autumn-cli 0.9.0

//! Integration tests for the CMS starter.
//!
//! ```text
//! cargo test -p {{project_name}}                                    # smoke tests (no Docker)
//! cargo test -p {{project_name}} -- --include-ignored --test-threads=1   # full flow (needs Docker)
//! ```
//!
//! The ignored tests start a Postgres testcontainer and drive the real
//! registration → author → publish → read flow through the actual routes.
//! `--test-threads=1` is not optional: they share one process-global
//! `TestDb::shared()` container and each test truncates it, so running them
//! concurrently would race each other's data.

use autumn_web::config::AutumnConfig;
use autumn_web::test::{TestApp, TestClient, TestDb, TestResponse};

/// The real migration, so the test schema can never drift from the shipped one.
const MIGRATION_SQL: &str =
    include_str!("../migrations/20260908005714_create_content_schema/up.sql");

/// The application's real route table — the same one `main` mounts.
fn app_routes() -> Vec<autumn_web::Route> {
    {{crate_name}}::all_routes()
}

/// URL-encode form pairs.
///
/// `TestRequest::form` takes an already-encoded body, and these tests submit
/// values containing spaces, commas and `%` — encoding by hand once here is
/// safer than remembering to escape at twenty call sites.
fn form(pairs: &[(&str, &str)]) -> String {
    fn encode(value: &str) -> String {
        let mut out = String::with_capacity(value.len());
        for byte in value.as_bytes() {
            match byte {
                b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => {
                    out.push(*byte as char);
                }
                b' ' => out.push('+'),
                other => out.push_str(&format!("%{other:02X}")),
            }
        }
        out
    }
    pairs
        .iter()
        .map(|(key, value)| format!("{}={}", encode(key), encode(value)))
        .collect::<Vec<_>>()
        .join("&")
}

// ── Smoke tests (no Docker) ─────────────────────────────────────────────────

/// Exactly one route is a wildcard, and it is the front controller.
///
/// This is the one structural claim worth making without a database, because it
/// is the hazard the routing design actually has: `dispatch` is mounted at
/// `/{*path}` and serves every permalink, so a second wildcard — or a reserved
/// prefix that was never given a literal route — would be silently swallowed by
/// it and 404 at runtime rather than fail to build.
#[test]
fn the_front_controller_is_the_only_wildcard_route() {
    let routes = app_routes();
    let wildcards: Vec<&str> = routes
        .iter()
        .map(|route| route.path)
        .filter(|path| path.contains('*'))
        .collect();
    assert_eq!(
        wildcards,
        vec!["/{*path}"],
        "a second wildcard route would shadow, or be shadowed by, the front controller"
    );
}

/// Every reserved prefix has a literal route of its own.
///
/// A path listed here that lost its handler would not 404 — it would fall
/// through to the front controller and be looked up as a post slug, which is a
/// far more confusing failure than a missing route.
#[test]
fn every_reserved_prefix_has_a_literal_route() {
    let routes = app_routes();
    let paths: Vec<&str> = routes.iter().map(|route| route.path).collect();
    for reserved in [
        "/login",
        "/logout",
        "/register",
        "/search",
        "/admin",
        "/feed",
        "/api/v1",
        "/media/{slug}",
        // The browser asks for this on every page load. Without a literal
        // route the catch-all answers it with a themed 404, which the
        // headless-Chromium smoke sees as a console error — and which
        // shadows the framework's own `204 No Content` fallback.
        "/favicon.ico",
    ] {
        assert!(
            paths.contains(&reserved),
            "`{reserved}` has no literal route, so the front controller would try to resolve \
             it as content; mounted paths: {paths:?}"
        );
    }
}

/// Every route source, for the scans below. One list, so a new module cannot
/// be added to one gate and forgotten by the other.
fn route_sources() -> &'static [(&'static str, &'static str)] {
    &[
        ("routes/site.rs", include_str!("../src/routes/site.rs")),
        ("routes/auth.rs", include_str!("../src/routes/auth.rs")),
        ("routes/front.rs", include_str!("../src/routes/front.rs")),
        (
            "routes/comments.rs",
            include_str!("../src/routes/comments.rs"),
        ),
        (
            "routes/admin/mod.rs",
            include_str!("../src/routes/admin/mod.rs"),
        ),
        (
            "routes/admin/posts.rs",
            include_str!("../src/routes/admin/posts.rs"),
        ),
        (
            "routes/admin/terms.rs",
            include_str!("../src/routes/admin/terms.rs"),
        ),
        (
            "routes/admin/comments.rs",
            include_str!("../src/routes/admin/comments.rs"),
        ),
        (
            "routes/admin/media.rs",
            include_str!("../src/routes/admin/media.rs"),
        ),
        (
            "routes/admin/users.rs",
            include_str!("../src/routes/admin/users.rs"),
        ),
        (
            "routes/admin/settings.rs",
            include_str!("../src/routes/admin/settings.rs"),
        ),
        (
            "routes/admin/appearance.rs",
            include_str!("../src/routes/admin/appearance.rs"),
        ),
        (
            "routes/admin/tools.rs",
            include_str!("../src/routes/admin/tools.rs"),
        ),
        ("theme.rs", include_str!("../src/theme.rs")),
    ]
}

/// No handler takes the `Db` extractor.
///
/// `Db` is checked out before the handler body runs and held until the response
/// is returned. The repositories are pool-backed and acquire their *own*
/// connection per call, so a handler holding a `Db` and then reaching for a
/// repository needs two slots at once. With the shipped `pool_size = 10`, ten
/// concurrent requests in that shape each hold one while waiting for a second
/// that only another of them could release — a pool-wide deadlock, reachable
/// from `/comments/{id}`, which is unauthenticated.
///
/// The rule is therefore: handlers get their connection from `Repos::with_conn`,
/// which scopes it to a single call and cannot span a repository read. This
/// scans for the extractor because the failure is invisible until the pool is
/// under real concurrency, which no test in this suite produces.
#[test]
fn no_handler_holds_a_pool_connection_across_repository_calls() {
    let sources = route_sources();
    let mut offenders = Vec::new();
    for (name, source) in sources {
        for (line_no, line) in source.lines().enumerate() {
            if line.contains("autumn_web::Db") && !line.trim_start().starts_with("//") {
                offenders.push(format!("{name}:{}: {}", line_no + 1, line.trim()));
            }
        }
    }
    assert!(
        offenders.is_empty(),
        "these handlers take the `Db` extractor; use `Repos::with_conn` instead so the \
         connection cannot be held across a repository call:\n{}",
        offenders.join("\n")
    );
}

/// Every `POST` form in the source carries a CSRF token.
///
/// The runtime test above proves the mechanism works on one form. This proves
/// no form was *forgotten* — the actual failure mode, since a missing token is
/// invisible until someone submits that particular form in a deployment with
/// CSRF on (and this suite runs with it off). Scanning the source is crude, but
/// it is the only check that covers all twenty-odd forms at once.
#[test]
fn every_post_form_emits_a_csrf_token() {
    let sources = route_sources();
    let mut forms = 0_usize;
    for (name, source) in sources {
        let lines: Vec<&str> = source.lines().collect();
        for (index, line) in lines.iter().enumerate() {
            if !line.contains(r#"method="post""#) {
                continue;
            }
            forms += 1;
            // The token is emitted as the form's first child, so it lands
            // within a few lines of the opening tag. `chrome.csrf` is the
            // pre-rendered input the theme layout carries.
            let window = lines[index..lines.len().min(index + 8)].join("\n");
            assert!(
                window.contains("csrf.input()") || window.contains("chrome.csrf"),
                "{name}:{} opens a POST form with no CSRF token:\n{window}",
                index + 1
            );
        }
    }
    assert!(
        forms >= 20,
        "expected to scan the application's POST forms, found only {forms} — \
         has the markup changed shape?"
    );
}

/// The admin is capability-gated at every entry point.
///
/// A handler added to the admin without a `require_capability!` would be
/// reachable by any signed-in Subscriber. This asserts the shape rather than
/// the behaviour — the behaviour is covered by the Docker tests below — so it
/// catches the omission at the cheapest possible moment.
#[test]
fn every_admin_route_is_under_the_admin_prefix() {
    let routes = app_routes();
    for route in &routes {
        if route.name.contains("admin") {
            assert!(
                route.path.starts_with("/admin") || route.path.starts_with("/media"),
                "`{}` looks like an admin handler but is mounted at `{}`",
                route.name,
                route.path
            );
        }
    }
}

// ── Full flow (requires Docker) ─────────────────────────────────────────────

/// Split the migration into individual statements.
///
/// `TestDb::execute_sql` prepares what it is given, and Postgres refuses
/// multiple commands in one prepared statement — passing the whole file makes
/// every Docker test in the suite fail with "cannot insert multiple commands
/// into a prepared statement". `examples/teams` shipped exactly that bug for
/// months; this is the fix, applied up front.
fn migration_statements() -> Vec<String> {
    // Comments are stripped BEFORE splitting, not after. A prose comment in the
    // migration contains a semicolon ("…no application code; `#[searchable]`…"),
    // and splitting first turns the rest of that sentence into a statement of
    // its own — which fails with `syntax error at or near "\`#"`. This ordering
    // is the whole subtlety in this function.
    //
    // It still assumes no statement contains a semicolon inside a string
    // literal or a `$$`-quoted body; this migration has neither, and a
    // migration that grows one needs a real parser rather than a patch here.
    let without_comments: String = MIGRATION_SQL
        .lines()
        .filter(|line| !line.trim_start().starts_with("--"))
        .collect::<Vec<_>>()
        .join("\n");

    without_comments
        .split(';')
        .map(|statement| statement.trim().to_owned())
        .filter(|statement| !statement.is_empty())
        .collect()
}

/// Apply one statement, returning the error instead of panicking.
///
/// `TestDb::execute_sql` panics on failure, which is the right default but
/// makes the version probe below impossible.
async fn try_execute(db: &TestDb, sql: &str) -> Result<(), String> {
    use diesel_async::RunQueryDsl;
    let mut conn = db.pool().get().await.expect("pool connection");
    diesel::sql_query(sql)
        .execute(&mut conn)
        .await
        .map(|_| ())
        .map_err(|error| error.to_string())
}

/// Apply the migration exactly once per test process.
///
/// `TestDb::shared()` hands every test the *same* container, so running the
/// DDL per test fails the second one with `relation "users" already exists`.
/// Rewriting the migration to say `IF NOT EXISTS` would be the other fix and is
/// worse: it would make the committed migration lie about being idempotent when
/// it is not, to serve a test-only need.
static SCHEMA: tokio::sync::OnceCell<()> = tokio::sync::OnceCell::const_new();

/// Recreate the `search_vector` column with a trigger, for servers older than
/// PostgreSQL 12. See the call site for why this lives in the test harness.
async fn apply_search_vector_fallback(db: &TestDb) {
    db.execute_sql("ALTER TABLE posts ADD COLUMN search_vector tsvector")
        .await;
    db.execute_sql(
        "CREATE FUNCTION posts_search_vector_refresh() RETURNS trigger AS $$
         BEGIN
             NEW.search_vector :=
                 setweight(to_tsvector('english'::regconfig, coalesce(NEW.title, '')), 'A') ||
                 setweight(to_tsvector('english'::regconfig, coalesce(NEW.excerpt, '')), 'B') ||
                 setweight(to_tsvector('english'::regconfig, coalesce(NEW.body, '')), 'C');
             RETURN NEW;
         END
         $$ LANGUAGE plpgsql",
    )
    .await;
    db.execute_sql(
        "CREATE TRIGGER posts_search_vector_trigger BEFORE INSERT OR UPDATE ON posts
         FOR EACH ROW EXECUTE PROCEDURE posts_search_vector_refresh()",
    )
    .await;
}

/// A migrated, truncated, CSRF-disabled client.
async fn db_client() -> TestClient {
    let db = TestDb::shared().await;
    SCHEMA
        .get_or_init(|| async {
            for statement in migration_statements() {
                // `GENERATED ALWAYS AS (…) STORED` needs PostgreSQL 12, and
                // `TestDb` pins `postgres:11-alpine` (testcontainers-modules'
                // default tag). The migration is NOT wrong — `docker-compose.yml`
                // runs Postgres 16, and the framework's own `#[searchable]`
                // generator emits this exact construct (see
                // `examples/wiki/migrations/…_add_search_to_pages`). So the
                // fallback belongs here, in the harness, rather than degrading
                // the shipped migration to suit an EOL server.
                //
                // The fallback produces the *same column with the same
                // contents* via a trigger, so `search()` is genuinely exercised
                // rather than skipped — the FTS test would otherwise be the one
                // test that never ran.
                if let Err(error) = try_execute(db, &statement).await {
                    let is_generated_column = statement.contains("GENERATED ALWAYS AS");
                    assert!(
                        is_generated_column,
                        "migration statement failed: {error}\nSQL: {statement}"
                    );
                    apply_search_vector_fallback(db).await;
                }
            }
        })
        .await;
    db.execute_sql(
        "TRUNCATE users, options, attachments, posts, post_meta, terms, post_terms, \
         revisions, comments, menus, menu_items, widgets RESTART IDENTITY CASCADE",
    )
    .await;

    // The settings read is memoized per *process*, so truncating `options`
    // alone does not reset it: a test that changes a setting keeps changing it
    // for every test that runs afterwards. That surfaced as an unrelated
    // failure — a test configuring a front page left `/` rendering that single
    // post for everything after it — and the same shape once disabled guest
    // comments suite-wide. Invalidating through the app's own mechanism is what
    // makes each test start from the shipped defaults.
    assert!(
        {{crate_name}}::repositories::PgSiteOptionRepository::invalidate_declared_caches(),
        "the test cache backend cannot invalidate by namespace, so settings would leak \
         between tests"
    );

    // Registrations are process-global; the real `main` calls this too, so the
    // test app and the shipped app see the same post types and shortcodes.
    {{crate_name}}::bootstrap();

    // The forms post normally; disabling CSRF keeps the tests from having to
    // scrape a hidden token out of every rendered page.
    let mut config = AutumnConfig::default();
    config.security.csrf.enabled = false;
    // `SubmitTokenLayer` is the same story: the registration form carries a
    // one-time token that the tests would otherwise have to round-trip.
    config.security.submit_token.enabled = false;
    // A `TestClient` request has no TCP peer, and `__check_throttle` bypasses a
    // caller it cannot identify — so a `#[throttle(key = "ip")]` route is
    // unreachable from a test unless the address arrives in a header. This
    // makes `X-Forwarded-For` that address. It changes nothing for a request
    // that sends no such header (still no peer, still bypassed), so only the
    // test that deliberately sets one is throttled; the global limiter stays
    // off.
    config.security.rate_limit.trust_forwarded_headers = true;

    TestApp::new()
        .routes(app_routes())
        .config(config)
        .with_db(db.pool())
        .build()
}

/// A client with CSRF **enabled**, unlike [`db_client`].
///
/// `TestApp::new()` disables CSRF by default, so the rest of this suite never
/// exercises it — which is exactly how every form in this application once came
/// to carry a hidden field named `_csrf_token` while `CsrfLayer` scans for the
/// configured `security.csrf.form_field` (default `_csrf`). Every POST would
/// have 403'd in production and no test would have noticed.
async fn csrf_client() -> TestClient {
    let db = TestDb::shared().await;
    SCHEMA
        .get_or_init(|| async {
            for statement in migration_statements() {
                if try_execute(db, &statement).await.is_err() {
                    apply_search_vector_fallback(db).await;
                }
            }
        })
        .await;
    db.execute_sql(
        "TRUNCATE users, options, attachments, posts, post_meta, terms, post_terms, \
         revisions, comments, menus, menu_items, widgets RESTART IDENTITY CASCADE",
    )
    .await;

    // The settings read is memoized per *process*, so truncating `options`
    // alone does not reset it: a test that changes a setting keeps changing it
    // for every test that runs afterwards. That surfaced as an unrelated
    // failure — a test configuring a front page left `/` rendering that single
    // post for everything after it — and the same shape once disabled guest
    // comments suite-wide. Invalidating through the app's own mechanism is what
    // makes each test start from the shipped defaults.
    assert!(
        {{crate_name}}::repositories::PgSiteOptionRepository::invalidate_declared_caches(),
        "the test cache backend cannot invalidate by namespace, so settings would leak \
         between tests"
    );
    {{crate_name}}::bootstrap();

    let mut config = AutumnConfig::default();
    config.security.csrf.enabled = true;
    TestApp::new()
        .routes(app_routes())
        .config(config)
        .with_db(db.pool())
        .build()
}

/// Pull the value of the hidden CSRF input out of a rendered form.
///
/// Deliberately reads the **name** from the markup rather than assuming
/// `_csrf`: that assumption is the bug this test exists to catch.
fn scrape_csrf(html: &str) -> (String, String) {
    let marker = r#"<input type="hidden" name=""#;
    let start = html
        .find(marker)
        .unwrap_or_else(|| panic!("no hidden CSRF input in the rendered form:\n{html}"))
        + marker.len();
    let rest = &html[start..];
    let name_end = rest.find('"').expect("field name is quoted");
    let name = rest[..name_end].to_owned();

    let value_marker = r#" value=""#;
    let value_start =
        rest.find(value_marker).expect("hidden input has a value") + value_marker.len();
    let value_rest = &rest[value_start..];
    let value_end = value_rest.find('"').expect("value is quoted");
    (name, value_rest[..value_end].to_owned())
}

/// Every POST form carries a token the layer will actually look for, and a
/// submission without one is refused.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn forms_carry_a_csrf_token_the_layer_accepts() {
    let client = csrf_client().await;

    // The registration form renders a token…
    let page = client.get("/register").send().await.assert_ok().text();
    let (field, token) = scrape_csrf(&page);
    assert_eq!(
        field, "_csrf",
        "the hidden field must use the configured `security.csrf.form_field`; \
         a form that invents its own name submits a token nothing validates"
    );

    // …a submission carrying it is accepted…
    let accepted = client
        .post("/register")
        .form(&form(&[
            ("username", "owner"),
            ("email", "owner@example.com"),
            ("password", "correct-horse-battery-staple"),
            (field.as_str(), token.as_str()),
        ]))
        .send()
        .await;
    assert_eq!(
        accepted.status,
        303,
        "a token-carrying submission must be accepted; body: {}",
        accepted.text()
    );

    // …and one without it is refused.
    let refused = client
        .post("/register")
        .form(&form(&[
            ("username", "intruder"),
            ("email", "intruder@example.com"),
            ("password", "correct-horse-battery-staple"),
        ]))
        .send()
        .await;
    assert!(
        refused.status.is_client_error(),
        "a submission with no CSRF token must be refused, got {}",
        refused.status
    );
}

/// The `name=value` pair from a response's session cookie.
fn session_cookie(resp: &TestResponse) -> String {
    resp.header("set-cookie")
        .expect("an authenticating response sets a session cookie")
        .split(';')
        .next()
        .expect("cookie has a name=value pair")
        .to_owned()
}

/// Make the client anonymous.
///
/// `TestClient` carries a cookie jar and replays it automatically, so a plain
/// `client.get(...)` after a registration is still signed in. Every assertion
/// about what a *visitor* can see has to clear it first — without this, the
/// draft-visibility and password-protection tests pass for the wrong reason.
fn sign_out(client: &TestClient) {
    client.log_out();
}

/// Register an account. The first one created owns the site.
/// Sign an existing account in, returning its fresh session cookie.
///
/// `register` rotates the session, so a cookie captured before a second account
/// registers is stale — the request lands signed out and the admin screens
/// redirect to the login form. Tests that need two accounts and then act as the
/// first one come back through here.
async fn sign_in(client: &TestClient, username: &str) -> String {
    let resp = client
        .post("/login")
        .form(&form(&[
            ("username", username),
            ("password", "correct-horse-battery-staple"),
        ]))
        .send()
        .await;
    assert_eq!(
        resp.status,
        303,
        "sign-in should redirect; body was: {}",
        resp.text()
    );
    session_cookie(&resp)
}

async fn register(client: &TestClient, username: &str) -> String {
    let email = format!("{username}@example.com");
    let resp = client
        .post("/register")
        .form(&form(&[
            ("username", username),
            ("email", &email),
            ("password", "correct-horse-battery-staple"),
        ]))
        .send()
        .await;
    assert_eq!(
        resp.status,
        303,
        "registration should redirect; body was: {}",
        resp.text()
    );
    session_cookie(&resp)
}

/// The settings form, filled with the shipped defaults, with `overrides` applied.
///
/// Posting a partial settings form is a trap: `comment_moderation` and
/// `allow_guest_comments` are `Option<String>`, so a browser omits them when
/// unchecked and the handler reads *absent* as *off*. A test that names only
/// the field it cares about therefore silently disables guest comments — and
/// because the settings read is memoized per process, it does so for every test
/// that runs after it, in a way that looks like an unrelated failure. Building
/// from the defaults here means a test can only change what it names.
fn settings_form(overrides: &[(&str, &str)]) -> String {
    let mut fields: Vec<(&str, &str)> = vec![
        ("site_title", "Test Site"),
        ("tagline", ""),
        ("permalink_structure", "day_and_name"),
        ("posts_per_page", "10"),
        ("default_comment_status", "open"),
        ("comment_moderation", "on"),
        ("allow_guest_comments", "on"),
        ("active_theme", "default"),
        ("date_format", "%B %-d, %Y"),
        ("timezone", "UTC"),
    ];
    for (key, value) in overrides {
        match fields.iter_mut().find(|(k, _)| k == key) {
            Some(slot) => slot.1 = value,
            None => fields.push((key, value)),
        }
    }
    form(&fields)
}

/// Upload an export file to the importer.
///
/// The endpoint takes a multipart file rather than a URL-encoded field: form
/// encoding turned every quote and brace into a three-byte escape, so a backup
/// roughly a third of the request limit already exceeded it and the CMS could
/// not restore its own export.
async fn import_export(client: &TestClient, cookie: &str, payload: &str) -> TestResponse {
    const BOUNDARY: &str = "----cmsimport";
    let body = format!(
        "--{BOUNDARY}\r\nContent-Disposition: form-data; name=\"payload\"; \
         filename=\"export.json\"\r\nContent-Type: application/json\r\n\r\n\
         {payload}\r\n--{BOUNDARY}--\r\n"
    );
    client
        .post("/admin/tools/import")
        .header("cookie", cookie)
        .header(
            "content-type",
            &format!("multipart/form-data; boundary={BOUNDARY}"),
        )
        .body(body)
        .send()
        .await
}

/// The post's current `lock_version`, read directly from the database.
///
/// Split out from [`edit_form`] so a staleness test can capture a version
/// stamp *before* a later request changes it — `edit_form` always reads the
/// current value, which is right for every ordinary test but cannot express
/// "the form this stale request carries."
async fn lock_version_of(id: i64) -> i32 {
    use diesel::prelude::*;
    use diesel_async::RunQueryDsl;
    let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
    {{crate_name}}::schema::posts::table
        .find(id)
        .select({{crate_name}}::schema::posts::lock_version)
        .first::<i32>(&mut conn)
        .await
        .expect("the post")
}

/// Encode an editor form, stamping the post's current `lock_version`.
///
/// The editor renders that hidden field on every edit and the update handler
/// requires it, so a test that omits it is exercising a request the UI cannot
/// make — and, before the check existed, one that silently skipped the
/// stale-edit guard.
async fn edit_form(id: &impl std::fmt::Display, fields: &[(&str, &str)]) -> String {
    let id: i64 = id.to_string().parse().expect("a post id");
    let version = lock_version_of(id).await.to_string();
    let mut all: Vec<(&str, &str)> = fields.to_vec();
    all.push(("lock_version", version.as_str()));
    form(&all)
}

/// Create a post through the admin editor and return its id.
async fn create_post(
    client: &TestClient,
    cookie: &str,
    title: &str,
    body: &str,
    status: &str,
) -> i64 {
    let resp = client
        .post("/admin/content/post")
        .header("cookie", cookie)
        .form(&form(&[
            ("title", title),
            ("slug", ""),
            ("excerpt", ""),
            ("body", body),
            ("status", status),
            ("password", ""),
            ("taxonomy_names[post_tag]", ""),
            // Browsers omit an unchecked checkbox entirely, so the handler
            // reads an absent `comment_status` as "closed". The real editor
            // renders this box checked; the fixture has to say so too.
            ("comment_status", "open"),
        ]))
        .send()
        .await;
    assert_eq!(resp.status, 303, "create should redirect: {}", resp.text());
    resp.header("location")
        .expect("redirect to the editor")
        .rsplit('/')
        .next()
        .expect("id is the last path segment")
        .parse()
        .expect("id is numeric")
}

/// A blank/whitespace-only title on a status that requires one (`publish`,
/// `private`, `future`) used to reach `AutumnError::unprocessable_msg` three
/// layers into the create transaction — the state machine's `can_publish`
/// guard for private/future, `normalize_post`'s direct-create check for
/// publish — producing the generic `application/problem+json`/error-page
/// response and discarding whatever body, excerpt and taxonomy picks the
/// author had already entered. It is now caught pre-flight and redisplays the
/// editor at 422 with the draft intact and a message next to Title.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn create_with_a_blank_title_redisplays_the_editor_with_the_draft_intact() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    for status in ["publish", "private", "future"] {
        let mut fields = vec![
            ("title", "   "),
            ("slug", ""),
            ("excerpt", ""),
            ("body", "A body nobody should lose."),
            ("status", status),
            ("password", ""),
            ("taxonomy_names[post_tag]", ""),
            ("comment_status", "open"),
        ];
        if status == "future" {
            fields.push(("publish_at", "2999-01-01T00:00"));
        }
        let resp = client
            .post("/admin/content/post")
            .header("cookie", &cookie)
            .form(&form(&fields))
            .send()
            .await;
        resp.assert_status(422);
        assert!(
            resp.header("location").is_none(),
            "a rejected {status} submission must not redirect"
        );
        resp.assert_body_contains("A body nobody should lose.")
            .assert_body_contains("must have a title");
    }
}

/// The same redisplay, exercised on `update` against an existing post — the
/// state machine's `can_publish` guard is what `update` hits (see
/// [`create_with_a_blank_title_redisplays_the_editor_with_the_draft_intact`]),
/// and the post must still be a draft afterwards: a rejected transition must
/// not have partially applied.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn update_with_a_blank_title_redisplays_the_editor_and_leaves_the_post_a_draft() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let id = create_post(
        &client,
        &cookie,
        "Original Title",
        "Original body.",
        "draft",
    )
    .await;

    let resp = client
        .post(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .form(
            &edit_form(
                &id,
                &[
                    ("title", "   "),
                    ("slug", ""),
                    ("excerpt", ""),
                    ("body", "An edit nobody should lose."),
                    ("status", "publish"),
                    ("password", ""),
                    ("taxonomy_names[post_tag]", ""),
                    ("comment_status", "open"),
                ],
            )
            .await,
        )
        .send()
        .await;
    resp.assert_status(422);
    resp.assert_body_contains("An edit nobody should lose.")
        .assert_body_contains("must have a title");

    // Not published — the rejected transition never reached the write path.
    sign_out(&client);
    let front = client.get("/original-title").send().await;
    assert_eq!(
        front.status, 404,
        "the post must still be an unreachable draft"
    );
}

/// The redisplay must not silently repair a stale edit.
///
/// `EditorContext`/`editor` are shared between the GET routes (which always
/// want the row's *current* `lock_version`) and the validation-error 422
/// branch (which must echo back exactly what was submitted, stale or not) —
/// see `EditorValues::lock_version`. Getting this backwards would make a
/// rejected-then-corrected submission pass optimistic locking against an
/// edit it never actually saw, silently overwriting it.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_rejected_submission_does_not_launder_a_stale_lock_version() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let id = create_post(&client, &cookie, "Concurrent Post", "v1", "draft").await;
    let stale_version = lock_version_of(id).await;

    // A concurrent edit lands and succeeds, bumping `lock_version`.
    let bump = client
        .post(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .form(
            &edit_form(
                &id,
                &[
                    ("title", "Concurrent Post"),
                    ("slug", ""),
                    ("excerpt", ""),
                    ("body", "v2, from someone else"),
                    ("status", "draft"),
                    ("password", ""),
                    ("taxonomy_names[post_tag]", ""),
                    ("comment_status", "open"),
                ],
            )
            .await,
        )
        .send()
        .await;
    assert_eq!(bump.status, 303, "the concurrent edit should succeed");
    assert_ne!(
        lock_version_of(id).await,
        stale_version,
        "the concurrent edit must have advanced the lock version"
    );

    // The original editor, unaware of the concurrent edit, submits the stale
    // `lock_version` it loaded with — but also a blank title while trying to
    // publish, which the pre-flight check rejects. The redisplay must carry
    // the *stale* version back, not the row's now-current one.
    let stale_form = form(&[
        ("title", "   "),
        ("slug", ""),
        ("excerpt", ""),
        ("body", "v1, edited but never saved"),
        ("status", "publish"),
        ("password", ""),
        ("taxonomy_names[post_tag]", ""),
        ("comment_status", "open"),
        ("lock_version", &stale_version.to_string()),
    ]);
    let rejected = client
        .post(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .form(&stale_form)
        .send()
        .await;
    rejected
        .assert_status(422)
        .assert_body_contains(&format!(r#"value="{stale_version}""#));

    // Correcting just the title and resubmitting the same (still-stale) form
    // must now be caught by optimistic locking — not silently accepted.
    let resubmitted = client
        .post(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .form(&stale_form.replacen("title=+++", "title=Fixed", 1))
        .send()
        .await;
    resubmitted.assert_status(409);
}

/// A scheduled post's date needs to be both present and in the future — see
/// `require_future_publish_date`. Both failures used to reach the same
/// generic error page via `?`; both now redisplay the editor.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn scheduling_with_a_past_or_missing_date_redisplays_the_editor() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    // A past date.
    let past = client
        .post("/admin/content/post")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "Backdated"),
            ("slug", ""),
            ("excerpt", ""),
            ("body", "Scheduled body."),
            ("status", "future"),
            ("publish_at", "2000-01-01T00:00"),
            ("password", ""),
            ("taxonomy_names[post_tag]", ""),
            ("comment_status", "open"),
        ]))
        .send()
        .await;
    past.assert_status(422)
        .assert_body_contains("Scheduled body.")
        .assert_body_contains("publish date in the future");

    // No date at all.
    let missing = client
        .post("/admin/content/post")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "Undated"),
            ("slug", ""),
            ("excerpt", ""),
            ("body", "Scheduled body."),
            ("status", "future"),
            ("password", ""),
            ("taxonomy_names[post_tag]", ""),
            ("comment_status", "open"),
        ]))
        .send()
        .await;
    missing
        .assert_status(422)
        .assert_body_contains("Scheduled body.")
        .assert_body_contains("Pick a publish date");
}

#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn the_first_registered_account_owns_the_site() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    // An administrator lands on the dashboard and sees every capability.
    client
        .get("/admin")
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Administrator")
        .assert_body_contains("manage_options");

    // The second account is a Subscriber, and a Subscriber has no admin.
    let subscriber = register(&client, "reader").await;
    let resp = client
        .get("/admin")
        .header("cookie", &subscriber)
        .send()
        .await;
    assert_eq!(
        resp.status, 403,
        "a signed-in account without the capability gets a 403, not a redirect"
    );
}

#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_published_post_appears_on_the_front_page_and_a_draft_does_not() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    create_post(
        &client,
        &cookie,
        "Published Post",
        "Visible body.",
        "publish",
    )
    .await;
    create_post(&client, &cookie, "Draft Post", "Hidden body.", "draft").await;

    sign_out(&client);
    let home = client.get("/").send().await;
    home.assert_ok().assert_body_contains("Published Post");
    assert!(
        !home.text().contains("Draft Post"),
        "an unpublished post must not appear on the front page"
    );

    // The published post resolves at its permalink…
    client
        .get("/published-post")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Visible body.");

    // …and the draft is a 404 for an anonymous visitor, not a 403: a 403 would
    // confirm that unpublished content exists at that URL.
    sign_out(&client);
    let draft = client.get("/draft-post").send().await;
    assert_eq!(draft.status, 404);
    assert!(!draft.text().contains("Hidden body."));

    // Its author, though, can preview it.
    client
        .get("/draft-post")
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Hidden body.");
}

/// A post created *directly* as published carries a publish date.
///
/// It did not, at first: `published_at` was stamped only in `before_update`, so
/// content that never passed through a draft→publish transition had no date —
/// no byline on the page, nothing to order the index by, and no `<lastmod>` in
/// the sitemap. Every Docker test in this file passed while that was broken,
/// because none of them looked at the rendered date; it took booting the app.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_directly_published_post_has_a_publish_date() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    create_post(&client, &cookie, "Dated", "Body.", "publish").await;

    sign_out(&client);
    let page = client.get("/dated").send().await.assert_ok().text();
    assert!(
        page.contains("<time datetime="),
        "a published post must render its date; page:\n{page}"
    );

    // The API is the machine-readable half of the same fact.
    let posts: serde_json::Value = client.get("/api/v1/posts").send().await.assert_ok().json();
    let first = &posts.as_array().expect("array")[0];
    assert!(
        !first["published_at"].is_null(),
        "published_at must be set on a directly-published post: {first}"
    );

    // …and the sitemap carries a `<lastmod>` derived from it.
    let sitemap = client.get("/sitemap.xml").send().await.assert_ok().text();
    assert!(sitemap.contains("<loc>"), "sitemap has no URLs:\n{sitemap}");
    assert!(
        sitemap.contains("/dated"),
        "sitemap omits the published post:\n{sitemap}"
    );
    assert!(
        sitemap.contains("<lastmod>"),
        "sitemap entry has no lastmod:\n{sitemap}"
    );
}

/// `robots.txt` refuses crawlers outside a production profile.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn robots_disallows_everything_outside_production() {
    let client = db_client().await;
    let body = client.get("/robots.txt").send().await.assert_ok().text();
    assert!(
        body.contains("Disallow: /"),
        "a non-production profile must not invite indexing; body: {body}"
    );
}

#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn the_status_state_machine_refuses_an_undeclared_edge() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let id = create_post(&client, &cookie, "Lifecycle", "Body.", "draft").await;

    // draft -> publish is declared.
    let ok = client
        .post(&format!("/admin/content/post/{id}/status?to=publish"))
        .header("cookie", &cookie)
        .send()
        .await;
    assert_eq!(ok.status, 303);

    // publish -> future is NOT: scheduling a post that is already live is not a
    // move the graph has, and the transition must be refused rather than
    // silently applied.
    let refused = client
        .post(&format!("/admin/content/post/{id}/status?to=future"))
        .header("cookie", &cookie)
        .send()
        .await;
    assert!(
        refused.status.is_client_error() || refused.status.is_server_error(),
        "publish -> future is not a declared edge; got {}",
        refused.status
    );

    // The post is still published.
    client
        .get("/lifecycle")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Lifecycle");
}

#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_guest_comment_is_held_for_moderation_until_approved() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let post_id = create_post(&client, &cookie, "Discuss", "Body.", "publish").await;

    // A signed-out visitor comments. Moderation is on by default, so it is held.
    sign_out(&client);
    let posted = client
        .post(&format!("/comments/{post_id}"))
        .form(&form(&[
            ("body", "First!"),
            ("author_name", "Guest"),
            ("author_email", "guest@example.com"),
        ]))
        .send()
        .await;
    assert_eq!(posted.status, 303);

    // It is not on the page yet…
    sign_out(&client);
    let page = client.get("/discuss").send().await;
    page.assert_ok();
    assert!(
        !page.text().contains("First!"),
        "an unapproved comment must not be published"
    );

    // …and the API does not serve it either. A moderation queue that the API
    // walks straight past is not a moderation queue.
    let api: serde_json::Value = client
        .get(&format!("/api/v1/posts/{post_id}/comments"))
        .send()
        .await
        .assert_ok()
        .json();
    assert_eq!(api.as_array().map(Vec::len), Some(0));

    // Approve it from the queue.
    let queue = client
        .get("/admin/comments?status=pending")
        .header("cookie", &cookie)
        .send()
        .await;
    queue.assert_ok().assert_body_contains("First!");

    let approved = client
        .post("/admin/comments/1/status?to=approved")
        .header("cookie", &cookie)
        .send()
        .await;
    assert_eq!(approved.status, 303);

    // Now it renders, and the post's approved-comment counter moved with it.
    client
        .get("/discuss")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("First!")
        .assert_body_contains("1 comment");
}

#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn approving_and_unapproving_keeps_the_comment_counter_exact() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let post_id = create_post(&client, &cookie, "Counted", "Body.", "publish").await;

    sign_out(&client);
    for n in 0..3 {
        let body = format!("Comment {n}");
        client
            .post(&format!("/comments/{post_id}"))
            .form(&form(&[
                ("body", &body),
                ("author_name", "Guest"),
                ("author_email", "guest@example.com"),
            ]))
            .send()
            .await;
    }
    for id in 1..=3 {
        client
            .post(&format!("/admin/comments/{id}/status?to=approved"))
            .header("cookie", &cookie)
            .send()
            .await;
    }
    client
        .get("/counted")
        .send()
        .await
        .assert_body_contains("3 comments");

