// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
// SPDX-License-Identifier: PolyForm-Noncommercial-1.0.0

package admin

import (
	"bytes"
	"mime/multipart"
	"net/http"
	"net/http/httptest"
	"net/url"
	"os"
	"path/filepath"
	"strings"
	"testing"
	"time"

	"sourcedock.dev/petrbalvin/volumen/internal/biblio"
	"sourcedock.dev/petrbalvin/volumen/internal/post"
	"sourcedock.dev/petrbalvin/volumen/internal/preview"
)

func writeTestPost(t *testing.T, f *fixture, name, body string) {
	t.Helper()
	path := filepath.Join(f.contentDir, name)
	if err := os.WriteFile(path, []byte(body), 0o644); err != nil {
		t.Fatalf("write post: %v", err)
	}
}

const samplePost = `+++
title = "Hello"
slug = "hello"
date = 2026-08-18
lang = "cs"
tags = ["go", "blog"]
+++

Hello **body**.
`

func TestDashboardRenders(t *testing.T) {
	f := newFixture(t)
	writeTestPost(t, f, "hello.md", samplePost)
	cookie := login(t, f, "admin", "correct-horse-9")

	req := httptest.NewRequest(http.MethodGet, "/admin/", nil)
	req.AddCookie(cookie)
	rec := f.do(t, req)
	if rec.Code != http.StatusOK {
		t.Fatalf("code = %d", rec.Code)
	}
	body := rec.Body.String()
	for _, want := range []string{
		"Posts", "Hello", `data-slug="hello"`, "Published", "Drafts",
		`data-tag="go"`, "1 post", "Log out",
	} {
		if !strings.Contains(body, want) {
			t.Fatalf("missing %q", want)
		}
	}
}

func TestDashboardGroupsLanguageVariants(t *testing.T) {
	f := newFixture(t)
	writeTestPost(t, f, "hello.md", `+++
title = "Hello"
slug = "hello"
date = 2026-08-18
lang = "en"
translations = { cs = "ahoj" }
+++

English body.
`)
	writeTestPost(t, f, "ahoj.md", `+++
title = "Ahoj"
slug = "ahoj"
date = 2026-08-18
lang = "cs"
translations = { en = "hello" }
+++

České tělo.
`)
	writeTestPost(t, f, "lonely.md", `+++
title = "Lonely"
slug = "lonely"
date = 2026-08-17
lang = "en"
+++

Alone.
`)
	cookie := login(t, f, "admin", "correct-horse-9")

	req := httptest.NewRequest(http.MethodGet, "/admin/", nil)
	req.AddCookie(cookie)
	body := f.do(t, req).Body.String()

	// The linked pair is one card, the unrelated post the second one.
	if got := strings.Count(body, `<article class="post"`); got != 2 {
		t.Fatalf("cards = %d, want 2", got)
	}
	if got := strings.Count(body, `data-variants=`); got != 1 {
		t.Fatalf("cards with variants = %d, want 1", got)
	}
	if !strings.Contains(body, `data-slug="hello"`) || strings.Contains(body, `data-slug="ahoj"`) {
		t.Fatal("the variant ahoj must not stand as its own card")
	}
	// Both language versions are reachable from the switch chips.
	if !strings.Contains(body, `data-lang="en"`) || !strings.Contains(body, `data-lang="cs"`) {
		t.Fatal("the card must offer both language variants")
	}
	// The selection acts on the whole publication: both slugs ride along.
	if !strings.Contains(body, `value="hello,ahoj"`) && !strings.Contains(body, `value="ahoj,hello"`) {
		t.Fatal("the bulk selection must carry every variant slug")
	}
}

func TestDashboardRequiresLogin(t *testing.T) {
	f := newFixture(t)
	rec := f.do(t, httptest.NewRequest(http.MethodGet, "/admin/", nil))
	if rec.Code != http.StatusSeeOther || rec.Header().Get("Location") != "/admin/login" {
		t.Fatalf("code=%d location=%q", rec.Code, rec.Header().Get("Location"))
	}
}

func TestNewFormRendersEditor(t *testing.T) {
	f := newFixture(t)
	cookie := login(t, f, "admin", "correct-horse-9")
	req := httptest.NewRequest(http.MethodGet, "/admin/posts/new", nil)
	req.AddCookie(cookie)
	rec := f.do(t, req)
	if rec.Code != http.StatusOK {
		t.Fatalf("code = %d", rec.Code)
	}
	body := rec.Body.String()
	for _, want := range []string{"New post", `id="post-form"`, `action="/admin/posts"`, "Markdown"} {
		if !strings.Contains(body, want) {
			t.Fatalf("missing %q", want)
		}
	}
}

