package slidestest

import (
	"bufio"
	"context"
	"net/http"
	"net/http/httptest"
	"net/url"
	"regexp"
	"strings"
	"testing"
	"time"
)

// presentLocation is what POST /d/{sqid}/present redirects to: the
// presenter view for the new session, carrying the remote's capability
// once. Both halves are captured because every later request in these
// tests is one or the other — the session sqid is the address, and the
// token is the permission.
var presentLocation = regexp.MustCompile(
	`^/p/([23456789abcdefghjkmnpqrstuvwxyz]{10})/notes\?t=([A-Za-z0-9_-]{43})$`)

// pairingCode finds the six-character code on the presenter view. The
// alphabet is the unambiguous one (no O, no 0, no I, no 1), because a
// code is read aloud and typed on a phone.
//
// Anchored to the element that displays it rather than loose in the
// page: the remote token on the same page is base64url, and a run of
// six of ITS characters inside this alphabet is a coin flip away —
// an unanchored pattern would find the token about half the time.
var pairingCode = regexp.MustCompile(
	`slides-code>([ABCDEFGHJKLMNPQRSTUVWXYZ23456789]{6})<`)

// codeOn reads the pairing code off a presenter view.
func codeOn(t *testing.T, page string) string {
	t.Helper()
	m := pairingCode.FindStringSubmatch(page)
	if m == nil {
		t.Fatalf("no pairing code on the presenter view:\n%s", page)
	}
	return m[1]
}

// startPresenting presses Present on a deck and returns the session's
// sqid and the remote token it was shown once.
func startPresenting(t *testing.T, a *testApp, deckPath string, cookies []*http.Cookie) (string, string) {
	t.Helper()
	rec := post(t, a, deckPath+"/present", nil, cookies...)
	if rec.Code != http.StatusSeeOther {
		t.Fatalf("POST %s/present: status %d, want 303\n%s", deckPath, rec.Code, rec.Body)
	}
	loc := rec.Header().Get("Location")
	m := presentLocation.FindStringSubmatch(loc)
	if m == nil {
		t.Fatalf("POST %s/present: Location = %q, want /p/{session}/notes?t={token}", deckPath, loc)
	}
	return m[1], m[2]
}

// command posts one remote command as the phone does: a form, with the
// capability as a field. referer is sent when it is not empty, because
// where the answer goes — 303 back, or 204 to a caller with no page to
// return to — is part of what these tests are about.
func command(t *testing.T, a *testApp, session, op, token, referer string, extra url.Values) *httptest.ResponseRecorder {
	t.Helper()
	form := url.Values{"op": {op}, "t": {token}}
	for k, vs := range extra {
		form[k] = vs
	}
	req := httptest.NewRequest(http.MethodPost, "/p/"+session+"/command",
		strings.NewReader(form.Encode()))
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	req.Header.Set("Origin", testOrigin)
	req.Header.Set("Sec-Fetch-Site", "same-origin")
	if referer != "" {
		req.Header.Set("Referer", referer)
	}
	rec := httptest.NewRecorder()
	a.ServeHTTP(rec, req)
	return rec
}

// TestPresentCreatesSessionWithCodeAndRemoteUrl: the Present button is
// a form, pressing it opens a session, and the page it lands on shows
// the pairing code, the remote's address and its QR — once, to the
// presenter, and to nobody else.
func TestPresentCreatesSessionWithCodeAndRemoteUrl(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)
	path := sampleDeck(t, a, cookies)

	viewer := mustGet(t, a, path, http.StatusOK, cookies).Body.String()
	if !strings.Contains(viewer, `action="`+path+`/present"`) {
		t.Errorf("the viewer offers no Present form:\n%s", viewer)
	}

	session, token := startPresenting(t, a, path, cookies)

