package slidestest

// Who may read or write what, asked of the six holes the GPT-6 (codex)
// review of 2026-09-08 found in it. Each test names the finding it
// pins, and each one failed before the fix in the same commit.
//
// They live together rather than beside their subjects because they are
// one subject: a capability in this app is supposed to be a thing you
// were given, not a string you can name. Every finding here was a place
// where naming was enough.

import (
	"bufio"
	"bytes"
	"context"
	"fmt"
	"net/http"
	"net/http/httptest"
	"net/url"
	"regexp"
	"strings"
	"testing"
	"time"

	"amadan.net/rastrillo/rastrillo/db"

	slides "amadan.net/oficina/slides/internal/slides"
)

// --- codex 1: an uploaded asset stops being writable once it is verified ---

// TestVerifiedAssetCannotBeOverwritten is the finding itself: a member
// asked for a PUT URL naming an address that was already registered and
// verified, and the store signed an unconditional PUT for it — so
// replacement bytes changed what every surface served, in this deck and
// in any other holding the same ref, with no document update anywhere.
//
// Two halves, because the two stores take different code: the
// development PUT comes through this app, and a real bucket's does not.
func TestVerifiedAssetCannotBeOverwritten(t *testing.T) {
	a := newAppWithStore(t, dirStore(t))
	cookies := signedIn(t, a, allowedAddress)
	token := mintAgent(t, a, cookies, "claude")
	sqid := apiDeck(t, a, token, "Immutable")
	deck := "/d/" + sqid

	record := upload(t, a, deck, cookies, "chart.png", "image/png", onePixelPNG, "A chart")
	registerInDeck(t, a, token, sqid, record)
	ref := record["ref"].(string)
	mustGet(t, a, deck+"/assets/"+ref, http.StatusOK, cookies)

	// Asking for a URL to the verified address does not get one: what
	// comes back is a staging address of the app's own, and it is not
	// the ref.
	signed := postJSON(t, a, deck+"/uploads",
		fmt.Sprintf(`{"name":"chart.png","size":%d,"type":"image/png","hash":%q}`, len(onePixelPNG), ref), cookies)
	if signed.Code != http.StatusOK {
		t.Fatalf("sign: status %d\n%s", signed.Code, signed.Body)
	}
	if got, _ := jsonBody(t, signed)["ref"].(string); got == ref {
		t.Fatalf("signing answered the verified address %s", ref)
	}

	// And the PUT this app receives in development refuses an address
	// no receipt of its own covers, which the verified one never can be.
	evil := []byte("\x89PNG\r\n\x1a\nnot the chart you registered")
	if rec := putBytes(t, a, deck+"/uploads/"+ref, "image/png", evil, cookies); rec.Code != http.StatusNotFound {
		t.Errorf("PUT to a verified address: status %d, want 404\n%s", rec.Code, rec.Body)
	}

	// The picture is still the picture.
	rec := mustGet(t, a, deck+"/assets/"+ref, http.StatusOK, cookies)
	if !bytes.Equal(rec.Body.Bytes(), onePixelPNG) {
		t.Errorf("the verified asset changed under it: %d bytes, want the %d that went up",
			rec.Body.Len(), len(onePixelPNG))
	}
}

// TestStagingAddressIsNeverTheClientsChoice: two signings of the same
// file get two different addresses, and neither is the content hash the
// browser sent. That is what makes "an address a browser can name is an
// address a browser can overwrite" stop being a sentence about this app.
func TestStagingAddressIsNeverTheClientsChoice(t *testing.T) {
	a := newAppWithStore(t, dirStore(t))
	cookies := signedIn(t, a, allowedAddress)
	deck := createDeck(t, a, cookies, "Staging")
	hash := hashOf(onePixelPNG)

	seen := map[string]bool{}
	for i := 0; i < 2; i++ {
		signed := postJSON(t, a, deck+"/uploads",
			fmt.Sprintf(`{"name":"x.png","size":%d,"type":"image/png","hash":%q}`, len(onePixelPNG), hash), cookies)
		if signed.Code != http.StatusOK {
			t.Fatalf("sign %d: status %d\n%s", i, signed.Code, signed.Body)
		}
		key, _ := jsonBody(t, signed)["ref"].(string)
		if key == hash {
			t.Fatalf("sign %d answered the address the browser named", i)
		}
		if seen[key] {
			t.Fatalf("two signings answered the same staging address %s", key)
		}
		seen[key] = true
	}
}