func TestEditFormRendersPost(t *testing.T) {
	f := newFixture(t)
	writeTestPost(t, f, "hello.md", samplePost)
	cookie := login(t, f, "admin", "correct-horse-9")
	req := httptest.NewRequest(http.MethodGet, "/admin/posts/hello/edit", nil)
	req.AddCookie(cookie)
	rec := f.do(t, req)
	if rec.Code != http.StatusOK {
		t.Fatalf("code = %d", rec.Code)
	}
	body := rec.Body.String()
	for _, want := range []string{
		"Edit post", `value="Hello"`, `value="hello"`, `readonly`,
		`action="/admin/posts/hello"`, "Hello **body**.",
	} {
		if !strings.Contains(body, want) {
			t.Fatalf("missing %q", want)
		}
	}

	req = httptest.NewRequest(http.MethodGet, "/admin/posts/ghost/edit", nil)
	req.AddCookie(cookie)
	if rec := f.do(t, req); rec.Code != http.StatusNotFound {
		t.Fatalf("code = %d", rec.Code)
	}
}

func TestCreatePostViaForm(t *testing.T) {
	f := newFixture(t)
	cookie := login(t, f, "admin", "correct-horse-9")
	csrf := csrfFromSession(t, f, cookie)

	form := url.Values{
		"_csrf":  {csrf},
		"title":  {"Fresh"},
		"slug":   {"fresh"},
		"lang":   {"cs"},
		"tags":   {"a, b"},
		"body":   {"content"},
		"draft":  {"on"},
		"author": {"Petr"},
	}
	rec := postForm(t, f, "/admin/posts", form, cookie)
	if rec.Code != http.StatusSeeOther || rec.Header().Get("Location") != "/admin/?saved=created" {
		t.Fatalf("code=%d location=%q body=%s", rec.Code, rec.Header().Get("Location"), rec.Body.String())
	}
	if p := f.findPost("fresh"); p == nil || p.Title() != "Fresh" || !p.Draft() {
		t.Fatalf("post = %v", p)
	}
	if len(f.events) == 0 || f.events[len(f.events)-1] != "post.created" {
		t.Fatalf("events = %v", f.events)
	}
}

func TestCreatePostValidationRendersForm(t *testing.T) {
	f := newFixture(t)
	cookie := login(t, f, "admin", "correct-horse-9")
	csrf := csrfFromSession(t, f, cookie)

	form := url.Values{"_csrf": {csrf}, "title": {"X"}, "slug": {"Bad Slug"}, "body": {"b"}}
	rec := postForm(t, f, "/admin/posts", form, cookie)
	if rec.Code != http.StatusUnprocessableEntity {
		t.Fatalf("code = %d", rec.Code)
	}
	if !strings.Contains(rec.Body.String(), "Invalid slug.") {
		t.Fatal("validation message missing")
	}
}

func TestUpdatePostKeepsPath(t *testing.T) {
	f := newFixture(t)
	writeTestPost(t, f, "hello.md", samplePost)
	cookie := login(t, f, "admin", "correct-horse-9")
	csrf := csrfFromSession(t, f, cookie)

	form := url.Values{
		"_csrf": {csrf}, "title": {"Updated"}, "slug": {"hello"},
		"lang": {"cs"}, "tags": {"go"}, "body": {"new body"},
	}
	rec := postForm(t, f, "/admin/posts/hello", form, cookie)
	if rec.Code != http.StatusSeeOther {
		t.Fatalf("code = %d", rec.Code)
	}
	p := f.findPost("hello")
	if p == nil || p.Title() != "Updated" || p.Body != "new body\n" {
		t.Fatalf("post = %v", p)
	}
}

// The bibliography card writes the refs tables through the whole save
// path: the editor's JSON reaches the file as [[refs]] blocks, an
// author's ORCID survives as a name table, and a frontmatter key the
// form never names round-trips untouched beside them.
func TestEditorSavesTheBibliography(t *testing.T) {
	f := newFixture(t)
	writeTestPost(t, f, "hello.md", `+++
title = "Cite"
slug = "hello"
date = 2026-08-18
note = "keep me"
tags = ["go"]

[[refs]]
raw = "Old entry."
+++
Cites [1].
`)
	cookie := login(t, f, "admin", "correct-horse-9")
	csrf := csrfFromSession(t, f, cookie)

