package callstest

import (
	"encoding/json"
	"net/http"
	"net/url"
	"regexp"
	"strconv"
	"strings"
	"testing"
	"time"
)

var sqidInPage = regexp.MustCompile(`/m/([23456789a-z]{10})`)

// Renamed from TestRoomPageIsScriptlessHonestAndStandingGated: the
// standing gate is not tested here and never was — fix round 1's
// Important 1 moved it to
// TestRoomAndTakeoverAreGatedByStandingOrParticipation, which has a real
// second meeting to check it against. What is left is what this test
// actually asserts.
func TestRoomPageRendersItsHeaderStandingAndScriptlessFallback(t *testing.T) {
	x, sqid, _ := memberWithMeeting(t)
	c := x.browser(t)
	c.signIn("paul@example.com")
	rec := c.get("/m/" + sqid)
	body := rec.Body.String()
	if rec.Code != http.StatusOK || !strings.Contains(body, "Board meeting") || !strings.Contains(body, `data-sqid="`+sqid+`"`) || !strings.Contains(body, "/m/"+sqid+"/join") {
		t.Fatalf("room page: %d\n%s", rec.Code, body)
	}
	if !strings.Contains(body, "<noscript>") || !strings.Contains(body, "needs JavaScript") {
		t.Fatal("room page lacks its scriptless paragraph")
	}
	// True before any participation exists: the room page renders
	// server-side, ahead of anything room.js does (Important 14).
	if !strings.Contains(body, "You’re in this call as paul.") {
		t.Fatalf("room page's own-standing sentence: %s", body)
	}
	// calls.css and room.js move into layout.html's new head block
	// (Important 15): both must appear in <head>, ahead of </head>,
	// not at the tail of the body content.
	headEnd := strings.Index(body, "</head>")
	// asset() fingerprints the filename (static/calls.<hash>.css), so the
	// literal "calls.css" never appears — match the stable prefix instead.
	css := strings.Index(body, "/static/calls.")
	if headEnd < 0 || css < 0 || css > headEnd {
		t.Fatalf("calls.css is not inside <head>: head ends at %d, calls.css at %d\n%s", headEnd, css, body)
	}
	// A member must be able to reach Share without JavaScript. The form
	// is rendered twice and never both at once: the control-row copy is
	// inside #room, which room.js un-hides, and the <noscript> copy is
	// the scriptless path. This asserts the first occurrence precedes
	// #room, so deleting the <noscript> copy and leaving only the
	// control-row one fails.
	//
	// Between c80a506 and a6c2ac8 only the control-row copy existed, so
	// a member action sat behind JavaScript while the <noscript>
	// paragraph went on promising "everything else on this page works
	// without it". AGENTS.md makes that floor load-bearing with two
	// named exceptions, and sharing is not one of them.
	//
	// Position, not presence, is what regressed: the form rendered in
	// both layouts, so every Contains-style assertion stayed green.
	// That is why this compares offsets.
	share := strings.Index(body, `action="/m/`+sqid+`/share"`)
	room := strings.Index(body, `<div id="room"`)
	if share < 0 || room < 0 || share > room {
		t.Fatalf("share form is not outside #room: share at %d, #room at %d\n%s", share, room, body)
	}

	// The no-standing case belongs to
	// TestRoomAndTakeoverAreGatedByStandingOrParticipation: this
	// harness's member allowlist refuses to even mail a magic link to
	// an address with no standing and no pending join, so a "stranger"
	// here can only be tested against a real second meeting a
	// signed-in outsider holds no grant for — a fresh, memberless
	// harness would let anyone sign in and a nonexistent meeting would
	// 404 regardless of standing, which is exactly the vacuous version
	// of this test fix round 1's Important 1 replaced.
}

// review C1-8's pattern (holding_test.go), applied to the room and
// takeover pages: a real second meeting the guest holds no grant for is
// the test that actually exercises standing being checked, not merely
// a meeting's absence answering 404 on its own (fix round 1,
// Important 1).
func TestRoomAndTakeoverAreGatedByStandingOrParticipation(t *testing.T) {
	x, first, tok := memberWithMeeting(t)
	member := x.browser(t)
	member.signIn("paul@example.com")
	second, _ := createMeeting(t, member, "A meeting they were not invited to", "")

	g := x.browser(t)
	g.get("/j/" + tok)
	g.signIn("guest@example.com")

	if rec := g.get("/m/" + second); rec.Code != http.StatusNotFound {
		t.Fatalf("room, a real meeting with no standing: %d", rec.Code)
	}
	if rec := g.get("/m/" + second + "/takeover"); rec.Code != http.StatusNotFound {
		t.Fatalf("takeover confirm, a real meeting with no standing: %d", rec.Code)
	}
	if rec := g.post("/m/"+second+"/takeover", nil); rec.Code != http.StatusNotFound {
		t.Fatalf("takeover POST, a real meeting with no standing: %d", rec.Code)
	}

	// The guest's own meeting, its grant now expired, and no
	// participation was ever opened for it: still 404.
	x.advance(2*time.Hour + time.Minute)
	if rec := g.get("/m/" + first); rec.Code != http.StatusNotFound {
		t.Fatalf("expired grant, no participation: %d", rec.Code)
	}
}

