#[path = "support/temp.rs"]
mod temp;

use std::fs;

use dever_core::source::SourceMap;
use dever_runtime::config::Settings;

fn sources(files: &[(&str, &str)]) -> SourceMap {
    let mut sources = SourceMap::default();
    for (path, source) in files {
        sources.add(*path, *source);
    }
    sources
}

fn check(files: &[(&str, &str)]) {
    let sources = sources(files);
    dever_core::check(&sources).unwrap_or_else(|errors| {
        panic!(
            "{}",
            errors
                .iter()
                .map(|error| error.render(&sources))
                .collect::<String>()
        )
    });
}

fn reject(files: &[(&str, &str)], expected: &str) {
    let sources = sources(files);
    let errors = dever_core::check(&sources).expect_err("source must be rejected");
    let rendered = errors
        .iter()
        .map(|error| error.render(&sources))
        .collect::<String>();
    assert!(
        rendered.contains(expected),
        "expected {expected}: {rendered}"
    );
}

fn auth_settings() -> (temp::TemporaryDirectory, Settings) {
    let root = temp::TemporaryDirectory::new();
    fs::create_dir(root.path().join("config")).unwrap();
    fs::write(
        root.path().join("config/setting.json"),
        r#"{
          "auth": {
            "providers": {
              "session": {
                "verify": "user.account.verify",
                "jwtSecret": "0123456789abcdef0123456789abcdef"
              }
            }
          },
          "sites": {
            "admin": {"path": "admin", "auth": "session"}
          },
          "database": {
            "default": {
              "type": "sqlite",
              "path": "data/control.db",
              "tenant_directory": "data/tenants"
            }
          },
          "tenant": {
            "database": "default"
          }
        }"#,
    )
    .unwrap();
    let settings = Settings::load_project(root.path()).unwrap();
    (root, settings)
}

fn multi_provider_settings() -> (temp::TemporaryDirectory, Settings) {
    let (root, _) = auth_settings();
    let setting_path = root.path().join("config/setting.json");
    let mut settings: serde_json::Value =
        serde_json::from_str(&fs::read_to_string(&setting_path).unwrap()).unwrap();
    settings["auth"]["providers"]["other"] = serde_json::json!({
        "verify": "admin.principal.verify",
        "jwtSecret": "0123456789abcdef0123456789abcdef",
    });
    settings["sites"]["other"] = serde_json::json!({"path": "other", "auth": "other"});
    fs::write(&setting_path, settings.to_string()).unwrap();
    let settings = Settings::load_project(root.path()).unwrap();
    (root, settings)
}

fn identity_sources() -> [(&'static str, &'static str); 3] {
    [
        (
            "user/account/model.dever",
            "global type Account { email: Text(1, 254) }",
        ),
        (
            "platform/tenant/model.dever",
            "global type Tenant { name: Text(1, 64) }",
        ),
        (
            "user/account/app.dever",
            r#"type Identity {
  id: Text
  user_id: user.account.model.id?
  tenant_id: platform.tenant.model.id?
}
verify(claims: dever.auth.Claims) (identity: Identity) {
  identity = Identity {
    id = claims.subject
    user_id = null
    tenant_id = null
  }
}
profile() (response: Text) {
  response = dever.site.key()
}"#,
        ),
    ]
}

fn configured_check(
    files: &[(&str, &str)],
    settings: &Settings,
) -> Result<dever_core::hir::Program, String> {
    let sources = sources(files);
    dever_core::check_with_settings(&sources, settings).map_err(|errors| {
        errors
            .iter()
            .map(|error| error.render(&sources))
            .collect::<String>()
    })
}

#[test]
fn api_bindings_inherit_app_signatures_without_response_name_requirement() {
    check(&[
        (
            "user/account/app.dever",
            "greet(name: Text) (greeting: Text) { greeting = text.trim(name) }",
        ),
        (
            "user/account/api.dever",
            "get greeting = app.greet\npost greeting = app.greet\nput greeting = app.greet\ndelete greeting = app.greet\ncmd greeting = app.greet",
        ),
    ]);
}