	// The edit form hands the stored list to the card's script, and the
	// card sits below the editor with its own bounded list.
	req := httptest.NewRequest(http.MethodGet, "/admin/posts/hello/edit", nil)
	req.AddCookie(cookie)
	body := f.do(t, req).Body.String()
	for _, want := range []string{`id="refs-card"`, "Old entry.", `id="ref-row-template"`, `id="refs-count"`, `class="refs-scroll"`} {
		if !strings.Contains(body, want) {
			t.Fatalf("edit form missing %q", want)
		}
	}
	if strings.Index(body, `id="refs-card"`) < strings.Index(body, `id="post-form"`) {
		t.Fatal("the bibliography card must not precede the form")
	}
	editorSection := strings.Index(body, `id="markdown-view"`)
	refsCard := strings.Index(body, `id="refs-card"`)
	if editorSection == -1 || refsCard == -1 || refsCard < editorSection {
		t.Fatal("the bibliography card must sit below the editor")
	}

	form := url.Values{
		"_csrf": {csrf}, "title": {"Cite"}, "slug": {"hello"}, "body": {"Cites [1].\n\n[[refs]]\n"},
		"refs": {`[` +
			`{"num":2,"raw":"Kept and edited."},` +
			`{"raw":"Added verbatim.","doi":"10.1086/300499"},` +
			`{"authors":[{"name":"Adam Riess","orcid":"0000-0002-1825-0097"}],` +
			`"title":"Observational Evidence","year":"1998"}` +
			`]`},
	}
	rec := postForm(t, f, "/admin/posts/hello", form, cookie)
	if rec.Code != http.StatusSeeOther {
		t.Fatalf("code = %d, body = %s", rec.Code, rec.Body.String())
	}

	raw, err := os.ReadFile(filepath.Join(f.contentDir, "hello.md"))
	if err != nil {
		t.Fatalf("read post: %v", err)
	}
	file := string(raw)
	for _, want := range []string{
		`note = "keep me"`,
		"[[refs]]",
		"raw = \"Kept and edited.\"",
		"num = 2",
		"raw = \"Added verbatim.\"",
		`doi = "10.1086/300499"`,
		`title = "Observational Evidence"`,
		`{name = "Adam Riess", orcid = "0000-0002-1825-0097"}`,
	} {
		if !strings.Contains(file, want) {
			t.Fatalf("saved file missing %q:\n%s", want, file)
		}
	}
	if strings.Contains(file, "Old entry.") {
		t.Fatalf("the replaced entry survived:\n%s", file)
	}
	// The rewritten list renders with its citations linked.
	p := f.findPost("hello")
	refs := p.RefsLinked()
	if len(refs) != 3 {
		t.Fatalf("refs = %v", refs)
	}
	if refs[0].Num != 2 || refs[0].Raw != "Kept and edited." {
		t.Fatalf("first entry = %+v", refs[0])
	}
	html, err := p.HTML()
	if err != nil {
		t.Fatalf("render: %v", err)
	}
	// The preserved numbers name the anchors: the first entry keeps its
	// explicit num = 2, so the list carries ref-2 and ref-3 and no ref-1.
	if !strings.Contains(html, `id="ref-2"`) || !strings.Contains(html, `id="ref-3"`) {
		t.Fatalf("rendered list wrong:\n%s", html)
	}
	if strings.Contains(html, `id="ref-1"`) {
		t.Fatalf("an unnumbered anchor appeared:\n%s", html)
	}
}

// A save whose form carries no refs field keeps the stored list, so the
// bibliography never disappears under a page that does not edit it.
func TestEditorWithoutRefsKeepsTheStoredList(t *testing.T) {
	f := newFixture(t)
	writeTestPost(t, f, "hello.md", `+++
title = "Cite"
slug = "hello"
date = 2026-08-18

[[refs]]
raw = "Old entry."
+++
Body.
`)
	cookie := login(t, f, "admin", "correct-horse-9")
	csrf := csrfFromSession(t, f, cookie)

	form := url.Values{
		"_csrf": {csrf}, "title": {"Cite"}, "slug": {"hello"}, "body": {"Body.\n"},
	}
	if rec := postForm(t, f, "/admin/posts/hello", form, cookie); rec.Code != http.StatusSeeOther {
		t.Fatalf("code = %d", rec.Code)
	}
	if refs := f.findPost("hello").Refs(); len(refs) != 1 || refs[0].Raw != "Old entry." {
		t.Fatalf("refs = %v", refs)
	}
}

func TestDeleteAndUndeleteFlow(t *testing.T) {
	f := newFixture(t)
	writeTestPost(t, f, "hello.md", samplePost)
	cookie := login(t, f, "admin", "correct-horse-9")
	csrf := csrfFromSession(t, f, cookie)

	rec := postForm(t, f, "/admin/posts/hello/delete", url.Values{"_csrf": {csrf}}, cookie)
	if rec.Code != http.StatusSeeOther ||
		!strings.Contains(rec.Header().Get("Location"), "saved=deleted&undo=hello") {
		t.Fatalf("code=%d location=%q", rec.Code, rec.Header().Get("Location"))
	}
	if f.findPost("hello") != nil {
		t.Fatal("post still present")
	}
	// The webhook contract names the post under the "post" key, the same
	// shape every other post event and the API's delete endpoint deliver.
	last := len(f.events) - 1
	if last < 0 || f.events[last] != "post.deleted" {
		t.Fatalf("events = %v", f.events)
	}
	inner, ok := f.payloads[last]["post"].(map[string]any)
	if !ok || inner["slug"] != "hello" || inner["title"] != "Hello" {
		t.Fatalf("post.deleted payload = %#v", f.payloads[last])
	}

	rec = postForm(t, f, "/admin/posts/hello/undelete", url.Values{"_csrf": {csrf}}, cookie)
	if rec.Code != http.StatusSeeOther || rec.Header().Get("Location") != "/admin/?saved=undone" {
		t.Fatalf("code=%d location=%q", rec.Code, rec.Header().Get("Location"))
	}
	if f.findPost("hello") == nil {
		t.Fatal("post not restored")
	}
}

