aranya-client 6.0.0

use std::{ptr, time::Duration};

use anyhow::{bail, Context, Result};
use tracing::{debug, info};

use super::common::{sleep, DeviceCtx, DevicesCtx, SLEEP_INTERVAL};
#[cfg(feature = "preview")]
use crate::config::HelloSubscriptionConfig;
use crate::{
    client::{ChanOp, Permission},
    config::{CreateTeamConfig, SyncPeerConfig},
    text, AddTeamConfig, AddTeamQuicSyncConfig, CreateTeamQuicSyncConfig, Rank,
};

/// Tests getting keybundle and device ID.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_get_keybundle_device_id() -> Result<()> {
    let devices = DevicesCtx::new("test_get_keybundle_device_id").await?;

    // Note: get_device_id() and get_key_bundle() are already invoked in `DevicesCtx::new()`.
    // This test makes sure we don't accidentally break the API from a backward compatibility standpoint.
    assert_eq!(
        devices.owner.client.get_device_id().await?,
        devices.owner.id
    );
    assert_eq!(
        devices.owner.client.get_public_key_bundle().await?,
        devices.owner.pk
    );

    Ok(())
}

/// Tests generating random numbers with the aranya client.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_client_rand() -> Result<()> {
    let devices = DevicesCtx::new("test_get_keybundle_device_id").await?;

    let mut buf1 = vec![0u8; 100];
    devices.owner.client.rand(&mut buf1).await;
    let mut buf2 = vec![0u8; 100];
    devices.owner.client.rand(&mut buf2).await;

    // Randomly generated numbers should never match.
    assert_ne!(buf1, buf2);

    Ok(())
}

#[tokio::test(flavor = "multi_thread")]
async fn test_trace_id_round_trip() -> Result<()> {
    let work_dir = tempfile::tempdir()?;
    let owner = DeviceCtx::new("trace-roundtrip", "owner", work_dir.path().join("owner")).await?;

    let (client_trace_id, daemon_trace_id) = owner.client.test_trace_id().await?;
    info!("client trace_id: {client_trace_id}");
    info!("daemon trace_id: {daemon_trace_id}");

    assert_eq!(client_trace_id, daemon_trace_id);
    assert_ne!(client_trace_id, "00");

    Ok(())
}

/// Tests sync_now() by showing that an admin cannot perform operations until it syncs with the owner.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_sync_now() -> Result<()> {
    // Set up our team context so we can run the test.
    let mut devices = DevicesCtx::new("test_sync_now").await?;

    // Create the initial team, and get our TeamId and seed.
    let team_id = devices.create_and_add_team().await?;

    let roles = devices
        .setup_default_roles(team_id)
        .await
        .context("unable to setup default roles")?;

    let owner_addr = devices.owner.aranya_local_addr().await?;

    let owner = devices.owner.client.team(team_id);
    let admin = devices.admin.client.team(team_id);

    // Add the admin as a new device, but don't give it a role.
    let admin_role_rank = devices
        .owner
        .client
        .team(team_id)
        .rank(roles.admin().id)
        .await?;
    owner
        .add_device(
            devices.admin.pk.clone(),
            None,
            Rank::new(admin_role_rank.value().saturating_sub(1)),
        )
        .await
        .context("owner unable to add admin to team")?;

    // Add the operator as a new device, but don't give it a role.
    let operator_role_rank = devices
        .owner
        .client
        .team(team_id)
        .rank(roles.operator().id)
        .await?;
    owner
        .add_device(
            devices.operator.pk.clone(),
            None,
            Rank::new(operator_role_rank.value().saturating_sub(1)),
        )
        .await
        .context("owner unable to add operator to team")?;

    // Finally, let's give the admin its role, but don't sync with peers.
    owner
        .device(devices.admin.id)
        .assign_role(roles.admin().id)
        .await
        .context("owner unable to assign admin role")?;

    // Now, we try to assign a role using the admin, which is expected to fail
    // because the admin hasn't synced yet and doesn't know about its role.
    let err = admin
        .device(devices.operator.id)
        .assign_role(roles.operator().id)
        .await
        .expect_err("admin has not synced yet, role assignment should fail");
    assert!(matches!(err, crate::Error::Aranya(_)), "{err:?}");

    // Let's sync immediately, which will propagate the role change.
    admin
        .sync_now(owner_addr, None)
        .await
        .context("admin unable to sync with owner")?;

    // Now we should be able to successfully create a label (admin has CreateLabel perm).
    let member_role_rank = admin.rank(roles.member().id).await?;
    // Label rank must be lower than the member role rank so all team members can operate on it.
    let label_rank = Rank::new(member_role_rank.value().saturating_sub(1));
    admin
        .create_label(text!("test_label"), label_rank)
        .await
        .context("admin unable to create label after sync")?;

    Ok(())
}

/// Tests adding/removing sync peers.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_add_remove_sync_peers() -> Result<()> {
    let mut devices = DevicesCtx::new("test_add_remove_sync_peers").await?;
    let team_id = devices
        .create_and_add_team()
        .await
        .expect("expected to create team");

    // create default roles
    let roles = devices.setup_default_roles(team_id).await?;

    // add all sync peers with sync intervals.
    devices
        .add_all_sync_peers(team_id)
        .await
        .context("unable to add all sync peers")?;

    // TODO: if this is removed the label queries have a seal error.
    devices.add_all_device_roles(team_id, &roles).await?;

    // Add a command to graph by having the owner create a label.
    let owner_team = devices.owner.client.team(team_id);
    let member_role_rank = owner_team.rank(roles.member().id).await?;
    // Label rank must be lower than the member role rank so all team members can operate on it.
    let label_rank = Rank::new(member_role_rank.value().saturating_sub(1));
    owner_team.create_label(text!("label1"), label_rank).await?;

    // Wait for syncing.
    // We're sleeping here rather than syncing via `sync_now()` to test periodic sync functionality.
    sleep(SLEEP_INTERVAL).await;

    // Verify peers automatically sync command with sync peer.
    // They should receive the label that was created.
    let owner_team_labels = owner_team.labels().await?;
    assert_eq!(owner_team_labels.iter().count(), 1);

    let membera_team = devices.membera.client.team(team_id);
    let membera_team_labels = membera_team.labels().await?;
    assert_eq!(membera_team_labels.iter().count(), 1);

    let memberb_team = devices.memberb.client.team(team_id);
    let memberb_team_labels = memberb_team.labels().await?;
    assert_eq!(memberb_team_labels.iter().count(), 1);

    // Remove sync peers.
    for device in devices.devices() {
        for peer in devices.devices() {
            if ptr::eq(device, peer) {
                continue;
            }
            device
                .client
                .team(team_id)
                .remove_sync_peer(peer.aranya_local_addr().await?)
                .await?;
        }
    }

    let owner_addr = devices.owner.aranya_local_addr().await?;
    membera_team.remove_sync_peer(owner_addr).await?;
    let membera_addr = devices.membera.aranya_local_addr().await?;
    owner_team.remove_sync_peer(membera_addr).await?;

    // Create another label.
    owner_team.create_label(text!("label2"), label_rank).await?;

    // Wait for syncing.
    sleep(SLEEP_INTERVAL).await;

    // Verify device doesn't see label after sync peer is removed.
    let labels_after_removing_sync_peer = membera_team.labels().await?;
    assert_eq!(labels_after_removing_sync_peer.iter().count(), 1);

    Ok(())
}

/// Tests creating/assigning/revoking a role.
/// Verifies query indicates correct role assignment status.
/// Verifies device is only allowed to perform operation when role with permission is assigned to it.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_role_create_assign_revoke() -> Result<()> {
    // Set up our team context so we can run the test.
    let devices = DevicesCtx::new("test_role_create_assign_revoke").await?;

    // Grab the shorthand for our address.
    let owner_addr = devices.owner.aranya_local_addr().await?;

    // Create the initial team, and get our TeamId.
    let owner = devices
        .owner
        .client
        .create_team({
            CreateTeamConfig::builder()
                .quic_sync(CreateTeamQuicSyncConfig::builder().build()?)
                .build()?
        })
        .await
        .expect("expected to create team");
    let team_id = owner.team_id();
    info!(?team_id);

    let roles = devices.setup_default_roles(team_id).await?;
    let owner_team = devices.owner.client.team(team_id);
    let admin_team = devices.admin.client.team(team_id);

    // Query to show admin role exists.
    let roles_on_team = owner_team.roles().await?;
    assert_eq!(roles_on_team.iter().count(), 4);
    roles_on_team
        .iter()
        .find(|r| r.name == "admin")
        .ok_or_else(|| anyhow::anyhow!("no admin role"))?;

    let member_role_rank = owner_team.rank(roles.member().id).await?;
    // Label rank must be lower than the member role rank so all team members can operate on it.
    let label_rank = Rank::new(member_role_rank.value().saturating_sub(1));

    // Show that admin cannot create a label.
    admin_team
        .create_label(text!("label1"), label_rank)
        .await
        .expect_err("expected label creation to fail");

    // Add the admin as a new device.
    info!("adding admin to team");
    let admin_role_rank = devices
        .owner
        .client
        .team(team_id)
        .rank(roles.admin().id)
        .await?;
    owner
        .add_device(
            devices.admin.pk.clone(),
            None,
            Rank::new(admin_role_rank.value().saturating_sub(1)),
        )
        .await?;

    // Add team to admin device.
    let admin_seed = owner
        .encrypt_psk_seed_for_peer(devices.admin.pk.encryption())
        .await?;
    devices
        .admin
        .client
        .add_team({
            AddTeamConfig::builder()
                .team_id(team_id)
                .quic_sync(
                    AddTeamQuicSyncConfig::builder()
                        .wrapped_seed(&admin_seed)?
                        .build()?,
                )
                .build()?
        })
        .await?;

    // Admin sync with owner.
    admin_team
        .sync_now(owner_addr, None)
        .await
        .context("admin unable to sync with owner")?;

    // Show that admin cannot create a label.
    admin_team
        .create_label(text!("label1"), label_rank)
        .await
        .expect_err("expected label creation to fail");

    // Give the admin its role.
    owner
        .device(devices.admin.id)
        .assign_role(roles.admin().id)
        .await?;

    // Admin sync with owner.
    admin_team
        .sync_now(owner_addr, None)
        .await
        .context("admin unable to sync with owner")?;

    // Query to show admin role is assigned to admin device.
    let admin_role = admin_team
        .device(devices.admin.id)
        .role()
        .await?
        .expect("expected admin device to have role assigned to it");
    assert_eq!(admin_role.name, text!("admin"));

    // Create label.
    let label1 = admin_team
        .create_label(text!("label1"), label_rank)
        .await
        .expect("expected admin to create label");

    // Confirm there is 1 label on team.
    assert_eq!(admin_team.labels().await?.iter().count(), 1);

    // Confirm created label exists.
    admin_team.label(label1).await?;

    // Revoke role.
    owner
        .device(devices.admin.id)
        .revoke_role(roles.admin().id)
        .await?;

    // Admin sync with owner.
    admin_team
        .sync_now(owner_addr, None)
        .await
        .context("admin unable to sync with owner")?;

    // Query to show admin role is no longer assigned to admin device.
    if admin_team.device(devices.admin.id).role().await?.is_some() {
        bail!("did not expect role to be assigned to admin device");
    }

    // Show that admin cannot create a label.
    admin_team
        .create_label(text!("label1"), label_rank)
        .await
        .expect_err("expected label creation to fail");

    // TODO: issue#575 show operation fails after delete_role() (after it is added to the API).

    Ok(())
}

/// Tests that a role can be changed after it has been assigned to a device.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_role_change() -> Result<()> {
    // Set up our team context so we can run the test.
    let mut devices = DevicesCtx::new("test_role_change").await?;

    // Create the initial team, and get our TeamId and seed.
    let team_id = devices.create_and_add_team().await?;

    let roles = devices
        .setup_default_roles(team_id)
        .await
        .context("unable to setup default roles")?;
    devices.add_all_device_roles(team_id, &roles).await?;

    let owner = devices.owner.client.team(team_id);

    // Assign operator role to membera.
    owner
        .device(devices.membera.id)
        .change_role(roles.member().id, roles.operator().id)
        .await
        .expect("expected to change role from member to operator");

    Ok(())
}

/// Tests that devices can be added to the team.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_add_devices() -> Result<()> {
    let mut team = DevicesCtx::new("test_add_devices").await?;

    let team_id = team
        .create_and_add_team()
        .await
        .expect("expected to create team");
    info!(?team_id);

    let owner = team.owner.client.team(team_id);
    let admin = team.admin.client.team(team_id);
    let operator = team.operator.client.team(team_id);

    // There are now three more roles in addition to the original
    // owner role:
    // - admin
    // - operator
    // - member
    // The owner role manages all of those roles.
    let roles = team
        .setup_default_roles(team_id)
        .await
        .context("unable to setup default roles")?;

    // Add the initial admin who should be allowed to add
    // devices.
    let admin_role_rank = team
        .owner
        .client
        .team(team_id)
        .rank(roles.admin().id)
        .await?;
    owner
        .add_device(
            team.admin.pk.clone(),
            Some(roles.admin().id),
            Rank::new(admin_role_rank.value().saturating_sub(1)),
        )
        .await
        .context("owner should be able to add admin to team")?;

    admin
        .sync_now(team.owner.aranya_local_addr().await?, None)
        .await
        .context("admin unable to sync with owner")?;