// The positive fallback for the same rule: an admitted guest survives
// its own grant expiring (ruling 14, hub.standingLostLocked), because
// the room page's authority is standing OR a live participation, and
// the participation does not end when only the guest's grant does.
func TestRoomPageSurvivesGrantExpiryForAnAdmittedGuest(t *testing.T) {
	x, sqid, tok := memberWithMeeting(t)
	m := x.browser(t)
	m.signIn("paul@example.com")
	sm := m.stream("/m/" + sqid + "/stream")
	defer sm.close()
	pm, _ := sm.hello()
	m.signal(sqid, pm, `{"type":"join"}`)

	g := x.browser(t)
	g.get("/j/" + tok)
	g.signIn("guest@example.com")
	sg := g.stream("/m/" + sqid + "/stream")
	defer sg.close()
	pg, _ := sg.hello()
	g.signal(sqid, pg, `{"type":"join"}`)
	m.signal(sqid, pm, `{"type":"admit","payload":{"peer":"`+pg+`"}}`)
	// The admission itself, proved rather than assumed: a guest still
	// only waiting would survive the expiry below on the waiting
	// participation alone, and the test would say nothing about ruling
	// 14. The roster is what admission sends and waiting never does.
	if ev, _, ok := sg.nextOf("roster", 2*time.Second); !ok {
		t.Fatalf("the guest was never admitted (got %q)", ev)
	}

	x.advance(2*time.Hour + time.Minute)
	if rec := g.get("/m/" + sqid); rec.Code != http.StatusOK {
		t.Fatalf("admitted guest past grant expiry: %d", rec.Code)
	}
}

// The other side of ruling 14, and Task 6's issue 6: roomAccess falls
// back to a live participation only where §2.4 makes the participation
// the authority, which is an admitted **guest**. A member who has lost
// the team is dropped by the next thing they do (§2.5), so their own
// participation is not a way to keep the page — relabelling it as a
// guest's would hand an ex-member the room for as long as the hub
// happened to still hold it.
func TestAnExMemberCannotKeepTheRoomThroughTheirOwnParticipation(t *testing.T) {
	x, sqid, _ := memberWithMeeting(t)
	a := x.browser(t)
	a.signIn("paul@example.com")
	sa := a.stream("/m/" + sqid + "/stream")
	defer sa.close()
	pa, _ := sa.hello()
	a.signal(sqid, pa, `{"type":"join"}`)

	b := newMemberBrowser(t, x, "paul@rslw.com")
	sb := b.stream("/m/" + sqid + "/stream")
	defer sb.close()
	pb, _ := sb.hello()
	if resp, _ := b.signal(sqid, pb, `{"type":"join"}`); resp.StatusCode != http.StatusOK {
		t.Fatalf("b's join: %d", resp.StatusCode)
	}
	if ev, _, ok := sb.nextOf("roster", 2*time.Second); !ok {
		t.Fatalf("b was never admitted (got %q)", ev)
	}
	for _, path := range []string{"/m/" + sqid, "/m/" + sqid + "/join"} {
		if rec := b.get(path); rec.Code != http.StatusOK {
			t.Fatalf("GET %s while on the team: %d", path, rec.Code)
		}
	}

	// Off the team, and deliberately no tick: the participation is still
	// there, still admitted, and still says member. Standing is the only
	// thing that has changed.
	x.ctl.SetAllowlist("paul@example.com")
	for _, path := range []string{"/m/" + sqid, "/m/" + sqid + "/join"} {
		if rec := b.get(path); rec.Code != http.StatusNotFound {
			t.Fatalf("GET %s after leaving the team: %d, want 404", path, rec.Code)
		}
	}
	// The member who is still on it is untouched.
	if rec := a.get("/m/" + sqid); rec.Code != http.StatusOK {
		t.Fatalf("the remaining member's room page: %d", rec.Code)
	}
}

// Task 6's issue 3, finished: the removal confirm page needs current
// member standing as well as the admitted member participation
// hub.PeerNameFor checks. PeerNameFor reads the kind the last tick
// wrote, so a member who has just left the team — and who still reaches
// the page through a guest grant of their own — would otherwise be
// offered a page whose POST hub.Remove refuses. Both refusals are the
// same 404, never a 403 (§2.5).
func TestTheRemovalConfirmPageNeedsFreshMemberStanding(t *testing.T) {
	x, sqid, tok := memberWithMeeting(t)
	a := x.browser(t)
	a.signIn("paul@example.com")
	sa := a.stream("/m/" + sqid + "/stream")
	defer sa.close()
	pa, _ := sa.hello()
	a.signal(sqid, pa, `{"type":"join"}`)

	b := newMemberBrowser(t, x, "paul@rslw.com")
	sb := b.stream("/m/" + sqid + "/stream")
	defer sb.close()
	pb, _ := sb.hello()
	b.signal(sqid, pb, `{"type":"join"}`)
	if ev, _, ok := sb.nextOf("roster", 2*time.Second); !ok {
		t.Fatalf("b was never admitted (got %q)", ev)
	}
	if rec := b.get("/m/" + sqid + "/remove/" + pa); rec.Code != http.StatusOK {
		t.Fatalf("confirm page for a member on the team: %d", rec.Code)
	}