// A bulk delete delivers the same post.deleted shape as the single
// delete, so a subscriber cannot tell which screen the change came from.
func TestBulkDeleteEventShape(t *testing.T) {
	f := newFixture(t)
	writeTestPost(t, f, "hello.md", samplePost)
	cookie := login(t, f, "admin", "correct-horse-9")
	csrf := csrfFromSession(t, f, cookie)

	rec := postForm(t, f, "/admin/posts/bulk",
		url.Values{"_csrf": {csrf}, "action": {"delete"}, "slugs": {"hello"}}, cookie)
	if rec.Code != http.StatusSeeOther || !strings.Contains(rec.Header().Get("Location"), "n=1") {
		t.Fatalf("code=%d location=%q", rec.Code, rec.Header().Get("Location"))
	}
	last := len(f.events) - 1
	if last < 0 || f.events[last] != "post.deleted" {
		t.Fatalf("events = %v", f.events)
	}
	inner, ok := f.payloads[last]["post"].(map[string]any)
	if !ok || inner["slug"] != "hello" {
		t.Fatalf("post.deleted payload = %#v", f.payloads[last])
	}
}

func TestDuplicateCreatesDraftCopy(t *testing.T) {
	f := newFixture(t)
	writeTestPost(t, f, "hello.md", samplePost)
	cookie := login(t, f, "admin", "correct-horse-9")
	csrf := csrfFromSession(t, f, cookie)

	rec := postForm(t, f, "/admin/posts/hello/duplicate", url.Values{"_csrf": {csrf}}, cookie)
	if rec.Code != http.StatusSeeOther ||
		!strings.Contains(rec.Header().Get("Location"), "/admin/posts/hello-copy/edit") {
		t.Fatalf("code=%d location=%q", rec.Code, rec.Header().Get("Location"))
	}
	copyPost := f.findPost("hello-copy")
	if copyPost == nil || !copyPost.Draft() {
		t.Fatalf("copy = %v", copyPost)
	}
	if copyPost.DateString() != "" {
		t.Fatalf("copy kept the date: %q", copyPost.DateString())
	}

	// A second duplicate gets the -copy-2 suffix.
	rec = postForm(t, f, "/admin/posts/hello/duplicate", url.Values{"_csrf": {csrf}}, cookie)
	if !strings.Contains(rec.Header().Get("Location"), "hello-copy-2") {
		t.Fatalf("location = %q", rec.Header().Get("Location"))
	}
}

// A duplicate that cannot be created must say so on the dashboard, not
// disappear behind a silent redirect.
func TestDuplicateFailureIsReported(t *testing.T) {
	f := newFixture(t)
	writeTestPost(t, f, "hello.md", `+++
title = "Hello"
slug = "hello"
date = 2026-08-18
doi = "not-a-doi"
+++

Body.
`)
	cookie := login(t, f, "admin", "correct-horse-9")
	csrf := csrfFromSession(t, f, cookie)

	rec := postForm(t, f, "/admin/posts/hello/duplicate", url.Values{"_csrf": {csrf}}, cookie)
	if rec.Code != http.StatusSeeOther || rec.Header().Get("Location") != "/admin/?saved=duplicate_failed" {
		t.Fatalf("code=%d location=%q", rec.Code, rec.Header().Get("Location"))
	}
	if f.findPost("hello-copy") != nil {
		t.Fatal("a rejected duplicate must not be saved")
	}
}

// The editor's API link carries a valid preview token, so it opens a
// draft as well as a published post.
func TestEditFormCarriesPreviewToken(t *testing.T) {
	f := newFixture(t)
	writeTestPost(t, f, "hello.md", samplePost)
	cookie := login(t, f, "admin", "correct-horse-9")

	req := httptest.NewRequest(http.MethodGet, "/admin/posts/hello/edit", nil)
	req.AddCookie(cookie)
	body := f.do(t, req).Body.String()

	mark := `/api/volumen/posts/hello?preview_token=`
	i := strings.Index(body, mark)
	if i < 0 {
		t.Fatal("API link without a preview token")
	}
	token, _, _ := strings.Cut(body[i+len(mark):], `"`)
	if !preview.Valid(token, "hello", f.admin.deps.PreviewKey, time.Now()) {
		t.Fatalf("preview token invalid: %q", token)
	}
}