	notes := mustGet(t, a, "/p/"+session+"/notes?t="+token, http.StatusOK, cookies).Body.String()
	code := codeOn(t, notes)
	remoteURL := testOrigin + "/r/" + code + "?t=" + token
	if !strings.Contains(notes, remoteURL) {
		t.Errorf("the presenter view does not show the remote address %q:\n%s", remoteURL, notes)
	}
	if !strings.Contains(notes, "slides-qr") || !strings.Contains(notes, code+`"`) {
		t.Errorf("the presenter view carries no QR naming the code:\n%s", notes)
	}
	// The presenter view is the presenter's own screen, so it carries
	// the notes the projector must not.
	if !strings.Contains(notes, "Speaker notes") && !strings.Contains(notes, "Presenter view") {
		t.Errorf("the presenter view does not name itself:\n%s", notes)
	}

	// Without the capability in the URL there is nothing to copy: the
	// pairing block is shown once, at the moment of pairing.
	again := mustGet(t, a, "/p/"+session+"/notes", http.StatusOK, cookies).Body.String()
	if strings.Contains(again, token) {
		t.Errorf("coming back to the presenter view shows the remote token again:\n%s", again)
	}
	if strings.Contains(again, "slides-qr") {
		t.Errorf("coming back to the presenter view shows the QR again:\n%s", again)
	}

	// The phone holds the capability and not a session: it reads the
	// notes and never the pairing block.
	phone := mustGet(t, a, "/p/"+session+"/notes?t="+token, http.StatusOK, nil).Body.String()
	if !strings.Contains(phone, "Speaker notes") && !strings.Contains(phone, "Presenter view") {
		t.Errorf("the token holder cannot read the presenter view:\n%s", phone)
	}
	if strings.Contains(phone, remoteURL) {
		t.Errorf("the token holder is shown the pairing block:\n%s", phone)
	}

	// A stranger with neither gets nothing.
	mustGet(t, a, "/p/"+session+"/notes", http.StatusNotFound, nil)

	// Pressing Present again reuses the same session rather than
	// opening a second one on the same deck for the same person.
	second, _ := startPresenting(t, a, path, cookies)
	if second != session {
		t.Errorf("pressing Present twice opened a second session: %q then %q", session, second)
	}

	// The fullscreen surface is the sqid's own capability: anybody who
	// has the address can watch, with no token and no session.
	surface := mustGet(t, a, "/p/"+session, http.StatusOK, nil).Body.String()
	if !strings.Contains(surface, `<main id="main" slides-present-stage>`) || strings.Contains(surface, `<main rst-page id="main">`) {
		t.Errorf("the projector is not a full-screen stage outside the ordinary page wrapper:\n%s", surface)
	}
	if strings.Contains(surface, "<header estilo-bar") || strings.Contains(surface, "estilo-account") {
		t.Errorf("the projector surface carries app chrome:\n%s", surface)
	}
	if !strings.Contains(surface, "<section slides-slide") {
		t.Errorf("the fullscreen surface renders no slide:\n%s", surface)
	}
	if !strings.Contains(surface, "1 / 8") {
		t.Errorf("the fullscreen surface does not say where in the deck it is:\n%s", surface)
	}
	if !strings.Contains(surface, "<progress") {
		t.Errorf("the fullscreen surface has no progress element:\n%s", surface)
	}
	if strings.Contains(surface, "Speaker notes") {
		t.Errorf("the projector surface carries the speaker notes:\n%s", surface)
	}
}

// TestRemoteCommandAdvancesSlideAndPublishes: a phone posts "next" and
// every page watching the session hears about it — which is the whole
// mechanism, so it is asserted through the real stream rather than
// through the row.
func TestRemoteCommandAdvancesSlideAndPublishes(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)
	path := sampleDeck(t, a, cookies)
	session, token := startPresenting(t, a, path, cookies)

	srv := httptest.NewServer(a)
	defer srv.Close()

