package slidestest

import (
	"bufio"
	"bytes"
	"context"
	"encoding/binary"
	"net/http"
	"net/http/httptest"
	"net/url"
	"os"
	"path/filepath"
	"strconv"
	"strings"
	"testing"
	"time"

	"amadan.net/oficina/slides/internal/slides/core"
)

// --- helpers ---

// postBody makes a POST with a body of this test's choosing — the
// binary update endpoint and the JSON presence endpoint both take one,
// and neither is a form.
//
// It sends the same same-origin evidence `post` does: these are
// browser-made requests, inside csrf.Protect like every other write.
func postBody(t *testing.T, a *testApp, target, contentType string, body []byte, cookies []*http.Cookie) *httptest.ResponseRecorder {
	t.Helper()
	req := httptest.NewRequest(http.MethodPost, target, bytes.NewReader(body))
	req.Header.Set("Content-Type", contentType)
	req.Header.Set("Origin", testOrigin)
	req.Header.Set("Sec-Fetch-Site", "same-origin")
	for _, c := range cookies {
		req.AddCookie(c)
	}
	rec := httptest.NewRecorder()
	a.ServeHTTP(rec, req)
	return rec
}

// frames splits an updates response into the updates it carries: a
// 4-byte big-endian length then that many bytes, repeated. A body that
// does not divide cleanly is a failure rather than a short read — the
// framing is the protocol, and a client that guessed would be a client
// that silently loses the last update.
func frames(t *testing.T, body []byte) [][]byte {
	t.Helper()
	var out [][]byte
	for len(body) > 0 {
		if len(body) < 4 {
			t.Fatalf("%d trailing bytes with no length prefix", len(body))
		}
		n := binary.BigEndian.Uint32(body[:4])
		body = body[4:]
		if uint32(len(body)) < n {
			t.Fatalf("a frame claims %d bytes and %d remain", n, len(body))
		}
		out = append(out, body[:n])
		body = body[n:]
	}
	return out
}

// getUpdates fetches one cursor's worth of the log and returns the
// frames plus the advisory seq the response carried.
func getUpdates(t *testing.T, a *testApp, path string, since int64, cookies []*http.Cookie) ([][]byte, int64) {
	t.Helper()
	target := path + "/updates?since=" + strconv.FormatInt(since, 10)
	rec := mustGet(t, a, target, http.StatusOK, cookies)
	if ct := rec.Header().Get("Content-Type"); ct != "application/octet-stream" {
		t.Fatalf("GET %s: Content-Type = %q, want application/octet-stream", target, ct)
	}
	seq, err := strconv.ParseInt(rec.Header().Get("Slides-Seq"), 10, 64)
	if err != nil {
		t.Fatalf("GET %s: Slides-Seq = %q, not a number", target, rec.Header().Get("Slides-Seq"))
	}
	return frames(t, rec.Body.Bytes()), seq
}

// mirror is a browser's copy of a deck: a core document of its own,
// caught up to the server's log, that produces the update bytes a real
// editor would post. It is the only honest way to test this wire —
// bytes made up by hand are not Yjs updates and prove nothing about the
// path they travel.
type mirror struct {
	rt *core.Runtime
	h  *core.Handle
}

func newMirror(t *testing.T, sqid string, log [][]byte) *mirror {
	t.Helper()
	ctx := context.Background()
	rt, err := core.New(ctx)
	if err != nil {
		t.Fatalf("core.New: %v", err)
	}
	// Client id 2: the server writes as 1 (decks.go's serverClientID),
	// and two writers sharing one client id is the one thing a CRDT
	// cannot forgive.
	h, err := rt.NewDoc(ctx, sqid, 2)
	if err != nil {
		rt.Close(ctx)
		t.Fatalf("core.NewDoc: %v", err)
	}
	m := &mirror{rt: rt, h: h}
	t.Cleanup(func() {
		h.Close(ctx)
		rt.Close(ctx)
	})
	m.apply(t, log)
	return m
}

func (m *mirror) apply(t *testing.T, log [][]byte) {
	t.Helper()
	for i, u := range log {
		if err := m.h.Apply(context.Background(), u); err != nil {
			t.Fatalf("applying frame %d to the mirror: %v", i, err)
		}
	}
}