	// Off the team, and then in through the front door as an outsider:
	// the link mints a guest grant, so roomAccess answers guest standing
	// while the hub still has the participation down as a member. That
	// gap is the one the standing check closes.
	x.ctl.SetAllowlist("paul@example.com")
	rec := b.get("/j/" + tok)
	if rec.Code != http.StatusSeeOther || rec.Header().Get("Location") != "/m/"+sqid+"/join" {
		t.Fatalf("the ex-member's walk through the join link: %d %s", rec.Code, rec.Header().Get("Location"))
	}
	if rec := b.get("/m/" + sqid + "/remove/" + pa); rec.Code != http.StatusNotFound {
		t.Fatalf("confirm page for an ex-member holding a guest grant: %d, want 404", rec.Code)
	}
	// And the POST agrees, which is the whole point: a page that offers
	// an action its own POST would refuse is a page that lies.
	if rec := b.post("/m/"+sqid+"/remove/"+pa, nil); rec.Code != http.StatusNotFound {
		t.Fatalf("POST remove for an ex-member holding a guest grant: %d, want 404", rec.Code)
	}

	// A plain guest, admitted and all, never gets the page either — not
	// even for a peer that really is in the room.
	g := x.browser(t)
	g.get("/j/" + tok)
	g.signIn("guest@example.com")
	sg := g.stream("/m/" + sqid + "/stream")
	defer sg.close()
	pg, _ := sg.hello()
	g.signal(sqid, pg, `{"type":"join"}`)
	a.signal(sqid, pa, `{"type":"admit","payload":{"peer":"`+pg+`"}}`)
	if ev, _, ok := sg.nextOf("roster", 2*time.Second); !ok {
		t.Fatalf("the guest was never admitted (got %q)", ev)
	}
	if rec := g.get("/m/" + sqid + "/remove/" + pa); rec.Code != http.StatusNotFound {
		t.Fatalf("confirm page for an admitted guest: %d, want 404", rec.Code)
	}
}

func TestRemoveNeedsAConfirmPageAndAnAdmittedMemberActor(t *testing.T) {
	x, sqid, tok := memberWithMeeting(t)
	m := x.browser(t)
	m.signIn("paul@example.com")
	sm := m.stream("/m/" + sqid + "/stream")
	defer sm.close()
	pm, _ := sm.hello()
	m.signal(sqid, pm, `{"type":"join"}`)
	g := x.browser(t)
	g.get("/j/" + tok)
	g.signIn("guest@example.com")
	sg := g.stream("/m/" + sqid + "/stream")
	defer sg.close()
	pg, _ := sg.hello()
	g.signal(sqid, pg, `{"type":"join"}`)

	// The confirm page names the person, derived from hub.PeerNameFor —
	// exactly Remove's own authority, read rather than acted on
	// (Important 2, Important 3) — not merely the meeting.
	rec := m.get("/m/" + sqid + "/remove/" + pg)
	if rec.Code != http.StatusOK || !strings.Contains(rec.Body.String(), "Remove") || !strings.Contains(rec.Body.String(), "guest") {
		t.Fatalf("confirm page: %d\n%s", rec.Code, rec.Body.String())
	}
	// Its back-nav names the meeting, not the generic "Meetings" list
	// this page's Cancel does not lead to (Important 9).
	if !strings.Contains(rec.Body.String(), "Board meeting") {
		t.Fatalf("confirm page back-nav: %s", rec.Body.String())
	}
	// Cancel and the back link both lead to the holding screen, where a
	// confirmed removal also lands (Important 11's other half). Never
	// /m/{sqid}: this page opens in its own tab while the call holds the
	// one behind it, and the room would open a second stream in this
	// one — a 409 and a takeover offer, for someone who pressed Cancel.
	if !strings.Contains(rec.Body.String(), `href="/m/`+sqid+`/join"`) {
		t.Fatalf("confirm page must lead back to the holding screen:\n%s", rec.Body.String())
	}
	if strings.Contains(rec.Body.String(), `href="/m/`+sqid+`"`) {
		t.Fatalf("confirm page still offers the room, which would open a second stream:\n%s", rec.Body.String())
	}
	// A peer that does not exist in the room at all must not render a
	// working confirm page: PeerNameFor answers nothing to remove.
	if rec := m.get("/m/" + sqid + "/remove/" + strings.Repeat("0", 32)); rec.Code != http.StatusNotFound {
		t.Fatalf("confirm page for an absent peer: %d", rec.Code)
	}
	// A path segment that is not the hub's own peer shape (32 lowercase
	// hex) is refused before it is ever looked up (Important 8), on
	// both the confirm page and the POST.
	if rec := m.get("/m/" + sqid + "/remove/not-a-peer-id"); rec.Code != http.StatusNotFound {
		t.Fatalf("malformed peer segment, confirm: %d", rec.Code)
	}
	if rec := m.post("/m/"+sqid+"/remove/not-a-peer-id", nil); rec.Code != http.StatusNotFound {
		t.Fatalf("malformed peer segment, POST: %d", rec.Code)
	}
	// A well-formed peer id that simply isn't in the room: hub.Remove's
	// ErrUnknownPeer, mapped to 404 by the sentinel check (Important 7),
	// not the 500 an unrecognised error would get.
	if rec := m.post("/m/"+sqid+"/remove/"+strings.Repeat("0", 32), nil); rec.Code != http.StatusNotFound {
		t.Fatalf("POST for an absent peer: %d", rec.Code)
	}
	if rec := g.post("/m/"+sqid+"/remove/"+pm, nil); rec.Code != http.StatusNotFound {
		t.Fatalf("waiting guest removing the member: %d", rec.Code)
	}
	// A successful removal lands on the holding screen, which opens no
	// stream of its own, not back on the room (Important 11).
	rec = m.post("/m/"+sqid+"/remove/"+pg, nil)
	if rec.Code != http.StatusSeeOther || rec.Header().Get("Location") != "/m/"+sqid+"/join" {
		t.Fatalf("member removing: %d %s", rec.Code, rec.Header().Get("Location"))
	}
	ev, data, ok := sg.nextOf("lost", 2*time.Second)
	if !ok || !strings.Contains(string(data), `"removed"`) {
		t.Fatalf("removed guest got %s %s", ev, data)
	}
}

