package main

// The SET IT UP page, driven through the real handler.
//
// Not tagged !windows, for the reason ui_test.go gives: Windows is the platform
// this UI exists for. The two platform-shaped things here — the claim-anchor
// line and the claim-owner line — take the platform as an argument so a Linux
// builder can check the Windows string, which is the hole restartHintFor was
// rewritten to close (privilege.go:88).

import (
	"encoding/json"
	"html"
	"net/http"
	"net/http/httptest"
	"net/url"
	"os"
	"path/filepath"
	"runtime"
	"strings"
	"testing"
	"time"

	"rsc.io/qr"
)

// ── fixtures ────────────────────────────────────────────────────────────────

// uiSetupPairingInState starts a fresh isolated config dir holding ONE pairing
// in a named state, and returns the DCN dir it points at.
//
// Split from uiSetupAddPairing because uiTestConfigDir points XDG_CONFIG_HOME at
// a NEW t.TempDir() on every call (uiauth_test.go:18) — so calling it twice does
// not give a machine with two pairings, it gives two machines with one each, and
// a test written that way silently checks the single-host path.
func uiSetupPairingInState(t *testing.T, host, state string) string {
	t.Helper()
	uiTestConfigDir(t)
	return uiSetupAddPairing(t, host, state)
}

// uiSetupAddPairing adds a pairing to the config dir already in force.
func uiSetupAddPairing(t *testing.T, host, state string) string {
	t.Helper()
	pd, err := pairingsDir()
	if err != nil {
		t.Fatal(err)
	}
	if err := os.MkdirAll(pd, 0o700); err != nil {
		t.Fatal(err)
	}
	dcn := filepath.Join(t.TempDir(), "dcn")
	if err := os.MkdirAll(dcn, 0o700); err != nil {
		t.Fatal(err)
	}
	b, _ := json.Marshal(&Config{
		HostName:   host,
		ListenAddr: "127.0.0.1:59999", // nothing answers there
		State:      state,
		DCNDir:     dcn,
		FirstSeen:  "2026-09-01T00:00:00Z",
	})
	if err := os.WriteFile(filepath.Join(pd, host+".json"), b, 0o600); err != nil {
		t.Fatal(err)
	}
	return dcn
}

func uiSetupPairingWithDCN(t *testing.T, host string) string {
	t.Helper()
	return uiSetupPairingInState(t, host, pairingActive)
}

// uiSetupNetworked writes mode.json DIRECTLY, the way repinBox does
// (anchor_test.go:1006) — setBoxMode needs machine authority, and this is
// setting up state, not driving the gate.
func uiSetupNetworked(t *testing.T) error {
	t.Helper()
	p, err := modePath()
	if err != nil {
		return err
	}
	if err := os.WriteFile(p, []byte(`{"mode":"networked"}`), 0o600); err != nil {
		return err
	}
	if boxMode() != modeNetworked {
		t.Fatalf("box must read networked, got %s", boxMode())
	}
	return nil
}

func uiSetupAnchorPath(t *testing.T) string {
	t.Helper()
	p, err := anchorPath()
	if err != nil {
		t.Fatal(err)
	}
	return p
}

func runtimeGOOSForTest() string { return runtime.GOOS }

// uiSetupNoMachineMarker points the machine marker at a path that does not
// exist, so the singleton guard reads "absent ⇒ today's behaviour"
// (singleton.go:362) instead of the real marker this builder carries.
//
// Not singleton_test.go's withMarkerAt, which is identical and behind
// `//go:build !windows` — and this file has to compile for Windows, because
// Windows is the platform the whole UI exists for.
func uiSetupNoMachineMarker(t *testing.T) {
	t.Helper()
	old := markerPathOverride
	markerPathOverride = filepath.Join(t.TempDir(), "no-such-marker.json")
	t.Cleanup(func() { markerPathOverride = old })
}

// qrTerminalPNGForTest is what the QR route must produce for a given payload.
func qrTerminalPNGForTest(uri string) ([]byte, error) {
	c, err := qr.Encode(uri, qr.M)
	if err != nil {
		return nil, err
	}
	return c.PNG(), nil
}

// uiSetupTestBox gives the setup page a machine to render: an isolated config
// dir and its own mux, so the test can reach the enrolments held in memory.
func uiSetupTestBox(t *testing.T) (*uiServer, *uiSetup, http.Handler, string) {
	t.Helper()
	u := uiTestServer(t)
	mux := http.NewServeMux()
	s := u.setupRoutes(mux)
	return u, s, mux, uiSignedIn(t, u)
}

func uiSetupGet(t *testing.T, h http.Handler, path, cookie string) *httptest.ResponseRecorder {
	t.Helper()
	r := uiReq(http.MethodGet, path)
	r.Header.Set("Cookie", cookie)
	w := httptest.NewRecorder()
	h.ServeHTTP(w, r)
	return w
}