// ops runs a batch against the mirror and returns the update it
// produced — exactly what the browser's own ops module will POST.
func (m *mirror) ops(t *testing.T, batch string) []byte {
	t.Helper()
	update, err := m.h.Ops(context.Background(), []byte(batch))
	if err != nil {
		t.Fatalf("mirror ops %s: %v", batch, err)
	}
	return update
}

// postUpdate posts one update and insists on the 204 and the seq.
func postUpdate(t *testing.T, a *testApp, path string, update []byte, cookies []*http.Cookie) int64 {
	t.Helper()
	rec := postBody(t, a, path+"/updates", "application/octet-stream", update, cookies)
	if rec.Code != http.StatusNoContent {
		t.Fatalf("POST %s/updates: status %d, want 204\n%s", path, rec.Code, rec.Body)
	}
	seq, err := strconv.ParseInt(rec.Header().Get("Slides-Seq"), 10, 64)
	if err != nil {
		t.Fatalf("POST %s/updates: Slides-Seq = %q, not a number", path, rec.Header().Get("Slides-Seq"))
	}
	return seq
}

// scan opens the deck's SSE stream against a real server and returns a
// reader over it. The request's context is the timeout, so a stream
// that never speaks fails the test rather than hanging it.
func scan(t *testing.T, a *testApp, path string, cookies []*http.Cookie) *bufio.Reader {
	t.Helper()
	srv := httptest.NewServer(a)
	t.Cleanup(srv.Close)

	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
	t.Cleanup(cancel)
	req, err := http.NewRequestWithContext(ctx, http.MethodGet, srv.URL+path+"/stream", nil)
	if err != nil {
		t.Fatalf("build the stream request: %v", err)
	}
	for _, c := range cookies {
		req.AddCookie(c)
	}
	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		t.Fatalf("open the stream: %v", err)
	}
	t.Cleanup(func() { resp.Body.Close() })
	if resp.StatusCode != http.StatusOK {
		t.Fatalf("GET %s/stream: status %d, want 200", path, resp.StatusCode)
	}
	if got := resp.Header.Get("Content-Type"); got != "text/event-stream" {
		t.Fatalf("the stream's Content-Type is %q, want text/event-stream", got)
	}
	return bufio.NewReader(resp.Body)
}

// nextEvent reads events until one of the named kind arrives,
// returning its data line. Pings and the other kind are skipped.
func nextEvent(t *testing.T, r *bufio.Reader, want string) string {
	t.Helper()
	var kind string
	for {
		line, err := r.ReadString('\n')
		if err != nil {
			t.Fatalf("reading the stream for a %q event: %v", want, err)
		}
		line = strings.TrimRight(line, "\r\n")
		switch {
		case strings.HasPrefix(line, "event: "):
			kind = strings.TrimPrefix(line, "event: ")
		case strings.HasPrefix(line, "data: "):
			if kind == want {
				return strings.TrimPrefix(line, "data: ")
			}
		}
	}
}

// scalar reads one value out of the app's own database, for the facts
// that have no screen: which actor a row recorded, which id a person
// got.
func scalar(t *testing.T, a *testApp, query string, args ...any) string {
	t.Helper()
	var out string
	if err := a.db.G.Raw(query, args...).Scan(&out).Error; err != nil {
		t.Fatalf("query %q: %v", query, err)
	}
	return out
}

// sqidOf turns the /d/{sqid} path createDeck returns into the sqid.
func sqidOf(path string) string { return strings.TrimPrefix(path, "/d/") }

// --- the wire ---

// TestUpdatesRoundTripThroughTheWire: a browser's own update, made by
// the same core the server runs, posted, read back framed, and visible
// in the deck the server renders.
//
// The last step is the point. A test that posted bytes and read the
// same bytes back would pass over a table that stored them and a
// document that never saw them.
func TestUpdatesRoundTripThroughTheWire(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)
	path := createDeck(t, a, cookies, "Wire")

