package graph

import (
	"context"
	"crypto/rand"
	"crypto/sha1"
	"encoding/base64"
	"encoding/hex"
	"encoding/json"
	"fmt"
	"net/http"
	"net/http/httptest"
	"os"
	"sort"
	"strings"
	"testing"
	"time"

	"github.com/fernet/fernet-go"
	"github.com/go-chi/chi/v5"
	"github.com/vaughan0/go-ini"
	"sourcecraft.dev/bigbes/sr-ht-core/crypto"

	"sourcecraft.dev/bigbes/sr-ht-spec/authn"
	"sourcecraft.dev/bigbes/sr-ht-spec/core"
	"sourcecraft.dev/bigbes/sr-ht-spec/doc"
	"sourcecraft.dev/bigbes/sr-ht-spec/search"
	"sourcecraft.dev/bigbes/sr-ht-spec/service"
)

// testConf carries the crypto keys established in TestMain, so a test can seal
// a unified-login cookie the way meta.sr.ht does and drive the schema through
// the same middleware the daemon installs.
var testConf ini.File

func TestMain(m *testing.M) {
	var fk fernet.Key
	if err := fk.Generate(); err != nil {
		panic("generate fernet key: " + err.Error())
	}
	seed := make([]byte, 32)
	if _, err := rand.Read(seed); err != nil {
		panic("generate webhook seed: " + err.Error())
	}
	testConf = ini.File{
		"sr.ht":    ini.Section{"network-key": fk.Encode()},
		"webhooks": ini.Section{"private-key": base64.StdEncoding.EncodeToString(seed)},
	}
	crypto.InitCrypto(testConf)
	os.Exit(m.Run())
}

// ---- fixtures -------------------------------------------------------------

const (
	headRev   = "1111111111111111111111111111111111111111"
	oldRev    = "2222222222222222222222222222222222222222"
	absentRev = "3333333333333333333333333333333333333333"
	agentTk   = "test-agent-token"
)

var (
	demoSpace  = core.SpaceRef{Owner: "bigbes", Name: "rfcs"}
	otherSpace = core.SpaceRef{Owner: "bigbes", Name: "notes"}

	fullProject  = core.ProjectRef{Owner: "bigbes", Name: "docs"}
	emptyProject = core.ProjectRef{Owner: "bigbes", Name: "fresh"}

	created = time.Date(2026, 7, 22, 10, 0, 0, 0, time.UTC)
)

// headDocs is the demo space at its approved head. notes/plain.md carries no
// frontmatter at all and is therefore addressed by its path; SPEC-0009 is
// claimed twice, so it resolves to neither of its claimants.
var headDocs = map[string]string{
	"specs/0007-storage.md": `---
id: SPEC-0007
title: Proposal storage model
status: draft
type: spec
supersedes: SPEC-0003
owners: [~bigbes]
tags: [storage, review]
summary: How proposals are stored.
---

# Proposal storage model

Git is authoritative.
`,
	"specs/0009-a.md": `---
id: SPEC-0009
title: One claimant
status: draft
---

# One claimant
`,
	"specs/0009-b.md": `---
id: SPEC-0009
title: The other claimant
status: draft
---

# The other claimant
`,
	"notes/plain.md": `# Just a note

No frontmatter here at all.
`,
}

// oldDocs is the same space at a pinned, older revision. The title differs, so
// a test can prove that `rev:` actually reached a different tree.
var oldDocs = map[string]string{
	"specs/0007-storage.md": `---
id: SPEC-0007
title: Storage, first draft
status: draft
---

# Storage, first draft
`,
}

// fakeReader is an in-memory Reader: a space is a revision-keyed set of
// documents, and a project is a list of member spaces.
type fakeReader struct {
	revs     map[string]map[string]string // rev -> path -> content
	head     string
	projects map[core.ProjectRef][]core.SpaceRef
}

func newFakeReader() *fakeReader {
	return &fakeReader{
		revs: map[string]map[string]string{headRev: headDocs, oldRev: oldDocs},
		head: headRev,
		projects: map[core.ProjectRef][]core.SpaceRef{
			fullProject:  {demoSpace},
			emptyProject: nil,
		},
	}
}

func spaceOf(ref core.SpaceRef) *service.Space {
	return &service.Space{Ref: ref, ID: 1, Created: created}
}

func (f *fakeReader) ListSpaces(context.Context) ([]*service.Space, error) {
	return []*service.Space{spaceOf(demoSpace), spaceOf(otherSpace)}, nil
}

func (f *fakeReader) OpenSpace(_ context.Context, ref core.SpaceRef) (*service.Space, error) {
	if ref != demoSpace {
		return nil, fmt.Errorf("%w: space %s", service.ErrNotFound, ref)
	}
	return spaceOf(ref), nil
}