    // Unapproving decrements; a repeated unapprove is a no-op rather than a
    // second decrement — the counter is derived from the before/after pair, not
    // from the action name.
    for _ in 0..2 {
        client
            .post("/admin/comments/1/status?to=spam")
            .header("cookie", &cookie)
            .send()
            .await;
    }
    client
        .get("/counted")
        .send()
        .await
        .assert_body_contains("2 comments");
}

#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_contributor_cannot_publish_their_own_draft() {
    let client = db_client().await;
    let owner = register(&client, "owner").await;

    // The owner creates a contributor.
    client
        .post("/admin/users")
        .header("cookie", &owner)
        .form(&form(&[
            ("username", "carla"),
            ("email", "carla@example.com"),
            ("password", "correct-horse-battery-staple"),
            ("role", "contributor"),
            ("display_name", "Carla"),
        ]))
        .send()
        .await
        .assert_status(303);

    let login = client
        .post("/login")
        .form(&form(&[
            ("username", "carla"),
            ("password", "correct-horse-battery-staple"),
        ]))
        .send()
        .await;
    assert_eq!(login.status, 303);
    let carla = session_cookie(&login);

    // A contributor submitting `status=publish` gets a draft: the editor hides
    // the option, and the server clamps it regardless of what was posted.
    let id = create_post(&client, &carla, "Contributor Draft", "Body.", "publish").await;
    sign_out(&client);
    let draft = client.get("/contributor-draft").send().await;
    assert_eq!(
        draft.status, 404,
        "a contributor's post must not be published by posting `status=publish`"
    );

    // The explicit transition route refuses too.
    let refused = client
        .post(&format!("/admin/content/post/{id}/status?to=publish"))
        .header("cookie", &carla)
        .send()
        .await;
    assert_eq!(refused.status, 403);
}

#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_password_protected_post_withholds_its_body_until_unlocked() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let resp = client
        .post("/admin/content/post")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "Secret"),
            ("slug", ""),
            ("excerpt", ""),
            ("body", "The hidden text."),
            ("status", "publish"),
            ("password", "letmein"),
            ("taxonomy_names[post_tag]", ""),
        ]))
        .send()
        .await;
    assert_eq!(resp.status, 303);

    sign_out(&client);
    let locked = client.get("/secret").send().await;
    locked
        .assert_ok()
        .assert_body_contains("password protected");
    assert!(
        !locked.text().contains("The hidden text."),
        "a protected post must not render its body"
    );

    // The REST API withholds it too — otherwise the password is decorative.
    let api: serde_json::Value = client.get("/api/v1/posts").send().await.assert_ok().json();
    let first = &api.as_array().expect("array")[0];
    assert_eq!(first["password_protected"], serde_json::json!(true));
    assert!(
        first.get("body").is_none(),
        "the API must omit a protected post's body: {first}"
    );
}

/// Password protection has to hold on every surface, not just the page body.
///
/// The derived excerpt was the leak: with a blank excerpt, `display_excerpt()`
/// took the first 55 words straight from the body — and the blog index, the
/// REST API and the syndication feeds all call it. The comment thread was the
/// other one: the front end hides it until the session unlocks the post, but
/// the API served it to anyone.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_protected_post_withholds_its_excerpt_and_comments_everywhere() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let resp = client
        .post("/admin/content/post")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "Sealed"),
            ("slug", ""),
            // Deliberately blank, which is what makes the excerpt derived.
            ("excerpt", ""),
            (
                "body",
                "THE-SECRET-SENTENCE should never appear in a listing.",
            ),
            ("status", "publish"),
            ("password", "letmein"),
            ("taxonomy_names[post_tag]", ""),
            ("comment_status", "open"),
        ]))
        .send()
        .await;
    assert_eq!(resp.status, 303);
    let post_id: i64 = resp
        .header("location")
        .expect("redirect")
        .rsplit('/')
        .next()
        .expect("id")
        .parse()
        .expect("numeric id");

    // A comment exists and is approved, so only the protection can hide it.
    client
        .post(&format!("/comments/{post_id}"))
        .header("cookie", &cookie)
        .form(&form(&[("body", "VISIBLE-ONLY-WHEN-UNLOCKED")]))
        .send()
        .await;

    sign_out(&client);

    for (label, path) in [
        ("home", "/"),
        ("atom feed", "/feed"),
        ("rss feed", "/feed/rss"),
        ("api list", "/api/v1/posts"),
        ("single page", "/sealed"),
    ] {
        let body = client.get(path).send().await.text();
        assert!(
            !body.contains("THE-SECRET-SENTENCE"),
            "{label} leaked the protected body: {path}"
        );
        assert!(
            !body.contains("VISIBLE-ONLY-WHEN-UNLOCKED"),
            "{label} leaked a protected post's comments: {path}"
        );
    }

    // The comments endpoint refuses outright rather than returning an empty
    // list, so it does not confirm the thread exists either.
    assert_eq!(
        client
            .get(&format!("/api/v1/posts/{post_id}/comments"))
            .send()
            .await
            .status,
        404
    );
}

/// Commenting is gated by the same rules as reading.
///
/// The read side was covered; the *write* side was not, which is how a fix for
/// this was twice reported as landed while the tree was unchanged. A signed-in
/// caller's comment is approved immediately, so accepting one on locked content
/// puts visible discussion under a post whose thread the front end withholds.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_protected_post_refuses_comments_until_unlocked() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let resp = client
        .post("/admin/content/post")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "Sealed Thread"),
            ("slug", ""),
            ("excerpt", ""),
            ("body", "Body."),
            ("status", "publish"),
            ("password", "letmein"),
            ("taxonomy_names[post_tag]", ""),
            ("comment_status", "open"),
        ]))
        .send()
        .await;
    assert_eq!(resp.status, 303);
    let post_id: i64 = resp
        .header("location")
        .expect("redirect")
        .rsplit('/')
        .next()
        .expect("id")
        .parse()
        .expect("numeric id");

    // Signed in, but the session has not unlocked the post. This is the sharp
    // case: a signed-in comment is stored `approved`.
    let refused = client
        .post(&format!("/comments/{post_id}"))
        .header("cookie", &cookie)
        .form(&form(&[("body", "SHOULD-NOT-BE-STORED")]))
        .send()
        .await;
    assert_eq!(
        refused.status, 403,
        "a comment on a locked post must be refused, not stored approved"
    );

    // Unlock, then the same submission is accepted.
    client
        .post(&format!("/unlock/{post_id}"))
        .header("cookie", &cookie)
        .form(&form(&[("password", "letmein")]))
        .send()
        .await
        .assert_status(303);
    client
        .post(&format!("/comments/{post_id}"))
        .header("cookie", &cookie)
        .form(&form(&[("body", "ALLOWED-AFTER-UNLOCK")]))
        .send()
        .await
        .assert_status(303);

    // Nothing from the refused attempt reached the database.
    let comments: serde_json::Value = client
        .get(&format!("/api/v1/posts/{post_id}/comments"))
        .send()
        .await
        .json();
    let rendered = comments.to_string();
    assert!(
        !rendered.contains("SHOULD-NOT-BE-STORED"),
        "the refused comment must not have been persisted: {rendered}"
    );
}

/// A post and a page may both be slugged `about`; both mint `/about`, and only
/// one can be served there. The loser is suffixed rather than left unreachable.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_post_and_a_page_cannot_take_the_same_bare_path() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    create_post(&client, &cookie, "About", "Post body.", "publish").await;
    client
        .post("/admin/content/page")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "About"),
            ("slug", ""),
            ("excerpt", ""),
            ("body", "Page body."),
            ("status", "publish"),
            ("password", ""),
            ("taxonomy_names[post_tag]", ""),
        ]))
        .send()
        .await
        .assert_status(303);

    sign_out(&client);

    // The post keeps `/about`; the page is reachable at its de-duplicated slug.
    client
        .get("/about")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Post body.");
    client
        .get("/about-2")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Page body.");
}

/// Two editors on one post: the second save is refused rather than silently
/// overwriting the first.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_stale_editor_submission_is_refused() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let id = create_post(&client, &cookie, "Contested", "Original.", "publish").await;

    // Both editors loaded the form at version 0.
    let stale_version = "0";

    let first = client
        .post(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "Contested"),
            ("slug", "contested"),
            ("excerpt", ""),
            ("body", "First editor's text."),
            ("status", "publish"),
            ("password", ""),
            ("taxonomy_names[post_tag]", ""),
            ("comment_status", "open"),
            ("lock_version", stale_version),
        ]))
        .send()
        .await;
    assert_eq!(first.status, 303, "the first save should succeed");

    let second = client
        .post(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "Contested"),
            ("slug", "contested"),
            ("excerpt", ""),
            ("body", "Second editor's text."),
            ("status", "publish"),
            ("password", ""),
            ("taxonomy_names[post_tag]", ""),
            ("comment_status", "open"),
            ("lock_version", stale_version),
        ]))
        .send()
        .await;
    assert_eq!(
        second.status, 409,
        "a save built on a stale version must be refused, not applied"
    );

    // The first editor's text survived.
    sign_out(&client);
    client
        .get("/contested")
        .send()
        .await
        .assert_body_contains("First editor's text.");
}

/// A backup restore must not publish content that was protected, nor flatten a
/// page tree.
/// Restoring a page whose slug an existing post already holds must not abort
/// the run part-way.
///
/// `idx_posts_bare_path_slug` made bare-path uniqueness the database's
/// invariant, which meant every insert path had to allocate through the shared
/// allocator — the importer did not, so this aborted after earlier rows had
/// already committed.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn importing_a_slug_an_existing_post_holds_does_not_abort_the_run() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    // A hand-built export containing a page slugged `about`, plus another post
    // after it — so a mid-run abort would be visible as the second going missing.
    let payload = serde_json::json!({
        "version": 2,
        "site_title": "Imported",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {
                "post_type": "page", "title": "About", "slug": "about",
                "excerpt": "", "body": "Imported page.", "status": "publish",
                "comment_status": "closed", "password": "", "author": "owner",
                "published_at": null, "parent": null, "terms": []
            },
            {
                "post_type": "post", "title": "Second", "slug": "second",
                "excerpt": "", "body": "Imported post.", "status": "publish",
                "comment_status": "open", "password": "", "author": "owner",
                "published_at": null, "parent": null, "terms": []
            }
        ]
    })
    .to_string();

    // An existing post already holds `about`.
    create_post(&client, &cookie, "About", "Existing post.", "publish").await;

    let result = import_export(&client, &cookie, payload.as_str()).await;
    result.assert_ok().assert_body_contains("2 imported");

    sign_out(&client);
    // Everything is reachable: the original post, the re-slugged page, and the
    // row that came after the collision.
    client
        .get("/about")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Existing post.");
    client
        .get("/about-2")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Imported page.");
    client
        .get("/second")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Imported post.");
}

#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn export_preserves_password_protection_and_page_ancestry() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let parent = client
        .post("/admin/content/page")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "Handbook"),
            ("slug", ""),
            ("excerpt", ""),
            ("body", "Parent."),
            ("status", "publish"),
            ("password", ""),
            ("taxonomy_names[post_tag]", ""),
        ]))
        .send()
        .await;
    let parent_id = parent
        .header("location")
        .expect("redirect")
        .rsplit('/')
        .next()
        .expect("id")
        .to_owned();

    client
        .post("/admin/content/page")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "Chapter"),
            ("slug", ""),
            ("excerpt", ""),
            ("body", "Child."),
            ("status", "publish"),
            ("password", "shh"),
            ("taxonomy_names[post_tag]", ""),
            ("parent_id", parent_id.as_str()),
        ]))
        .send()
        .await
        .assert_status(303);

    let payload = client
        .get("/admin/tools/export")
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .text();

    let parsed: serde_json::Value = serde_json::from_str(&payload).expect("export is valid JSON");
    let chapter = parsed["posts"]
        .as_array()
        .expect("posts array")
        .iter()
        .find(|p| p["slug"] == serde_json::json!("chapter"))
        .expect("the child page is exported");
    assert_eq!(
        chapter["password"],
        serde_json::json!("shh"),
        "the export must carry the password, or a restore publishes protected content"
    );
    assert_eq!(
        chapter["parent"],
        serde_json::json!("handbook"),
        "the export must carry ancestry, or a restore flattens the page tree"
    );

    // Hierarchical taxonomies are supported, so a restore that flattened the
    // category tree would quietly change every archive's shape.
    client
        .post("/admin/terms/category")
        .header("cookie", &cookie)
        .form(&form(&[
            ("name", "Guides"),
            ("slug", ""),
            ("description", ""),
        ]))
        .send()
        .await
        .assert_status(303);
    let parent_term: serde_json::Value = client
        .get("/api/v1/terms?taxonomy=category")
        .send()
        .await
        .assert_ok()
        .json();
    let parent_term_id = parent_term.as_array().expect("array")[0]["id"]
        .as_i64()
        .expect("term id")
        .to_string();
    client
        .post("/admin/terms/category")
        .header("cookie", &cookie)
        .form(&form(&[
            ("name", "Deep Dives"),
            ("slug", ""),
            ("description", ""),
            ("parent_id", parent_term_id.as_str()),
        ]))
        .send()
        .await
        .assert_status(303);

    let payload = client
        .get("/admin/tools/export")
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .text();
    let parsed: serde_json::Value = serde_json::from_str(&payload).expect("export is valid JSON");
    let child_term = parsed["terms"]
        .as_array()
        .expect("terms array")
        .iter()
        .find(|t| t["slug"] == serde_json::json!("deep-dives"))
        .expect("the child term is exported");
    assert_eq!(
        child_term["parent"],
        serde_json::json!("guides"),
        "the export must carry taxonomy ancestry too"
    );
}

#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn changing_the_permalink_structure_does_not_break_existing_urls() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    create_post(&client, &cookie, "Durable", "Body.", "publish").await;

    // The default structure.
    client.get("/durable").send().await.assert_ok();

    // Switch to the dated structure.
    client
        .post("/admin/settings")
        .header("cookie", &cookie)
        .form(&settings_form(&[
            ("site_title", "Autumn CMS"),
            ("permalink_structure", "day_and_name"),
            ("front_page_id", ""),
        ]))
        .send()
        .await
        .assert_status(303);

    // The new URL works…
    let year = chrono::Utc::now().format("%Y/%m/%d").to_string();
    client
        .get(&format!("/{year}/durable"))
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Durable");

    // …and so does the old one. This is the property that makes the setting
    // safe to change on a site with links already in the wild.
    client
        .get("/durable")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Durable");
}

#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn editing_a_post_records_a_restorable_revision() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let id = create_post(&client, &cookie, "Versioned", "First draft.", "publish").await;

    client
        .post(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .form(
            &edit_form(
                &id,
                &[
                    ("title", "Versioned"),
                    ("slug", "versioned"),
                    ("excerpt", ""),
                    ("body", "Second draft."),
                    ("status", "publish"),
                    ("password", ""),
                    ("taxonomy_names[post_tag]", ""),
                ],
            )
            .await,
        )
        .send()
        .await
        .assert_status(303);

    client
        .get("/versioned")
        .send()
        .await
        .assert_body_contains("Second draft.");

    // The history holds the pre-edit snapshot.
    let history = client
        .get(&format!("/admin/content/post/{id}/revisions"))
        .header("cookie", &cookie)
        .send()
        .await;
    history.assert_ok().assert_body_contains("First draft.");

    // Restoring the first revision brings the old text back. Revision 1 is the
    // "Created" snapshot the create path records.
    client
        .post(&format!("/admin/content/post/{id}/revisions/1/restore"))
        .header("cookie", &cookie)
        .send()
        .await
        .assert_status(303);

    client
        .get("/versioned")
        .send()
        .await
        .assert_body_contains("First draft.");
}

#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn tags_typed_into_the_editor_are_created_and_archived() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    client
        .post("/admin/content/post")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "Tagged"),
            ("slug", ""),
            ("excerpt", ""),
            ("body", "Body."),
            ("status", "publish"),
            ("password", ""),
            ("taxonomy_names[post_tag]", "Rust, Web Frameworks"),
        ]))
        .send()
        .await
        .assert_status(303);

    // The tag archive lists it, at the taxonomy's *rewrite base* (`/tag`), not
    // its slug (`post_tag`).
    client
        .get("/tag/rust")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Tagged");
    client
        .get("/tag/web-frameworks")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Tagged");

    // The API agrees, and the term's published-post count was maintained.
    let terms: serde_json::Value = client
        .get("/api/v1/terms?taxonomy=post_tag")
        .send()
        .await
        .assert_ok()
        .json();
    let rust = terms
        .as_array()
        .expect("array")
        .iter()
        .find(|t| t["slug"] == serde_json::json!("rust"))
        .expect("the rust tag exists");
    assert_eq!(rust["post_count"], serde_json::json!(1));
}

/// Search paginates the *visible* set, not the whole match set.
///
/// Filtering after `search_page` returned meant drafts could occupy the first
/// page — leaving it blank while public results sat on page two — and the total
/// disclosed how many hidden matches existed.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn search_counts_and_paginates_only_visible_matches() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    // Three drafts and one published post, all matching the same term.
    for n in 0..3 {
        create_post(
            &client,
            &cookie,
            &format!("Hidden {n}"),
            "kumquat marmalade recipe",
            "draft",
        )
        .await;
    }
    create_post(
        &client,
        &cookie,
        "Visible",
        "kumquat marmalade recipe",
        "publish",
    )
    .await;

    sign_out(&client);
    let body = client
        .get("/search?s=kumquat")
        .send()
        .await
        .assert_ok()
        .text();

    assert!(body.contains("Visible"), "the published match must appear");
    assert!(
        !body.contains("Hidden"),
        "a draft must not appear in public search results"
    );
    assert!(
        body.contains("1 result"),
        "the total must count only visible matches, not disclose hidden ones; body: {}",
        &body[..body.len().min(2000)]
    );
}

/// Once an editor publishes a Contributor's draft, the Contributor can no
/// longer edit it — nor trash it, which is the more destructive of the two.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_contributor_cannot_trash_their_published_post() {
    let client = db_client().await;
    let owner = register(&client, "owner").await;

    client
        .post("/admin/users")
        .header("cookie", &owner)
        .form(&form(&[
            ("username", "carla"),
            ("email", "carla@example.com"),
            ("password", "correct-horse-battery-staple"),
            ("role", "contributor"),
            ("display_name", "Carla"),
        ]))
        .send()
        .await
        .assert_status(303);

    sign_out(&client);
    let login = client
        .post("/login")
        .form(&form(&[
            ("username", "carla"),
            ("password", "correct-horse-battery-staple"),
        ]))
        .send()
        .await;
    let carla = session_cookie(&login);
    sign_out(&client);
    let id = create_post(&client, &carla, "Carla Draft", "Body.", "draft").await;

    // The owner publishes it.
    sign_out(&client);
    client
        .post(&format!("/admin/content/post/{id}/status?to=publish"))
        .header("cookie", &owner)
        .send()
        .await
        .assert_status(303);

    // Confirm it really published — a 303 alone would also be the guard's
    // redirect to /login, which is how the first draft of this test passed
    // while the transition silently never happened.
    sign_out(&client);
    let published: serde_json::Value = client.get("/api/v1/posts").send().await.json();
    assert_eq!(
        published.as_array().map(Vec::len),
        Some(1),
        "the owner's publish must have taken effect: {published}"
    );

    // Carla can no longer trash it.
    sign_out(&client);
    let refused = client
        .post(&format!("/admin/content/post/{id}/status?to=trash"))
        .header("cookie", &carla)
        .send()
        .await;
    assert_eq!(
        refused.status, 403,
        "a contributor must not be able to trash content they can no longer edit"
    );

    sign_out(&client);
    client.get("/carla-draft").send().await.assert_ok();
}

/// A slug shaped like a year would otherwise be swallowed by the date archive.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_year_shaped_slug_stays_reachable() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let resp = client
        .post("/admin/content/post")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "2026"),
            ("slug", ""),
            ("excerpt", ""),
            ("body", "A year in review."),
            ("status", "publish"),
            ("password", ""),
            ("taxonomy_names[post_tag]", ""),
            ("comment_status", "open"),
        ]))
        .send()
        .await;
    assert_eq!(resp.status, 303);

    sign_out(&client);
    // `/2026` is still the date archive. It legitimately *lists* the post
    // (published in 2026), so assert on the archive's own heading rather than
    // on the absence of the post — the listing showing it is correct.
    let archive = client.get("/2026").send().await;
    archive.assert_ok().assert_body_contains("Archive: 2026");

    // The post itself is reachable at the slug it was given, which is what the
    // reservation is for: without it the slug would be `2026`, whose canonical
    // URL the archive owns, leaving the post unreachable.
    let single = client.get("/2026-2").send().await;
    single.assert_ok().assert_body_contains("A year in review.");
    assert!(
        !single.text().contains("Archive: 2026"),
        "/2026-2 must be the post, not the archive"
    );
}

#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn full_text_search_finds_a_post_by_its_body() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    create_post(
        &client,
        &cookie,
        "Nothing Obvious",
        "The quick brown fox jumps over the lazy dog.",
        "publish",
    )
    .await;
    create_post(
        &client,
        &cookie,
        "Unrelated",
        "Something else entirely.",
        "publish",
    )
    .await;

    let results = client.get("/search?s=brown+fox").send().await;
    results.assert_ok().assert_body_contains("Nothing Obvious");
    assert!(
        !results.text().contains("Unrelated"),
        "search must not match every post"
    );
}

#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn export_and_import_round_trip_the_site_content() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    create_post(&client, &cookie, "Exported", "Body text.", "publish").await;

    let export = client
        .get("/admin/tools/export")
        .header("cookie", &cookie)
        .send()
        .await;
    export.assert_ok();
    let payload = export.text();
    assert!(payload.contains("Exported"), "export payload: {payload}");

    // Re-importing into the same site is a no-op: content is matched on
    // (post_type, slug), so a re-run duplicates nothing.
    let reimport = import_export(&client, &cookie, payload.as_str()).await;
    reimport.assert_ok().assert_body_contains("already present");

    let posts: serde_json::Value = client.get("/api/v1/posts").send().await.assert_ok().json();
    assert_eq!(
        posts.as_array().map(Vec::len),
        Some(1),
        "re-importing must not duplicate content"
    );
}

#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn the_api_never_serves_a_password_hash() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    create_post(&client, &cookie, "Bylined", "Body.", "publish").await;

    let authors = client.get("/api/v1/authors").send().await;
    let body = authors.assert_ok().text();
    assert!(
        !body.contains("password_hash") && !body.contains("$2b$"),
        "the authors endpoint leaked credential material: {body}"
    );
}

#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_page_is_addressed_by_its_ancestry() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let parent = client
        .post("/admin/content/page")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "About"),
            ("slug", ""),
            ("excerpt", ""),
            ("body", "Parent page."),
            ("status", "publish"),
            ("password", ""),
            ("taxonomy_names[post_tag]", ""),
        ]))
        .send()
        .await;
    let parent_id = parent
        .header("location")
        .expect("redirect")
        .rsplit('/')
        .next()
        .expect("id")
        .to_owned();

    client
        .post("/admin/content/page")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "Team"),
            ("slug", ""),
            ("excerpt", ""),
            ("body", "Child page."),
            ("status", "publish"),
            ("password", ""),
            ("taxonomy_names[post_tag]", ""),
            ("parent_id", parent_id.as_str()),
        ]))
        .send()
        .await
        .assert_status(303);

    client
        .get("/about/team")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Child page.");

    // The bare child slug does NOT resolve: a page is addressed by its path, so
    // two pages named "team" under different parents stay distinct.
    sign_out(&client);
    assert_eq!(client.get("/team").send().await.status, 404);
}

/// The unlock endpoint must not answer for content the caller cannot reach.
///
/// It takes a bare post id from an unauthenticated request and its response
/// carries the row's canonical permalink. Without the reachability gate,
/// iterating ids confirmed the existence of drafts, private and trashed rows
/// and disclosed their slugs and page ancestry — with a wrong password, and
/// with no session at all.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn unlocking_a_hidden_post_discloses_nothing() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let draft = client
        .post("/admin/content/post")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "Unannounced Acquisition"),
            ("slug", ""),
            ("excerpt", ""),
            ("body", "Not for publication."),
            ("status", "draft"),
            ("password", ""),
            ("taxonomy_names[post_tag]", ""),
        ]))
        .send()
        .await;
    assert_eq!(draft.status, 303);
    let draft_id = draft
        .header("location")
        .expect("redirect")
        .rsplit('/')
        .next()
        .expect("id")
        .to_owned();

    sign_out(&client);
    let probe = client
        .post(&format!("/unlock/{draft_id}"))
        .form(&form(&[("password", "guess")]))
        .send()
        .await;
    assert_eq!(
        probe.status, 404,
        "an anonymous unlock of a draft must 404, not redirect"
    );
    assert!(
        probe.header("location").is_none(),
        "no Location header may carry a hidden post's permalink"
    );
    assert!(
        !probe.text().contains("unannounced-acquisition"),
        "the draft's slug must not appear in the response: {}",
        probe.text()
    );
}

/// API creation allocates a slug the same way the editor does.
///
/// It saved through the repository directly, so a second item with the same
/// title reached `idx_posts_bare_path_slug` and came back as a constraint
/// error, where the admin editor and the importer both get the usual suffix.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn api_creation_suffixes_a_duplicate_slug_instead_of_failing() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let body = serde_json::json!({
        "title": "Release Notes",
        "body": "First.",
        "status": "publish",
    });
    let first: serde_json::Value = client
        .post("/api/v1/posts")
        .header("cookie", &cookie)
        .json(&body)
        .send()
        .await
        .assert_status(201)
        .json();
    assert_eq!(first["slug"], serde_json::json!("release-notes"));

    let second: serde_json::Value = client
        .post("/api/v1/posts")
        .header("cookie", &cookie)
        .json(&body)
        .send()
        .await
        .assert_status(201)
        .json();
    assert_eq!(
        second["slug"],
        serde_json::json!("release-notes-2"),
        "the second creation must take a suffix, not a 500: {second}"
    );
}

/// Public read endpoints are bounded by the request, not by the corpus.
///
/// `/api/v1/terms` returned every row of a taxonomy and the comment endpoint
/// returned a post's whole thread, both unauthenticated and both with a cost
/// that grew without limit as the site did.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn the_public_api_paginates_terms_and_comments() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    for name in ["Alpha", "Bravo", "Charlie", "Delta", "Echo"] {
        client
            .post("/admin/terms/category")
            .header("cookie", &cookie)
            .form(&form(&[
                ("name", name),
                ("slug", ""),
                ("description", ""),
                ("parent_id", ""),
            ]))
            .send()
            .await
            .assert_status(303);
    }

    sign_out(&client);
    let page_one: serde_json::Value = client
        .get("/api/v1/terms?per_page=2")
        .send()
        .await
        .assert_ok()
        .json();
    let page_one = page_one.as_array().expect("array");
    assert_eq!(page_one.len(), 2, "per_page must be applied in SQL");

    let page_two: serde_json::Value = client
        .get("/api/v1/terms?per_page=2&page=2")
        .send()
        .await
        .assert_ok()
        .json();
    let page_two = page_two.as_array().expect("array");
    assert_eq!(page_two.len(), 2);
    assert_ne!(
        page_one[0]["id"], page_two[0]["id"],
        "the second page must not repeat the first"
    );

    // An absurd page size is clamped rather than honoured.
    let clamped: serde_json::Value = client
        .get("/api/v1/terms?per_page=100000")
        .send()
        .await
        .assert_ok()
        .json();
    assert!(clamped.as_array().expect("array").len() <= 100);
}

/// `supports_comments: false` on a registered type is a refusal, not a hint.
///
/// The gate asked the row's `comment_status` and the type's `public` flag but
/// never the type's `supports_comments`. A `page` registers it false and the
/// editor offers no checkbox — but a direct request that sets the column, or an
/// import carrying it, produced a page that accepted comments. A signed-in
/// submission is approved immediately, so the thread then rendered on a type
/// that had explicitly disabled it.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_type_that_disables_comments_refuses_them_however_the_row_is_set() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let created = client
        .post("/admin/content/page")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "Contact"),
            ("slug", ""),
            ("excerpt", ""),
            ("body", "Reach us here."),
            ("status", "publish"),
            ("password", ""),
            ("taxonomy_names[post_tag]", ""),
            ("comment_status", "open"),
        ]))
        .send()
        .await;
    assert_eq!(created.status, 303);
    let page_id = created
        .header("location")
        .expect("redirect")
        .rsplit('/')
        .next()
        .expect("id")
        .to_owned();

    // Whatever the editor did with the checkbox, force the column open — this
    // is the import/crafted-request shape the gate has to survive.
    try_execute(
        TestDb::shared().await,
        &format!("UPDATE posts SET comment_status = 'open' WHERE id = {page_id}"),
    )
    .await
    .expect("force comment_status");

    // Signed in, so the submission would be approved on the spot if accepted.
    let refused = client
        .post(&format!("/comments/{page_id}"))
        .header("cookie", &cookie)
        .form(&form(&[("body", "COMMENT-ON-A-PAGE")]))
        .send()
        .await;
    assert_eq!(
        refused.status,
        403,
        "a page must refuse comments: {}",
        refused.text()
    );

    let page = client.get("/contact").send().await;
    page.assert_ok();
    assert!(
        !page.text().contains("COMMENT-ON-A-PAGE"),
        "nothing may have been stored"
    );
    assert!(
        !page.text().contains("Post comment"),
        "and the form must not be offered: {}",
        page.text()
    );
}

/// Deleting a comment takes its replies with it, and the counter has to know.
///
/// `comments.parent_id` cascades, so deleting an approved parent removes every
/// approved descendant — while the handler decremented by one. The post then
/// advertised comments that no longer existed, permanently.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn deleting_a_comment_recounts_the_replies_it_cascades_away() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let post_id = create_post(&client, &cookie, "Threaded", "Body.", "publish").await;

    // Signed in, so all three land approved immediately.
    client
        .post(&format!("/comments/{post_id}"))
        .header("cookie", &cookie)
        .form(&form(&[("body", "Parent comment")]))
        .send()
        .await
        .assert_status(303);
    client
        .post(&format!("/comments/{post_id}"))
        .header("cookie", &cookie)
        .form(&form(&[("body", "Reply one"), ("reply_to", "1")]))
        .send()
        .await
        .assert_status(303);
    client
        .post(&format!("/comments/{post_id}"))
        .header("cookie", &cookie)
        .form(&form(&[("body", "Unrelated comment")]))
        .send()
        .await
        .assert_status(303);

    client
        .get("/threaded")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("3 comments");

    // Delete the parent; the reply goes with it through the cascade.
    client
        .post("/admin/comments/1/delete")
        .header("cookie", &cookie)
        .send()
        .await
        .assert_status(303);

    let page = client.get("/threaded").send().await;
    page.assert_ok().assert_body_contains("1 comment");
    assert!(
        !page.text().contains("Reply one"),
        "the cascaded reply must be gone"
    );
    assert!(
        page.text().contains("Unrelated comment"),
        "and the untouched comment must remain"
    );
}

/// The public comment endpoint is bounded per address.
///
/// Unauthenticated, guest comments on by default, a reusable CSRF token and no
/// global limiter: without a per-route bound, a request loop writes a database
/// row per request and buries the moderation queue.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn guest_comment_submissions_are_throttled() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let post_id = create_post(&client, &cookie, "Flooded", "Body.", "publish").await;

    sign_out(&client);
    let mut throttled = false;
    for i in 0..25 {
        let resp = client
            .post(&format!("/comments/{post_id}"))
            .header("X-Forwarded-For", "198.51.100.23")
            .form(&form(&[
                ("body", &format!("flood {i}")),
                ("author_name", "Guest"),
                ("author_email", "guest@example.com"),
            ]))
            .send()
            .await;
        if resp.status == 429 {
            throttled = true;
            break;
        }
    }
    assert!(
        throttled,
        "the comment endpoint must stop accepting after its per-minute bound"
    );
}

/// Password guesses against protected content are bounded per address.
///
/// The route is unauthenticated, each request is one guess, and the redirect
/// target starts serving the body on success — a free oracle telling a client
/// when to stop.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn protected_post_password_attempts_are_throttled() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let created = client
        .post("/admin/content/post")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "Members Only"),
            ("slug", ""),
            ("excerpt", ""),
            ("body", "The protected text."),
            ("status", "publish"),
            ("password", "correcthorse"),
            ("taxonomy_names[post_tag]", ""),
        ]))
        .send()
        .await;
    assert_eq!(created.status, 303);
    let post_id = created
        .header("location")
        .expect("redirect")
        .rsplit('/')
        .next()
        .expect("id")
        .to_owned();

    sign_out(&client);
    let mut throttled = false;
    for i in 0..25 {
        let resp = client
            .post(&format!("/unlock/{post_id}"))
            .header("X-Forwarded-For", "198.51.100.77")
            .form(&form(&[("password", &format!("guess{i}"))]))
            .send()
            .await;
        if resp.status == 429 {
            throttled = true;
            break;
        }
    }
    assert!(
        throttled,
        "unlimited password guesses must not be available to one address"
    );
}

/// The importer applies the editor's parent rules, and says when it cannot.
///
/// Importing into a partly-populated site resolves a skipped parent by slug
/// against rows already present. That row can be trashed, of another type, or
/// already nested as deeply as pages go — none of which the editor would
/// accept. Writing the link anyway produced a child whose generated ancestry
/// the resolver cannot walk, leaving the imported page unreachable at its own
/// canonical URL. Aborting the run instead is worse, so the link is declined
/// and the child lands at the top level.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn importing_under_a_trashed_parent_keeps_the_child_reachable() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    // An existing page the import will name as a parent — then trashed, so it
    // is exactly the kind of row `validate_parent` refuses.
    let parent = client
        .post("/admin/content/page")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "Archive"),
            ("slug", ""),
            ("excerpt", ""),
            ("body", "Old parent."),
            ("status", "publish"),
            ("password", ""),
            ("taxonomy_names[post_tag]", ""),
        ]))
        .send()
        .await;
    assert_eq!(parent.status, 303);
    let parent_id = parent
        .header("location")
        .expect("redirect")
        .rsplit('/')
        .next()
        .expect("id")
        .to_owned();
    client
        .post(&format!("/admin/content/page/{parent_id}/status?to=trash"))
        .header("cookie", &cookie)
        .send()
        .await
        .assert_status(303);

    let payload = serde_json::json!({
        "version": 2,
        "site_title": "Imported",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {
                "post_type": "page", "title": "Orphan", "slug": "orphan",
                "excerpt": "", "body": "Imported child.", "status": "publish",
                "comment_status": "closed", "password": "", "author": "owner",
                "published_at": null, "parent": "archive", "terms": []
            }
        ]
    })
    .to_string();

    let result = import_export(&client, &cookie, payload.as_str()).await;
    result
        .assert_ok()
        .assert_body_contains("1 imported")
        .assert_body_contains("could not keep its parent");

    // The child is at the top level and reachable there, rather than filed
    // under a trashed ancestor and reachable nowhere.
    sign_out(&client);
    client
        .get("/orphan")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Imported child.");
}

/// A password-protected post's body must not be searchable.
///
/// `search_vector` covers title, excerpt and body, so a query matching only
/// protected body text still returned the post — turning `/search` and
/// `/api/v1/posts?search=` into an oracle for probing content the password
/// exists to withhold. The title stays searchable because it is already public.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn search_does_not_reach_into_a_protected_body() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    client
        .post("/admin/content/post")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "Quarterly Briefing"),
            ("slug", ""),
            ("excerpt", ""),
            ("body", "The acquisition of Zephyrine closes in March."),
            ("status", "publish"),
            ("password", "letmein"),
            ("taxonomy_names[post_tag]", ""),
        ]))
        .send()
        .await
        .assert_status(303);

    sign_out(&client);

    // A word that occurs only in the protected body finds nothing.
    let hidden: serde_json::Value = client
        .get("/api/v1/posts?search=Zephyrine")
        .send()
        .await
        .assert_ok()
        .json();
    assert_eq!(
        hidden.as_array().map(Vec::len),
        Some(0),
        "body text of a protected post must not be searchable: {hidden}"
    );
    let page = client.get("/search?q=Zephyrine").send().await;
    page.assert_ok();
    assert!(
        !page.text().contains("Quarterly Briefing"),
        "the front-end search must not surface it either"
    );

    // The title still is — it renders publicly on the index either way.
    let visible: serde_json::Value = client
        .get("/api/v1/posts?search=Quarterly")
        .send()
        .await
        .assert_ok()
        .json();
    assert_eq!(visible.as_array().map(Vec::len), Some(1));
}

/// Un-approving a comment takes its approved replies with it.
///
/// `assemble_thread` builds from the roots down, so a reply whose parent is no
/// longer approved can never be rendered — while it stayed `approved` and
/// stayed in `comment_count`. The post advertised comments no reader could see.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn unapproving_a_parent_hides_and_uncounts_its_replies() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let post_id = create_post(&client, &cookie, "Moderated", "Body.", "publish").await;

    for (body, reply_to) in [
        ("Parent comment", ""),
        ("Reply under parent", "1"),
        ("Unrelated comment", ""),
    ] {
        let mut fields = vec![("body", body)];
        if !reply_to.is_empty() {
            fields.push(("reply_to", reply_to));
        }
        client
            .post(&format!("/comments/{post_id}"))
            .header("cookie", &cookie)
            .form(&form(&fields))
            .send()
            .await
            .assert_status(303);
    }

    client
        .get("/moderated")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("3 comments");