	// A new deck is one update: its opening batch (decks.go).
	log, seq := getUpdates(t, a, path, 0, cookies)
	if len(log) != 1 {
		t.Fatalf("a new deck's log has %d frames, want 1", len(log))
	}
	if seq != 1 {
		t.Fatalf("Slides-Seq on a new deck is %d, want 1", seq)
	}

	m := newMirror(t, sqidOf(path), log)
	update := m.ops(t, `[{"op":"add_slide","id":"wiretestslide","layout":"flow","template":"title"}]`)

	if got := postUpdate(t, a, path, update, cookies); got != 2 {
		t.Fatalf("POST answered Slides-Seq %d, want 2", got)
	}

	// Read back from the cursor the client held: exactly the one
	// update it did not already have, byte for byte.
	tail, seq := getUpdates(t, a, path, 1, cookies)
	if len(tail) != 1 {
		t.Fatalf("since=1 returned %d frames, want 1", len(tail))
	}
	if !bytes.Equal(tail[0], update) {
		t.Errorf("the frame read back is not the update posted:\n got %x\nwant %x", tail[0], update)
	}
	if seq != 2 {
		t.Errorf("Slides-Seq is %d, want 2", seq)
	}

	// And the server's own document really has the slide.
	rec := mustGet(t, a, path+"/slides/wiretestslide.html", http.StatusOK, cookies)
	if !strings.Contains(rec.Body.String(), "<section slides-slide") {
		t.Errorf("the slide the update added does not render:\n%s", rec.Body)
	}
}

// TestUpdatesSinceCursorIsExclusive: ?since=N means "everything after
// N", never "everything from N". Off by one here and every client
// re-applies the update it already holds on every reconnect.
func TestUpdatesSinceCursorIsExclusive(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)
	path := createDeck(t, a, cookies, "Cursors")

	log, _ := getUpdates(t, a, path, 0, cookies)
	m := newMirror(t, sqidOf(path), log)
	postUpdate(t, a, path, m.ops(t, `[{"op":"set_meta","title":"Second"}]`), cookies)
	postUpdate(t, a, path, m.ops(t, `[{"op":"set_meta","title":"Third"}]`), cookies)

	for _, tc := range []struct {
		since  int64
		frames int
		seq    int64
	}{
		{since: 0, frames: 3, seq: 3},
		{since: 1, frames: 2, seq: 3},
		{since: 2, frames: 1, seq: 3},
		// Nothing after the last one, and the header says where the
		// client already is rather than dropping to zero.
		{since: 3, frames: 0, seq: 3},
		// A cursor past the end is a client that is ahead of this
		// instance, not an error: it gets nothing and keeps its place.
		{since: 99, frames: 0, seq: 99},
	} {
		got, seq := getUpdates(t, a, path, tc.since, cookies)
		if len(got) != tc.frames {
			t.Errorf("since=%d returned %d frames, want %d", tc.since, len(got), tc.frames)
		}
		if seq != tc.seq {
			t.Errorf("since=%d answered Slides-Seq %d, want %d", tc.since, seq, tc.seq)
		}
	}

	// A cursor that is not a number is a client bug, and it is told so
	// rather than being handed the whole log as if it had asked.
	mustGet(t, a, path+"/updates?since=banana", http.StatusBadRequest, cookies)
	mustGet(t, a, path+"/updates?since=-1", http.StatusBadRequest, cookies)
}

// TestStreamAnnouncesSeqOnConnectAndAfterPost: the stream says where
// the deck is the moment it opens — which is what heals a tab whose
// cursor fell behind — and says so again every time an update lands.
func TestStreamAnnouncesSeqOnConnectAndAfterPost(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)
	path := createDeck(t, a, cookies, "Stream")

	log, _ := getUpdates(t, a, path, 0, cookies)
	m := newMirror(t, sqidOf(path), log)

	events := scan(t, a, path, cookies)
	if data := nextEvent(t, events, "update"); data != "1" {
		t.Errorf("the connect event is %q, want the deck's current seq 1", data)
	}
	// Nobody has posted presence, so the connect set is empty — an
	// event all the same, so a tab knows it is alone rather than
	// waiting to find out.
	if data := nextEvent(t, events, "presence"); data != "[]" {
		t.Errorf("the connect presence is %q, want an empty set", data)
	}

	postUpdate(t, a, path, m.ops(t, `[{"op":"set_meta","title":"Moved"}]`), cookies)
	if data := nextEvent(t, events, "update"); data != "2" {
		t.Errorf("after a POST the stream said %q, want 2", data)
	}