// at resolves a revision the way service does: ApprovedRev is the approved
// head, and anything else must name a revision that exists.
func (f *fakeReader) at(rev string) (string, map[string]string, error) {
	if rev == service.ApprovedRev {
		rev = f.head
	}
	docs, ok := f.revs[rev]
	if !ok {
		return "", nil, fmt.Errorf("%w: revision %q", service.ErrNotFound, rev)
	}
	return rev, docs, nil
}

func (f *fakeReader) ResolveRev(_ context.Context, _ *service.Space, rev string) (string, error) {
	resolved, _, err := f.at(rev)
	return resolved, err
}

func (f *fakeReader) Archive(_ context.Context, sp *service.Space, rev string) (*doc.Archive, map[string][]byte, error) {
	resolved, docs, err := f.at(rev)
	if err != nil {
		return nil, nil, err
	}
	paths := make([]string, 0, len(docs))
	for p := range docs {
		paths = append(paths, p)
	}
	sort.Strings(paths)

	// Built through service.ArchiveFrom, which is the seam it exists for: the
	// addressing rule under test is the production one rather than a fixture's
	// idea of it.
	sd := make([]service.Document, 0, len(paths))
	for _, p := range paths {
		data := []byte(docs[p])
		sd = append(sd, service.Document{Path: p, Blob: blobSha(data), Rev: resolved, Data: data})
	}
	return service.ArchiveFrom(sp.Ref, resolved, sd)
}

func (f *fakeReader) GetProject(_ context.Context, ref core.ProjectRef) (*service.Project, error) {
	if _, ok := f.projects[ref]; !ok {
		return nil, fmt.Errorf("%w: project %s", service.ErrNotFound, ref)
	}
	return &service.Project{Ref: ref, ID: 1, Created: created}, nil
}

func (f *fakeReader) ListProjects(context.Context) ([]*service.Project, error) {
	return []*service.Project{
		{Ref: fullProject, ID: 1, Created: created},
		{Ref: emptyProject, ID: 2, Created: created},
	}, nil
}

func (f *fakeReader) ProjectSpaces(_ context.Context, ref core.ProjectRef) ([]*service.Space, error) {
	// The meta-project lists every space, exactly as service.ProjectSpaces does:
	// a listing is enumerated by definition, even though the filter it resolves
	// to is not.
	if ref.IsMeta() {
		return f.ListSpaces(context.Background())
	}
	members, ok := f.projects[ref]
	if !ok {
		return nil, fmt.Errorf("%w: project %s", service.ErrNotFound, ref)
	}
	out := make([]*service.Space, 0, len(members))
	for _, m := range members {
		out = append(out, spaceOf(m))
	}
	return out, nil
}

// blobSha is git's object name for a blob: sha1 over "blob <len>\0" and the
// content. Spelled out rather than taken from go-git so that this package —
// tests included — never imports the git layer, which is the whole point of
// reading through service/.
func blobSha(data []byte) string {
	h := sha1.New()
	fmt.Fprintf(h, "blob %d", len(data))
	h.Write([]byte{0})
	h.Write(data)
	return hex.EncodeToString(h.Sum(nil))
}

// fakeSearcher records the query it was handed and returns one fixed hit.
type fakeSearcher struct {
	last search.Query
}

func (s *fakeSearcher) Search(_ context.Context, q search.Query) (search.Results, error) {
	s.last = q
	// The two answers the index knows without looking, spelled the same way
	// search.Index spells them: a scope nobody set is a caller bug, and a
	// filter that selects no space has no hits by construction.
	if q.Spaces.IsZero() {
		return search.Results{}, fmt.Errorf("search: query names no space scope")
	}
	if q.Spaces.MatchesNothing() {
		return search.Results{}, nil
	}
	return search.Results{
		Total: 1,
		Took:  3 * time.Millisecond,
		Hits: []search.Hit{{
			Space:   demoSpace,
			ID:      "SPEC-0007",
			Rev:     headRev,
			Path:    "specs/0007-storage.md",
			Title:   "Proposal storage model",
			Section: "specs",
			Lang:    search.LangEN,
			Score:   1.5,
			Snippet: `Git is <mark>authoritative</mark> &amp; boring`,
		}},
	}, nil
}

// fakeProposals is the port service/ does not implement yet.
type fakeProposals struct {
	rows []Proposal
}

func (f *fakeProposals) ListProposals(_ context.Context, space core.SpaceRef, state core.ProposalState) ([]Proposal, error) {
	var out []Proposal
	for _, p := range f.rows {
		if p.Space == space && p.State == state {
			out = append(out, p)
		}
	}
	return out, nil
}

// stubTokenStore knows exactly one live agent token.
type stubTokenStore struct{}

func (stubTokenStore) LookupAgentToken(_ context.Context, hash []byte) (authn.AgentToken, error) {
	want := authn.HashToken(agentTk)
	if string(hash) != string(want) {
		return authn.AgentToken{}, authn.ErrUnknownToken
	}
	return authn.AgentToken{ID: 1, Name: "test", Hash: want}, nil
}