    // Spam the parent.
    client
        .post("/admin/comments/1/status?to=spam")
        .header("cookie", &cookie)
        .send()
        .await
        .assert_status(303);

    let page = client.get("/moderated").send().await;
    page.assert_ok().assert_body_contains("1 comment");
    assert!(
        !page.text().contains("Reply under parent"),
        "the orphaned reply must not render"
    );
    assert!(
        page.text().contains("Unrelated comment"),
        "an unrelated comment is untouched"
    );

    // The API agrees — it is the same approved-status query.
    let api: serde_json::Value = client
        .get(&format!("/api/v1/posts/{post_id}/comments"))
        .send()
        .await
        .assert_ok()
        .json();
    assert_eq!(api.as_array().map(Vec::len), Some(1));
}

/// A reader can actually reply, without a hand-written POST.
///
/// The thread rendered no per-comment control and the single top-level form
/// never supplied `reply_to`, so the threading the schema, the depth cap and
/// the renderer all support was unreachable from a browser.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn the_thread_offers_a_reply_control_that_works() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let post_id = create_post(&client, &cookie, "Conversation", "Body.", "publish").await;

    client
        .post(&format!("/comments/{post_id}"))
        .header("cookie", &cookie)
        .form(&form(&[("body", "The first comment")]))
        .send()
        .await
        .assert_status(303);

    let page = client
        .get("/conversation")
        .header("cookie", &cookie)
        .send()
        .await;
    let html = page.assert_ok().text();
    assert!(
        html.contains(r#"name="reply_to""#),
        "the thread must render a control that supplies reply_to:\n{html}"
    );
    assert!(
        html.contains(r#"value="1""#),
        "and it must name the comment it replies to"
    );

    // The control posts to the same endpoint, and the reply nests.
    client
        .post(&format!("/comments/{post_id}"))
        .header("cookie", &cookie)
        .form(&form(&[("body", "A threaded reply"), ("reply_to", "1")]))
        .send()
        .await
        .assert_status(303);
    client
        .get("/conversation")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("A threaded reply")
        .assert_body_contains("aria-level=\"2\"");
}

/// Plain permalinks belong in the sitemap.
///
/// With that structure every post's canonical URL is `/?p=<id>`, which
/// `front_page` serves — so skipping query-string paths dropped the entire post
/// corpus from `sitemap.xml` on a site that chose it.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn the_sitemap_carries_plain_permalinks() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let post_id = create_post(&client, &cookie, "Findable", "Body.", "publish").await;

    client
        .post("/admin/settings")
        .header("cookie", &cookie)
        .form(&settings_form(&[("permalink_structure", "plain")]))
        .send()
        .await
        .assert_status(303);

    sign_out(&client);
    let sitemap = client.get("/sitemap.xml").send().await;
    let body = sitemap.assert_ok().text();
    assert!(
        body.contains(&format!("/?p={post_id}")),
        "the plain permalink must be listed:\n{body}"
    );
}

/// Re-running an import does not duplicate a row the allocator had to re-slug.
///
/// The dedupe checked the slug the file names. When an imported `about`
/// collided with an existing post and landed as `about-2`, the retry found
/// nothing under `about` and created `about-3`.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn re_importing_a_reslugged_page_is_still_idempotent() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    // An existing post already holds the bare path `about`.
    create_post(&client, &cookie, "About", "Existing post.", "publish").await;

    let payload = serde_json::json!({
        "version": 2,
        "site_title": "Imported",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [{
            "post_type": "page", "title": "About", "slug": "about",
            "excerpt": "", "body": "Imported page.", "status": "publish",
            "comment_status": "closed", "password": "", "author": "owner",
            "published_at": null, "parent": null, "terms": []
        }]
    })
    .to_string();

    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("1 imported");

    // The same file again: nothing new.
    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("0 imported");

    sign_out(&client);
    assert_eq!(
        client.get("/about-3").send().await.status,
        404,
        "a second suffix means the retry duplicated the page"
    );
    client
        .get("/about-2")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Imported page.");
}

/// Multi-level menus are reachable from the admin UI.
///
/// The item form forced `parent_id: None` and carried no parent field, so the
/// two-level menu the schema stores and the theme renders could not be built.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn menu_items_can_be_nested_and_only_within_their_own_menu() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    for (name, location) in [("Main", "primary"), ("Footer", "")] {
        client
            .post("/admin/appearance/menus")
            .header("cookie", &cookie)
            .form(&form(&[("name", name), ("location", location)]))
            .send()
            .await
            .assert_status(303);
    }

    // A root item in menu 1, and one in menu 2.
    client
        .post("/admin/appearance/menus/1/items")
        .header("cookie", &cookie)
        .form(&form(&[("label", "Products"), ("url", "/products")]))
        .send()
        .await
        .assert_status(303);
    client
        .post("/admin/appearance/menus/2/items")
        .header("cookie", &cookie)
        .form(&form(&[("label", "Legal"), ("url", "/legal")]))
        .send()
        .await
        .assert_status(303);

    // The admin screen offers the parent selector.
    let screen = client
        .get("/admin/appearance")
        .header("cookie", &cookie)
        .send()
        .await;
    screen
        .assert_ok()
        .assert_body_contains(r#"name="parent_id""#)
        .assert_body_contains("Under Products");

    // Nesting under a root item of the same menu works.
    client
        .post("/admin/appearance/menus/1/items")
        .header("cookie", &cookie)
        .form(&form(&[
            ("label", "Widgets"),
            ("url", "/products/widgets"),
            ("parent_id", "1"),
        ]))
        .send()
        .await
        .assert_status(303);

    // Nesting under an item of a *different* menu is refused: the renderer
    // walks one menu's roots, so a foreign parent renders nowhere.
    let foreign = client
        .post("/admin/appearance/menus/1/items")
        .header("cookie", &cookie)
        .form(&form(&[
            ("label", "Smuggled"),
            ("url", "/x"),
            ("parent_id", "2"),
        ]))
        .send()
        .await;
    assert_eq!(foreign.status, 422, "body: {}", foreign.text());

    // And so is nesting under an item that is itself nested — the renderer
    // draws two levels.
    let too_deep = client
        .post("/admin/appearance/menus/1/items")
        .header("cookie", &cookie)
        .form(&form(&[
            ("label", "Deeper"),
            ("url", "/y"),
            ("parent_id", "3"),
        ]))
        .send()
        .await;
    assert_eq!(too_deep.status, 422, "body: {}", too_deep.text());
}

/// A published post cannot be edited into an untitled one.
///
/// The editor's save path applies the form to a locked row and writes the
/// fields with plain Diesel — which is what makes the edit and its revision one
/// transaction, and is also what bypasses `PostHooks::before_update`. The
/// state-machine preflight only fires on a status *change*, so a crafted form
/// keeping `status=publish` while clearing the title went live untitled.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_published_post_cannot_be_saved_without_a_title() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let id = create_post(&client, &cookie, "Has A Title", "Body.", "publish").await;

    let refused = client
        .post(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .form(
            &edit_form(
                &id,
                &[
                    ("title", ""),
                    ("slug", "has-a-title"),
                    ("excerpt", ""),
                    ("body", "Body."),
                    ("status", "publish"),
                    ("password", ""),
                    ("taxonomy_names[post_tag]", ""),
                    ("comment_status", "open"),
                ],
            )
            .await,
        )
        .send()
        .await;
    assert_eq!(
        refused.status,
        422,
        "an untitled live post must be refused: {}",
        refused.text()
    );

    // And the row is untouched.
    let post: serde_json::Value = client
        .get(&format!("/api/v1/posts/{id}"))
        .send()
        .await
        .assert_ok()
        .json();
    assert_eq!(post["title"], serde_json::json!("Has A Title"));
}

/// A revision records who made the edit, not who owns the post.
///
/// `revisions.author_id` stored the post's owner, so every collaborative edit
/// was credited to the wrong account — and nothing rendered the field, which is
/// why it could stay wrong unnoticed. The history shows it now.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_revision_is_attributed_to_the_editor_who_made_it() {
    let client = db_client().await;
    let owner = register(&client, "owner").await;
    let id = create_post(&client, &owner, "Collaborative", "First draft.", "draft").await;

    // A second account, promoted to Editor so it may edit somebody else's post.
    sign_out(&client);
    let editor = register(&client, "editor").await;
    client
        .post("/admin/users/2")
        .header("cookie", &owner)
        .form(&form(&[
            ("role", "editor"),
            ("email", "editor@example.com"),
            ("display_name", "Editor"),
            ("bio", ""),
            ("website", ""),
        ]))
        .send()
        .await
        .assert_status(303);

    client
        .post(&format!("/admin/content/post/{id}"))
        .header("cookie", &editor)
        .form(
            &edit_form(
                &id,
                &[
                    ("title", "Collaborative"),
                    ("slug", "collaborative"),
                    ("excerpt", ""),
                    ("body", "Edited by somebody else."),
                    ("status", "draft"),
                    ("password", ""),
                    ("taxonomy_names[post_tag]", ""),
                    ("comment_status", "open"),
                ],
            )
            .await,
        )
        .send()
        .await
        .assert_status(303);

    let history = client
        .get(&format!("/admin/content/post/{id}/revisions"))
        .header("cookie", &owner)
        .send()
        .await;
    let html = history.assert_ok().text();
    assert!(
        html.contains("by Editor"),
        "the revision must be credited to the account that made the edit:\n{html}"
    );
    assert!(
        !html.contains("by Owner"),
        "and not to the post's owner:\n{html}"
    );
}

/// A reply to a comment that is no longer approved is refused.
///
/// A form rendered before the parent was moderated still posts. A signed-in
/// reply then lands `approved` and bumps `comment_count`, but the thread query
/// omits its parent — so it can never render and the count drifts up by a
/// comment nobody can see.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_reply_to_a_hidden_parent_is_refused() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let post_id = create_post(&client, &cookie, "Stale Form", "Body.", "publish").await;

    client
        .post(&format!("/comments/{post_id}"))
        .header("cookie", &cookie)
        .form(&form(&[("body", "Parent comment")]))
        .send()
        .await
        .assert_status(303);

    client
        .post("/admin/comments/1/status?to=spam")
        .header("cookie", &cookie)
        .send()
        .await
        .assert_status(303);

    let refused = client
        .post(&format!("/comments/{post_id}"))
        .header("cookie", &cookie)
        .form(&form(&[("body", "Late reply"), ("reply_to", "1")]))
        .send()
        .await;
    assert_eq!(
        refused.status,
        422,
        "a reply to a hidden parent must be refused: {}",
        refused.text()
    );

    let page = client.get("/stale-form").send().await;
    page.assert_ok();
    assert!(
        !page.text().contains("Late reply"),
        "and nothing may have been stored"
    );
    assert!(
        page.text().contains("No comments yet"),
        "the count must not have drifted: {}",
        page.text()
    );
}

/// The public list endpoints are navigable, not merely bounded.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn the_posts_api_pages_through_the_corpus() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    for n in 1..=5 {
        create_post(
            &client,
            &cookie,
            &format!("Entry {n}"),
            &format!("Body {n} about widgets."),
            "publish",
        )
        .await;
    }

    sign_out(&client);
    let titles = |v: &serde_json::Value| -> Vec<String> {
        v.as_array()
            .expect("array")
            .iter()
            .map(|p| p["title"].as_str().unwrap_or_default().to_owned())
            .collect()
    };

    let page_one: serde_json::Value = client
        .get("/api/v1/posts?per_page=2")
        .send()
        .await
        .assert_ok()
        .json();
    let page_two: serde_json::Value = client
        .get("/api/v1/posts?per_page=2&page=2")
        .send()
        .await
        .assert_ok()
        .json();
    assert_eq!(titles(&page_one).len(), 2);
    assert_eq!(titles(&page_two).len(), 2);
    assert!(
        titles(&page_one)
            .iter()
            .all(|t| !titles(&page_two).contains(t)),
        "pages must not overlap: {:?} vs {:?}",
        titles(&page_one),
        titles(&page_two)
    );

    // The search branch takes the same offset.
    let search_two: serde_json::Value = client
        .get("/api/v1/posts?search=widgets&per_page=2&page=2")
        .send()
        .await
        .assert_ok()
        .json();
    assert_eq!(titles(&search_two).len(), 2);

    let authors: serde_json::Value = client
        .get("/api/v1/authors?per_page=1")
        .send()
        .await
        .assert_ok()
        .json();
    assert_eq!(authors.as_array().map(Vec::len), Some(1));
}

/// A malformed date format is refused, and never reaches a rendered page.
///
/// `format()` defers everything to `Display`, a bad directive makes `Display`
/// return an error, and `to_string()` turns that into a panic — so `%` in the
/// settings form would 500 every dated listing and every single-post page.
///
/// Two defences, deliberately different. The form refuses it outright: silently
/// keeping the default would reset the site's date style from a typo, and the
/// current value is worth more than a guess. `Settings::from_rows` still
/// *ignores* it, because that funnel also reads an import and a direct write to
/// `options`, where failing would take the site down rather than save it.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_malformed_date_format_is_refused_rather_than_crashing_the_site() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    create_post(&client, &cookie, "Dated", "Body.", "publish").await;

    let settings = |date_format: &str| settings_form(&[("date_format", date_format)]);

    // A working pattern first, so there is a value worth preserving.
    client
        .post("/admin/settings")
        .header("cookie", &cookie)
        .form(&settings("%Y/%m/%d"))
        .send()
        .await
        .assert_status(303);
    sign_out(&client);
    let dated = client
        .get("/api/v1/posts")
        .send()
        .await
        .assert_ok()
        .json::<serde_json::Value>();
    let url = dated.as_array().expect("array")[0]["url"]
        .as_str()
        .expect("url")
        .to_owned();
    client
        .get(&url)
        .send()
        .await
        .assert_ok()
        .assert_body_contains(&chrono::Utc::now().format("%Y/%m/%d").to_string());

    // A pattern chrono cannot render is refused rather than accepted-and-dropped.
    let refused = client
        .post("/admin/settings")
        .header("cookie", &cookie)
        .form(&settings("%"))
        .send()
        .await;
    assert_eq!(
        refused.status,
        422,
        "a malformed pattern must be refused, not silently reset to the default: {}",
        refused.text()
    );

    // The site is unharmed and still on the format the administrator chose.
    sign_out(&client);
    client.get("/").send().await.assert_ok();
    client
        .get(&url)
        .send()
        .await
        .assert_ok()
        .assert_body_contains(&chrono::Utc::now().format("%Y/%m/%d").to_string());
}

/// A failed private creation leaves nothing behind.
///
/// `private` is reached by transitioning a draft, and that edge carries the
/// `can_publish` guard — so an empty title committed the draft, then failed,
/// leaving a row the client never asked for and each retry allocating another
/// suffixed slug.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_refused_private_api_creation_persists_nothing() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    for _ in 0..3 {
        let refused = client
            .post("/api/v1/posts")
            .header("cookie", &cookie)
            .json(&serde_json::json!({
                "title": "",
                "body": "No title here.",
                "status": "private",
            }))
            .send()
            .await;
        assert_eq!(refused.status, 422, "body: {}", refused.text());
    }

    // Nothing was written by any of the three attempts.
    let listing = client
        .get("/admin/content/post")
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .text();
    assert!(
        !listing.contains("No title here."),
        "a refused creation must persist nothing:\n{listing}"
    );
}

/// Restoring an untitled revision onto a live post is refused.
///
/// A revision captured while the post was an untitled draft is legitimate;
/// restoring it keeps the live status, so it would write the empty title past
/// the invariant every other edit path enforces.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn restoring_an_untitled_revision_onto_a_live_post_is_refused() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    // An untitled draft. Legal: the title invariant applies to live content.
    let created = client
        .post("/admin/content/post")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", ""),
            ("slug", "work-in-progress"),
            ("excerpt", ""),
            ("body", "First body."),
            ("status", "draft"),
            ("password", ""),
            ("taxonomy_names[post_tag]", ""),
            ("comment_status", "open"),
        ]))
        .send()
        .await;
    assert_eq!(created.status, 303, "body: {}", created.text());
    let id: i64 = created
        .header("location")
        .expect("redirect")
        .rsplit('/')
        .next()
        .expect("id")
        .parse()
        .expect("numeric id");

    // Its initial revision therefore carries an empty title. Now give it one
    // and publish.
    client
        .post(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .form(
            &edit_form(
                &id,
                &[
                    ("title", "Final Title"),
                    ("slug", "work-in-progress"),
                    ("excerpt", ""),
                    ("body", "Second body."),
                    ("status", "publish"),
                    ("password", ""),
                    ("taxonomy_names[post_tag]", ""),
                    ("comment_status", "open"),
                ],
            )
            .await,
        )
        .send()
        .await
        .assert_status(303);

    // The oldest revision is the untitled snapshot.
    let history = client
        .get(&format!("/admin/content/post/{id}/revisions"))
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .text();
    let untitled_revision = history
        .match_indices("/revisions/")
        .filter_map(|(at, _)| {
            history[at + "/revisions/".len()..]
                .split('/')
                .next()
                .and_then(|id| id.parse::<i64>().ok())
        })
        .min()
        .expect("at least one revision");

    let refused = client
        .post(&format!(
            "/admin/content/post/{id}/revisions/{untitled_revision}/restore"
        ))
        .header("cookie", &cookie)
        .send()
        .await;
    assert_eq!(
        refused.status,
        422,
        "restoring an untitled revision onto a live post must be refused: {}",
        refused.text()
    );

    // The live post is untouched.
    let post: serde_json::Value = client
        .get(&format!("/api/v1/posts/{id}"))
        .send()
        .await
        .assert_ok()
        .json();
    assert_eq!(post["title"], serde_json::json!("Final Title"));
}

/// An account with nothing published has no author archive.
///
/// The `Some(author)` branch returned a 200 carrying the account's public name
/// and profile, so on a site with open registration `/author/<username>`
/// answered "does this person have an account here?" for anyone who asked —
/// while `/api/v1/authors` already refused to list them.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn an_author_archive_needs_published_content() {
    let client = db_client().await;
    let owner = register(&client, "owner").await;
    create_post(&client, &owner, "Owner Post", "Body.", "publish").await;

    // A second account that has published nothing.
    sign_out(&client);
    register(&client, "lurker").await;
    sign_out(&client);

    assert_eq!(
        client.get("/author/lurker").send().await.status,
        404,
        "an account with no public content must not have an archive"
    );
    let unknown = client.get("/author/nobody-at-all").send().await;
    assert_eq!(
        unknown.status, 404,
        "and it must be indistinguishable from an account that does not exist"
    );

    // The author who has published still has one.
    client
        .get("/author/owner")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Owner Post");
}

/// A refused deferred transition on the admin path persists nothing.
///
/// `private` and `future` are reached by transitioning the draft the editor
/// creates, so a rejection after the insert left the draft, its initial
/// revision and its term assignments committed — with each retry consuming
/// another suffixed slug.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_refused_admin_creation_persists_nothing() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    for _ in 0..3 {
        let refused = client
            .post("/admin/content/post")
            .header("cookie", &cookie)
            .form(&form(&[
                ("title", ""),
                ("slug", "sneaky"),
                ("excerpt", ""),
                ("body", "Should not persist."),
                ("status", "private"),
                ("password", ""),
                ("taxonomy_names[post_tag]", ""),
                ("comment_status", "open"),
            ]))
            .send()
            .await;
        assert_eq!(refused.status, 422, "body: {}", refused.text());
    }

    let listing = client
        .get("/admin/content/post")
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .text();
    assert!(
        !listing.contains("Should not persist."),
        "a refused creation must write nothing:\n{listing}"
    );
    sign_out(&client);
    assert_eq!(client.get("/sneaky").send().await.status, 404);
}

/// A status transition is credited to whoever performed it.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_transition_is_attributed_to_the_acting_editor() {
    let client = db_client().await;
    let owner = register(&client, "owner").await;
    let id = create_post(&client, &owner, "Awaiting Review", "Body.", "draft").await;

    sign_out(&client);
    let editor = register(&client, "editor").await;
    client
        .post("/admin/users/2")
        .header("cookie", &owner)
        .form(&form(&[
            ("role", "editor"),
            ("email", "editor@example.com"),
            ("display_name", "Editor"),
            ("bio", ""),
            ("website", ""),
        ]))
        .send()
        .await
        .assert_status(303);

    // The Editor publishes somebody else's draft.
    client
        .post(&format!("/admin/content/post/{id}/status?to=publish"))
        .header("cookie", &editor)
        .send()
        .await
        .assert_status(303);

    let history = client
        .get(&format!("/admin/content/post/{id}/revisions"))
        .header("cookie", &owner)
        .send()
        .await
        .assert_ok()
        .text();
    assert!(
        history.contains("draft → publish"),
        "the transition must be in the history:\n{history}"
    );
    let transition_line = history
        .split("draft → publish")
        .nth(1)
        .expect("text after the transition summary");
    // The snapshot records the state *before* the transition, so its status is
    // the one being left — `draft` — and its author is whoever acted.
    assert!(
        transition_line.starts_with(" · draft · by Editor"),
        "the transition must be credited to the acting editor: {}",
        &transition_line[..transition_line.len().min(80)]
    );
}

/// A post is reachable at its permalink, and only at its permalink.
///
/// The dated fallback took the last segment of *any* multi-segment path, so
/// `/hello` was also served at `/anything/hello` and `/2026/13/hello` — an
/// unbounded set of duplicate-content aliases, and a 200 where a 404 belongs.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_post_is_not_served_from_arbitrary_paths() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    create_post(&client, &cookie, "Hello", "Body.", "publish").await;

    client
        .post("/admin/settings")
        .header("cookie", &cookie)
        .form(&settings_form(&[("permalink_structure", "day_and_name")]))
        .send()
        .await
        .assert_status(303);

    sign_out(&client);
    let dated = chrono::Utc::now().format("%Y/%m/%d").to_string();
    client
        .get(&format!("/{dated}/hello"))
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Body.");

    for alias in [
        "/anything/hello",
        "/2026/13/hello",
        "/2026/00/hello",
        "/2026/01/32/hello",
        "/a/b/c/d/hello",
        "/99/hello",
    ] {
        assert_eq!(
            client.get(alias).send().await.status,
            404,
            "`{alias}` is not a permalink and must not serve the post"
        );
    }
}

/// An ordinary save does not unfile a post from taxonomies the editor hides.
///
/// `set_post_terms` replaces a post's filings wholesale, and the editor renders
/// only `category` and `post_tag` — so a save silently deleted every custom
/// taxonomy assignment, including the ones the importer had just restored. The
/// form is not evidence about taxonomies it never showed.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn saving_a_post_keeps_assignments_the_editor_does_not_render() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let id = create_post(&client, &cookie, "Filed", "Body.", "publish").await;

    // A term in a taxonomy the editor has no field for, filed against the post.
    // Written directly because registering one would leak into every later
    // test through the process-global registry — and `post_terms` does not
    // care whether the taxonomy is registered, which is exactly the state an
    // import leaves behind.
    let db = TestDb::shared().await;
    try_execute(
        db,
        "INSERT INTO terms (taxonomy, name, slug, description) \
         VALUES ('genre', 'Longform', 'longform', '')",
    )
    .await
    .expect("insert custom term");
    try_execute(
        db,
        &format!(
            "INSERT INTO post_terms (post_id, term_id) \
             SELECT {id}, id FROM terms WHERE slug = 'longform'"
        ),
    )
    .await
    .expect("file the post under it");

    // An ordinary edit that names only a tag.
    client
        .post(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .form(
            &edit_form(
                &id,
                &[
                    ("title", "Filed"),
                    ("slug", "filed"),
                    ("excerpt", ""),
                    ("body", "Edited body."),
                    ("status", "publish"),
                    ("password", ""),
                    ("taxonomy_names[post_tag]", "rust"),
                    ("comment_status", "open"),
                ],
            )
            .await,
        )
        .send()
        .await
        .assert_status(303);

    // The tag was applied, and the custom-taxonomy filing survived.
    let editor = client
        .get(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .text();
    assert!(editor.contains("rust"), "the tag should have been applied");

    // Read the filing back. `1/COUNT(*)` divides by zero — and so errors —
    // exactly when the row is gone, which is the assertion this needs from a
    // helper that reports success or failure rather than rows.
    let still_filed = try_execute(
        db,
        &format!(
            "SELECT 1/COUNT(*) FROM post_terms pt JOIN terms t ON t.id = pt.term_id \
             WHERE pt.post_id = {id} AND t.taxonomy = 'genre'"
        ),
    )
    .await;
    assert!(
        still_filed.is_ok(),
        "the custom-taxonomy filing was deleted by an ordinary save: {still_filed:?}"
    );
}

/// A post is served at its own dated permalink and no other date.
///
/// Restricting the fallback by shape was not enough: `/2025/01/hello` has a
/// valid shape and is not the post's permalink, so a single post was still
/// reachable at thousands of dates. `/YYYY/<slug>` is not a shape any structure
/// mints at all.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_dated_permalink_matches_only_the_posts_own_date() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    create_post(&client, &cookie, "Hello", "Body.", "publish").await;

    client
        .post("/admin/settings")
        .header("cookie", &cookie)
        .form(&settings_form(&[("permalink_structure", "day_and_name")]))
        .send()
        .await
        .assert_status(303);

    sign_out(&client);
    let now = chrono::Utc::now();
    let day = now.format("%Y/%m/%d").to_string();
    let month = now.format("%Y/%m").to_string();
    let year = now.format("%Y").to_string();

    // Its own date, in both dated shapes — these are the aliases that exist so
    // that changing the permalink structure does not 404 shared links.
    client
        .get(&format!("/{day}/hello"))
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Body.");
    client
        .get(&format!("/{month}/hello"))
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Body.");

    // A bare year is not a shape any structure mints.
    assert_eq!(
        client.get(&format!("/{year}/hello")).send().await.status,
        404
    );

    // Well-shaped dates that are not this post's.
    for alias in ["/2015/01/hello", "/2015/01/02/hello"] {
        assert_eq!(
            client.get(alias).send().await.status,
            404,
            "`{alias}` is not this post's permalink"
        );
    }

    // Unpadded is not what the generator writes, so it is not an alias either.
    let unpadded = format!("/{}/{}/hello", now.format("%Y"), now.format("%-m"));
    if unpadded != format!("/{month}/hello") {
        assert_eq!(client.get(&unpadded).send().await.status, 404);
    }
}

/// Search results past the first page are reachable from the UI.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn search_results_render_pagination() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    client
        .post("/admin/settings")
        .header("cookie", &cookie)
        .form(&settings_form(&[("posts_per_page", "2")]))
        .send()
        .await
        .assert_status(303);

    for n in 1..=5 {
        create_post(
            &client,
            &cookie,
            &format!("Widget Report {n}"),
            "All about widgets.",
            "publish",
        )
        .await;
    }

    sign_out(&client);
    let first = client.get("/search?s=widgets").send().await;
    let html = first.assert_ok().text();
    assert!(
        html.contains("Older →"),
        "the first page of results must link to the next:\n{html}"
    );
    assert!(
        html.contains("s=widgets&amp;page=2"),
        "and that link must carry the search term:\n{html}"
    );

    let second = client.get("/search?s=widgets&page=2").send().await;
    let html = second.assert_ok().text();
    assert!(html.contains("← Newer"), "the second page must link back");
    assert!(html.contains("Page 2 of 3"), "and say where it is:\n{html}");
}

/// A hierarchical page's permalink in a search result must still resolve its
/// full nested path when it comes from a batched ancestor lookup rather than
/// a per-row one.
///
/// `search()` used to call `Repos::permalink` once per result, which for a
/// page walked its ancestor chain a row at a time. It now resolves every
/// result's ancestors in one batched pass (`content::posts_with_ancestors`)
/// and builds the URL from that map with `site::permalink_from` — the same
/// pure function `site::nav_for` already uses for the nav menu. This is the
/// equivalence proof for the new call sites: a three-level chain must still
/// produce its full path, two sibling leaves sharing the same parent (the
/// shape the batching actually has to get right — a single result works
/// under any implementation) must each resolve independently and correctly,
/// and a flat, non-hierarchical post must render exactly as before.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn search_resolves_hierarchical_page_permalinks_from_the_batched_lookup() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    async fn create_page(
        client: &TestClient,
        cookie: &str,
        title: &str,
        slug: &str,
        parent_id: Option<&str>,
    ) -> String {
        let mut fields = vec![
            ("title", title),
            ("slug", slug),
            ("excerpt", ""),
            (
                "body",
                "Zzflorb marks the search token this test looks for.",
            ),
            ("status", "publish"),
            ("password", ""),
        ];
        if let Some(parent) = parent_id {
            fields.push(("parent_id", parent));
        }
        let resp = client
            .post("/admin/content/page")
            .header("cookie", cookie)
            .form(&form(&fields))
            .send()
            .await;
        assert_eq!(
            resp.status,
            303,
            "create page should redirect: {}",
            resp.text()
        );
        resp.header("location")
            .expect("redirect to the editor")
            .rsplit('/')
            .next()
            .expect("id")
            .to_owned()
    }

    // docs > docs/install > docs/install/{setup-a,setup-b}: a three-level
    // chain with two sibling leaves sharing the same immediate parent, so the
    // batch has to resolve one shared ancestor path for two distinct results.
    let docs = create_page(&client, &cookie, "Docs Zzflorb", "docs", None).await;
    let install = create_page(&client, &cookie, "Install Zzflorb", "install", Some(&docs)).await;
    create_page(
        &client,
        &cookie,
        "Setup A Zzflorb",
        "setup-a",
        Some(&install),
    )
    .await;
    create_page(
        &client,
        &cookie,
        "Setup B Zzflorb",
        "setup-b",
        Some(&install),
    )
    .await;

    // A flat post: `permalink()`/`permalink_from` never walk ancestry for a
    // non-`page` type at all, batched or not.
    create_post(&client, &cookie, "Flat Zzflorb", "A flat post.", "publish").await;

    sign_out(&client);
    let html = client
        .get("/search?s=zzflorb")
        .send()
        .await
        .assert_ok()
        .text();

    assert!(
        html.contains(r#"href="/docs/install/setup-a""#),
        "the first sibling must resolve its full three-level path:\n{html}"
    );
    assert!(
        html.contains(r#"href="/docs/install/setup-b""#),
        "the second sibling, sharing the same parent, must resolve its own \
         full path too -- not be dropped or given the first sibling's URL by \
         the batched lookup:\n{html}"
    );
    assert!(
        html.contains("Flat Zzflorb"),
        "a flat post must still appear, unaffected by ancestry batching:\n{html}"
    );
}

/// An absurd page number is bounded, not an overflow.
///
/// `page` is an unbounded `usize` from the query string and the offset is
/// `(page - 1) * per_page`, so `?page=18446744073709551615` overflows: a panic
/// under overflow checks (which is what a debug build, and this test, uses) and
/// a wrapped, unrelated page in release.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn an_absurd_page_number_does_not_overflow() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    create_post(&client, &cookie, "Only Post", "Body.", "publish").await;

    sign_out(&client);
    for path in [
        "/?page=18446744073709551615",
        "/?page=9223372036854775808",
        "/search?s=body&page=18446744073709551615",
        "/api/v1/posts?page=18446744073709551615",
        "/api/v1/terms?page=18446744073709551615",
        "/api/v1/authors?page=18446744073709551615",
    ] {
        let resp = client.get(path).send().await;
        assert!(
            resp.status.is_success(),
            "`{path}` must be bounded rather than overflow, got {}",
            resp.status
        );
    }
}

/// A stale plain permalink answers 404, not the front page.
///
/// `?p=` naming a deleted row, or one whose type was since registered
/// `public: false`, fell out of its condition and rendered the front page with
/// a 200 — so a canonical URL that no longer resolves became a soft redirect
/// home, and a search engine told "200, and here is the homepage" keeps the
/// dead URL indexed under the homepage's content. `/archives/123` and every
/// slug permalink answer the same case with the themed 404.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_stale_plain_permalink_is_a_404() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let id = create_post(&client, &cookie, "Briefly", "Body.", "publish").await;

    sign_out(&client);
    client
        .get(&format!("/?p={id}"))
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Body.");

    // Gone.
    try_execute(
        TestDb::shared().await,
        &format!("DELETE FROM posts WHERE id = {id}"),
    )
    .await
    .expect("delete the post");

    let stale = client.get(&format!("/?p={id}")).send().await;
    assert_eq!(
        stale.status,
        404,
        "a permalink that no longer resolves must say so: {}",
        stale.text()
    );
    // And the same answer `/archives/<id>` already gave.
    assert_eq!(
        client.get(&format!("/archives/{id}")).send().await.status,
        404
    );

    // The front page itself is untouched.
    client.get("/").send().await.assert_ok();
}

/// A post created through the API gets the same history as one created in the
/// admin.
///
/// The admin's create transaction records an initial revision and the API's did
/// not, so "restore this revision" meant something different depending on which
/// supported write surface made the content — and the first edit would snapshot
/// a body whose predecessor was nowhere.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn an_api_created_post_gets_an_initial_revision() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let created = client
        .post("/api/v1/posts")
        .header("cookie", &cookie)
        .json(&serde_json::json!({
            "title": "Through the API",
            "body": "Body.",
            "status": "draft"
        }))
        .send()
        .await;
    assert!(
        created.status.is_success(),
        "create: {} {}",
        created.status,
        created.text()
    );

    let revisions: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        RunQueryDsl::get_result({{crate_name}}::schema::revisions::table.count(), &mut conn)
            .await
            .expect("the count")
    };
    assert_eq!(
        revisions, 1,
        "a post created through the API starts with the same history as one \
         created in the admin"
    );
}

/// A restore keeps each file with its uploader.
///
/// The export carried no uploader identity, so every restored attachment
/// belonged to whoever ran the import — and `delete_attachment` lets an Author
/// remove only files whose `uploader_id` is theirs, so each Author lost control
/// of their own uploads in the workflow that is supposed to put the site back.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_restore_keeps_each_file_with_its_uploader() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    create_post(&client, &cookie, "Illustrated", "Body.", "publish").await;
    let _second = register(&client, "photographer").await;

    let uploader_id: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        RunQueryDsl::first(
            {{crate_name}}::schema::users::table
                .filter({{crate_name}}::schema::users::username.eq("photographer"))
                .select({{crate_name}}::schema::users::id),
            &mut conn,
        )
        .await
        .expect("the account")
    };
    try_execute(
        TestDb::shared().await,
        &format!(
            "INSERT INTO attachments (title, slug, mime_type, byte_size, alt_text, caption,
                                      uploader_id)
             VALUES ('Their Photo', 'their-photo', 'image/png', 1, '', '', {uploader_id})"
        ),
    )
    .await
    .expect("seed the upload");

    // Back as the administrator: registering the second account rotated the
    // session, so the cookie captured before it is signed out.
    let cookie = sign_in(&client, "owner").await;
    let payload = client
        .get("/admin/tools/export")
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .text();
    assert!(
        payload.contains("photographer"),
        "the uploader travels:\n{payload}"
    );

    // Restore into a site where both accounts exist, the importer being the
    // administrator.
    let fresh = db_client().await;
    let _admin = register(&fresh, "owner").await;
    let _second = register(&fresh, "photographer").await;
    let cookie = sign_in(&fresh, "owner").await;
    import_export(&fresh, &cookie, &payload).await.assert_ok();

    let (owner_of_file, photographer): (Option<i64>, i64) = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        let owner_of_file = RunQueryDsl::first(
            {{crate_name}}::schema::attachments::table
                .filter({{crate_name}}::schema::attachments::slug.eq("their-photo"))
                .select({{crate_name}}::schema::attachments::uploader_id),
            &mut conn,
        )
        .await
        .expect("the attachment");
        let photographer = RunQueryDsl::first(
            {{crate_name}}::schema::users::table
                .filter({{crate_name}}::schema::users::username.eq("photographer"))
                .select({{crate_name}}::schema::users::id),
            &mut conn,
        )
        .await
        .expect("the account");
        (owner_of_file, photographer)
    };
    assert_eq!(
        owner_of_file,
        Some(photographer),
        "the file comes back belonging to the account that uploaded it, not to \
         whoever ran the import"
    );
}

/// A term's displayed count comes from the posts, not from a stored number the
/// registry can invalidate.
///
/// `terms.post_count` is computed from `public_type_slugs()` — the registry —
/// so it is right when written and stale the moment a deployment registers a
/// type differently, or restores content whose plugin is disabled. No row
/// changes, so nothing recounts. The archive the number describes is already
/// visibility-aware, so the screens showing it disagreed with the thing they
/// were describing.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_terms_displayed_count_comes_from_the_posts() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let id = create_post(&client, &cookie, "Counted", "Body.", "publish").await;

    client
        .post("/admin/terms/category")
        .header("cookie", &cookie)
        .form(&form(&[
            ("name", "Tallied"),
            ("slug", ""),
            ("description", ""),
        ]))
        .send()
        .await
        .assert_status(303);
    try_execute(
        TestDb::shared().await,
        &format!(
            "INSERT INTO post_terms (post_id, term_id)
             VALUES ({id}, (SELECT id FROM terms WHERE slug = 'tallied'))"
        ),
    )
    .await
    .expect("file the post");