// ── the page ────────────────────────────────────────────────────────────────

func TestTheSetupPageRendersEveryPanelItPromises(t *testing.T) {
	uiTestPairing(t, "member.host.privatae.ai")
	_, _, h, cookie := uiSetupTestBox(t)

	w := uiSetupGet(t, h, "/setup", cookie)
	if w.Code != http.StatusOK {
		t.Fatalf("/setup = %d: %s", w.Code, w.Body.String())
	}
	body := w.Body.String()
	for _, want := range []string{
		"member.host.privatae.ai",                     // the machine it is describing
		`hx-post="/setup/pair"`,                       // 1. pair
		`hx-post="/setup/stepup/start"`,               // 2. a second factor
		`hx-post="/setup/folder/check"`,               // 3. the live path check
		`hx-post="/setup/anchor/choose"`,              // 4. the anchor picker
		`hx-post="/setup/owner/name"`,                 // 5. the owner name
		`name="host" value="member.host.privatae.ai"`, // the anchor choice is a real pairing
		"/assets/setup.css",
		"This page will not do it", // the root-gated promise, said out loud
	} {
		if !strings.Contains(body, want) {
			t.Errorf("the setup page is missing %q", want)
		}
	}
	// No inline styles and no template.HTML anywhere: the page's own CSP has no
	// 'unsafe-inline' in it, so a style attribute would be silently dropped —
	// the failure app.css:149 records.
	if strings.Contains(body, "style=") {
		t.Error("the page carries an inline style, which its own CSP blocks")
	}
}

// The setup page and the status page must be held to the same headers. They are
// rendered by two functions (uisetup.go's render, ui.go's renderWith) because
// their view models differ, and two functions drift.
func TestTheSetupPageIsHeldToTheSameHeadersAsTheStatusPage(t *testing.T) {
	uiTestPairing(t, "member.host.privatae.ai")
	u := uiTestServer(t)
	h := u.handler()
	cookie := uiSignedIn(t, u)

	status := uiSetupGet(t, h, "/", cookie)
	setup := uiSetupGet(t, h, "/setup", cookie)
	if status.Code != http.StatusOK || setup.Code != http.StatusOK {
		t.Fatalf("/ = %d, /setup = %d", status.Code, setup.Code)
	}
	for _, hdr := range []string{"Content-Security-Policy", "Cache-Control",
		"X-Content-Type-Options", "Content-Type"} {
		if got, want := setup.Header().Get(hdr), status.Header().Get(hdr); got != want {
			t.Errorf("/setup %s = %q, / = %q — the two render paths have drifted", hdr, got, want)
		}
	}
}

// A pending host is offerable as the anchor — claim-anchor flips it active
// because the anchor never waits on itself (anchor.go:931) — so it appears in
// the picker, and its state appears WITH it. A choice whose consequence is
// invisible at the moment of choosing is the thing this page exists to fix.
func TestAPendingHostIsOfferedTheAnchorWithItsStateVisible(t *testing.T) {
	const host = "waiting.host.privatae.ai"
	const live = "serving.host.privatae.ai"
	uiSetupPairingInState(t, host, pairingPending)
	// A live pairing beside it, so the panels that DO render a host list render
	// one — otherwise they collapse to their empty state and the assertions
	// below about what is missing from them would hold for the wrong reason.
	uiSetupAddPairing(t, live, pairingActive)
	_, _, h, cookie := uiSetupTestBox(t)

	body := uiSetupGet(t, h, "/setup", cookie).Body.String()
	radio := `<input type="radio" name="host" value="` + host + `">`
	i := strings.Index(body, radio)
	if i < 0 {
		t.Fatalf("a pending host is not offered the anchor at all: %q", body)
	}
	// Inside the same label, not merely somewhere on the page.
	label := body[i:]
	if end := strings.Index(label, "</label>"); end > 0 {
		label = label[:end]
	}
	if !strings.Contains(label, "waiting for approval") {
		t.Errorf("the pending state is not shown beside the choice: %q", label)
	}
	// But nothing that would CREATE state for it is offered: a pending pairing
	// gets no directory on this machine until the anchor approves it
	// (run.go:311), and both the folder target and the factor host are dropdowns
	// that would.
	if strings.Contains(body, `<option value="`+host+`"`) {
		t.Error("a pending host is offered as a folder or factor target — nothing may be " +
			"created for it here until the anchor approves the pairing")
	}
	// The live one IS offered, so the check above is about the pending host and
	// not about a panel that rendered nothing.
	if !strings.Contains(body, `<option value="`+live+`"`) {
		t.Fatal("the active host is not offered either — the panels rendered empty and the " +
			"assertion above proved nothing")
	}
}