// ---- harness --------------------------------------------------------------

type harness struct {
	handler   http.Handler
	searcher  *fakeSearcher
	proposals *fakeProposals
}

func newHarness(t *testing.T, withProposals bool) harness {
	t.Helper()
	resolver, err := authn.NewResolver("bigbes", stubTokenStore{})
	if err != nil {
		t.Fatalf("NewResolver: %v", err)
	}
	searcher := &fakeSearcher{}
	opts := Options{Reader: newFakeReader(), Searcher: searcher, Resolver: resolver}
	var proposals *fakeProposals
	if withProposals {
		proposals = &fakeProposals{}
		opts.Proposals = proposals
	}
	srv, err := New(opts)
	if err != nil {
		t.Fatalf("New: %v", err)
	}
	return harness{handler: srv.Handler(), searcher: searcher, proposals: proposals}
}

// response is one GraphQL response, decoded far enough to assert on.
type response struct {
	status int
	body   string
	Data   json.RawMessage `json:"data"`
	Errors []graphqlError  `json:"errors"`
}

type graphqlError struct {
	Message string `json:"message"`
}

// errText joins every error message, for assertions that care what was said.
func (r response) errText() string {
	var msgs []string
	for _, e := range r.Errors {
		msgs = append(msgs, e.Message)
	}
	return strings.Join(msgs, "; ")
}

// query POSTs a GraphQL query as the instance owner.
func query(t *testing.T, h harness, q string) response {
	t.Helper()
	return post(t, h, q, func(req *http.Request) { login(req, "bigbes") })
}

func post(t *testing.T, h harness, q string, auth func(*http.Request)) response {
	t.Helper()
	body, err := json.Marshal(map[string]any{"query": q})
	if err != nil {
		t.Fatalf("marshal query: %v", err)
	}
	req := httptest.NewRequest(http.MethodPost, "/query", strings.NewReader(string(body)))
	req.Header.Set("Content-Type", "application/json")
	if auth != nil {
		auth(req)
	}
	rec := httptest.NewRecorder()
	h.handler.ServeHTTP(rec, req)

	out := response{status: rec.Code, body: rec.Body.String()}
	if strings.HasPrefix(rec.Header().Get("Content-Type"), "application/json") {
		if err := json.Unmarshal(rec.Body.Bytes(), &out); err != nil {
			t.Fatalf("decode response %q: %v", rec.Body.String(), err)
		}
	}
	return out
}

// ok fails unless the query succeeded outright, and decodes data into v.
func ok(t *testing.T, r response, v any) {
	t.Helper()
	if r.status != http.StatusOK {
		t.Fatalf("status %d, body %s", r.status, r.body)
	}
	if len(r.Errors) > 0 {
		t.Fatalf("unexpected errors: %s", r.errText())
	}
	if v != nil {
		if err := json.Unmarshal(r.Data, v); err != nil {
			t.Fatalf("decode data %s: %v", r.Data, err)
		}
	}
}

// login seals a unified-login cookie for user onto a request — the same shape
// meta.sr.ht writes, sealed with the shared network key.
func login(req *http.Request, user string) {
	payload, _ := json.Marshal(map[string]string{"name": user})
	req.AddCookie(&http.Cookie{Name: authn.CookieName, Value: string(crypto.Encrypt(payload))})
}

// ---- the read contract ----------------------------------------------------

// A read with no rev is a read of the approved head, and reports the sha it
// resolved to so the caller can pin the next one.
func TestDocumentDefaultsToTheApprovedHead(t *testing.T) {
	h := newHarness(t, false)
	r := query(t, h, `{
		document(space: "~bigbes/rfcs", id: "SPEC-0007") {
			id docId path rev blob pinned title status section summary type supersedes tags owners markdown
		}
	}`)

	var got struct {
		Document struct {
			ID, Path, Rev, Blob       string
			DocID                     *string
			Pinned                    bool
			Title, Status, Section    string
			Summary, Type, Supersedes string
			Tags, Owners              []string
			Markdown                  string
		}
	}
	ok(t, r, &got)

	if got.Document.Rev != headRev {
		t.Errorf("rev = %q, want the approved head %q", got.Document.Rev, headRev)
	}
	if got.Document.Pinned {
		t.Error("pinned = true for a read that named no revision")
	}
	if got.Document.Title != "Proposal storage model" {
		t.Errorf("title = %q, want the head's title", got.Document.Title)
	}
	if got.Document.ID != "SPEC-0007" || got.Document.DocID == nil || *got.Document.DocID != "SPEC-0007" {
		t.Errorf("id/docId = %q/%v, want both SPEC-0007", got.Document.ID, got.Document.DocID)
	}
	if got.Document.Path != "specs/0007-storage.md" {
		t.Errorf("path = %q", got.Document.Path)
	}
	if got.Document.Blob != blobSha([]byte(headDocs["specs/0007-storage.md"])) {
		t.Errorf("blob = %q, want the content hash", got.Document.Blob)
	}
	if got.Document.Section != "specs" || got.Document.Status != "draft" {
		t.Errorf("section/status = %q/%q", got.Document.Section, got.Document.Status)
	}
	if got.Document.Type != "spec" || got.Document.Supersedes != "SPEC-0003" {
		t.Errorf("type/supersedes = %q/%q", got.Document.Type, got.Document.Supersedes)
	}
	if strings.Join(got.Document.Tags, ",") != "storage,review" {
		t.Errorf("tags = %v", got.Document.Tags)
	}
	if strings.Join(got.Document.Owners, ",") != "~bigbes" {
		t.Errorf("owners = %v", got.Document.Owners)
	}
	if !strings.HasPrefix(got.Document.Markdown, "---\nid: SPEC-0007") {
		t.Errorf("markdown does not carry the frontmatter: %q", got.Document.Markdown)
	}
}