    // A stored counter that disagrees with the posts — which is exactly what a
    // registry change leaves behind, since it writes no rows.
    try_execute(
        TestDb::shared().await,
        "UPDATE terms SET post_count = 0 WHERE slug = 'tallied'",
    )
    .await
    .expect("stale the counter");

    // The management screen shows what the archive would.
    let screen = client
        .get("/admin/terms/category")
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .text();
    let row = screen
        .split("Tallied")
        .nth(1)
        .expect("the term's row")
        .to_owned();
    assert!(
        row.contains(">1<") || row.contains("> 1 <"),
        "the screen an editor decides on must agree with the archive:\n{row}"
    );

    // And so does the API.
    let api = client
        .get("/api/v1/terms?taxonomy=category")
        .send()
        .await
        .assert_ok()
        .text();
    let parsed: serde_json::Value = serde_json::from_str(&api).expect("the terms parse");
    let counted = parsed
        .as_array()
        .expect("an array")
        .iter()
        .find(|term| term["slug"] == "tallied")
        .expect("the term");
    assert_eq!(
        counted["post_count"], 1,
        "the API publishes the count the archive would produce:\n{api}"
    );
}

/// Restoring a disabled plugin's taxonomy keeps its hierarchy.
///
/// The export now carries the terms of a plugin that was disabled when the
/// backup was taken. Restoring one while that plugin is *still* disabled read
/// "not registered" as "has no hierarchy" and dropped every parent — and
/// re-enabling the plugin afterwards found the taxonomy permanently flattened,
/// because a second import only re-parents rows it created itself.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn restoring_an_unregistered_taxonomy_keeps_its_hierarchy() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    // A file describing a nested taxonomy nothing registers. Slugs no other
    // test uses: the registry is process-global.
    let payload = serde_json::json!({
        "version": 5,
        "site_title": "Elsewhere",
        "exported_at": "2026-01-01T00:00:00Z",
        "attachments": [],
        "posts": [],
        "terms": [
            {
                "taxonomy": "dozing-plugin", "name": "Parent", "slug": "dozing-parent",
                "description": "", "parent": null
            },
            {
                "taxonomy": "dozing-plugin", "name": "Child", "slug": "dozing-child",
                "description": "", "parent": "dozing-parent"
            }
        ]
    })
    .to_string();

    import_export(&client, &cookie, &payload).await.assert_ok();

    let (child_parent, parent_id): (Option<i64>, i64) = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        let child_parent = RunQueryDsl::first(
            {{crate_name}}::schema::terms::table
                .filter({{crate_name}}::schema::terms::slug.eq("dozing-child"))
                .select({{crate_name}}::schema::terms::parent_id),
            &mut conn,
        )
        .await
        .expect("the child");
        let parent_id = RunQueryDsl::first(
            {{crate_name}}::schema::terms::table
                .filter({{crate_name}}::schema::terms::slug.eq("dozing-parent"))
                .select({{crate_name}}::schema::terms::id),
            &mut conn,
        )
        .await
        .expect("the parent");
        (child_parent, parent_id)
    };
    assert_eq!(
        child_parent,
        Some(parent_id),
        "only the file knows the shape of a taxonomy nothing registers, so the \
         file is what to believe"
    );

    // And a registered *flat* taxonomy is still refused a parent — the rule
    // that check exists for is intact.
    let flat = serde_json::json!({
        "version": 5,
        "site_title": "Elsewhere",
        "exported_at": "2026-01-01T00:00:00Z",
        "attachments": [],
        "posts": [],
        "terms": [
            {
                "taxonomy": "post_tag", "name": "Rust", "slug": "rust",
                "description": "", "parent": null
            },
            {
                "taxonomy": "post_tag", "name": "Async", "slug": "async",
                "description": "", "parent": "rust"
            }
        ]
    })
    .to_string();
    import_export(&client, &cookie, &flat).await.assert_ok();
    let tag_parent: Option<i64> = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        RunQueryDsl::first(
            {{crate_name}}::schema::terms::table
                .filter({{crate_name}}::schema::terms::slug.eq("async"))
                .select({{crate_name}}::schema::terms::parent_id),
            &mut conn,
        )
        .await
        .expect("the tag")
    };
    assert_eq!(
        tag_parent, None,
        "a registered flat taxonomy still refuses a parent, whatever a file says"
    );
}

/// A backup carries content whose plugin is not registered right now.
///
/// A plugin that is disabled when the backup is taken leaves its posts and
/// terms in the database and its registration absent, and a file built from the
/// registry omitted both — so re-enabling the plugin after a restore could
/// recover neither the content nor the taxonomy that described it.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_backup_carries_content_of_an_unregistered_type() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    create_post(&client, &cookie, "Ordinary", "Body.", "publish").await;

    // Rows of a type and a taxonomy nothing registers — the state a disabled
    // plugin leaves. Slugs no other test registers; the registry is
    // process-global.
    try_execute(
        TestDb::shared().await,
        "INSERT INTO posts (post_type, title, slug, excerpt, body, status, author_id,
                            comment_status, password, sticky, published_at)
         VALUES ('dormant-plugin', 'Dormant', 'dormant', '', 'Still here.', 'publish', 1,
                 'closed', '', false, NOW())",
    )
    .await
    .expect("seed the post");
    try_execute(
        TestDb::shared().await,
        "INSERT INTO terms (taxonomy, name, slug, description, post_count)
         VALUES ('dormant-taxonomy', 'Dormant term', 'dormant-term', '', 0)",
    )
    .await
    .expect("seed the term");

    let payload = client
        .get("/admin/tools/export")
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .text();
    assert!(
        payload.contains("dormant-plugin") && payload.contains("Still here."),
        "the disabled plugin's content is in the backup:\n{payload}"
    );
    assert!(
        payload.contains("dormant-taxonomy") && payload.contains("dormant-term"),
        "and so is the taxonomy that described it"
    );
    // The registered content is still there too.
    assert!(payload.contains("Ordinary"));

    // And it restores. Carrying content the importer then refuses would be a
    // backup that can be produced and never used — the export half of this fix
    // is only half of it.
    let fresh = db_client().await;
    let cookie = register(&fresh, "owner").await;
    import_export(&fresh, &cookie, &payload).await.assert_ok();

    let (body, term): (String, i64) = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        let body = RunQueryDsl::first(
            {{crate_name}}::schema::posts::table
                .filter({{crate_name}}::schema::posts::post_type.eq("dormant-plugin"))
                .select({{crate_name}}::schema::posts::body),
            &mut conn,
        )
        .await
        .expect("the restored post");
        let term = RunQueryDsl::get_result(
            {{crate_name}}::schema::terms::table
                .filter({{crate_name}}::schema::terms::taxonomy.eq("dormant-taxonomy"))
                .count(),
            &mut conn,
        )
        .await
        .expect("the count");
        (body, term)
    };
    assert_eq!(body, "Still here.", "the content comes back");
    assert_eq!(term, 1, "and so does the taxonomy that described it");
}

/// A term whose taxonomy is no longer registered is not linked.
///
/// A plugin that stops registering a taxonomy leaves its terms and filings in
/// place, and `permalinks::resolve` recognises a term archive only by iterating
/// the *currently registered* taxonomies — so a link built for an orphaned term
/// 404s, or resolves as unrelated page content.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn an_unregistered_taxonomys_terms_are_not_linked() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let id = create_post(&client, &cookie, "Filed", "Body.", "publish").await;

    // A term of a taxonomy nothing registers — the state a removed plugin
    // leaves behind. Written directly, because the admin screens are
    // registry-driven and cannot produce it.
    //
    // The slug is deliberately one no other test registers: `content_types` is
    // a process-global registry, so `shelf` — which
    // `a_registered_custom_taxonomy_is_editable` registers — is *registered* by
    // the time this runs in a full suite, and the term would be routable after
    // all. That is the same trap round 57 hit with a post type.
    // One statement per call: `try_execute` prepares, and a prepared statement
    // cannot carry several.
    try_execute(
        TestDb::shared().await,
        "INSERT INTO terms (taxonomy, name, slug, description, post_count)
         VALUES ('retired-plugin', 'Reference', 'reference', '', 1)",
    )
    .await
    .expect("seed the orphaned term");
    try_execute(
        TestDb::shared().await,
        &format!(
            "INSERT INTO post_terms (post_id, term_id)
             VALUES ({id}, (SELECT id FROM terms WHERE slug = 'reference'))"
        ),
    )
    .await
    .expect("file it under the orphaned term");

    // A category too, so the footer is not simply empty.
    client
        .post("/admin/terms/category")
        .header("cookie", &cookie)
        .form(&form(&[
            ("name", "News"),
            ("slug", ""),
            ("description", ""),
        ]))
        .send()
        .await
        .assert_status(303);
    try_execute(
        TestDb::shared().await,
        &format!(
            "INSERT INTO post_terms (post_id, term_id)
             VALUES ({id}, (SELECT id FROM terms WHERE slug = 'news'))"
        ),
    )
    .await
    .expect("file it under the category");

    sign_out(&client);
    let page = client.get("/filed").send().await.assert_ok().text();
    assert!(
        page.contains("/category/news"),
        "a registered taxonomy's term is still linked:\n{page}"
    );
    assert!(
        !page.contains("Reference") && !page.contains("/retired-plugin/reference"),
        "and one whose taxonomy nothing registers is not advertised at all"
    );
    // The link it would have minted really does go nowhere, which is the point.
    assert_eq!(
        client.get("/retired-plugin/reference").send().await.status,
        404
    );
}

/// A seeded composite is all there or not there at all.
///
/// The menu and the sidebar are each a composite whose existence check reads
/// only the first row. Committed statement by statement, a run interrupted
/// after the menu row but before its items left a menu the next run reads as
/// already seeded — so the missing items were never restored, and the
/// idempotent retry this seeder advertises could not repair it.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_seeded_composite_is_all_or_nothing() {
    let client = db_client().await;
    let _cookie = register(&client, "owner").await;

    // A trigger that refuses the *second* menu item, which is what an
    // interruption part-way through the composite looks like.
    try_execute(
        TestDb::shared().await,
        "CREATE FUNCTION refuse_second_item() RETURNS trigger AS $$
         BEGIN
           IF (SELECT count(*) FROM menu_items) >= 1 THEN
             RAISE EXCEPTION 'interrupted';
           END IF;
           RETURN NEW;
         END;
         $$ LANGUAGE plpgsql",
    )
    .await
    .expect("install the function");
    try_execute(
        TestDb::shared().await,
        "CREATE TRIGGER refuse_second_item BEFORE INSERT ON menu_items
         FOR EACH ROW EXECUTE PROCEDURE refuse_second_item()",
    )
    .await
    .expect("install the trigger");

    {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::seed::seed_site(&mut conn)
            .await
            .expect_err("the seed fails while the trigger refuses");
    }

    // Nothing half-written: the menu row did not survive its items' failure.
    let menus: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        RunQueryDsl::get_result({{crate_name}}::schema::menus::table.count(), &mut conn)
            .await
            .expect("the count")
    };
    assert_eq!(
        menus, 0,
        "a menu with no items must not be left for the next run to read as done"
    );

    // With the fault removed, a retry seeds it completely.
    try_execute(
        TestDb::shared().await,
        "DROP TRIGGER refuse_second_item ON menu_items",
    )
    .await
    .expect("remove the trigger");
    try_execute(TestDb::shared().await, "DROP FUNCTION refuse_second_item()")
        .await
        .expect("remove the function");
    {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::seed::seed_site(&mut conn)
            .await
            .expect("the retry repairs it");
    }
    let items: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        RunQueryDsl::get_result({{crate_name}}::schema::menu_items::table.count(), &mut conn)
            .await
            .expect("the count")
    };
    assert!(items >= 2, "the whole menu is there, got {items} items");
}

/// A backup carries the revision history.
///
/// Revisions are a supported feature, and a restore that drops them takes away
/// the ability to roll content back — silently, since nothing on the restored
/// post says its history used to exist.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn an_export_carries_revision_history() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let id = create_post(&client, &cookie, "Revised", "First draft.", "publish").await;

    // Two edits, so there is a history worth keeping.
    for body in ["Second draft.", "Third draft."] {
        client
            .post(&format!("/admin/content/post/{id}"))
            .header("cookie", &cookie)
            .form(
                &edit_form(
                    &id,
                    &[
                        ("title", "Revised"),
                        ("slug", "revised"),
                        ("excerpt", ""),
                        ("body", body),
                        ("status", "publish"),
                        ("password", ""),
                        ("taxonomy_names[post_tag]", ""),
                    ],
                )
                .await,
            )
            .send()
            .await
            .assert_status(303);
    }

    let payload = client
        .get("/admin/tools/export")
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .text();
    assert!(
        payload.contains("First draft.") && payload.contains("Second draft."),
        "the snapshots travel, not just the current body:\n{payload}"
    );

    let fresh = db_client().await;
    let cookie = register(&fresh, "owner").await;
    import_export(&fresh, &cookie, &payload).await.assert_ok();

    let bodies: Vec<String> = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        RunQueryDsl::load(
            {{crate_name}}::schema::revisions::table
                .order({{crate_name}}::schema::revisions::created_at.asc())
                .select({{crate_name}}::schema::revisions::body),
            &mut conn,
        )
        .await
        .expect("the revisions")
    };
    assert!(
        bodies.contains(&"First draft.".to_owned()) && bodies.contains(&"Second draft.".to_owned()),
        "the history comes back: {bodies:?}"
    );
    // And it is the file's history, not the restore's own bookkeeping: the
    // import creates every post as a draft and transitions it, and both record
    // snapshots of their own.
    assert!(
        !bodies.iter().any(|body| body == "Third draft."),
        "the restore's own snapshots do not survive beside it: {bodies:?}"
    );

    // The author travels too.
    let authors: Vec<Option<i64>> = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        RunQueryDsl::load(
            {{crate_name}}::schema::revisions::table.select({{crate_name}}::schema::revisions::author_id),
            &mut conn,
        )
        .await
        .expect("the authors")
    };
    assert!(
        authors.iter().any(Option::is_some),
        "a snapshot's editor is resolved back to an account: {authors:?}"
    );
}

/// A backup carries custom fields.
///
/// A plugin storing per-post data through the `PostMeta` repository had every
/// field silently dropped by an export and restore, with nothing in the file or
/// the report to say so. The importer's own private keys stay out of the file,
/// and are refused on the way in whatever a file claims.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn an_export_carries_custom_fields() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let id = create_post(&client, &cookie, "Annotated", "Body.", "publish").await;

    try_execute(
        TestDb::shared().await,
        &format!(
            "INSERT INTO post_meta (post_id, meta_key, meta_value) VALUES
               ({id}, 'subtitle', 'A plugin wrote this'),
               ({id}, 'reading_time', '4')"
        ),
    )
    .await
    .expect("seed the fields");

    let payload = client
        .get("/admin/tools/export")
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .text();
    assert!(
        payload.contains("A plugin wrote this") && payload.contains("reading_time"),
        "the fields travel:\n{payload}"
    );
    assert!(
        !payload.contains("_import_source_slug") && !payload.contains("_import_completed"),
        "and the importer's own markers do not"
    );

    let fresh = db_client().await;
    let cookie = register(&fresh, "owner").await;
    import_export(&fresh, &cookie, &payload).await.assert_ok();

    let restored: Vec<(String, String)> = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        RunQueryDsl::load(
            {{crate_name}}::schema::post_meta::table
                .filter({{crate_name}}::schema::post_meta::meta_key.ne_all({{crate_name}}::content::INTERNAL_META_KEYS))
                .order({{crate_name}}::schema::post_meta::meta_key.asc())
                .select((
                    {{crate_name}}::schema::post_meta::meta_key,
                    {{crate_name}}::schema::post_meta::meta_value,
                )),
            &mut conn,
        )
        .await
        .expect("the fields")
    };
    assert_eq!(
        restored,
        vec![
            ("reading_time".to_owned(), "4".to_owned()),
            ("subtitle".to_owned(), "A plugin wrote this".to_owned()),
        ],
        "both come back, and nothing else does"
    );

    // Re-running replaces rather than appends: `post_meta` has no uniqueness
    // constraint, so a second copy of every field would be a reader's coin toss.
    import_export(&fresh, &cookie, &payload).await.assert_ok();
    let total: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        RunQueryDsl::get_result(
            {{crate_name}}::schema::post_meta::table
                .filter({{crate_name}}::schema::post_meta::meta_key.ne_all({{crate_name}}::content::INTERNAL_META_KEYS))
                .count(),
            &mut conn,
        )
        .await
        .expect("the count")
    };
    assert_eq!(total, 2, "a second import does not duplicate them");
}

/// A featured image has to be an image.
///
/// The selector listed every attachment, so an editor could pick a PDF, the
/// save would succeed, and the post would render nothing — the editor said yes
/// and the site said nothing.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_featured_image_has_to_be_an_image() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let id = create_post(&client, &cookie, "Illustrated", "Body.", "publish").await;

    try_execute(
        TestDb::shared().await,
        "INSERT INTO attachments (title, slug, mime_type, byte_size, alt_text, caption)
         VALUES ('Spreadsheet', 'spreadsheet-aaaa', 'text/csv', 1, '', ''),
                ('Picture', 'picture-bbbb', 'image/png', 1, '', '')",
    )
    .await
    .expect("seed the library");

    let ids = async |mime: &'static str| -> i64 {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        RunQueryDsl::first(
            {{crate_name}}::schema::attachments::table
                .filter({{crate_name}}::schema::attachments::mime_type.eq(mime))
                .select({{crate_name}}::schema::attachments::id),
            &mut conn,
        )
        .await
        .expect("the attachment")
    };
    let csv = ids("text/csv").await;
    let png = ids("image/png").await;

    // The picker offers the image and not the spreadsheet.
    let editor = client
        .get(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .text();
    assert!(editor.contains("Picture"), "an image is offered");
    assert!(
        !editor.contains("Spreadsheet"),
        "and a file the post cannot render is not:\n{editor}"
    );

    // And a crafted submission is refused rather than stored and ignored.
    let refused = client
        .post(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .form(
            &edit_form(
                &id,
                &[
                    ("title", "Illustrated"),
                    ("slug", "illustrated"),
                    ("excerpt", ""),
                    ("body", "Body."),
                    ("status", "publish"),
                    ("password", ""),
                    ("taxonomy_names[post_tag]", ""),
                    ("featured_media_id", &csv.to_string()),
                ],
            )
            .await,
        )
        .send()
        .await;
    assert_ne!(refused.status, 303, "a non-image must be refused");

    // The image is accepted.
    client
        .post(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .form(
            &edit_form(
                &id,
                &[
                    ("title", "Illustrated"),
                    ("slug", "illustrated"),
                    ("excerpt", ""),
                    ("body", "Body."),
                    ("status", "publish"),
                    ("password", ""),
                    ("taxonomy_names[post_tag]", ""),
                    ("featured_media_id", &png.to_string()),
                ],
            )
            .await,
        )
        .send()
        .await
        .assert_status(303);
}

/// An ordinary save does not move a published post's date.
///
/// The `datetime-local` control is prefilled from the stored date and submits
/// on every save, so an unconditional write rewrote `published_at` whenever
/// anything else on the form changed — truncating the seconds off a publication
/// record each time, and reordering posts published within the same minute. A
/// deliberate change still applies; what this pins is that saving a title does
/// not silently redate the post.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn saving_a_published_post_does_not_move_its_date() {
    use diesel::prelude::*;
    use diesel_async::RunQueryDsl;

    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let id = create_post(&client, &cookie, "Dated", "Body.", "publish").await;

    // A stored date with seconds on it, which is what the form cannot express.
    try_execute(
        TestDb::shared().await,
        &format!("UPDATE posts SET published_at = TIMESTAMP '2026-03-04 05:06:07' WHERE id = {id}"),
    )
    .await
    .expect("stamp a precise date");

    let stored = async || -> Option<chrono::NaiveDateTime> {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        RunQueryDsl::first(
            {{crate_name}}::schema::posts::table
                .find(id)
                .select({{crate_name}}::schema::posts::published_at),
            &mut conn,
        )
        .await
        .expect("the post")
    };

    // Open the editor and save it back exactly as rendered — the browser
    // submits the prefilled field whether or not anybody touched it.
    let editor = client
        .get(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .text();
    let prefilled = editor
        .split("name=\"publish_at\"")
        .nth(1)
        .and_then(|rest| rest.split("value=\"").nth(1))
        .and_then(|rest| rest.split('"').next())
        .expect("the prefilled date")
        .to_owned();
    assert_eq!(
        prefilled, "2026-03-04T05:06",
        "the control renders minute precision, which is the whole problem"
    );

    client
        .post(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .form(
            &edit_form(
                &id,
                &[
                    ("title", "Dated, retitled"),
                    ("slug", "dated"),
                    ("excerpt", ""),
                    ("body", "Body."),
                    ("status", "publish"),
                    ("password", ""),
                    ("taxonomy_names[post_tag]", ""),
                    ("publish_at", &prefilled),
                ],
            )
            .await,
        )
        .send()
        .await
        .assert_status(303);

    assert_eq!(
        stored().await,
        Some(
            chrono::NaiveDate::from_ymd_opt(2026, 3, 4)
                .unwrap()
                .and_hms_opt(5, 6, 7)
                .unwrap()
        ),
        "an untouched field must leave the publication record alone, seconds included"
    );

    // A deliberate change still applies — the guard is against accidents, not
    // against editing.
    client
        .post(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .form(
            &edit_form(
                &id,
                &[
                    ("title", "Dated, retitled"),
                    ("slug", "dated"),
                    ("excerpt", ""),
                    ("body", "Body."),
                    ("status", "publish"),
                    ("password", ""),
                    ("taxonomy_names[post_tag]", ""),
                    ("publish_at", "2026-03-05T09:30"),
                ],
            )
            .await,
        )
        .send()
        .await
        .assert_status(303);
    assert_eq!(
        stored().await,
        Some(
            chrono::NaiveDate::from_ymd_opt(2026, 3, 5)
                .unwrap()
                .and_hms_opt(9, 30, 0)
                .unwrap()
        ),
        "a date the editor actually typed is applied"
    );
}

/// A nested item of a hierarchical custom type stays reachable.
///
/// A custom type is addressed as `/{archive_base}/{slug}` with no ancestry
/// walk, and `idx_posts_type_slug` makes `(post_type, slug)` unique for it
/// whatever its parent — so there is no ambiguity to resolve. Excluding its
/// nested items from resolution instead 404'd them at the only URL the site
/// ever advertises for them. That exclusion was mine, one round earlier: the
/// rule is about being addressed by a *path*, which is pages, not about having
/// a parent.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_nested_custom_type_item_is_still_reachable() {
    // Registered before the client is built; the registry is process-global.
    // The slug and archive base are deliberately unusual: the registry is
    // process-global, so a type registered here is registered for every test
    // that runs after it, and a base that collides with a slug another test
    // uses changes that test's outcome. `manuals` did exactly that to
    // `an_import_does_not_reparent_a_local_post_that_shares_a_slug`.
    {{crate_name}}::content_types::register_post_type({{crate_name}}::content_types::PostType {
        hierarchical: true,
        archive_base: "runbooks",
        ..{{crate_name}}::content_types::PostType::new("runbook", "Runbook", "Runbooks")
    })
    .expect("runbook registers cleanly");

    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let item = async |title: &str, slug: &str, parent: &str| -> String {
        let mut fields = vec![
            ("title", title),
            ("slug", slug),
            ("excerpt", ""),
            (
                "body",
                if parent.is_empty() {
                    "The parent."
                } else {
                    "The child."
                },
            ),
            ("status", "publish"),
            ("password", ""),
            ("taxonomy_names[post_tag]", ""),
        ];
        if !parent.is_empty() {
            fields.push(("parent_id", parent));
        }
        let response = client
            .post("/admin/content/runbook")
            .header("cookie", &cookie)
            .form(&form(&fields))
            .send()
            .await;
        assert_eq!(response.status, 303, "create {title}: {}", response.text());
        response
            .header("location")
            .expect("redirect")
            .rsplit('/')
            .next()
            .expect("id")
            .to_owned()
    };

    let parent = item("Setup", "setup", "").await;
    item("Wiring", "wiring", &parent).await;

    sign_out(&client);
    // Both at the two-segment shape the permalink builder mints for this type.
    client
        .get("/runbook/setup")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("The parent.");
    client
        .get("/runbook/wiring")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("The child.");
}

/// A hierarchy edit settles every descendant's path, not just its own.
///
/// A page's path is built from its ancestors, so renaming or re-parenting one
/// rewrites the canonical URL of everything under it. `guard_page_path` checked
/// only the edited row, so a rename could hand a *child's* path to the health
/// probe while the parent's own path was fine — the probe then shadows a child
/// the listings and the sitemap keep advertising.
///
/// The paths are asserted rather than the refusal: `CONFIGURED_PROBE_PATHS` is
/// a process-global `OnceLock` that an integration test cannot set
/// deterministically, and a nested probe path is the only way to reach the
/// refusal. That the guard refuses a claimed multi-segment path is covered by
/// `a_claimed_path_is_refused_whatever_mints_it`; what was missing, and what
/// this pins, is that the descendants are in the set at all.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_hierarchy_edit_settles_every_descendant_path() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let page = async |title: &str, slug: &str, parent: &str| -> i64 {
        let mut fields = vec![
            ("title", title),
            ("slug", slug),
            ("excerpt", ""),
            ("body", "Body."),
            ("status", "publish"),
            ("password", ""),
            ("taxonomy_names[post_tag]", ""),
        ];
        if !parent.is_empty() {
            fields.push(("parent_id", parent));
        }
        let response = client
            .post("/admin/content/page")
            .header("cookie", &cookie)
            .form(&form(&fields))
            .send()
            .await;
        assert_eq!(response.status, 303, "create {title}: {}", response.text());
        response
            .header("location")
            .expect("redirect")
            .rsplit('/')
            .next()
            .expect("id")
            .parse()
            .expect("a numeric id")
    };

    let old = page("Old", "old", "").await;
    let status = page("Status", "status", &old.to_string()).await;
    page("Deep", "deep", &status.to_string()).await;

    let paths = {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::content::page_paths_under(&mut conn, old)
            .await
            .expect("the paths")
    };
    let mut rendered: Vec<String> = paths.iter().map(|path| path.join("/")).collect();
    rendered.sort();
    assert_eq!(
        rendered,
        vec!["old/status".to_owned(), "old/status/deep".to_owned()],
        "an edit at the root settles every path beneath it \
         (the root's own path is top-level, so it has none of this shape)"
    );
}

/// A backup carries the discussion, with its nesting and moderation states.
///
/// The envelope had posts, terms and attachments and no comments, so a restore
/// brought a site back with every thread gone and every count at zero — the
/// approved discussion, the moderation queue and the spam decisions a moderator
/// had already made, none of them recoverable from the file.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn an_export_carries_comments_and_an_import_restores_them() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let post_id = create_post(&client, &cookie, "Discussed", "Body.", "publish").await;

    // A registered root, a guest reply under it, and one of each held state.
    try_execute(
        TestDb::shared().await,
        &format!(
            "INSERT INTO comments (post_id, parent_id, author_id, author_name, author_email,
                                   author_url, author_ip, body, status, created_at)
             VALUES ({post_id}, NULL, 1, 'Owner', 'owner@example.com', '', '',
                     'The root', 'approved', NOW() - interval '3 hours')"
        ),
    )
    .await
    .expect("seed the root");
    try_execute(
        TestDb::shared().await,
        &format!(
            "INSERT INTO comments (post_id, parent_id, author_id, author_name, author_email,
                                   author_url, author_ip, body, status, created_at)
             VALUES
               ({post_id}, (SELECT id FROM comments WHERE body = 'The root'), NULL,
                'Guest', 'guest@example.com', '', '', 'A nested reply', 'approved',
                NOW() - interval '2 hours'),
               ({post_id}, NULL, NULL, 'Waiting', 'waiting@example.com', '', '',
                'Held for moderation', 'pending', NOW() - interval '1 hours'),
               ({post_id}, NULL, NULL, 'Spammer', 'spam@example.com', '', '',
                'Buy things', 'spam', NOW())"
        ),
    )
    .await
    .expect("seed the rest");

    let payload = client
        .get("/admin/tools/export")
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .text();
    let parsed: serde_json::Value = serde_json::from_str(&payload).expect("the export parses");
    let comments = &parsed["posts"][0]["comments"];
    assert_eq!(
        comments.as_array().map(Vec::len),
        Some(3),
        "three roots, with the reply nested under one of them:\n{payload}"
    );
    assert!(
        payload.contains("A nested reply") && payload.contains("Buy things"),
        "every state travels, not only the approved ones"
    );

    // Restore into an empty site.
    let fresh = db_client().await;
    let cookie = register(&fresh, "owner").await;
    let result = import_export(&fresh, &cookie, &payload).await;
    result
        .assert_ok()
        .assert_body_contains("restored, moderation states and all");

    let (approved, pending, spam, nested): (i64, i64, i64, i64) = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        let count = async |conn: &mut _, status: &'static str| -> i64 {
            RunQueryDsl::get_result(
                {{crate_name}}::schema::comments::table
                    .filter({{crate_name}}::schema::comments::status.eq(status))
                    .count(),
                conn,
            )
            .await
            .expect("the count")
        };
        let approved = count(&mut conn, "approved").await;
        let pending = count(&mut conn, "pending").await;
        let spam = count(&mut conn, "spam").await;
        let nested: i64 = RunQueryDsl::get_result(
            {{crate_name}}::schema::comments::table
                .filter({{crate_name}}::schema::comments::parent_id.is_not_null())
                .count(),
            &mut conn,
        )
        .await
        .expect("the count");
        (approved, pending, spam, nested)
    };
    assert_eq!(
        (approved, pending, spam, nested),
        (2, 1, 1, 1),
        "every state and the nesting come back"
    );

    // And the post's counter agrees, so the thread renders.
    let count: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        RunQueryDsl::first(
            {{crate_name}}::schema::posts::table
                .filter({{crate_name}}::schema::posts::slug.eq("discussed"))
                .select({{crate_name}}::schema::posts::comment_count),
            &mut conn,
        )
        .await
        .expect("the post")
    };
    assert_eq!(count, 2, "the counter is rebuilt from the approved rows");

    // Re-running does not append a second copy of the thread.
    import_export(&fresh, &cookie, &payload).await.assert_ok();
    let total: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        RunQueryDsl::get_result({{crate_name}}::schema::comments::table.count(), &mut conn)
            .await
            .expect("the count")
    };
    assert_eq!(total, 4, "a second import is a no-op for comments");
}

/// A top-level page resolves even when a nested namesake was created first.
///
/// `idx_pages_parent_slug` scopes a nested page's slug to its parent and
/// `idx_posts_bare_path_slug` only constrains top-level ones, so `/about/team`
/// and `/team` are both legal. `find_by_slug` has no ordering, so taking the
/// first row and *then* asking whether it was top-level 404'd the real `/team`
/// whenever the nested row came back first — which, created first, it does.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_top_level_page_resolves_past_a_nested_namesake() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let page = async |title: &str, slug: &str, parent: &str| -> String {
        let mut fields = vec![
            ("title", title),
            ("slug", slug),
            ("excerpt", ""),
            (
                "body",
                if parent.is_empty() {
                    "Top level."
                } else {
                    "Nested."
                },
            ),
            ("status", "publish"),
            ("password", ""),
            ("taxonomy_names[post_tag]", ""),
        ];
        if !parent.is_empty() {
            fields.push(("parent_id", parent));
        }
        let response = client
            .post("/admin/content/page")
            .header("cookie", &cookie)
            .form(&form(&fields))
            .send()
            .await;
        assert_eq!(response.status, 303, "create {title}: {}", response.text());
        response
            .header("location")
            .expect("redirect")
            .rsplit('/')
            .next()
            .expect("id")
            .to_owned()
    };

    // The nested one first, so it is the row `find_by_slug` returns first.
    let about_id = page("About", "about", "").await;
    page("Team", "team", &about_id).await;
    page("Team", "team", "").await;

    sign_out(&client);
    // Both are reachable at their own canonical URLs.
    client
        .get("/team")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Top level.");
    client
        .get("/about/team")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Nested.");
}

/// A capacity check serializes on something that exists even when the
/// container is empty.
///
/// `FOR UPDATE` over a container's existing children locks nothing while there
/// are none, so concurrent transactions each lock zero rows, each count zero,
/// and each insert — carrying an empty menu or sidebar straight past its bound,
/// which is the one case the check exists for. The menu row and an advisory
/// lock on the sidebar's name are the stable things to serialize on.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_capacity_check_serializes_on_an_empty_container() {
    use diesel_async::RunQueryDsl;

    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    client
        .post("/admin/appearance/menus")
        .header("cookie", &cookie)
        .form(&form(&[("name", "Main"), ("location", "primary")]))
        .send()
        .await
        .assert_status(303);

    // The menu is empty and the sidebar is empty — the state in which locking
    // the children locks nothing at all.
    let mut holder = TestDb::shared().await.pool().get().await.expect("conn");
    diesel::sql_query("BEGIN")
        .execute(&mut holder)
        .await
        .expect("begin");
    // `FOR NO KEY UPDATE`, not `FOR UPDATE`. The insert's foreign key takes
    // `FOR KEY SHARE` on the menu row, which conflicts with `FOR UPDATE` — so
    // holding that would block the insert whether or not it takes the row lock
    // deliberately, and the test would pass against the bug. `NO KEY UPDATE` is
    // compatible with key share and conflicts only with the explicit
    // `FOR UPDATE` the capacity check now takes.
    diesel::sql_query("SELECT id FROM menus WHERE id = 1 FOR NO KEY UPDATE")
        .execute(&mut holder)
        .await
        .expect("hold the menu row");

    let blocked = tokio::time::timeout(std::time::Duration::from_millis(750), async {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::content::insert_menu_item(
            &mut conn,
            {{crate_name}}::models::NewMenuItem {
                menu_id: 1,
                parent_id: None,
                label: "Home".to_owned(),
                url: "/".to_owned(),
                post_id: None,
                term_id: None,
                position: 0,
            },
            100,
        )
        .await
    })
    .await;
    assert!(
        blocked.is_err(),
        "the insert must wait on the menu row, not race past an empty menu"
    );
    diesel::sql_query("COMMIT")
        .execute(&mut holder)
        .await
        .expect("release the menu row");

    // The sidebar's advisory lock, held from a session so an `xact` lock waits
    // on it — the same trick the hierarchy-lock test uses.
    let mut holder = TestDb::shared().await.pool().get().await.expect("conn");
    diesel::sql_query("SELECT pg_advisory_lock(7717260, hashtext('primary'))")
        .execute(&mut holder)
        .await
        .expect("hold the sidebar");
    let blocked = tokio::time::timeout(std::time::Duration::from_millis(750), async {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::content::insert_widget(
            &mut conn,
            {{crate_name}}::models::NewWidget {
                sidebar: "primary".to_owned(),
                kind: "search".to_owned(),
                title: "Search".to_owned(),
                settings: serde_json::json!({}),
                position: 0,
            },
            30,
        )
        .await
    })
    .await;
    assert!(
        blocked.is_err(),
        "the insert must wait on the sidebar's lock, not race past an empty sidebar"
    );
    diesel::sql_query("SELECT pg_advisory_unlock(7717260, hashtext('primary'))")
        .execute(&mut holder)
        .await
        .expect("release the sidebar");

    // Released, both go through.
    {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::content::insert_widget(
            &mut conn,
            {{crate_name}}::models::NewWidget {
                sidebar: "primary".to_owned(),
                kind: "search".to_owned(),
                title: "Search".to_owned(),
                settings: serde_json::json!({}),
                position: 0,
            },
            30,
        )
        .await
        .expect("the insert proceeds once the lock is free");
    }
}

/// The seed leaves an occupied primary location alone.
///
/// The check asked for a menu whose *slug* was `primary`, but
/// `idx_menus_location` constrains the *location* — so a site whose primary
/// menu is named anything else read as having none, and the insert violated the
/// index. The settings, terms and posts are already committed by then, so the
/// task reported failure over a half-seeded site and failed the same way on
/// every retry.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn the_seed_leaves_an_occupied_menu_location_alone() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    // A menu at `primary` whose slug is anything but `primary`.
    client
        .post("/admin/appearance/menus")
        .header("cookie", &cookie)
        .form(&form(&[("name", "Main"), ("location", "primary")]))
        .send()
        .await
        .assert_status(303);

    {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::seed::seed_site(&mut conn)
            .await
            .expect("the seed must not fail over a menu that is already there");
    }

    let at_primary: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        RunQueryDsl::get_result(
            {{crate_name}}::schema::menus::table
                .filter({{crate_name}}::schema::menus::location.eq("primary"))
                .count(),
            &mut conn,
        )
        .await
        .expect("the count")
    };
    assert_eq!(at_primary, 1, "and does not add a second one");
}