	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
	defer cancel()
	req, err := http.NewRequestWithContext(ctx, http.MethodGet, srv.URL+"/p/"+session+"/stream", nil)
	if err != nil {
		t.Fatalf("build the stream request: %v", err)
	}
	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		t.Fatalf("open the stream: %v", err)
	}
	defer resp.Body.Close()
	if got := resp.Header.Get("Content-Type"); got != "text/event-stream" {
		t.Fatalf("the stream's Content-Type is %q, want text/event-stream", got)
	}
	events := bufio.NewReader(resp.Body)

	// One event on connect, so a page that opened the stream after the
	// deck moved is right rather than merely hopeful.
	if data := nextSlideEvent(t, events); !strings.Contains(data, `"slide":1`) {
		t.Errorf("the connect event is %q, want slide 1", data)
	}

	rec := command(t, a, session, "next", token, "", nil)
	if rec.Code != http.StatusNoContent {
		t.Fatalf("POST command with no page to return to: status %d, want 204\n%s", rec.Code, rec.Body)
	}
	if data := nextSlideEvent(t, events); !strings.Contains(data, `"slide":2`) {
		t.Errorf("after next the event is %q, want slide 2", data)
	}

	// A browser form submission goes back where it came from.
	back := testOrigin + "/p/" + session + "/remote?t=" + token
	rec = command(t, a, session, "next", token, back, nil)
	if rec.Code != http.StatusSeeOther {
		t.Fatalf("POST command from a page: status %d, want 303\n%s", rec.Code, rec.Body)
	}
	if loc := rec.Header().Get("Location"); loc != back {
		t.Errorf("the command redirected to %q, want %q", loc, back)
	}
	if data := nextSlideEvent(t, events); !strings.Contains(data, `"slide":3`) {
		t.Errorf("after a second next the event is %q, want slide 3", data)
	}

	// Blackout is its own state, and it does not move the deck.
	rec = command(t, a, session, "blackout", token, "", nil)
	if rec.Code != http.StatusNoContent {
		t.Fatalf("POST blackout: status %d, want 204\n%s", rec.Code, rec.Body)
	}
	data := nextSlideEvent(t, events)
	if !strings.Contains(data, `"slide":3`) || !strings.Contains(data, `"blackout":true`) {
		t.Errorf("after blackout the event is %q, want slide 3 blacked out", data)
	}

	// goto names a slide; prev walks back; neither runs off an end.
	command(t, a, session, "goto", token, "", url.Values{"slide": {"8"}})
	if data := nextSlideEvent(t, events); !strings.Contains(data, `"slide":8`) {
		t.Errorf("after goto 8 the event is %q, want slide 8", data)
	}
	command(t, a, session, "next", token, "", nil)
	if data := nextSlideEvent(t, events); !strings.Contains(data, `"slide":8`) {
		t.Errorf("next past the last slide moved to %q, want to stay on slide 8", data)
	}

	// And the surface everyone is watching really shows it.
	surface := mustGet(t, a, "/p/"+session, http.StatusOK, nil).Body.String()
	if !strings.Contains(surface, "8 / 8") {
		t.Errorf("the surface does not show the session's own slide:\n%s", surface)
	}
	if !strings.Contains(surface, `data-blackout="true"`) {
		t.Errorf("the surface does not carry the blackout state:\n%s", surface)
	}
	if !strings.Contains(surface, "blacked out") {
		t.Errorf("the blackout is carried by colour alone, with no words:\n%s", surface)
	}

	// The two URLs the script uses come down as attributes rather than
	// being built in the browser (codex 5): on the projector they are
	// the session's own, and static/present.js reads them instead of
	// assembling a /p/ path out of a sqid it may not have.
	if !strings.Contains(surface, `data-stream="/p/`+session+`/stream"`) {
		t.Errorf("the surface does not name its own stream:\n%s", surface)
	}
	if !strings.Contains(surface, `data-fragment="/p/`+session+`?slide={n}&amp;fragment=1"`) {
		t.Errorf("the surface does not name its own fragment URL:\n%s", surface)
	}