// A full object name pins the read to that revision, and says so.
func TestDocumentPinnedToARevision(t *testing.T) {
	h := newHarness(t, false)
	r := query(t, h, `{
		document(space: "~bigbes/rfcs", id: "SPEC-0007", rev: "`+oldRev+`") { rev pinned title }
	}`)

	var got struct {
		Document struct {
			Rev    string
			Pinned bool
			Title  string
		}
	}
	ok(t, r, &got)

	if got.Document.Rev != oldRev {
		t.Errorf("rev = %q, want the pinned %q", got.Document.Rev, oldRev)
	}
	if !got.Document.Pinned {
		t.Error("pinned = false for a read that named a revision")
	}
	if got.Document.Title != "Storage, first draft" {
		t.Errorf("title = %q — the pin did not reach the older tree", got.Document.Title)
	}
}

// A ref name is not a revision this plane will serve. Without the guard,
// rev: "proposals/42" would hand back unreviewed proposal content as though it
// were approved — the one failure this service exists to prevent.
func TestRefNameRevIsRefused(t *testing.T) {
	h := newHarness(t, false)
	// A branch name, the approved branch itself, a full ref, an abbreviation
	// that is unique today and may not be tomorrow, and an object name in the
	// wrong case.
	for _, rev := range []string{"proposals/42", "main", "refs/heads/main", "1111111", strings.Repeat("A", 40)} {
		r := query(t, h, `{ document(space: "~bigbes/rfcs", id: "SPEC-0007", rev: "`+rev+`") { rev } }`)
		if len(r.Errors) == 0 {
			t.Errorf("rev %q was accepted: %s", rev, r.body)
			continue
		}
		if !strings.Contains(r.errText(), "object name") {
			t.Errorf("rev %q refused, but not for being a bad object name: %s", rev, r.errText())
		}
	}
}

// A revision that is well-formed but absent is absence, not a bad argument: the
// field is null and no error is reported.
func TestAbsentRevisionIsNull(t *testing.T) {
	h := newHarness(t, false)
	r := query(t, h, `{ document(space: "~bigbes/rfcs", id: "SPEC-0007", rev: "`+absentRev+`") { rev } }`)

	var got struct {
		Document *struct{ Rev string }
	}
	ok(t, r, &got)
	if got.Document != nil {
		t.Errorf("document = %+v, want null", got.Document)
	}
}

// The addressing rule: a document with no usable id is addressed by its path,
// and an id two documents claim resolves to neither of them.
func TestAddressing(t *testing.T) {
	h := newHarness(t, false)

	t.Run("path of a document with no frontmatter", func(t *testing.T) {
		r := query(t, h, `{ document(space: "~bigbes/rfcs", id: "notes/plain") { id docId title } }`)
		var got struct {
			Document struct {
				ID    string
				DocID *string
				Title string
			}
		}
		ok(t, r, &got)
		if got.Document.ID != "notes/plain" {
			t.Errorf("id = %q, want the path minus the extension", got.Document.ID)
		}
		if got.Document.DocID != nil {
			t.Errorf("docId = %v, want null for a document with no frontmatter id", *got.Document.DocID)
		}
	})

	t.Run("by path", func(t *testing.T) {
		r := query(t, h, `{ document(space: "~bigbes/rfcs", path: "specs/0007-storage.md") { id } }`)
		var got struct{ Document struct{ ID string } }
		ok(t, r, &got)
		if got.Document.ID != "SPEC-0007" {
			t.Errorf("id = %q", got.Document.ID)
		}
	})

	t.Run("a duplicated id resolves to neither document", func(t *testing.T) {
		r := query(t, h, `{ document(space: "~bigbes/rfcs", id: "SPEC-0009") { id path } }`)
		if len(r.Errors) == 0 {
			t.Fatalf("a duplicated id resolved: %s", r.body)
		}
		if !strings.Contains(r.errText(), "claimed by 2 documents") {
			t.Errorf("error does not name the collision: %s", r.errText())
		}
	})

	t.Run("both id and path", func(t *testing.T) {
		r := query(t, h, `{ document(space: "~bigbes/rfcs", id: "SPEC-0007", path: "notes/plain.md") { id } }`)
		if len(r.Errors) == 0 {
			t.Fatalf("id and path together were accepted: %s", r.body)
		}
	})

	t.Run("neither id nor path", func(t *testing.T) {
		r := query(t, h, `{ document(space: "~bigbes/rfcs") { id } }`)
		if len(r.Errors) == 0 {
			t.Fatalf("an unaddressed document was accepted: %s", r.body)
		}
	})
}

