package slidestest

import (
	"encoding/json"
	"io"
	"net/http"
	"net/http/httptest"
	"strconv"
	"strings"
	"testing"
)

// bearerRequest builds the request an agent's HTTP client makes: an
// Authorization header and nothing else.
//
// What it deliberately does NOT send is the point of most of this
// file: no cookie, no Origin, no Sec-Fetch-Site. A non-browser caller
// has none of those to send, so the API has to be reachable without
// them — and csrf.Protect refuses a POST carrying none of the three,
// which is why /api/v1 is mounted outside it (api.go says so at
// length).
func bearerRequest(t *testing.T, method, target, token, body string) *http.Request {
	t.Helper()
	var r io.Reader
	if body != "" {
		r = strings.NewReader(body)
	}
	req := httptest.NewRequest(method, target, r)
	if token != "" {
		req.Header.Set("Authorization", "Bearer "+token)
	}
	if body != "" {
		req.Header.Set("Content-Type", "application/json")
	}
	return req
}

// send runs one built request against the whole app.
func send(t *testing.T, a *testApp, req *http.Request) *httptest.ResponseRecorder {
	t.Helper()
	rec := httptest.NewRecorder()
	a.ServeHTTP(rec, req)
	return rec
}

// apiJSON makes one API call, insists on the status, and decodes the
// JSON body. Every API answer with a body is JSON, including every
// error, so one helper covers the whole surface.
func apiJSON(t *testing.T, a *testApp, method, target, token, body string, want int) map[string]any {
	t.Helper()
	rec := send(t, a, bearerRequest(t, method, target, token, body))
	if rec.Code != want {
		t.Fatalf("%s %s: status %d, want %d\n%s", method, target, rec.Code, want, rec.Body)
	}
	if ct := rec.Header().Get("Content-Type"); !strings.HasPrefix(ct, "application/json") {
		t.Fatalf("%s %s: Content-Type = %q, want application/json", method, target, ct)
	}
	var out map[string]any
	if err := json.Unmarshal(rec.Body.Bytes(), &out); err != nil {
		t.Fatalf("%s %s: body is not a JSON object: %v\n%s", method, target, err, rec.Body)
	}
	return out
}

// apiDeck creates a deck over the API and returns its sqid.
func apiDeck(t *testing.T, a *testApp, token, title string) string {
	t.Helper()
	out := apiJSON(t, a, http.MethodPost, "/api/v1/decks", token,
		`{"title":`+quote(title)+`}`, http.StatusCreated)
	sqid, _ := out["sqid"].(string)
	if len(sqid) != 10 {
		t.Fatalf("POST /api/v1/decks: sqid = %v, want ten characters", out["sqid"])
	}
	return sqid
}

// quote is a JSON string literal, for building request bodies.
func quote(s string) string {
	b, _ := json.Marshal(s)
	return string(b)
}

// TestApiNeverReadsCookie: the API is a bearer surface and only a
// bearer surface. A request carrying a perfectly good session cookie
// and no token is 401 — otherwise every page in a signed-in person's
// browser would be able to drive their decks cross-site.
func TestApiNeverReadsCookie(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)

	req := bearerRequest(t, http.MethodGet, "/api/v1/decks", "", "")
	for _, c := range cookies {
		req.AddCookie(c)
	}
	rec := send(t, a, req)
	if rec.Code != http.StatusUnauthorized {
		t.Fatalf("GET /api/v1/decks with a session cookie: status %d, want 401\n%s", rec.Code, rec.Body)
	}
	var out map[string]any
	if err := json.Unmarshal(rec.Body.Bytes(), &out); err != nil {
		t.Fatalf("the 401 body is not JSON: %v\n%s", err, rec.Body)
	}
	if out["error"] != "unauthorized" {
		t.Errorf("error = %v, want %q", out["error"], "unauthorized")
	}

	// The mirror of the same rule: an HTML route never reads a bearer.
	token := mintAgent(t, a, cookies, "claude")
	page := send(t, a, bearerRequest(t, http.MethodGet, "/", token, ""))
	if page.Code != http.StatusSeeOther {
		t.Errorf("GET / with a bearer and no cookie: status %d, want a redirect to sign-in", page.Code)
	}

	// A garbage bearer is the same 401 as none at all.
	bad := apiJSON(t, a, http.MethodGet, "/api/v1/decks", "sl_not-a-real-token", "", http.StatusUnauthorized)
	if bad["error"] != "unauthorized" {
		t.Errorf("a bad token: error = %v, want %q", bad["error"], "unauthorized")
	}
}