    // Admin adds operator without initial role (admin has AddDevice but not AssignRole).
    let operator_role_rank = team
        .owner
        .client
        .team(team_id)
        .rank(roles.operator().id)
        .await?;
    admin
        .add_device(
            team.operator.pk.clone(),
            None,
            Rank::new(operator_role_rank.value().saturating_sub(1)),
        )
        .await
        .context("admin should be able to add operator to team")?;

    // Owner assigns operator role (owner has AssignRole).
    owner
        .sync_now(team.admin.aranya_local_addr().await?, None)
        .await
        .context("owner unable to sync with admin")?;
    owner
        .device(team.operator.id)
        .assign_role(roles.operator().id)
        .await
        .context("owner should be able to assign operator role")?;

    operator
        .sync_now(team.owner.aranya_local_addr().await?, None)
        .await
        .context("operator unable to sync with owner")?;

    let member_role_rank = team
        .owner
        .client
        .team(team_id)
        .rank(roles.member().id)
        .await?;
    for (name, kb, device_id) in [
        ("membera", team.membera.pk.clone(), team.membera.id),
        ("memberb", team.memberb.pk.clone(), team.memberb.id),
    ] {
        // Admin adds members without role (admin has AddDevice but not AssignRole).
        admin
            .add_device(
                kb,
                None,
                Rank::new(member_role_rank.value().saturating_sub(1)),
            )
            .await
            .with_context(|| format!("admin should be able to add `{name}` to team"))?;
        // Operator syncs to see newly added device, then assigns member role (operator has AssignRole).
        operator
            .sync_now(team.admin.aranya_local_addr().await?, None)
            .await
            .context("operator unable to sync with admin")?;
        operator
            .device(device_id)
            .assign_role(roles.member().id)
            .await
            .with_context(|| {
                format!("operator should be able to assign member role to `{name}`")
            })?;
    }

    Ok(())
}

#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_add_device_with_initial_role_requires_outranking() -> Result<()> {
    let mut devices =
        DevicesCtx::new("test_add_device_with_initial_role_requires_outranking").await?;

    let team_id = devices.create_and_add_team().await?;

    let roles = devices
        .setup_default_roles(team_id)
        .await
        .context("unable to setup default roles")?;

    let owner_team = devices.owner.client.team(team_id);
    let admin_team = devices.admin.client.team(team_id);

    // Admin already has AddDevice from setup_default_roles, but needs AssignRole
    // to add a device with an initial role assignment.
    owner_team
        .add_perm_to_role(roles.admin().id, Permission::AssignRole)
        .await
        .context("owner should be able to add AssignRole to admin")?;

    // Add admin with rank below admin role (outranks member role at rank 600).
    let admin_role_rank = devices
        .owner
        .client
        .team(team_id)
        .rank(roles.admin().id)
        .await?;
    let member_role_rank = devices
        .owner
        .client
        .team(team_id)
        .rank(roles.member().id)
        .await?;
    owner_team
        .add_device(
            devices.admin.pk.clone(),
            Some(roles.admin().id),
            Rank::new(admin_role_rank.value().saturating_sub(1)),
        )
        .await
        .context("owner should be able to add admin to team")?;

    admin_team
        .sync_now(devices.owner.aranya_local_addr().await?, None)
        .await
        .context("admin unable to sync with owner")?;

    // Admin should succeed at adding membera with member role
    // because admin outranks the member role and has both AddDevice and AssignRole perms.
    admin_team
        .add_device(
            devices.membera.pk.clone(),
            Some(roles.member().id),
            Rank::new(member_role_rank.value().saturating_sub(1)),
        )
        .await
        .context("admin should be able to add device with member role (admin outranks member)")?;

    // Admin should fail when trying to add a device with the owner role
    // because admin does not outrank the owner role.
    match admin_team
        .add_device(
            devices.memberb.pk.clone(),
            Some(roles.owner().id),
            Rank::new(member_role_rank.value().saturating_sub(1)),
        )
        .await
    {
        Ok(_) => {
            bail!("expected add_device with owner role to fail (admin does not outrank owner)")
        }
        Err(crate::Error::Aranya(_)) => {}
        Err(err) => bail!("unexpected error: {err:?}"),
    }

    Ok(())
}

/// Tests that devices can be removed from the team.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_remove_devices() -> Result<()> {
    // Set up our team context so we can run the test.
    let mut devices = DevicesCtx::new("test_remove_devices").await?;

    // Create the initial team, and get our TeamId.
    let team_id = devices
        .create_and_add_team()
        .await
        .expect("expected to create team");
    info!(?team_id);

    // Setup default roles and ensure delegations exist for helper routines.
    let roles = devices
        .setup_default_roles(team_id)
        .await
        .context("unable to setup default roles")?;

    // Tell all peers to sync with one another, and assign their roles.
    devices.add_all_device_roles(team_id, &roles).await?;

    // Remove devices from the team while checking that the device count decreases each time a device is removed.
    let owner = devices.owner.client.team(team_id);

    assert_eq!(owner.devices().await?.iter().count(), 5);

    owner.device(devices.membera.id).remove_from_team().await?;
    assert_eq!(owner.devices().await?.iter().count(), 4);

    owner.device(devices.memberb.id).remove_from_team().await?;
    assert_eq!(owner.devices().await?.iter().count(), 3);

    owner.device(devices.operator.id).remove_from_team().await?;
    assert_eq!(owner.devices().await?.iter().count(), 2);

    owner.device(devices.admin.id).remove_from_team().await?;
    assert_eq!(owner.devices().await?.iter().count(), 1);

    owner
        .device(devices.owner.id)
        .remove_from_team()
        .await
        .expect_err("owner should not be able to remove itself from team");

    Ok(())
}

/// Tests functionality to make sure that we can query the fact database for various things.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_query_functions() -> Result<()> {
    // Set up our team context so we can run the test.
    let mut devices = DevicesCtx::new("test_query_functions").await?;

    // Create the initial team, and get our TeamId and seed.
    let team_id = devices.create_and_add_team().await?;

    // Set up the default roles first
    let roles = devices
        .setup_default_roles(team_id)
        .await
        .context("unable to setup default roles")?;

    // Tell all peers to sync with one another, and assign their roles.
    devices.add_all_device_roles(team_id, &roles).await?;

    let owner_team = devices.owner.client.team(team_id);
    let member_role_rank = owner_team.rank(roles.member().id).await?;
    // Label rank must be lower than the member role rank so all team members can operate on it.
    let label_rank = Rank::new(member_role_rank.value().saturating_sub(1));
    let label_id = owner_team.create_label(text!("label1"), label_rank).await?;

    // Assigning labels to devices with the "member" role should succeed since it does not have `CanUseAfc` permission.
    let op = ChanOp::SendRecv;
    owner_team
        .device(devices.membera.id)
        .assign_label(label_id, op)
        .await?;
    owner_team
        .device(devices.memberb.id)
        .assign_label(label_id, op)
        .await?;

    // wait for syncing.
    let owner_addr = devices.owner.aranya_local_addr().await?;
    devices
        .membera
        .client
        .team(team_id)
        .sync_now(owner_addr, None)
        .await?;
    devices
        .memberb
        .client
        .team(team_id)
        .sync_now(owner_addr, None)
        .await?;

    // Test all our fact database queries.
    let memberb = devices.membera.client.team(team_id);

    // First, let's check how many devices are on the team.
    let devices_query = memberb.devices().await?;
    assert_eq!(devices_query.iter().count(), 5);
    debug!(
        "membera devices on team: {:?}",
        devices_query.iter().count()
    );

    // Check the specific role(s) a device has.
    let dev_role = memberb.device(devices.membera.id).role().await?;
    assert_eq!(dev_role.as_ref().map(|r| r.id), Some(roles.member().id));
    debug!("membera role: {:?}", dev_role);

    // Make sure that we have the correct keybundle.
    let keybundle = memberb
        .device(devices.membera.id)
        .public_key_bundle()
        .await?;
    debug!("membera keybundle: {:?}", keybundle);

    // Make sure membera can query labels assigned to it.
    let membera_labels = memberb
        .device(devices.membera.id)
        .label_assignments()
        .await?;
    assert_eq!(membera_labels.iter().count(), 1);

    // Make sure owner can query labels created on the team.
    let team_labels = owner_team.labels().await?;
    assert_eq!(team_labels.iter().count(), 1);

    // Make sure owner can query the label on the team.
    owner_team.label(label_id).await?;

    // Query role assigned to a device.
    assert_eq!(
        roles.member().id,
        memberb
            .device(devices.memberb.id)
            .role()
            .await?
            .expect("expected role")
            .id
    );

    // Query all the roles on the team.
    let membera_team = devices.membera.client.team(team_id);
    assert_eq!(membera_team.roles().await?.iter().count(), 4);

    Ok(())
}

/// Tests add_team() by demonstrating that syncing can only occur after
/// a peer calls the add_team() API
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_add_team() -> Result<()> {
    // Set up our team context so we can run the test.
    let devices = DevicesCtx::new("test_add_team").await?;

    // Grab the shorthand for our address.
    let owner_addr = devices.owner.aranya_local_addr().await?;

    // Create the initial team, and get our TeamId.
    let owner = devices
        .owner
        .client
        .create_team({
            CreateTeamConfig::builder()
                .quic_sync(CreateTeamQuicSyncConfig::builder().build()?)
                .build()?
        })
        .await
        .expect("expected to create team");
    let team_id = owner.team_id();
    info!(?team_id);

    let roles = devices.setup_default_roles(team_id).await?;
    let member_role_rank = owner.rank(roles.member().id).await?;
    // Label rank must be lower than the member role rank so all team members can operate on it.
    let label_rank = Rank::new(member_role_rank.value().saturating_sub(1));

    // Add the admin as a new device.
    info!("adding admin to team");
    let admin_role_rank = devices
        .owner
        .client
        .team(team_id)
        .rank(roles.admin().id)
        .await?;
    owner
        .add_device(
            devices.admin.pk.clone(),
            None,
            Rank::new(admin_role_rank.value().saturating_sub(1)),
        )
        .await?;

    // Add the operator as a new device.
    info!("adding operator to team");
    let operator_role_rank = devices
        .owner
        .client
        .team(team_id)
        .rank(roles.operator().id)
        .await?;
    owner
        .add_device(
            devices.operator.pk.clone(),
            None,
            Rank::new(operator_role_rank.value().saturating_sub(1)),
        )
        .await?;

    // Give the admin its role.
    owner
        .device(devices.admin.id)
        .assign_role(roles.admin().id)
        .await?;

    // Let's sync immediately. The role change will not propogate since add_team() hasn't been called.
    {
        let admin = devices.admin.client.team(team_id);
        let err = admin
            .sync_now(owner_addr, None)
            .await
            .expect_err("syncing should fail before add_team()");
        assert!(matches!(err, crate::Error::Aranya(_)), "{err:?}");

        // Now, we try to assign a role using the admin, which is expected to fail
        // because the admin hasn't called add_team() yet.
        let err = admin
            .device(devices.operator.id)
            .assign_role(roles.operator().id)
            .await
            .expect_err("role assignment should fail before add_team()");
        assert!(matches!(err, crate::Error::Aranya(_)), "{err:?}");
    }

    let admin_seed = owner
        .encrypt_psk_seed_for_peer(devices.admin.pk.encryption())
        .await?;
    devices
        .admin
        .client
        .add_team({
            AddTeamConfig::builder()
                .team_id(team_id)
                .quic_sync(
                    AddTeamQuicSyncConfig::builder()
                        .wrapped_seed(&admin_seed)?
                        .build()?,
                )
                .build()?
        })
        .await?;
    {
        let admin = devices.admin.client.team(team_id);
        admin.sync_now(owner_addr, None).await?;

        // Now we should be able to successfully create a label (admin has CreateLabel perm).
        admin
            .create_label(text!("test_label"), label_rank)
            .await
            .context("Creating a label should not fail here!")?;
    }

    return Ok(());
}

/// Tests that devices can be removed from the team.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_remove_team() -> Result<()> {
    // Set up our team context so we can run the test.
    let mut devices = DevicesCtx::new("test_remove_team").await?;

    // Create the initial team, and get our TeamId.
    let team_id = devices
        .create_and_add_team()
        .await
        .expect("expected to create team");
    info!(?team_id);

    let owner = devices.owner.client.team(team_id);
    let roles = devices.setup_default_roles(team_id).await?;
    let member_role_rank = owner.rank(roles.member().id).await?;
    // Label rank must be lower than the member role rank so all team members can operate on it.
    let label_rank = Rank::new(member_role_rank.value().saturating_sub(1));

    {
        let admin = devices.admin.client.team(team_id);

        // Add the operator as a new device.
        info!("adding operator to team");
        let operator_role_rank = devices
            .owner
            .client
            .team(team_id)
            .rank(roles.operator().id)
            .await?;
        owner
            .add_device(
                devices.operator.pk.clone(),
                None,
                Rank::new(operator_role_rank.value().saturating_sub(1)),
            )
            .await?;

        // Add the admin as a new device.
        let admin_role_rank = devices
            .owner
            .client
            .team(team_id)
            .rank(roles.admin().id)
            .await?;
        owner
            .add_device(
                devices.admin.pk.clone(),
                None,
                Rank::new(admin_role_rank.value().saturating_sub(1)),
            )
            .await?;

        // Give the admin its role.
        owner
            .device(devices.admin.id)
            .assign_role(roles.admin().id)
            .await?;

        admin
            .sync_now(devices.owner.aranya_local_addr().await?, None)
            .await?;

        // We should be able to successfully create a label (admin has CreateLabel perm).
        admin.create_label(text!("test_label"), label_rank).await?;
    }

    // Remove the team from the admin's local storage
    devices.admin.client.remove_team(team_id).await?;