func TestBulkActions(t *testing.T) {
	f := newFixture(t)
	writeTestPost(t, f, "a.md", "+++\nslug = \"a\"\ntitle = \"A\"\ndraft = true\n+++\nx\n")
	writeTestPost(t, f, "b.md", "+++\nslug = \"b\"\ntitle = \"B\"\n+++\nx\n")
	cookie := login(t, f, "admin", "correct-horse-9")
	csrf := csrfFromSession(t, f, cookie)

	rec := postForm(t, f, "/admin/posts/bulk",
		url.Values{"_csrf": {csrf}, "action": {"publish"}, "slugs": {"a"}}, cookie)
	if rec.Code != http.StatusSeeOther || !strings.Contains(rec.Header().Get("Location"), "bulk=publish&n=1") {
		t.Fatalf("code=%d location=%q", rec.Code, rec.Header().Get("Location"))
	}
	if f.findPost("a").Draft() {
		t.Fatal("post not published")
	}

	rec = postForm(t, f, "/admin/posts/bulk",
		url.Values{"_csrf": {csrf}, "action": {"delete"}, "slugs": {"a,b"}}, cookie)
	if !strings.Contains(rec.Header().Get("Location"), "n=2") {
		t.Fatalf("location = %q", rec.Header().Get("Location"))
	}
	if f.findPost("a") != nil || f.findPost("b") != nil {
		t.Fatal("posts not deleted")
	}
}

func TestSlugExistsEndpoint(t *testing.T) {
	f := newFixture(t)
	writeTestPost(t, f, "hello.md", samplePost)
	cookie := login(t, f, "admin", "correct-horse-9")

	for path, want := range map[string]string{
		"/admin/posts/exists?slug=hello":               `"available":false`,
		"/admin/posts/exists?slug=fresh":               `"available":true`,
		"/admin/posts/exists?slug=":                    `"available":true`,
		"/admin/posts/exists?slug=hello&exclude=hello": `"available":true`,
	} {
		req := httptest.NewRequest(http.MethodGet, path, nil)
		req.AddCookie(cookie)
		rec := f.do(t, req)
		if rec.Code != http.StatusOK || !strings.Contains(rec.Body.String(), want) {
			t.Fatalf("%s: code=%d body=%s", path, rec.Code, rec.Body.String())
		}
	}
}

func TestPreviewEndpoint(t *testing.T) {
	f := newFixture(t)
	cookie := login(t, f, "admin", "correct-horse-9")
	csrf := csrfFromSession(t, f, cookie)

	rec := postForm(t, f, "/admin/preview", url.Values{"_csrf": {csrf}, "body": {"**bold**"}}, cookie)
	if rec.Code != http.StatusOK || !strings.Contains(rec.Body.String(), "<strong>bold</strong>") {
		t.Fatalf("code=%d body=%s", rec.Code, rec.Body.String())
	}
}

func TestPreviewLinkEndpoint(t *testing.T) {
	f := newFixture(t)
	writeTestPost(t, f, "draft.md", "+++\nslug = \"d\"\ndraft = true\n+++\nx\n")
	cookie := login(t, f, "admin", "correct-horse-9")
	req := httptest.NewRequest(http.MethodGet, "/admin/posts/d/preview-link", nil)
	req.AddCookie(cookie)
	rec := f.do(t, req)
	if rec.Code != http.StatusOK || !strings.Contains(rec.Body.String(), "preview_token=") {
		t.Fatalf("code=%d body=%s", rec.Code, rec.Body.String())
	}
}

func TestImportFlow(t *testing.T) {
	f := newFixture(t)
	cookie := login(t, f, "admin", "correct-horse-9")
	csrf := csrfFromSession(t, f, cookie)

	rec := multipartForm(t, f, "/admin/posts/import", cookie, csrf,
		"file", "imported.md", "+++\ntitle = \"Imported\"\nslug = \"imported\"\n+++\nbody\n")
	if rec.Code != http.StatusSeeOther || rec.Header().Get("Location") != "/admin/posts/imported/edit" {
		t.Fatalf("code=%d body=%s", rec.Code, rec.Body.String())
	}
	if f.findPost("imported") == nil {
		t.Fatal("import not saved")
	}

	// Non-.md rejected.
	rec = multipartForm(t, f, "/admin/posts/import", cookie, csrf,
		"file", "evil.txt", "content")
	if rec.Code != http.StatusUnprocessableEntity {
		t.Fatalf("code = %d", rec.Code)
	}

	// Import without a slug derives one from the file name.
	rec = multipartForm(t, f, "/admin/posts/import", cookie, csrf,
		"file", "derived-slug.md", "Just a body, no frontmatter.\n")
	if rec.Code != http.StatusSeeOther {
		t.Fatalf("code=%d body=%s", rec.Code, rec.Body.String())
	}
	if f.findPost("derived-slug") == nil {
		t.Fatal("derived slug import failed")
	}
}

func TestDownloadAndHistory(t *testing.T) {
	f := newFixture(t)
	writeTestPost(t, f, "hello.md", samplePost)
	cookie := login(t, f, "admin", "correct-horse-9")
	csrf := csrfFromSession(t, f, cookie)