// TestApiCreateDeckRecordsAgentActor: a deck the API makes is the
// operator's, and every write it carries names the AGENT — never the
// person whose token it is holding.
func TestApiCreateDeckRecordsAgentActor(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)
	token := mintAgent(t, a, cookies, "claude")

	sqid := apiDeck(t, a, token, "Q3 review")

	var got struct {
		Actor   string
		OwnerID int64
	}
	err := a.db.G.Raw(`SELECT u.actor AS actor, d.owner_id AS owner_id
		FROM deck_updates u JOIN decks d ON d.id = u.deck_id
		WHERE d.sqid = ? ORDER BY u.seq DESC LIMIT 1`, sqid).Scan(&got).Error
	if err != nil {
		t.Fatalf("read deck_updates: %v", err)
	}
	var agentID int64
	if err := a.db.G.Raw("SELECT id FROM agents").Scan(&agentID).Error; err != nil {
		t.Fatalf("read agents: %v", err)
	}
	if want := "agent:" + strconv.FormatInt(agentID, 10); got.Actor != want {
		t.Errorf("deck_updates.actor = %q, want %q", got.Actor, want)
	}
	var operator int64
	if err := a.db.G.Raw("SELECT id FROM users WHERE email = ?", allowedAddress).Scan(&operator).Error; err != nil {
		t.Fatalf("read users: %v", err)
	}
	if got.OwnerID != operator {
		t.Errorf("decks.owner_id = %d, want the operator %d", got.OwnerID, operator)
	}

	// The deck the agent made is the operator's to open, and the row
	// says who last touched it: the robot mark plus the principal,
	// never a bare id.
	page := mustGet(t, a, "/", http.StatusOK, cookies).Body.String()
	if !strings.Contains(page, "Q3 review") {
		t.Fatalf("the deck the agent made is not in the operator's list:\n%s", page)
	}
	if want := "🤖 claude~" + allowedAddress; !strings.Contains(page, want) {
		t.Errorf("the deck list does not badge the agent's write with %q:\n%s", want, page)
	}
	// And the sample deck the operator's own sign-in seeded is badged
	// the other way — a person's address, with no robot mark. Matched
	// with the separator in front of it so this cannot pass on the
	// account menu, which shows the same address.
	if want := "· by " + allowedAddress; !strings.Contains(page, want) {
		t.Errorf("the deck list does not name the person behind a person's write with %q:\n%s", want, page)
	}
}

// TestApiOpsMintIdsAndReturnThem: an agent may leave the ids out, and
// the answer tells it what they were — otherwise it could never
// address the slide it just made.
func TestApiOpsMintIdsAndReturnThem(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)
	token := mintAgent(t, a, cookies, "claude")
	sqid := apiDeck(t, a, token, "Q3 review")

	before := apiJSON(t, a, http.MethodGet, "/api/v1/decks/"+sqid, token, "", http.StatusOK)

	out := apiJSON(t, a, http.MethodPost, "/api/v1/decks/"+sqid+"/ops", token, `{"ops":[
		{"op":"add_slide","layout":"flow","template":"section"},
		{"op":"set_meta","title":"Q3 review"}
	]}`, http.StatusOK)

	ids, ok := out["ids"].(map[string]any)
	if !ok {
		t.Fatalf("ops answered no ids map: %v", out)
	}
	slide, _ := ids["0"].(string)
	if len(slide) != 12 {
		t.Fatalf(`ids["0"] = %v, want a twelve-character slide id`, ids["0"])
	}
	if _, minted := ids["1"]; minted {
		t.Errorf("set_meta needs no id, but one was minted for it: %v", ids)
	}
	if out["seq"].(float64) <= before["seq"].(float64) {
		t.Errorf("seq did not move: %v then %v", before["seq"], out["seq"])
	}

	// The id it was handed is the id the document holds, so the next
	// op an agent sends can address the slide it just made.
	after := apiJSON(t, a, http.MethodGet, "/api/v1/decks/"+sqid, token, "", http.StatusOK)
	if !strings.Contains(mustJSON(t, after["slides"]), slide) {
		t.Errorf("the minted slide id %q is not in the deck:\n%s", slide, mustJSON(t, after["slides"]))
	}