/// Changing and deleting accounts are authorized against the actor's current
/// row too, not only creation.
///
/// `with_administrator_guard` locked and reloaded the *target* and never the
/// actor, so an administrator demoted or deleted while their request was in
/// flight could still promote an account they control and keep privileged
/// access through it. Fixing only `create_user_as` last round left the two
/// paths that already had a guard still deciding on the session's stale copy.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn managing_accounts_is_authorized_against_the_actors_current_row() {
    use diesel::prelude::*;
    use diesel_async::RunQueryDsl;

    let client = db_client().await;
    let _owner = register(&client, "owner").await;
    let _second = register(&client, "second").await;
    let _third = register(&client, "third").await;
    try_execute(
        TestDb::shared().await,
        "UPDATE users SET role = 'administrator' WHERE username IN ('second', 'third')",
    )
    .await
    .expect("promote");

    let id_of = async |username: &'static str| -> i64 {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        RunQueryDsl::first(
            {{crate_name}}::schema::users::table
                .filter({{crate_name}}::schema::users::username.eq(username))
                .select({{crate_name}}::schema::users::id),
            &mut conn,
        )
        .await
        .expect("the account")
    };
    let actor_id = id_of("second").await;
    let target_id = id_of("third").await;

    // Revoked while the request was in flight.
    try_execute(
        TestDb::shared().await,
        &format!("UPDATE users SET role = 'subscriber' WHERE id = {actor_id}"),
    )
    .await
    .expect("demote the actor");

    // A role change: the promotion the finding describes.
    let updated = {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::content::update_user(
            &mut conn,
            actor_id,
            target_id,
            {{crate_name}}::content::UserEdit {
                role: {{crate_name}}::capabilities::Role::Administrator,
                email: "third@example.com".to_owned(),
                display_name: "Third".to_owned(),
                bio: String::new(),
                website: String::new(),
            },
        )
        .await
    };
    assert_eq!(
        updated
            .expect_err("a revoked actor may not change roles")
            .status(),
        autumn_web::prelude::StatusCode::FORBIDDEN
    );

    // And a deletion, which is a demotion to no role at all.
    let deleted = {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::content::delete_user(&mut conn, actor_id, target_id).await
    };
    assert_eq!(
        deleted
            .expect_err("a revoked actor may not delete accounts")
            .status(),
        autumn_web::prelude::StatusCode::FORBIDDEN
    );

    let (role, present): (String, i64) = {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        let role: String = RunQueryDsl::first(
            {{crate_name}}::schema::users::table
                .find(target_id)
                .select({{crate_name}}::schema::users::role),
            &mut conn,
        )
        .await
        .expect("the target");
        let present: i64 =
            RunQueryDsl::get_result({{crate_name}}::schema::users::table.find(target_id).count(), &mut conn)
                .await
                .expect("the count");
        (role, present)
    };
    assert_eq!(role, "administrator", "the target is unchanged");
    assert_eq!(present, 1, "and still there");
}

/// Creating an account is authorized against the actor's current row.
///
/// The handler's capability check runs at the start of a request that then
/// spends hundreds of milliseconds hashing a password — the cost is the point
/// of bcrypt, and it is a wide window. The account being created can carry any
/// role, so an administrator demoted or deleted while their request was hashing
/// could otherwise still mint a fresh administrator and keep privileged access
/// through it.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn creating_an_account_is_authorized_against_the_actors_current_row() {
    use diesel::prelude::*;
    use diesel_async::RunQueryDsl;

    let client = db_client().await;
    let _owner = register(&client, "owner").await;
    let demoted = register(&client, "second").await;
    try_execute(
        TestDb::shared().await,
        "UPDATE users SET role = 'administrator' WHERE username = 'second'",
    )
    .await
    .expect("promote the second account");
    let actor_id: i64 = {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        RunQueryDsl::first(
            {{crate_name}}::schema::users::table
                .filter({{crate_name}}::schema::users::username.eq("second"))
                .select({{crate_name}}::schema::users::id),
            &mut conn,
        )
        .await
        .expect("the actor")
    };

    // Demoted after the session was established — which is exactly the state a
    // request that started before the demotion is holding.
    try_execute(
        TestDb::shared().await,
        &format!("UPDATE users SET role = 'subscriber' WHERE id = {actor_id}"),
    )
    .await
    .expect("demote the actor");

    // The content layer is the subject: the handler would refuse this on its
    // own check, and what has to hold is that the *write* refuses too, however
    // stale the caller's authority turns out to be.
    let outcome = {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::content::create_user_as(
            &mut conn,
            actor_id,
            {{crate_name}}::models::NewUser {
                username: "planted".to_owned(),
                email: "planted@example.com".to_owned(),
                password_hash: "x".repeat(60),
                display_name: "Planted".to_owned(),
                role: "administrator".to_owned(),
                bio: String::new(),
                website: String::new(),
            },
        )
        .await
    };
    let error = outcome.expect_err("a demoted account may not mint an administrator");
    assert_eq!(
        error.status(),
        autumn_web::prelude::StatusCode::FORBIDDEN,
        "and is told so: {error}"
    );

    let planted: i64 = {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        RunQueryDsl::get_result(
            {{crate_name}}::schema::users::table
                .filter({{crate_name}}::schema::users::username.eq("planted"))
                .count(),
            &mut conn,
        )
        .await
        .expect("the count")
    };
    assert_eq!(planted, 0, "and no account was created");

    // A deleted actor has no authority either — a missing row is a refusal, not
    // a fall-through.
    try_execute(
        TestDb::shared().await,
        &format!("UPDATE users SET role = 'administrator' WHERE id = {actor_id}"),
    )
    .await
    .expect("restore the role");
    let ok = {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::content::create_user_as(
            &mut conn,
            actor_id,
            {{crate_name}}::models::NewUser {
                username: "legitimate".to_owned(),
                email: "legitimate@example.com".to_owned(),
                password_hash: "x".repeat(60),
                display_name: "Legitimate".to_owned(),
                role: "editor".to_owned(),
                bio: String::new(),
                website: String::new(),
            },
        )
        .await
    };
    ok.expect("an administrator may still create accounts");
    let _ = demoted;
}

/// The edit path authorizes against the row as locked, not against what a
/// caller checked earlier.
///
/// The handler's `can_edit_post` runs on a connection released before the
/// save's transaction opens, and `lock_version` cannot stand in for it: it is
/// form data, so a crafted request names the version the row will have *after*
/// the transition it is racing. This asserts the guarantee at the function that
/// does the write, because that is where it has to hold — see the review thread
/// for why the end-to-end request is refused a step earlier today, and why
/// depending on that is the shape this PR keeps finding.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn the_edit_path_refuses_an_actor_the_locked_row_forbids() {
    use diesel::prelude::*;
    use diesel_async::RunQueryDsl;

    let client = db_client().await;
    let owner = register(&client, "owner").await;

    // Published, and authored by the administrator — so a Contributor may edit
    // it on neither count. Created before the second account registers, because
    // registering rotates the session the first cookie names.
    let id = create_post(&client, &owner, "Theirs", "Not yours.", "publish").await;

    let _contributor = register(&client, "scribe").await;
    try_execute(
        TestDb::shared().await,
        "UPDATE users SET role = 'contributor' WHERE username = 'scribe'",
    )
    .await
    .expect("demote to contributor");

    let contributor: {{crate_name}}::models::User = {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        RunQueryDsl::first(
            {{crate_name}}::schema::users::table
                .filter({{crate_name}}::schema::users::username.eq("scribe"))
                .select({{crate_name}}::models::User::as_select()),
            &mut conn,
        )
        .await
        .expect("the contributor")
    };

    let outcome = {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::content::update_post_with_revision(
            &mut conn,
            id,
            {{crate_name}}::content::EditContext {
                editor_id: contributor.id,
                summary: "Edited".to_owned(),
                // `None`, so nothing but the authorization check can refuse
                // this — a mismatched version would be a different answer.
                expected_lock_version: None,
                record_revision: false,
                may_touch_hierarchy: false,
                actor: Some(contributor.clone()),
            },
            |post| post.body = "Overwritten.".to_owned(),
        )
        .await
    };
    let error = outcome.expect_err("a Contributor may not edit somebody else's published post");
    assert_eq!(
        error.status(),
        autumn_web::prelude::StatusCode::FORBIDDEN,
        "and is told so rather than getting a generic failure: {error}"
    );

    let body: String = {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        RunQueryDsl::first(
            {{crate_name}}::schema::posts::table
                .find(id)
                .select({{crate_name}}::schema::posts::body),
            &mut conn,
        )
        .await
        .expect("the post")
    };
    assert_eq!(body, "Not yours.", "and nothing was written");

    // The same call by an actor who *is* allowed goes through, so the check is
    // a real predicate rather than a blanket refusal.
    let owner_user: {{crate_name}}::models::User = {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        RunQueryDsl::first(
            {{crate_name}}::schema::users::table
                .filter({{crate_name}}::schema::users::username.eq("owner"))
                .select({{crate_name}}::models::User::as_select()),
            &mut conn,
        )
        .await
        .expect("the owner")
    };
    {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::content::update_post_with_revision(
            &mut conn,
            id,
            {{crate_name}}::content::EditContext {
                editor_id: owner_user.id,
                summary: "Edited".to_owned(),
                expected_lock_version: None,
                record_revision: false,
                may_touch_hierarchy: false,
                actor: Some(owner_user.clone()),
            },
            |post| post.body = "Theirs to write.".to_owned(),
        )
        .await
        .expect("an administrator may edit it");
    }
}

/// A menu cannot accept an item it will never show.
///
/// The management screen and the navigation both read the first
/// `MENU_ITEMS_SHOWN` items, so an unbounded insert behind that bounded read
/// produced an item that appears nowhere and has no delete control — reachable
/// only by removing a visible one first.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_menu_refuses_an_item_it_cannot_show() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    client
        .post("/admin/appearance/menus")
        .header("cookie", &cookie)
        .form(&form(&[("name", "Main"), ("location", "primary")]))
        .send()
        .await
        .assert_status(303);

    // Fill the menu to the bound, directly — a hundred form posts is the test's
    // runtime, not its subject.
    try_execute(
        TestDb::shared().await,
        "INSERT INTO menu_items (menu_id, parent_id, label, url, position)
         SELECT 1, NULL, 'Item ' || g, '/', 0 FROM generate_series(1, 100) AS g",
    )
    .await
    .expect("fill the menu");

    let refused = client
        .post("/admin/appearance/menus/1/items")
        .header("cookie", &cookie)
        .form(&form(&[
            ("label", "One too many"),
            ("url", "/late"),
            ("parent_id", ""),
            ("post_id", ""),
            ("term_id", ""),
            ("position", "0"),
        ]))
        .send()
        .await;
    assert_ne!(
        refused.status, 303,
        "an item past the bound must be refused, not silently hidden"
    );
    assert!(
        refused.text().contains("Remove one"),
        "and must say how to make room:\n{}",
        refused.text()
    );
}

/// A sidebar cannot accept a widget it will never show.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_sidebar_refuses_a_widget_it_cannot_show() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    try_execute(
        TestDb::shared().await,
        "INSERT INTO widgets (sidebar, kind, title, settings, position)
         SELECT 'primary', 'text', 'Widget ' || g, '{\"text\":\"x\"}'::jsonb, 0
         FROM generate_series(1, 30) AS g",
    )
    .await
    .expect("fill the sidebar");

    let refused = client
        .post("/admin/appearance/widgets")
        .header("cookie", &cookie)
        .form(&form(&[
            ("kind", "text"),
            ("title", "One too many"),
            ("text", "Invisible."),
            ("count", "5"),
            ("taxonomy", "category"),
            ("position", "0"),
        ]))
        .send()
        .await;
    assert_ne!(
        refused.status, 303,
        "a widget past the bound must be refused, not silently hidden"
    );
    assert!(
        refused.text().contains("Remove one"),
        "and must say how to make room:\n{}",
        refused.text()
    );
}

/// A menu-slug race allocates the next suffix rather than reporting a conflict.
///
/// Allocation is a read followed by a write, so two administrators creating
/// same-named menus at once can both read the same taken set and pick the same
/// suffix. The unique index catches the loser — and reporting that told them
/// the *name* was unavailable, which is wrong (duplicate names are supported)
/// and unactionable, since only the invisible slug collided.
///
/// Held deterministically: a competing row is inserted and left uncommitted, so
/// the allocator cannot see it but the index still blocks the insert; committing
/// the competitor then turns that block into the collision.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_menu_slug_race_takes_the_next_suffix() {
    use diesel_async::RunQueryDsl;

    let client = db_client().await;
    let _cookie = register(&client, "owner").await;

    // The competitor: `main` is taken, but not yet visible to anyone else.
    let mut competitor = TestDb::shared().await.pool().get().await.expect("conn");
    diesel::sql_query("BEGIN")
        .execute(&mut competitor)
        .await
        .expect("begin");
    diesel::sql_query("INSERT INTO menus (name, slug, location) VALUES ('Main', 'main', '')")
        .execute(&mut competitor)
        .await
        .expect("the competing insert");

    // This one reads a taken set without `main` in it, picks `main`, and blocks
    // on the index behind the uncommitted row.
    let creating = tokio::spawn(async move {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::content::replace_menu_at_location(&mut conn, "Main", "").await
    });

    wait_for_a_blocked_backend().await;
    diesel::sql_query("COMMIT")
        .execute(&mut competitor)
        .await
        .expect("commit");

    creating
        .await
        .expect("the task")
        .expect("a lost slug race is not a conflict to report");

    let slugs: Vec<String> = {
        use diesel::QueryDsl as _;
        use diesel::prelude::ExpressionMethods as _;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        diesel_async::RunQueryDsl::load(
            {{crate_name}}::schema::menus::table
                .order({{crate_name}}::schema::menus::id.asc())
                .select({{crate_name}}::schema::menus::slug),
            &mut conn,
        )
        .await
        .expect("the menus")
    };
    assert_eq!(
        slugs,
        vec!["main".to_owned(), "main-2".to_owned()],
        "the loser takes the next suffix"
    );
}

/// Two menus may share a name.
///
/// `menus.slug` is `NOT NULL UNIQUE` and `slugify(name)` was the whole
/// allocator, so a second menu called "Main" was refused — and refused with the
/// location-race message, which told an administrator who had simply reused a
/// name that somebody else was editing at the same moment. A message that is
/// confidently wrong sends them looking for a conflict that is not there.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn two_menus_may_share_a_name() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    for location in ["primary", "footer"] {
        client
            .post("/admin/appearance/menus")
            .header("cookie", &cookie)
            .form(&form(&[("name", "Main"), ("location", location)]))
            .send()
            .await
            .assert_status(303);
    }

    let slugs: Vec<String> = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::menus::table
            .order({{crate_name}}::schema::menus::id.asc())
            .select({{crate_name}}::schema::menus::slug)
            .load(&mut conn)
            .await
            .expect("the menus")
    };
    assert_eq!(
        slugs,
        vec!["main".to_owned(), "main-2".to_owned()],
        "the second menu takes a suffix rather than being refused"
    );

    // And the location index still says what it means when it is the one that
    // fires: assigning a third menu to a location an existing one holds detaches
    // the incumbent rather than erroring.
    client
        .post("/admin/appearance/menus")
        .header("cookie", &cookie)
        .form(&form(&[("name", "Main"), ("location", "primary")]))
        .send()
        .await
        .assert_status(303);
}

/// A download keeps the uploaded file's extension.
///
/// `display_title` strips it before it becomes `attachment.title`, and the
/// `Content-Disposition` filename was that title — so clicking View on
/// `report.csv` saved a file called `report`, which the operating system no
/// longer knows what to open.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_download_is_named_with_its_extension() {
    let db = TestDb::shared().await;
    let _ = db_client().await;
    let uploads = std::env::temp_dir().join(format!(
        "cms-download-test-{}",
        std::time::SystemTime::now()
            .duration_since(std::time::UNIX_EPOCH)
            .expect("clock")
            .as_nanos()
    ));
    std::fs::create_dir_all(&uploads).expect("create the blob store root");
    let mut config = AutumnConfig::default();
    config.security.csrf.enabled = false;
    config.security.submit_token.enabled = false;
    let store = autumn_web::storage::LocalBlobStore::new(
        "default".to_owned(),
        uploads.clone(),
        "/_blobs".to_owned(),
        std::time::Duration::from_secs(900),
        autumn_web::storage::local::SigningKey::new(b"cms-download-test-key".to_vec()),
        Vec::new(),
    )
    .expect("local blob store");
    let client = TestApp::new()
        .routes(app_routes())
        .config(config)
        .with_db(db.pool())
        .state_initializer(move |state| {
            state.insert_extension::<autumn_web::storage::BlobStoreState>(
                autumn_web::storage::BlobStoreState::new(std::sync::Arc::new(store)),
            );
        })
        .build();
    let cookie = register(&client, "owner").await;

    // `text/csv` is on the allow-list and never renders inline, so this is the
    // forced-download path.
    let boundary = "----cmsdownload";
    let payload = format!(
        "--{boundary}\r\nContent-Disposition: form-data; name=\"file\"; \
         filename=\"report.csv\"\r\nContent-Type: text/csv\r\n\r\nid,name\r\n\
         --{boundary}--\r\n"
    );
    client
        .post("/admin/media")
        .header("cookie", &cookie)
        .header(
            "content-type",
            &format!("multipart/form-data; boundary={boundary}"),
        )
        .body(payload)
        .send()
        .await
        .assert_status(303);

    let slug: String = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = db.pool().get().await.expect("conn");
        {{crate_name}}::schema::attachments::table
            .select({{crate_name}}::schema::attachments::slug)
            .first(&mut conn)
            .await
            .expect("the attachment")
    };
    assert!(
        slug.ends_with(".csv"),
        "the key keeps the extension: {slug}"
    );

    let served = client.get(&format!("/media/{slug}")).send().await;
    let disposition = served
        .assert_ok()
        .header("content-disposition")
        .expect("a disposition header");
    assert!(
        disposition.contains("attachment"),
        "a csv is a download, not an inline render: {disposition}"
    );
    assert!(
        disposition.contains("report.csv"),
        "the saved file must keep its extension: {disposition}"
    );

    std::fs::remove_dir_all(&uploads).ok();
}

/// A second `file` part is refused rather than orphaning a blob.
///
/// Every `file` field was written to the blob store but only the last got an
/// attachment row, so the earlier objects were unreachable from the media
/// library and undeletable through the UI — repeatable, so an Author could
/// consume storage indefinitely.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_second_file_part_is_refused() {
    // This is the one test that needs a blob store, so it builds its own app
    // rather than making every other test carry one.
    let db = TestDb::shared().await;
    let _ = db_client().await; // migrate + truncate through the shared path
    // A plain temp directory rather than a `tempfile` dev-dependency: the
    // starter ships its own `Cargo.toml.tmpl`, so a new dev-dependency here
    // would have to be added there too or the scaffolded project would not
    // build its tests.
    let uploads = std::env::temp_dir().join(format!(
        "cms-upload-test-{}",
        std::time::SystemTime::now()
            .duration_since(std::time::UNIX_EPOCH)
            .expect("clock")
            .as_nanos()
    ));
    std::fs::create_dir_all(&uploads).expect("create the blob store root");
    let mut config = AutumnConfig::default();
    config.security.csrf.enabled = false;
    config.security.submit_token.enabled = false;
    // `TestApp` does not run the storage preflight that `App::run` does, so the
    // store is mounted onto the state directly.
    let store = autumn_web::storage::LocalBlobStore::new(
        "default".to_owned(),
        uploads.clone(),
        "/_blobs".to_owned(),
        std::time::Duration::from_secs(900),
        autumn_web::storage::local::SigningKey::new(b"cms-upload-test-key".to_vec()),
        Vec::new(),
    )
    .expect("local blob store");
    let client = TestApp::new()
        .routes(app_routes())
        .config(config)
        .with_db(db.pool())
        .state_initializer(move |state| {
            state.insert_extension::<autumn_web::storage::BlobStoreState>(
                autumn_web::storage::BlobStoreState::new(std::sync::Arc::new(store)),
            );
        })
        .build();
    let cookie = register(&client, "owner").await;

    let boundary = "----cmsboundary";
    let part = |name: &str, body: &str| {
        format!(
            "--{boundary}\r\nContent-Disposition: form-data; name=\"file\"; \
             filename=\"{name}\"\r\nContent-Type: text/plain\r\n\r\n{body}\r\n"
        )
    };
    let payload = format!(
        "{}{}--{boundary}--\r\n",
        part("one.txt", "first"),
        part("two.txt", "second")
    );

    let refused = client
        .post("/admin/media")
        .header("cookie", &cookie)
        .header(
            "content-type",
            &format!("multipart/form-data; boundary={boundary}"),
        )
        .body(payload)
        .send()
        .await;
    assert_eq!(
        refused.status,
        422,
        "a second file part must be refused: {}",
        refused.text()
    );

    // Nothing was recorded, so nothing was stored under a row-less key either.
    let library = client
        .get("/admin/media")
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .text();
    assert!(!library.contains("one.txt"));
    assert!(!library.contains("two.txt"));
}

/// A featured image survives an export round trip.
///
/// The export carried no attachment reference, so a restore silently dropped
/// every featured image — and without the metadata rows, body links to
/// `/media/{slug}` had nothing to resolve against either.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn an_export_round_trip_keeps_featured_media() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    // An attachment and a post that features it. Written directly because a
    // multipart upload is not what this test is about.
    let db = TestDb::shared().await;
    try_execute(
        db,
        "INSERT INTO attachments (title, slug, file, mime_type, byte_size, alt_text, caption) \
         VALUES ('Cover', 'cover-image', \
                 '{\"provider_id\":\"default\",\"key\":\"media/cover-image\",\
                   \"content_type\":\"image/png\",\"byte_size\":1234}'::jsonb, \
                 'image/png', 1234, 'A cover', '')",
    )
    .await
    .expect("insert attachment");
    let id = create_post(&client, &cookie, "Illustrated", "Body.", "publish").await;
    try_execute(
        db,
        &format!(
            "UPDATE posts SET featured_media_id = (SELECT id FROM attachments \
             WHERE slug = 'cover-image') WHERE id = {id}"
        ),
    )
    .await
    .expect("attach the image");

    // The export carries both halves.
    let exported = client
        .get("/admin/tools/export")
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .text();
    let payload: serde_json::Value = serde_json::from_str(&exported).expect("valid export JSON");
    assert_eq!(payload["version"], serde_json::json!(5));
    assert_eq!(
        payload["attachments"][0]["slug"],
        serde_json::json!("cover-image")
    );
    // The handle, not just the display metadata: without the provider and key
    // a restored row cannot name its bytes, so restoring the separately
    // backed-up blob store would fix nothing and `/media/{slug}` would 500.
    assert_eq!(
        payload["attachments"][0]["file"]["key"],
        serde_json::json!("media/cover-image"),
        "the export must carry the blob handle: {}",
        payload["attachments"][0]
    );
    let post = payload["posts"]
        .as_array()
        .expect("posts")
        .iter()
        .find(|p| p["slug"] == serde_json::json!("illustrated"))
        .expect("the post is in the export");
    assert_eq!(post["featured_media"], serde_json::json!("cover-image"));

    // Importing it into a site that has neither restores both and re-attaches.
    let fresh = db_client().await;
    let cookie = register(&fresh, "owner").await;
    import_export(&fresh, &cookie, exported.as_str())
        .await
        .assert_ok()
        .assert_body_contains("1 imported");

    let editor = fresh
        .get("/admin/content/post/1")
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .text();
    assert!(
        editor.contains("cover-image") || editor.contains("Cover"),
        "the restored post must still name its featured image:\n{editor}"
    );

    // And the restored row points at the same bytes it always did.
    let restored = fresh
        .get("/admin/tools/export")
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .text();
    let restored: serde_json::Value = serde_json::from_str(&restored).expect("valid JSON");
    assert_eq!(
        restored["attachments"][0]["file"]["key"],
        serde_json::json!("media/cover-image"),
        "the import must restore the handle, not only the metadata: {}",
        restored["attachments"][0]
    );
}

/// A crafted `categories` value cannot file a post under an unrelated taxonomy.
///
/// The ids went straight into `set_post_terms`, which checks neither the term's
/// taxonomy nor whether that taxonomy applies to this post type — so an Author
/// could attach a post to a taxonomy registered for something else, after which
/// that taxonomy's public archive listed it.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_crafted_category_id_from_another_taxonomy_is_ignored() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let id = create_post(&client, &cookie, "Ordinary", "Body.", "publish").await;

    // A term in a taxonomy that does not apply to `post`.
    let db = TestDb::shared().await;
    try_execute(
        db,
        "INSERT INTO terms (taxonomy, name, slug, description) \
         VALUES ('shelf', 'Reference', 'reference', '')",
    )
    .await
    .expect("insert the foreign term");

    // A real category, so the test proves filtering rather than refusal.
    client
        .post("/admin/terms/category")
        .header("cookie", &cookie)
        .form(&form(&[
            ("name", "News"),
            ("slug", ""),
            ("description", ""),
            ("parent_id", ""),
        ]))
        .send()
        .await
        .assert_status(303);

    let categories: serde_json::Value = client
        .get("/api/v1/terms?taxonomy=category")
        .send()
        .await
        .assert_ok()
        .json();
    let news_id = categories.as_array().expect("array")[0]["id"]
        .as_i64()
        .expect("id")
        .to_string();
    let foreign_id = (news_id.parse::<i64>().expect("id") + 1).to_string();

    client
        .post(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .form(
            &edit_form(
                &id,
                &[
                    ("title", "Ordinary"),
                    ("slug", "ordinary"),
                    ("excerpt", ""),
                    ("body", "Body."),
                    ("status", "publish"),
                    ("password", ""),
                    ("taxonomy_names[post_tag]", ""),
                    ("comment_status", "open"),
                    ("taxonomies[category]", news_id.as_str()),
                    ("taxonomies[category]", foreign_id.as_str()),
                ],
            )
            .await,
        )
        .send()
        .await
        .assert_status(303);

    // The legitimate category stuck; the foreign one did not.
    let filed = try_execute(
        db,
        &format!(
            "SELECT 1/COUNT(*) FROM post_terms pt JOIN terms t ON t.id = pt.term_id \
             WHERE pt.post_id = {id} AND t.taxonomy = 'category'"
        ),
    )
    .await;
    assert!(filed.is_ok(), "the real category must have been applied");

    let foreign = try_execute(
        db,
        &format!(
            "SELECT 1/COUNT(*) FROM post_terms pt JOIN terms t ON t.id = pt.term_id \
             WHERE pt.post_id = {id} AND t.taxonomy = 'shelf'"
        ),
    )
    .await;
    assert!(
        foreign.is_err(),
        "a term from a taxonomy that does not apply to `post` must be ignored"
    );
}

/// The `the_excerpt` filter reaches actual output.
///
/// The hook is documented and was applied nowhere outside its own unit test, so
/// a plugin registering it silently did nothing for visitors.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn the_excerpt_filter_reaches_rendered_output() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    create_post(
        &client,
        &cookie,
        "Filtered",
        "The body that becomes an excerpt.",
        "publish",
    )
    .await;

    // `bootstrap` registers a `TheContent` filter turning ` -- ` into an em
    // dash; the excerpt hook needs its own evidence, so register one here. The
    // registry is process-global, so this deliberately uses a marker no other
    // test asserts the absence of.
    {{crate_name}}::plugins::add_filter(
        {{crate_name}}::plugins::Filter::TheExcerpt,
        {{crate_name}}::plugins::DEFAULT_PRIORITY,
        |excerpt| format!("{excerpt} [EXCERPT-FILTER-RAN]"),
    );

    sign_out(&client);
    // The listing card…
    client
        .get("/")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("[EXCERPT-FILTER-RAN]");
    // …the feed…
    client
        .get("/feed")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("[EXCERPT-FILTER-RAN]");
    // …and the REST projection.
    let api: serde_json::Value = client.get("/api/v1/posts").send().await.assert_ok().json();
    assert!(
        api.as_array().expect("array")[0]["excerpt"]
            .as_str()
            .unwrap_or_default()
            .contains("[EXCERPT-FILTER-RAN]"),
        "the API projection must apply the filter too: {api}"
    );
}

/// Ticking a category box saves the post.
///
/// The editor's category checkboxes post the same key repeatedly, and `Form<T>`
/// decodes bodies through `serde_urlencoded`, which has no repeated-key rule —
/// so checking a single box failed the whole save with "invalid type: string,
/// expected a sequence". Category assignment did not work at all through the
/// admin UI, and none of the suite's other tests ever ticked a box.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn checking_a_category_box_saves_the_post() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let id = create_post(&client, &cookie, "Categorised", "Body.", "publish").await;

    for name in ["News", "Reviews"] {
        client
            .post("/admin/terms/category")
            .header("cookie", &cookie)
            .form(&form(&[
                ("name", name),
                ("slug", ""),
                ("description", ""),
                ("parent_id", ""),
            ]))
            .send()
            .await
            .assert_status(303);
    }
    let categories: serde_json::Value = client
        .get("/api/v1/terms?taxonomy=category")
        .send()
        .await
        .assert_ok()
        .json();
    let ids: Vec<String> = categories
        .as_array()
        .expect("array")
        .iter()
        .map(|t| t["id"].as_i64().expect("id").to_string())
        .collect();
    assert_eq!(ids.len(), 2);

    // One box…
    let mut fields = vec![
        ("title", "Categorised"),
        ("slug", "categorised"),
        ("excerpt", ""),
        ("body", "Body."),
        ("status", "publish"),
        ("password", ""),
        ("taxonomy_names[post_tag]", ""),
        ("comment_status", "open"),
        ("taxonomies[category]", ids[0].as_str()),
    ];
    client
        .post(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .form(&edit_form(&id, &fields).await)
        .send()
        .await
        .assert_status(303);

    // …and two, which is the shape a checkbox group actually posts.
    fields.push(("taxonomies[category]", ids[1].as_str()));
    client
        .post(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .form(&edit_form(&id, &fields).await)
        .send()
        .await
        .assert_status(303);

    // Both archives list it.
    sign_out(&client);
    for slug in ["news", "reviews"] {
        client
            .get(&format!("/category/{slug}"))
            .send()
            .await
            .assert_ok()
            .assert_body_contains("Categorised");
    }
}

/// The editor offers only statuses the state machine can actually reach.
///
/// The dropdown listed every status, but the graph declares no `publish ->
/// pending` or `publish -> future` edge — so choosing either was rejected after
/// the UI had explicitly offered it.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn the_editor_offers_only_reachable_statuses() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let id = create_post(&client, &cookie, "Live", "Body.", "publish").await;

    let editor = client
        .get(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .text();

    // From `publish` the graph declares draft, private and trash. The dropdown
    // shows the reachable ones plus "stay put".
    assert!(
        editor.contains(r#"value="publish""#),
        "staying put is an option"
    );
    assert!(
        editor.contains(r#"value="draft""#),
        "publish -> draft is declared"
    );
    assert!(
        editor.contains(r#"value="private""#),
        "publish -> private is declared"
    );
    // …and hides the two the graph does not declare.
    assert!(
        !editor.contains(r#"value="pending""#),
        "publish -> pending is not a declared edge:\n{editor}"
    );
    assert!(
        !editor.contains(r#"value="future""#),
        "publish -> future is not a declared edge:\n{editor}"
    );

    // A draft still offers the full publisher set.
    let draft = create_post(&client, &cookie, "Unpublished", "Body.", "draft").await;
    let editor = client
        .get(&format!("/admin/content/post/{draft}"))
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .text();
    for value in ["draft", "pending", "publish", "private", "future"] {
        assert!(
            editor.contains(&format!(r#"value="{value}""#)),
            "a draft can reach `{value}`"
        );
    }
}

/// Re-approving an already-approved comment fires nothing a second time.
///
/// `moderate_comment` returns the unchanged row for an idempotent request, but
/// the handler checked only the resulting status — so a retry or double-click
/// dispatched `CommentApproved` again and plugins enqueued duplicate work.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn re_approving_a_comment_is_idempotent() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let post_id = create_post(&client, &cookie, "Discussed", "Body.", "publish").await;

    sign_out(&client);
    client
        .post(&format!("/comments/{post_id}"))
        .form(&form(&[
            ("body", "Held for review"),
            ("author_name", "Guest"),
            ("author_email", "guest@example.com"),
        ]))
        .send()
        .await
        .assert_status(303);

    // Approve it three times; the counter must not drift.
    for _ in 0..3 {
        client
            .post("/admin/comments/1/status?to=approved")
            .header("cookie", &cookie)
            .send()
            .await
            .assert_status(303);
    }

    sign_out(&client);
    client
        .get("/discussed")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("1 comment")
        .assert_body_contains("Held for review");
}

/// A sticky post comes back sticky.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn an_export_round_trip_keeps_the_sticky_flag() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let id = create_post(&client, &cookie, "Pinned", "Body.", "publish").await;
    try_execute(
        TestDb::shared().await,
        &format!("UPDATE posts SET sticky = true WHERE id = {id}"),
    )
    .await
    .expect("pin the post");

    let exported = client
        .get("/admin/tools/export")
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .text();
    let payload: serde_json::Value = serde_json::from_str(&exported).expect("valid JSON");
    assert_eq!(
        payload["posts"][0]["sticky"],
        serde_json::json!(true),
        "the export must carry the flag: {}",
        payload["posts"][0]
    );

    let fresh = db_client().await;
    let cookie = register(&fresh, "owner").await;
    import_export(&fresh, &cookie, exported.as_str())
        .await
        .assert_ok()
        .assert_body_contains("1 imported");

    let restored = fresh
        .get("/admin/tools/export")
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .text();
    let restored: serde_json::Value = serde_json::from_str(&restored).expect("valid JSON");
    assert_eq!(
        restored["posts"][0]["sticky"],
        serde_json::json!(true),
        "and the import must apply it: {}",
        restored["posts"][0]
    );
}

/// A plugin that registers a hook from inside a hook does not hang the request.
///
/// `do_action` held the registry's read lock while running listeners, so a
/// listener calling `add_action` waited on the write lock — `RwLock` is not
/// reentrant, so the thread waited on itself, forever. Registering from inside
/// a hook is an ordinary thing for a plugin to do.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_hook_that_registers_a_hook_does_not_deadlock() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    {{crate_name}}::plugins::add_action(
        {{crate_name}}::plugins::Action::PostSaved,
        {{crate_name}}::plugins::DEFAULT_PRIORITY,
        |_| {
            // The re-entrant call. Before the fix this never returned.
            {{crate_name}}::plugins::add_filter(
                {{crate_name}}::plugins::Filter::TheTitle,
                {{crate_name}}::plugins::DEFAULT_PRIORITY,
                |title| title,
            );
        },
    );

    // Saving fires `PostSaved`; the request has to come back.
    let created = tokio::time::timeout(
        std::time::Duration::from_secs(10),
        create_post(&client, &cookie, "Re-entrant", "Body.", "publish"),
    )
    .await
    .expect("saving must not hang while a listener registers another hook");
    assert!(created > 0);
}

/// A settings save is all-or-nothing.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn saving_settings_applies_every_option() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    client
        .post("/admin/settings")
        .header("cookie", &cookie)
        .form(&settings_form(&[
            ("site_title", "Renamed Site"),
            ("tagline", "A new tagline"),
            ("posts_per_page", "7"),
        ]))
        .send()
        .await
        .assert_status(303);

    let screen = client
        .get("/admin/settings")
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .text();
    assert!(screen.contains("Renamed Site"));
    assert!(screen.contains("A new tagline"));
    assert!(
        screen.contains(r#"value="7""#),
        "the page size stuck:\n{screen}"
    );

    // And the public site reflects all of it, so the cache was invalidated
    // after the commit rather than before it.
    sign_out(&client);
    client
        .get("/")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Renamed Site");
}

/// A long filename does not leave a blob with no attachment row.
///
/// The derived title exceeded the model's 300-character limit, so the row was
/// refused *after* the bytes were already stored — an object invisible in the
/// media library and impossible to delete through it.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_very_long_filename_still_uploads() {
    let db = TestDb::shared().await;
    let _ = db_client().await;
    let uploads = std::env::temp_dir().join(format!(
        "cms-longname-test-{}",
        std::time::SystemTime::now()
            .duration_since(std::time::UNIX_EPOCH)
            .expect("clock")
            .as_nanos()
    ));
    std::fs::create_dir_all(&uploads).expect("create the blob store root");
    let mut config = AutumnConfig::default();
    config.security.csrf.enabled = false;
    config.security.submit_token.enabled = false;
    let store = autumn_web::storage::LocalBlobStore::new(
        "default".to_owned(),
        uploads.clone(),
        "/_blobs".to_owned(),
        std::time::Duration::from_secs(900),
        autumn_web::storage::local::SigningKey::new(b"cms-upload-test-key".to_vec()),
        Vec::new(),
    )
    .expect("local blob store");
    let client = TestApp::new()
        .routes(app_routes())
        .config(config)
        .with_db(db.pool())
        .state_initializer(move |state| {
            state.insert_extension::<autumn_web::storage::BlobStoreState>(
                autumn_web::storage::BlobStoreState::new(std::sync::Arc::new(store)),
            );
        })
        .build();
    let cookie = register(&client, "owner").await;

    let long_name = format!("{}.txt", "a".repeat(500));
    let boundary = "----cmsboundary";
    let payload = format!(
        "--{boundary}\r\nContent-Disposition: form-data; name=\"file\"; \
         filename=\"{long_name}\"\r\nContent-Type: text/plain\r\n\r\nhello\r\n--{boundary}--\r\n"
    );

    let resp = client
        .post("/admin/media")
        .header("cookie", &cookie)
        .header(
            "content-type",
            &format!("multipart/form-data; boundary={boundary}"),
        )
        .body(payload)
        .send()
        .await;
    assert_eq!(
        resp.status,
        303,
        "a long filename is a valid upload: {}",
        resp.text()
    );