	// Saving twice archives one revision.
	form := url.Values{
		"_csrf": {csrf}, "title": {"Hello"}, "slug": {"hello"},
		"lang": {"cs"}, "body": {"changed"},
	}
	postForm(t, f, "/admin/posts/hello", form, cookie)

	req := httptest.NewRequest(http.MethodGet, "/admin/posts/hello/download", nil)
	req.AddCookie(cookie)
	rec := f.do(t, req)
	if rec.Code != http.StatusOK || !strings.Contains(rec.Body.String(), "title = \"Hello\"") {
		t.Fatalf("download code=%d body=%s", rec.Code, rec.Body.String())
	}
	if !strings.Contains(rec.Header().Get("Content-Disposition"), `filename="hello.md"`) {
		t.Fatalf("disposition = %q", rec.Header().Get("Content-Disposition"))
	}

	req = httptest.NewRequest(http.MethodGet, "/admin/posts/hello/history", nil)
	req.AddCookie(cookie)
	rec = f.do(t, req)
	if rec.Code != http.StatusOK || !strings.Contains(rec.Body.String(), "History") {
		t.Fatalf("history code=%d", rec.Code)
	}
	if !strings.Contains(rec.Body.String(), " kB") {
		t.Fatal("revision size missing")
	}
}

func TestUploadRejectsGarbage(t *testing.T) {
	f := newFixture(t)
	cookie := login(t, f, "admin", "correct-horse-9")
	csrf := csrfFromSession(t, f, cookie)

	rec := multipartForm(t, f, "/admin/uploads", cookie, csrf,
		"file", "x.webp", "not an image at all")
	if rec.Code != http.StatusUnsupportedMediaType {
		t.Fatalf("code=%d body=%s", rec.Code, rec.Body.String())
	}

	webpData := append([]byte("RIFF"), 0, 0, 0, 0)
	webpData = append(webpData, []byte("WEBPVP8 ")...)
	rec = multipartForm(t, f, "/admin/uploads", cookie, csrf,
		"file", "pic.png", string(webpData))
	if rec.Code != http.StatusOK || !strings.Contains(rec.Body.String(), "/media/") {
		t.Fatalf("code=%d body=%s", rec.Code, rec.Body.String())
	}
}

func TestCSRFRequiredOnMutations(t *testing.T) {
	f := newFixture(t)
	cookie := login(t, f, "admin", "correct-horse-9")
	for _, path := range []string{
		"/admin/posts", "/admin/posts/bulk", "/admin/preview",
		"/admin/posts/import",
	} {
		req := httptest.NewRequest(http.MethodPost, path, strings.NewReader("_csrf=wrong"))
		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
		req.AddCookie(cookie)
		if rec := f.do(t, req); rec.Code != http.StatusForbidden {
			t.Fatalf("%s: code = %d, want 403", path, rec.Code)
		}
	}
}

// --- helpers ---------------------------------------------------------------

func (f *fixture) findPost(slug string) *post.Post {
	return f.storeObj.Find(slug, "")
}

// csrfFromSession performs the login GET flow and returns the CSRF token.
func csrfFromSession(t *testing.T, f *fixture, cookie *http.Cookie) string {
	t.Helper()
	req := httptest.NewRequest(http.MethodGet, "/admin/login", nil)
	req.AddCookie(cookie)
	rec := f.do(t, req)
	if rec.Code == http.StatusOK {
		return extractCSRF(t, rec.Body.String())
	}
	// Authenticated: pull the token from the session instead.
	sess := f.store.Load(req)
	return CSRFToken(sess)
}

func postForm(t *testing.T, f *fixture, path string, form url.Values, cookie *http.Cookie) *httptest.ResponseRecorder {
	t.Helper()
	req := httptest.NewRequest(http.MethodPost, path, strings.NewReader(form.Encode()))
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	req.AddCookie(cookie)
	return f.do(t, req)
}

func multipartForm(t *testing.T, f *fixture, path string, cookie *http.Cookie, csrf, field, filename, content string) *httptest.ResponseRecorder {
	t.Helper()
	var buf bytes.Buffer
	mw := multipart.NewWriter(&buf)
	_ = mw.WriteField("_csrf", csrf)
	part, err := mw.CreateFormFile(field, filename)
	if err != nil {
		t.Fatalf("create form file: %v", err)
	}
	if _, err := part.Write([]byte(content)); err != nil {
		t.Fatalf("write part: %v", err)
	}
	_ = mw.Close()

	req := httptest.NewRequest(http.MethodPost, path, &buf)
	req.Header.Set("Content-Type", mw.FormDataContentType())
	req.AddCookie(cookie)
	return f.do(t, req)
}