	// A write through any other path says so too: the stream is the
	// deck's, not the update endpoint's.
	rec := post(t, a, path+"/settings", url.Values{
		"title": {"Renamed"}, "theme": {"ink"}, "rung": {"private"},
	}, cookies...)
	if rec.Code != http.StatusSeeOther {
		t.Fatalf("POST %s/settings: status %d, want 303", path, rec.Code)
	}
	if data := nextEvent(t, events, "update"); data != "3" {
		t.Errorf("after a settings save the stream said %q, want 3", data)
	}
}

// TestPresencePostReachesTheStream: a heartbeat becomes the whole set,
// stamped with the name and colour of the person whose SESSION it came
// from rather than whatever the body claimed.
func TestPresencePostReachesTheStream(t *testing.T) {
	a := newSharedApp(t)
	cookies := signedIn(t, a, allowedAddress)
	path := createDeck(t, a, cookies, "Presence")

	events := scan(t, a, path, cookies)
	nextEvent(t, events, "presence")

	body := `{"client":"tab-1","slide":"s1","block":"b1","name":"Somebody Else","colour":"#ff0000"}`
	rec := postBody(t, a, path+"/presence", "application/json", []byte(body), cookies)
	if rec.Code != http.StatusNoContent {
		t.Fatalf("POST %s/presence: status %d, want 204\n%s", path, rec.Code, rec.Body)
	}

	data := nextEvent(t, events, "presence")
	for _, want := range []string{`"client":"tab-1"`, `"slide":"s1"`, `"block":"b1"`} {
		if !strings.Contains(data, want) {
			t.Errorf("the presence event %q does not carry %q", data, want)
		}
	}
	// The name and the colour are the users row's, exactly — the two
	// things the browser draws a person with (an avatar on the strip,
	// an outline on their block) and the two it is never allowed to
	// choose for itself. Nameless, a person is their address, which is
	// what every other surface calls them (decks.go's shellFor).
	colour := scalar(t, a, "SELECT colour FROM users WHERE email = ?", allowedAddress)
	if colour == "" || !strings.Contains(data, `"colour":"`+colour+`"`) {
		t.Errorf("the presence event %q does not carry the person's own colour %q", data, colour)
	}
	if !strings.Contains(data, `"name":"`+allowedAddress+`"`) {
		t.Errorf("the presence event %q does not name the person by their address", data)
	}
	if strings.Contains(data, "Somebody Else") || strings.Contains(data, "#ff0000") {
		t.Errorf("the body's own name or colour was trusted:\n%s", data)
	}

	// Once they have a name, that is what their colleagues see.
	if err := a.db.G.Exec("UPDATE users SET name = ? WHERE email = ?", "Ana Ruiz", allowedAddress).Error; err != nil {
		t.Fatalf("name the user: %v", err)
	}
	rec = postBody(t, a, path+"/presence", "application/json", []byte(body), cookies)
	if rec.Code != http.StatusNoContent {
		t.Fatalf("POST %s/presence: status %d, want 204", path, rec.Code)
	}
	data = nextEvent(t, events, "presence")
	if !strings.Contains(data, `"name":"Ana Ruiz"`) || strings.Contains(data, allowedAddress) {
		t.Errorf("the presence event %q does not carry the person's own name", data)
	}

	// A heartbeat with no client to key on is a client bug, not a
	// person: refused rather than filed under the empty string.
	rec = postBody(t, a, path+"/presence", "application/json", []byte(`{"slide":"s1"}`), cookies)
	if rec.Code != http.StatusUnprocessableEntity {
		t.Errorf("POST presence with no client: status %d, want 422", rec.Code)
	}
}

// TestUpdatesRequireMembershipAndRecordActor: every live-sync route is
// behind the same visibility seam every other deck route is, answering
// 404 rather than 403 — and every write it accepts says who made it.
func TestUpdatesRequireMembershipAndRecordActor(t *testing.T) {
	a := newSharedApp(t)
	mine := signedIn(t, a, allowedAddress)
	theirs := signedIn(t, a, otherAddress)
	path := createDeck(t, a, mine, "Members only")

	log, _ := getUpdates(t, a, path, 0, mine)
	m := newMirror(t, sqidOf(path), log)
	update := m.ops(t, `[{"op":"set_meta","title":"Mine"}]`)