    {
        let admin = devices.admin.client.team(team_id);

        // Label creation should fail since the team was removed from local storage above.
        match admin.create_label(text!("test_label2"), label_rank).await {
            Ok(_) => bail!("Expected label creation to fail"),
            Err(crate::Error::Aranya(_)) => {}
            Err(_) => bail!("Unexpected error"),
        }
    }

    Ok(())
}

/// Tests that a device can create multiple teams and receive sync requests for each team.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_multi_team_sync() -> Result<()> {
    // Set up our team context so we can run the test.
    let devices = DevicesCtx::new("test_multi_team_sync").await?;

    // Grab the shorthand for our address.
    let owner_addr = devices.owner.aranya_local_addr().await?;

    // Create the initial team, and get our TeamId.
    let team1 = devices
        .owner
        .client
        .create_team({
            CreateTeamConfig::builder()
                .quic_sync(CreateTeamQuicSyncConfig::builder().build()?)
                .build()?
        })
        .await
        .expect("expected to create team1");
    let team_id1 = team1.team_id();
    info!(?team_id1);

    // Create the second team, and get our TeamId.
    let team2 = devices
        .owner
        .client
        .create_team({
            CreateTeamConfig::builder()
                .quic_sync(CreateTeamQuicSyncConfig::builder().build()?)
                .build()?
        })
        .await
        .expect("expected to create team2");
    let team_id2 = team2.team_id();
    info!(?team_id2);

    // Set up roles for team1
    let roles1 = devices.setup_default_roles(team_id1).await?;

    // Set up roles for team2
    let roles2 = devices.setup_default_roles(team_id2).await?;

    // Add the admin as a new device.
    info!("adding admin to team1");
    let admin_role_rank_t1 = devices
        .owner
        .client
        .team(team_id1)
        .rank(roles1.admin().id)
        .await?;
    let operator_role_rank_t1 = devices
        .owner
        .client
        .team(team_id1)
        .rank(roles1.operator().id)
        .await?;
    team1
        .add_device(
            devices.admin.pk.clone(),
            None,
            Rank::new(admin_role_rank_t1.value().saturating_sub(1)),
        )
        .await?;

    // Add the operator as a new device.
    info!("adding operator to team1");
    team1
        .add_device(
            devices.operator.pk.clone(),
            None,
            Rank::new(operator_role_rank_t1.value().saturating_sub(1)),
        )
        .await?;

    // Give the admin its role.
    team1
        .device(devices.admin.id)
        .assign_role(roles1.admin().id)
        .await?;

    // Add the admin as a new device.
    info!("adding admin to team2");
    let admin_role_rank_t2 = devices
        .owner
        .client
        .team(team_id2)
        .rank(roles2.admin().id)
        .await?;
    let operator_role_rank_t2 = devices
        .owner
        .client
        .team(team_id2)
        .rank(roles2.operator().id)
        .await?;
    team2
        .add_device(
            devices.admin.pk.clone(),
            None,
            Rank::new(admin_role_rank_t2.value().saturating_sub(1)),
        )
        .await?;

    // Add the operator as a new device.
    info!("adding operator to team2");
    team2
        .add_device(
            devices.operator.pk.clone(),
            None,
            Rank::new(operator_role_rank_t2.value().saturating_sub(1)),
        )
        .await?;

    // Give the admin its role.
    team2
        .device(devices.admin.id)
        .assign_role(roles2.admin().id)
        .await?;

    // Let's sync immediately. The role change will not propogate since add_team() hasn't been called.
    {
        let admin = devices.admin.client.team(team_id1);
        let err = admin
            .sync_now(owner_addr, None)
            .await
            .expect_err("syncing team1 should fail before add_team()");
        assert!(matches!(err, crate::Error::Aranya(_)), "{err:?}");

        // Now, we try to assign a role using the admin, which is expected to fail
        // because add_team() hasn't been called yet.
        let err = admin
            .device(devices.operator.id)
            .assign_role(roles1.operator().id)
            .await
            .expect_err("role assignment on team1 should fail before add_team()");
        assert!(matches!(err, crate::Error::Aranya(_)), "{err:?}");
    }

    let admin_seed1 = team1
        .encrypt_psk_seed_for_peer(devices.admin.pk.encryption())
        .await?;
    devices
        .admin
        .client
        .add_team({
            AddTeamConfig::builder()
                .team_id(team_id1)
                .quic_sync(
                    AddTeamQuicSyncConfig::builder()
                        .wrapped_seed(&admin_seed1)?
                        .build()?,
                )
                .build()?
        })
        .await?;

    let admin1 = devices.admin.client.team(team_id1);
    admin1.sync_now(owner_addr, None).await?;

    // Now we should be able to successfully create a label (admin has CreateLabel perm).
    let member_role_rank_t1 = admin1.rank(roles1.member().id).await?;
    // Label rank must be lower than the member role rank so all team members can operate on it.
    let label_rank_t1 = Rank::new(member_role_rank_t1.value().saturating_sub(1));
    admin1
        .create_label(text!("team1_label"), label_rank_t1)
        .await
        .context("Creating a label should not fail here!")?;

    // Let's sync immediately. The role change will not propogate since add_team() hasn't been called.
    {
        let admin = devices.admin.client.team(team_id2);
        let err = admin
            .sync_now(owner_addr, None)
            .await
            .expect_err("syncing team2 should fail before add_team()");
        assert!(matches!(err, crate::Error::Aranya(_)), "{err:?}");

        // Now, we try to assign a role using the admin, which is expected to fail
        // because add_team() hasn't been called for team2 yet.
        let err = admin
            .device(devices.operator.id)
            .assign_role(roles2.operator().id)
            .await
            .expect_err("role assignment on team2 should fail before add_team()");
        assert!(matches!(err, crate::Error::Aranya(_)), "{err:?}");
    }

    let admin_seed2 = team2
        .encrypt_psk_seed_for_peer(devices.admin.pk.encryption())
        .await?;
    devices
        .admin
        .client
        .add_team({
            AddTeamConfig::builder()
                .team_id(team_id2)
                .quic_sync(
                    AddTeamQuicSyncConfig::builder()
                        .wrapped_seed(&admin_seed2)?
                        .build()?,
                )
                .build()?
        })
        .await?;

    let admin2 = devices.admin.client.team(team_id2);
    admin2.sync_now(owner_addr, None).await?;

    // Now we should be able to successfully create a label (admin has CreateLabel perm).
    let member_role_rank_t2 = admin2.rank(roles2.member().id).await?;
    // Label rank must be lower than the member role rank so all team members can operate on it.
    let label_rank_t2 = Rank::new(member_role_rank_t2.value().saturating_sub(1));
    admin2
        .create_label(text!("team2_label"), label_rank_t2)
        .await
        .context("Creating a label should not fail here!")?;

    Ok(())
}

/// Tests hello subscription functionality by demonstrating that devices can subscribe
/// to hello notifications from peers and automatically sync when receiving notifications.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
#[cfg(feature = "preview")]
async fn test_hello_subscription() -> Result<()> {
    // Set up our team context so we can run the test.
    let mut devices = DevicesCtx::new("test_hello_subscription").await?;

    // Create the initial team, and get our TeamId.
    let team_id = devices.create_and_add_team().await?;

    let roles = devices.setup_default_roles(team_id).await?;
    devices.add_all_device_roles(team_id, &roles).await?;

    // Grab addresses for testing
    let admin_addr = devices.admin.aranya_local_addr().await?;

    // Grab the shorthand for the teams we need to operate on.
    let membera_team = devices.membera.client.team(team_id);
    let admin_team = devices.admin.client.team(team_id);

    let sync_config = SyncPeerConfig::builder()
        .sync_now(false)
        .sync_on_hello(true)
        .build()?;

    membera_team.add_sync_peer(admin_addr, sync_config).await?;
    info!("membera added admin as sync peer with sync_on_hello=true");

    // MemberA subscribes to hello notifications from Admin
    // Use a long periodic_interval to ensure sync is triggered by graph change, not periodic send
    membera_team
        .sync_hello_subscribe(
            admin_addr,
            HelloSubscriptionConfig::builder()
                .periodic_interval(Duration::from_secs(60))
                .build()?,
        )
        .await?;
    info!("membera subscribed to hello notifications from admin");

    // Before the action, verify that MemberA doesn't know about any labels created by admin
    // (This will be our way to test if sync worked)
    info!("verifying initial state - membera should not see any labels created by admin");
    let initial_labels = membera_team.labels().await?;
    let initial_label_count = initial_labels.iter().count();
    info!(
        "initial label count as seen by membera: {}",
        initial_label_count
    );

    // Admin performs an action that will update their graph - create a label
    // (admin has permission to create labels)
    info!("admin creating a test label");
    let member_role_rank = admin_team.rank(roles.member().id).await?;
    // Label rank must be lower than the member role rank so all team members can operate on it.
    let label_rank = Rank::new(member_role_rank.value().saturating_sub(1));
    let test_label = admin_team
        .create_label(
            aranya_daemon_api::text!("sync_hello_test_label"),
            label_rank,
        )
        .await?;
    info!("admin created test label: {:?}", test_label);

    // Wait for hello message to be sent and sync to be triggered
    // The hello message should be sent, membera should receive it,
    // check that the command doesn't exist locally, and trigger a sync
    info!("waiting for hello message and automatic sync...");

    // Poll every 100ms for up to 10 seconds for the label count to increase
    let poll_start = std::time::Instant::now();
    let poll_timeout = Duration::from_millis(10_000);
    let poll_interval = Duration::from_millis(100);

    let final_labels = loop {
        let current_labels = membera_team.labels().await?;
        let current_count = current_labels.iter().count();

        if current_count > initial_label_count {
            info!(
                "sync detected - label count increased from {} to {} after {:?}",
                initial_label_count,
                current_count,
                poll_start.elapsed()
            );
            break current_labels;
        }

        if poll_start.elapsed() >= poll_timeout {
            bail!(
                "Sync on hello failed: timeout after {:?} - expected label count to increase from {} but it remained at {}",
                poll_timeout,
                initial_label_count,
                current_count
            );
        }

        sleep(poll_interval).await;
    };

    // Verify that the specific label created by admin is visible
    let label_exists = final_labels
        .iter()
        .any(|label| label.name.as_str() == "sync_hello_test_label");

    if !label_exists {
        bail!("Sync on hello failed: the test label created by admin is not visible to membera");
    }

    info!("sync_on_hello test succeeded - membera automatically synced after receiving hello notification");

    // Test basic subscription/unsubscription functionality for completeness
    info!("testing basic subscription functionality");

    let owner_addr = devices.owner.aranya_local_addr().await?;
    let operator_team = devices.operator.client.team(team_id);

    // Admin subscribes to hello notifications from Owner
    admin_team
        .sync_hello_subscribe(owner_addr, HelloSubscriptionConfig::default())
        .await?;
    info!("admin subscribed to hello notifications from owner");

    // Test multiple subscriptions
    operator_team
        .sync_hello_subscribe(owner_addr, HelloSubscriptionConfig::default())
        .await?;
    operator_team
        .sync_hello_subscribe(admin_addr, HelloSubscriptionConfig::default())
        .await?;
    info!("operator subscribed to both owner and admin");

    // Test unsubscribing
    admin_team.sync_hello_unsubscribe(owner_addr).await?;
    operator_team.sync_hello_unsubscribe(owner_addr).await?;
    operator_team.sync_hello_unsubscribe(admin_addr).await?;
    membera_team.sync_hello_unsubscribe(admin_addr).await?;
    info!("all devices unsubscribed");

    // Test edge cases
    admin_team
        .sync_hello_subscribe(owner_addr, HelloSubscriptionConfig::default())
        .await?;
    admin_team.sync_hello_unsubscribe(owner_addr).await?;
    info!("tested immediate subscribe/unsubscribe");

    // Test unsubscribing from non-subscribed peer
    let memberb_addr = devices.memberb.aranya_local_addr().await?;
    admin_team.sync_hello_unsubscribe(memberb_addr).await?;
    info!("tested unsubscribing from non-subscribed peer");

    Ok(())
}

/// Tests that schedule_delay parameter in sync_hello_subscribe works correctly.
/// Verifies that with high schedule_delay, only graph-change-triggered notifications occur,
/// while with low schedule_delay, scheduled periodic sends pick up all pending changes.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
#[cfg(feature = "preview")]
async fn test_hello_subscription_schedule_delay() -> Result<()> {
    // Set up our team context so we can run the test.
    let mut devices = DevicesCtx::new("test_hello_subscription_schedule_delay").await?;

    // Create the initial team, and get our TeamId.
    let team_id = devices.create_and_add_team().await?;

    let roles = devices.setup_default_roles(team_id).await?;
    devices.add_all_device_roles(team_id, &roles).await?;

    // Grab addresses for testing
    let admin_addr = devices.admin.aranya_local_addr().await?;

    // Grab the shorthand for the teams we need to operate on.
    let membera_team = devices.membera.client.team(team_id);
    let admin_team = devices.admin.client.team(team_id);

    let sync_config = SyncPeerConfig::builder()
        .sync_now(false)
        .sync_on_hello(true)
        .build()?;

    membera_team.add_sync_peer(admin_addr, sync_config).await?;
    info!("membera added admin as sync peer with sync_on_hello=true");

    // Phase 1: Test with high schedule_delay (60s) - should only see first graph change
    info!("Phase 1: Testing with high schedule_delay (60s) and high graph_change_debounce (60s)");
    membera_team
        .sync_hello_subscribe(
            admin_addr,
            HelloSubscriptionConfig::builder()
                .graph_change_debounce(Duration::from_secs(60))
                .periodic_interval(Duration::from_secs(60))
                .build()?,
        )
        .await?;
    info!("membera subscribed to hello notifications from admin with high schedule_delay");