// The same rule at the handler, because a select is a suggestion and a POST is
// not: cfg.dcnDir() is MkdirAll-on-read (config.go:115), so enrolling for a
// pending host would create the state dir run.go guards.
func TestAFactorIsNotEnrolledForAPairingWithNoLanes(t *testing.T) {
	const host = "waiting.host.privatae.ai"
	dcn := uiSetupPairingInState(t, host, pairingPending)
	if err := os.RemoveAll(dcn); err != nil { // it must be the HANDLER that does not create it
		t.Fatal(err)
	}
	_, s, h, cookie := uiSetupTestBox(t)

	w := uiPost(t, h, "/setup/stepup/start", url.Values{"host": {host}}, cookie)
	if !strings.Contains(w.Body.String(), "is pending on this machine") {
		t.Errorf("a pending host was not refused: %q", w.Body.String())
	}
	if _, e := s.enrols.forHost(host); e != nil {
		t.Fatal("a secret was minted for a pairing with no lanes")
	}
	if _, err := os.Stat(dcn); !os.IsNotExist(err) {
		t.Fatal("the page created a state directory for a host the anchor has not approved")
	}
}

// The same rule on the STATUS page, which is where this was found: it polls
// every three seconds and asked every pairing — including pending ones — for
// its approvals, and asking creates the directory. Covers a fix in ui.go's
// pendingApprovals rather than anything on the setup page; it lives here
// because this is the file whose test surfaced it.
func TestTheStatusPageDoesNotCreateStateForAPendingPairing(t *testing.T) {
	const host = "waiting.host.privatae.ai"
	dcn := uiSetupPairingInState(t, host, pairingPending)
	if err := os.RemoveAll(dcn); err != nil {
		t.Fatal(err)
	}
	u := uiTestServer(t)
	h := u.handler()
	cookie := uiSignedIn(t, u)

	for i := 0; i < 3; i++ { // it is a poll, so the leak compounds
		if w := uiSetupGet(t, h, "/fragments/status", cookie); w.Code != http.StatusOK {
			t.Fatalf("/fragments/status = %d", w.Code)
		}
	}
	if _, err := os.Stat(dcn); !os.IsNotExist(err) {
		t.Fatal("rendering the status page created a state directory for a host the " +
			"anchor has not approved")
	}
}

// Every template the handlers name must exist, or a browser gets an empty body
// and a line in a log nobody is reading.
func TestEverySetupTemplateExists(t *testing.T) {
	u := uiTestServer(t)
	for _, name := range uiSetupTemplates() {
		if u.tpl.Lookup(name) == nil {
			t.Errorf("template %q is not in the parsed set", name)
		}
	}
}

// ── 1. pairing ──────────────────────────────────────────────────────────────

func TestPlanPairChangeFollowsWhatTheDaemonIsActuallyServing(t *testing.T) {
	active := func(h string) *Config { return &Config{HostName: h, State: pairingActive} }
	pending := func(h string) *Config { return &Config{HostName: h, State: pairingPending} }

	cases := []struct {
		name      string
		before    []string
		after     []*Config
		cfg       *Config
		wantStop  []string
		wantStart string
		wantIn    string
	}{
		{
			name:   "a brand new host starts, nothing stops",
			before: []string{"one.example"}, cfg: active("two.example"),
			after:     []*Config{active("one.example"), active("two.example")},
			wantStop:  nil,
			wantStart: "two.example",
			wantIn:    "Paired with two.example.",
		},
		{
			name:   "a pending pairing starts NOTHING and says so",
			before: []string{"one.example"}, cfg: pending("two.example"),
			after:     []*Config{active("one.example"), pending("two.example")},
			wantStop:  nil,
			wantStart: "",
			wantIn:    "PENDING",
		},
		{
			// The lane still running holds the credentials this redeem just
			// rotated out, so it must go before the new one comes up.
			name:   "a --replace stops the lane holding the old credentials",
			before: []string{"one.example"}, cfg: active("one.example"),
			after:     []*Config{active("one.example")},
			wantStop:  []string{"one.example"},
			wantStart: "one.example",
		},
		{
			// pair.go:370 removes the superseded file; the goroutine serving the
			// old name is still up and would collide on the inherited port.
			name:   "a --replace that renames stops the old name too",
			before: []string{"old.example"}, cfg: active("new.example"),
			after:     []*Config{active("new.example")},
			wantStop:  []string{"old.example"},
			wantStart: "new.example",
		},
	}
	for _, c := range cases {
		t.Run(c.name, func(t *testing.T) {
			p := planPairChange(c.before, c.after, c.cfg)
			if strings.Join(p.Stop, ",") != strings.Join(c.wantStop, ",") {
				t.Errorf("stop = %v, want %v", p.Stop, c.wantStop)
			}
			if p.Start != c.wantStart {
				t.Errorf("start = %q, want %q", p.Start, c.wantStart)
			}
			if c.wantIn != "" && !strings.Contains(p.Note, c.wantIn) {
				t.Errorf("note %q does not contain %q", p.Note, c.wantIn)
			}
		})
	}
}