    // It is in the library, so it can be deleted through the UI.
    client
        .get("/admin/media")
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .assert_body_contains("aaaa");
}

/// A rejected duplicate upload leaves no blob behind.
///
/// The first `file` part is already persisted when the second is refused, so
/// the early return leaked a whole object — repeatable, and an Author could
/// send a 16 MB first part in a loop to consume storage with files the media
/// library cannot show or delete.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_rejected_duplicate_upload_leaves_no_orphaned_blob() {
    let db = TestDb::shared().await;
    let _ = db_client().await;
    let uploads = std::env::temp_dir().join(format!(
        "cms-orphan-test-{}",
        std::time::SystemTime::now()
            .duration_since(std::time::UNIX_EPOCH)
            .expect("clock")
            .as_nanos()
    ));
    std::fs::create_dir_all(&uploads).expect("create the blob store root");
    let mut config = AutumnConfig::default();
    config.security.csrf.enabled = false;
    config.security.submit_token.enabled = false;
    let store = autumn_web::storage::LocalBlobStore::new(
        "default".to_owned(),
        uploads.clone(),
        "/_blobs".to_owned(),
        std::time::Duration::from_secs(900),
        autumn_web::storage::local::SigningKey::new(b"cms-upload-test-key".to_vec()),
        Vec::new(),
    )
    .expect("local blob store");
    let client = TestApp::new()
        .routes(app_routes())
        .config(config)
        .with_db(db.pool())
        .state_initializer(move |state| {
            state.insert_extension::<autumn_web::storage::BlobStoreState>(
                autumn_web::storage::BlobStoreState::new(std::sync::Arc::new(store)),
            );
        })
        .build();
    let cookie = register(&client, "owner").await;

    let boundary = "----cmsboundary";
    let part = |name: &str, body: &str| {
        format!(
            "--{boundary}\r\nContent-Disposition: form-data; name=\"file\"; \
             filename=\"{name}\"\r\nContent-Type: text/plain\r\n\r\n{body}\r\n"
        )
    };
    let payload = format!(
        "{}{}--{boundary}--\r\n",
        part("first.txt", "the first payload"),
        part("second.txt", "the second payload")
    );

    client
        .post("/admin/media")
        .header("cookie", &cookie)
        .header(
            "content-type",
            &format!("multipart/form-data; boundary={boundary}"),
        )
        .body(payload)
        .send()
        .await
        .assert_status(422);

    // The cleanup is spawned, so give it a moment to land, then assert the
    // store is empty — no attachment row exists, so any file here is orphaned.
    for _ in 0..50 {
        if count_files(&uploads) == 0 {
            break;
        }
        tokio::time::sleep(std::time::Duration::from_millis(50)).await;
    }
    assert_eq!(
        count_files(&uploads),
        0,
        "the first part's blob must not survive the rejection"
    );
}

/// Every file under `root`, recursively.
fn count_files(root: &std::path::Path) -> usize {
    let Ok(entries) = std::fs::read_dir(root) else {
        return 0;
    };
    entries
        .filter_map(Result::ok)
        .map(|entry| {
            let path = entry.path();
            if path.is_dir() { count_files(&path) } else { 1 }
        })
        .sum()
}

/// A username has to be usable as the author archive's URL segment.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_username_that_is_not_a_url_segment_is_refused() {
    let client = db_client().await;

    // `Alice` is deliberately absent: `normalize_new_user` lowercases before it
    // validates, so it is accepted and stored as `alice`, which is a perfectly
    // good segment. Only values that cannot be normalized *into* one are
    // refused.
    for bad in [
        "alice/news",
        "alice bloggs",
        "alice?x",
        "alice.news",
        "alice%2f",
    ] {
        let resp = client
            .post("/register")
            .form(&form(&[
                ("username", bad),
                ("email", "someone@example.com"),
                ("password", "correct-horse-battery-staple"),
            ]))
            .send()
            .await;
        assert_ne!(
            resp.status, 303,
            "`{bad}` cannot be an author URL segment and must be refused"
        );
    }

    // A well-formed one still registers, and its byline resolves.
    let cookie = register(&client, "alice-bloggs").await;
    create_post(&client, &cookie, "By Alice", "Body.", "publish").await;
    sign_out(&client);
    client
        .get("/author/alice-bloggs")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("By Alice");
}

/// The configured front page stays selected however old it is.
///
/// The selector listed the newest 200 pages, so a front page older than those
/// was simply absent — the browser then submitted the empty option and saving
/// any unrelated setting silently switched the site back to the posts index.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn the_configured_front_page_stays_selected() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    // The page that will be configured, created first so it is the oldest.
    let front = client
        .post("/admin/content/page")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "Welcome"),
            ("slug", "welcome"),
            ("excerpt", ""),
            ("body", "The front page."),
            ("status", "publish"),
            ("password", ""),
            ("taxonomy_names[post_tag]", ""),
        ]))
        .send()
        .await;
    assert_eq!(front.status, 303);
    let front_id = front
        .header("location")
        .expect("redirect")
        .rsplit('/')
        .next()
        .expect("id")
        .to_owned();

    client
        .post("/admin/settings")
        .header("cookie", &cookie)
        .form(&settings_form(&[("front_page_id", front_id.as_str())]))
        .send()
        .await
        .assert_status(303);

    // Push it out of the newest-200 window.
    try_execute(
        TestDb::shared().await,
        "INSERT INTO posts (post_type, title, slug, body, status, author_id, published_at) \
         SELECT 'page', 'Filler ' || n, 'filler-' || n, '', 'publish', 1, now() \
         FROM generate_series(1, 250) AS n",
    )
    .await
    .expect("insert filler pages");

    let screen = client
        .get("/admin/settings")
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .text();
    assert!(
        screen.contains(&format!(r#"value="{front_id}" selected"#))
            || screen.contains(&format!(r#"selected value="{front_id}""#))
            || (screen.contains("Welcome") && screen.contains(&format!(r#"value="{front_id}""#))),
        "the configured front page must still be in the selector:\n{}",
        &screen[..screen.len().min(4000)]
    );
}

/// Removing every category actually unfiles the post.
///
/// `set_post_terms` replaces the filings, so skipping it when the selection is
/// empty made "remove every category" quietly do nothing and the post stayed in
/// archives it had been taken out of.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn clearing_every_category_removes_the_post_from_its_archives() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let id = create_post(&client, &cookie, "Filed Then Not", "Body.", "publish").await;

    client
        .post("/admin/terms/category")
        .header("cookie", &cookie)
        .form(&form(&[
            ("name", "News"),
            ("slug", ""),
            ("description", ""),
            ("parent_id", ""),
        ]))
        .send()
        .await
        .assert_status(303);
    let categories: serde_json::Value = client
        .get("/api/v1/terms?taxonomy=category")
        .send()
        .await
        .assert_ok()
        .json();
    let news = categories.as_array().expect("array")[0]["id"]
        .as_i64()
        .expect("id")
        .to_string();

    let post_id = &id;
    let base = async |extra: Option<&str>| {
        let mut fields = vec![
            ("title", "Filed Then Not"),
            ("slug", "filed-then-not"),
            ("excerpt", ""),
            ("body", "Body."),
            ("status", "publish"),
            ("password", ""),
            ("taxonomy_names[post_tag]", "rust"),
            ("comment_status", "open"),
        ];
        if let Some(term) = extra {
            fields.push(("taxonomies[category]", term));
        }
        edit_form(post_id, &fields).await
    };

    // File it, and confirm the archive lists it.
    client
        .post(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .form(&base(Some(news.as_str())).await)
        .send()
        .await
        .assert_status(303);
    client
        .get("/category/news")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Filed Then Not");

    // Now clear every category and tag.
    let mut cleared = base(None).await;
    cleared = cleared.replace(
        "taxonomy_names%5Bpost_tag%5D=rust",
        "taxonomy_names%5Bpost_tag%5D=",
    );
    client
        .post(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .form(&cleared)
        .send()
        .await
        .assert_status(303);

    sign_out(&client);
    let archive = client.get("/category/news").send().await;
    archive.assert_ok();
    assert!(
        !archive.text().contains("Filed Then Not"),
        "an emptied selection must unfile the post:\n{}",
        archive.text()
    );
}

/// A shortcode handler that registers a shortcode does not hang the page.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_shortcode_that_registers_a_shortcode_does_not_deadlock() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    {{crate_name}}::shortcodes::add_shortcode("reentrant", |_| {
        // The re-entrant call. Before the fix this never returned.
        {{crate_name}}::shortcodes::add_shortcode("added-from-inside", |_| String::new());
        "<span>expanded</span>".to_owned()
    });

    create_post(
        &client,
        &cookie,
        "Shortcoded",
        "Before [reentrant] after.",
        "publish",
    )
    .await;

    sign_out(&client);
    let page = tokio::time::timeout(
        std::time::Duration::from_secs(10),
        client.get("/shortcoded").send(),
    )
    .await
    .expect("rendering must not hang while a handler registers another shortcode");
    page.assert_ok().assert_body_contains("expanded");
}

/// A scheduled publication records the state it left, not the one it reached.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_scheduled_publication_snapshots_the_scheduled_state() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let id = create_post(&client, &cookie, "Due Now", "Body.", "draft").await;

    // Make it a scheduled post that is already due, at a date this test names
    // so the guard can be given exactly what the sweep would have observed.
    let db = TestDb::shared().await;
    let due = chrono::NaiveDateTime::parse_from_str("2026-01-02 03:04:05", "%Y-%m-%d %H:%M:%S")
        .expect("a fixed due date");
    try_execute(
        db,
        &format!("UPDATE posts SET status = 'future', published_at = '{due}' WHERE id = {id}"),
    )
    .await
    .expect("schedule the post");

    // A mismatched `observed_published_at` must not publish it — that guard is
    // what stops an editor's reschedule being overridden by an in-flight sweep.
    assert!(
        !{{crate_name}}::content::publish_due_post(
            &mut db.pool().get().await.expect("connection"),
            id,
            None,
            "publish",
        )
        .await
        .expect("query"),
        "the guard compares the observed publish date"
    );

    assert!(
        {{crate_name}}::content::publish_due_post(
            &mut db.pool().get().await.expect("connection"),
            id,
            Some(due),
            "publish",
        )
        .await
        .expect("publish"),
        "the due post publishes"
    );

    // The revision snapshots the state it was in *before* the transition.
    let history = client
        .get(&format!("/admin/content/post/{id}/revisions"))
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .text();
    let after = history
        .split("future → publish")
        .nth(1)
        .expect("the transition is recorded");
    assert!(
        after.starts_with(" · future"),
        "the snapshot must record the scheduled state, not the published one: {}",
        &after[..after.len().min(60)]
    );
}

/// A plugin's taxonomy is editable through the post editor.
///
/// The editor recognised only `category` and `post_tag`, so an administrator
/// could create custom terms through the generic term screens and then had no
/// way to attach one to anything — the registry-driven workflow the starter
/// advertises stopped halfway.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_registered_custom_taxonomy_is_editable() {
    // Registered before the client is built, and deliberately for `page` rather
    // than `post`: the registry is process-global, so adding a taxonomy to
    // `post` would change every other test's editor. `page` has no taxonomies
    // of its own, which also makes this a clean check that the controls come
    // from the registry rather than from the two built-in slugs.
    {{crate_name}}::content_types::register_taxonomy({{crate_name}}::content_types::Taxonomy {
        slug: "shelf",
        singular: "Shelf",
        plural: "Shelves",
        hierarchical: true,
        post_types: &["page"],
        rewrite_base: "shelf",
    })
    .expect("shelf registers cleanly");

    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    client
        .post("/admin/terms/shelf")
        .header("cookie", &cookie)
        .form(&form(&[
            ("name", "Reference"),
            ("slug", ""),
            ("description", ""),
            ("parent_id", ""),
        ]))
        .send()
        .await
        .assert_status(303);
    let terms: serde_json::Value = client
        .get("/api/v1/terms?taxonomy=shelf")
        .send()
        .await
        .assert_ok()
        .json();
    let shelf_id = terms.as_array().expect("array")[0]["id"]
        .as_i64()
        .expect("id")
        .to_string();

    let created = client
        .post("/admin/content/page")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "Handbook"),
            ("slug", "handbook"),
            ("excerpt", ""),
            ("body", "Body."),
            ("status", "publish"),
            ("password", ""),
        ]))
        .send()
        .await;
    assert_eq!(created.status, 303);
    let id = created
        .header("location")
        .expect("redirect")
        .rsplit('/')
        .next()
        .expect("id")
        .to_owned();

    // The editor renders a control for it…
    let editor = client
        .get(&format!("/admin/content/page/{id}"))
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .text();
    assert!(
        editor.contains("Shelves") && editor.contains("taxonomies[shelf]"),
        "the editor must render a control for a registered taxonomy:\n{editor}"
    );

    // …and submitting it attaches the term.
    client
        .post(&format!("/admin/content/page/{id}"))
        .header("cookie", &cookie)
        .form(
            &edit_form(
                &id,
                &[
                    ("title", "Handbook"),
                    ("slug", "handbook"),
                    ("excerpt", ""),
                    ("body", "Body."),
                    ("status", "publish"),
                    ("password", ""),
                    ("taxonomies[shelf]", shelf_id.as_str()),
                ],
            )
            .await,
        )
        .send()
        .await
        .assert_status(303);

    let filed = try_execute(
        TestDb::shared().await,
        &format!(
            "SELECT 1/COUNT(*) FROM post_terms pt JOIN terms t ON t.id = pt.term_id \
             WHERE pt.post_id = {id} AND t.taxonomy = 'shelf'"
        ),
    )
    .await;
    assert!(
        filed.is_ok(),
        "the custom taxonomy term must be attached: {filed:?}"
    );

    // And clearing it detaches again.
    client
        .post(&format!("/admin/content/page/{id}"))
        .header("cookie", &cookie)
        .form(
            &edit_form(
                &id,
                &[
                    ("title", "Handbook"),
                    ("slug", "handbook"),
                    ("excerpt", ""),
                    ("body", "Body."),
                    ("status", "publish"),
                    ("password", ""),
                ],
            )
            .await,
        )
        .send()
        .await
        .assert_status(303);
    let still = try_execute(
        TestDb::shared().await,
        &format!(
            "SELECT 1/COUNT(*) FROM post_terms pt JOIN terms t ON t.id = pt.term_id \
             WHERE pt.post_id = {id} AND t.taxonomy = 'shelf'"
        ),
    )
    .await;
    assert!(still.is_err(), "clearing the control must detach the term");
}

/// A save cannot create an unbounded number of terms.
///
/// Find-or-create means one lookup and possibly one insert per name, and the
/// field is free text — a crafted save could carry millions of names inside the
/// framework's request limit, holding the request open and leaving a permanent
/// term set behind.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_save_cannot_create_unbounded_terms() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let id = create_post(&client, &cookie, "Tagged", "Body.", "publish").await;

    let save = async |tags: &str| {
        edit_form(
            &id,
            &[
                ("title", "Tagged"),
                ("slug", "tagged"),
                ("excerpt", ""),
                ("body", "Body."),
                ("status", "publish"),
                ("password", ""),
                ("comment_status", "open"),
                ("taxonomy_names[post_tag]", tags),
            ],
        )
        .await
    };

    // Far more than any editor types.
    let many: Vec<String> = (0..500).map(|n| format!("tag{n}")).collect();
    let refused = client
        .post(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .form(&save(&many.join(",")).await)
        .send()
        .await;
    assert_eq!(refused.status, 422, "body: {}", refused.text());

    // A single absurdly long name is refused too.
    let refused = client
        .post(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .form(&save(&"a".repeat(500)).await)
        .send()
        .await;
    assert_eq!(refused.status, 422, "body: {}", refused.text());

    // Nothing was created by either attempt.
    let terms: serde_json::Value = client
        .get("/api/v1/terms?taxonomy=post_tag")
        .send()
        .await
        .assert_ok()
        .json();
    assert_eq!(terms.as_array().map(Vec::len), Some(0));

    // An ordinary handful still works.
    client
        .post(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .form(&save("rust, web, async").await)
        .send()
        .await
        .assert_status(303);
    let terms: serde_json::Value = client
        .get("/api/v1/terms?taxonomy=post_tag")
        .send()
        .await
        .assert_ok()
        .json();
    assert_eq!(terms.as_array().map(Vec::len), Some(3));
}

/// Scheduling requires a date that is actually in the future.
///
/// A published post moved back to draft keeps its original `published_at`, and
/// the editor pre-fills it — so choosing "Scheduled" without touching the field
/// produced a row that was already due, and the next sweep republished it
/// within the minute instead of scheduling it.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn scheduling_requires_a_future_date() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let id = create_post(&client, &cookie, "Was Live", "Body.", "publish").await;

    // Back to draft; the row keeps its past publish date.
    client
        .post(&format!("/admin/content/post/{id}/status?to=draft"))
        .header("cookie", &cookie)
        .send()
        .await
        .assert_status(303);

    let save = async |publish_at: &str| {
        let mut fields = vec![
            ("title", "Was Live"),
            ("slug", "was-live"),
            ("excerpt", ""),
            ("body", "Body."),
            ("status", "future"),
            ("password", ""),
            ("comment_status", "open"),
        ];
        if !publish_at.is_empty() {
            fields.push(("publish_at", publish_at));
        }
        edit_form(&id, &fields).await
    };

    // No date at all, and a date in the past, are both refused.
    for attempt in ["", "2020-01-01T09:00"] {
        let refused = client
            .post(&format!("/admin/content/post/{id}"))
            .header("cookie", &cookie)
            .form(&save(attempt).await)
            .send()
            .await;
        assert_eq!(
            refused.status,
            422,
            "`{attempt}` is not a future publish date: {}",
            refused.text()
        );
    }

    // A genuinely future one schedules.
    let future = (chrono::Utc::now() + chrono::Duration::days(7))
        .format("%Y-%m-%dT%H:%M")
        .to_string();
    client
        .post(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .form(&save(&future).await)
        .send()
        .await
        .assert_status(303);
}

/// An administrator-created account is held to the same username rule.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn an_admin_created_username_must_be_a_url_segment() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let refused = client
        .post("/admin/users")
        .header("cookie", &cookie)
        .form(&form(&[
            ("username", "alice/news"),
            ("email", "alice@example.com"),
            ("password", "correct-horse-battery-staple"),
            ("role", "author"),
            ("display_name", "Alice"),
        ]))
        .send()
        .await;
    assert_ne!(
        refused.status,
        303,
        "the admin screen must apply the same rule as registration: {}",
        refused.text()
    );

    client
        .post("/admin/users")
        .header("cookie", &cookie)
        .form(&form(&[
            ("username", "alice-news"),
            ("email", "alice@example.com"),
            ("password", "correct-horse-battery-staple"),
            ("role", "author"),
            ("display_name", "Alice"),
        ]))
        .send()
        .await
        .assert_status(303);
}

/// An import leaves a same-slug local post completely alone.
///
/// A retry fix in the previous round offered every already-present row to the
/// ancestry pass, including ones matched only by slug — so an import advertised
/// as skipping existing items could re-parent a local page and change its
/// canonical URL. Only rows this importer created are its to move.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn an_import_does_not_reparent_a_local_post_that_shares_a_slug() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    // Two local pages: `guides` at the top level, and `install` under it.
    for (title, slug, parent) in [
        ("Guides", "guides", None),
        ("Install", "install", Some("1")),
    ] {
        let mut fields = vec![
            ("title", title),
            ("slug", slug),
            ("excerpt", ""),
            ("body", "Local content."),
            ("status", "publish"),
            ("password", ""),
        ];
        if let Some(parent) = parent {
            fields.push(("parent_id", parent));
        }
        client
            .post("/admin/content/page")
            .header("cookie", &cookie)
            .form(&form(&fields))
            .send()
            .await
            .assert_status(303);
    }
    client
        .get("/guides/install")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Local content.");

    // A backup that happens to contain a page with the same slug, filed under a
    // different parent.
    let payload = serde_json::json!({
        "version": 3,
        "site_title": "Elsewhere",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "attachments": [],
        "posts": [
            {
                "post_type": "page", "title": "Manuals", "slug": "manuals",
                "excerpt": "", "body": "Imported parent.", "status": "publish",
                "comment_status": "closed", "password": "", "author": "owner",
                "published_at": null, "parent": null, "terms": [],
                "sticky": false, "menu_order": 0
            },
            {
                "post_type": "page", "title": "Install", "slug": "install",
                "excerpt": "", "body": "Imported child.", "status": "publish",
                "comment_status": "closed", "password": "", "author": "owner",
                "published_at": null, "parent": "manuals", "terms": [],
                "sticky": false, "menu_order": 0
            }
        ]
    })
    .to_string();

    // Both pages in the file are restored. The file's `install` sits under
    // `manuals` and the local one under `guides`: different paths, so they are
    // different pages, and skipping the second would drop a page out of the
    // backup. (This assertion read "1 imported" while a nested page's slug was
    // globally unique — the file's page was silently discarded then, which is
    // the defect the identity change fixes.)
    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("2 imported");

    // The local page is where it was, with its own content and URL — which is
    // what this test is actually about.
    sign_out(&client);
    client
        .get("/guides/install")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Local content.");

    // And the imported one is at its own path, carrying the file's content
    // rather than having displaced anything.
    client
        .get("/manuals/install")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Imported child.");
}

/// The one-click status control cannot schedule without a date.
///
/// It carries no date, so `to=future` produced a post that either never
/// publishes (`published_at IS NULL`, which the sweep never matches) or
/// publishes on the very next sweep (a retained past date).
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn the_status_endpoint_refuses_undated_scheduling() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    // A fresh draft has no publish date at all.
    let fresh = create_post(&client, &cookie, "Never Dated", "Body.", "draft").await;
    let refused = client
        .post(&format!("/admin/content/post/{fresh}/status?to=future"))
        .header("cookie", &cookie)
        .send()
        .await;
    assert_eq!(refused.status, 422, "body: {}", refused.text());

    // A formerly published draft has a *past* one, which is worse: it would
    // republish on the next sweep.
    let was_live = create_post(&client, &cookie, "Was Live", "Body.", "publish").await;
    client
        .post(&format!("/admin/content/post/{was_live}/status?to=draft"))
        .header("cookie", &cookie)
        .send()
        .await
        .assert_status(303);
    let refused = client
        .post(&format!("/admin/content/post/{was_live}/status?to=future"))
        .header("cookie", &cookie)
        .send()
        .await;
    assert_eq!(refused.status, 422, "body: {}", refused.text());

    // With a genuinely future date already on the row, it is allowed.
    try_execute(
        TestDb::shared().await,
        &format!("UPDATE posts SET published_at = now() + interval '7 days' WHERE id = {was_live}"),
    )
    .await
    .expect("give it a future date");
    client
        .post(&format!("/admin/content/post/{was_live}/status?to=future"))
        .header("cookie", &cookie)
        .send()
        .await
        .assert_status(303);
}

/// Trashing a page that still has live children is refused.
///
/// `page_ancestry` keeps putting a trashed parent's slug in its children's
/// permalinks while `resolve_page_path` refuses a trashed ancestor, so every
/// published child 404s at its own canonical URL and the sitemap keeps
/// advertising it.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn trashing_a_page_with_live_children_is_refused() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let parent = client
        .post("/admin/content/page")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "Docs"),
            ("slug", "docs"),
            ("excerpt", ""),
            ("body", "Parent."),
            ("status", "publish"),
            ("password", ""),
        ]))
        .send()
        .await;
    assert_eq!(parent.status, 303);
    let parent_id = parent
        .header("location")
        .expect("redirect")
        .rsplit('/')
        .next()
        .expect("id")
        .to_owned();

    let child = client
        .post("/admin/content/page")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "Install"),
            ("slug", "install"),
            ("excerpt", ""),
            ("body", "Child."),
            ("status", "publish"),
            ("password", ""),
            ("parent_id", parent_id.as_str()),
        ]))
        .send()
        .await;
    assert_eq!(child.status, 303);
    let child_id = child
        .header("location")
        .expect("redirect")
        .rsplit('/')
        .next()
        .expect("id")
        .to_owned();

    client
        .get("/docs/install")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Child.");

    // Trashing the parent is refused while the child is live.
    let refused = client
        .post(&format!("/admin/content/page/{parent_id}/status?to=trash"))
        .header("cookie", &cookie)
        .send()
        .await;
    assert_eq!(refused.status, 422, "body: {}", refused.text());

    // The child is still reachable, so nothing was half-applied.
    client
        .get("/docs/install")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Child.");

    // Trash the child first, and the parent goes.
    client
        .post(&format!("/admin/content/page/{child_id}/status?to=trash"))
        .header("cookie", &cookie)
        .send()
        .await
        .assert_status(303);
    client
        .post(&format!("/admin/content/page/{parent_id}/status?to=trash"))
        .header("cookie", &cookie)
        .send()
        .await
        .assert_status(303);
}

/// An import does not restructure a locally-managed taxonomy.
///
/// The first pass deliberately leaves an existing term alone, but the ancestry
/// pass still assigned the backup's parent — so importing into a populated site
/// could silently reparent a local category, or close a cycle with it.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn an_import_does_not_reparent_a_local_term() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    // Two local categories, both at the top level.
    for name in ["Guides", "Reference"] {
        client
            .post("/admin/terms/category")
            .header("cookie", &cookie)
            .form(&form(&[
                ("name", name),
                ("slug", ""),
                ("description", ""),
                ("parent_id", ""),
            ]))
            .send()
            .await
            .assert_status(303);
    }

    // A backup that files `reference` under `guides`.
    let payload = serde_json::json!({
        "version": 3,
        "site_title": "Elsewhere",
        "exported_at": "2026-01-01T00:00:00Z",
        "attachments": [],
        "posts": [],
        "terms": [
            {"taxonomy": "category", "name": "Guides", "slug": "guides",
             "description": "", "parent": null},
            {"taxonomy": "category", "name": "Reference", "slug": "reference",
             "description": "", "parent": "guides"}
        ]
    })
    .to_string();

    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok();

    // The local hierarchy is untouched: `reference` is still top-level.
    let orphaned = try_execute(
        TestDb::shared().await,
        "SELECT 1/COUNT(*) FROM terms WHERE slug = 'reference' AND parent_id IS NOT NULL",
    )
    .await;
    assert!(
        orphaned.is_err(),
        "the import must not have reparented the local term"
    );
}

/// The moderation queue is bounded and paginated.
///
/// It loaded every row of the selected status, sorted in memory, and looked the
/// post up once per comment — so the screen needed to clear a spam flood was
/// the first one to stop working under it.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn the_moderation_queue_paginates() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let post_id = create_post(&client, &cookie, "Busy", "Body.", "publish").await;

    // Sixty pending guest comments, written directly — the point is the queue's
    // shape, not the submission path, and the throttle would bound the rate.
    try_execute(
        TestDb::shared().await,
        &format!(
            "INSERT INTO comments (post_id, author_name, body, status, created_at) \
             SELECT {post_id}, 'Guest', 'pending ' || n, 'pending', now() - (n || ' minutes')::interval \
             FROM generate_series(1, 60) AS n"
        ),
    )
    .await
    .expect("seed the queue");

    let first = client
        .get("/admin/comments?status=pending")
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .text();
    // Newest first, bounded at 50: `pending 1` is the newest, `pending 60` the
    // oldest and off this page.
    assert!(
        first.contains("pending 1<"),
        "the newest comment is on page one"
    );
    assert!(
        !first.contains("pending 60<"),
        "the oldest must not be on page one — the queue is unbounded:\n{}",
        &first[..first.len().min(2000)]
    );

    let second = client
        .get("/admin/comments?status=pending&page=2")
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .text();
    assert!(second.contains("pending 60<"), "the rest is on page two");
    assert!(!second.contains("pending 1<"), "pages must not overlap");

    // The post title still shows, so the batched lookup replaced the per-row
    // one rather than dropping it.
    assert!(
        first.contains("Busy"),
        "the queue names the post being discussed"
    );
}

/// An imported attachment cannot smuggle an inline-rendered media type.
///
/// The upload path enforces `ALLOWED_MIME`; an import did not, so a tampered
/// export could label bytes already in the store `text/html` and `/media/{slug}`
/// would serve them inline — stored script execution on the site's own origin.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn an_import_cannot_introduce_an_inline_html_attachment() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let payload = serde_json::json!({
        "version": 3,
        "site_title": "Tampered",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [],
        "attachments": [{
            "slug": "payload", "title": "Payload", "mime_type": "text/html",
            "byte_size": 10, "width": null, "height": null,
            "alt_text": "", "caption": "",
            "file": {"provider_id": "default", "key": "media/payload",
                     "content_type": "text/html", "byte_size": 10}
        }]
    })
    .to_string();

    let refused = import_export(&client, &cookie, payload.as_str()).await;
    assert_eq!(
        refused.status,
        422,
        "an unsupported media type must stop the restore: {}",
        refused.text()
    );

    // And the serving policy is allowlist-shaped, so a row written by any other
    // route is still not rendered inline.
    assert!(!{{crate_name}}::routes::admin::media::may_render_inline("text/html"));
    assert!(!{{crate_name}}::routes::admin::media::may_render_inline(
        "image/svg+xml"
    ));
    assert!({{crate_name}}::routes::admin::media::may_render_inline("image/png"));
}

/// A transition is authorized against the row as it is, not as it was read.
///
/// A Contributor may edit their own draft but not a published post. If an
/// Editor publishes it between the handler's check and the write, the stale
/// `draft` kept the request authorized — so the Contributor could trash content
/// they no longer had the capability to touch.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_transition_is_authorized_against_the_locked_row() {
    let client = db_client().await;
    let owner = register(&client, "owner").await;

    sign_out(&client);
    let contributor = register(&client, "contributor").await;
    client
        .post("/admin/users/2")
        .header("cookie", &owner)
        .form(&form(&[
            ("role", "contributor"),
            ("email", "contributor@example.com"),
            ("display_name", "Contributor"),
            ("bio", ""),
            ("website", ""),
        ]))
        .send()
        .await
        .assert_status(303);

    // The Contributor's own draft.
    let id = create_post(&client, &contributor, "Their Draft", "Body.", "draft").await;

    // The owner publishes it — the Contributor no longer has any capability
    // over it.
    client
        .post(&format!("/admin/content/post/{id}/status?to=publish"))
        .header("cookie", &owner)
        .send()
        .await
        .assert_status(303);

    // Trashing is refused, and would have been refused even if the handler's
    // pre-check had been made on a stale read.
    let refused = client
        .post(&format!("/admin/content/post/{id}/status?to=trash"))
        .header("cookie", &contributor)
        .send()
        .await;
    assert_eq!(refused.status, 403, "body: {}", refused.text());

    sign_out(&client);
    client
        .get("/their-draft")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Body.");
}

/// A comment cannot land on a post whose comments were just closed.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn create_comment_rechecks_the_post_under_its_lock() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let post_id = create_post(&client, &cookie, "Closing", "Body.", "publish").await;

    // Close comments behind the handler's back, the way a concurrent edit
    // would — then the insert must refuse regardless of what a caller checked.
    try_execute(
        TestDb::shared().await,
        &format!("UPDATE posts SET comment_status = 'closed' WHERE id = {post_id}"),
    )
    .await
    .expect("close comments");

    let refused = {{crate_name}}::content::create_comment(
        &mut TestDb::shared().await.pool().get().await.expect("conn"),
        {{crate_name}}::models::NewComment {
            post_id,
            parent_id: None,
            author_id: None,
            author_name: "Guest".to_owned(),
            author_email: "guest@example.com".to_owned(),
            author_url: String::new(),
            author_ip: String::new(),
            body: "Late comment".to_owned(),
            status: "approved".to_owned(),
        },
        "",
    )
    .await;
    assert!(
        refused.is_err(),
        "the insert must re-read the post rather than trusting the caller"
    );

    let page = client.get("/closing").send().await;
    page.assert_ok();
    assert!(!page.text().contains("Late comment"));
}

/// A crafted comment submission is validated on the server.
///
/// The form declares `required` and `maxlength`; a POST that never went through
/// a browser declares nothing. `create_comment` inserts through direct Diesel —
/// it has to, so the row and the counter move together — which means it never
/// runs `CommentHooks::before_create`, and for a while it did not run
/// `validate_comment` either. A signed-in commenter's empty body would have
/// been stored *approved*.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_crafted_comment_submission_is_validated_server_side() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let post_id = create_post(&client, &cookie, "Rules", "Body.", "publish").await;

    // Signed in, so the comment would land `approved` and be immediately
    // public — the case where skipping validation costs the most.
    let empty = client
        .post(&format!("/comments/{post_id}"))
        .header("cookie", &cookie)
        .form(&form(&[("body", "   ")]))
        .send()
        .await;
    assert_ne!(
        empty.status,
        303,
        "an empty comment body must be refused: {}",
        empty.text()
    );

    // A guest with no name is unattributable.
    sign_out(&client);
    let nameless = client
        .post(&format!("/comments/{post_id}"))
        .form(&form(&[("body", "Anonymous"), ("author_name", "  ")]))
        .send()
        .await;
    assert_ne!(
        nameless.status,
        303,
        "a guest comment with no name must be refused: {}",
        nameless.text()
    );

    // And the declared 10,000-byte cap is the cap, not the global request-body
    // limit.
    let huge = "x".repeat(10_001);
    let oversized = client
        .post(&format!("/comments/{post_id}"))
        .form(&form(&[
            ("body", huge.as_str()),
            ("author_name", "Guest"),
            ("author_email", "guest@example.com"),
        ]))
        .send()
        .await;
    assert_ne!(
        oversized.status, 303,
        "a body past the declared cap must be refused"
    );

    // None of the three reached the queue.
    let queue = client
        .get("/admin/comments?status=approved")
        .header("cookie", &cookie)
        .send()
        .await;
    queue.assert_ok();
    assert!(
        !queue.text().contains("Anonymous"),
        "no rejected submission may have been stored"
    );
}

/// Restoring a revision is authorized against the row as locked.
///
/// A Contributor may edit their own draft but not a published post. If an
/// Editor publishes it between the handler's check and the transaction, the
/// stale `draft` would keep the request authorized and the restore would
/// rewrite the body of live content the Contributor can no longer touch. The
/// re-check lives inside the transaction, so the call is made directly here —
/// through the route the handler's own pre-check would refuse first, and the
/// test would pass with the inner check deleted.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn restoring_a_revision_is_authorized_against_the_locked_row() {
    use diesel::prelude::*;
    use diesel_async::RunQueryDsl;

    let client = db_client().await;
    let owner = register(&client, "owner").await;

    sign_out(&client);
    let contributor = register(&client, "contributor").await;
    client
        .post("/admin/users/2")
        .header("cookie", &owner)
        .form(&form(&[
            ("role", "contributor"),
            ("email", "contributor@example.com"),
            ("display_name", "Contributor"),
            ("bio", ""),
            ("website", ""),
        ]))
        .send()
        .await
        .assert_status(303);

    let id = create_post(&client, &contributor, "Their Draft", "Original.", "draft").await;

    // The owner publishes it. The Contributor's capability over it is gone.
    client
        .post(&format!("/admin/content/post/{id}/status?to=publish"))
        .header("cookie", &owner)
        .send()
        .await
        .assert_status(303);

    let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
    let actor: {{crate_name}}::models::User = {{crate_name}}::schema::users::table
        .filter({{crate_name}}::schema::users::username.eq("contributor"))
        .select({{crate_name}}::models::User::as_select())
        .first(&mut conn)
        .await
        .expect("the contributor account");
    let revision_id: i64 = {{crate_name}}::schema::revisions::table
        .filter({{crate_name}}::schema::revisions::post_id.eq(id))
        .select({{crate_name}}::schema::revisions::id)
        .order({{crate_name}}::schema::revisions::id.asc())
        .first(&mut conn)
        .await
        .expect("the initial revision");

    let refused =
        {{crate_name}}::content::restore_revision(&mut conn, id, revision_id, Some(actor.id), Some(&actor))
            .await;
    assert!(
        refused.is_err(),
        "the restore must re-check the capability against the locked row"
    );

    // The process's own paths — the importer, the seeder — still have no actor
    // and are still allowed.
    {{crate_name}}::content::restore_revision(&mut conn, id, revision_id, None, None)
        .await
        .expect("an actorless restore is the scheduler's, not a user's");
}

/// A term's parent has to be in the term's own taxonomy.
///
/// The `<select>` offers only this taxonomy's terms, but the id is a number in
/// a form body: the foreign key accepts any term, and `TermHooks` has no
/// database to resolve the candidate in. A category filed under a tag renders
/// nowhere and the exporter drops it.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_terms_parent_must_belong_to_the_same_taxonomy() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    client
        .post("/admin/terms/post_tag")
        .header("cookie", &cookie)
        .form(&form(&[
            ("name", "Rust"),
            ("slug", ""),
            ("description", ""),
        ]))
        .send()
        .await
        .assert_status(303);

    let tags = client
        .get("/admin/terms/post_tag")
        .header("cookie", &cookie)
        .send()
        .await;
    tags.assert_ok();
    assert!(tags.text().contains("Rust"));