#[test]
fn configured_sites_bind_nested_api_directories_to_checked_auth_hooks() {
    let (_root, settings) = auth_settings();
    let mut files = identity_sources().to_vec();
    files.push((
        "user/account/api/admin/profile.dever",
        "public get profile = app.profile",
    ));

    let source_map = sources(&files);
    let program =
        dever_core::check_with_settings(&source_map, &settings).unwrap_or_else(|errors| {
            panic!(
                "{}",
                errors
                    .iter()
                    .map(|error| error.render(&source_map))
                    .collect::<String>()
            )
        });
    let generated = dever_core::native::emit_project(
        &program,
        &source_map,
        dever_runtime::config::RuntimeProfile::default(),
    )
    .unwrap();
    assert!(generated.contains("dever_runtime::auth::prepare(&[\"admin\"]"));
    assert!(generated.contains("dever_runtime::auth::scope(auth_prepared, auth_identity"));
}

#[test]
fn configured_sites_reject_unmapped_api_directories_and_invalid_verify_records() {
    let (_root, settings) = auth_settings();
    let mut unmapped = identity_sources().to_vec();
    unmapped.push((
        "user/account/api/front/profile.dever",
        "get profile = app.profile",
    ));
    let error = configured_check(&unmapped, &settings).unwrap_err();
    assert!(
        error.contains("not assigned to a configured site"),
        "{error}"
    );

    let invalid_app = identity_sources()[2]
        .1
        .replace("tenant_id: platform.tenant.model.id?", "tenant_id: Int?");
    let mut invalid = identity_sources().to_vec();
    invalid[2] = ("user/account/app.dever", &invalid_app);
    invalid.push((
        "user/account/api/admin/profile.dever",
        "get profile = app.profile",
    ));
    let error = configured_check(&invalid, &settings).unwrap_err();
    assert!(
        error.contains("identity must be an App-owned public record"),
        "{error}"
    );
}

#[test]
fn verify_is_read_only() {
    let (_root, settings) = auth_settings();
    let writing_verify = identity_sources()[2].1.replace(
        "identity = Identity {",
        "account = model.create({ email = claims.subject })\n  identity = Identity {",
    );
    let mut writing = identity_sources().to_vec();
    writing[2] = ("user/account/app.dever", &writing_verify);
    writing.push((
        "user/account/api/admin/profile.dever",
        "get profile = app.profile",
    ));
    let error = configured_check(&writing, &settings).unwrap_err();
    assert!(
        error.contains("authentication verify cannot write"),
        "{error}"
    );
}

#[test]
fn trusted_identity_getters_preserve_nominal_ids_and_nullable_representation() {
    let (_root, settings) = auth_settings();
    let mut files = identity_sources().to_vec();
    files.extend([
        (
            "news/reader/app.dever",
            r#"
type Profile {
  user: user.account.model.id?
  tenant: platform.tenant.model.id?
  raw: Int?
}
profile() (profile: Profile) {
  profile = Profile {
    user = dever.auth.user_id()
    tenant = dever.auth.tenant_id()
    raw = dever.auth.user_id()
  }
}
current_user() (user: user.account.model.id) {
  user = require_user(dever.auth.user_id())
}
require_user(value: user.account.model.id) (user: user.account.model.id) {
  user = value
}
require_user(value: null) (user: user.account.model.id) {
  fail(dever.api.Error.Unauthorized)
}
owns(id: user.account.model.id) (owned: Bool) {
  owned = dever.auth.owns_user(id)
}
"#,
        ),
        (
            "news/reader/api/admin/profile.dever",
            "get profile = app.profile\nget current = app.current_user\nget owns = app.owns",
        ),
    ]);
    let source_map = sources(&files);
    dever_core::check(&source_map).expect("source-only checking defers provider binding");
    let program =
        dever_core::check_with_settings(&source_map, &settings).unwrap_or_else(|errors| {
            panic!(
                "{}",
                errors
                    .iter()
                    .map(|error| error.render(&source_map))
                    .collect::<String>()
            )
        });
    let native = dever_core::native::emit_project(
        &program,
        &source_map,
        dever_runtime::config::RuntimeProfile {
            sqlite: true,
            postgres: false,
        },
    )
    .unwrap();
    assert!(native.contains("dever_runtime::auth::user_id().map(|value| value.map(T"));
    assert!(native.contains("dever_runtime::auth::tenant_id().map(|value| value.map(T"));
    let llvm = dever_core::llvm::emit_application(&program, &source_map).unwrap();
    assert!(llvm.contains("@dever_rt_v1_auth_user_id"));
    assert!(llvm.contains("@dever_rt_v1_auth_tenant_id"));
}