// The history page's two per-revision endpoints are the ones an operator
// reaches for after a bad edit, so both are exercised: the download and
// the restore, including the redirect that carries the flash message.
func TestHistoryDownloadAndRestore(t *testing.T) {
	f := newFixture(t)
	writeTestPost(t, f, "hello.md", samplePost)
	cookie := login(t, f, "admin", "correct-horse-9")
	csrf := csrfFromSession(t, f, cookie)

	// One save archives the original.
	postForm(t, f, "/admin/posts/hello", url.Values{
		"_csrf": {csrf}, "title": {"Hello"}, "slug": {"hello"},
		"lang": {"cs"}, "body": {"changed"},
	}, cookie)
	revisions := f.admin.deps.Store.Revisions("hello")
	if len(revisions) != 1 {
		t.Fatalf("revisions = %v", revisions)
	}
	name := revisions[0].Name

	req := httptest.NewRequest(http.MethodGet, "/admin/posts/hello/history/"+name, nil)
	req.AddCookie(cookie)
	rec := f.do(t, req)
	if rec.Code != http.StatusOK {
		t.Fatalf("history download code = %d", rec.Code)
	}
	if !strings.Contains(rec.Body.String(), "Hello **body**.") {
		t.Fatalf("revision body = %s", rec.Body.String())
	}
	if got := rec.Header().Get("Content-Disposition"); !strings.Contains(got, "hello-"+name) {
		t.Fatalf("disposition = %q", got)
	}

	// An unknown revision name is a 404, not an empty file.
	req = httptest.NewRequest(http.MethodGet, "/admin/posts/hello/history/nope.md", nil)
	req.AddCookie(cookie)
	if rec := f.do(t, req); rec.Code != http.StatusNotFound {
		t.Fatalf("unknown revision code = %d", rec.Code)
	}

	// Restoring puts the archived body back and redirects to the editor.
	req = httptest.NewRequest(http.MethodPost, "/admin/posts/hello/history/"+name+"/restore",
		strings.NewReader("_csrf="+url.QueryEscape(csrf)))
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	req.AddCookie(cookie)
	rec = f.do(t, req)
	if rec.Code != http.StatusSeeOther {
		t.Fatalf("restore code = %d body=%s", rec.Code, rec.Body.String())
	}
	if got := rec.Header().Get("Location"); got != "/admin/posts/hello/edit?restored=1" {
		t.Fatalf("location = %q", got)
	}
	restored := f.storeObj.Find("hello", "")
	if restored == nil || !strings.Contains(restored.Body, "Hello **body**.") {
		t.Fatalf("body after restore = %q", restored.Body)
	}
}

// The brand SVG loads on every admin page, so a broken embed pattern
// would break the whole UI silently. The one asset is the icon: the
// favicon, the login brand and the topbar badge all read the same file.
func TestStaticSVGRoutes(t *testing.T) {
	f := newFixture(t)
	const path = "/admin/icon.svg"
	rec := f.do(t, httptest.NewRequest(http.MethodGet, path, nil))
	if rec.Code != http.StatusOK {
		t.Fatalf("%s: code = %d", path, rec.Code)
	}
	if got := rec.Header().Get("Content-Type"); got != "image/svg+xml" {
		t.Fatalf("%s: content-type = %q", path, got)
	}
	if !strings.Contains(rec.Body.String(), "<svg") {
		t.Fatalf("%s: body is not an SVG", path)
	}
}

func TestImportFormRenders(t *testing.T) {
	f := newFixture(t)
	cookie := login(t, f, "admin", "correct-horse-9")
	req := httptest.NewRequest(http.MethodGet, "/admin/posts/import", nil)
	req.AddCookie(cookie)
	rec := f.do(t, req)
	if rec.Code != http.StatusOK || !strings.Contains(rec.Body.String(), `name="file"`) {
		t.Fatalf("import form code=%d body=%s", rec.Code, rec.Body.String())
	}
}

// Deleting a media file removes it from the library and from the public
// route, and a second delete reports the absence.
func TestMediaDelete(t *testing.T) {
	f := newFixture(t)
	cookie := login(t, f, "admin", "correct-horse-9")
	csrf := csrfFromSession(t, f, cookie)

	rec := multipartForm(t, f, "/admin/uploads", cookie, csrf, "file", "x.webp", string(webpFixture()))
	if rec.Code != http.StatusOK {
		t.Fatalf("upload code = %d body=%s", rec.Code, rec.Body.String())
	}
	items := f.storeObj.ListMedia()
	if len(items) != 1 {
		t.Fatalf("media = %v", items)
	}
	name := items[0].Name

	req := httptest.NewRequest(http.MethodPost, "/admin/media/"+name+"/delete",
		strings.NewReader("_csrf="+url.QueryEscape(csrf)))
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	req.AddCookie(cookie)
	if rec := f.do(t, req); rec.Code != http.StatusSeeOther {
		t.Fatalf("delete code = %d", rec.Code)
	}
	if len(f.storeObj.ListMedia()) != 0 {
		t.Fatal("media survived the delete")
	}
	req = httptest.NewRequest(http.MethodPost, "/admin/media/"+name+"/delete",
		strings.NewReader("_csrf="+url.QueryEscape(csrf)))
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	req.AddCookie(cookie)
	if rec := f.do(t, req); rec.Code != http.StatusNotFound {
		t.Fatalf("second delete code = %d, want 404", rec.Code)
	}
}