	// A stranger cannot read the log, write to it, watch it, or say
	// they are in the deck.
	mustGet(t, a, path+"/updates?since=0", http.StatusNotFound, theirs)
	mustGet(t, a, path+"/stream", http.StatusNotFound, theirs)
	mustGet(t, a, path+"/slides/whatever.html", http.StatusNotFound, theirs)
	if rec := postBody(t, a, path+"/updates", "application/octet-stream", update, theirs); rec.Code != http.StatusNotFound {
		t.Errorf("a stranger's POST /updates: status %d, want 404", rec.Code)
	}
	if rec := postBody(t, a, path+"/presence", "application/json", []byte(`{"client":"x"}`), theirs); rec.Code != http.StatusNotFound {
		t.Errorf("a stranger's POST /presence: status %d, want 404", rec.Code)
	}
	// Signed out is a redirect to sign in, never the log.
	mustGet(t, a, path+"/updates?since=0", http.StatusSeeOther, nil)

	// The owner's own write records them.
	postUpdate(t, a, path, update, mine)
	id := scalar(t, a, "SELECT id FROM users WHERE email = ?", allowedAddress)
	actor := scalar(t, a,
		"SELECT actor FROM deck_updates WHERE deck_id = (SELECT id FROM decks WHERE sqid = ?) ORDER BY seq DESC LIMIT 1",
		sqidOf(path))
	if want := "person:" + id; actor != want {
		t.Errorf("the update recorded actor %q, want %q", actor, want)
	}

	// A team member can edit: the live routes are visibleDecks' whole
	// audience, not the owner alone.
	if rec := post(t, a, path+"/settings", url.Values{
		"title": {"Members only"}, "theme": {"ink"}, "rung": {"team"},
	}, mine...); rec.Code != http.StatusSeeOther {
		t.Fatalf("raising the rung: status %d, want 303", rec.Code)
	}
	shared, _ := getUpdates(t, a, path, 0, theirs)
	if len(shared) == 0 {
		t.Fatal("a team member cannot read the deck's log")
	}
	m.apply(t, shared[len(shared)-1:])
	postUpdate(t, a, path, m.ops(t, `[{"op":"set_meta","title":"Ours"}]`), theirs)
	theirID := scalar(t, a, "SELECT id FROM users WHERE email = ?", otherAddress)
	actor = scalar(t, a,
		"SELECT actor FROM deck_updates WHERE deck_id = (SELECT id FROM decks WHERE sqid = ?) ORDER BY seq DESC LIMIT 1",
		sqidOf(path))
	if want := "person:" + theirID; actor != want {
		t.Errorf("the team member's update recorded actor %q, want %q", actor, want)
	}
}

// TestRefusedUpdateIs422: bytes the core will not have are the client's
// problem, and the answer says so without pretending anything was
// stored.
func TestRefusedUpdateIs422(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)
	path := createDeck(t, a, cookies, "Refusals")

	rec := postBody(t, a, path+"/updates", "application/octet-stream",
		[]byte("this is not a Yjs update"), cookies)
	if rec.Code != http.StatusUnprocessableEntity {
		t.Fatalf("POST garbage: status %d, want 422\n%s", rec.Code, rec.Body)
	}

	// Nothing was written: the log is still the one opening update.
	log, seq := getUpdates(t, a, path, 0, cookies)
	if len(log) != 1 || seq != 1 {
		t.Errorf("after a refusal the log has %d frames at seq %d, want 1 at 1", len(log), seq)
	}

	// And an update larger than the cap is refused before it is read
	// into memory at all.
	rec = postBody(t, a, path+"/updates", "application/octet-stream",
		make([]byte, maxUpdateBytesForTest+1), cookies)
	if rec.Code != http.StatusRequestEntityTooLarge {
		t.Errorf("POST an oversized update: status %d, want 413", rec.Code)
	}
}