// --- codex 2: knowing a ref is not permission to read it ---

// TestRegisteringAnotherDecksRefIsRefused is the finding: registration
// checked access to the DESTINATION deck and then fetched whatever ref
// it was handed, writing that deck's verification row. So a member who
// knew another deck's content address — and a ref is a content address,
// which is the whole reason serveAsset checks two things — could
// register it into a deck of their own and pass both checks.
//
// Now registration only ever looks at a staged upload of this
// principal's, for this deck. A ref alone reaches nothing.
func TestRegisteringAnotherDecksRefIsRefused(t *testing.T) {
	a := newAppWithStore(t, dirStore(t))
	cookies := signedIn(t, a, allowedAddress)
	token := mintAgent(t, a, cookies, "claude")

	theirs := apiDeck(t, a, token, "Theirs")
	mine := apiDeck(t, a, token, "Mine")

	record := upload(t, a, "/d/"+theirs, cookies, "secret.png", "image/png", onePixelPNG, "A chart")
	registerInDeck(t, a, token, theirs, record)
	ref := record["ref"].(string)
	mustGet(t, a, "/d/"+theirs+"/assets/"+ref, http.StatusOK, cookies)

	// The other deck's ref, named at the other deck's owner's own
	// second deck. Not a 500, and not a verification: nothing was
	// staged here.
	reg := postJSON(t, a, "/d/"+mine+"/assets",
		fmt.Sprintf(`{"ref":%q,"name":"secret.png","width":1,"height":1,"alt":"a"}`, ref), cookies)
	if reg.Code != http.StatusNotFound {
		t.Fatalf("registering another deck's ref: status %d, want 404\n%s", reg.Code, reg.Body)
	}

	// Even with the document made to refer to it, which is an op
	// nothing checks, the bytes stay out of reach.
	apiJSON(t, a, http.MethodPost, "/api/v1/decks/"+mine+"/ops", token,
		fmt.Sprintf(`{"ops":[{"op":"register_asset","id":"borrowed1234","ref":%q,"name":"x.png","width":1,"height":1,"alt":"x"}]}`, ref),
		http.StatusOK)
	if rec := get(t, a, "/d/"+mine+"/assets/"+ref, cookies...); rec.Code != http.StatusNotFound {
		t.Errorf("a borrowed ref was served: status %d, want 404", rec.Code)
	}
	share := mintShareLink(t, a, "/d/"+mine, cookies)
	if rec := get(t, a, "/s/"+share+"/assets/"+ref); rec.Code != http.StatusNotFound {
		t.Errorf("a borrowed ref was served over a share link: status %d, want 404", rec.Code)
	}
}

// TestAStagedUploadBelongsToOneDeck: a receipt is not transferable
// either. An upload staged for one deck cannot be registered into
// another, however firmly the person holds both.
func TestAStagedUploadBelongsToOneDeck(t *testing.T) {
	a := newAppWithStore(t, dirStore(t))
	cookies := signedIn(t, a, allowedAddress)
	one := createDeck(t, a, cookies, "One")
	two := createDeck(t, a, cookies, "Two")

	staged := stageUpload(t, a, one, cookies, "x.png", "image/png", onePixelPNG)
	reg := postJSON(t, a, two+"/assets",
		fmt.Sprintf(`{"ref":%q,"name":"x.png","width":1,"height":1,"alt":"a"}`, staged), cookies)
	if reg.Code != http.StatusNotFound {
		t.Errorf("registering deck one's staged upload into deck two: status %d, want 404\n%s", reg.Code, reg.Body)
	}
	// And it is single use: registered once in its own deck, the same
	// receipt is spent.
	first := postJSON(t, a, one+"/assets",
		fmt.Sprintf(`{"ref":%q,"name":"x.png","width":1,"height":1,"alt":"a"}`, staged), cookies)
	if first.Code != http.StatusOK {
		t.Fatalf("registering in its own deck: status %d, want 200\n%s", first.Code, first.Body)
	}
	again := postJSON(t, a, one+"/assets",
		fmt.Sprintf(`{"ref":%q,"name":"x.png","width":1,"height":1,"alt":"a"}`, staged), cookies)
	if again.Code != http.StatusNotFound {
		t.Errorf("registering a spent receipt: status %d, want 404\n%s", again.Code, again.Body)
	}
}

// --- codex 5: following a presentation stays behind the share link ---

// TestFollowStaysBehindTheShareLink is the finding: following handed
// the audience the presentation session sqid, and every later read went
// to /p/{session}, which asks only for a live presentation. So revoking
// the share link left the recipient reading fresh deck content until
// the talk ended — a capability the person who granted it could not
// take back.
func TestFollowStaysBehindTheShareLink(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)
	path := sampleDeck(t, a, cookies)
	link := mintShareLink(t, a, path, cookies)
	share := "/s/" + link

	session, remote := startPresenting(t, a, path, cookies)
	command(t, a, session, "next", remote, "", nil)

	follow := mustGet(t, a, share+"?follow=1", http.StatusOK, nil).Body.String()
	if strings.Contains(follow, session) {
		t.Errorf("the follow surface carries the session sqid %s:\n%s", session, follow)
	}
	if strings.Contains(follow, "/p/") {
		t.Errorf("the follow surface carries a /p/ URL:\n%s", follow)
	}
	// The two URLs its script uses, both the share link's own.
	if !strings.Contains(follow, `data-stream="`+share+`/stream"`) {
		t.Errorf("the follow surface does not stream from the share link:\n%s", follow)
	}
	if !strings.Contains(follow, `data-fragment="`+share+`?follow=1&amp;slide={n}&amp;fragment=1"`) {
		t.Errorf("the follow surface does not fetch fragments from the share link:\n%s", follow)
	}