// The listing is the same revision resolution, and carries every document.
func TestDocumentsListing(t *testing.T) {
	h := newHarness(t, false)
	r := query(t, h, `{ documents(space: "~bigbes/rfcs") { id rev pinned } }`)

	var got struct {
		Documents []struct {
			ID     string
			Rev    string
			Pinned bool
		}
	}
	ok(t, r, &got)
	if len(got.Documents) != len(headDocs) {
		t.Fatalf("got %d documents, want %d", len(got.Documents), len(headDocs))
	}
	for _, d := range got.Documents {
		if d.Rev != headRev || d.Pinned {
			t.Errorf("%s: rev/pinned = %q/%v", d.ID, d.Rev, d.Pinned)
		}
	}
}

// ---- authorization --------------------------------------------------------

// The read plane is fail-closed: the owner and its agents read, and nobody
// else does. A refusal is a 401 with no content, never a page of login markup.
func TestAnonymousIsRefused(t *testing.T) {
	h := newHarness(t, false)

	cases := map[string]func(*http.Request){
		"no credential":       nil,
		"a stranger's cookie": func(req *http.Request) { login(req, "somebody-else") },
		"an unknown token": func(req *http.Request) {
			req.Header.Set("Authorization", "Bearer not-a-real-token")
		},
	}
	for name, auth := range cases {
		t.Run(name, func(t *testing.T) {
			r := post(t, h, `{ documents(space: "~bigbes/rfcs") { markdown } }`, auth)
			if r.status != http.StatusUnauthorized {
				t.Fatalf("status = %d, want 401; body %s", r.status, r.body)
			}
			if strings.Contains(r.body, "SPEC-0007") || strings.Contains(r.body, "authoritative") {
				t.Fatalf("the refusal leaked content: %s", r.body)
			}
		})
	}
}

// Introspection is content too, in the sense that matters here: it is served
// only to a caller with read authority.
func TestIntrospectionIsGated(t *testing.T) {
	h := newHarness(t, false)
	r := post(t, h, `{ __schema { queryType { name } } }`, nil)
	if r.status != http.StatusUnauthorized {
		t.Fatalf("anonymous introspection: status = %d, want 401", r.status)
	}
}

// An agent token reads. This is the other half of the ACL and the half the
// whole service is for.
func TestAgentTokenReads(t *testing.T) {
	h := newHarness(t, false)
	r := post(t, h, `{ document(space: "~bigbes/rfcs", id: "SPEC-0007") { title } }`, func(req *http.Request) {
		req.Header.Set("Authorization", "Bearer "+agentTk)
	})
	var got struct{ Document struct{ Title string } }
	ok(t, r, &got)
	if got.Document.Title != "Proposal storage model" {
		t.Errorf("title = %q", got.Document.Title)
	}
}

// ---- search ---------------------------------------------------------------

func TestSearchSpaceFiltering(t *testing.T) {
	t.Run("a space list is the filter", func(t *testing.T) {
		h := newHarness(t, false)
		r := query(t, h, `{
			search(query: "storage", spaces: ["~bigbes/rfcs"]) {
				total took hits { space id rev path title section lang score snippet }
			}
		}`)
		var got struct {
			Search struct {
				Total int
				Took  string
				Hits  []struct {
					Space, ID, Rev, Path, Title, Section, Lang, Snippet string
					Score                                               float64
				}
			}
		}
		ok(t, r, &got)

		got_ := h.searcher.last.Spaces
		if got_.Everything() || len(got_.Refs()) != 1 || got_.Refs()[0] != demoSpace {
			t.Fatalf("query.Spaces = %s, want just %s", got_, demoSpace)
		}
		if h.searcher.last.Text != "storage" {
			t.Errorf("query.Text = %q", h.searcher.last.Text)
		}
		if got.Search.Total != 1 || len(got.Search.Hits) != 1 {
			t.Fatalf("total/hits = %d/%d", got.Search.Total, len(got.Search.Hits))
		}
		hit := got.Search.Hits[0]
		if hit.Space != "~bigbes/rfcs" || hit.Rev != headRev || hit.Path != "specs/0007-storage.md" {
			t.Errorf("hit = %+v — a hit must be a pinned address", hit)
		}
		if !strings.Contains(hit.Snippet, "<mark>") {
			t.Errorf("snippet lost its highlighting: %q", hit.Snippet)
		}
	})

	t.Run("an omitted space list is every space", func(t *testing.T) {
		h := newHarness(t, false)
		r := query(t, h, `{ search(query: "storage") { total } }`)
		ok(t, r, nil)
		if !h.searcher.last.Spaces.Everything() {
			t.Errorf("query.Spaces = %s, want the filter that excludes nothing", h.searcher.last.Spaces)
		}
	})