// webpFixture is a minimal RIFF/WEBP header, enough for the signature
// check the upload path performs.
func webpFixture() []byte {
	data := append([]byte("RIFF"), 0, 0, 0, 0)
	return append(data, []byte("WEBPVP8 ")...)
}

// A malformed date in the editor form is rejected with the post
// re-rendered, rather than silently dropping an inherited schedule.
func TestEditorRejectsMalformedPublishAt(t *testing.T) {
	f := newFixture(t)
	if err := os.WriteFile(filepath.Join(f.contentDir, "sched.md"),
		[]byte("+++\ntitle = \"S\"\nslug = \"sched\"\npublish_at = 2999-01-01\n+++\nbody\n"), 0o644); err != nil {
		t.Fatalf("write: %v", err)
	}
	cookie := login(t, f, "admin", "correct-horse-9")
	csrf := csrfFromSession(t, f, cookie)
	rec := postForm(t, f, "/admin/posts/sched", url.Values{
		"_csrf": {csrf}, "title": {"S"}, "slug": {"sched"},
		"publish_at": {"not a date"}, "body": {"body"},
	}, cookie)
	if rec.Code != http.StatusUnprocessableEntity {
		t.Fatalf("code = %d, body = %s", rec.Code, rec.Body.String())
	}
	if !strings.Contains(rec.Body.String(), "publish_at must be an ISO 8601 date") {
		t.Fatal("validation message missing")
	}
	if p := f.admin.deps.Store.Find("sched", ""); p == nil || !p.Scheduled() {
		t.Fatal("the stored schedule was dropped by the rejected save")
	}
}

// An admin POST body over the configured allowance is cut off with 413
// before it can fill the temp directory.
func TestAdminBodyOverTheLimitIs413(t *testing.T) {
	f := newFixture(t)
	cookie := login(t, f, "admin", "correct-horse-9")
	csrf := csrfFromSession(t, f, cookie)
	huge := strings.Repeat("a", 12*1024*1024)
	rec := postForm(t, f, "/admin/posts", url.Values{
		"_csrf": {csrf}, "title": {"Big"}, "slug": {"big"}, "body": {huge},
	}, cookie)
	if rec.Code != http.StatusRequestEntityTooLarge {
		t.Fatalf("code = %d, want 413", rec.Code)
	}
}

// The editor preview must show the bibliography the published page
// will show: the refs live in the saved post's frontmatter, which the
// body-only render cannot see on its own.
func TestPreviewWeavesSavedRefs(t *testing.T) {
	f := newFixture(t)
	writeTestPost(t, f, "cite.md", `+++
title = "Cite"
slug = "cite"

[[refs]]
title = "Observational evidence from supernovae"
doi = "10.1103/PhysRevD.59.103502"
+++

Tvrzení [1].

[[refs]]
`)
	cookie := login(t, f, "admin", "correct-horse-9")
	csrf := csrfFromSession(t, f, cookie)

	rec := postForm(t, f, "/admin/preview", url.Values{
		"_csrf": {csrf}, "body": {"Tvrzení [1].\n\n[[refs]]\n"},
		"slug": {"cite"},
	}, cookie)
	if rec.Code != http.StatusOK {
		t.Fatalf("code = %d", rec.Code)
	}
	body := rec.Body.String()
	for _, want := range []string{
		`<section class="refs" id="references">`,
		`<a class="ref-cite" href="#ref-1">[1]</a>`,
		`href="https://doi.org/10.1103/PhysRevD.59.103502"`,
	} {
		if !strings.Contains(body, want) {
			t.Fatalf("preview missing %q:\n%s", want, body)
		}
	}
	// A new post with no saved refs keeps the marker as inert text, and
	// an unknown slug is just the plain body render.
	for _, slug := range []string{"", "ghost"} {
		rec := postForm(t, f, "/admin/preview", url.Values{
			"_csrf": {csrf}, "body": {"[[refs]]\n"}, "slug": {slug},
		}, cookie)
		if !strings.Contains(rec.Body.String(), biblio.Marker) {
			t.Fatalf("slug %q: preview rewrote an unsaved marker:\n%s", slug, rec.Body.String())
		}
	}
}