func TestTakeoverIsAConfirmedPostAndAGetEndsNothing(t *testing.T) {
	x, sqid, _ := memberWithMeeting(t)
	m := x.browser(t)
	m.signIn("paul@example.com")
	s1 := m.stream("/m/" + sqid + "/stream")
	defer s1.close()
	p1, _ := s1.hello()
	m.signal(sqid, p1, `{"type":"join"}`)
	// A plain GET at the stream endpoint, EventSource's own Accept
	// header and all, must not let a query parameter perform a takeover:
	// the session already holds p1, so this is the ordinary
	// already-open conflict (stream.go, unmodified by this task), never
	// hub.Takeover. getStream, not get: this needs the Accept header
	// EventSource always sends (ruling 15) to reach that check at all.
	if rec := m.getStream("/m/" + sqid + "/stream?takeover=1"); rec.Code != http.StatusConflict {
		t.Fatalf("a GET with a query parameter must not take over: %d", rec.Code)
	}
	rec := m.get("/m/" + sqid + "/takeover")
	if rec.Code != http.StatusOK || !strings.Contains(rec.Body.String(), "another tab") {
		t.Fatalf("takeover confirm: %d", rec.Code)
	}
	// Its back-nav names the meeting too (Important 9).
	if !strings.Contains(rec.Body.String(), "Board meeting") {
		t.Fatalf("takeover confirm back-nav: %s", rec.Body.String())
	}
	req := httptestPost("/m/"+sqid+"/takeover", url.Values{})
	req.Header.Set("Origin", "https://evil.example")
	if rec := m.do(req); rec.Code != http.StatusForbidden {
		t.Fatalf("cross-origin takeover: %d", rec.Code)
	}
	if rec := m.post("/m/"+sqid+"/takeover", nil); rec.Code != http.StatusSeeOther {
		t.Fatalf("takeover: %d", rec.Code)
	}
	if ev, data, ok := s1.nextOf("lost", 2*time.Second); !ok || !strings.Contains(string(data), `"replaced"`) {
		t.Fatalf("old stream got %s %s", ev, data)
	}
	// getStream, not get, for the same reason as above: a resume is
	// only ever attempted by EventSource, and the Accept-header gate
	// (ruling 15) applies ahead of the resume branch too.
	if rec := m.getStream("/m/" + sqid + "/stream?peer=" + p1); rec.Code != http.StatusGone {
		t.Fatalf("resume of the replaced peer: %d, want 410", rec.Code)
	}
	s2 := m.stream("/m/" + sqid + "/stream")
	defer s2.close()
	if p2, _ := s2.hello(); p2 == "" || p2 == p1 {
		t.Fatalf("fresh stream after takeover: %q", p2)
	}
}

// A confirm page's premise — "this is open in another tab" — only
// holds when this session actually has a live participation to take
// over; asked with nothing to take over, it sends the caller straight
// to the holding screen instead (Important 4).
func TestTakeoverConfirmRedirectsWhenThereIsNothingToTakeOver(t *testing.T) {
	x, sqid, _ := memberWithMeeting(t)
	m := x.browser(t)
	m.signIn("paul@example.com")
	rec := m.get("/m/" + sqid + "/takeover")
	if rec.Code != http.StatusSeeOther || rec.Header().Get("Location") != "/m/"+sqid+"/join" {
		t.Fatalf("takeover confirm with nothing to take over: %d %s", rec.Code, rec.Header().Get("Location"))
	}
}