#[test]
fn trusted_identity_getters_reject_wrong_ids_and_implicit_casts() {
    let (_root, settings) = auth_settings();
    for (app, message) in [
        (
            "profile() (value: platform.tenant.model.id?) { value = dever.auth.user_id() }",
            "nominal ID must match provider",
        ),
        (
            "profile() (value: user.account.model.id?) { value = dever.auth.tenant_id() }",
            "nominal ID must match provider",
        ),
        (
            "profile(id: platform.tenant.model.id) (owned: Bool) { owned = dever.auth.owns_user(id) }",
            "nominal ID must match provider",
        ),
        (
            "profile() (value: user.account.model.id) { value = dever.auth.user_id() }",
            "C005",
        ),
        (
            "profile(raw: Int?) (value: user.account.model.id?) { value = raw }",
            "C005",
        ),
        (
            "profile() (value: user.account.model.id?) { value = 1 }",
            "C005",
        ),
        (
            "profile() (value: user.account.model.id?) { raw = dever.auth.user_id()\nvalue = raw }",
            "C005",
        ),
    ] {
        let mut files = identity_sources().to_vec();
        files.extend([
            ("news/reader/app.dever", app),
            (
                "news/reader/api/admin/profile.dever",
                "get profile = app.profile",
            ),
        ]);
        let error = configured_check(&files, &settings).unwrap_err();
        assert!(error.contains(message), "{app}: {error}");
    }
}

#[test]
fn trusted_identity_getters_require_matching_providers_at_every_route() {
    let (_root, settings) = multi_provider_settings();
    let other_provider = identity_sources()[2]
        .1
        .replace("user.account.model.id?", "admin.principal.model.id?");
    for app in [
        "profile() (value: user.account.model.id?) { value = dever.auth.user_id() }",
        "profile(id: user.account.model.id) (owned: Bool) { owned = dever.auth.owns_user(id) }",
    ] {
        let mut files = identity_sources().to_vec();
        files.extend([
            (
                "admin/principal/model.dever",
                "global type Principal { name: Text }",
            ),
            ("admin/principal/app.dever", other_provider.as_str()),
            ("news/reader/app.dever", app),
            (
                "news/reader/api/admin/profile.dever",
                "get profile = app.profile",
            ),
            (
                "news/reader/api/other/profile.dever",
                "get profile = app.profile",
            ),
        ]);
        let error = configured_check(&files, &settings).unwrap_err();
        assert!(
            error.contains("C006") && error.contains("provider 'other'"),
            "{error}"
        );
    }
}

#[test]
fn rest_identity_bindings_preserve_matching_nominal_ids() {
    let (_root, settings) = auth_settings();
    let mut files = identity_sources().to_vec();
    files.extend([
        (
            "news/article/model.dever",
            r#"type Article {
  private owner author: user.account.model.id = dever.auth.user_id()
  title: Text
  linked_user: user.account.model.id? create = dever.auth.user_id() replace = dever.auth.user_id()
  linked_tenant: platform.tenant.model.id? create = dever.auth.tenant_id() replace = dever.auth.tenant_id()
}"#,
        ),
        ("news/article/api/admin/manage.dever", "rest model"),
    ]);
    check(&files);
    let program = configured_check(&files, &settings).unwrap();
    let source_map = sources(&files);
    let native = dever_core::native::emit_project(
        &program,
        &source_map,
        dever_runtime::config::RuntimeProfile {
            sqlite: true,
            postgres: false,
        },
    )
    .unwrap();
    assert!(native.contains("dever_runtime::auth::user_id().map(|value| value.map(T"));
    assert!(native.contains("dever_runtime::auth::tenant_id().map(|value| value.map(T"));
    let llvm = dever_core::llvm::emit_application(&program, &source_map).unwrap();
    assert!(llvm.contains("@dever_rt_v1_auth_user_id"));
    assert!(llvm.contains("@dever_rt_v1_auth_tenant_id"));
}

