.Get(context.Background(), "control/certs/example.com"); err != nil {
		t.Errorf("the refused DELETE removed control/certs/example.com anyway: %v", err)
	}
	if _, _, err := store.Get(context.Background(), "control/edge-mesh-key"); err != nil {
		t.Errorf("the refused DELETE removed control/edge-mesh-key anyway: %v", err)
	}
}

// TestStoreDoorListScopeStripsOtherTenants: a listing is the easiest place to
// leak a neighbour, so every listing route is checked against a store that
// holds another account's and another fleet's objects.
func TestStoreDoorListScopeStripsOtherTenants(t *testing.T) {
	d, store := newTestDoor(t)
	seedObject(t, store, ownKey, "{}")
	seedObject(t, store, "apps/"+testSqid+"/web/releases/v1/manifest.json", "{}")
	seedObject(t, store, otherAccountKey, "{}")
	seedObject(t, store, "accounts/"+testSqid+"/account.json", "{}")
	seedObject(t, store, "accounts/zz99/account.json", "{}")
	seedObject(t, store, ownFleetKey, "{}")
	seedObject(t, store, "fleets/other/status/boxes/box-a.json", "{}")

	list := func(target string) []string {
		t.Helper()
		w := doorDo(d, "GET", target, "", nil)
		if w.Code != http.StatusOK {
			t.Fatalf("GET %s = %d, want 200", target, w.Code)
		}
		var out []string
		if err := json.Unmarshal(w.Body.Bytes(), &out); err != nil {
			t.Fatalf("GET %s: decode %q: %v", target, w.Body.String(), err)
		}
		return out
	}
	for _, c := range []struct {
		target string
		want   []string
	}{
		{"/store/list?prefix=apps/", []string{ownKey, "apps/" + testSqid + "/web/releases/v1/manifest.json"}},
		{"/store/list?prefix=accounts/", []string{"accounts/" + testSqid + "/account.json"}},
		{"/store/list?prefix=fleets/", []string{ownFleetKey}},
		{"/store/list?prefix=apps/" + testSqid + "/web/releases/", []string{"apps/" + testSqid + "/web/releases/v1/manifest.json"}},
		{"/store/dirs?prefix=apps/", []string{"apps/" + testSqid + "/web/"}},
		{"/store/dirs?prefix=fleets/", []string{"fleets/" + testFleet + "/status/"}},
		// The regression that matters most on the dirs route: accounts/ is a
		// SHARED prefix, and ListDirs returns one child per account on the
		// platform. Filtering by "is it under the prefix we listed" is a
		// tautology there — the answer must be this tenant's own directory
		// and nothing else, with zz99 seeded above to prove it.
		{"/store/dirs?prefix=accounts/", []string{"accounts/" + testSqid + "/"}},
	} {
		got := list(c.target)
		if !slices.Equal(got, c.want) {
			t.Errorf("%s = %v, want %v", c.target, got, c.want)
		}
	}
	// An empty listing is [] on the wire, never null: the client decodes into
	// a []string either way, but null would invite a nil-vs-empty distinction
	// the Store contract does not have.
	w := doorDo(d, "GET", "/store/list?prefix=apps/"+testSqid+"/nosuchapp/", "", nil)
	if body := strings.TrimSpace(w.Body.String()); body != "[]" {
		t.Errorf("empty listing body = %q, want []", body)
	}
}

// doorOpCounter records how many store operations a request performed —
// enough to prove a refused request touches the bucket zero times.
type doorOpCounter struct {
	release.Store
	ops int
}

func (c *doorOpCounter) Get(ctx context.Context, key string) ([]byte, string, error) {
	c.ops++
	return c.Store.Get(ctx, key)
}

func (c *doorOpCounter) Put(ctx context.Context, key string, body []byte, ifMatch string) (string, error) {
	c.ops++
	return c.Store.Put(ctx, key, body, ifMatch)
}

func (c *doorOpCounter) List(ctx context.Context, prefix string) ([]string, error) {
	c.ops++
	return c.Store.List(ctx, prefix)
}

func (c *doorOpCounter) ListDirs(ctx context.Context, prefix string) ([]string, error) {
	c.ops++
	return c.Store.ListDirs(ctx, prefix)
}

func (c *doorOpCounter) Delete(ctx context.Context, key string) error {
	c.ops++
	return c.Store.Delete(ctx, key)
}