	// The fragment is the same slide with no page around it — what the
	// script swaps in, and never a nested layout.
	fragment := mustGet(t, a, "/p/"+session+"?slide=2&fragment=1", http.StatusOK, nil).Body.String()
	if !strings.HasPrefix(strings.TrimSpace(fragment), "<section slides-slide") {
		t.Errorf("the fragment is not a bare slide:\n%s", fragment)
	}
	if strings.Contains(fragment, "<html") {
		t.Errorf("the fragment carries the whole page:\n%s", fragment)
	}
}

// nextSlideEvent reads events until a `slide` one arrives, returning
// its data line. Pings are skipped; the request's own context is the
// timeout, so a stream that never speaks fails the test rather than
// hanging it.
func nextSlideEvent(t *testing.T, r *bufio.Reader) string {
	t.Helper()
	var event string
	for {
		line, err := r.ReadString('\n')
		if err != nil {
			t.Fatalf("reading the stream: %v", err)
		}
		line = strings.TrimRight(line, "\r\n")
		switch {
		case strings.HasPrefix(line, "event: "):
			event = strings.TrimPrefix(line, "event: ")
		case strings.HasPrefix(line, "data: "):
			if event == "slide" {
				return strings.TrimPrefix(line, "data: ")
			}
		}
	}
}

// TestWrongRemoteTokenIs404: the token is the whole permission to move
// somebody else's deck, and a wrong one is not a 403 — a 403 would
// confirm the session is real to whoever is guessing.
func TestWrongRemoteTokenIs404(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)
	path := sampleDeck(t, a, cookies)
	session, token := startPresenting(t, a, path, cookies)

	wrong := strings.Repeat("a", len(token))
	if rec := command(t, a, session, "next", wrong, "", nil); rec.Code != http.StatusNotFound {
		t.Errorf("a command with the wrong token: status %d, want 404", rec.Code)
	}
	if rec := command(t, a, session, "next", "", "", nil); rec.Code != http.StatusNotFound {
		t.Errorf("a command with no token: status %d, want 404", rec.Code)
	}
	mustGet(t, a, "/p/"+session+"/remote?t="+wrong, http.StatusNotFound, nil)
	mustGet(t, a, "/p/"+session+"/remote", http.StatusNotFound, nil)
	// Signed in as the presenter is not the same as holding the remote:
	// the capability is what moves the deck.
	if rec := command(t, a, session, "next", wrong, "", nil); rec.Code != http.StatusNotFound {
		t.Errorf("a command with the wrong token from the presenter: status %d, want 404", rec.Code)
	}

	// And nothing moved.
	surface := mustGet(t, a, "/p/"+session, http.StatusOK, nil).Body.String()
	if !strings.Contains(surface, "1 / 8") {
		t.Errorf("a refused command moved the deck anyway:\n%s", surface)
	}

	// An unknown session is a 404 too, with the right token or without.
	mustGet(t, a, "/p/2222222222", http.StatusNotFound, nil)
	if rec := command(t, a, "2222222222", "next", token, "", nil); rec.Code != http.StatusNotFound {
		t.Errorf("a command against an unknown session: status %d, want 404", rec.Code)
	}
}

// TestEndedSessionIs410: a talk that is over is gone, not missing. The
// distinction is the point — somebody following a link to last week's
// session should be told it finished, and a dead pairing code should
// tell a stranger nothing at all.
func TestEndedSessionIs410(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)
	path := sampleDeck(t, a, cookies)
	session, token := startPresenting(t, a, path, cookies)

	notes := mustGet(t, a, "/p/"+session+"/notes?t="+token, http.StatusOK, cookies).Body.String()
	code := codeOn(t, notes)
	mustGet(t, a, "/r/"+code+"?t="+token, http.StatusSeeOther, nil)