    // Before the action, verify that MemberA doesn't know about any labels created by admin
    info!("verifying initial state - membera should not see any labels created by admin");
    let initial_labels = membera_team.labels().await?;
    let initial_label_count = initial_labels.iter().count();
    info!(
        "initial label count as seen by membera: {}",
        initial_label_count
    );

    // Admin creates first label
    info!("admin creating first test label");
    let member_role_rank = admin_team.rank(roles.member().id).await?;
    // Label rank must be lower than the member role rank so all team members can operate on it.
    let label_rank = Rank::new(member_role_rank.value().saturating_sub(1));
    let test_label_1 = admin_team
        .create_label(
            aranya_daemon_api::text!("schedule_test_label_1"),
            label_rank,
        )
        .await?;
    info!("admin created first test label: {:?}", test_label_1);

    // Wait for first label to be seen (should be sent via graph change notification)
    info!("waiting for first label to be seen via graph change notification...");
    let poll_start = std::time::Instant::now();
    let poll_timeout = Duration::from_secs(10);
    let poll_interval = Duration::from_millis(100);

    let first_label_seen = loop {
        let current_labels = membera_team.labels().await?;
        let current_count = current_labels.iter().count();

        if current_count > initial_label_count {
            let label_exists = current_labels
                .iter()
                .any(|label| label.name.as_str() == "schedule_test_label_1");
            if label_exists {
                info!(
                    "first label seen after {:?} - label count increased from {} to {}",
                    poll_start.elapsed(),
                    initial_label_count,
                    current_count
                );
                break true;
            }
        }

        if poll_start.elapsed() >= poll_timeout {
            bail!(
                "First label not seen: timeout after {:?} - expected label count to increase from {} but it remained at {}",
                poll_timeout,
                initial_label_count,
                current_count
            );
        }

        sleep(poll_interval).await;
    };

    assert!(first_label_seen, "First label should have been seen");

    // Admin creates second label
    info!("admin creating second test label");
    let test_label_2 = admin_team
        .create_label(
            aranya_daemon_api::text!("schedule_test_label_2"),
            label_rank,
        )
        .await?;
    info!("admin created second test label: {:?}", test_label_2);

    // Wait a short time and verify second label is NOT seen (rate-limited and schedule hasn't fired)
    info!("waiting briefly to confirm second label is not seen (rate-limited)...");
    sleep(Duration::from_secs(2)).await;

    let current_labels = membera_team.labels().await?;
    let current_count = current_labels.iter().count();
    let second_label_exists = current_labels
        .iter()
        .any(|label| label.name.as_str() == "schedule_test_label_2");

    if second_label_exists {
        bail!(
            "Second label should not have been seen yet (rate-limited) - found {} labels, expected {}",
            current_count,
            initial_label_count + 1
        );
    }

    info!("confirmed second label not seen - rate limiting working");

    // Phase 2: Test with low schedule_delay (10ms) - should see all labels
    info!("Phase 2: Testing with low schedule_delay (10ms)");
    membera_team.sync_hello_unsubscribe(admin_addr).await?;
    info!("membera unsubscribed from admin");

    membera_team
        .sync_hello_subscribe(
            admin_addr,
            HelloSubscriptionConfig::builder()
                .graph_change_debounce(Duration::from_secs(60))
                .periodic_interval(Duration::from_millis(10))
                .build()?,
        )
        .await?;
    info!("membera subscribed to hello notifications from admin with low periodic_interval");

    // Wait for both labels to be seen (scheduled send should pick up pending changes)
    info!("waiting for both labels to be seen via scheduled periodic send...");
    let poll_start = std::time::Instant::now();
    let poll_timeout = Duration::from_secs(10);
    let poll_interval = Duration::from_millis(100);

    let both_labels_seen = loop {
        let current_labels = membera_team.labels().await?;
        let current_count = current_labels.iter().count();

        if current_count >= initial_label_count + 2 {
            let label1_exists = current_labels
                .iter()
                .any(|label| label.name.as_str() == "schedule_test_label_1");
            let label2_exists = current_labels
                .iter()
                .any(|label| label.name.as_str() == "schedule_test_label_2");

            if label1_exists && label2_exists {
                info!(
                    "both labels seen after {:?} - label count: {} (expected at least {})",
                    poll_start.elapsed(),
                    current_count,
                    initial_label_count + 2
                );
                break true;
            }
        }

        if poll_start.elapsed() >= poll_timeout {
            let current_labels = membera_team.labels().await?;
            let label1_exists = current_labels
                .iter()
                .any(|label| label.name.as_str() == "schedule_test_label_1");
            let label2_exists = current_labels
                .iter()
                .any(|label| label.name.as_str() == "schedule_test_label_2");

            bail!(
                "Both labels not seen: timeout after {:?} - label1: {}, label2: {}, count: {} (expected at least {})",
                poll_timeout,
                label1_exists,
                label2_exists,
                current_labels.iter().count(),
                initial_label_count + 2
            );
        }

        sleep(poll_interval).await;
    };

    assert!(both_labels_seen, "Both labels should have been seen");

    // Cleanup
    membera_team.sync_hello_unsubscribe(admin_addr).await?;
    info!("cleanup: unsubscribed membera from admin");

    Ok(())
}

/// Enforces that default roles can only be seeded once per team.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_setup_default_roles_single_use() -> Result<()> {
    let mut devices = DevicesCtx::new("test_setup_default_roles_single_use").await?;

    let team_id = devices.create_and_add_team().await?;
    devices
        .setup_default_roles(team_id)
        .await
        .context("unable to setup default roles")?;

    let owner_team = devices.owner.client.team(team_id);
    match owner_team.setup_default_roles().await {
        Ok(_) => bail!("expected replayed setup_default_roles to fail"),
        Err(crate::Error::Aranya(_)) => {}
        Err(err) => bail!("unexpected error re-running setup_default_roles: {err:?}"),
    }

    Ok(())
}

/// Tests that role creation works.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_create_role() -> Result<()> {
    let mut devices = DevicesCtx::new("test_create_role").await?;

    let team_id = devices.create_and_add_team().await?;
    let roles = devices.setup_default_roles(team_id).await?;

    let owner_team = devices.owner.client.team(team_id);
    let member_role_rank = owner_team.rank(roles.member().id).await?;

    let expected_rank = Rank::new(member_role_rank.value().saturating_sub(1));
    let test_role = owner_team
        .create_role(text!("test_role"), expected_rank)
        .await
        .expect("expected to create role");

    // Verify the rank can be queried back.
    let rank = owner_team.rank(test_role.id).await?;
    assert_eq!(rank, expected_rank);

    owner_team
        .roles()
        .await?
        .into_iter()
        .find(|r| r.name == "test_role")
        .expect("no test role found");

    // Set up another device, sync it, and make sure they can see the
    // role.
    let admin_role_rank = devices
        .owner
        .client
        .team(team_id)
        .rank(roles.admin().id)
        .await?;
    owner_team
        .add_device(
            devices.admin.pk.clone(),
            Some(roles.admin().id),
            Rank::new(admin_role_rank.value().saturating_sub(1)),
        )
        .await?;
    let admin_team = devices.admin.client.team(team_id);
    let owner_addr = devices.owner.aranya_local_addr().await?;
    admin_team.sync_now(owner_addr, None).await?;

    let test_role2 = admin_team
        .roles()
        .await?
        .into_iter()
        .find(|r| r.name == "test_role")
        .expect("no test role found");
    assert_eq!(test_role.id, test_role2.id);
    assert_eq!(test_role.name, test_role2.name);

    Ok(())
}

/// Tests that role creation works.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_add_perm_to_created_role() -> Result<()> {
    let mut devices = DevicesCtx::new("test_add_perm_to_created_role").await?;

    let team_id = devices.create_and_add_team().await?;
    let owner_team = devices.owner.client.team(team_id);
    let owner_addr = devices.owner.aranya_local_addr().await?;

    // Create a custom admin type role with rank derived from the owner's device rank.
    let owner_device_rank = owner_team.rank(devices.owner.id).await?;
    let custom_role_rank = owner_device_rank.value() / 2;
    let admin_role = owner_team
        .create_role(text!("admin"), custom_role_rank.into())
        .await?;
    owner_team
        .add_perm_to_role(admin_role.id, Permission::AddDevice)
        .await
        .expect("expected to assign AddDevice to admin");

    // Add our admin with this role (rank must be < role rank)
    owner_team
        .add_device(
            devices.admin.pk,
            Some(admin_role.id),
            custom_role_rank.saturating_sub(1).into(),
        )
        .await
        .expect("expected to add admin with role");

    // Sync the admin and test that they can add the operator
    let admin_team = devices.admin.client.team(team_id);
    admin_team.sync_now(owner_addr, None).await?;

    // Admin adds operator at an even lower rank
    admin_team
        .add_device(
            devices.operator.pk,
            None,
            custom_role_rank.saturating_sub(100).into(),
        )
        .await
        .expect("admin should be able to add operator");

    Ok(())
}

/// Tests that privilege escalation attempt is rejected.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_privilege_escalation_rejected() -> Result<()> {
    let team_name = "test_privilege_escalation_rejected";
    let mut devices = DevicesCtx::new(team_name).await?;

    // Owner creates the team.
    let team_id = devices.create_and_add_team().await?;
    let owner_team = devices.owner.client.team(team_id);
    let roles = devices.setup_default_roles(team_id).await?;
    let member_role_rank = owner_team.rank(roles.member().id).await?;

    // All custom ranks must be below the lowest default role rank.
    let malicious_role_rank = Rank::new(member_role_rank.value().saturating_sub(1));
    let malicious_device_rank = Rank::new(malicious_role_rank.value().saturating_sub(1));
    let target_role_rank = Rank::new(malicious_device_rank.value().saturating_sub(1));

    // Initialize malicious device on team.
    let work_dir = tempfile::tempdir()?;
    let work_dir_path = work_dir.path();
    let device = DeviceCtx::new(team_name, "malicious", work_dir_path.join("malicious")).await?;
    owner_team
        .add_device(device.pk.clone(), None, malicious_device_rank)
        .await?;
    let device_seed = owner_team
        .encrypt_psk_seed_for_peer(device.pk.encryption())
        .await?;
    device
        .client
        .add_team({
            AddTeamConfig::builder()
                .team_id(team_id)
                .quic_sync(
                    AddTeamQuicSyncConfig::builder()
                        .wrapped_seed(&device_seed)?
                        .build()?,
                )
                .build()?
        })
        .await?;

    // Owner creates malicious role on team:
    let role = owner_team
        .create_role(text!("malicious_role"), malicious_role_rank)
        .await
        .expect("expected to create malicious role");

    // Owner only allows role to create new roles.
    owner_team
        .add_perm_to_role(role.id, Permission::CreateRole)
        .await?;

    // Owner assigns role to malicious device.
    owner_team.device(device.id).assign_role(role.id).await?;

    // Malicious device syncs with owner.
    let device_team = device.client.team(team_id);
    let owner_addr = devices.owner.aranya_local_addr().await?;
    device_team.sync_now(owner_addr, None).await?;

    // Malicious device creates a new target role (which it maintains control of).
    let target_role = device_team
        .create_role(text!("target_role"), target_role_rank)
        .await
        .expect("unable to create target role");

    // Malicious device attempts to grant target role a permission it does not have: e.g. CanUseAfc
    // This should be rejected, which indicates a privilege escalation attempt will be rejected.
    device_team
        .add_perm_to_role(target_role.id, Permission::CanUseAfc)
        .await
        .expect_err("expected privilege escalation attempt to fail");

    Ok(())
}

/// Tests that role creation works.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_remove_perm_from_default_role() -> Result<()> {
    let mut devices = DevicesCtx::new("test_add_perm_to_created_role").await?;

    let team_id = devices.create_and_add_team().await?;
    let roles = devices.setup_default_roles(team_id).await?;

    let owner_team = devices.owner.client.team(team_id);
    let owner_addr = devices.owner.aranya_local_addr().await?;

    // Add admin with admin role
    let admin_role_rank = devices
        .owner
        .client
        .team(team_id)
        .rank(roles.admin().id)
        .await?;
    owner_team
        .add_device(
            devices.admin.pk,
            Some(roles.admin().id),
            Rank::new(admin_role_rank.value().saturating_sub(1)),
        )
        .await
        .expect("expected to add admin with role");

    owner_team
        .remove_perm_from_role(roles.admin().id, Permission::AddDevice)
        .await
        .expect("expected to remove AddDevice from admin");

    // Sync the admin
    let admin_team = devices.admin.client.team(team_id);
    admin_team.sync_now(owner_addr, None).await?;

    // Admin cannot add operator
    let operator_role_rank = devices
        .owner
        .client
        .team(team_id)
        .rank(roles.operator().id)
        .await?;
    admin_team
        .add_device(
            devices.operator.pk,
            None,
            Rank::new(operator_role_rank.value().saturating_sub(1)),
        )
        .await
        .expect_err("admin should not be able to add operator");

    Ok(())
}

/// Tests that role deletion works.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_delete_role() -> Result<()> {
    let mut devices = DevicesCtx::new("test_delete_role").await?;

    let team_id = devices.create_and_add_team().await?;
    let roles = devices.setup_default_roles(team_id).await?;

    let owner_team = devices.owner.client.team(team_id);
    owner_team
        .delete_role(roles.member().id)
        .await
        .expect("expected to delete role");