#[test]
fn rest_identity_bindings_reject_wrong_provider_ids() {
    let (_root, settings) = auth_settings();
    for field in [
        "linked: platform.tenant.model.id? create = dever.auth.user_id()",
        "linked: platform.tenant.model.id? replace = dever.auth.user_id()",
        "linked: user.account.model.id? create = dever.auth.tenant_id()",
        "linked: user.account.model.id? replace = dever.auth.tenant_id()",
        "private owner linked: platform.tenant.model.id = dever.auth.user_id()",
        "private owner linked: user.account.model.id = dever.auth.tenant_id()",
    ] {
        let model = format!("type Article {{\n title: Text\n {field}\n}}");
        let mut files = identity_sources().to_vec();
        files.extend([
            ("news/article/model.dever", model.as_str()),
            ("news/article/api/admin/manage.dever", "rest model"),
        ]);
        check(&files);
        let error = configured_check(&files, &settings).unwrap_err();
        assert!(
            error.contains("C006") && error.contains("provider 'session'"),
            "{field}: {error}"
        );
    }
}

#[test]
fn rest_identity_bindings_match_each_sites_provider() {
    let (_root, settings) = multi_provider_settings();
    let other_provider = identity_sources()[2]
        .1
        .replace("user.account.model.id?", "admin.principal.model.id?");
    for field in [
        "linked: user.account.model.id? create = dever.auth.user_id()",
        "linked: user.account.model.id? replace = dever.auth.user_id()",
        "private owner linked: user.account.model.id = dever.auth.user_id()",
    ] {
        let model = format!("type Article {{\n title: Text\n {field}\n}}");
        let mut files = identity_sources().to_vec();
        files.extend([
            (
                "admin/principal/model.dever",
                "global type Principal { name: Text }",
            ),
            ("admin/principal/app.dever", other_provider.as_str()),
            ("news/article/model.dever", model.as_str()),
            ("news/article/api/admin/manage.dever", "rest model"),
        ]);
        configured_check(&files, &settings).expect("first site's provider matches");
        files.push(("news/article/api/other/manage.dever", "rest model"));
        let error = configured_check(&files, &settings).unwrap_err();
        assert!(
            error.contains("C006") && error.contains("provider 'other'"),
            "{field}: {error}"
        );
    }
}

#[test]
fn nominal_identity_getters_do_not_gain_public_cmd_or_job_context() {
    let (_root, settings) = auth_settings();
    let app = "profile() (value: user.account.model.id?) { value = dever.auth.user_id() }";
    for (path, declaration, message) in [
        (
            "news/reader/api/admin/profile.dever",
            "public get profile = app.profile",
            "requires a protected API",
        ),
        (
            "news/reader/api.dever",
            "cmd profile = app.profile",
            "not available from CMD or Job",
        ),
        (
            "news/reader/job.dever",
            "database default\njob sample() () retry(3) timeout(1000) { value = app.profile() }",
            "not available from CMD or Job",
        ),
    ] {
        let mut files = identity_sources().to_vec();
        files.extend([("news/reader/app.dever", app), (path, declaration)]);
        let error = configured_check(&files, &settings).unwrap_err();
        assert!(error.contains("C006") && error.contains(message), "{error}");
    }
}

#[test]
fn nominal_identity_getters_remain_unavailable_to_ordinary_tests() {
    let (_root, settings) = auth_settings();
    let mut files = identity_sources().to_vec();
    files.push((
        "news/reader/app.dever",
        "profile() (value: user.account.model.id?) { value = dever.auth.user_id() }",
    ));
    let mut inputs = sources(&files).compilation_sources().unwrap();
    inputs.push(dever_core::source::CompilationSource {
        logical_path: "news/reader/probe.dever".into(),
        is_test: true,
        text: "probe() () { value = app.profile() }".into(),
    });
    let source_map = SourceMap::from_compilation_sources(&inputs).unwrap();
    let errors = dever_core::check_with_settings(&source_map, &settings).unwrap_err();
    let rendered = errors
        .iter()
        .map(|error| error.render(&source_map))
        .collect::<String>();
    assert!(
        rendered.contains("C006") && rendered.contains("not available from tests"),
        "{rendered}"
    );
}