	if rec := command(t, a, session, "end", token, "", nil); rec.Code != http.StatusNoContent {
		t.Fatalf("ending the session: status %d, want 204\n%s", rec.Code, rec.Body)
	}

	for _, target := range []string{
		"/p/" + session,
		"/p/" + session + "/notes?t=" + token,
		"/p/" + session + "/remote?t=" + token,
	} {
		rec := getHTML(t, a, target, cookies...)
		if rec.Code != http.StatusGone {
			t.Errorf("GET %s after the session ended: status %d, want 410", target, rec.Code)
		}
		if !strings.Contains(rec.Body.String(), "over") {
			t.Errorf("GET %s says nothing about the session being over:\n%s", target, rec.Body)
		}
	}
	if rec := command(t, a, session, "next", token, "", nil); rec.Code != http.StatusGone {
		t.Errorf("a command against an ended session: status %d, want 410", rec.Code)
	}
	// A dead code is a 404: a gone would tell whoever typed it that the
	// code was once real.
	mustGet(t, a, "/r/"+code+"?t="+token, http.StatusNotFound, nil)
	mustGet(t, a, "/r/"+code, http.StatusNotFound, nil)
}

// TestDeletingADeckEndsItsPresentations: deleting a deck takes its live
// talks with it.
//
// deleteDeck cascaded the update log, the grants and the share links
// and left the presentations behind, so a projector went on holding a
// session whose deck no longer existed, a pairing code went on being
// live, and every page watching sat there waiting for an event that
// was never coming. The row goes in the same transaction as the deck,
// and the hub is told the session is over, which is what a projector
// and a phone act on.
func TestDeletingADeckEndsItsPresentations(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)
	path := sampleDeck(t, a, cookies)
	session, token := startPresenting(t, a, path, cookies)

	notes := mustGet(t, a, "/p/"+session+"/notes?t="+token, http.StatusOK, cookies).Body.String()
	code := codeOn(t, notes)
	mustGet(t, a, "/p/"+session, http.StatusOK, nil)

	// A projector watching, so this asserts what a projector actually
	// hears rather than only what the database holds.
	srv := httptest.NewServer(a)
	defer srv.Close()
	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
	defer cancel()
	req, err := http.NewRequestWithContext(ctx, http.MethodGet, srv.URL+"/p/"+session+"/stream", nil)
	if err != nil {
		t.Fatalf("build the stream request: %v", err)
	}
	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		t.Fatalf("open the stream: %v", err)
	}
	defer resp.Body.Close()
	events := bufio.NewReader(resp.Body)
	if data := nextSlideEvent(t, events); !strings.Contains(data, `"ended":false`) {
		t.Fatalf("the connect event is %q, want a live session", data)
	}

	rec := post(t, a, path+"/delete", nil, cookies...)
	if rec.Code != http.StatusSeeOther {
		t.Fatalf("POST %s/delete: status %d, want 303\n%s", path, rec.Code, rec.Body)
	}

	if data := nextSlideEvent(t, events); !strings.Contains(data, `"ended":true`) {
		t.Errorf("the event after the deck was deleted is %q, want the session ended", data)
	}

	// Gone or never-was are both honest here; still answering is not.
	if rec := get(t, a, "/p/"+session); rec.Code != http.StatusNotFound && rec.Code != http.StatusGone {
		t.Errorf("GET /p/%s after its deck was deleted: status %d, want 404 or 410\n%s", session, rec.Code, rec.Body)
	}
	// The pairing code is a 404 rather than a gone, for the reason a
	// dead code always is: it tells whoever typed it nothing.
	mustGet(t, a, "/r/"+code, http.StatusNotFound, nil)
	mustGet(t, a, "/r/"+code+"?t="+token, http.StatusNotFound, nil)

	var left int64
	if err := a.db.G.Raw("SELECT COUNT(*) FROM presentations").Scan(&left).Error; err != nil {
		t.Fatalf("count presentations: %v", err)
	}
	if left != 0 {
		t.Errorf("%d presentation rows outlived their deck, want 0", left)
	}
}