    Ok(())
}

/// A device cannot assign a role to itself. The rank system enforces this:
/// `author_can_operate_on_target` uses strict `>`, so a device never
/// outranks itself and the operation is rejected.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_assign_role_self_rejected() -> Result<()> {
    let mut devices = DevicesCtx::new("test_assign_role_self_rejected").await?;

    let team_id = devices.create_and_add_team().await?;
    let roles = devices.setup_default_roles(team_id).await?;

    let owner_team = devices.owner.client.team(team_id);
    // Owner tries to assign a role to itself. Fails because the policy
    // requires the author to strictly outrank the target device.
    let err = owner_team
        .device(devices.owner.id)
        .assign_role(roles.owner().id)
        .await
        .expect_err("assigning role to self should fail");
    assert!(matches!(err, crate::Error::Aranya(_)), "{err:?}");

    Ok(())
}

/// The sole owner cannot revoke its own owner role. The rank system
/// prevents self-operations (strict `>` means a device never outranks
/// itself), and the policy also prevents removing the last owner.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_owner_cannot_revoke_owner_role() -> Result<()> {
    let mut devices = DevicesCtx::new("test_owner_cannot_revoke_owner_role").await?;

    let team_id = devices.create_and_add_team().await?;
    let roles = devices.setup_default_roles(team_id).await?;

    let owner_team = devices.owner.client.team(team_id);
    let err = owner_team
        .device(devices.owner.id)
        .revoke_role(roles.owner().id)
        .await
        .expect_err("sole owner cannot revoke its own role");
    assert!(matches!(err, crate::Error::Aranya(_)), "{err:?}");

    Ok(())
}

/// A device that already has a role cannot be assigned another role.
/// The policy rejects the operation because an existing role assignment
/// already exists for the target device.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_cannot_assign_role_twice() -> Result<()> {
    let mut devices = DevicesCtx::new("test_cannot_assign_role_twice").await?;

    let team_id = devices.create_and_add_team().await?;
    let roles = devices.setup_default_roles(team_id).await?;
    devices.add_all_device_roles(team_id, &roles).await?;

    let owner_team = devices.owner.client.team(team_id);

    match owner_team
        .device(devices.membera.id)
        .assign_role(roles.operator().id)
        .await
    {
        Ok(_) => bail!("Expected role assignment to fail"),
        Err(crate::Error::Aranya(_)) => {}
        Err(_) => bail!("Unexpected error"),
    }

    Ok(())
}

/// Deleting a label requires `DeleteLabel` permission and sufficient rank.
/// An operator without `DeleteLabel` cannot delete a label even if it
/// outranks the label.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_delete_label_requires_permission() -> Result<()> {
    let mut devices = DevicesCtx::new("test_delete_label_requires_permission").await?;

    let team_id = devices.create_and_add_team().await?;
    let roles = devices.setup_default_roles(team_id).await?;
    devices.add_all_device_roles(team_id, &roles).await?;

    let owner_team = devices.owner.client.team(team_id);
    let operator_team = devices.operator.client.team(team_id);

    let member_role_rank = owner_team.rank(roles.member().id).await?;
    // Label rank must be lower than the member role rank so all team members can operate on it.
    let label_rank = Rank::new(member_role_rank.value().saturating_sub(1));
    let label = owner_team
        .create_label(text!("delete-label-guard"), label_rank)
        .await?;

    operator_team
        .sync_now(devices.owner.aranya_local_addr().await?, None)
        .await
        .context("operator unable to sync owner state")?;

    let err = operator_team
        .delete_label(label)
        .await
        .expect_err("delete_label without permission should fail");
    assert!(matches!(err, crate::Error::Aranya(_)), "{err:?}");

    Ok(())
}

/// A device cannot assign a label to itself. The rank system enforces this:
/// `author_can_operate_on_target` uses strict `>`, so a device never
/// outranks itself and the operation is rejected.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_assign_label_to_device_self_rejected() -> Result<()> {
    let mut devices = DevicesCtx::new("test_assign_label_to_device_self_rejected").await?;

    let team_id = devices.create_and_add_team().await?;
    let roles = devices.setup_default_roles(team_id).await?;

    let owner_id = devices.owner.id;
    let owner_team = devices.owner.client.team(team_id);

    let member_role_rank = owner_team.rank(roles.member().id).await?;
    // Label rank must be lower than the member role rank so all team members can operate on it.
    let label_rank = Rank::new(member_role_rank.value().saturating_sub(1));
    let label = owner_team
        .create_label(text!("device-self-label"), label_rank)
        .await?;

    // Owner tries to assign a label to itself. This fails because the policy
    // requires the author to strictly outrank the target device, and a device
    // can never outrank itself (rank comparison uses `>`).
    let err = owner_team
        .device(owner_id)
        .assign_label(label, ChanOp::SendRecv)
        .await
        .expect_err("assigning label to self should fail");
    assert!(matches!(err, crate::Error::Aranya(_)), "{err:?}");

    Ok(())
}

/// Ensures the last owner cannot be removed by another device.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_admin_cannot_remove_last_owner() -> Result<()> {
    let mut devices = DevicesCtx::new("test_admin_cannot_remove_last_owner").await?;

    let team_id = devices.create_and_add_team().await?;
    let roles = devices.setup_default_roles(team_id).await?;
    devices.add_all_device_roles(team_id, &roles).await?;

    let admin_team = devices.admin.client.team(team_id);
    let err = admin_team
        .device(devices.owner.id)
        .remove_from_team()
        .await
        .expect_err("removing the final owner should fail");
    assert!(matches!(err, crate::Error::Aranya(_)), "{err:?}");

    Ok(())
}

// ========================================================================
// Rank-based tests
// ========================================================================

/// Tests that a label can be created with a specific rank and that the rank
/// can be queried back.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_create_label() -> Result<()> {
    let mut devices = DevicesCtx::new("test_create_label").await?;
    let team_id = devices.create_and_add_team().await?;
    let roles = devices.setup_default_roles(team_id).await?;

    let owner_team = devices.owner.client.team(team_id);
    let member_role_rank = owner_team.rank(roles.member().id).await?;
    let expected_rank = Rank::new(member_role_rank.value().saturating_sub(1));
    let label_id = owner_team
        .create_label(text!("ranked_label"), expected_rank)
        .await?;

    let rank = owner_team.rank(label_id).await?;
    assert_eq!(rank, expected_rank);

    Ok(())
}

/// Tests that the rank of a label can be changed with a valid old_rank.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_change_rank() -> Result<()> {
    let mut devices = DevicesCtx::new("test_change_rank").await?;
    let team_id = devices.create_and_add_team().await?;
    let roles = devices.setup_default_roles(team_id).await?;

    let owner_team = devices.owner.client.team(team_id);
    let member_role_rank = owner_team.rank(roles.member().id).await?;
    let initial_rank = Rank::new(member_role_rank.value().saturating_sub(2));
    let updated_rank = Rank::new(initial_rank.value().saturating_add(1));
    let label = owner_team
        .create_label(text!("mutable_label"), initial_rank)
        .await?;

    owner_team
        .change_rank(label, initial_rank, updated_rank)
        .await?;

    let new_rank = owner_team.rank(label).await?;
    assert_eq!(new_rank, updated_rank);

    Ok(())
}

/// Tests that a lower-ranked device cannot change the rank of a higher-ranked
/// object (author_rank must be > target_rank).
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_change_rank_requires_sufficient_author_rank() -> Result<()> {
    let mut devices = DevicesCtx::new("test_change_rank_requires_sufficient_author_rank").await?;
    let team_id = devices.create_and_add_team().await?;
    let roles = devices.setup_default_roles(team_id).await?;

    let owner_team = devices.owner.client.team(team_id);
    let operator_team = devices.operator.client.team(team_id);

    // Create a label with rank higher than the operator device rank
    let operator_role_rank = devices
        .owner
        .client
        .team(team_id)
        .rank(roles.operator().id)
        .await?;
    let member_role_rank = devices
        .owner
        .client
        .team(team_id)
        .rank(roles.member().id)
        .await?;
    let high_label_rank = Rank::new(operator_role_rank.value().saturating_add(50));
    let high_label = owner_team
        .create_label(text!("high_label"), high_label_rank)
        .await?;

    // Add operator device and sync
    owner_team
        .add_device(
            devices.operator.pk.clone(),
            Some(roles.operator().id),
            Rank::new(operator_role_rank.value().saturating_sub(1)),
        )
        .await?;

    // Give operator ChangeRank permission
    owner_team
        .add_perm_to_role(roles.operator().id, Permission::ChangeRank)
        .await?;

    let owner_addr = devices.owner.aranya_local_addr().await?;
    operator_team.sync_now(owner_addr, None).await?;

    // Operator tries to change rank of object ranked above it -- should fail
    match operator_team
        .change_rank(high_label, high_label_rank, member_role_rank)
        .await
    {
        Ok(_) => bail!("expected change_rank to fail when author rank < object rank"),
        Err(crate::Error::Aranya(_)) => {}
        Err(err) => bail!("unexpected change_rank error: {err:?}"),
    }

    Ok(())
}

/// Tests that an admin cannot create a role with a rank higher than the
/// admin's own rank.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_create_role_rank_too_high_rejected() -> Result<()> {
    let mut devices = DevicesCtx::new("test_create_role_rank_too_high_rejected").await?;
    let team_id = devices.create_and_add_team().await?;
    let roles = devices.setup_default_roles(team_id).await?;

    let owner_team = devices.owner.client.team(team_id);
    let admin_team = devices.admin.client.team(team_id);

    // Add admin with rank below admin role (admin default role already has CreateRole)
    let admin_role_rank = devices
        .owner
        .client
        .team(team_id)
        .rank(roles.admin().id)
        .await?;
    owner_team
        .add_device(
            devices.admin.pk.clone(),
            Some(roles.admin().id),
            Rank::new(admin_role_rank.value().saturating_sub(1)),
        )
        .await?;

    let owner_addr = devices.owner.aranya_local_addr().await?;
    admin_team.sync_now(owner_addr, None).await?;

    // Admin tries to create role with rank above admin role rank -- should fail
    match admin_team
        .create_role(
            text!("too_high"),
            Rank::new(admin_role_rank.value().saturating_add(100)),
        )
        .await
    {
        Ok(_) => bail!("expected create_role to fail when rank > author rank"),
        Err(crate::Error::Aranya(_)) => {}
        Err(err) => bail!("unexpected create_role error: {err:?}"),
    }

    Ok(())
}

/// Tests that adding a device with a rank higher than its assigned role's rank
/// is rejected (role_rank >= device_rank must hold).
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_add_device_rank_higher_than_role_rejected() -> Result<()> {
    let mut devices = DevicesCtx::new("test_add_device_rank_higher_than_role_rejected").await?;
    let team_id = devices.create_and_add_team().await?;
    let roles = devices.setup_default_roles(team_id).await?;

    let owner_team = devices.owner.client.team(team_id);

    // Try to add device with rank above member role rank
    // Should fail: role_rank (member) >= device_rank (operator role rank) is false
    let operator_role_rank = devices
        .owner
        .client
        .team(team_id)
        .rank(roles.operator().id)
        .await?;
    match owner_team
        .add_device(
            devices.admin.pk.clone(),
            Some(roles.member().id),
            operator_role_rank,
        )
        .await
    {
        Ok(_) => bail!("expected add_device to fail when device rank > role rank"),
        Err(crate::Error::Aranya(_)) => {}
        Err(err) => bail!("unexpected add_device error: {err:?}"),
    }

    Ok(())
}

/// Tests that changing a device rank above its role's rank is rejected.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_change_rank_above_role_rank_rejected() -> Result<()> {
    let mut devices = DevicesCtx::new("test_change_rank_above_role_rank_rejected").await?;
    let team_id = devices.create_and_add_team().await?;
    let roles = devices.setup_default_roles(team_id).await?;

    let owner_team = devices.owner.client.team(team_id);

    // Add admin with member role and device rank below the role rank
    let member_role_rank = devices
        .owner
        .client
        .team(team_id)
        .rank(roles.member().id)
        .await?;
    let operator_role_rank = devices
        .owner
        .client
        .team(team_id)
        .rank(roles.operator().id)
        .await?;
    let device_rank = Rank::new(member_role_rank.value().saturating_sub(1));
    owner_team
        .add_device(
            devices.admin.pk.clone(),
            Some(roles.member().id),
            device_rank,
        )
        .await?;

    // Try to change device rank above its role rank -- should fail
    match owner_team
        .change_rank(devices.admin.id, device_rank, operator_role_rank)
        .await
    {
        Ok(_) => bail!("expected change_rank to fail when new rank > role rank"),
        Err(crate::Error::Aranya(_)) => {}
        Err(err) => bail!("unexpected change_rank error: {err:?}"),
    }

    Ok(())
}

/// Tests that role ranks cannot be changed after creation.
///
/// Role ranks are fixed at creation time to maintain the invariant that
/// `role_rank > device_rank` for all devices assigned to the role.
///
/// This applies unconditionally to all roles - a device cannot promote or
/// demote any role's rank, including the rank of its own assigned role.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_change_role_rank_rejected() -> Result<()> {
    let mut devices = DevicesCtx::new("test_change_role_rank_rejected").await?;
    let team_id = devices.create_and_add_team().await?;
    let roles = devices.setup_default_roles(team_id).await?;

    let owner_team = devices.owner.client.team(team_id);
    let member_role_rank = owner_team.rank(roles.member().id).await?;