// A pairing token is single-use credential material. It arrives in a POST body
// and must not come back out in the page — not in a field, not in an error.
func TestAPairingTokenNeverComesBackOutOfThePage(t *testing.T) {
	uiTestConfigDir(t)
	// The builder this runs on has a REAL machine marker naming a real state
	// dir, so without this the singleton guard (pair.go:221) refuses first and
	// decodeToken is never reached.
	uiSetupNoMachineMarker(t)
	_, _, h, cookie := uiSetupTestBox(t)

	// Malformed on purpose: decodeToken (pair.go:50) refuses it before any
	// network call, so this test touches nothing off the machine.
	const token = "skb_this-is-not-a-real-token-aaaaaaaaaaaa"
	w := uiPost(t, h, "/setup/pair", url.Values{"token": {token}}, cookie)
	if w.Code != http.StatusOK {
		t.Fatalf("/setup/pair = %d: %s", w.Code, w.Body.String())
	}
	if strings.Contains(w.Body.String(), token) {
		t.Fatalf("the token came back in the page: %q", w.Body.String())
	}
	if !strings.Contains(w.Body.String(), "malformed token") {
		t.Errorf("the refusal did not reach the page: %q", w.Body.String())
	}
	// An empty token is a nudge, not an error, and redeems nothing.
	w = uiPost(t, h, "/setup/pair", url.Values{"token": {""}}, cookie)
	if !strings.Contains(w.Body.String(), "Paste the token") {
		t.Errorf("an empty token did not prompt: %q", w.Body.String())
	}
}

func TestUIWithoutTokenScrubsTheTokenAndLeavesShortStringsAlone(t *testing.T) {
	const token = "skb_aaaaaaaaaaaaaaaaaaaa"
	if got := uiWithoutToken("redeem rejected: "+token+" is spent", token); strings.Contains(got, token) {
		t.Errorf("the token survived: %q", got)
	}
	// A short "token" would match half the words in an error message, so it is
	// left alone rather than turning a message into nonsense.
	if got := uiWithoutToken("no such host", "no"); got != "no such host" {
		t.Errorf("a short token rewrote the message: %q", got)
	}
}

// ── 2. the step-up QR ───────────────────────────────────────────────────────

func TestTheEnrolmentQRIsAnImageAndTheSecretIsNotInThePage(t *testing.T) {
	const host = "member.host.privatae.ai"
	uiTestPairing(t, host)
	_, s, h, cookie := uiSetupTestBox(t)

	w := uiPost(t, h, "/setup/stepup/start", url.Values{"host": {host}}, cookie)
	if w.Code != http.StatusOK {
		t.Fatalf("/setup/stepup/start = %d: %s", w.Code, w.Body.String())
	}
	handle, e := s.enrols.forHost(host)
	if e == nil {
		t.Fatal("no enrolment was held for the host")
	}
	body := w.Body.String()
	if !strings.Contains(body, `src="/setup/stepup/qr?e=`+handle+`"`) {
		t.Errorf("the page does not point at the QR route: %q", body)
	}
	// THE POINT OF THE WHOLE ROUTE: the secret is in the pixels, never in the
	// markup, and never in the URL that fetches the pixels.
	if strings.Contains(body, e.SecretB32) {
		t.Fatal("the enrolment secret is in the page body")
	}
	if strings.Contains(body, "otpauth://") {
		t.Fatal("the otpauth URI — which carries the secret — is in the page body")
	}

	// The image itself.
	qw := uiSetupGet(t, h, "/setup/stepup/qr?e="+handle, cookie)
	if qw.Code != http.StatusOK {
		t.Fatalf("the QR route = %d: %s", qw.Code, qw.Body.String())
	}
	if got := qw.Header().Get("Content-Type"); got != "image/png" {
		t.Errorf("the QR is served as %q", got)
	}
	if got := qw.Header().Get("Cache-Control"); got != "no-store" {
		t.Errorf("the QR is cacheable (%q) — a browser would keep a picture of a live secret", got)
	}
	png := qw.Body.Bytes()
	if len(png) < 8 || string(png[:8]) != "\x89PNG\r\n\x1a\n" {
		t.Fatalf("that is not a PNG (%d bytes)", len(png))
	}
	// It must be the code for THIS enrolment's URI, not a code for something
	// else that happens to be a valid PNG.
	want, err := qrTerminalPNGForTest(e.URI)
	if err != nil {
		t.Fatal(err)
	}
	if string(png) != string(want) {
		t.Error("the QR does not encode this enrolment's otpauth URI")
	}