#[test]
fn protected_api_permissions_are_stable_and_unique_across_paths_and_methods() {
    let (_root, settings) = auth_settings();
    let mut files = identity_sources().to_vec();
    files.push((
        "user/account/api/admin/profile.dever",
        "get profile = app.profile",
    ));
    let program = configured_check(&files, &settings).unwrap();
    assert!(program.api_snapshot().contains(
        "permission user.account.admin.profile method=GET component=user domain=account site=admin action=profile"
    ));

    files.push((
        "user/account/api/admin/alternate.dever",
        "post profile = app.profile",
    ));
    let error = configured_check(&files, &settings).unwrap_err();
    assert!(
        error.contains("duplicate API permission 'user.account.admin.profile'"),
        "{error}"
    );
}

#[test]
fn public_visibility_and_identity_stay_on_http_app_bindings() {
    reject(
        &[
            (
                "user/account/app.dever",
                "profile() (response: Text) { response = \"ok\" }",
            ),
            (
                "user/account/api/admin/profile.dever",
                "public cmd profile = app.profile",
            ),
        ],
        "application visibility is defined by the source role",
    );
    reject(
        &[(
            "user/account/domain.dever",
            "profile() (response: Text) { response = dever.auth.id() }",
        )],
        "available only from App functions",
    );
    reject(
        &[
            (
                "user/account/app.dever",
                "manage() (ok: Bool) { dever.auth.disable_role(\"reader\")\nok = true }",
            ),
            (
                "user/account/api/admin/manage.dever",
                "public post manage = app.manage",
            ),
        ],
        "public API call chains cannot administer authorization",
    );
}

#[test]
fn public_api_cannot_reach_a_tenant_component() {
    let (_root, settings) = auth_settings();
    let mut files = identity_sources().to_vec();
    files.extend([
        (
            "news/article/model.dever",
            "type Article { title: Text(1, 160) }",
        ),
        (
            "news/article/app.dever",
            "count() (value: Int) { value = model.count() }",
        ),
        (
            "news/article/api/admin/browse.dever",
            "public get count = app.count",
        ),
    ]);
    let error = configured_check(&files, &settings).unwrap_err();
    assert!(
        error.contains("public API cannot reach tenant components [news]"),
        "{error}"
    );
}

#[test]
fn json_bindings_accept_wire_records_but_query_bindings_require_scalars() {
    let app = "type Input { name: Text }\nupdate(input: Input) (value: Text) { value = text.trim(input.name) }";
    check(&[
        ("user/account/app.dever", app),
        (
            "user/account/api.dever",
            "put profile = app.update\ncmd update = app.update",
        ),
    ]);
    reject(
        &[
            ("user/account/app.dever", app),
            ("user/account/api.dever", "get profile = app.update"),
        ],
        "wire-safe scalars",
    );
}

#[test]
fn api_bindings_reject_legacy_bodies_cross_domain_and_ambiguous_targets() {
    reject(
        &[(
            "user/account/api.dever",
            "get_name() (response: Text) { response = \"x\" }",
        )],
        "handler function bodies and legacy prefixes",
    );
    reject(
        &[("user/account/api.dever", "post save = user.profile.save")],
        "same domain",
    );
    reject(
        &[("user/account/api.dever", "post save = app.missing")],
        "unambiguous same-domain",
    );
    reject(
        &[
            (
                "user/account/app.dever",
                "save() (value: Text) { value = \"x\" }\nsave(name: Text) (value: Text) { value = text.trim(name) }",
            ),
            ("user/account/api.dever", "post save = app.save"),
        ],
        "unambiguous same-domain",
    );
}

#[test]
fn duplicate_routes_and_commands_are_rejected() {
    let app = "greet() (value: Text) { value = \"hello\" }";
    for (declaration, diagnostic) in [
        ("get hello = app.greet", "duplicate HTTP route"),
        ("cmd hello = app.greet", "duplicate command"),
    ] {
        let api = format!("{declaration}\n{declaration}");
        reject(
            &[
                ("user/account/app.dever", app),
                ("user/account/api.dever", &api),
            ],
            diagnostic,
        );
    }
    reject(
        &[
            ("user/account/app.dever", app),
            ("user/account/api.dever", "cmd hello = app.greet"),
            (
                "user/account/api/maintenance.dever",
                "cmd hello = app.greet",
            ),
        ],
        "duplicate command",
    );
}