    // Create a role
    let role_rank = Rank::new(member_role_rank.value().saturating_sub(2));
    let role = owner_team
        .create_role(text!("immutable_role"), role_rank)
        .await?;

    // Try to change the role's rank -- should fail
    let attempted_rank = Rank::new(role_rank.value().saturating_add(1));
    match owner_team
        .change_rank(role.id, role_rank, attempted_rank)
        .await
    {
        Ok(_) => bail!("expected change_rank to fail for roles"),
        Err(crate::Error::Aranya(_)) => {}
        Err(err) => bail!("unexpected change_rank error: {err:?}"),
    }

    // Verify the role rank was not changed
    let current_role_rank = owner_team.rank(role.id).await?;
    assert_eq!(
        current_role_rank, role_rank,
        "role rank should not have changed"
    );

    Ok(())
}

/// Tests the migration pattern for changing a role's effective rank.
///
/// Since role ranks are immutable after creation, the recommended workflow is:
/// 1. Create a new role with the desired rank
/// 2. Query and copy permissions from the old role to the new role
/// 3. Change devices from the old role to the new role
/// 4. Delete the old role (optional cleanup)
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_role_rank_migration_pattern() -> Result<()> {
    let mut devices = DevicesCtx::new("test_role_rank_migration_pattern").await?;
    let team_id = devices.create_and_add_team().await?;
    let roles = devices.setup_default_roles(team_id).await?;

    let owner_team = devices.owner.client.team(team_id);
    let member_role_rank = owner_team.rank(roles.member().id).await?;

    // Step 1: Create original role below member role rank with some permissions
    let old_role_rank = member_role_rank.value().saturating_sub(2);
    let old_role = owner_team
        .create_role(text!("old_role"), old_role_rank.into())
        .await?;

    // Add permissions to the old role
    owner_team
        .add_perm_to_role(old_role.id, Permission::CreateLabel)
        .await?;
    owner_team
        .add_perm_to_role(old_role.id, Permission::DeleteLabel)
        .await?;

    // Add device with old role (device rank must be <= role rank)
    let device_rank = old_role_rank.saturating_sub(1);
    owner_team
        .add_device(
            devices.admin.pk.clone(),
            Some(old_role.id),
            device_rank.into(),
        )
        .await?;

    // Verify device has old role
    let assigned = owner_team.device(devices.admin.id).role().await?;
    assert_eq!(assigned.map(|r| r.id), Some(old_role.id));

    // Step 2: Create new role with higher rank
    let new_role_rank = old_role_rank.saturating_add(1);
    let new_role = owner_team
        .create_role(text!("new_role"), new_role_rank.into())
        .await?;

    // Step 3: Query permissions from old role and copy to new role
    let old_perms = owner_team.role_perm(old_role.id).await?;
    assert_eq!(old_perms.len(), 2, "old role should have 2 permissions");
    for &perm in &old_perms {
        owner_team.add_perm_to_role(new_role.id, perm).await?;
    }

    // Verify new role has the same permissions (sort since fact iteration order
    // is not guaranteed across different roles)
    let mut new_perms = owner_team.role_perm(new_role.id).await?;
    let mut old_sorted = old_perms.clone();
    old_sorted.sort_by_key(|p| format!("{p:?}"));
    new_perms.sort_by_key(|p| format!("{p:?}"));
    assert_eq!(
        old_sorted, new_perms,
        "new role should have the same permissions as old role"
    );

    // Step 4: Migrate device from old role to new role
    owner_team
        .device(devices.admin.id)
        .change_role(old_role.id, new_role.id)
        .await
        .context("should be able to change to higher-ranked role")?;

    // Verify device now has new role
    let assigned = owner_team.device(devices.admin.id).role().await?;
    assert_eq!(assigned.map(|r| r.id), Some(new_role.id));

    // Step 5: Delete the old role (cleanup)
    owner_team
        .delete_role(old_role.id)
        .await
        .context("should be able to delete unused role")?;

    // Verify old role no longer exists
    let all_roles = owner_team.roles().await?;
    assert!(
        !all_roles.iter().any(|r| r.id == old_role.id),
        "old role should be deleted"
    );

    Ok(())
}

/// Tests that a lower-ranked device cannot operate on higher-ranked objects:
/// removing devices, deleting roles, or deleting labels.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_insufficient_rank_cannot_operate_on_objects() -> Result<()> {
    let mut devices = DevicesCtx::new("test_insufficient_rank_cannot_operate_on_objects").await?;
    let team_id = devices.create_and_add_team().await?;
    let roles = devices.setup_default_roles(team_id).await?;

    let owner_team = devices.owner.client.team(team_id);
    let operator_team = devices.operator.client.team(team_id);

    // Add admin and operator devices
    let admin_role_rank = devices
        .owner
        .client
        .team(team_id)
        .rank(roles.admin().id)
        .await?;
    let operator_role_rank = devices
        .owner
        .client
        .team(team_id)
        .rank(roles.operator().id)
        .await?;
    owner_team
        .add_device(
            devices.admin.pk.clone(),
            Some(roles.admin().id),
            Rank::new(admin_role_rank.value().saturating_sub(1)),
        )
        .await?;
    owner_team
        .add_device(
            devices.operator.pk.clone(),
            Some(roles.operator().id),
            Rank::new(operator_role_rank.value().saturating_sub(1)),
        )
        .await?;

    // Create a label with rank above the operator's rank so the operator can't delete it.
    let high_label_rank = Rank::new(operator_role_rank.value().saturating_add(100));
    let high_label = owner_team
        .create_label(text!("high_label"), high_label_rank)
        .await?;

    let owner_addr = devices.owner.aranya_local_addr().await?;
    operator_team.sync_now(owner_addr, None).await?;

    // Operator tries to remove admin (higher ranked device) -- should fail
    match operator_team
        .device(devices.admin.id)
        .remove_from_team()
        .await
    {
        Ok(_) => bail!("expected removing higher-ranked device to fail"),
        Err(crate::Error::Aranya(_)) => {}
        Err(err) => bail!("unexpected remove_device error: {err:?}"),
    }

    // Operator tries to delete admin role (higher ranked) -- should fail
    match operator_team.delete_role(roles.admin().id).await {
        Ok(_) => bail!("expected deleting higher-ranked role to fail"),
        Err(crate::Error::Aranya(_)) => {}
        Err(err) => bail!("unexpected delete_role error: {err:?}"),
    }

    // Operator tries to delete high-rank label -- should fail
    match operator_team.delete_label(high_label).await {
        Ok(_) => bail!("expected deleting higher-ranked label to fail"),
        Err(crate::Error::Aranya(_)) => {}
        Err(err) => bail!("unexpected delete_label error: {err:?}"),
    }

    Ok(())
}

/// Tests that change_rank fails when the new_rank exceeds the author's own rank.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_change_rank_new_rank_above_author_rejected() -> Result<()> {
    let mut devices = DevicesCtx::new("test_change_rank_new_rank_above_author_rejected").await?;
    let team_id = devices.create_and_add_team().await?;
    let roles = devices.setup_default_roles(team_id).await?;

    let owner_team = devices.owner.client.team(team_id);
    let operator_team = devices.operator.client.team(team_id);

    let member_role_rank = owner_team.rank(roles.member().id).await?;
    let low_label_rank = Rank::new(member_role_rank.value().saturating_sub(1));

    // Owner creates a label at low rank
    let label = owner_team
        .create_label(text!("low_label"), low_label_rank)
        .await?;

    // Add operator with ChangeRank perm
    let operator_role_rank = devices
        .owner
        .client
        .team(team_id)
        .rank(roles.operator().id)
        .await?;
    let admin_role_rank = devices
        .owner
        .client
        .team(team_id)
        .rank(roles.admin().id)
        .await?;
    owner_team
        .add_device(
            devices.operator.pk.clone(),
            Some(roles.operator().id),
            Rank::new(operator_role_rank.value().saturating_sub(1)),
        )
        .await?;
    owner_team
        .add_perm_to_role(roles.operator().id, Permission::ChangeRank)
        .await?;

    let owner_addr = devices.owner.aranya_local_addr().await?;
    operator_team.sync_now(owner_addr, None).await?;

    // Operator tries to change label rank to above operator's rank -- should fail
    match operator_team
        .change_rank(label, low_label_rank, admin_role_rank)
        .await
    {
        Ok(_) => bail!("expected change_rank to fail when new_rank > author_rank"),
        Err(crate::Error::Aranya(_)) => {}
        Err(err) => bail!("unexpected change_rank error: {err:?}"),
    }

    Ok(())
}

/// Tests that change_rank fails when the provided old_rank does not match the
/// object's current rank (stale old_rank).
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_change_rank_stale_old_rank_rejected() -> Result<()> {
    let mut devices = DevicesCtx::new("test_change_rank_stale_old_rank_rejected").await?;
    let team_id = devices.create_and_add_team().await?;
    let roles = devices.setup_default_roles(team_id).await?;

    let owner_team = devices.owner.client.team(team_id);
    let member_role_rank = owner_team.rank(roles.member().id).await?;

    let initial_rank = Rank::new(member_role_rank.value().saturating_sub(3));
    let updated_rank = Rank::new(initial_rank.value().saturating_add(1));
    let stale_attempt_rank = Rank::new(updated_rank.value().saturating_add(1));
    let label = owner_team
        .create_label(text!("versioned_label"), initial_rank)
        .await?;
    // Change rank from initial to updated
    owner_team
        .change_rank(label, initial_rank, updated_rank)
        .await?;

    // Try to change rank using stale old_rank (initial instead of current updated)
    match owner_team
        .change_rank(label, initial_rank, stale_attempt_rank)
        .await
    {
        Ok(_) => bail!("expected change_rank to fail with stale old_rank"),
        Err(crate::Error::Aranya(_)) => {}
        Err(err) => bail!("unexpected change_rank error: {err:?}"),
    }

    Ok(())
}

/// Tests that a device can demote its own rank (self-demotion is allowed with
/// just the ChangeRank permission).
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_change_rank_self_demotion() -> Result<()> {
    let mut devices = DevicesCtx::new("test_change_rank_self_demotion").await?;
    let team_id = devices.create_and_add_team().await?;
    let roles = devices.setup_default_roles(team_id).await?;

    let owner_team = devices.owner.client.team(team_id);
    let admin_team = devices.admin.client.team(team_id);

    // Add admin -- admin default role already has ChangeRank
    let admin_role_rank = devices
        .owner
        .client
        .team(team_id)
        .rank(roles.admin().id)
        .await?;
    let admin_rank = Rank::new(admin_role_rank.value().saturating_sub(1));
    let member_role_rank = devices
        .owner
        .client
        .team(team_id)
        .rank(roles.member().id)
        .await?;
    // Demoted rank must be lower than admin's current rank.
    let demoted_rank = Rank::new(member_role_rank.value().saturating_sub(1));
    owner_team
        .add_device(devices.admin.pk.clone(), Some(roles.admin().id), admin_rank)
        .await?;

    let owner_addr = devices.owner.aranya_local_addr().await?;
    admin_team.sync_now(owner_addr, None).await?;

    // Admin demotes itself
    admin_team
        .change_rank(devices.admin.id, admin_rank, demoted_rank)
        .await
        .context("device should be able to demote its own rank")?;

    // Verify the rank actually changed
    // Need to sync owner to see the change
    owner_team
        .sync_now(devices.admin.aranya_local_addr().await?, None)
        .await?;
    let new_rank = owner_team.rank(devices.admin.id).await?;
    assert_eq!(new_rank, demoted_rank);

    Ok(())
}

/// Tests that a device cannot promote its own rank (self-promotion is rejected).
///
/// This is a critical security control: a device should never be able to
/// escalate its own privileges by increasing its rank.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_change_rank_self_promotion_rejected() -> Result<()> {
    let mut devices = DevicesCtx::new("test_change_rank_self_promotion_rejected").await?;
    let team_id = devices.create_and_add_team().await?;
    let roles = devices.setup_default_roles(team_id).await?;

    let owner_team = devices.owner.client.team(team_id);
    let admin_team = devices.admin.client.team(team_id);

    // Add admin with ChangeRank permission (admin role has it by default)
    let admin_role_rank = devices
        .owner
        .client
        .team(team_id)
        .rank(roles.admin().id)
        .await?;
    let admin_rank = Rank::new(admin_role_rank.value().saturating_sub(1));
    let promoted_rank = Rank::new(admin_rank.value().saturating_add(50));
    owner_team
        .add_device(devices.admin.pk.clone(), Some(roles.admin().id), admin_rank)
        .await?;

    let owner_addr = devices.owner.aranya_local_addr().await?;
    admin_team.sync_now(owner_addr, None).await?;

    // Admin tries to promote itself -- should fail
    match admin_team
        .change_rank(devices.admin.id, admin_rank, promoted_rank)
        .await
    {
        Ok(_) => bail!("expected self-promotion to fail"),
        Err(crate::Error::Aranya(_)) => {}
        Err(err) => bail!("unexpected change_rank error: {err:?}"),
    }

    // Verify the rank was not changed
    let current_rank = admin_team.rank(devices.admin.id).await?;
    assert_eq!(current_rank, admin_rank, "rank should not have changed");

    Ok(())
}

/// Tests that a device at the same rank as another cannot operate on it
/// (strict > is required, not >=).
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_equal_rank_cannot_operate() -> Result<()> {
    let mut devices = DevicesCtx::new("test_equal_rank_cannot_operate").await?;
    let team_id = devices.create_and_add_team().await?;
    let roles = devices.setup_default_roles(team_id).await?;

    let owner_team = devices.owner.client.team(team_id);
    let admin_team = devices.admin.client.team(team_id);