	// The polarity trap, from the client's side: an empty project resolves to
	// no spaces, and passing that membership to a search must return nothing
	// rather than the whole corpus. null and [] are different arguments here,
	// which is what makes the two expressible at all.
	t.Run("an empty space list selects nothing", func(t *testing.T) {
		h := newHarness(t, false)
		r := query(t, h, `{ search(query: "storage", spaces: []) { total hits { id } } }`)
		var got struct {
			Search struct {
				Total int
				Hits  []struct{ ID string }
			}
		}
		ok(t, r, &got)
		if got.Search.Total != 0 || len(got.Search.Hits) != 0 {
			t.Fatalf("an empty space list matched %d/%d — it must select nothing", got.Search.Total, len(got.Search.Hits))
		}
		if h.searcher.last.Spaces.Everything() || !h.searcher.last.Spaces.MatchesNothing() {
			t.Errorf("query.Spaces = %s, want a filter selecting nothing", h.searcher.last.Spaces)
		}
	})

	// End to end: what a client actually does with an empty project.
	t.Run("an empty project searched through its membership returns no hits", func(t *testing.T) {
		h := newHarness(t, false)
		r := query(t, h, `{ project(owner: "bigbes", name: "fresh") { spaces { ref } } }`)
		var project struct {
			Project struct {
				Spaces []struct{ Ref string }
			}
		}
		ok(t, r, &project)

		refs := make([]string, 0, len(project.Project.Spaces))
		for _, s := range project.Project.Spaces {
			refs = append(refs, `"`+s.Ref+`"`)
		}
		r = query(t, h, `{ search(query: "storage", spaces: [`+strings.Join(refs, ",")+`]) { total } }`)
		var got struct{ Search struct{ Total int } }
		ok(t, r, &got)
		if got.Search.Total != 0 {
			t.Fatalf("an empty project's search matched %d documents", got.Search.Total)
		}
	})

	t.Run("limit and offset are passed through", func(t *testing.T) {
		h := newHarness(t, false)
		ok(t, query(t, h, `{ search(query: "storage", limit: 5, offset: 10) { total } }`), nil)
		if h.searcher.last.Limit != 5 || h.searcher.last.Offset != 10 {
			t.Errorf("limit/offset = %d/%d", h.searcher.last.Limit, h.searcher.last.Offset)
		}
	})

	t.Run("a negative limit is refused", func(t *testing.T) {
		h := newHarness(t, false)
		r := query(t, h, `{ search(query: "storage", limit: -1) { total } }`)
		if len(r.Errors) == 0 {
			t.Fatalf("a negative limit was accepted: %s", r.body)
		}
	})
}

// ---- spaces and projects --------------------------------------------------

func TestSpaces(t *testing.T) {
	h := newHarness(t, false)
	r := query(t, h, `{ spaces { owner name ref created } }`)

	var got struct {
		Spaces []struct {
			Owner, Name, Ref string
			Created          time.Time
		}
	}
	ok(t, r, &got)
	if len(got.Spaces) != 2 {
		t.Fatalf("got %d spaces", len(got.Spaces))
	}
	if got.Spaces[0].Ref != "~bigbes/rfcs" || got.Spaces[0].Owner != "bigbes" || got.Spaces[0].Name != "rfcs" {
		t.Errorf("space = %+v", got.Spaces[0])
	}
	if !got.Spaces[0].Created.Equal(created) {
		t.Errorf("created = %v", got.Spaces[0].Created)
	}
}

func TestSpaceApprovedRev(t *testing.T) {
	h := newHarness(t, false)
	r := query(t, h, `{ space(owner: "bigbes", name: "rfcs") { ref approvedRev } }`)

	var got struct {
		Space struct{ Ref, ApprovedRev string }
	}
	ok(t, r, &got)
	if got.Space.ApprovedRev != headRev {
		t.Errorf("approvedRev = %q, want %q", got.Space.ApprovedRev, headRev)
	}
}

func TestAbsentSpaceIsNull(t *testing.T) {
	h := newHarness(t, false)
	r := query(t, h, `{ space(owner: "bigbes", name: "nope") { ref } }`)
	var got struct{ Space *struct{ Ref string } }
	ok(t, r, &got)
	if got.Space != nil {
		t.Errorf("space = %+v, want null", got.Space)
	}
}

func TestOwnerDecorationIsNotPartOfTheName(t *testing.T) {
	h := newHarness(t, false)
	r := query(t, h, `{ space(owner: "~bigbes", name: "rfcs") { ref } }`)
	if len(r.Errors) == 0 {
		t.Fatalf("a '~'-decorated owner was accepted: %s", r.body)
	}
}

func TestProjects(t *testing.T) {
	h := newHarness(t, false)

	t.Run("a project lists its member spaces", func(t *testing.T) {
		r := query(t, h, `{ project(owner: "bigbes", name: "docs") { ref meta spaces { ref } } }`)
		var got struct {
			Project struct {
				Ref    string
				Meta   bool
				Spaces []struct{ Ref string }
			}
		}
		ok(t, r, &got)
		if got.Project.Ref != "~bigbes/+docs" || got.Project.Meta {
			t.Errorf("project = %+v", got.Project)
		}
		if len(got.Project.Spaces) != 1 || got.Project.Spaces[0].Ref != "~bigbes/rfcs" {
			t.Errorf("spaces = %+v", got.Project.Spaces)
		}
	})