// Takeover needs standing, not merely a participation (spec §2.5) —
// unlike the room page's own authority, and unlike Remove's, both of
// which an admitted guest's expired grant survives (ruling 14).
// Important 5.
func TestTakeoverRequiresStandingNotJustParticipation(t *testing.T) {
	x, sqid, tok := memberWithMeeting(t)
	m := x.browser(t)
	m.signIn("paul@example.com")
	sm := m.stream("/m/" + sqid + "/stream")
	defer sm.close()
	pm, _ := sm.hello()
	m.signal(sqid, pm, `{"type":"join"}`)

	g := x.browser(t)
	g.get("/j/" + tok)
	g.signIn("guest@example.com")
	sg := g.stream("/m/" + sqid + "/stream")
	defer sg.close()
	pg, _ := sg.hello()
	g.signal(sqid, pg, `{"type":"join"}`)
	m.signal(sqid, pm, `{"type":"admit","payload":{"peer":"`+pg+`"}}`)
	// Admission proved, not assumed: the point of this test is what an
	// *admitted* guest may and may not do past the expiry.
	if ev, _, ok := sg.nextOf("roster", 2*time.Second); !ok {
		t.Fatalf("the guest was never admitted (got %q)", ev)
	}

	x.advance(2*time.Hour + time.Minute)
	if rec := g.get("/m/" + sqid); rec.Code != http.StatusOK {
		t.Fatalf("room page for the admitted guest: %d", rec.Code)
	}
	if rec := g.post("/m/"+sqid+"/takeover", nil); rec.Code != http.StatusNotFound {
		t.Fatalf("takeover past grant expiry: %d", rec.Code)
	}
}

func TestEndingTheMeetingEndsTheRoom(t *testing.T) {
	x, sqid, _ := memberWithMeeting(t)
	m := x.browser(t)
	m.signIn("paul@example.com")
	s := m.stream("/m/" + sqid + "/stream")
	defer s.close()
	p, _ := s.hello()
	m.signal(sqid, p, `{"type":"join"}`)
	m.post("/meetings/"+sqid+"/end", nil)
	if ev, data, ok := s.nextOf("lost", 2*time.Second); !ok || !strings.Contains(string(data), `"ended"`) {
		t.Fatalf("got %s %s", ev, data)
	}
	if rec := m.get("/m/" + sqid); rec.Code != http.StatusNotFound {
		t.Fatalf("room page after end: %d", rec.Code)
	}
}

// room.js is what makes the room a call, and it loads from layout's
// head block for the same reason calls.css does (Important 15): the
// page's CSP is default-src 'self', so nothing about the call may be
// inline. The scriptless floor rests on #room being rendered hidden —
// a browser with no script sees the noscript paragraph and the link
// back to the holding screen, never an empty grid and three dead
// buttons — so both facts are asserted together.
func TestRoomPageLoadsRoomScriptFromTheHeadAndHidesTheRoom(t *testing.T) {
	x, sqid, _ := memberWithMeeting(t)
	c := x.browser(t)
	c.signIn("paul@example.com")
	body := c.get("/m/" + sqid).Body.String()

	headEnd := strings.Index(body, "</head>")
	// asset() fingerprints the filename (static/room.<hash>.js), so the
	// literal "room.js" never appears — match the stable prefix.
	script := strings.Index(body, "/static/room.")
	if headEnd < 0 || script < 0 || script > headEnd {
		t.Fatalf("room.js is not inside <head>: head ends at %d, room.js at %d\n%s", headEnd, script, body)
	}
	if !strings.Contains(body[:headEnd], "<script defer src=") {
		t.Fatalf("room.js must stay deferred in the head block:\n%s", body[:headEnd])
	}

	open := strings.Index(body, "<div id=\"room\"")
	if open < 0 {
		t.Fatalf("no #room element:\n%s", body)
	}
	end := strings.Index(body[open:], ">")
	if end < 0 || !strings.Contains(body[open:open+end], " hidden") {
		t.Fatalf("#room must be rendered hidden for the scriptless floor: %q", body[open:open+end])
	}

	// The room's own toggles follow the holding screen's shape: a fixed
	// accessible name in aria-label, the state in aria-pressed and in a
	// word room.js rewrites, never in colour alone.
	for _, want := range []string{
		`id="mute" rst-btn aria-label="Microphone" aria-pressed="false"`,
		`<span id="mute-state" class="calls-toggle-state" aria-hidden="true">On</span>`,
		`id="camera" rst-btn aria-label="Camera" aria-pressed="false"`,
		`<span id="camera-state" class="calls-toggle-state" aria-hidden="true">On</span>`,
	} {
		if !strings.Contains(body, want) {
			t.Fatalf("room page's toggles: missing %q\n%s", want, body)
		}
	}
}

// The chat panel is estilo's first chat (§6, §10): one self-contained
// partial and one script, so a second app can adopt both files
// unchanged. Calls' job here is only to mount it — inside #room, after
// the controls and before the admission queue — and to load its two
// files the way every other room asset loads, from layout's head block
// with defer, because the page's CSP is default-src 'self' and nothing
// about the call may be inline.
//
// The panel renders hidden for the same reason #room does: a browser
// with no script sees the noscript paragraph, never a dead form whose
// Send button does nothing. room.js un-hides #room, and the panel with
// it, on admission.
func TestRoomPageMountsTheChatPanelHiddenWithItsScriptInTheHead(t *testing.T) {
	x, sqid, _ := memberWithMeeting(t)
	c := x.browser(t)
	c.signIn("paul@example.com")
	body := c.get("/m/" + sqid).Body.String()