    // Add admin and operator both at operator device rank (testing equal ranks)
    let operator_role_rank = devices
        .owner
        .client
        .team(team_id)
        .rank(roles.operator().id)
        .await?;
    let equal_rank = Rank::new(operator_role_rank.value().saturating_sub(1));
    owner_team
        .add_device(devices.admin.pk.clone(), Some(roles.admin().id), equal_rank)
        .await?;
    owner_team
        .add_device(
            devices.operator.pk.clone(),
            Some(roles.operator().id),
            equal_rank,
        )
        .await?;

    let owner_addr = devices.owner.aranya_local_addr().await?;
    admin_team.sync_now(owner_addr, None).await?;

    // Admin tries to remove operator (same rank) -- should fail (strict >)
    match admin_team
        .device(devices.operator.id)
        .remove_from_team()
        .await
    {
        Ok(_) => bail!("expected removing equal-ranked device to fail"),
        Err(crate::Error::Aranya(_)) => {}
        Err(err) => bail!("unexpected remove_device error: {err:?}"),
    }

    Ok(())
}

/// Tests that assigning a role requires the author to outrank both the role
/// and the target device.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_assign_role_requires_outranking_both_role_and_device() -> Result<()> {
    let mut devices = DevicesCtx::new("test_assign_role_requires_outranking_both").await?;
    let team_id = devices.create_and_add_team().await?;
    let roles = devices.setup_default_roles(team_id).await?;

    let owner_team = devices.owner.client.team(team_id);
    let admin_team = devices.admin.client.team(team_id);
    let owner_addr = devices.owner.aranya_local_addr().await?;

    // Give admin the AssignRole permission
    owner_team
        .add_perm_to_role(roles.admin().id, Permission::AssignRole)
        .await?;

    // Create custom roles and devices with ordered ranks below member role rank.
    // Ordering: low_device < low_role < admin < high_device < high_role < member_role
    let member_role_rank = owner_team.rank(roles.member().id).await?;
    let high_role_rank = member_role_rank.value().saturating_sub(1);
    let high_device_rank = high_role_rank.saturating_sub(1);
    let admin_rank = high_device_rank.saturating_sub(1);
    let low_role_rank = admin_rank.saturating_sub(1);
    let low_device_rank = low_role_rank.saturating_sub(1);

    let low_role = owner_team
        .create_role(text!("low_role"), low_role_rank.into())
        .await?;
    let high_role = owner_team
        .create_role(text!("high_role"), high_role_rank.into())
        .await?;

    owner_team
        .add_device(
            devices.admin.pk.clone(),
            Some(roles.admin().id),
            admin_rank.into(),
        )
        .await?;
    owner_team
        .add_device(devices.membera.pk.clone(), None, low_device_rank.into())
        .await?;
    owner_team
        .add_device(devices.memberb.pk.clone(), None, high_device_rank.into())
        .await?;

    admin_team.sync_now(owner_addr, None).await?;

    // Case 1: Author outranks device but NOT role -- should fail
    // Admin (300) tries to assign high_role (500) to membera (100)
    let result = admin_team
        .device(devices.membera.id)
        .assign_role(high_role.id)
        .await;
    assert!(
        matches!(result, Err(crate::Error::Aranya(_))),
        "Case 1: expected assign_role to fail when author doesn't outrank the role, got {result:?}"
    );

    // Case 2: Author outranks role but NOT device -- should fail
    // Admin (300) tries to assign low_role (200) to memberb (400)
    let result = admin_team
        .device(devices.memberb.id)
        .assign_role(low_role.id)
        .await;
    assert!(
        matches!(result, Err(crate::Error::Aranya(_))),
        "Case 2: expected assign_role to fail when author doesn't outrank the device, got {result:?}"
    );

    // Case 3: Author outranks BOTH role and device -- should succeed
    // Admin (300) tries to assign low_role (200) to membera (100)
    admin_team
        .device(devices.membera.id)
        .assign_role(low_role.id)
        .await
        .context("Case 3: assign_role should succeed when author outranks both role and device")?;

    Ok(())
}

/// Tests that creating a label with a rank higher than the author's rank is
/// rejected.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_create_label_rank_too_high_rejected() -> Result<()> {
    let mut devices = DevicesCtx::new("test_create_label_rank_too_high_rejected").await?;
    let team_id = devices.create_and_add_team().await?;
    let roles = devices.setup_default_roles(team_id).await?;

    let owner_team = devices.owner.client.team(team_id);
    let admin_team = devices.admin.client.team(team_id);

    // Add admin with rank below admin role
    let admin_role_rank = devices
        .owner
        .client
        .team(team_id)
        .rank(roles.admin().id)
        .await?;
    owner_team
        .add_device(
            devices.admin.pk.clone(),
            Some(roles.admin().id),
            Rank::new(admin_role_rank.value().saturating_sub(1)),
        )
        .await?;

    let owner_addr = devices.owner.aranya_local_addr().await?;
    admin_team.sync_now(owner_addr, None).await?;

    // Admin tries to create label with rank above admin role -- should fail
    match admin_team
        .create_label(
            text!("too_high_label"),
            Rank::new(admin_role_rank.value().saturating_add(100)),
        )
        .await
    {
        Ok(_) => bail!("expected create_label to fail when rank > author rank"),
        Err(crate::Error::Aranya(_)) => {}
        Err(err) => bail!("unexpected create_label error: {err:?}"),
    }

    Ok(())
}

/// Tests that adding a permission to a role requires the author to outrank
/// that role.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_perm_change_requires_outranking_role() -> Result<()> {
    let mut devices = DevicesCtx::new("test_perm_change_requires_outranking_role").await?;
    let team_id = devices.create_and_add_team().await?;
    let roles = devices.setup_default_roles(team_id).await?;

    let owner_team = devices.owner.client.team(team_id);
    let operator_team = devices.operator.client.team(team_id);

    // Add operator with ChangeRolePerms permission
    let operator_role_rank = devices
        .owner
        .client
        .team(team_id)
        .rank(roles.operator().id)
        .await?;
    owner_team
        .add_device(
            devices.operator.pk.clone(),
            Some(roles.operator().id),
            Rank::new(operator_role_rank.value().saturating_sub(1)),
        )
        .await?;
    owner_team
        .add_perm_to_role(roles.operator().id, Permission::ChangeRolePerms)
        .await?;

    let owner_addr = devices.owner.aranya_local_addr().await?;
    operator_team.sync_now(owner_addr, None).await?;

    // Operator tries to add permission to admin role (higher ranked) -- should fail
    match operator_team
        .add_perm_to_role(roles.admin().id, Permission::CreateRole)
        .await
    {
        Ok(_) => bail!("expected add_perm_to_role to fail when author doesn't outrank role"),
        Err(crate::Error::Aranya(_)) => {}
        Err(err) => bail!("unexpected add_perm_to_role error: {err:?}"),
    }

    Ok(())
}

/// Tests that assigning a role where role_rank equals device_rank is allowed.
///
/// The policy uses `role_rank >= device_rank` (not strict `>`). Equal ranks
/// are safe because a device still cannot modify its own role - modification
/// requires strictly outranking the target via `author_can_operate_on_target`.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_assign_role_where_role_rank_equals_device_rank_allowed() -> Result<()> {
    let mut devices =
        DevicesCtx::new("test_assign_role_where_role_rank_equals_device_rank_allowed").await?;
    let team_id = devices.create_and_add_team().await?;
    let roles = devices.setup_default_roles(team_id).await?;

    let owner_team = devices.owner.client.team(team_id);
    let member_role_rank = owner_team.rank(roles.member().id).await?;

    // Create a custom role below the member role rank
    let role_rank = member_role_rank.value().saturating_sub(1);
    let custom_role = owner_team
        .create_role(text!("equal_rank_role"), role_rank.into())
        .await?;

    // Add device at exactly the same rank as the role
    owner_team
        .add_device(devices.admin.pk.clone(), None, role_rank.into())
        .await?;

    // Assign role where role_rank == device_rank -- should succeed
    owner_team
        .device(devices.admin.id)
        .assign_role(custom_role.id)
        .await
        .context("assigning role with equal rank should succeed")?;

    // Verify the role was assigned
    let assigned_role = owner_team.device(devices.admin.id).role().await?;
    assert_eq!(
        assigned_role.map(|r| r.id),
        Some(custom_role.id),
        "role should be assigned"
    );

    Ok(())
}

/// Tests that changing a device's rank to exactly equal its role's rank is allowed.
///
/// The policy uses `role_rank >= device_rank` (not strict `>`). Equal ranks
/// are safe because the device still cannot modify its own role.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_change_rank_device_to_exact_role_rank_allowed() -> Result<()> {
    let mut devices = DevicesCtx::new("test_change_rank_device_to_exact_role_rank_allowed").await?;
    let team_id = devices.create_and_add_team().await?;
    let roles = devices.setup_default_roles(team_id).await?;

    let owner_team = devices.owner.client.team(team_id);

    // Add device with member role at rank below the role
    let member_role_rank = devices
        .owner
        .client
        .team(team_id)
        .rank(roles.member().id)
        .await?;
    let device_rank = Rank::new(member_role_rank.value().saturating_sub(100));
    owner_team
        .add_device(
            devices.admin.pk.clone(),
            Some(roles.member().id),
            device_rank,
        )
        .await?;

    // Change device rank to exactly equal the role rank -- should succeed
    owner_team
        .change_rank(devices.admin.id, device_rank, member_role_rank)
        .await
        .context("changing device rank to equal role rank should succeed")?;

    // Verify the rank was changed
    let new_rank = owner_team.rank(devices.admin.id).await?;
    assert_eq!(new_rank, member_role_rank);

    Ok(())
}

/// Tests that having a permission is not sufficient without also having
/// sufficient rank to operate on the target.
///
/// A device with ChangeRank permission but lower rank than the target
/// cannot change the target's rank.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_has_permission_but_insufficient_rank() -> Result<()> {
    let mut devices = DevicesCtx::new("test_has_permission_but_insufficient_rank").await?;
    let team_id = devices.create_and_add_team().await?;
    let roles = devices.setup_default_roles(team_id).await?;

    let owner_team = devices.owner.client.team(team_id);
    let operator_team = devices.operator.client.team(team_id);

    // Create a label ranked higher than operator
    let operator_role_rank = devices
        .owner
        .client
        .team(team_id)
        .rank(roles.operator().id)
        .await?;
    let high_label_rank = Rank::new(operator_role_rank.value().saturating_add(100));
    let high_label = owner_team
        .create_label(text!("high_label"), high_label_rank)
        .await?;

    // Add operator with ChangeRank permission
    owner_team
        .add_device(
            devices.operator.pk.clone(),
            Some(roles.operator().id),
            Rank::new(operator_role_rank.value().saturating_sub(1)),
        )
        .await?;
    owner_team
        .add_perm_to_role(roles.operator().id, Permission::ChangeRank)
        .await?;

    let owner_addr = devices.owner.aranya_local_addr().await?;
    operator_team.sync_now(owner_addr, None).await?;

    // Operator has ChangeRank permission but cannot change higher-ranked label
    let member_role_rank = owner_team.rank(roles.member().id).await?;
    let low_rank = Rank::new(member_role_rank.value().saturating_sub(1));
    match operator_team
        .change_rank(high_label, high_label_rank, low_rank)
        .await
    {
        Ok(_) => {
            bail!("expected change_rank to fail despite having permission (insufficient rank)")
        }
        Err(crate::Error::Aranya(_)) => {}
        Err(err) => bail!("unexpected change_rank error: {err:?}"),
    }

    Ok(())
}

/// Tests that outranking a target is not sufficient without also having
/// the required permission.
///
/// A device that outranks a target but lacks ChangeRank permission
/// cannot change the target's rank.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_outranks_but_missing_permission() -> Result<()> {
    let mut devices = DevicesCtx::new("test_outranks_but_missing_permission").await?;
    let team_id = devices.create_and_add_team().await?;
    let roles = devices.setup_default_roles(team_id).await?;

    let owner_team = devices.owner.client.team(team_id);
    let admin_team = devices.admin.client.team(team_id);

    // Create a label ranked lower than admin
    let member_role_rank = owner_team.rank(roles.member().id).await?;
    let low_label_rank = Rank::new(member_role_rank.value().saturating_sub(1));
    let low_label = owner_team
        .create_label(text!("low_label"), low_label_rank)
        .await?;

    // Add admin but explicitly remove ChangeRank permission
    let admin_role_rank = devices
        .owner
        .client
        .team(team_id)
        .rank(roles.admin().id)
        .await?;
    owner_team
        .add_device(
            devices.admin.pk.clone(),
            Some(roles.admin().id),
            Rank::new(admin_role_rank.value().saturating_sub(1)),
        )
        .await?;
    owner_team
        .remove_perm_from_role(roles.admin().id, Permission::ChangeRank)
        .await?;

    let owner_addr = devices.owner.aranya_local_addr().await?;
    admin_team.sync_now(owner_addr, None).await?;

    // Admin outranks the label but lacks ChangeRank permission
    let attempted_rank = Rank::new(low_label_rank.value().saturating_add(1));
    match admin_team
        .change_rank(low_label, low_label_rank, attempted_rank)
        .await
    {
        Ok(_) => {
            bail!("expected change_rank to fail despite outranking target (missing permission)")
        }
        Err(crate::Error::Aranya(_)) => {}
        Err(err) => bail!("unexpected change_rank error: {err:?}"),
    }