// TestStoreDoorAuthRunsExactlyOncePerRequest pins the invariant two ways: the
// handler contains exactly ONE call to VerifyDynamic (no path can skip it,
// none can pay for it twice — and the auth logic itself is never
// re-implemented here), and an unauthenticated request of any shape reaches
// the store zero times.
func TestStoreDoorAuthRunsExactlyOncePerRequest(t *testing.T) {
	fset := token.NewFileSet()
	f, err := parser.ParseFile(fset, "storedoor.go", nil, 0)
	if err != nil {
		t.Fatalf("parse storedoor.go: %v", err)
	}
	calls := 0
	ast.Inspect(f, func(n ast.Node) bool {
		call, ok := n.(*ast.CallExpr)
		if !ok {
			return true
		}
		if sel, ok := call.Fun.(*ast.SelectorExpr); ok && sel.Sel.Name == "VerifyDynamic" {
			calls++
		}
		return true
	})
	if calls != 1 {
		t.Errorf("storedoor.go calls VerifyDynamic %d times, want exactly 1 (one auth, one place)", calls)
	}

	d, _ := newTestDoor(t)
	counting := &doorOpCounter{Store: d.store}
	d.store = counting
	for _, r := range []*http.Request{
		doorReq("GET", "/store/o/"+ownKey, testChannel, "wrong", ""),
		doorReq("PUT", "/store/o/"+ownFleetKey, testChannel, "wrong", "x"),
		doorReq("DELETE", "/store/o/"+ownFleetKey, testChannel, "wrong", ""),
		doorReq("GET", "/store/list?prefix=apps/", testChannel, "wrong", ""),
		doorReq("GET", "/store/dirs?prefix=apps/", testChannel, "wrong", ""),
		doorReq("GET", "/store/o/"+ownKey, staticName, staticToken, ""),
		doorReq("GET", "/store/o/"+ownKey, "", "", ""),
	} {
		w := httptest.NewRecorder()
		d.ServeHTTP(w, r)
		if w.Code != http.StatusNotFound {
			t.Errorf("%s %s unauthenticated = %d, want 404", r.Method, r.URL, w.Code)
		}
	}
	if counting.ops != 0 {
		t.Errorf("unauthenticated requests performed %d store operation(s), want 0", counting.ops)
	}
}

// TestStoreDoorOnlyOnReservedHost drives the door through the EDGE, not
// directly: it must be unreachable on every host except the reserved tunnel
// hostname, exactly like tunnel registration — and it must not have swallowed
// /register on the way in.
func TestStoreDoorOnlyOnReservedHost(t *testing.T) {
	reg := openReg(t)
	if err := reg.UpsertFleet(registry.Fleet{Name: testFleet, Account: testSqid, Bucket: "pi-data"}); err != nil {
		t.Fatalf("UpsertFleet: %v", err)
	}
	if err := reg.AddFleetBox(registry.FleetBox{Fleet: testFleet, Label: "box-a", TokenHash: sha256Hex(testToken), Status: "active"}); err != nil {
		t.Fatalf("AddFleetBox: %v", err)
	}
	backend, _ := hostEchoBackend(t, "the app, not the door")
	if err := reg.Upsert(registry.Route{Host: "app.example", Kind: "service", Addr: backend.Listener.Addr().String(), Status: "ready"}); err != nil {
		t.Fatalf("upsert route: %v", err)
	}
	e, err := New(reg, nil)
	if err != nil {
		t.Fatalf("New: %v", err)
	}
	store := release.NewDirStore(t.TempDir())
	seedObject(t, store, "control/serial", "77")
	_, pubB64, err := release.GenerateKey()
	if err != nil {
		t.Fatal(err)
	}
	pub, err := release.ParsePublicKey(pubB64, "test")
	if err != nil {
		t.Fatal(err)
	}
	e.EnableStatic(store, pub, filepath.Join(t.TempDir(), "cache"))
	e.EnableTunnels(NewTunnelHub("tunnel.test", nil))
	if err := e.Reload(); err != nil {
		t.Fatalf("Reload: %v", err)
	}
	srv := httptest.NewServer(e)
	defer srv.Close()