	// And they work: the fragment is a bare slide, the stream speaks.
	fragment := mustGet(t, a, share+"?follow=1&slide=3&fragment=1", http.StatusOK, nil).Body.String()
	if !strings.HasPrefix(strings.TrimSpace(fragment), "<section slides-slide") {
		t.Errorf("the follow fragment is not a bare slide:\n%s", fragment)
	}
	if strings.Contains(fragment, "<html") {
		t.Errorf("the follow fragment carries the whole page:\n%s", fragment)
	}

	srv := httptest.NewServer(a)
	defer srv.Close()
	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
	defer cancel()
	req, err := http.NewRequestWithContext(ctx, http.MethodGet, srv.URL+share+"/stream", nil)
	if err != nil {
		t.Fatalf("build the stream request: %v", err)
	}
	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		t.Fatalf("open the share link's stream: %v", err)
	}
	defer resp.Body.Close()
	if resp.StatusCode != http.StatusOK {
		t.Fatalf("GET %s/stream: status %d, want 200", share, resp.StatusCode)
	}
	if got := resp.Header.Get("Content-Type"); got != "text/event-stream" {
		t.Fatalf("the share link's stream is %q, want text/event-stream", got)
	}
	if data := nextSlideEvent(t, bufio.NewReader(resp.Body)); !strings.Contains(data, `"slide":2`) {
		t.Errorf("the connect event is %q, want the presenter's slide 2", data)
	}
	resp.Body.Close()

	// Revoked, mid-talk, and every one of those doors shuts — which is
	// the whole point of the finding.
	revokeShareLink(t, a, path, cookies)
	for _, target := range []string{
		share,
		share + "?follow=1",
		share + "?follow=1&slide=3&fragment=1",
		share + "/stream",
	} {
		if rec := get(t, a, target); rec.Code != http.StatusNotFound {
			t.Errorf("GET %s after revoking: status %d, want 404", target, rec.Code)
		}
	}
	// The talk is still live for the projector, which is the point of
	// the projector's own capability being a different thing.
	mustGet(t, a, "/p/"+session, http.StatusOK, nil)
}

// TestFollowingWithNothingLiveEndsTheStream: the share link's stream
// answers even when there is no talk, with the one event that tells a
// following page to go back to reading the deck. Nothing to follow is
// the ordinary end of a session, not an error.
func TestFollowingWithNothingLiveEndsTheStream(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)
	path := sampleDeck(t, a, cookies)
	link := mintShareLink(t, a, path, cookies)

	rec := mustGet(t, a, "/s/"+link+"/stream", http.StatusOK, nil)
	if got := rec.Header().Get("Content-Type"); got != "text/event-stream" {
		t.Fatalf("Content-Type = %q, want text/event-stream", got)
	}
	if !strings.Contains(rec.Body.String(), `"ended":true`) {
		t.Errorf("the stream with nothing live said %q, want an ended event", rec.Body)
	}
	// An unknown token is a 404 here like everywhere else.
	if rec := get(t, a, "/s/nosuchtoken/stream"); rec.Code != http.StatusNotFound {
		t.Errorf("an unknown share token's stream: status %d, want 404", rec.Code)
	}
}

// revokeShareLink turns off the newest link on a deck, through the
// screen a person uses. share_test.go finds the form the same way; this
// is that walk as a helper, because two tests here need it.
func revokeShareLink(t *testing.T, a *testApp, deckPath string, cookies []*http.Cookie) {
	t.Helper()
	page := mustGet(t, a, deckPath+"/share", http.StatusOK, cookies).Body.String()
	m := regexp.MustCompile(`/share/(\d+)/revoke`).FindStringSubmatch(page)
	if m == nil {
		t.Fatalf("the share page carries no revoke form:\n%s", page)
	}
	if rec := post(t, a, deckPath+"/share/"+m[1]+"/revoke", nil, cookies...); rec.Code != http.StatusSeeOther {
		t.Fatalf("POST revoke: status %d, want 303\n%s", rec.Code, rec.Body)
	}
}