// maxUpdateBytesForTest is the app's own cap, restated here rather than
// exported: the number is part of the wire contract (the plan's "limit
// 1 MiB"), so a test that read it from the app could never notice it
// changing.
const maxUpdateBytesForTest = 1 << 20

// TestSlideHTMLTwinRendersOneSection: the editor's stage and strip
// fetch slide HTML with a session cookie rather than a bearer token,
// and get the same section the API serves — the section alone, never a
// page.
func TestSlideHTMLTwinRendersOneSection(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)
	path := createDeck(t, a, cookies, "Stage")

	log, _ := getUpdates(t, a, path, 0, cookies)
	m := newMirror(t, sqidOf(path), log)
	postUpdate(t, a, path, m.ops(t, `[{"op":"add_slide","id":"stageslide","layout":"flow","template":"title"}]`), cookies)

	for _, vp := range []string{"", "desktop", "phone", "thumb"} {
		target := path + "/slides/stageslide.html"
		if vp != "" {
			target += "?vp=" + vp
		}
		body := mustGet(t, a, target, http.StatusOK, cookies).Body.String()
		if !strings.HasPrefix(strings.TrimSpace(body), "<section slides-slide") {
			t.Errorf("vp=%q is not a bare slide section:\n%s", vp, body)
		}
		if strings.Contains(body, "<html") {
			t.Errorf("vp=%q carries a whole page:\n%s", vp, body)
		}
	}

	mustGet(t, a, path+"/slides/nosuchslide.html", http.StatusNotFound, cookies)
	mustGet(t, a, path+"/slides/stageslide", http.StatusNotFound, cookies)
}

// TestPostedMetaReachesTheDeckRow: the editor's deck section writes
// meta.title and meta.theme over the wire, and the deck list reads the
// row — so the row follows the document on this path as it follows a
// set_meta on the API's (metaRowUpdates). An empty title and a theme
// this build does not have leave the row alone.
func TestPostedMetaReachesTheDeckRow(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)
	path := createDeck(t, a, cookies, "Before")
	sqid := sqidOf(path)

	history, _ := getUpdates(t, a, path, 0, cookies)
	m := newMirror(t, sqid, history)
	postUpdate(t, a, path, m.ops(t, `[{"op":"set_meta","title":"After","theme":"ink"}]`), cookies)
	if got := scalar(t, a, "SELECT title FROM decks WHERE sqid = ?", sqid); got != "After" {
		t.Errorf("after a posted set_meta the row's title is %q, want After", got)
	}
	if got := scalar(t, a, "SELECT theme FROM decks WHERE sqid = ?", sqid); got != "ink" {
		t.Errorf("after a posted set_meta the row's theme is %q, want ink", got)
	}

	postUpdate(t, a, path, m.ops(t, `[{"op":"set_meta","title":"","theme":"nosuchtheme"}]`), cookies)
	if got := scalar(t, a, "SELECT title FROM decks WHERE sqid = ?", sqid); got != "After" {
		t.Errorf("an empty title reached the row: %q", got)
	}
	if got := scalar(t, a, "SELECT theme FROM decks WHERE sqid = ?", sqid); got != "ink" {
		t.Errorf("an unknown theme reached the row: %q", got)
	}
	list := mustGet(t, a, "/", http.StatusOK, cookies).Body.String()
	if !strings.Contains(list, "After") {
		t.Errorf("the deck list does not show the posted title:\n%s", list)
	}
}

// --- poison ---

// poisonUpdate reads one of the updates fixtures/poison.mjs writes:
// a shape no op can produce, built directly with yjs, as real Yjs v1
// bytes. Committed, because the Go suite has no yjs of its own.
func poisonUpdate(t *testing.T, name string) []byte {
	t.Helper()
	b, err := os.ReadFile(filepath.Join("testdata", "poison", name+".yjs"))
	if err != nil {
		t.Fatalf("read the %s poison update (run node fixtures/poison.mjs): %v", name, err)
	}
	return b
}

// poisonSlides is the slide each poison update adds, for the shapes
// that add one — the slide that has to render afterwards.
var poisonSlides = map[string]string{
	"box":        "poisonboxsld",
	"background": "poisonbgsld1",
	"magnitude":  "poisonmagsld",
}