	headEnd := strings.Index(body, "</head>")
	if headEnd < 0 {
		t.Fatalf("no </head> in the room page:\n%s", body)
	}
	head := body[:headEnd]
	// asset() fingerprints the filename (static/chat.<hash>.js), so the
	// literal "chat.js" never appears — match the stable prefix.
	if !strings.Contains(head, `<script defer src="/static/chat.`) {
		t.Fatalf("chat.js must load deferred from the head block:\n%s", head)
	}
	if !strings.Contains(head, `<link rel="stylesheet" href="/static/chat.`) {
		t.Fatalf("chat.css must load from the head block:\n%s", head)
	}
	// Two deferred scripts run in document order, and room.js mounts the
	// panel through window.Chat — which chat.js has to have defined by
	// then. Swapping these two lines breaks the room in a way no unit
	// test would otherwise notice.
	chatJS := strings.Index(head, `<script defer src="/static/chat.`)
	roomJS := strings.Index(head, `<script defer src="/static/room.`)
	if roomJS < 0 {
		t.Fatalf("room.js is not in the head block any more:\n%s", head)
	}
	if chatJS > roomJS {
		t.Fatalf("chat.js must be loaded before room.js: chat.js at %d, room.js at %d\n%s", chatJS, roomJS, head)
	}

	panel := strings.Index(body, `<section id="chat"`)
	if panel < 0 {
		t.Fatalf("no chat panel on the room page:\n%s", body)
	}
	end := strings.Index(body[panel:], ">")
	if end < 0 || !strings.Contains(body[panel:panel+end], " hidden") {
		t.Fatalf("the chat panel must render hidden for the scriptless floor: %q", body[panel:panel+end])
	}
	if !strings.Contains(body[panel:panel+end], " data-chat") {
		t.Fatalf("the chat panel needs its data-chat mount point: %q", body[panel:panel+end])
	}

	// Since the call window (2026-09-28) the admission queue is one of
	// the notices under the title, ahead of the stage, and chat is a
	// sidebar after the bar; both are still inside #room, which is what
	// makes them script-only.
	room := strings.Index(body, `<div id="room"`)
	controls := strings.Index(body, `id="controls"`)
	queue := strings.Index(body, `id="queue"`)
	if room < 0 || controls < 0 || queue < 0 {
		t.Fatalf("room page shape changed: room %d controls %d queue %d", room, controls, queue)
	}
	if room > queue || room > controls || controls > panel {
		t.Fatalf("the queue and the panel belong inside #room, the panel after the controls: room %d controls %d chat %d queue %d", room, controls, panel, queue)
	}

	// The form's own shape: one labelled control, the browser's own
	// courtesy cap at §4.4's 2 KB, a polite live region for arrivals and
	// a status line for the two sentences the panel can say.
	//
	// aria-describedby is asserted whole rather than by attribute name:
	// it is the wiring that makes the status line part of the field for
	// a screen reader instead of a paragraph that happens to be nearby,
	// and it is the one attribute here that a person editing the markup
	// would not miss the loss of by looking at the screen.
	for _, want := range []string{
		`<ol id="chat-log" class="chat-log" data-chat-log aria-live="polite" aria-relevant="additions"></ol>`,
		`<label for="chat-text"`,
		`id="chat-text"`,
		`maxlength="2048"`,
		`aria-describedby="chat-status"`,
		`<button type="submit" id="chat-send"`,
		`<p id="chat-status" class="chat-status" data-chat-status role="status"></p>`,
	} {
		if !strings.Contains(body, want) {
			t.Fatalf("chat panel: missing %q\n%s", want, body[panel:])
		}
	}

	// And no `required`, which is a decision rather than an omission —
	// see the note in partials/chat.html. This form never reaches a
	// server, so the attribute would buy only the browser's own
	// validation bubble on an empty click of Send: a sentence nobody
	// here wrote, that the copy list cannot catalogue, and that Enter
	// could not raise anyway. Without it both ways of sending an empty
	// box do the same nothing.
	field := strings.Index(body[panel:], "<textarea")
	if field < 0 {
		t.Fatalf("no textarea in the chat panel:\n%s", body[panel:])
	}
	tag := body[panel+field:]
	tag = tag[:strings.Index(tag, ">")]
	if strings.Contains(tag, " required") {
		t.Fatalf("the message box must not be `required`: an empty Send would raise a browser validation bubble that Enter cannot, and that this app's copy list does not own: %q", tag)
	}
}

func TestNativeRoomInfoUsesRoomAuthority(t *testing.T) {
	x, room, token := memberWithMeeting(t)
	member := x.browser(t)
	member.signIn("paul@example.com")
	other, _ := createMeeting(t, member, "Private title", "")
	guest := x.browser(t)
	guest.get("/j/" + token)
	guest.signIn("guest@example.com")
	res := guest.get("/m/" + room + "/info")
	var info struct {
		Title    string
		Standing string
		Floor    bool
	}
	if res.Code != 200 || json.Unmarshal(res.Body.Bytes(), &info) != nil || info.Title != "Board meeting" || info.Standing != "guest" {
		t.Fatalf("metadata: %d %+v", res.Code, info)
	}
	if res.Header().Get("Cache-Control") != "no-store" {
		t.Fatal("metadata may be cached")
	}
	res = guest.get("/m/" + other + "/info")
	if res.Code != 404 || strings.Contains(res.Body.String(), "Private title") {
		t.Fatal("metadata leaked another meeting")
	}
}