	get := func(host, path string) (int, string) {
		t.Helper()
		req, err := http.NewRequest("GET", srv.URL+path, nil)
		if err != nil {
			t.Fatal(err)
		}
		req.Host = host
		req.Header.Set("Carlos-Tunnel-Name", testChannel)
		req.Header.Set("Authorization", "Bearer "+testToken)
		resp, err := http.DefaultClient.Do(req)
		if err != nil {
			t.Fatalf("GET %s (host %s): %v", path, host, err)
		}
		defer resp.Body.Close()
		b, _ := io.ReadAll(resp.Body)
		return resp.StatusCode, string(b)
	}
	if code, body := get("tunnel.test", "/store/o/control/serial"); code != http.StatusOK || body != "77" {
		t.Fatalf("on the reserved host: %d %q, want 200 \"77\"", code, body)
	}
	if code, body := get("app.example", "/store/o/control/serial"); code != http.StatusOK || body != "the app, not the door" {
		t.Fatalf("on a routed host: %d %q — the door answered on a host it must not serve", code, body)
	}
	if code, _ := get("nosuch.example", "/store/o/control/serial"); code == http.StatusOK {
		t.Fatal("the door answered on an unknown host")
	}
	// /register stays the hub's on the same hostname: no upgrade headers, so
	// a 400 (the hub's wire-contract refusal), never the door's 404.
	if code, _ := get("tunnel.test", "/register"); code != http.StatusBadRequest {
		t.Fatalf("/register on the reserved host = %d, want 400 (still the hub's)", code)
	}
}

// TestStoreDoorClaimsAreOwnAccountAndRedacted (#215): a fleet box used to be
// able to read every tenant's hostname claims — who made each one (a
// person's address), its account and app, its path map, and whether anyone
// had proved it. It now reads only its own account's verified claims,
// without created_by; every other claim body answers the door's
// byte-identical 404. The listing still names every claimed hostname.
func TestStoreDoorClaimsAreOwnAccountAndRedacted(t *testing.T) {
	d, store := newTestDoor(t)
	ctx := context.Background()
	put := func(c domains.Claim) {
		t.Helper()
		if _, _, _, err := domains.AttachClaimProven(ctx, store, c, time.Now(), func() bool { return !c.Pending }); err != nil {
			t.Fatal(err)
		}
	}
	put(domains.Claim{Host: "own.example.com", Account: testSqid, App: "web", Route: "web." + testSqid + ".oncarlos.com", CreatedBy: "paul@keymail.dev"})
	put(domains.Claim{Host: "pending.example.com", Account: testSqid, App: "web", Pending: true})
	put(domains.Claim{Host: "theirs.example.com", Account: "zz99", App: "shop", CreatedBy: "sam@keymail.dev"})

	w := doorDo(d, "GET", "/store/list?prefix=domains/", "", nil)
	// Every claimed NAME is listed, whoever holds it: the alias pass decides
	// "someone else claimed this" from the listing. Bodies are what is
	// withheld (below).
	if w.Code != http.StatusOK || strings.TrimSpace(w.Body.String()) !=
		`["domains/own.example.com.json","domains/pending.example.com.json","domains/theirs.example.com.json"]` {
		t.Fatalf("listing = %d %s, want every claimed hostname", w.Code, w.Body.String())
	}
	w = doorDo(d, "GET", "/store/o/domains/own.example.com.json", "", nil)
	if w.Code != http.StatusOK {
		t.Fatalf("own claim = %d", w.Code)
	}
	var c domains.Claim
	if err := json.Unmarshal(w.Body.Bytes(), &c); err != nil {
		t.Fatal(err)
	}
	if c.Host != "own.example.com" || c.Route == "" || c.CreatedBy != "" || strings.Contains(w.Body.String(), "keymail.dev") {
		t.Fatalf("own claim body = %s, want the claim without created_by", w.Body.String())
	}
	want := doorDo(d, "GET", "/store/o/domains/absent.example.com.json", "", nil)
	for _, key := range []string{"theirs.example.com", "pending.example.com"} {
		got := doorDo(d, "GET", "/store/o/domains/"+key+".json", "", nil)
		if got.Code != http.StatusNotFound || got.Body.String() != want.Body.String() || fmt.Sprint(got.Header()) != fmt.Sprint(want.Header()) {
			t.Errorf("%s = %d %q, want the same 404 an absent claim gets", key, got.Code, got.Body.String())
		}
	}
	if w := doorDo(d, "GET", "/store/dirs?prefix=domains/", "", nil); strings.TrimSpace(w.Body.String()) != "[]" {
		t.Errorf("dirs under domains/ = %s, want []", w.Body.String())
	}
}

// TestFleetBoxCanReadThePlansMarker: a fleet box reads the plans marker
// (plans 2) to learn whether to read limits at all; the same two-identity
// guard applies.
func TestFleetBoxCanReadThePlansMarker(t *testing.T) {
	key := plans.MarkerKey()
	if !aclRead(testSqid, testFleet, key) {
		t.Errorf("aclRead(%q, %q, %q) = false, want true", testSqid, testFleet, key)
	}
	if aclRead("", testFleet, key) || aclRead(testSqid, "", key) {
		t.Error("the plans marker was readable without both identities")
	}
}