	// And a block goes on it the same way.
	blockOut := apiJSON(t, a, http.MethodPost, "/api/v1/decks/"+sqid+"/ops", token,
		`{"ops":[{"op":"add_block","slide":`+quote(slide)+`,"type":"heading","region":"heading","markdown":"Revenue"}]}`,
		http.StatusOK)
	blockIDs, _ := blockOut["ids"].(map[string]any)
	block, _ := blockIDs["0"].(string)
	if len(block) != 12 {
		t.Fatalf("add_block minted no id: %v", blockOut)
	}

	// The rendered section is how an agent looks at what it made.
	html := send(t, a, bearerRequest(t, http.MethodGet,
		"/api/v1/decks/"+sqid+"/slides/"+slide+".html?vp=phone", token, ""))
	if html.Code != http.StatusOK {
		t.Fatalf("GET the slide html: status %d\n%s", html.Code, html.Body)
	}
	if ct := html.Header().Get("Content-Type"); !strings.HasPrefix(ct, "text/html") {
		t.Errorf("slide html Content-Type = %q, want text/html", ct)
	}
	body := html.Body.String()
	if !strings.HasPrefix(strings.TrimSpace(body), "<section") {
		t.Errorf("the slide endpoint answered a whole page rather than the section:\n%s", body)
	}
	if !strings.Contains(body, "Revenue") {
		t.Errorf("the rendered slide does not carry the block the agent added:\n%s", body)
	}
	if !strings.Contains(body, `data-vp="phone"`) {
		t.Errorf("?vp=phone did not reach the renderer:\n%s", body)
	}
}

// TestApiDuplicateSlideMintsEveryBlockId: duplicate_slide is the op
// that needs more than one id — a new slide id and exactly one new id
// per block being copied — and an agent should not have to count the
// blocks itself to use it.
func TestApiDuplicateSlideMintsEveryBlockId(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)
	token := mintAgent(t, a, cookies, "claude")
	sqid := apiDeck(t, a, token, "Q3 review")

	// The deck opens on one slide carrying one heading; add a second
	// block so the copy has two ids to mint rather than one.
	deck := apiJSON(t, a, http.MethodGet, "/api/v1/decks/"+sqid, token, "", http.StatusOK)
	slides, _ := deck["slides"].([]any)
	if len(slides) != 1 {
		t.Fatalf("a new deck has %d slides, want 1", len(slides))
	}
	first, _ := slides[0].(map[string]any)
	source, _ := first["id"].(string)

	apiJSON(t, a, http.MethodPost, "/api/v1/decks/"+sqid+"/ops", token,
		`{"ops":[{"op":"add_block","slide":`+quote(source)+`,"type":"text","region":"body","markdown":"Up 14%"}]}`,
		http.StatusOK)

	out := apiJSON(t, a, http.MethodPost, "/api/v1/decks/"+sqid+"/ops", token,
		`{"ops":[{"op":"duplicate_slide","id":`+quote(source)+`}]}`, http.StatusOK)
	ids, _ := out["ids"].(map[string]any)
	copyID, _ := ids["0"].(string)
	if len(copyID) != 12 {
		t.Fatalf("duplicate_slide minted no new slide id: %v", out)
	}

	after := apiJSON(t, a, http.MethodGet, "/api/v1/decks/"+sqid, token, "", http.StatusOK)
	list, _ := after["slides"].([]any)
	if len(list) != 2 {
		t.Fatalf("after duplicate_slide the deck has %d slides, want 2", len(list))
	}
	// The copy's blocks are new ids, not the originals: two slides
	// sharing a block id would be one block in two places.
	seen := map[string]bool{}
	for _, raw := range list {
		s, _ := raw.(map[string]any)
		blocks, _ := s["blocks"].([]any)
		if len(blocks) != 2 {
			t.Fatalf("slide %v has %d blocks, want 2", s["id"], len(blocks))
		}
		for _, b := range blocks {
			id, _ := b.(map[string]any)["id"].(string)
			if seen[id] {
				t.Errorf("block id %q appears on two slides", id)
			}
			seen[id] = true
		}
	}
}