    // The tag is the only term, so it is id 1. Offer it as a category's parent.
    let refused = client
        .post("/admin/terms/category")
        .header("cookie", &cookie)
        .form(&form(&[
            ("name", "Grafted"),
            ("slug", ""),
            ("description", ""),
            ("parent_id", "1"),
        ]))
        .send()
        .await;
    assert_eq!(
        refused.status,
        422,
        "a cross-taxonomy parent must be refused: {}",
        refused.text()
    );

    let categories = client
        .get("/admin/terms/category")
        .header("cookie", &cookie)
        .send()
        .await;
    categories.assert_ok();
    assert!(
        !categories.text().contains("Grafted"),
        "the refused term must not have been stored"
    );

    // A parent from the same taxonomy still works — the check bounds the input,
    // it does not remove hierarchy.
    client
        .post("/admin/terms/category")
        .header("cookie", &cookie)
        .form(&form(&[
            ("name", "Guides"),
            ("slug", ""),
            ("description", ""),
        ]))
        .send()
        .await
        .assert_status(303);
    client
        .post("/admin/terms/category")
        .header("cookie", &cookie)
        .form(&form(&[
            ("name", "Beginner"),
            ("slug", ""),
            ("description", ""),
            ("parent_id", "2"),
        ]))
        .send()
        .await
        .assert_status(303);
    client
        .get("/admin/terms/category")
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Guides — ");
}

/// The media library is paginated in SQL, not loaded whole and sorted in Rust.
///
/// Every Author holds `UploadFiles`, so this table grows without any single
/// upload being invalid; the screen used to manage uploads was the one that
/// became unusable first.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn the_media_library_is_paginated() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    // 50 rows, newest first by `created_at`: `File 001` is the most recent.
    try_execute(
        TestDb::shared().await,
        "INSERT INTO attachments (title, slug, mime_type, byte_size, created_at)
         SELECT 'File ' || lpad(g::text, 3, '0'),
                'file-' || lpad(g::text, 3, '0'),
                'application/pdf',
                1024,
                NOW() - (g || ' minutes')::interval
         FROM generate_series(1, 50) AS g",
    )
    .await
    .expect("seed the library");

    let first = client
        .get("/admin/media")
        .header("cookie", &cookie)
        .send()
        .await;
    first.assert_ok();
    let first = first.text();
    assert!(first.contains("File 001"), "the newest row leads page one");
    assert!(first.contains("File 048"), "page one holds a full page");
    assert!(
        !first.contains("File 049"),
        "page one must stop at the page size rather than render the whole table"
    );
    assert!(
        first.contains("Page 1 of 2"),
        "the pager states where it is"
    );

    let second = client
        .get("/admin/media?page=2")
        .header("cookie", &cookie)
        .send()
        .await;
    second.assert_ok();
    let second = second.text();
    assert!(
        second.contains("File 049") && second.contains("File 050"),
        "the tail is reachable"
    );
    assert!(
        !second.contains("File 001"),
        "page two must not repeat page one"
    );
}

/// A guest's identity fields are capped, not just their comment body.
///
/// `/comments/{post_id}` is unauthenticated with the shipped defaults and the
/// form's `maxlength` attributes are a browser convenience; `author_url` has no
/// input on the form at all. Uncapped, a handful of accepted comments carry
/// request-sized values that the moderation queue then renders fifty at a time.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_guests_identity_fields_are_capped() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let post_id = create_post(&client, &cookie, "Caps", "Body.", "publish").await;

    sign_out(&client);
    let long_name = "n".repeat(81);
    let long_email = format!("{}@example.com", "e".repeat(250));
    let long_url = format!("https://example.com/{}", "u".repeat(200));

    for (label, fields) in [
        (
            "name",
            vec![
                ("body", "Hello"),
                ("author_name", long_name.as_str()),
                ("author_email", "guest@example.com"),
            ],
        ),
        (
            "email",
            vec![
                ("body", "Hello"),
                ("author_name", "Guest"),
                ("author_email", long_email.as_str()),
            ],
        ),
        (
            "url",
            vec![
                ("body", "Hello"),
                ("author_name", "Guest"),
                ("author_email", "guest@example.com"),
                ("author_url", long_url.as_str()),
            ],
        ),
    ] {
        let refused = client
            .post(&format!("/comments/{post_id}"))
            .form(&form(&fields))
            .send()
            .await;
        assert_ne!(
            refused.status,
            303,
            "an oversized {label} must be refused: {}",
            refused.text()
        );
    }

    // A signed-in commenter's name and email come from their account rather
    // than the request, so they are not capped here — enforcing an account
    // rule at the comment door would refuse a legitimate long display name.
    sign_out(&client);
    let reader = register(&client, "reader").await;
    let long_display = "D".repeat(120);
    client
        .post("/admin/users/2")
        .header("cookie", &cookie)
        .form(&form(&[
            ("role", "subscriber"),
            ("email", "reader@example.com"),
            ("display_name", long_display.as_str()),
            ("bio", ""),
            ("website", ""),
        ]))
        .send()
        .await
        .assert_status(303);
    client
        .post(&format!("/comments/{post_id}"))
        .header("cookie", &reader)
        .form(&form(&[("body", "From the account.")]))
        .send()
        .await
        .assert_status(303);
}

/// Re-parenting is bounded by the deepest descendant, not by the moved page.
///
/// Checking only where the moved row would land let a subtree be dragged under
/// a parent deep enough to push its own children past `MAX_PAGE_DEPTH`:
/// `page_ancestry` then truncated those children's canonical paths while
/// `resolve_page_path` still walked down from a real root, so each of them
/// 404'd at the URL the site itself published.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn reparenting_is_bounded_by_the_deepest_descendant() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let page = async |title: &str, parent: Option<&str>| -> String {
        let mut fields = vec![
            ("title", title),
            ("slug", ""),
            ("excerpt", ""),
            ("body", "Body."),
            ("status", "publish"),
            ("password", ""),
        ];
        if let Some(parent) = parent {
            fields.push(("parent_id", parent));
        }
        let created = client
            .post("/admin/content/page")
            .header("cookie", &cookie)
            .form(&form(&fields))
            .send()
            .await;
        assert_eq!(created.status, 303, "creating {title}: {}", created.text());
        created
            .header("location")
            .expect("redirect")
            .rsplit('/')
            .next()
            .expect("id")
            .to_owned()
    };

    // A chain six deep. `P6` is the deepest legal parent for a *leaf*.
    let mut chain = Vec::new();
    for level in 1..=6 {
        let parent = chain.last().cloned();
        chain.push(page(&format!("P{level}"), parent.as_deref()).await);
    }

    // A separate subtree three levels tall: A > B > C.
    let a = page("A", None).await;
    let b = page("B", Some(&a)).await;
    let _c = page("C", Some(&b)).await;

    // Moving A under P6 puts C at nine ancestors. The old check asked only
    // where A itself would land — six — and allowed it.
    let refused = client
        .post(&format!("/admin/content/page/{a}"))
        .header("cookie", &cookie)
        .form(
            &edit_form(
                &a,
                &[
                    ("title", "A"),
                    ("slug", "a"),
                    ("excerpt", ""),
                    ("body", "Body."),
                    ("status", "publish"),
                    ("password", ""),
                    ("parent_id", chain[5].as_str()),
                ],
            )
            .await,
        )
        .send()
        .await;
    assert_eq!(
        refused.status,
        422,
        "the subtree's own height has to count: {}",
        refused.text()
    );

    // A is still where it was, and still reachable.
    sign_out(&client);
    client
        .get("/a/b/c")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Body.");

    // A leaf may still take that place — the bound is on the height that would
    // result, not on re-parenting.
    let leaf = page("Leaf", None).await;
    client
        .post(&format!("/admin/content/page/{leaf}"))
        .header("cookie", &cookie)
        .form(
            &edit_form(
                &leaf,
                &[
                    ("title", "Leaf"),
                    ("slug", "leaf"),
                    ("excerpt", ""),
                    ("body", "Body."),
                    ("status", "publish"),
                    ("password", ""),
                    ("parent_id", chain[5].as_str()),
                ],
            )
            .await,
        )
        .send()
        .await
        .assert_status(303);
}

/// An import's term pass is all-or-nothing.
///
/// The creations and the ancestry links are two passes — a child term can
/// appear in the file before its parent — but they are one transaction. Split
/// across statements, a failure during the linking half left the creations
/// committed, and a retry then read every one of those rows as pre-existing
/// local content it must not restructure, so the unfinished links were skipped
/// permanently while the retry reported success.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_failed_import_leaves_no_half_created_taxonomy() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    // The failure has to land *after* a row has been written, which is the only
    // shape the atomicity is about: a malformed payload is rejected before the
    // pass starts and proves nothing. A trigger that refuses one particular
    // name is the smallest way to fail the pass mid-flight, standing in for the
    // constraint violation or dropped connection that would do it in practice.
    let db = TestDb::shared().await;
    try_execute(
        db,
        "CREATE OR REPLACE FUNCTION refuse_boom() RETURNS trigger AS $$
         BEGIN
             IF NEW.name = 'Boom' THEN RAISE EXCEPTION 'boom'; END IF;
             RETURN NEW;
         END; $$ LANGUAGE plpgsql",
    )
    .await
    .expect("create the trigger function");
    try_execute(db, "DROP TRIGGER IF EXISTS refuse_boom ON terms")
        .await
        .expect("clear any previous trigger");
    try_execute(
        db,
        "CREATE TRIGGER refuse_boom BEFORE INSERT ON terms
         FOR EACH ROW EXECUTE FUNCTION refuse_boom()",
    )
    .await
    .expect("install the trigger");

    // The first term is perfectly valid and is written; the second is refused,
    // failing the pass with the first already inserted.
    let payload = serde_json::json!({
        "version": 3,
        "site_title": "Elsewhere",
        "exported_at": "2026-01-01T00:00:00Z",
        "attachments": [],
        "posts": [],
        "terms": [
            {"taxonomy": "category", "name": "Guides", "slug": "guides", "description": ""},
            {"taxonomy": "category", "name": "Boom", "slug": "boom", "description": ""}
        ]
    })
    .to_string();

    let failed = import_export(&client, &cookie, payload.as_str()).await;
    assert_ne!(failed.status, 303, "the import must not report success");

    let categories = client
        .get("/admin/terms/category")
        .header("cookie", &cookie)
        .send()
        .await;
    categories.assert_ok();
    assert!(
        !categories.text().contains("Guides"),
        "a failed term pass must roll its creations back, or a retry reads \
         them as local content and never finishes the ancestry"
    );

    try_execute(db, "DROP TRIGGER refuse_boom ON terms")
        .await
        .expect("remove the trigger");

    // And a well-formed file still restores the hierarchy it describes.
    let payload = serde_json::json!({
        "version": 3,
        "site_title": "Elsewhere",
        "exported_at": "2026-01-01T00:00:00Z",
        "attachments": [],
        "posts": [],
        "terms": [
            {"taxonomy": "category", "name": "Beginner", "slug": "beginner",
             "description": "", "parent": "guides"},
            {"taxonomy": "category", "name": "Guides", "slug": "guides", "description": ""}
        ]
    })
    .to_string();
    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok();
    client
        .get("/admin/terms/category")
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Guides — ");
}

/// The content-administration list is paginated in SQL.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn the_content_admin_list_is_paginated() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    // 60 posts, newest first by `updated_at`: `Item 01` is the most recent.
    try_execute(
        TestDb::shared().await,
        "INSERT INTO posts (post_type, title, slug, excerpt, body, status, author_id,
                            password, comment_status, menu_order, updated_at)
         SELECT 'post',
                'Item ' || lpad(g::text, 2, '0'),
                'item-' || lpad(g::text, 2, '0'),
                '', 'Body.', 'publish', 1, '', 'open', 0,
                NOW() - (g || ' minutes')::interval
         FROM generate_series(1, 60) AS g",
    )
    .await
    .expect("seed the content list");

    let first = client
        .get("/admin/content/post")
        .header("cookie", &cookie)
        .send()
        .await;
    first.assert_ok();
    let first = first.text();
    assert!(first.contains("Item 01"), "the newest row leads page one");
    assert!(first.contains("Item 50"), "page one holds a full page");
    assert!(
        !first.contains("Item 51"),
        "page one must stop at the page size rather than render the whole table"
    );
    assert!(first.contains("Page 1 of 2"));

    let second = client
        .get("/admin/content/post?page=2")
        .header("cookie", &cookie)
        .send()
        .await;
    second.assert_ok();
    let second = second.text();
    assert!(second.contains("Item 60"), "the tail is reachable");
    assert!(
        !second.contains("Item 01"),
        "page two must not repeat page one"
    );

    // The status filter and the search still apply, and are applied in SQL
    // alongside the bound rather than to rows already loaded.
    let drafts = client
        .get("/admin/content/post?status=draft")
        .header("cookie", &cookie)
        .send()
        .await;
    drafts.assert_ok();
    assert!(!drafts.text().contains("Item 01"));

    let searched = client
        .get("/admin/content/post?s=Item")
        .header("cookie", &cookie)
        .send()
        .await;
    searched.assert_ok();
    let searched = searched.text();
    assert!(searched.contains("Item 01"));
    assert!(
        !searched.contains("Item 51"),
        "a search is bounded too, not just the unfiltered list"
    );

    // A Contributor's restriction is a predicate, not a filter applied after
    // the page was already chosen — otherwise their page one would be mostly
    // empty rows they cannot open.
    sign_out(&client);
    let contributor = register(&client, "contributor").await;
    client
        .post("/admin/users/2")
        .header("cookie", &cookie)
        .form(&form(&[
            ("role", "contributor"),
            ("email", "contributor@example.com"),
            ("display_name", "Contributor"),
            ("bio", ""),
            ("website", ""),
        ]))
        .send()
        .await
        .assert_status(303);
    let theirs = client
        .get("/admin/content/post")
        .header("cookie", &contributor)
        .send()
        .await;
    theirs.assert_ok();
    assert!(
        !theirs.text().contains("Item 01"),
        "a Contributor must not see another account's content"
    );
}

/// The featured-image picker is bounded, and keeps the current selection.
///
/// Paginating `/admin/media` did nothing for this control: opening any
/// thumbnail-capable editor still rendered every attachment as an `<option>`.
/// Bounding it introduces its own hazard — a selection older than the bound
/// would fall out of the select, and saving the form unchanged would clear it —
/// so the current value is added back explicitly.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn the_featured_media_picker_is_bounded_and_keeps_its_selection() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let post_id = create_post(&client, &cookie, "Illustrated", "Body.", "draft").await;

    // 150 uploads. `Shot 001` is the newest; `Shot 150` is far past the bound.
    try_execute(
        TestDb::shared().await,
        "INSERT INTO attachments (title, slug, mime_type, byte_size, created_at)
         SELECT 'Shot ' || lpad(g::text, 3, '0'),
                'shot-' || lpad(g::text, 3, '0'),
                'image/png',
                1024,
                NOW() - (g || ' minutes')::interval
         FROM generate_series(1, 150) AS g",
    )
    .await
    .expect("seed the library");

    let editor = client
        .get(&format!("/admin/content/post/{post_id}"))
        .header("cookie", &cookie)
        .send()
        .await;
    editor.assert_ok();
    let editor = editor.text();
    assert!(
        editor.contains("Shot 001"),
        "the newest uploads are offered"
    );
    assert!(
        !editor.contains("Shot 150"),
        "the picker must not render the whole library"
    );
    assert!(
        editor.contains("most recent uploads"),
        "the editor says it is showing a window, rather than implying the \
         library is this small"
    );

    // Now select the oldest one, which is well past the bound.
    let oldest: String = "Shot 150".to_owned();
    try_execute(
        TestDb::shared().await,
        &format!(
            "UPDATE posts SET featured_media_id =
                 (SELECT id FROM attachments WHERE title = '{oldest}')
             WHERE id = {post_id}"
        ),
    )
    .await
    .expect("select the oldest attachment");

    let editor = client
        .get(&format!("/admin/content/post/{post_id}"))
        .header("cookie", &cookie)
        .send()
        .await;
    editor.assert_ok();
    assert!(
        editor.text().contains(&oldest),
        "a selection older than the bound must still be in the select, or \
         saving the form unchanged silently clears it"
    );
}

/// The admin menu lists every registered taxonomy, not two hardcoded slugs.
///
/// A plugin's taxonomy already had a working screen at `/admin/terms/<slug>`
/// and no way to reach it: the post editor renders a checkbox list that is
/// empty until the taxonomy has a term, and the only place to create that first
/// term was a URL an administrator had to guess. A registry-driven workflow
/// that is undiscoverable is not one.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn the_admin_menu_lists_every_registered_taxonomy() {
    // For `page` rather than `post`, and with its own slug: the registry is
    // process-global, so this must not change what any other test's post
    // editor renders.
    {{crate_name}}::content_types::register_taxonomy({{crate_name}}::content_types::Taxonomy {
        slug: "aisle",
        singular: "Aisle",
        plural: "Aisles",
        hierarchical: true,
        post_types: &["page"],
        rewrite_base: "aisle",
    })
    .expect("aisle registers cleanly");

    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let dashboard = client.get("/admin").header("cookie", &cookie).send().await;
    dashboard.assert_ok();
    let dashboard = dashboard.text();
    assert!(
        dashboard.contains("/admin/terms/aisle"),
        "a registered taxonomy must be reachable from the menu"
    );
    assert!(dashboard.contains("Aisles"), "under its own plural name");
    // The built-ins still come from the same loop rather than a second list.
    assert!(dashboard.contains("/admin/terms/category"));
    assert!(dashboard.contains("/admin/terms/post_tag"));
}

/// Scheduling is validated against the row as locked.
///
/// The status endpoint carries no date — it can only move a post to `future`
/// when the row already holds a future one — so its check is a read that can go
/// stale. An editor who clears or rewinds `published_at` in between would
/// otherwise have the request schedule a post that either never publishes
/// (`NULL` never matches the sweep's `published_at <= now`) or publishes on the
/// very next sweep.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn scheduling_is_validated_against_the_locked_row() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let id = create_post(&client, &cookie, "Someday", "Body.", "draft").await;

    let mut conn = TestDb::shared().await.pool().get().await.expect("conn");

    // No date at all: the sweep would never see it, so it would sit `future`
    // forever. Called directly, because the handler's own pre-check refuses
    // first and the point is that the check inside the transaction refuses too.
    let refused = {{crate_name}}::content::transition_status(&mut conn, id, "future", None, None).await;
    assert!(
        refused.is_err(),
        "a schedule with no date must be refused under the lock"
    );

    // A date already in the past: the next sweep would publish it within the
    // minute, which is not what scheduling means.
    try_execute(
        TestDb::shared().await,
        &format!("UPDATE posts SET published_at = NOW() - interval '1 day' WHERE id = {id}"),
    )
    .await
    .expect("rewind the date");
    let refused = {{crate_name}}::content::transition_status(&mut conn, id, "future", None, None).await;
    assert!(
        refused.is_err(),
        "a schedule with a past date must be refused under the lock"
    );

    // A real future date still schedules.
    try_execute(
        TestDb::shared().await,
        &format!("UPDATE posts SET published_at = NOW() + interval '1 day' WHERE id = {id}"),
    )
    .await
    .expect("set a future date");
    let scheduled = {{crate_name}}::content::transition_status(&mut conn, id, "future", None, None)
        .await
        .expect("a real future date schedules");
    assert_eq!(scheduled.status, "future");
}

/// The users screen is paginated in SQL.
///
/// Open registration is the shipped default and the per-IP throttle bounds the
/// rate rather than the total, so the screen an administrator would use to
/// clear a signup flood is the one the flood breaks first.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn the_users_admin_list_is_paginated() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    // 60 accounts, ordered by username: `user-01` … `user-60`. `owner` sorts
    // before all of them, so page one is `owner` plus `user-01` … `user-49`.
    try_execute(
        TestDb::shared().await,
        "INSERT INTO users (username, email, password_hash, display_name, role, bio, website)
         SELECT 'user-' || lpad(g::text, 2, '0'),
                'user-' || lpad(g::text, 2, '0') || '@example.com',
                'x', '', 'subscriber', '', ''
         FROM generate_series(1, 60) AS g",
    )
    .await
    .expect("seed the accounts");

    let first = client
        .get("/admin/users")
        .header("cookie", &cookie)
        .send()
        .await;
    first.assert_ok();
    let first = first.text();
    assert!(
        first.contains("user-01"),
        "the first account leads page one"
    );
    assert!(first.contains("user-49"), "page one holds a full page");
    assert!(
        !first.contains("user-50"),
        "page one must stop at the page size rather than render every account"
    );
    assert!(first.contains("Page 1 of 2"));

    let second = client
        .get("/admin/users?page=2")
        .header("cookie", &cookie)
        .send()
        .await;
    second.assert_ok();
    let second = second.text();
    assert!(
        second.contains("user-50") && second.contains("user-60"),
        "the tail is reachable"
    );
    assert!(
        !second.contains("user-01"),
        "page two must not repeat page one"
    );
}

/// A scheduled post is stored as the instant the editor's wall clock names.
///
/// `datetime-local` submits a wall-clock value with **no offset**. Storing it
/// as-is made it a UTC timestamp by accident, and the scheduler compares
/// against `Utc::now()` — so scheduling 09:00 on a site set to UTC-7 published
/// at 02:00 local.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_scheduled_date_is_read_in_the_sites_timezone() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    client
        .post("/admin/settings")
        .header("cookie", &cookie)
        .form(&settings_form(&[("timezone", "America/Los_Angeles")]))
        .send()
        .await
        .assert_status(303);

    // Far enough out that it is in the future in every zone, so the test is
    // about the *offset* rather than about the guard.
    let local = (chrono::Utc::now() + chrono::Duration::days(30))
        .naive_utc()
        .format("%Y-%m-%dT09:00")
        .to_string();
    let created = client
        .post("/admin/content/post")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "Later"),
            ("slug", "later"),
            ("excerpt", ""),
            ("body", "Body."),
            ("status", "future"),
            ("password", ""),
            ("publish_at", local.as_str()),
        ]))
        .send()
        .await;
    assert_eq!(created.status, 303, "body: {}", created.text());
    let id = created
        .header("location")
        .expect("redirect")
        .rsplit('/')
        .next()
        .expect("id")
        .to_owned();

    // 09:00 in America/Los_Angeles is 16:00 or 17:00 UTC depending on daylight
    // saving — never 09:00. Asserting the stored hour is *not* the submitted
    // one is what the old behaviour fails.
    let stored: String = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        let when: Option<chrono::NaiveDateTime> = {{crate_name}}::schema::posts::table
            .find(id.parse::<i64>().expect("id"))
            .select({{crate_name}}::schema::posts::published_at)
            .first(&mut conn)
            .await
            .expect("the scheduled post");
        when.expect("a scheduled post has a date")
            .format("%H:%M")
            .to_string()
    };
    assert!(
        stored == "16:00" || stored == "17:00",
        "09:00 Pacific must be stored as the UTC instant it names, not as 09:00 UTC: {stored}"
    );

    // And the editor reads it back in the site's zone, so the round trip is
    // stable rather than drifting by the offset on every save.
    let editor = client
        .get(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .send()
        .await;
    editor.assert_ok();
    assert!(
        editor.text().contains(&local),
        "the editor must redisplay the wall clock the author typed"
    );
}

/// Creating a post with `status=future` and no publish date redisplays the
/// editor with the author's draft intact, instead of bouncing to the generic
/// error page `require_future_publish_date`'s `?` used to produce.
///
/// See [`{{crate_name}}::routes::admin::posts`]'s `PostForm::validate_fields`: the same
/// anti-pattern already fixed for `examples/wiki`'s page forms (#2773),
/// `examples/blog`'s post editor (#2687) and `reddit-clone`'s
/// create-community form (#2665).
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn scheduling_a_post_with_no_publish_date_redisplays_the_editor() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let resp = client
        .post("/admin/content/post")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "A future post"),
            ("slug", ""),
            ("excerpt", ""),
            ("body", "A body worth keeping."),
            ("status", "future"),
            ("password", ""),
            ("publish_at", ""),
        ]))
        .send()
        .await;
    resp.assert_status(422);
    let body = resp.text();
    assert!(
        body.contains("Pick a publish date for a scheduled post"),
        "the field-specific message must be shown: {body}"
    );
    assert!(
        body.contains("A future post") && body.contains("A body worth keeping."),
        "the author's title and body must round-trip rather than be lost: {body}"
    );
    assert!(
        body.contains(r#"aria-describedby="publish_at-error""#),
        "the publish-date field must be wired to its error for assistive tech: {body}"
    );

    use diesel::prelude::*;
    use diesel_async::RunQueryDsl;
    let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
    let count: i64 = {{crate_name}}::schema::posts::table
        .count()
        .get_result(&mut conn)
        .await
        .expect("count");
    assert_eq!(count, 0, "a rejected submission must not create a row");
}

/// Same rejection, for a publish date that has already passed.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn scheduling_a_post_with_a_past_publish_date_redisplays_the_editor() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let past = (chrono::Utc::now() - chrono::Duration::days(1))
        .naive_utc()
        .format("%Y-%m-%dT%H:%M")
        .to_string();
    let resp = client
        .post("/admin/content/post")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "Already due"),
            ("slug", ""),
            ("excerpt", ""),
            ("body", "Still a draft."),
            ("status", "future"),
            ("password", ""),
            ("publish_at", past.as_str()),
        ]))
        .send()
        .await;
    resp.assert_status(422);
    let body = resp.text();
    assert!(
        body.contains("A scheduled post needs a publish date in the future"),
        "the field-specific message must be shown: {body}"
    );
    assert!(
        body.contains(&past),
        "the exact wall clock the author typed must round-trip, not a reformatted or blanked \
         value: {body}"
    );
}

/// The same rejection on the *update* path: editing an already-published
/// post's title/body while switching its status to "Scheduled" without
/// picking a publish date must redisplay the editor with the edit intact
/// rather than discard it. `require_future_publish_date`'s own doc comment
/// names this general shape as an easy, ordinary editing mistake — not a
/// crafted request — since the field is not required and nothing prompts an
/// editor to fill it in before switching to "Scheduled".
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn rescheduling_an_edit_with_no_publish_date_redisplays_the_editor() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let created = client
        .post("/admin/content/post")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "Once live"),
            ("slug", "once-live"),
            ("excerpt", ""),
            ("body", "Original body."),
            ("status", "publish"),
            ("password", ""),
        ]))
        .send()
        .await;
    created.assert_status(303);
    let id = created
        .header("location")
        .expect("redirect")
        .rsplit('/')
        .next()
        .expect("id")
        .to_owned();

    let resp = client
        .post(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .form(
            &edit_form(
                &id,
                &[
                    ("title", "Once live, edited"),
                    ("slug", "once-live"),
                    ("excerpt", ""),
                    ("body", "Edited body worth keeping."),
                    ("status", "future"),
                    ("password", ""),
                ],
            )
            .await,
        )
        .send()
        .await;
    resp.assert_status(422);
    let body = resp.text();
    assert!(
        body.contains("Pick a publish date for a scheduled post"),
        "the field-specific message must be shown: {body}"
    );
    assert!(
        body.contains("Once live, edited") && body.contains("Edited body worth keeping."),
        "the just-typed edit must round-trip, not the previously-saved content: {body}"
    );

    use diesel::prelude::*;
    use diesel_async::RunQueryDsl;
    let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
    let stored_title: String = {{crate_name}}::schema::posts::table
        .find(id.parse::<i64>().expect("id"))
        .select({{crate_name}}::schema::posts::title)
        .first(&mut conn)
        .await
        .expect("the post");
    assert_eq!(
        stored_title, "Once live",
        "a rejected submission must not write the edit"
    );
}

/// A validation-rejected redisplay must carry the *submitted* `lock_version`
/// forward, not the row's current one — otherwise a stale edit's retry
/// silently stops being stale.
///
/// Concretely: editor A loads the form at version 1. Editor B saves first,
/// advancing the row to version 2. A submits their (now-stale) version-1 form
/// with a scheduling mistake (`status=future`, no date); `validate_fields`
/// rejects it and redisplays the editor. If that redisplay's hidden
/// `lock_version` field were stamped from the freshly-reloaded row (version 2)
/// instead of from A's own stale submission (version 1), fixing the date and
/// resubmitting would pass the stale-edit check it should fail, silently
/// overwriting B's edit — exactly the loss `expected_lock_version` exists to
/// prevent. This must still return 409, not 303.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn validation_redisplay_keeps_the_submitted_stale_lock_version() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let created = client
        .post("/admin/content/post")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "Editor A's starting point"),
            ("slug", "race"),
            ("excerpt", ""),
            ("body", "Original body."),
            ("status", "draft"),
            ("password", ""),
        ]))
        .send()
        .await;
    created.assert_status(303);
    let id = created
        .header("location")
        .expect("redirect")
        .rsplit('/')
        .next()
        .expect("id")
        .to_owned();

    use diesel::prelude::*;
    use diesel_async::RunQueryDsl;
    let stale_version: i32 = {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::posts::table
            .find(id.parse::<i64>().expect("id"))
            .select({{crate_name}}::schema::posts::lock_version)
            .first(&mut conn)
            .await
            .expect("the post")
    };

    // Editor B saves first, advancing the row past the version A's form was
    // rendered from.
    client
        .post(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .form(
            &edit_form(
                &id,
                &[
                    ("title", "Editor B's save"),
                    ("slug", "race"),
                    ("excerpt", ""),
                    ("body", "Editor B's body."),
                    ("status", "draft"),
                    ("password", ""),
                ],
            )
            .await,
        )
        .send()
        .await
        .assert_status(303);

    // Editor A submits their stale version-1 form with a scheduling mistake.
    let resp = client
        .post(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "Editor A's edit"),
            ("slug", "race"),
            ("excerpt", ""),
            ("body", "Editor A's body."),
            ("status", "future"),
            ("password", ""),
            ("lock_version", &stale_version.to_string()),
        ]))
        .send()
        .await;
    resp.assert_status(422);
    let body = resp.text();
    assert!(
        body.contains(&format!(r#"name="lock_version" value="{stale_version}""#)),
        "the redisplay must stamp back the version A actually submitted, not the row's current \
         (already-advanced) version: {body}"
    );

    // A fixes the date and resubmits the same (still-stale) lock_version, as
    // the redisplayed form's hidden field instructs them to.
    let future = (chrono::Utc::now() + chrono::Duration::days(1))
        .naive_utc()
        .format("%Y-%m-%dT%H:%M")
        .to_string();
    let retry = client
        .post(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "Editor A's edit"),
            ("slug", "race"),
            ("excerpt", ""),
            ("body", "Editor A's body."),
            ("status", "future"),
            ("password", ""),
            ("lock_version", &stale_version.to_string()),
            ("publish_at", future.as_str()),
        ]))
        .send()
        .await;
    retry.assert_status(409);

    let stored_title: String = {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::posts::table
            .find(id.parse::<i64>().expect("id"))
            .select({{crate_name}}::schema::posts::title)
            .first(&mut conn)
            .await
            .expect("the post")
    };
    assert_eq!(
        stored_title, "Editor B's save",
        "editor A's stale retry must not overwrite editor B's save"
    );
}

/// A completed import is not reconciled again.
///
/// The source marker says "an import created this row" and is written before
/// the row's terms, status and ancestry are — so on its own it cannot also mean
/// "and it is done". Without a separate completion record, importing the same
/// backup twice re-applied the file's terms and status over an editor's later
/// changes, on a screen that promises existing items are left alone.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_completed_import_is_left_alone_on_a_re_import() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let payload = serde_json::json!({
        "version": 3,
        "site_title": "Elsewhere",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "attachments": [],
        "posts": [
            {
                "post_type": "post", "title": "Restored", "slug": "restored",
                "excerpt": "", "body": "Imported body.", "status": "publish",
                "password": "", "comment_status": "open",
                "author": "owner", "terms": [], "comments": [],
                "published_at": null, "parent": null, "sticky": false, "menu_order": 0
            }
        ]
    })
    .to_string();

    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("1 imported");

    // An editor then unpublishes it — a perfectly ordinary thing to do to
    // restored content.
    let id: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::posts::table
            .filter({{crate_name}}::schema::posts::slug.eq("restored"))
            .select({{crate_name}}::schema::posts::id)
            .first(&mut conn)
            .await
            .expect("the imported post")
    };
    client
        .post(&format!("/admin/content/post/{id}/status?to=draft"))
        .header("cookie", &cookie)
        .send()
        .await
        .assert_status(303);

    // The same backup again. It must report the post as already present and
    // change nothing.
    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("already present");

    let status: String = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::posts::table
            .find(id)
            .select({{crate_name}}::schema::posts::status)
            .first(&mut conn)
            .await
            .expect("the imported post")
    };
    assert_eq!(
        status, "draft",
        "a finished import must not republish content an editor unpublished"
    );
}

/// The hierarchical parent picker is bounded, and keeps the current parent.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn the_parent_picker_is_bounded_and_keeps_its_selection() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    // 150 pages. `Page 001` is the most recently edited; `Page 150` is far
    // past the bound.
    try_execute(
        TestDb::shared().await,
        "INSERT INTO posts (post_type, title, slug, excerpt, body, status, author_id,
                            password, comment_status, menu_order, updated_at)
         SELECT 'page',
                'Page ' || lpad(g::text, 3, '0'),
                'page-' || lpad(g::text, 3, '0'),
                '', 'Body.', 'publish', 1, '', 'closed', 0,
                NOW() - (g || ' minutes')::interval
         FROM generate_series(1, 150) AS g",
    )
    .await
    .expect("seed the pages");

    let editor = client
        .get("/admin/content/page/new")
        .header("cookie", &cookie)
        .send()
        .await;
    editor.assert_ok();
    let editor = editor.text();
    assert!(editor.contains("Page 001"), "recent pages are offered");
    assert!(
        !editor.contains("Page 150"),
        "the picker must not render every page of the type"
    );
    assert!(editor.contains("most recently edited"));

    // A child whose parent is older than the bound must still see it selected,
    // or saving the form unchanged moves the page to the top level and changes
    // its canonical URL.
    try_execute(
        TestDb::shared().await,
        "INSERT INTO posts (post_type, title, slug, excerpt, body, status, author_id,
                            password, comment_status, menu_order, parent_id, updated_at)
         SELECT 'page', 'Child', 'child', '', 'Body.', 'publish', 1, '', 'closed', 0,
                (SELECT id FROM posts WHERE slug = 'page-150'), NOW()",
    )
    .await
    .expect("seed the child");

    let child_id: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::posts::table
            .filter({{crate_name}}::schema::posts::slug.eq("child"))
            .select({{crate_name}}::schema::posts::id)
            .first(&mut conn)
            .await
            .expect("the child page")
    };
    let editor = client
        .get(&format!("/admin/content/page/{child_id}"))
        .header("cookie", &cookie)
        .send()
        .await;
    editor.assert_ok();
    assert!(
        editor.text().contains("Page 150"),
        "a parent older than the bound must still be in the select"
    );
}

/// The taxonomy screen is paginated, and its parent selector is bounded.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn the_taxonomy_admin_screen_is_paginated() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    // 120 categories, `cat-001` … `cat-120`, ordered by name.
    try_execute(
        TestDb::shared().await,
        "INSERT INTO terms (taxonomy, name, slug, description, post_count)
         SELECT 'category',
                'cat-' || lpad(g::text, 3, '0'),
                'cat-' || lpad(g::text, 3, '0'),
                '', 0
         FROM generate_series(1, 120) AS g",
    )
    .await
    .expect("seed the terms");

    let first = client
        .get("/admin/terms/category")
        .header("cookie", &cookie)
        .send()
        .await;
    first.assert_ok();
    let first = first.text();
    assert!(first.contains("cat-001"), "the first term leads page one");
    assert!(first.contains("cat-050"), "page one holds a full page");
    // Counted on the per-row delete form rather than on a term name: the
    // parent selector below the table renders its own (differently bounded)
    // set of terms, so a name appearing on the page does not mean the *list*
    // grew.
    assert_eq!(
        first.matches("/delete\"").count(),
        50,
        "the list must stop at the page size rather than render the taxonomy"
    );
    assert!(first.contains("Page 1 of 3"));
    // The parent selector is bounded independently of the list: it may reach
    // past the page, but not to the whole taxonomy.
    assert!(
        !first.contains("cat-101"),
        "the parent selector must not render every term either"
    );
    assert!(first.contains("Showing the first"));

    let third = client
        .get("/admin/terms/category?page=3")
        .header("cookie", &cookie)
        .send()
        .await;
    third.assert_ok();
    let third = third.text();
    assert!(third.contains("cat-120"), "the tail is reachable");
    assert_eq!(
        third.matches("/delete\"").count(),
        20,
        "the last page holds the remainder, not a repeat of the first"
    );
}

/// A dated permalink names the day the site says the post was published.
///
/// `published_at` is stored in UTC; a dated URL names a *calendar day*, which
/// is a local question. Formatting the stored value directly gave a post
/// published at 23:30 on the 9th in Los Angeles a `/2026/09/10/` URL while
/// every rendered date on the page said the 9th — and the archive route, whose
/// bounds were raw UTC midnights, filed it under the 10th to match the URL
/// rather than the content.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_dated_permalink_and_its_archive_use_the_site_timezone() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    client
        .post("/admin/settings")
        .header("cookie", &cookie)
        .form(&settings_form(&[
            ("timezone", "America/Los_Angeles"),
            ("permalink_structure", "day_and_name"),
        ]))
        .send()
        .await
        .assert_status(303);

    create_post(&client, &cookie, "Late", "Body.", "publish").await;