// TestScriptlessRemoteButtonsAreForms: the remote is four buttons, and
// with scripts off each one is a form that posts and comes back. This
// is §8's floor for the one screen most likely to be used on a phone
// with something blocking the script.
func TestScriptlessRemoteButtonsAreForms(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)
	path := sampleDeck(t, a, cookies)
	session, token := startPresenting(t, a, path, cookies)

	remote := mustGet(t, a, "/p/"+session+"/remote?t="+token, http.StatusOK, nil).Body.String()
	if n := strings.Count(remote, `<form method="post"`); n != 4 {
		t.Errorf("the remote has %d forms, want 4 (previous, next, blackout, end):\n%s", n, remote)
	}
	for _, op := range []string{"prev", "next", "blackout", "end"} {
		if !strings.Contains(remote, `value="`+op+`"`) {
			t.Errorf("the remote has no %s button:\n%s", op, remote)
		}
	}
	if !strings.Contains(remote, `action="/p/`+session+`/command"`) {
		t.Errorf("the remote's forms do not post commands:\n%s", remote)
	}
	if !strings.Contains(remote, `value="`+token+`"`) {
		t.Errorf("the remote's forms carry no capability:\n%s", remote)
	}
	// The phone shows what is on screen now and what is coming, so the
	// presenter is not reading the room off a projector behind them.
	// A picture of each, not a live copy: two whole slides of DOM on a
	// phone over a hotel wifi is a lot of markup for a preview
	// (presentation.go's slideThumbImg).
	if !strings.Contains(remote, `src="/p/`+session+`/slides/`) {
		t.Errorf("the remote shows no picture of the slide:\n%s", remote)
	}
	if strings.Contains(remote, "<section slides-slide") {
		t.Errorf("the remote still renders a whole slide:\n%s", remote)
	}

	// Blacking out changes what the button says, not only how it looks.
	if !strings.Contains(remote, "Black the screen") {
		t.Errorf("the remote's blackout button is unlabelled:\n%s", remote)
	}
	command(t, a, session, "blackout", token, "", nil)
	blacked := mustGet(t, a, "/p/"+session+"/remote?t="+token, http.StatusOK, nil).Body.String()
	if !strings.Contains(blacked, "Show the screen") {
		t.Errorf("the blackout button does not change its words when the screen is black:\n%s", blacked)
	}

	// The pair page is the way in for a typed code, and it is a form
	// too — the QR is the shortcut, never the only route.
	notes := mustGet(t, a, "/p/"+session+"/notes?t="+token, http.StatusOK, cookies).Body.String()
	code := codeOn(t, notes)
	pair := mustGet(t, a, "/r/"+code, http.StatusOK, nil).Body.String()
	if !strings.Contains(pair, "<form") {
		t.Errorf("the pair page has no form:\n%s", pair)
	}
	if !strings.Contains(pair, code) {
		t.Errorf("the pair page does not carry the code that reached it:\n%s", pair)
	}
	// The QR carries both halves, so scanning it lands on the remote.
	rec := get(t, a, "/r/"+code+"?t="+token)
	if rec.Code != http.StatusSeeOther {
		t.Fatalf("GET /r/{code}?t=: status %d, want 303\n%s", rec.Code, rec.Body)
	}
	if loc := rec.Header().Get("Location"); loc != "/p/"+session+"/remote?t="+token {
		t.Errorf("the pair redirect goes to %q, want the remote", loc)
	}
}