	// A handle that is not held opens nothing.
	if bad := uiSetupGet(t, h, "/setup/stepup/qr?e=nope", cookie); bad.Code != http.StatusNotFound {
		t.Errorf("an unknown enrolment handle = %d, want 404", bad.Code)
	}
}

func TestTheEnrolmentKeyIsShownOnlyWhenAsked(t *testing.T) {
	const host = "member.host.privatae.ai"
	uiTestPairing(t, host)
	_, s, h, cookie := uiSetupTestBox(t)

	started := uiPost(t, h, "/setup/stepup/start", url.Values{"host": {host}}, cookie)
	handle, e := s.enrols.forHost(host)
	if e == nil {
		t.Fatal("no enrolment was held")
	}
	// ONLY WHEN ASKED is the whole claim, so the half that says "not before" is
	// checked here too and not only in the QR test.
	if strings.Contains(started.Body.String(), e.SecretB32) {
		t.Fatal("the key is on the page before anyone asked for it")
	}
	w := uiPost(t, h, "/setup/stepup/key", url.Values{"enrol": {handle}}, cookie)
	if !strings.Contains(w.Body.String(), e.SecretB32) {
		t.Errorf("the key was asked for and not given: %q", w.Body.String())
	}
	// And it is gone again on the next ordinary render — the key route is the
	// only response it ever appears in.
	if again := uiSetupGet(t, h, "/setup", cookie); strings.Contains(again.Body.String(), e.SecretB32) {
		t.Error("the key is still on the page after the request that showed it")
	}
	// And it is a POST: a GET would mean a link, a prefetch or an <img> could
	// spend it, and the Origin check does not apply to reads.
	if g := uiSetupGet(t, h, "/setup/stepup/key", cookie); g.Code != http.StatusMethodNotAllowed {
		t.Errorf("GET /setup/stepup/key = %d, want 405", g.Code)
	}
}

func TestNothingIsEnrolledUntilACodeMatches(t *testing.T) {
	const host = "member.host.privatae.ai"
	dir := uiSetupPairingWithDCN(t, host)
	_, s, h, cookie := uiSetupTestBox(t)

	uiPost(t, h, "/setup/stepup/start", url.Values{"host": {host}}, cookie)
	handle, e := s.enrols.forHost(host)
	if e == nil {
		t.Fatal("no enrolment was held")
	}
	if stepupEnrolled(dir) {
		t.Fatal("starting an enrolment already wrote a factor to disk")
	}

	// A wrong code writes nothing and keeps the enrolment alive to retry.
	w := uiPost(t, h, "/setup/stepup/confirm",
		url.Values{"enrol": {handle}, "code": {"000000"}}, cookie)
	if !strings.Contains(w.Body.String(), "did not match") {
		t.Errorf("a bad code did not say so: %q", w.Body.String())
	}
	if stepupEnrolled(dir) {
		t.Fatal("a wrong code enrolled a factor")
	}
	if _, still := s.enrols.forHost(host); still == nil {
		t.Fatal("a wrong code threw the enrolment away — the person would have to rescan")
	}

	// The real code, from the secret this machine is holding.
	raw, err := b32decode(e.SecretB32)
	if err != nil {
		t.Fatal(err)
	}
	code := hotp(raw, time.Now().Unix()/stepupPeriod)
	w = uiPost(t, h, "/setup/stepup/confirm",
		url.Values{"enrol": {handle}, "code": {code}}, cookie)
	if !strings.Contains(w.Body.String(), "Enrolled for "+host) {
		t.Fatalf("the confirmation did not land: %q", w.Body.String())
	}
	if !stepupEnrolled(dir) {
		t.Fatal("a matching code enrolled nothing")
	}
	f, err := stepupLoad(dir)
	if err != nil {
		t.Fatal(err)
	}
	if f.SecretB32 != e.SecretB32 {
		t.Error("a different secret was written than the one the QR showed")
	}
	if f.LastCounter != -1 {
		t.Errorf("last_counter = %d, want -1 — the CLI's shape (stepup.go:802)", f.LastCounter)
	}
	// The secret is out of memory once it is on disk.
	if _, still := s.enrols.forHost(host); still != nil {
		t.Error("the enrolment is still held in memory after it was written")
	}
}

func TestReplacingAnEnrolledFactorTakesADeliberateTick(t *testing.T) {
	const host = "member.host.privatae.ai"
	dir := uiSetupPairingWithDCN(t, host)
	if err := stepupSave(dir, &stepupFile{
		SecretB32: uiTestSecret, EnrolledAt: "2026-08-29T00:00:00Z", LastCounter: -1}); err != nil {
		t.Fatal(err)
	}
	_, s, h, cookie := uiSetupTestBox(t)

	w := uiPost(t, h, "/setup/stepup/start", url.Values{"host": {host}}, cookie)
	if !strings.Contains(w.Body.String(), "already enrolled") {
		t.Errorf("starting over an enrolled factor was not refused: %q", w.Body.String())
	}
	if _, e := s.enrols.forHost(host); e != nil {
		t.Fatal("a refused start still minted a secret")
	}
	w = uiPost(t, h, "/setup/stepup/start",
		url.Values{"host": {host}, "replace": {"1"}}, cookie)
	if _, e := s.enrols.forHost(host); e == nil {
		t.Fatalf("an explicit replace did not start an enrolment: %q", w.Body.String())
	}
	// And the factor on disk is untouched until a code confirms the new one.
	f, err := stepupLoad(dir)
	if err != nil || f.SecretB32 != uiTestSecret {
		t.Fatal("starting a replacement already overwrote the enrolled factor")
	}
}