// TestApiRejectedBatchAppliesNothing: the core refuses a batch as one
// thing, so a batch whose second op is wrong must leave the deck
// exactly as it was — including the good op in front of it.
func TestApiRejectedBatchAppliesNothing(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)
	token := mintAgent(t, a, cookies, "claude")
	sqid := apiDeck(t, a, token, "Q3 review")

	before := apiJSON(t, a, http.MethodGet, "/api/v1/decks/"+sqid, token, "", http.StatusOK)

	out := apiJSON(t, a, http.MethodPost, "/api/v1/decks/"+sqid+"/ops", token, `{"ops":[
		{"op":"add_slide","layout":"flow","template":"section"},
		{"op":"set_text","slide":"nosuchslide","id":"nosuchblock","markdown":"x"}
	]}`, http.StatusUnprocessableEntity)

	if out["error"] != "invalid" {
		t.Errorf("a refused batch: error = %v, want %q", out["error"], "invalid")
	}
	if op, ok := out["op"].(float64); !ok || op != 1 {
		t.Errorf("a refused batch: op = %v, want the index 1", out["op"])
	}
	if msg, _ := out["message"].(string); msg == "" {
		t.Errorf("a refused batch carries no message: %v", out)
	}

	after := apiJSON(t, a, http.MethodGet, "/api/v1/decks/"+sqid, token, "", http.StatusOK)
	if after["seq"] != before["seq"] {
		t.Errorf("a refused batch moved the seq: %v then %v", before["seq"], after["seq"])
	}
	if mustJSON(t, after["slides"]) != mustJSON(t, before["slides"]) {
		t.Errorf("a refused batch changed the slides:\n%s\n%s",
			mustJSON(t, before["slides"]), mustJSON(t, after["slides"]))
	}

	// An op the vocabulary has never heard of is the same answer.
	unknown := apiJSON(t, a, http.MethodPost, "/api/v1/decks/"+sqid+"/ops", token,
		`{"ops":[{"op":"delete_everything"}]}`, http.StatusUnprocessableEntity)
	if unknown["error"] != "invalid" {
		t.Errorf("an unknown op: error = %v, want %q", unknown["error"], "invalid")
	}
}

// TestApiGetHonoursEtag: the seq is the deck's version, so an agent
// that already has it can be told so instead of being handed the whole
// document again.
func TestApiGetHonoursEtag(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)
	token := mintAgent(t, a, cookies, "claude")
	sqid := apiDeck(t, a, token, "Q3 review")

	rec := send(t, a, bearerRequest(t, http.MethodGet, "/api/v1/decks/"+sqid, token, ""))
	if rec.Code != http.StatusOK {
		t.Fatalf("GET the deck: status %d\n%s", rec.Code, rec.Body)
	}
	etag := rec.Header().Get("ETag")
	if etag == "" || !strings.HasPrefix(etag, `"`) {
		t.Fatalf("GET the deck: ETag = %q, want a quoted seq", etag)
	}

	req := bearerRequest(t, http.MethodGet, "/api/v1/decks/"+sqid, token, "")
	req.Header.Set("If-None-Match", etag)
	cached := send(t, a, req)
	if cached.Code != http.StatusNotModified {
		t.Fatalf("If-None-Match with the current ETag: status %d, want 304\n%s", cached.Code, cached.Body)
	}
	if cached.Body.Len() != 0 {
		t.Errorf("a 304 carries a body: %s", cached.Body)
	}

	// One write later the same If-None-Match is stale and the whole
	// document comes back.
	apiJSON(t, a, http.MethodPost, "/api/v1/decks/"+sqid+"/ops", token,
		`{"ops":[{"op":"add_slide","layout":"flow","template":"section"}]}`, http.StatusOK)
	stale := send(t, a, req)
	if stale.Code != http.StatusOK {
		t.Errorf("If-None-Match with a stale ETag: status %d, want 200", stale.Code)
	}
	if stale.Header().Get("ETag") == etag {
		t.Errorf("the ETag did not move with the deck: still %q", etag)
	}
}

// TestApiListsWhatTheOperatorCanSee: the API's visibility is the
// operator's visibility, not a wider one — an agent is exactly as
// powerful as the person who minted it.
func TestApiListsWhatTheOperatorCanSee(t *testing.T) {
	a := newSharedApp(t)
	mine := signedIn(t, a, allowedAddress)
	theirs := signedIn(t, a, otherAddress)
	token := mintAgent(t, a, mine, "claude")

	hidden := createDeck(t, a, theirs, "Their private deck")
	apiDeck(t, a, token, "Q3 review")

	out := apiJSON(t, a, http.MethodGet, "/api/v1/decks", token, "", http.StatusOK)
	listed := mustJSON(t, out["decks"])
	if !strings.Contains(listed, "Q3 review") {
		t.Errorf("the list is missing the operator's own deck:\n%s", listed)
	}
	if strings.Contains(listed, "Their private deck") {
		t.Errorf("the list carries another person's private deck:\n%s", listed)
	}