fn sql_projection_files(sqlite: &str, postgres: &str, method: &str) -> [(&'static str, String); 3] {
    [
        (
            "news/article/model.dever",
            format!(
                "type Article {{\n  name: Text\n  private draft: Bool default true\n}}\n\
                 sql lookup(name: Text, size: Int) (rows: List<app.View>) {{\n\
                   sqlite = {sqlite:?}\n  postgres = {postgres:?}\n}}\n"
            ),
        ),
        (
            "news/article/app.dever",
            "type View { name: Text }\n\
             read(name: Text, size: Int) (rows: List<View>) {\n\
               rows = model.lookup(name, size)\n}\n"
                .into(),
        ),
        (
            "news/article/api.dever",
            format!("{method} read = app.read\n"),
        ),
    ]
}

#[test]
fn get_accepts_only_proven_single_model_sql_projections() {
    for sqlite in [
        "SELECT name FROM article WHERE name = ?1 ORDER BY id DESC LIMIT ?2",
        "select \"name\" from \"article\" where \"name\" = ?1 AND name = ?1 order by id desc, name asc limit ?2;",
    ] {
        let postgres = sqlite.replace('?', "$");
        let files = sql_projection_files(sqlite, &postgres, "get");
        check(
            &files
                .iter()
                .map(|(path, source)| (*path, source.as_str()))
                .collect::<Vec<_>>(),
        );
    }
}

#[test]
fn unproven_sql_keeps_its_write_effect_in_each_dialect() {
    let plain = "SELECT name FROM article WHERE name = ?1 ORDER BY id DESC LIMIT ?2";
    for unproven in [
        "SELECT name FROM other_article WHERE name = ?1 ORDER BY id DESC LIMIT ?2",
        "SELECT missing FROM article WHERE name = ?1 ORDER BY id DESC LIMIT ?2",
        "SELECT lower(name) FROM article WHERE name = ?1 ORDER BY id DESC LIMIT ?2",
        "WITH changed AS (UPDATE article SET name = ?1 WHERE id = ?2 RETURNING name) SELECT name FROM changed",
        "SELECT name FROM article WHERE name = ?1 LIMIT ?2; DELETE FROM article",
        "UPDATE article SET name = ?1 WHERE id = ?2 RETURNING name",
        "SELECT name INTO copied_article FROM article WHERE name = ?1 LIMIT ?2",
        "SELECT name FROM article WHERE name = ?1 LIMIT ?2 FOR UPDATE",
        "SELECT name FROM article WHERE name = ?1 LIMIT ?2 -- unproved comment",
    ] {
        let plain_postgres = plain.replace('?', "$");
        let unproven_postgres = unproven.replace('?', "$");
        for (sqlite, postgres) in [
            (unproven, plain_postgres.as_str()),
            (plain, unproven_postgres.as_str()),
        ] {
            let files = sql_projection_files(sqlite, postgres, "get");
            reject(
                &files
                    .iter()
                    .map(|(path, source)| (*path, source.as_str()))
                    .collect::<Vec<_>>(),
                "GET App call chains cannot write",
            );
            let files = sql_projection_files(sqlite, postgres, "post");
            check(
                &files
                    .iter()
                    .map(|(path, source)| (*path, source.as_str()))
                    .collect::<Vec<_>>(),
            );
        }
    }
}

#[test]
fn get_rejects_writes_reached_through_cross_domain_app_calls() {
    let writer = "create(name: Text) (value: Text) { account = model.create({ name = text.trim(name) })\nvalue = account.name }";
    reject(
        &[
            (
                "user/account/model.dever",
                "type Account { name: Text(1, 64) }",
            ),
            ("user/account/app.dever", writer),
            (
                "user/report/app.dever",
                "greet(name: Text) (value: Text) { value = \"hello \" + user.account.create(name) }",
            ),
            ("user/report/api.dever", "get greeting = app.greet"),
        ],
        "GET App call chains cannot write",
    );
    check(&[
        (
            "user/account/model.dever",
            "type Account { name: Text(1, 64) }",
        ),
        ("user/account/app.dever", writer),
        ("user/account/api.dever", "post create = app.create"),
    ]);
    check(&[
        (
            "user/account/model.dever",
            "type Account { name: Text(1, 64) }",
        ),
        (
            "user/account/app.dever",
            "count() (value: Text) { value = int.to_text(model.count()) }",
        ),
        ("user/account/api.dever", "get count = app.count"),
    ]);
    reject(
        &[
            (
                "user/account/app.dever",
                "disable() (ok: Bool) { dever.auth.disable_role(\"reader\")\nok = true }",
            ),
            ("user/account/api.dever", "get disable = app.disable"),
        ],
        "GET App call chains cannot write database or authorization state",
    );
}