	// A project is a saved filter, and a filter with no terms selects nothing.
	// Collapsing that into "everything" would turn a freshly created project
	// into the whole corpus — invisibly, and the opposite of what its author
	// asked for.
	t.Run("an empty project selects nothing", func(t *testing.T) {
		r := query(t, h, `{ project(owner: "bigbes", name: "fresh") { ref spaces { ref } } }`)
		var got struct {
			Project struct {
				Ref    string
				Spaces []struct{ Ref string }
			}
		}
		ok(t, r, &got)
		if len(got.Project.Spaces) != 0 {
			t.Fatalf("an empty project resolved to %d spaces: %+v", len(got.Project.Spaces), got.Project.Spaces)
		}
	})

	// The meta-project is an address that resolves to a filter, not a row: it
	// has no membership to be missing and cannot be looked up.
	t.Run("the meta-project resolves without a row", func(t *testing.T) {
		r := query(t, h, `{ project(owner: "bigbes", name: "everything") { ref meta spaces { ref } } }`)
		var got struct {
			Project struct {
				Ref    string
				Meta   bool
				Spaces []struct{ Ref string }
			}
		}
		ok(t, r, &got)
		if got.Project.Ref != "~bigbes/+everything" || !got.Project.Meta {
			t.Errorf("meta-project = %+v", got.Project)
		}
		if len(got.Project.Spaces) != 2 {
			t.Errorf("the meta-project lists %d spaces, want every space", len(got.Project.Spaces))
		}
	})

	t.Run("an absent project is null", func(t *testing.T) {
		r := query(t, h, `{ project(owner: "bigbes", name: "nope") { ref } }`)
		var got struct{ Project *struct{ Ref string } }
		ok(t, r, &got)
		if got.Project != nil {
			t.Errorf("project = %+v, want null", got.Project)
		}
	})

	// The listing is rows only. The meta-project is not one, which is what
	// makes it impossible to rename, delete or forget to keep in step.
	t.Run("the listing carries only stored projects", func(t *testing.T) {
		r := query(t, h, `{ projects { ref meta } }`)
		var got struct {
			Projects []struct {
				Ref  string
				Meta bool
			}
		}
		ok(t, r, &got)
		if len(got.Projects) != 2 {
			t.Fatalf("got %d projects", len(got.Projects))
		}
		for _, p := range got.Projects {
			if p.Meta {
				t.Errorf("%s is listed as the meta-project", p.Ref)
			}
		}
	})
}

// ---- proposals ------------------------------------------------------------

func TestProposals(t *testing.T) {
	h := newHarness(t, true)
	merged := created.Add(time.Hour)
	h.proposals.rows = []Proposal{
		{
			ID: 42, Space: demoSpace, Title: "Rewrite the storage model",
			Rationale: "because", BaseRev: headRev, Branch: "proposals/42",
			State: core.StateOpen, Agent: "claude-code/spec-writer",
			AgentSession: "session-1", Created: created,
		},
		{
			ID: 43, Space: demoSpace, Title: "Already landed",
			BaseRev: headRev, Branch: "proposals/43", State: core.StateMerged,
			Approval: core.ApprovalPolicy, MergedRev: oldRev,
			Agent: "claude-code/spec-writer", AgentSession: "session-2",
			Created: created, Resolved: &merged,
		},
	}

	t.Run("open", func(t *testing.T) {
		r := query(t, h, `{
			proposals(space: "~bigbes/rfcs", state: OPEN) {
				id space title rationale baseRev branch state approval mergedRev agent agentSession created resolved
			}
		}`)
		var got struct {
			Proposals []struct {
				ID                               int
				Space, Title, Rationale, BaseRev string
				Branch, State                    string
				Approval, MergedRev              *string
				Agent, AgentSession              string
				Created                          time.Time
				Resolved                         *time.Time
			}
		}
		ok(t, r, &got)
		if len(got.Proposals) != 1 {
			t.Fatalf("got %d open proposals", len(got.Proposals))
		}
		p := got.Proposals[0]
		if p.ID != 42 || p.State != "OPEN" || p.Branch != "proposals/42" {
			t.Errorf("proposal = %+v", p)
		}
		// An unmerged proposal has no approval and no merge commit, and must
		// not be reported as though it had either.
		if p.Approval != nil || p.MergedRev != nil || p.Resolved != nil {
			t.Errorf("an open proposal reported approval=%v mergedRev=%v resolved=%v", p.Approval, p.MergedRev, p.Resolved)
		}
	})