// TestFollowOfferedOnlyWhileLive: a share link offers to follow the
// presenter while somebody is presenting, and goes back to being an
// ordinary read-only deck when nobody is.
func TestFollowOfferedOnlyWhileLive(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)
	path := sampleDeck(t, a, cookies)
	token := mintShareLink(t, a, path, cookies)
	share := "/s/" + token

	quiet := mustGet(t, a, share, http.StatusOK, nil).Body.String()
	if strings.Contains(quiet, "Follow the presenter") {
		t.Errorf("a share link offers to follow with nobody presenting:\n%s", quiet)
	}
	// Nothing to follow: the flag is not a way to reach a session that
	// does not exist.
	rec := get(t, a, share+"?follow=1")
	if rec.Code != http.StatusSeeOther {
		t.Errorf("?follow=1 with nobody presenting: status %d, want 303", rec.Code)
	}

	session, remoteToken := startPresenting(t, a, path, cookies)
	command(t, a, session, "next", remoteToken, "", nil)

	offered := mustGet(t, a, share, http.StatusOK, nil).Body.String()
	if !strings.Contains(offered, "Follow the presenter") {
		t.Errorf("a live session is not offered on the share link:\n%s", offered)
	}
	if !strings.Contains(offered, share+"?follow=1") {
		t.Errorf("the follow offer does not link to the follow surface:\n%s", offered)
	}

	follow := mustGet(t, a, share+"?follow=1", http.StatusOK, nil).Body.String()
	if !strings.Contains(follow, "2 / 8") {
		t.Errorf("following does not show the presenter's own slide:\n%s", follow)
	}
	if !strings.Contains(follow, `http-equiv="refresh"`) {
		t.Errorf("the follow surface does not refresh with scripts off:\n%s", follow)
	}
	if !strings.Contains(follow, share+`"`) {
		t.Errorf("the follow surface offers no way back to browsing:\n%s", follow)
	}
	// Read-only means read-only: an audience cannot move the deck.
	if strings.Contains(follow, "<form") {
		t.Errorf("the follow surface carries a control:\n%s", follow)
	}
	if strings.Contains(follow, remoteToken) {
		t.Errorf("the follow surface leaks the remote capability:\n%s", follow)
	}
	// And it never leaks the notes, which is what a share link is not.
	if strings.Contains(follow, "Speaker notes") {
		t.Errorf("the follow surface carries the speaker notes:\n%s", follow)
	}

	command(t, a, session, "end", remoteToken, "", nil)
	after := mustGet(t, a, share, http.StatusOK, nil).Body.String()
	if strings.Contains(after, "Follow the presenter") {
		t.Errorf("the follow offer outlives the session:\n%s", after)
	}
	if rec := get(t, a, share+"?follow=1"); rec.Code != http.StatusSeeOther {
		t.Errorf("following an ended session: status %d, want 303 back to the deck", rec.Code)
	}
}

// TestEveryPresentingPageSaysWhichSlideItShows: every page that loads
// static/present.js puts the slide it was rendered for on the script's
// root as data-slide, the same 1-based number the stream's events
// carry. The presenter view and the remote once had none, so the
// script took them to be on slide 0 and reloaded on every event —
// the stream's first included — forever (polish audit B3). The
// browser half is TestBrowserPresentingScreensHoldStill; this one is
// in the plain suite so the gate holds it too.
func TestEveryPresentingPageSaysWhichSlideItShows(t *testing.T) {
	a := newApp(t)
	cookies := signedIn(t, a, allowedAddress)
	path := sampleDeck(t, a, cookies)
	session, token := startPresenting(t, a, path, cookies)
	command(t, a, session, "next", token, "", nil)

	for _, page := range []string{
		"/p/" + session + "?t=" + token,
		"/p/" + session + "/notes?t=" + token,
		"/p/" + session + "/remote?t=" + token,
	} {
		body := mustGet(t, a, page, http.StatusOK, cookies).Body.String()
		if !strings.Contains(body, `static/present`) {
			t.Errorf("%s no longer loads present.js; this test is about the pages that do", page)
		}
		if !strings.Contains(body, `data-slide="2"`) {
			t.Errorf("%s: the script root does not say data-slide=\"2\" after one next:\n%s", page, body)
		}
	}
}