#[test]
fn rest_requires_unambiguous_same_domain_model_and_rejects_duplicate_registration() {
    let model = "type Account { name: Text(1, 64) }";
    check(&[
        ("user/account/model.dever", model),
        ("user/account/api.dever", "rest"),
    ]);
    check(&[
        ("user/account/model.dever", model),
        ("user/account/api.dever", "rest model"),
    ]);
    reject(
        &[("user/account/api.dever", "rest")],
        "requires one same-domain Model",
    );
    reject(
        &[
            ("user/account/model.dever", model),
            ("user/account/api.dever", "rest\nrest"),
        ],
        "duplicate HTTP route",
    );
}

#[test]
fn rest_selector_disambiguates_main_and_topic_models() {
    let main = (
        "user/account/model.dever",
        "type Account { name: Text(1, 64) }",
    );
    let detail = (
        "user/account/model/detail.dever",
        "type Detail { title: Text(1, 64) }",
    );
    reject(
        &[main, detail, ("user/account/api.dever", "rest")],
        "requires one same-domain Model",
    );
    check(&[
        main,
        detail,
        ("user/account/api.dever", "rest model.detail"),
    ]);
    let alternate = (
        "user/account/model/archive.dever",
        "type Archive { name: Text(1, 64) }",
    );
    reject(
        &[detail, alternate, ("user/account/api.dever", "rest")],
        "requires one same-domain Model",
    );
    reject(
        &[main, ("user/account/api.dever", "rest user.profile.model")],
        "requires one same-domain Model",
    );
}

#[test]
fn generated_rest_and_custom_bindings_cannot_register_the_same_route() {
    reject(
        &[
            (
                "user/account/model.dever",
                "type Account { name: Text(1, 64) }",
            ),
            (
                "user/account/app.dever",
                "details() (value: Text) { value = \"details\" }",
            ),
            ("user/account/api.dever", "get details = app.details"),
            ("user/account/api/details.dever", "rest model"),
        ],
        "duplicate HTTP route",
    );
}

#[test]
fn api_declarations_format_idempotently() {
    let mut sources = SourceMap::default();
    sources.add("user/account/api.dever", "# Actions\npost  publish=app.publish # publish article\ncmd rebuild =app.rebuild\nrest model\n");
    let source = sources.files().first().unwrap();
    let formatted = dever_core::format::format(source).unwrap();
    assert!(formatted.contains("post publish = app.publish"));
    assert!(formatted.contains("cmd rebuild = app.rebuild"));
    assert!(formatted.contains("rest model"));
    assert!(formatted.contains("# Actions"));
    assert!(formatted.contains("# publish article"));
    let mut roundtrip = SourceMap::default();
    roundtrip.add("user/account/api.dever", formatted.clone());
    assert_eq!(
        dever_core::format::format(roundtrip.files().first().unwrap()).unwrap(),
        formatted
    );
}

#[test]
fn markdown_api_declarations_share_plain_source_contracts() {
    let markdown = "# 账户接口\n\n绑定账户业务能力。\n\n- 包：`user.account.api`\n- 公开类型：无\n- 公开方法：无\n- 使用：无\n\n## 问候\n\n提供账户问候接口。\n\n- 声明：`get greeting`\n\n```dever\nget greeting = app.greet\n```\n";
    check(&[
        (
            "user/account/app.dever",
            "greet() (value: Text) { value = \"hello\" }",
        ),
        ("user/account/api.dever.md", markdown),
    ]);
    let invalid = markdown.replace("`get greeting`", "`post greeting`");
    reject(
        &[
            (
                "user/account/app.dever",
                "greet() (value: Text) { value = \"hello\" }",
            ),
            ("user/account/api.dever.md", &invalid),
        ],
        "documented Model declaration",
    );
}