// stillRenders is every surface that opens the deck: the viewer, the
// editor and a slide fetched for the stage. A poison update that took
// one down took them all down, because they share openDeck.
func stillRenders(t *testing.T, a *testApp, path, name string, cookies []*http.Cookie) {
	t.Helper()
	mustGet(t, a, path, http.StatusOK, cookies)
	mustGet(t, a, path+"/edit", http.StatusOK, cookies)
	if slide, ok := poisonSlides[name]; ok {
		mustGet(t, a, path+"/slides/"+slide+".html", http.StatusOK, cookies)
	}
}

// TestPoisonUpdateDoesNotBrickTheDeck: an update carrying a shape the
// server's typed reader cannot hold must never leave a deck no surface
// can open. Two layers, each proved on its own:
//
//   - the view (core/src/view.rs) rebuilds every fixed-shape leaf from
//     the fields that have the right type — so box.x = "a",
//     background.kind = 5, fonts.body = [] and an asset that is a
//     string are accepted, stored, and render; and a deck that holds
//     such data by some other road than the gate renders too;
//   - the gate (live.go's appendUpdate) parses the view AFTER applying
//     the bytes and BEFORE storing them, so a shape the view passes and
//     the reader still refuses (a phone order of 1e300 — a number, but
//     not one an int can hold) is a 422 and nothing is stored.
func TestPoisonUpdateDoesNotBrickTheDeck(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)

	for _, name := range []string{"box", "background", "fonts", "assets"} {
		t.Run(name, func(t *testing.T) {
			path := createDeck(t, a, cookies, "Poison "+name)
			rec := postBody(t, a, path+"/updates", "application/octet-stream", poisonUpdate(t, name), cookies)
			if rec.Code != http.StatusNoContent {
				t.Fatalf("POST %s/updates with the %s shape: status %d, want 204 (the view tolerates it)\n%s", path, name, rec.Code, rec.Body)
			}
			stillRenders(t, a, path, name, cookies)
		})
		t.Run(name+"/bypassing-the-gate", func(t *testing.T) {
			// Written straight into the log, as a row that reached the
			// table by some road other than appendUpdate would have.
			path := createDeck(t, a, cookies, "Stored poison "+name)
			sqid := sqidOf(path)
			seq, _ := strconv.ParseInt(scalar(t, a, "SELECT seq FROM decks WHERE sqid = ?", sqid), 10, 64)
			if err := a.db.G.Exec(
				"INSERT INTO deck_updates (deck_id, seq, actor, bytes, created_at) VALUES ((SELECT id FROM decks WHERE sqid = ?), ?, ?, ?, ?)",
				sqid, seq+1, "person:0", poisonUpdate(t, name), time.Now().UTC()).Error; err != nil {
				t.Fatalf("insert the poison row: %v", err)
			}
			if err := a.db.G.Exec("UPDATE decks SET seq = ? WHERE sqid = ?", seq+1, sqid).Error; err != nil {
				t.Fatalf("bump the seq: %v", err)
			}
			stillRenders(t, a, path, name, cookies)
		})
	}

	t.Run("magnitude", func(t *testing.T) {
		path := createDeck(t, a, cookies, "Poison magnitude")
		before, seqBefore := getUpdates(t, a, path, 0, cookies)
		rec := postBody(t, a, path+"/updates", "application/octet-stream", poisonUpdate(t, "magnitude"), cookies)
		if rec.Code != http.StatusUnprocessableEntity {
			t.Fatalf("POST %s/updates with a shape the reader cannot hold: status %d, want 422\n%s", path, rec.Code, rec.Body)
		}
		after, seqAfter := getUpdates(t, a, path, 0, cookies)
		if len(after) != len(before) || seqAfter != seqBefore {
			t.Errorf("a refused update was stored: %d frames at seq %d, was %d at %d", len(after), seqAfter, len(before), seqBefore)
		}
		if got := scalar(t, a, "SELECT seq FROM decks WHERE sqid = ?", sqidOf(path)); got != strconv.FormatInt(seqBefore, 10) {
			t.Errorf("the row's seq moved to %s on a refused update", got)
		}
		stillRenders(t, a, path, "", cookies)
	})
}