// --- codex 6: removing an address ends the authority it had ---

// TestRemovingAnAddressEndsItsSessionsAndItsAgents is the finding: the
// allowlist gated the minting of a session and nothing else. An
// existing session resolved its user row without asking whether the
// address was still admitted, rastrillo's RequireSession asks nothing,
// and an agent needed only an unrevoked token and an operator row. So
// taking somebody off SLIDES_ALLOWED_ADDRESSES and restarting removed
// nothing they already had, including an agent's writes to team decks.
//
// The restart is real: a second app is built over the SAME database
// file with the address gone from the list, which is exactly what
// `carlos env` plus a recycle does.
func TestRemovingAnAddressEndsItsSessionsAndItsAgents(t *testing.T) {
	cfg, mailer := newConfig(t)
	d := openTestDB(t, cfg)

	before := newAppOver(t, d, cfg, mailer)
	cookies := signedIn(t, before, allowedAddress)
	token := mintAgent(t, before, cookies, "claude")
	sqid := apiDeck(t, before, token, "Leaving")
	deck := "/d/" + sqid
	// Both credentials work while the address is on the list.
	mustGet(t, before, deck, http.StatusOK, cookies)
	apiJSON(t, before, http.MethodGet, "/api/v1/decks/"+sqid, token, "", http.StatusOK)

	// Somebody presenting on the way out, so the lifecycle question the
	// finding asks — what happens to outstanding capabilities — has an
	// answer under test rather than only in the spec.
	session, _ := startPresenting(t, before, deck, cookies)
	link := mintShareLink(t, before, deck, cookies)
	mustGet(t, before, "/p/"+session, http.StatusOK, nil)

	// The offboarding: the address comes off the list, and the app
	// restarts over the same data.
	gone, _ := newConfig(t)
	gone.AllowedAddresses = []string{"someone.else@example.test"}
	after := newAppOver(t, d, gone, mailer)

	// The session cookie is the same cookie, and it reaches nothing.
	rec := get(t, after, deck, cookies...)
	if rec.Code != http.StatusSeeOther {
		t.Fatalf("a removed address's session: status %d, want 303 to the sign-in page\n%s", rec.Code, rec.Body)
	}
	if loc := rec.Header().Get("Location"); loc != "/signin?err=removed" {
		t.Errorf("Location = %q, want /signin?err=removed", loc)
	}
	// And it is told so in words from the catalog, not left to guess.
	page := mustGet(t, after, "/signin?err=removed", http.StatusOK, nil).Body.String()
	if !strings.Contains(page, "has been removed") {
		t.Errorf("the sign-in page does not say the access was removed:\n%s", page)
	}
	// A write is a 403 rather than a redirect: there is no page to send
	// a fetch or a form POST to.
	if rec := post(t, after, deck+"/settings", url.Values{"title": {"Renamed"}}, cookies...); rec.Code != http.StatusForbidden {
		t.Errorf("a removed address's POST: status %d, want 403", rec.Code)
	}
	// Really revoked, not merely un-cookied: signing in again is the
	// only way back, and the allowlist refuses that too.
	if rec := get(t, after, "/", cookies...); rec.Code != http.StatusSeeOther {
		t.Errorf("a removed address's home: status %d, want 303", rec.Code)
	}

	// The agent token, which is the path that survives a browser being
	// signed out, fails closed on the operator rather than on itself.
	apiJSON(t, after, http.MethodGet, "/api/v1/decks/"+sqid, token, "", http.StatusUnauthorized)
	apiJSON(t, after, http.MethodPost, "/api/v1/decks/"+sqid+"/ops", token,
		`{"ops":[{"op":"set_meta","title":"Written by a removed operator"}]}`, http.StatusUnauthorized)

	// Their live talk is over: a presentation is a public URL that
	// reads the deck out, and a removed person does not get to leave
	// one running.
	if rec := get(t, after, "/p/"+session); rec.Code != http.StatusGone {
		t.Errorf("a removed presenter's session: status %d, want 410", rec.Code)
	}
	// Their share links are NOT revoked: a link belongs to the deck,
	// which belongs to the team, and one member leaving is not an
	// outage for everybody holding a link to a team deck. Spec §6.1
	// says so out loud.
	mustGet(t, after, "/s/"+link, http.StatusOK, nil)
}

// newAppOver is newAppWith over a database that already exists — the
// closest thing to a restart there is. The harness's own newAppWith
// opens a fresh file per app, which is what every other test wants and
// exactly what an offboarding test cannot have.
func newAppOver(t *testing.T, d *db.DB, cfg slides.Config, mailer *fakeMailer) *testApp {
	t.Helper()
	mux, a, err := slides.New(d, cfg)
	if err != nil {
		t.Fatalf("slides.New: %v", err)
	}
	t.Cleanup(func() { a.Close() })
	mailer.flush = a.FlushMail
	return &testApp{Handler: localised(t, mux), mailer: mailer, db: d, app: a}
}