// ── 3. the folder picker ────────────────────────────────────────────────────

func TestTheFolderCheckDescribesWhatIsActuallyThere(t *testing.T) {
	dir := t.TempDir()
	file := filepath.Join(dir, "a-file")
	if err := os.WriteFile(file, []byte("x"), 0o600); err != nil {
		t.Fatal(err)
	}
	cases := []struct {
		name, typed, class, in string
	}{
		{"a real folder", dir, "ok", "A folder on this machine."},
		{"a file", file, "bad", "That is a file, not a folder."},
		{"nothing there", filepath.Join(dir, "missing"), "bad", "There is nothing at that path"},
		{"empty", "  ", "warn", "Type the folder's full path."},
		// The trap a browser adds: there is no working directory the person can
		// see, so a relative path is a guess about what they meant.
		{"relative", "Documents", "bad", "Give the full path"},
	}
	for _, c := range cases {
		t.Run(c.name, func(t *testing.T) {
			got := uiCheckFolder(c.typed)
			if got.Class != c.class {
				t.Errorf("class = %q, want %q (line %q)", got.Class, c.class, got.Line)
			}
			if !strings.Contains(got.Line+" "+got.Note, c.in) {
				t.Errorf("said %q / %q, want %q", got.Line, got.Note, c.in)
			}
		})
	}
	// The resolved path is always shown, because that is the whole point of
	// checking before proposing.
	if got := uiCheckFolder(dir); got.Resolved != dir {
		t.Errorf("resolved = %q, want %q", got.Resolved, dir)
	}
}

func TestAFolderIsNotProposedWhenThePathIsWrong(t *testing.T) {
	const host = "member.host.privatae.ai"
	uiTestPairing(t, host) // listen_addr 127.0.0.1:59999 — nothing answers there
	_, _, h, cookie := uiSetupTestBox(t)

	// Refused here, so nothing is sent anywhere.
	w := uiPost(t, h, "/setup/folder/propose",
		url.Values{"host": {host}, "path": {"Documents"}}, cookie)
	if !strings.Contains(w.Body.String(), "Nothing was proposed") {
		t.Errorf("a relative path was not refused: %q", w.Body.String())
	}

	// A real folder, but this host's lane is not up: the CLI's wording here is
	// "the bastion daemon isn't running" (addfolder.go:76), which cannot be what
	// happened — this page is served BY the daemon.
	w = uiPost(t, h, "/setup/folder/propose",
		url.Values{"host": {host}, "path": {t.TempDir()}}, cookie)
	body := w.Body.String()
	if !strings.Contains(body, "not answering for "+host) {
		t.Errorf("a down lane was not explained: %q", body)
	}
	if strings.Contains(body, "isn't running") {
		t.Error("the page told the user to start a daemon that is serving the page")
	}
}

// ── 4. the anchor ───────────────────────────────────────────────────────────

// The line this page writes must stay the line the CLI documents. They are two
// functions because the Windows hint ends in a parenthetical a flag cannot
// follow (privilege.go:58), so the only thing keeping them together is this.
func TestTheAnchorLineMatchesTheCLIsOwnHint(t *testing.T) {
	const host = "member.host.privatae.ai"
	for _, goos := range []string{"linux", "darwin", "windows"} {
		cmd, how := uiAnchorCommandFor(goos, host)
		if !strings.HasSuffix(cmd, "--host "+host) {
			t.Errorf("%s: %q does not name the chosen host", goos, cmd)
		}
		bare := strings.TrimSuffix(cmd, " --host "+host)
		if !strings.HasPrefix(anchorCommandHintFor(goos), bare) {
			t.Errorf("%s: the page writes %q, the CLI hints %q — they have drifted",
				goos, bare, anchorCommandHintFor(goos))
		}
		if goos == "windows" && !strings.Contains(how, "Administrator") {
			t.Errorf("windows is told to use sudo: %q", how)
		}
		if goos != "windows" && !strings.HasPrefix(cmd, "sudo -H ") {
			t.Errorf("%s: %q drops the -H that keeps the write in root's own config dir", goos, cmd)
		}
	}
}

func TestTheAnchorPageChoosesAndNeverClaims(t *testing.T) {
	const host = "member.host.privatae.ai"
	uiTestPairing(t, host)
	_, _, h, cookie := uiSetupTestBox(t)