// The room's device panel (mid-call switching). The server renders it
// closed and renders the button that opens it hidden: room.js reveals
// the button only in a browser that can enumerate devices, so a
// scriptless page — and a browser with no enumeration — shows neither a
// panel nor a control that would do nothing. The panel reuses the
// holding screen's ids on purpose, because the two fill routines are
// mirrors of each other and test/browser/devices.test.mjs holds them to
// it; asserting them here is what stops a rename on one page from
// quietly unwiring the other.
func TestRoomRendersItsDevicePanelClosed(t *testing.T) {
	x, sqid, _ := memberWithMeeting(t)
	c := x.browser(t)
	c.signIn("paul@example.com")
	body := c.get("/m/" + sqid).Body.String()
	for _, want := range []string{
		`<button type="button" id="devices-toggle" rst-btn aria-expanded="false" aria-controls="room-devices" hidden aria-label="Devices"`,
		`<div id="room-devices" class="calls-pickers calls-popover calls-devices" role="group" aria-label="Devices" hidden>`,
		`id="pick-camera"`,
		`id="pick-mic"`,
		`id="pick-speaker"`,
		`id="device-note"`,
	} {
		if !strings.Contains(body, want) {
			t.Fatalf("room page lacks %q for the device panel: %s", want, body)
		}
	}
}

// The device panel's own live region is not #status. renderStatus owns
// #status and rewrites it on every roster, so a sentence about a camera
// that would not open would be gone within the tick — which is exactly
// the moment someone is reading it.
func TestRoomDeviceNoteIsNotTheStatusLine(t *testing.T) {
	x, sqid, _ := memberWithMeeting(t)
	c := x.browser(t)
	c.signIn("paul@example.com")
	body := c.get("/m/" + sqid).Body.String()
	note := strings.Index(body, `id="device-note"`)
	status := strings.Index(body, `id="status"`)
	if note < 0 || status < 0 {
		t.Fatalf("room page is missing one of the two regions: note=%d status=%d", note, status)
	}
	if note == status {
		t.Fatal("the device note and the status line are the same element")
	}
}

// The unread-chat live region (the accessibility half of collapsing the
// chat panel). Collapsing sets display:none on #chat, which takes its
// aria-live log out of the accessibility tree, so a message arriving
// while chat is closed announced nothing: the badge is aria-hidden, a
// changed aria-label does not announce, and the log was gone. This
// region is the one thing that survives the collapse, so what matters
// in the markup is that the server renders it OUTSIDE #chat.
func TestRoomAnnouncesUnreadChatOutsideTheCollapsingPanel(t *testing.T) {
	x, sqid, _ := memberWithMeeting(t)
	c := x.browser(t)
	c.signIn("paul@example.com")
	body := c.get("/m/" + sqid).Body.String()
	live := strings.Index(body, `id="chat-unread-live"`)
	if live < 0 {
		t.Fatalf("room page has no unread live region: %s", body)
	}
	for _, want := range []string{`role="status"`, `aria-live="polite"`, `class="calls-sr-only"`} {
		if !strings.Contains(body[live-200:live+200], want) {
			t.Fatalf("the unread live region lacks %q: %s", want, body[live-200:live+200])
		}
	}
	// Outside the panel, not merely present. A region inside #chat would
	// be display:none'd with it and announce nothing, which is the whole
	// defect.
	panel := strings.Index(body, `<section id="chat"`)
	if panel >= 0 && live > panel {
		t.Fatal("the unread live region renders inside #chat, where collapsing hides it")
	}
}

// The call window (2026-09-28): the room replaces the page shell with
// one rounded window, so what the shell carried has to be somewhere a
// scriptless browser can still reach. Since 2026-10-02 there is no
// title pill and no ☰ menu: the header is the title, and — inside
// <noscript>, so it is the scriptless page's and nobody else's — the
// standing line, the floor notice and the navigation (Meetings,
// Settings, Help, Sign out). With script the same navigation is in the
// bar's More menu, inside #room, with End meeting for everyone last; and
// with no script that is in the scriptless block beside the Share form.
func TestRoomIsOneWindowWhoseNavigationWorksWithoutScript(t *testing.T) {
	x, sqid, _ := memberWithMeeting(t)
	c := x.browser(t)
	c.signIn("paul@example.com")
	body := c.get("/m/" + sqid).Body.String()