	// And addressing it directly is a 404, never a 403: a deck that is
	// not yours does not exist (decks.go's visibleDecks).
	sqid := strings.TrimPrefix(hidden, "/d/")
	gone := apiJSON(t, a, http.MethodGet, "/api/v1/decks/"+sqid, token, "", http.StatusNotFound)
	if gone["error"] != "not_found" {
		t.Errorf("a deck the operator cannot see: error = %v, want %q", gone["error"], "not_found")
	}
}

// TestApiPresentStartsATalk: an agent can put a deck on a projector,
// and gets back the three addresses that reach the session.
func TestApiPresentStartsATalk(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)
	token := mintAgent(t, a, cookies, "claude")
	sqid := apiDeck(t, a, token, "Q3 review")

	out := apiJSON(t, a, http.MethodPost, "/api/v1/decks/"+sqid+"/present", token, "", http.StatusOK)
	session, _ := out["session"].(string)
	if len(session) != 10 {
		t.Fatalf("present: session = %v, want a sqid", out["session"])
	}
	for _, key := range []string{"present_url", "notes_url", "remote_url"} {
		got, _ := out[key].(string)
		if !strings.HasPrefix(got, testOrigin+"/") {
			t.Errorf("present: %s = %q, want an absolute URL on %s", key, got, testOrigin)
		}
	}
	if want := testOrigin + "/p/" + session; out["present_url"] != want {
		t.Errorf("present_url = %v, want %q", out["present_url"], want)
	}

	// The surface it named is live for somebody with no session at all
	// — which is the whole point of putting it on a projector.
	rec := get(t, a, "/p/"+session)
	if rec.Code != http.StatusOK {
		t.Errorf("the present URL an agent was handed: status %d, want 200", rec.Code)
	}

	// Pressing it again picks the same talk up rather than starting a
	// second one.
	twice := apiJSON(t, a, http.MethodPost, "/api/v1/decks/"+sqid+"/present", token, "", http.StatusOK)
	if twice["session"] != out["session"] {
		t.Errorf("presenting twice made a second session: %v then %v", out["session"], twice["session"])
	}
}

// TestApiRefusesBodiesItCannotRead: the three refusals a JSON surface
// owes a caller — the wrong media type, a body too big to be a deck
// edit, and JSON that is not what the endpoint takes.
func TestApiRefusesBodiesItCannotRead(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)
	token := mintAgent(t, a, cookies, "claude")
	sqid := apiDeck(t, a, token, "Q3 review")

	form := bearerRequest(t, http.MethodPost, "/api/v1/decks/"+sqid+"/ops", token, `{"ops":[]}`)
	form.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	if rec := send(t, a, form); rec.Code != http.StatusUnsupportedMediaType {
		t.Errorf("a form-encoded body: status %d, want 415\n%s", rec.Code, rec.Body)
	}

	huge := `{"ops":[{"op":"set_meta","title":"` + strings.Repeat("x", 1<<20) + `"}]}`
	if rec := send(t, a, bearerRequest(t, http.MethodPost, "/api/v1/decks/"+sqid+"/ops", token, huge)); rec.Code != http.StatusRequestEntityTooLarge {
		t.Errorf("a body over a mebibyte: status %d, want 413", rec.Code)
	}

	bad := apiJSON(t, a, http.MethodPost, "/api/v1/decks/"+sqid+"/ops", token, `{"ops":"nope"}`, http.StatusUnprocessableEntity)
	if bad["error"] != "invalid" {
		t.Errorf("ops that are not a list: error = %v, want %q", bad["error"], "invalid")
	}
	empty := apiJSON(t, a, http.MethodPost, "/api/v1/decks", token, `{"title":""}`, http.StatusUnprocessableEntity)
	if empty["error"] != "invalid" {
		t.Errorf("a deck with no title: error = %v, want %q", empty["error"], "invalid")
	}
	theme := apiJSON(t, a, http.MethodPost, "/api/v1/decks", token, `{"title":"x","theme":"neon"}`, http.StatusUnprocessableEntity)
	if theme["error"] != "invalid" {
		t.Errorf("a theme that is not one of the six: error = %v, want %q", theme["error"], "invalid")
	}