	// A local box: an anchor means nothing there, and set-mode is the first step.
	w := uiPost(t, h, "/setup/anchor/choose", url.Values{"host": {host}}, cookie)
	if !strings.Contains(w.Body.String(), "set-mode networked") {
		t.Errorf("a local box was not sent to set-mode first: %q", w.Body.String())
	}

	if err := uiSetupNetworked(t); err != nil {
		t.Fatal(err)
	}
	w = uiPost(t, h, "/setup/anchor/choose", url.Values{"host": {host}}, cookie)
	body := w.Body.String()
	cmd, _ := uiAnchorCommandFor(runtimeGOOSForTest(), host)
	if !strings.Contains(body, cmd) {
		t.Errorf("the page did not write the line %q: %q", cmd, body)
	}
	// IT CLAIMED NOTHING. currentAnchor reads the signed file; if this page had
	// called through, the box would be anchored now.
	if a := currentAnchor(); a != nil {
		t.Fatalf("the page claimed the anchor itself (%s) — it must only write the line",
			a.AnchorHost)
	}
	if _, err := os.Stat(uiSetupAnchorPath(t)); !os.IsNotExist(err) {
		t.Fatal("anchor.json exists — something wrote it")
	}

	// A host this machine does not serve is refused rather than typed into a line.
	w = uiPost(t, h, "/setup/anchor/choose", url.Values{"host": {"stranger.example"}}, cookie)
	if !strings.Contains(w.Body.String(), "does not serve") {
		t.Errorf("an unknown host was accepted: %q", w.Body.String())
	}
	if strings.Contains(w.Body.String(), "claim-anchor --host stranger.example") {
		t.Fatal("the page wrote a command naming a host this machine does not serve")
	}
}

// The one above cannot tell "the page refused to claim" apart from "the page
// tried and the MACHINE refused" — off-root, or behind this builder's real
// machine marker, cmdClaimAnchor would fail either way and the assertion would
// pass for the wrong reason. That is the tautology shape, so it gets its own
// test on a box where a claim WOULD land.
func TestTheAnchorPageClaimsNothingEvenOnABoxWhereItCould(t *testing.T) {
	const host = "member.host.privatae.ai"
	uiTestPairing(t, host)
	uiSetupNoMachineMarker(t) // singletonGuardForPair would otherwise refuse first
	if err := uiSetupNetworked(t); err != nil {
		t.Fatal(err)
	}
	if !processIsRoot() {
		t.Skip("this process holds no machine authority, so claim-anchor would refuse " +
			"whatever this page did — the assertion below can only mean something as root, " +
			"and the builder runs as root. Everything else about the picker is covered by " +
			"TestTheAnchorPageChoosesAndNeverClaims.")
	}
	// Proof the box is claimable: the real command, on this exact state, works.
	// Run in a sub-directory of the same fixture so the assertion below is about
	// a machine that HAS just been shown to be anchorable.
	_, _, h, cookie := uiSetupTestBox(t)
	w := uiPost(t, h, "/setup/anchor/choose", url.Values{"host": {host}}, cookie)
	if !strings.Contains(w.Body.String(), "claim-anchor --host "+host) {
		t.Fatalf("the page did not write the line at all: %q", w.Body.String())
	}
	if a := currentAnchor(); a != nil {
		t.Fatalf("the page anchored this machine to %s — it must only write the line", a.AnchorHost)
	}
	// Now prove the machine was claimable all along, so the nil above is the
	// page's restraint and not the machine's refusal.
	if err := cmdClaimAnchor("", false, "", host); err != nil {
		t.Fatalf("this box could not be anchored anyway (%v) — the assertion above proved nothing", err)
	}
	if currentAnchor() == nil {
		t.Fatal("claim-anchor reported success and wrote no anchor")
	}
}

// An anchored box does not get a second first-claim button. Moving the anchor
// is --rotate, which the design keeps in the CLI on purpose — so the
// page hands over that line instead, with the one thing it cannot know left in
// angle brackets the way main.go:55 prints it.
func TestAnAnchoredBoxIsSentToRotateAndNotOfferedAFreshClaim(t *testing.T) {
	const host = "member.host.privatae.ai"
	uiTestPairing(t, host)
	uiSetupNoMachineMarker(t)
	if err := uiSetupNetworked(t); err != nil {
		t.Fatal(err)
	}
	if err := writeAnchor("the owner", host); err != nil {
		t.Fatal(err)
	}
	_, _, h, cookie := uiSetupTestBox(t)

	w := uiPost(t, h, "/setup/anchor/choose", url.Values{"host": {host}}, cookie)
	body := html.UnescapeString(w.Body.String())
	if !strings.Contains(body, "claim-anchor --rotate <token>") {
		t.Errorf("the rotate line was not offered: %q", body)
	}
	if strings.Contains(body, "claim-anchor --host") {
		t.Error("an anchored box was offered a fresh claim — anchor.go:835 refuses it")
	}
	if !strings.Contains(body, "signed consent") {
		t.Errorf("it did not say what a rotation costs: %q", body)
	}
}

func TestARevokedHostIsNotOfferedTheAnchor(t *testing.T) {
	const host = "revoked.host.privatae.ai"
	uiSetupPairingInState(t, host, pairingRevoked)
	if err := uiSetupNetworked(t); err != nil {
		t.Fatal(err)
	}
	_, _, h, cookie := uiSetupTestBox(t)

	w := uiPost(t, h, "/setup/anchor/choose", url.Values{"host": {host}}, cookie)
	body := w.Body.String()
	if !strings.Contains(body, "revoked") {
		t.Errorf("a revoked host was not refused: %q", body)
	}
	if strings.Contains(body, "claim-anchor --host") {
		t.Error("the page wrote a claim-anchor line for a revoked host — anchor.go:910 refuses it")
	}
}