	win := strings.Index(body, `<main id="main" class="calls-window"`)
	room := strings.Index(body, `<div id="room"`)
	if win < 0 || room < win {
		t.Fatalf("the room is not inside the call window: window %d, #room %d\n%s", win, room, body)
	}
	if strings.Contains(body, "rst-shell-topbar") {
		t.Fatal("the room still renders the page shell's header")
	}
	for _, gone := range []string{`id="call-nav"`, `id="call-state"`, "calls-nav-menu"} {
		if strings.Contains(body, gone) {
			t.Fatalf("the title pill's %s is still there", gone)
		}
	}
	header := body[strings.Index(body, `<header id="call-top"`):strings.Index(body, `</header>`)]
	if !strings.Contains(header, `<h1 id="call-title">Board meeting</h1>`) {
		t.Fatalf("the header must carry the title:\n%s", header)
	}
	ns := strings.Index(header, "<noscript>")
	if ns < 0 {
		t.Fatalf("the header has no scriptless part:\n%s", header)
	}
	for _, want := range []string{"You’re in this call as paul.", "Calls outside your network may not connect yet.", `href="/">Meetings</a>`, `href="/settings">Settings</a>`, `href="/help/open-source"`, `<form method="post" action="/signout"><button type="submit">Sign out</button></form>`} {
		if !strings.Contains(header[ns:], want) {
			t.Fatalf("with no script the header lacks %q:\n%s", want, header[ns:])
		}
		if strings.Contains(header[:ns], want) {
			t.Fatalf("with script the header is only the title, but it has %q", want)
		}
	}
	sns := strings.Index(body, `<noscript><div class="calls-scriptless">`)
	nsEnd := sns + strings.Index(body[max(sns, 0):], "</noscript>")
	if sns < win || nsEnd < sns || nsEnd > room {
		t.Fatalf("the scriptless block belongs in the window, before #room: %d..%d, room %d", sns, nsEnd, room)
	}
	if !strings.Contains(body[sns:nsEnd], `href="/meetings/`+sqid+`/end"`) {
		t.Fatalf("with no script, End the meeting must still be reachable:\n%s", body[sns:nsEnd])
	}
	// With script it is all in the bar's More menu: the standing line
	// first, then the account menu's items, End meeting for everyone
	// last — still a link to its own confirm page, never a button that
	// ends it.
	more := strings.Index(body, `<div id="call-more"`)
	if more < room {
		t.Fatal("the bar's More menu must be inside #room")
	}
	menu := body[more : more+strings.Index(body[more:], "</div>")]
	order := []string{`<p class="calls-menu-standing">You’re in this call as paul.`, `href="/">Meetings</a>`, `href="/settings">Settings</a>`, `href="/help/open-source"`, `action="/signout"`, `<a href="/meetings/` + sqid + `/end" target="_blank"`}
	at := 0
	for _, want := range order {
		i := strings.Index(menu[at:], want)
		if i < 0 {
			t.Fatalf("the More menu lacks %q after position %d:\n%s", want, at, menu)
		}
		at += i
	}
	if !strings.Contains(body, `id="call-more-toggle"`) {
		t.Fatal("the bar has no More button")
	}
}

// A guest's room has no member actions anywhere: no Meetings list, no
// Settings, no Share link and no way to end the meeting, in the More
// menu, the bar or the scriptless block. More itself is there: it is
// where a guest's Help and Sign out are.
func TestGuestRoomWindowCarriesNoMemberActions(t *testing.T) {
	x, sqid, token := memberWithMeeting(t)
	guest := x.browser(t)
	guest.get("/j/" + token)
	guest.signIn("guest@example.com")
	rec := guest.get("/m/" + sqid)
	body := rec.Body.String()
	if rec.Code != http.StatusOK || !strings.Contains(body, ", a guest.") {
		t.Fatalf("guest room: %d\n%s", rec.Code, body)
	}
	for _, not := range []string{`href="/">Meetings</a>`, `href="/settings"`, `/end"`, `action="/m/` + sqid + `/share"`} {
		if strings.Contains(body, not) {
			t.Fatalf("a guest's room carries %q", not)
		}
	}
	more := strings.Index(body, `<div id="call-more"`)
	if more < 0 || !strings.Contains(body[more:], `action="/signout"`) || !strings.Contains(body[more:], `href="/help/open-source"`) {
		t.Fatal("a guest keeps Help and Sign out in the More menu")
	}
}

// The title (2026-10-02): a title someone chose is the window's title,
// centred in the strip at the top (calls-top-named); a title Calls
// wrote is the page's heading and its <title>, and nothing on screen.
// The apps read the same fact from /info's "named".
func TestRoomShowsAChosenTitleAndLeavesAnAutomaticOneOff(t *testing.T) {
	x, named, _ := memberWithMeeting(t)
	c := x.browser(t)
	c.signIn("paul@example.com")
	rec := c.post("/meetings/start", nil)
	auto := sqidInPage.FindStringSubmatch(rec.Body.String())
	if auto == nil {
		t.Fatalf("no meeting on the started call's page:\n%s", rec.Body.String())
	}
	for _, tc := range []struct {
		sqid  string
		named bool
	}{{named, true}, {auto[1], false}} {
		body := c.get("/m/" + tc.sqid).Body.String()
		start := strings.Index(body, `<header id="call-top"`)
		header := body[start : start+strings.Index(body[start:], ">")+1]
		if got := strings.Contains(header, "calls-top-named"); got != tc.named {
			t.Errorf("%s: header %q, named %v", tc.sqid, header, tc.named)
		}
		if !strings.Contains(body, `<h1 id="call-title">`) || !strings.Contains(body, "<title>") {
			t.Errorf("%s: the title is still the heading and the <title>", tc.sqid)
		}
		info := c.get("/m/" + tc.sqid + "/info").Body.String()
		if want := `"named":` + strconv.FormatBool(tc.named); !strings.Contains(info, want) {
			t.Errorf("%s: info %s lacks %s", tc.sqid, info, want)
		}
	}
	if body := c.get("/m/" + auto[1]).Body.String(); strings.Contains(body, " UTC</") {
		t.Error("an automatic title names its zone")
	}
}