	// Auto-merged is not human-approved, and a reader must be able to tell.
	t.Run("merged carries how it was approved", func(t *testing.T) {
		r := query(t, h, `{ proposals(space: "~bigbes/rfcs", state: MERGED) { id state approval mergedRev resolved } }`)
		var got struct {
			Proposals []struct {
				ID                  int
				State               string
				Approval, MergedRev *string
				Resolved            *time.Time
			}
		}
		ok(t, r, &got)
		if len(got.Proposals) != 1 {
			t.Fatalf("got %d merged proposals", len(got.Proposals))
		}
		p := got.Proposals[0]
		if p.Approval == nil || *p.Approval != "POLICY" {
			t.Errorf("approval = %v, want POLICY", p.Approval)
		}
		if p.MergedRev == nil || *p.MergedRev != oldRev || p.Resolved == nil {
			t.Errorf("mergedRev/resolved = %v/%v", p.MergedRev, p.Resolved)
		}
	})

	// Nothing implements the port yet. The field says so rather than answering
	// "no proposals", which would tell a reviewer their queue is clear when it
	// is merely unread.
	t.Run("unwired", func(t *testing.T) {
		bare := newHarness(t, false)
		r := query(t, bare, `{ proposals(space: "~bigbes/rfcs", state: OPEN) { id } }`)
		if len(r.Errors) == 0 {
			t.Fatalf("an unwired proposal listing answered: %s", r.body)
		}
		if !strings.Contains(r.errText(), "no proposal listing") {
			t.Errorf("error does not say what is missing: %s", r.errText())
		}
	})
}

// ---- the schema itself ----------------------------------------------------

// The only mutations are for webhooks (Phase 5). The proposal write plane
// stays off this surface deliberately: its `If-Match` concurrency is an HTTP
// idiom, and a federated type is a consumed contract, so the proposal types are
// not mutated here until they stop moving. A *proposal* mutation appearing here
// is a design change and should fail this test first. There are still no
// subscriptions.
func TestSchemaMutationsAreWebhooksOnly(t *testing.T) {
	h := newHarness(t, false)
	r := query(t, h, `{ __schema {
		mutationType { name fields { name } }
		subscriptionType { name }
	} }`)
	var got struct {
		Schema struct {
			MutationType *struct {
				Name   string
				Fields []struct{ Name string }
			}
			SubscriptionType *struct{ Name string }
		} `json:"__schema"`
	}
	ok(t, r, &got)
	if got.Schema.MutationType == nil {
		t.Fatalf("the schema declares no mutation type; the webhook mutations should be present")
	}
	want := map[string]bool{"createUserWebhook": true, "deleteUserWebhook": true}
	for _, f := range got.Schema.MutationType.Fields {
		if !want[f.Name] {
			t.Errorf("unexpected mutation %q; only webhook mutations belong on this surface "+
				"(proposal writes stay on REST/MCP)", f.Name)
		}
		delete(want, f.Name)
	}
	for name := range want {
		t.Errorf("missing expected webhook mutation %q", name)
	}
	if got.Schema.SubscriptionType != nil {
		t.Errorf("the schema declares a subscription type %q", got.Schema.SubscriptionType.Name)
	}
}

// The mounting call the package documents, exercised: a chi router with no
// middleware of its own, the endpoint at /query, and a query that goes through.
// The daemon's one line is the line under test here.
func TestMountedOnAChiRouter(t *testing.T) {
	resolver, err := authn.NewResolver("bigbes", stubTokenStore{})
	if err != nil {
		t.Fatalf("NewResolver: %v", err)
	}
	srv, err := New(Options{Reader: newFakeReader(), Searcher: &fakeSearcher{}, Resolver: resolver})
	if err != nil {
		t.Fatalf("New: %v", err)
	}
	router := chi.NewRouter()
	router.Handle("/query", srv.Handler())

	h := harness{handler: router}
	var got struct{ Space struct{ Ref string } }
	ok(t, query(t, h, `{ space(owner: "bigbes", name: "rfcs") { ref } }`), &got)
	if got.Space.Ref != "~bigbes/rfcs" {
		t.Errorf("ref = %q", got.Space.Ref)
	}

	// And the gate is still in front of it once mounted.
	if r := post(t, h, `{ spaces { ref } }`, nil); r.status != http.StatusUnauthorized {
		t.Errorf("anonymous request through the router: status = %d, want 401", r.status)
	}
}

// New refuses a half-wired server at startup rather than failing inside the
// first query.
func TestNewRequiresItsSeams(t *testing.T) {
	resolver, err := authn.NewResolver("bigbes", stubTokenStore{})
	if err != nil {
		t.Fatalf("NewResolver: %v", err)
	}
	cases := map[string]Options{
		"no reader":   {Searcher: &fakeSearcher{}, Resolver: resolver},
		"no searcher": {Reader: newFakeReader(), Resolver: resolver},
		"no resolver": {Reader: newFakeReader(), Searcher: &fakeSearcher{}},
	}
	for name, opts := range cases {
		if _, err := New(opts); err == nil {
			t.Errorf("%s: New succeeded", name)
		}
	}
}