	// Two JSON values in one body is not one request with something
	// extra after it, it is a caller whose encoder is wrong or whose
	// batch got concatenated — and reading only the first one would
	// silently apply half of what was sent.
	trailing := apiJSON(t, a, http.MethodPost, "/api/v1/decks/"+sqid+"/ops", token,
		`{"ops":[{"op":"set_meta","title":"one"}]}{"ops":[{"op":"set_meta","title":"two"}]}`,
		http.StatusUnprocessableEntity)
	if trailing["error"] != "invalid" {
		t.Errorf("a body with bytes after the JSON value: error = %v, want %q", trailing["error"], "invalid")
	}
	// And it applied nothing: the second title is not the deck's, and
	// neither is the first.
	got := apiJSON(t, a, http.MethodGet, "/api/v1/decks/"+sqid, token, "", http.StatusOK)
	if s := mustJSON(t, got["meta"]); strings.Contains(s, `"one"`) || strings.Contains(s, `"two"`) {
		t.Errorf("a refused body changed the document: meta = %s", s)
	}

	// A trailing newline is not trailing bytes: every `curl -d @file`
	// sends one.
	apiJSON(t, a, http.MethodPost, "/api/v1/decks/"+sqid+"/ops", token,
		`{"ops":[{"op":"set_meta","title":"fine"}]}`+"\n", http.StatusOK)
}

// TestApiSetMetaUpdatesTheDeckRow: a title and a theme live in two
// places — the document everyone reads and the decks row a list, a
// link and the settings form read — and an agent's set_meta has to
// move both, exactly as the settings screen's own save does.
//
// It did not: apiOps applied the batch with no rowUpdates at all, so
// an agent could rename a deck and the deck list would go on showing
// the old name forever.
func TestApiSetMetaUpdatesTheDeckRow(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)
	token := mintAgent(t, a, cookies, "claude")
	sqid := apiDeck(t, a, token, "Working title")

	apiJSON(t, a, http.MethodPost, "/api/v1/decks/"+sqid+"/ops", token,
		`{"ops":[{"op":"set_meta","title":"The real title","theme":"forest"}]}`,
		http.StatusOK)

	list := apiJSON(t, a, http.MethodGet, "/api/v1/decks", token, "", http.StatusOK)
	decks, _ := list["decks"].([]any)
	var found map[string]any
	for _, row := range decks {
		if m, ok := row.(map[string]any); ok && m["sqid"] == sqid {
			found = m
		}
	}
	if found == nil {
		t.Fatalf("GET /api/v1/decks does not list %s:\n%s", sqid, mustJSON(t, list))
	}
	if found["title"] != "The real title" {
		t.Errorf("the deck list shows title %v, want %q", found["title"], "The real title")
	}

	// And the settings form pre-fills from the same row, so what a
	// person sees when they open it is what the agent wrote.
	page := mustGet(t, a, "/d/"+sqid+"/settings", http.StatusOK, cookies).Body.String()
	if !strings.Contains(page, `value="The real title"`) {
		t.Errorf("the settings form does not pre-fill the agent's title:\n%s", page)
	}
	if !strings.Contains(page, `<option value="forest" selected>`) {
		t.Errorf("the settings form does not pre-select the agent's theme:\n%s", page)
	}
}

// TestApiOpsConflictIs409: two writers landing at once is a 409 with
// the documented body, never a 500.
//
// The race is staged rather than run: the decks row is put one seq
// BEHIND its own update log, which is precisely the state a request
// holds when somebody else's batch landed between it reading the row
// and writing its own. Both of applyAgentOps' attempts re-read that
// row, so both lose, which is the case docs/api.md describes — and no
// goroutine and no sleep are involved, so the test cannot flake.
func TestApiOpsConflictIs409(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)
	token := mintAgent(t, a, cookies, "claude")
	sqid := apiDeck(t, a, token, "Contended")

	if err := a.db.G.Exec("UPDATE decks SET seq = seq - 1 WHERE sqid = ?", sqid).Error; err != nil {
		t.Fatalf("stage the lost race: %v", err)
	}

	out := apiJSON(t, a, http.MethodPost, "/api/v1/decks/"+sqid+"/ops", token,
		`{"ops":[{"op":"set_meta","title":"Mine"}]}`, http.StatusConflict)
	if out["error"] != "conflict" {
		t.Errorf("a lost race: error = %v, want %q", out["error"], "conflict")
	}
}

// mustJSON re-encodes a decoded fragment so a test can compare or
// search it as text.
func mustJSON(t *testing.T, v any) string {
	t.Helper()
	b, err := json.Marshal(v)
	if err != nil {
		t.Fatalf("re-encode: %v", err)
	}
	return string(b)
}