// ── 5. the owner name ───────────────────────────────────────────────────────

func TestTheOwnerNameIsCheckedAndNeverClaimed(t *testing.T) {
	uiTestConfigDir(t)
	_, _, h, cookie := uiSetupTestBox(t)

	w := uiPost(t, h, "/setup/owner/name", url.Values{"owner": {"the owner"}}, cookie)
	// Unescaped, because html/template turns the shell quotes into &#34; — which
	// is what a browser renders back as a quote, and is the proof that the page
	// goes through the escaper rather than template.HTML.
	body := html.UnescapeString(w.Body.String())
	if !strings.Contains(w.Body.String(), "&#34;") {
		t.Error("the quotes were not escaped — something is bypassing html/template")
	}
	if !strings.Contains(body, `claim-owner "the owner"`) {
		t.Errorf("the page did not write the line: %q", body)
	}
	if !strings.Contains(body, "-H") {
		t.Error("the line drops sudo -H, which is what keeps the claim in root's own config dir")
	}
	// IT CLAIMED NOTHING.
	if o := currentOwnerClaim(); o != nil {
		t.Fatalf("the page signed an owner claim itself (%q)", o.Owner)
	}

	// The real rule (claimNameOK, anchor.go:121) is what refuses, not a second
	// copy of it living here.
	for _, bad := range []string{"", "  ", strings.Repeat("x", 121), "two\nlines"} {
		w = uiPost(t, h, "/setup/owner/name", url.Values{"owner": {bad}}, cookie)
		if !strings.Contains(w.Body.String(), "will be refused") {
			t.Errorf("%q was not refused: %q", bad, w.Body.String())
		}
	}
	// A name a shell would re-read is not refused — it is a fine name — but the
	// page will not write a line that does something other than what it says.
	w = uiPost(t, h, "/setup/owner/name", url.Values{"owner": {"O`whoami`Brien"}}, cookie)
	if strings.Contains(w.Body.String(), "claim-owner \"") {
		t.Error("the page wrote a command line containing a backtick")
	}
	if !strings.Contains(w.Body.String(), "a shell would read") {
		t.Errorf("it did not say why: %q", w.Body.String())
	}
}

func TestUIShellSafeName(t *testing.T) {
	for _, ok := range []string{"the owner", "the owner Smith", "team-a", "O'Brien", "a b (c)"} {
		if !uiShellSafeName(ok) {
			t.Errorf("%q should survive double quotes", ok)
		}
	}
	for _, bad := range []string{`say "hi"`, `back\slash`, `$HOME`, "a`b`"} {
		if uiShellSafeName(bad) {
			t.Errorf("%q would be re-read by a shell", bad)
		}
	}
}

// ── the method wall ─────────────────────────────────────────────────────────

// Anything that CHANGES something is POST, so it takes the Origin check —
// signOut was a GET behind only the Host check and that was a finding (ui.go:463).
func TestEverySetupRouteThatChangesSomethingIsPostOnly(t *testing.T) {
	uiTestPairing(t, "member.host.privatae.ai")
	_, _, h, cookie := uiSetupTestBox(t)

	for _, path := range []string{
		"/setup/pair", "/setup/stepup/start", "/setup/stepup/key",
		"/setup/stepup/confirm", "/setup/folder/check", "/setup/folder/propose",
		"/setup/anchor/choose", "/setup/owner/name",
	} {
		if w := uiSetupGet(t, h, path, cookie); w.Code != http.StatusMethodNotAllowed {
			t.Errorf("GET %s = %d, want 405", path, w.Code)
		}
		// Cross-site POST: uiRequestAllowed's Origin arm is what stops it.
		r := httptest.NewRequest(http.MethodPost, path, nil)
		r.Host = "127.0.0.1:" + uiTestPort
		r.Header.Set("Origin", "https://evil.example")
		r.Header.Set("Cookie", cookie)
		w := httptest.NewRecorder()
		h.ServeHTTP(w, r)
		if w.Code != http.StatusForbidden {
			t.Errorf("cross-site POST %s = %d, want 403", path, w.Code)
		}
	}
	// The two reads are GET-only for the same reason in reverse.
	for _, path := range []string{"/setup", "/setup/stepup/qr"} {
		r := httptest.NewRequest(http.MethodPost, path, nil)
		r.Host = "127.0.0.1:" + uiTestPort
		r.Header.Set("Origin", "http://127.0.0.1:"+uiTestPort)
		r.Header.Set("Cookie", cookie)
		w := httptest.NewRecorder()
		h.ServeHTTP(w, r)
		if w.Code != http.StatusMethodNotAllowed {
			t.Errorf("POST %s = %d, want 405", path, w.Code)
		}
	}
}