    Ok(())
}

/// Assigning the same label to a device twice should fail because the
/// label assignment already exists with the same generation.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_duplicate_label_assignment_rejected() -> Result<()> {
    let mut devices = DevicesCtx::new("test_duplicate_label_assignment_rejected").await?;
    let team_id = devices.create_and_add_team().await?;
    let roles = devices
        .setup_default_roles(team_id)
        .await
        .context("unable to setup default roles")?;
    devices.add_all_device_roles(team_id, &roles).await?;

    let owner_team = devices.owner.client.team(team_id);
    let member_role_rank = owner_team.rank(roles.member().id).await?;
    let label_rank = Rank::new(member_role_rank.value().saturating_sub(1));
    let label = owner_team.create_label(text!("label"), label_rank).await?;

    // First assignment should succeed.
    owner_team
        .device(devices.membera.id)
        .assign_label(label, ChanOp::SendRecv)
        .await
        .expect("first label assignment should succeed");

    // Second assignment of the same label should fail.
    let err = owner_team
        .device(devices.membera.id)
        .assign_label(label, ChanOp::SendRecv)
        .await
        .expect_err("duplicate label assignment should fail");
    assert!(matches!(err, crate::Error::Aranya(_)), "{err:?}");

    Ok(())
}

/// When a device is removed and re-added, old label assignments become
/// stale (generation mismatch). Reassigning the label should succeed.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_device_generation_counter_label_reassignment() -> Result<()> {
    let mut devices = DevicesCtx::new("test_device_generation_counter_label_reassignment").await?;
    let team_id = devices.create_and_add_team().await?;
    let roles = devices
        .setup_default_roles(team_id)
        .await
        .context("unable to setup default roles")?;
    devices.add_all_device_roles(team_id, &roles).await?;

    let owner_team = devices.owner.client.team(team_id);
    let member_role_rank = owner_team.rank(roles.member().id).await?;
    let label_rank = Rank::new(member_role_rank.value().saturating_sub(1));
    let label = owner_team.create_label(text!("label"), label_rank).await?;

    // Generation counter should start at 0.
    let gen = owner_team
        .device(devices.membera.id)
        .generation()
        .await
        .expect("generation should succeed");
    assert_eq!(gen, Some(0), "initial generation should be 0");

    // Assign label to membera.
    owner_team
        .device(devices.membera.id)
        .assign_label(label, ChanOp::SendRecv)
        .await?;

    // Verify label is visible.
    let labels = owner_team
        .device(devices.membera.id)
        .label_assignments()
        .await?;
    assert_eq!(labels.iter().count(), 1, "label should be assigned");

    // Remove membera from team.
    owner_team
        .device(devices.membera.id)
        .remove_from_team()
        .await?;

    // Generation counter increments on removal.
    let gen = owner_team
        .device(devices.membera.id)
        .generation()
        .await
        .expect("generation should succeed");
    assert_eq!(gen, Some(1), "generation should be 1 after removal");

    // Re-add membera with the member role.
    let device_rank = Rank::new(member_role_rank.value().saturating_sub(1));
    owner_team
        .add_device(
            devices.membera.pk.clone(),
            Some(roles.member().id),
            device_rank,
        )
        .await?;

    // Generation counter should not change on re-add.
    let gen = owner_team
        .device(devices.membera.id)
        .generation()
        .await
        .expect("generation should succeed");
    assert_eq!(gen, Some(1), "generation should still be 1 after re-add");

    // Old label assignment should be stale (not visible).
    let labels = owner_team
        .device(devices.membera.id)
        .label_assignments()
        .await?;
    assert_eq!(
        labels.iter().count(),
        0,
        "stale label should not be visible"
    );

    // Reassigning the same label should succeed (stale gen < current gen).
    owner_team
        .device(devices.membera.id)
        .assign_label(label, ChanOp::SendRecv)
        .await?;

    // Generation counter should still be 1 (reassignment doesn't change it).
    let gen = owner_team
        .device(devices.membera.id)
        .generation()
        .await
        .expect("generation should succeed");
    assert_eq!(
        gen,
        Some(1),
        "generation should still be 1 after reassignment"
    );

    // Label should now be visible.
    let labels = owner_team
        .device(devices.membera.id)
        .label_assignments()
        .await?;
    assert_eq!(
        labels.iter().count(),
        1,
        "reassigned label should be visible"
    );

    Ok(())
}

/// Adding the same device to a team twice should fail because the
/// Device fact already exists.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_add_device_to_team_twice_rejected() -> Result<()> {
    let mut devices = DevicesCtx::new("test_add_device_to_team_twice_rejected").await?;
    let team_id = devices.create_and_add_team().await?;
    let roles = devices
        .setup_default_roles(team_id)
        .await
        .context("unable to setup default roles")?;
    devices.add_all_device_roles(team_id, &roles).await?;

    let owner_team = devices.owner.client.team(team_id);
    let member_role_rank = owner_team.rank(roles.member().id).await?;
    let device_rank = Rank::new(member_role_rank.value().saturating_sub(1));

    // Try to add membera again (already on team).
    let err = owner_team
        .add_device(
            devices.membera.pk.clone(),
            Some(roles.member().id),
            device_rank,
        )
        .await
        .expect_err("adding same device twice should fail");
    assert!(matches!(err, crate::Error::Aranya(_)), "{err:?}");

    Ok(())
}

/// Revoking a label from a device that was removed from the team should
/// fail. Additionally, if a label was assigned before the device was
/// removed and the device is later re-added, attempting to revoke that
/// old assignment should also fail because the generation counter no
/// longer matches.
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_revoke_stale_label_assignment_rejected() -> Result<()> {
    let mut devices = DevicesCtx::new("test_revoke_stale_label_assignment_rejected").await?;
    let team_id = devices.create_and_add_team().await?;
    let roles = devices
        .setup_default_roles(team_id)
        .await
        .context("unable to setup default roles")?;
    devices.add_all_device_roles(team_id, &roles).await?;

    let owner_team = devices.owner.client.team(team_id);
    let member_role_rank = owner_team.rank(roles.member().id).await?;
    let label_rank = Rank::new(member_role_rank.value().saturating_sub(1));
    let label = owner_team.create_label(text!("label"), label_rank).await?;

    // Generation should start at 0.
    let gen = owner_team
        .device(devices.membera.id)
        .generation()
        .await
        .expect("generation should succeed");
    assert_eq!(gen, Some(0), "initial generation should be 0");

    // Assign label to membera.
    owner_team
        .device(devices.membera.id)
        .assign_label(label, ChanOp::SendRecv)
        .await
        .expect("label assignment should succeed");

    // Remove membera from team.
    owner_team
        .device(devices.membera.id)
        .remove_from_team()
        .await
        .expect("remove_from_team should succeed");

    // Generation counter increments on removal.
    let gen = owner_team
        .device(devices.membera.id)
        .generation()
        .await
        .expect("generation should succeed");
    assert_eq!(gen, Some(1), "generation should be 1 after removal");

    // Revoking a label from a removed device should fail.
    let err = owner_team
        .device(devices.membera.id)
        .revoke_label(label)
        .await
        .expect_err("revoking label from removed device should fail");
    assert!(matches!(err, crate::Error::Aranya(_)), "{err:?}");

    // Re-add membera with the member role.
    let device_rank = Rank::new(member_role_rank.value().saturating_sub(1));
    owner_team
        .add_device(
            devices.membera.pk.clone(),
            Some(roles.member().id),
            device_rank,
        )
        .await
        .expect("re-adding device should succeed");

    // Generation counter should not change on re-add.
    let gen = owner_team
        .device(devices.membera.id)
        .generation()
        .await
        .expect("generation should succeed");
    assert_eq!(gen, Some(1), "generation should still be 1 after re-add");

    // Try to revoke the stale label assignment (generation mismatch).
    let err = owner_team
        .device(devices.membera.id)
        .revoke_label(label)
        .await
        .expect_err("revoking stale label assignment should fail");
    assert!(matches!(err, crate::Error::Aranya(_)), "{err:?}");

    Ok(())
}

/// When one device assigns a label and another concurrently removes the
/// target device (without syncing), the label assignment should be
/// invalidated after syncing because its embedded generation counter
/// won't match the device's current generation after reordering.
///
/// RemoveDevice has priority 400 and AssignLabelToDevice has priority
/// 100, so the braid deterministically orders the remove before the
/// assign when they are concurrent. This means:
///   1. RemoveDevice runs first, bumping device_gen from 0 to 1.
///   2. AssignLabelToDevice runs second with embedded device_gen=0,
///      but the device's current gen is now 1 — the check fails.
///
/// Timeline:
///   owner: assign label to membera (captures device_gen=0)
///   admin: remove membera from team (bumps device_gen to 1)
///   (no sync between owner and admin during these operations)
///   sync all -> braid reorders remove before assign (priority 400 > 100)
///   -> assign fails because device_gen=0 != current_gen=1
///   owner: re-add membera (device_gen stays 1)
///   -> label should not be assigned
#[test_log::test(tokio::test(flavor = "multi_thread"))]
async fn test_concurrent_label_assign_and_device_removal() -> Result<()> {
    let mut devices = DevicesCtx::new("test_concurrent_label_assign_and_device_removal").await?;
    let team_id = devices.create_and_add_team().await?;
    let roles = devices
        .setup_default_roles(team_id)
        .await
        .context("unable to setup default roles")?;
    devices.add_all_device_roles(team_id, &roles).await?;

    let owner_team = devices.owner.client.team(team_id);

    // Create a label that can be assigned to members.
    let member_role_rank = owner_team.rank(roles.member().id).await?;
    let label_rank = Rank::new(member_role_rank.value().saturating_sub(1));
    let label = owner_team.create_label(text!("label"), label_rank).await?;

    // Sync so admin sees all devices and the label.
    let owner_addr = devices.owner.aranya_local_addr().await?;
    let admin_team = devices.admin.client.team(team_id);
    admin_team.sync_now(owner_addr, None).await?;

    // Verify initial generation is 0 on both devices.
    let gen = owner_team.device(devices.membera.id).generation().await?;
    assert_eq!(gen, Some(0), "initial generation should be 0 on owner");
    let gen = admin_team.device(devices.membera.id).generation().await?;
    assert_eq!(gen, Some(0), "initial generation should be 0 on admin");

    // --- Concurrent operations without syncing ---
    // Owner assigns the label to membera (captures device_gen=0).
    owner_team
        .device(devices.membera.id)
        .assign_label(label, ChanOp::SendRecv)
        .await
        .expect("label assignment should succeed locally");

    // On the owner's device the label assignment is valid and gen is still 0.
    let labels = owner_team
        .device(devices.membera.id)
        .label_assignments()
        .await?;
    assert_eq!(
        labels.iter().count(),
        1,
        "label should be assigned on owner before sync"
    );
    let gen = owner_team.device(devices.membera.id).generation().await?;
    assert_eq!(
        gen,
        Some(0),
        "generation should still be 0 on owner before sync"
    );

    // Admin removes membera from the team (bumps device_gen to 1).
    // Admin has not synced with owner, so it doesn't know about the
    // label assignment.
    admin_team
        .device(devices.membera.id)
        .remove_from_team()
        .await
        .expect("remove should succeed locally");

    // On admin, the generation was bumped to 1 by the removal.
    let gen = admin_team.device(devices.membera.id).generation().await?;
    assert_eq!(
        gen,
        Some(1),
        "generation should be 1 on admin after removal"
    );

    // Owner still sees gen=0 because it hasn't synced the removal yet.
    let gen = owner_team.device(devices.membera.id).generation().await?;
    assert_eq!(
        gen,
        Some(0),
        "generation should still be 0 on owner before sync"
    );

    // --- Sync to trigger braid reordering ---
    // RemoveDevice (priority 400) is ordered before AssignLabelToDevice
    // (priority 100) by the braid. After syncing:
    //   1. Both devices evaluate RemoveDevice first -> gen bumps to 1.
    //   2. Both devices evaluate AssignLabelToDevice second -> check
    //      fails because embedded device_gen=0 != current gen=1.
    admin_team.sync_now(owner_addr, None).await?;
    // Sync back to owner so it sees the removal.
    owner_team
        .sync_now(devices.admin.aranya_local_addr().await?, None)
        .await?;

    // After sync, both devices should agree: gen is 1 because the
    // remove was processed. The label assignment was rejected.
    let gen = owner_team.device(devices.membera.id).generation().await?;
    assert_eq!(gen, Some(1), "generation should be 1 on owner after sync");

    // Re-add membera so we can query label state for this device.
    let device_rank = Rank::new(member_role_rank.value().saturating_sub(1));
    owner_team
        .add_device(
            devices.membera.pk.clone(),
            Some(roles.member().id),
            device_rank,
        )
        .await
        .context("re-adding device should succeed")?;

    // Generation stays at 1 after re-add (only removal increments it).
    let gen = owner_team.device(devices.membera.id).generation().await?;
    assert_eq!(gen, Some(1), "generation should still be 1 after re-add");

    // The label that was previously assigned (and valid before sync)
    // should NOT be assigned now. The concurrent removal changed the
    // generation to 1, so the assignment authored with device_gen=0
    // was rejected during braid evaluation.
    let labels = owner_team
        .device(devices.membera.id)
        .label_assignments()
        .await?;
    assert_eq!(
        labels.iter().count(),
        0,
        "label should not be assigned after concurrent removal invalidated the assignment"
    );

    // Verify on the admin's device as well.
    admin_team.sync_now(owner_addr, None).await?;
    let labels = admin_team
        .device(devices.membera.id)
        .label_assignments()
        .await?;
    assert_eq!(
        labels.iter().count(),
        0,
        "label should not be assigned on admin after sync either"
    );

    Ok(())
}