    // 06:30 UTC on 2026-09-10 is 23:30 on the 9th in Los Angeles: the two zones
    // disagree about which day this is, which is the whole point.
    try_execute(
        TestDb::shared().await,
        "UPDATE posts SET published_at = '2026-09-10 06:30:00' WHERE slug = 'late'",
    )
    .await
    .expect("straddle the date boundary");

    sign_out(&client);
    let listed = client
        .get("/api/v1/posts")
        .send()
        .await
        .assert_ok()
        .json::<serde_json::Value>();
    let url = listed.as_array().expect("array")[0]["url"]
        .as_str()
        .expect("url")
        .to_owned();
    assert!(
        url.starts_with("/2026/09/09/"),
        "the URL must name the local day, not the UTC one: {url}"
    );
    client.get(&url).send().await.assert_ok();

    // And the archive agrees with the URL rather than with the stored value.
    client
        .get("/2026/09/09")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Late");
    let wrong_day = client.get("/2026/09/10").send().await;
    wrong_day.assert_ok();
    assert!(
        !wrong_day.text().contains("Late"),
        "the post must not also appear in the following day's archive"
    );
}

/// A mistyped timezone is refused, not stored as UTC.
///
/// `Settings::from_rows` ignores a value it cannot parse and keeps the default,
/// which is right for reading the options table and wrong for a form: the
/// default is UTC, so a typo would silently move a non-UTC site to UTC —
/// shifting every displayed date and the meaning of every scheduled time.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_mistyped_timezone_is_refused_rather_than_resetting_the_site() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    client
        .post("/admin/settings")
        .header("cookie", &cookie)
        .form(&settings_form(&[("timezone", "America/Los_Angeles")]))
        .send()
        .await
        .assert_status(303);

    let refused = client
        .post("/admin/settings")
        .header("cookie", &cookie)
        .form(&settings_form(&[("timezone", "Amerca/Los_Angeles")]))
        .send()
        .await;
    assert_eq!(
        refused.status,
        422,
        "a name the site cannot resolve must be refused: {}",
        refused.text()
    );

    // The setting the administrator chose is still in place.
    let screen = client
        .get("/admin/settings")
        .header("cookie", &cookie)
        .send()
        .await;
    screen.assert_ok();
    assert!(
        screen.text().contains("America/Los_Angeles"),
        "a refused submission must leave the previous zone alone"
    );
}

/// The editor's taxonomy checkboxes are bounded, and keep the post's own terms.
///
/// Saving *replaces* a post's filings, so a selected term missing from the form
/// would be silently unfiled — which makes retaining them part of the bound
/// rather than a nicety.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn the_editor_taxonomy_control_is_bounded_and_keeps_its_selection() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let id = create_post(&client, &cookie, "Filed", "Body.", "draft").await;

    // 150 categories, `cat-001` … `cat-150` by name.
    try_execute(
        TestDb::shared().await,
        "INSERT INTO terms (taxonomy, name, slug, description, post_count)
         SELECT 'category',
                'cat-' || lpad(g::text, 3, '0'),
                'cat-' || lpad(g::text, 3, '0'),
                '', 0
         FROM generate_series(1, 150) AS g",
    )
    .await
    .expect("seed the terms");

    let editor = client
        .get(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .send()
        .await;
    editor.assert_ok();
    let editor = editor.text();
    assert!(editor.contains("cat-001"), "the first terms are offered");
    assert!(
        !editor.contains("cat-150"),
        "the control must not render the whole taxonomy"
    );
    assert!(editor.contains("Showing the first"));

    // File the post under a term past the bound, behind the editor's back —
    // the same state an import or a bulk edit would leave.
    try_execute(
        TestDb::shared().await,
        &format!(
            "INSERT INTO post_terms (post_id, term_id)
             SELECT {id}, id FROM terms WHERE slug = 'cat-150'"
        ),
    )
    .await
    .expect("file the post");

    let editor = client
        .get(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .send()
        .await;
    editor.assert_ok();
    assert!(
        editor.text().contains("cat-150"),
        "a term the post carries must be in the form, or saving unfiles it"
    );
}

/// A page of authors keeps its distinct, its order and its bound.
///
/// `/api/v1/authors` is unauthenticated, and loading every distinct author id
/// before bounding the users query made even `?per_page=1` cost one row per
/// author on the wire and in memory. That cost is not observable through the
/// endpoint, so this is a correctness guard on the rewrite rather than a test
/// that fails without it: the `EXISTS` form has to keep excluding accounts with
/// no published content, keep the username ordering, and keep paging — three
/// things the two-query version got for free and a single query can quietly
/// lose.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn the_authors_endpoint_pages_in_sql() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    create_post(&client, &cookie, "Owned", "Body.", "publish").await;

    // 60 more accounts, each with a published post, plus 20 with none.
    try_execute(
        TestDb::shared().await,
        "INSERT INTO users (username, email, password_hash, display_name, role, bio, website)
         SELECT 'writer-' || lpad(g::text, 2, '0'),
                'writer-' || lpad(g::text, 2, '0') || '@example.com',
                'x', '', 'author', '', ''
         FROM generate_series(1, 80) AS g",
    )
    .await
    .expect("seed the accounts");
    try_execute(
        TestDb::shared().await,
        "INSERT INTO posts (post_type, title, slug, excerpt, body, status, author_id,
                            password, comment_status, menu_order)
         SELECT 'post',
                'By ' || u.username,
                'by-' || u.username,
                '', 'Body.', 'publish', u.id, '', 'open', 0
         FROM users u
         WHERE u.username LIKE 'writer-%'
           AND substring(u.username from 8)::int <= 60",
    )
    .await
    .expect("seed the posts");

    sign_out(&client);
    let page: serde_json::Value = client
        .get("/api/v1/authors?per_page=5")
        .send()
        .await
        .assert_ok()
        .json();
    let rows = page.as_array().expect("array");
    assert_eq!(rows.len(), 5, "the bound is the request's, not the site's");

    // Only accounts with published content, and ordered by username — the
    // twenty writers with no posts must not appear at all.
    let names: Vec<&str> = rows
        .iter()
        .map(|row| row["username"].as_str().expect("username"))
        .collect();
    assert_eq!(
        names,
        vec!["owner", "writer-01", "writer-02", "writer-03", "writer-04"],
        "the distinct, the order and the bound all have to survive the rewrite"
    );

    let later: serde_json::Value = client
        .get("/api/v1/authors?per_page=5&page=2")
        .send()
        .await
        .assert_ok()
        .json();
    let names: Vec<&str> = later
        .as_array()
        .expect("array")
        .iter()
        .map(|row| row["username"].as_str().expect("username"))
        .collect();
    assert_eq!(
        names,
        vec![
            "writer-05",
            "writer-06",
            "writer-07",
            "writer-08",
            "writer-09"
        ]
    );
}

/// A save can only apply so many terms, whichever control they came from.
///
/// The cap was on the flat taxonomy's free-text box and not on the hierarchical
/// id list, so a crafted submission could enumerate every term in a large
/// taxonomy: one database lookup per id on the way in, and a permanent set of
/// filings big enough to make that post's editor unbounded again, since the
/// picker adds every selected term back.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_save_cannot_apply_an_unbounded_number_of_terms() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let id = create_post(&client, &cookie, "Filed", "Body.", "draft").await;

    try_execute(
        TestDb::shared().await,
        "INSERT INTO terms (taxonomy, name, slug, description, post_count)
         SELECT 'category',
                'cat-' || lpad(g::text, 3, '0'),
                'cat-' || lpad(g::text, 3, '0'),
                '', 0
         FROM generate_series(1, 80) AS g",
    )
    .await
    .expect("seed the terms");

    let ids: Vec<i64> = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::terms::table
            .filter({{crate_name}}::schema::terms::taxonomy.eq("category"))
            .order({{crate_name}}::schema::terms::slug.asc())
            .select({{crate_name}}::schema::terms::id)
            .load(&mut conn)
            .await
            .expect("the seeded terms")
    };

    let save = async |count: usize| {
        let strings: Vec<String> = ids.iter().take(count).map(i64::to_string).collect();
        let mut fields = vec![
            ("title", "Filed"),
            ("slug", "filed"),
            ("excerpt", ""),
            ("body", "Body."),
            ("status", "draft"),
            ("password", ""),
        ];
        for value in &strings {
            fields.push(("taxonomies[category]", value.as_str()));
        }
        client
            .post(&format!("/admin/content/post/{id}"))
            .header("cookie", &cookie)
            .form(&edit_form(&id, &fields).await)
            .send()
            .await
    };

    let refused = save(80).await;
    assert_eq!(
        refused.status,
        422,
        "a submission past the cap must be refused: {}",
        refused.text()
    );

    // Nothing was filed — the cap is checked before any database work.
    let filed: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::post_terms::table
            .filter({{crate_name}}::schema::post_terms::post_id.eq(id))
            .count()
            .get_result(&mut conn)
            .await
            .expect("the filings")
    };
    assert_eq!(filed, 0, "a refused save must file nothing");

    // A save within the cap still works, and still files exactly what it named.
    assert_eq!(save(50).await.status, 303);
    let filed: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::post_terms::table
            .filter({{crate_name}}::schema::post_terms::post_id.eq(id))
            .count()
            .get_result(&mut conn)
            .await
            .expect("the filings")
    };
    assert_eq!(filed, 50, "the cap bounds the save, it does not break it");
}

/// A reply cannot be approved while an ancestor is hidden.
///
/// Hiding a parent cascades over its *approved* descendants, but a reply that
/// was already pending when its parent was spammed stays pending — and this is
/// where a moderator would then approve it. `assemble_thread` builds from the
/// roots down, so that reply can never be attached, while
/// `recount_post_comments` counts it: the post advertises a comment no reader
/// can reach.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_reply_cannot_be_approved_under_a_hidden_ancestor() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let post_id = create_post(&client, &cookie, "Thread", "Body.", "publish").await;

    // A signed-in comment lands approved; a guest reply is held for moderation.
    client
        .post(&format!("/comments/{post_id}"))
        .header("cookie", &cookie)
        .form(&form(&[("body", "Root comment.")]))
        .send()
        .await
        .assert_status(303);
    let root_id: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::comments::table
            .filter({{crate_name}}::schema::comments::body.eq("Root comment."))
            .select({{crate_name}}::schema::comments::id)
            .first(&mut conn)
            .await
            .expect("the root comment")
    };

    sign_out(&client);
    client
        .post(&format!("/comments/{post_id}"))
        .form(&form(&[
            ("body", "Pending reply."),
            ("author_name", "Guest"),
            ("author_email", "guest@example.com"),
            ("reply_to", root_id.to_string().as_str()),
        ]))
        .send()
        .await
        .assert_status(303);
    let reply_id: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::comments::table
            .filter({{crate_name}}::schema::comments::body.eq("Pending reply."))
            .select({{crate_name}}::schema::comments::id)
            .first(&mut conn)
            .await
            .expect("the reply")
    };

    // Spam the root. The reply was already pending, so the cascade leaves it.
    client
        .post(&format!("/admin/comments/{root_id}/status?to=spam"))
        .header("cookie", &cookie)
        .send()
        .await
        .assert_status(303);

    let refused = client
        .post(&format!("/admin/comments/{reply_id}/status?to=approved"))
        .header("cookie", &cookie)
        .send()
        .await;
    assert_eq!(
        refused.status,
        422,
        "approving under a hidden ancestor must be refused: {}",
        refused.text()
    );

    // Nothing was counted, and nothing is claimed on the page.
    let count: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::posts::table
            .find(post_id)
            .select({{crate_name}}::schema::posts::comment_count)
            .first(&mut conn)
            .await
            .expect("the post")
    };
    assert_eq!(count, 0, "a comment nobody can see must not be counted");

    // Restore the root, and the reply can be approved — the rule is an
    // ordering constraint, not a dead end.
    client
        .post(&format!("/admin/comments/{root_id}/status?to=approved"))
        .header("cookie", &cookie)
        .send()
        .await
        .assert_status(303);
    client
        .post(&format!("/admin/comments/{reply_id}/status?to=approved"))
        .header("cookie", &cookie)
        .send()
        .await
        .assert_status(303);
    sign_out(&client);
    client
        .get("/thread")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Pending reply.");
}

/// The model's title cap is enforced on the direct-Diesel edit path.
///
/// `update_post_with_revision` writes the fields back with plain Diesel — which
/// is what makes the edit and its revision one transaction, and what bypasses
/// the derived validator. The form's `maxlength` is a browser convenience: an
/// author could park a request-sized title on a draft and publish it
/// afterwards, at which point every listing, feed and API response carries it.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn an_oversized_title_is_refused_on_the_edit_path() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let id = create_post(&client, &cookie, "Modest", "Body.", "draft").await;

    let huge = "t".repeat(301);
    let refused = client
        .post(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .form(
            &edit_form(
                &id,
                &[
                    ("title", huge.as_str()),
                    ("slug", "modest"),
                    ("excerpt", ""),
                    ("body", "Body."),
                    ("status", "draft"),
                    ("password", ""),
                ],
            )
            .await,
        )
        .send()
        .await;
    assert_eq!(
        refused.status,
        422,
        "a title past the model's cap must be refused even on a draft: {}",
        refused.text()
    );

    // A title at the cap still saves — the bound is the model's, not tighter.
    let ok = "t".repeat(300);
    client
        .post(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .form(
            &edit_form(
                &id,
                &[
                    ("title", ok.as_str()),
                    ("slug", "modest"),
                    ("excerpt", ""),
                    ("body", "Body."),
                    ("status", "draft"),
                    ("password", ""),
                ],
            )
            .await,
        )
        .send()
        .await
        .assert_status(303);
}

/// The Appearance screen's category selector is bounded.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn the_appearance_category_selector_is_bounded() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    // A menu, so the screen renders the item builder at all.
    client
        .post("/admin/appearance/menus")
        .header("cookie", &cookie)
        .form(&form(&[("name", "Primary"), ("location", "primary")]))
        .send()
        .await
        .assert_status(303);

    try_execute(
        TestDb::shared().await,
        "INSERT INTO terms (taxonomy, name, slug, description, post_count)
         SELECT 'category',
                'cat-' || lpad(g::text, 3, '0'),
                'cat-' || lpad(g::text, 3, '0'),
                '', 0
         FROM generate_series(1, 250) AS g",
    )
    .await
    .expect("seed the terms");

    let screen = client
        .get("/admin/appearance")
        .header("cookie", &cookie)
        .send()
        .await;
    screen.assert_ok();
    let screen = screen.text();
    assert!(
        screen.contains("cat-001"),
        "the first categories are offered"
    );
    assert!(
        !screen.contains("cat-250"),
        "the selector must not render every category"
    );
    assert!(screen.contains("First 200 by name"));
}

/// Clearing the publish date on an unscheduled post clears the timestamp.
///
/// Leaving the old due time behind made "move this back to draft" keep a date
/// the post was never published at: publishing it later dated and ordered it at
/// that obsolete moment, and with a future date gave it a dated permalink and
/// an archive slot in the future.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn unscheduling_a_post_clears_its_publish_date() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let when = (chrono::Utc::now() + chrono::Duration::days(30))
        .naive_utc()
        .format("%Y-%m-%dT09:00")
        .to_string();
    let created = client
        .post("/admin/content/post")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "Later"),
            ("slug", "later"),
            ("excerpt", ""),
            ("body", "Body."),
            ("status", "future"),
            ("password", ""),
            ("publish_at", when.as_str()),
        ]))
        .send()
        .await;
    assert_eq!(created.status, 303, "body: {}", created.text());
    let id = created
        .header("location")
        .expect("redirect")
        .rsplit('/')
        .next()
        .expect("id")
        .to_owned();

    // Back to draft with the date field cleared — the editor unscheduling it.
    client
        .post(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .form(
            &edit_form(
                &id,
                &[
                    ("title", "Later"),
                    ("slug", "later"),
                    ("excerpt", ""),
                    ("body", "Body."),
                    ("status", "draft"),
                    ("password", ""),
                    ("publish_at", ""),
                ],
            )
            .await,
        )
        .send()
        .await
        .assert_status(303);

    let stored: Option<chrono::NaiveDateTime> = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::posts::table
            .find(id.parse::<i64>().expect("id"))
            .select({{crate_name}}::schema::posts::published_at)
            .first(&mut conn)
            .await
            .expect("the post")
    };
    assert!(
        stored.is_none(),
        "an unscheduled post must not keep the due time it never reached: {stored:?}"
    );

    // Publishing it now dates it now, not at the abandoned schedule.
    client
        .post(&format!("/admin/content/post/{id}/status?to=publish"))
        .header("cookie", &cookie)
        .send()
        .await
        .assert_status(303);
    let stored: chrono::NaiveDateTime = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::posts::table
            .find(id.parse::<i64>().expect("id"))
            .select({{crate_name}}::schema::posts::published_at)
            .first::<Option<chrono::NaiveDateTime>>(&mut conn)
            .await
            .expect("the post")
            .expect("a published post is dated")
    };
    assert!(
        stored <= chrono::Utc::now().naive_utc(),
        "a post published now must not be dated in the future: {stored}"
    );

    // A post that really was published keeps its date across an edit.
    let live = create_post(&client, &cookie, "Live", "Body.", "publish").await;
    try_execute(
        TestDb::shared().await,
        &format!("UPDATE posts SET published_at = '2020-01-01 00:00:00' WHERE id = {live}"),
    )
    .await
    .expect("backdate");
    client
        .post(&format!("/admin/content/post/{live}"))
        .header("cookie", &cookie)
        .form(
            &edit_form(
                &live,
                &[
                    ("title", "Live"),
                    ("slug", "live"),
                    ("excerpt", ""),
                    ("body", "Edited."),
                    ("status", "publish"),
                    ("password", ""),
                    ("publish_at", ""),
                ],
            )
            .await,
        )
        .send()
        .await
        .assert_status(303);
    let kept: Option<chrono::NaiveDateTime> = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::posts::table
            .find(live)
            .select({{crate_name}}::schema::posts::published_at)
            .first(&mut conn)
            .await
            .expect("the post")
    };
    assert!(
        kept.is_some_and(|when| when.format("%Y").to_string() == "2020"),
        "editing a published post must never reorder the blog index: {kept:?}"
    );
}

/// A backup restores after its schedules have elapsed.
///
/// `transition_status` refuses `future` with a past date — correctly, since
/// such a schedule either never fires or fires on the next sweep. But a backup
/// restored after downtime routinely carries exactly that, and the importer
/// unwound the post and aborted, so a valid backup could not be restored
/// without hand-editing its JSON.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn an_import_publishes_a_schedule_that_has_already_passed() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let payload = serde_json::json!({
        "version": 3,
        "site_title": "Elsewhere",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "attachments": [],
        "posts": [
            {
                "post_type": "post", "title": "Was Scheduled", "slug": "was-scheduled",
                "excerpt": "", "body": "Imported body.", "status": "future",
                "password": "", "comment_status": "open",
                "author": "owner", "terms": [], "comments": [],
                "published_at": "2020-01-01T00:00:00", "parent": null,
                "sticky": false, "menu_order": 0
            }
        ]
    })
    .to_string();

    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("1 imported");

    // Published rather than stuck `future`, which the sweep would never claim
    // for a date already in the past.
    let status: String = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::posts::table
            .filter({{crate_name}}::schema::posts::slug.eq("was-scheduled"))
            .select({{crate_name}}::schema::posts::status)
            .first(&mut conn)
            .await
            .expect("the imported post")
    };
    assert_eq!(status, "publish");

    sign_out(&client);
    let listed: serde_json::Value = client.get("/api/v1/posts").send().await.assert_ok().json();
    assert!(
        listed
            .as_array()
            .expect("array")
            .iter()
            .any(|p| p["slug"] == "was-scheduled"),
        "the restored post has to be readable, not stranded"
    );

    // A schedule still in the future is restored as a schedule.
    let future = (chrono::Utc::now() + chrono::Duration::days(30))
        .naive_utc()
        .format("%Y-%m-%dT%H:%M:%S")
        .to_string();
    let payload = serde_json::json!({
        "version": 3,
        "site_title": "Elsewhere",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "attachments": [],
        "posts": [
            {
                "post_type": "post", "title": "Still Scheduled", "slug": "still-scheduled",
                "excerpt": "", "body": "Imported body.", "status": "future",
                "password": "", "comment_status": "open",
                "author": "owner", "terms": [], "comments": [],
                "published_at": future, "parent": null,
                "sticky": false, "menu_order": 0
            }
        ]
    })
    .to_string();
    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("1 imported");
    let status: String = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::posts::table
            .filter({{crate_name}}::schema::posts::slug.eq("still-scheduled"))
            .select({{crate_name}}::schema::posts::status)
            .first(&mut conn)
            .await
            .expect("the imported post")
    };
    assert_eq!(
        status, "future",
        "a schedule that has not elapsed must stay a schedule"
    );
}

/// The importer accepts an export the exporter can actually produce.
///
/// The old form posted the JSON as a URL-encoded field, where every quote and
/// brace becomes a three-byte escape — so a backup roughly a third of the
/// request limit already exceeded it, and the CMS could not restore its own
/// export under the shipped configuration.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn the_importer_accepts_an_export_too_large_to_url_encode() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    // A body big enough that URL-encoding the JSON would have pushed the
    // request past the 32 MiB limit, while the raw bytes stay inside the
    // importer's own cap. Built from characters form encoding has to escape
    // and JSON does not, so the encoded length is close to three times the
    // raw one — which is exactly the inflation that made a real backup
    // unrestorable.
    let body = "{}&%<>,;".repeat(1_500_000);
    let payload = serde_json::json!({
        "version": 3,
        "site_title": "Elsewhere",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "attachments": [],
        "posts": [
            {
                "post_type": "post", "title": "Bulky", "slug": "bulky",
                "excerpt": "", "body": body, "status": "publish",
                "password": "", "comment_status": "open",
                "author": "owner", "terms": [], "comments": [],
                "published_at": null, "parent": null, "sticky": false, "menu_order": 0
            }
        ]
    })
    .to_string();
    assert!(
        payload.len() < 24 * 1024 * 1024,
        "the fixture has to fit the importer's own cap: {}",
        payload.len()
    );
    // The premise, asserted rather than assumed: this payload could not have
    // reached the old handler at all. `form()` percent-encodes every byte that
    // is not unreserved, so the JSON's quotes, braces and spaces each become
    // three bytes — and the encoded body exceeds the framework's 32 MiB request
    // limit, which the extractor applies before any handler runs.
    assert!(
        form(&[("payload", payload.as_str())]).len() > 32 * 1024 * 1024,
        "if this does not exceed the limit, the test is not testing the fix"
    );

    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("1 imported");

    let stored: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::posts::table
            .filter({{crate_name}}::schema::posts::slug.eq("bulky"))
            .count()
            .get_result(&mut conn)
            .await
            .expect("the imported post")
    };
    assert_eq!(stored, 1);
}

/// An edit without a version stamp is refused, not silently unguarded.
///
/// `update_post_with_revision` takes an `Option` because the importer and the
/// API legitimately have no form behind them. For the editor a missing, empty
/// or unparseable value is not "no form" — it is a form whose guard has been
/// removed, and falling through to `None` disabled the stale-edit check
/// entirely, so a crafted save could overwrite an edit committed after the form
/// was loaded.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn an_edit_without_a_version_stamp_is_refused() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let id = create_post(&client, &cookie, "Contested", "First.", "publish").await;

    let fields = |version: Option<&str>| {
        let mut fields = vec![
            ("title", "Contested"),
            ("slug", "contested"),
            ("excerpt", ""),
            ("body", "Overwritten."),
            ("status", "publish"),
            ("password", ""),
            ("comment_status", "open"),
        ];
        if let Some(version) = version {
            fields.push(("lock_version", version));
        }
        form(&fields)
    };

    for (label, version) in [
        ("missing", None),
        ("empty", Some("")),
        ("malformed", Some("not-a-number")),
    ] {
        let refused = client
            .post(&format!("/admin/content/post/{id}"))
            .header("cookie", &cookie)
            .form(&fields(version))
            .send()
            .await;
        assert_eq!(
            refused.status,
            422,
            "a {label} version stamp must be refused rather than skipping the check: {}",
            refused.text()
        );
    }

    // The body is untouched by any of them.
    sign_out(&client);
    client
        .get("/contested")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("First.");

    // A stale-but-well-formed version is still refused by the existing check,
    // and the current one still saves — the requirement is on the stamp being
    // present, not on the guard changing.
    let current: i32 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::posts::table
            .find(id)
            .select({{crate_name}}::schema::posts::lock_version)
            .first(&mut conn)
            .await
            .expect("the post")
    };
    let stale = client
        .post(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .form(&fields(Some(&(current - 1).to_string())))
        .send()
        .await;
    assert_ne!(stale.status, 303, "a stale save must still be refused");

    client
        .post(&format!("/admin/content/post/{id}"))
        .header("cookie", &cookie)
        .form(&fields(Some(&current.to_string())))
        .send()
        .await
        .assert_status(303);
    sign_out(&client);
    client
        .get("/contested")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Overwritten.");
}

/// A widget or sitemap archive is derived from posts, not from a cached count.
///
/// `terms.post_count` is maintained by `recount_term`, which applies the
/// *current* `public_type_slugs()` — right whenever it runs, and stale the
/// moment the answer to "is this type public?" changes without a write to
/// touch it. `register_post_type` supports replacing a registration, so a
/// deployment can flip a type's visibility between restarts and nothing
/// recomputes the counters. A stale positive count then advertises an archive
/// whose own listing is empty.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_stale_term_count_does_not_advertise_an_empty_archive() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    client
        .post("/admin/terms/category")
        .header("cookie", &cookie)
        .form(&form(&[
            ("name", "Ghosts"),
            ("slug", ""),
            ("description", ""),
        ]))
        .send()
        .await
        .assert_status(303);

    // The state a visibility flip leaves behind: a positive count with nothing
    // published behind it. Written directly, because the supported way to
    // produce it — re-registering a post type as non-public — is
    // process-global and would change every other test's registry.
    try_execute(
        TestDb::shared().await,
        "UPDATE terms SET post_count = 7 WHERE slug = 'ghosts'",
    )
    .await
    .expect("stale the counter");

    sign_out(&client);
    let home = client.get("/").send().await;
    home.assert_ok();
    assert!(
        !home.text().contains("Ghosts"),
        "the widget must not advertise an archive with nothing in it"
    );
    let sitemap = client.get("/sitemap.xml").send().await;
    sitemap.assert_ok();
    assert!(
        !sitemap.text().contains("/category/ghosts"),
        "the sitemap must not list an archive with nothing in it"
    );

    // And a term that really does have a published post is still listed, so
    // the derivation replaced the counter rather than emptying the widget.
    let id = create_post(&client, &cookie, "Real", "Body.", "publish").await;
    let term: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::terms::table
            .filter({{crate_name}}::schema::terms::slug.eq("ghosts"))
            .select({{crate_name}}::schema::terms::id)
            .first(&mut conn)
            .await
            .expect("the term")
    };
    try_execute(
        TestDb::shared().await,
        &format!("INSERT INTO post_terms (post_id, term_id) VALUES ({id}, {term})"),
    )
    .await
    .expect("file the post");

    sign_out(&client);
    client
        .get("/sitemap.xml")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("/category/ghosts");
}

/// The importer's ceiling is the deployment's configuration, not a constant.
///
/// A hard-coded cap made `security.upload.max_request_size_bytes` ineffective:
/// the exporter is unbounded, so a fixed number is a size of backup the CMS can
/// create and cannot restore, with no way out. The screen states the number the
/// handler enforces, and both come from the same place.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn the_import_ceiling_follows_the_configured_request_limit() {
    // For the schema, the truncation and the cache reset — this test then
    // builds its own client, because the limit under test is configuration the
    // shared harness does not vary.
    drop(db_client().await);
    let db = TestDb::shared().await;

    // A deployment that has raised the limit well past the old constant.
    let mut config = AutumnConfig::default();
    config.security.csrf.enabled = false;
    config.security.submit_token.enabled = false;
    config.security.upload.max_request_size_bytes = 96 * 1024 * 1024;
    let client = TestApp::new()
        .routes(app_routes())
        .config(config)
        .with_db(db.pool())
        .build();
    let cookie = register(&client, "owner").await;

    let screen = client
        .get("/admin/tools")
        .header("cookie", &cookie)
        .send()
        .await;
    screen.assert_ok();
    let screen = screen.text();
    assert!(
        screen.contains("Up to 95 MB"),
        "the screen must state the configured ceiling, not a constant:\n{screen}"
    );
    assert!(
        screen.contains("max_request_size_bytes"),
        "and name the knob that changes it"
    );
}

/// Deleting an account cannot silently re-root somebody else's pages.
///
/// `posts.author_id ... ON DELETE CASCADE` removes the account's content and
/// `posts.parent_id ... ON DELETE SET NULL` then moves a surviving child to the
/// top level — its canonical URL changes from `/parent/child` to `/child` and
/// every inbound link and sitemap entry for it breaks. The explicit trash path
/// already refuses for this reason; deleting the author was the way around it.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn deleting_an_account_will_not_orphan_another_authors_pages() {
    let client = db_client().await;
    let owner = register(&client, "owner").await;

    sign_out(&client);
    let author = register(&client, "author").await;
    client
        .post("/admin/users/2")
        .header("cookie", &owner)
        .form(&form(&[
            ("role", "author"),
            ("email", "author@example.com"),
            ("display_name", "Author"),
            ("bio", ""),
            ("website", ""),
        ]))
        .send()
        .await
        .assert_status(303);

    // The author owns a parent page; the owner owns a child under it.
    let parent = client
        .post("/admin/content/page")
        .header("cookie", &author)
        .form(&form(&[
            ("title", "Guides"),
            ("slug", "guides"),
            ("excerpt", ""),
            ("body", "Body."),
            ("status", "publish"),
            ("password", ""),
        ]))
        .send()
        .await;
    assert_eq!(parent.status, 303, "body: {}", parent.text());
    let parent_id = parent
        .header("location")
        .expect("redirect")
        .rsplit('/')
        .next()
        .expect("id")
        .to_owned();

    client
        .post("/admin/content/page")
        .header("cookie", &owner)
        .form(&form(&[
            ("title", "Install"),
            ("slug", "install"),
            ("excerpt", ""),
            ("body", "Body."),
            ("status", "publish"),
            ("password", ""),
            ("parent_id", parent_id.as_str()),
        ]))
        .send()
        .await
        .assert_status(303);
    sign_out(&client);
    client.get("/guides/install").send().await.assert_ok();

    // Deleting the author would take the parent with it.
    let refused = client
        .post("/admin/users/2/delete")
        .header("cookie", &owner)
        .send()
        .await;
    assert_eq!(
        refused.status,
        422,
        "the deletion must be refused rather than re-rooting the child: {}",
        refused.text()
    );

    // The account and the hierarchy are both intact.
    sign_out(&client);
    client
        .get("/guides/install")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Body.");

    // Trashing the child first makes the deletion allowed — the rule is a
    // precondition, not a permanent block.
    let child: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::posts::table
            .filter({{crate_name}}::schema::posts::slug.eq("install"))
            .select({{crate_name}}::schema::posts::id)
            .first(&mut conn)
            .await
            .expect("the child page")
    };
    client
        .post(&format!("/admin/content/page/{child}/status?to=trash"))
        .header("cookie", &owner)
        .send()
        .await
        .assert_status(303);
    client
        .post("/admin/users/2/delete")
        .header("cookie", &owner)
        .send()
        .await
        .assert_status(303);
}

/// A slug cannot collide with the framework's own probe routes.
///
/// `health.enabled` is on by default, so `GET /health`, `/live`, `/ready` and
/// `/startup` are mounted by the framework — not by `all_routes()`, which is
/// why the reservation list built from what the app declares had no reason to
/// include them. A literal route beats the front controller's wildcard, so a
/// post that took the bare slug `health` advertised a permalink it could never
/// be served at.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_slug_cannot_shadow_a_framework_probe_route() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    for probe in ["health", "live", "ready", "startup"] {
        let created = client
            .post("/admin/content/post")
            .header("cookie", &cookie)
            .form(&form(&[
                ("title", probe),
                ("slug", probe),
                ("excerpt", ""),
                ("body", "Body."),
                ("status", "publish"),
                ("password", ""),
            ]))
            .send()
            .await;
        assert_eq!(created.status, 303, "body: {}", created.text());

        let slug: String = {
            use diesel::prelude::*;
            use diesel_async::RunQueryDsl;
            let id: i64 = created
                .header("location")
                .expect("redirect")
                .rsplit('/')
                .next()
                .expect("id")
                .parse()
                .expect("id");
            let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
            {{crate_name}}::schema::posts::table
                .find(id)
                .select({{crate_name}}::schema::posts::slug)
                .first(&mut conn)
                .await
                .expect("the post")
        };
        assert_ne!(
            slug, probe,
            "`{probe}` is mounted by the framework, so a post taking it bare is unreachable"
        );
        assert!(
            slug.starts_with(probe),
            "the allocator should suffix rather than rename: {slug}"
        );
    }
}

/// The publish sweep works in bounded batches.
///
/// Loading every due post held each one's whole body in memory before
/// publishing any of them, so a backlog — downtime, or many authors scheduling
/// the same slot — could exhaust the task or run past its next tick.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn the_publish_sweep_drains_a_backlog_in_batches() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    create_post(&client, &cookie, "Anchor", "Body.", "draft").await;

    // 150 posts all due, more than one batch. Seeded directly: scheduling them
    // through the editor is not what this is about.
    try_execute(
        TestDb::shared().await,
        "INSERT INTO posts (post_type, title, slug, excerpt, body, status, author_id,
                            password, comment_status, menu_order, published_at)
         SELECT 'post',
                'Due ' || lpad(g::text, 3, '0'),
                'due-' || lpad(g::text, 3, '0'),
                '', 'Body.', 'future', 1, '', 'open', 0,
                NOW() - (g || ' minutes')::interval
         FROM generate_series(1, 150) AS g",
    )
    .await
    .expect("seed the backlog");

    let due_count = async || -> i64 {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::posts::table
            .filter({{crate_name}}::schema::posts::status.eq("future"))
            .count()
            .get_result(&mut conn)
            .await
            .expect("the backlog")
    };
    assert_eq!(due_count().await, 150);

    // One sweep claims a bounded batch, not the lot.
    let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
    let batch = {{crate_name}}::content::due_scheduled_posts(&mut conn, {{crate_name}}::tasks::PUBLISH_BATCH)
        .await
        .expect("a batch");
    assert_eq!(
        batch.len(),
        100,
        "a sweep must claim a bounded batch, not the whole backlog"
    );

    // Oldest first, so a backlog drains in the order the schedules were meant
    // to fire rather than starving the earliest posts. `due-150` is the one
    // seeded furthest in the past.
    assert_eq!(batch[0].slug, "due-150");
    assert_eq!(batch[99].slug, "due-051");

    // Publishing that batch leaves exactly the remainder for the next tick.
    for post in &batch {
        let status = post
            .transition_status_to("publish")
            .expect("a due post publishes");
        {{crate_name}}::content::publish_due_post(&mut conn, post.id, post.published_at, &status)
            .await
            .expect("publish");
    }
    assert_eq!(due_count().await, 50, "the rest wait for the next tick");
    let batch = {{crate_name}}::content::due_scheduled_posts(&mut conn, {{crate_name}}::tasks::PUBLISH_BATCH)
        .await
        .expect("a batch");
    assert_eq!(batch.len(), 50, "and the next tick drains them");
}

/// A batched menu resolves to the same URLs it did item by item.
///
/// The resolution moved from a query per item — plus one per ancestor for a
/// page — to two set queries and one more per level of hierarchy. That is a
/// cost change, not a behaviour change, and the cost is not observable through
/// the endpoint: this is a correctness guard on the rewrite rather than a test
/// that fails without it. What a single batched pass can quietly lose is the
/// per-item detail, so it pins all three link kinds and a nested page's full
/// ancestry.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_batched_menu_resolves_every_link_kind() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let page = async |title: &str, slug: &str, parent: Option<&str>| -> String {
        let mut fields = vec![
            ("title", title),
            ("slug", slug),
            ("excerpt", ""),
            ("body", "Body."),
            ("status", "publish"),
            ("password", ""),
        ];
        if let Some(parent) = parent {
            fields.push(("parent_id", parent));
        }
        let created = client
            .post("/admin/content/page")
            .header("cookie", &cookie)
            .form(&form(&fields))
            .send()
            .await;
        assert_eq!(created.status, 303, "creating {title}: {}", created.text());
        created
            .header("location")
            .expect("redirect")
            .rsplit('/')
            .next()
            .expect("id")
            .to_owned()
    };

    // Three levels, so the ancestry walk has to cross more than one map lookup.
    let about = page("About", "about", None).await;
    let team = page("Team", "team", Some(&about)).await;
    let nested = page("Alice", "alice", Some(&team)).await;

    client
        .post("/admin/terms/category")
        .header("cookie", &cookie)
        .form(&form(&[
            ("name", "News"),
            ("slug", ""),
            ("description", ""),
        ]))
        .send()
        .await
        .assert_status(303);
    let term: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::terms::table
            .filter({{crate_name}}::schema::terms::slug.eq("news"))
            .select({{crate_name}}::schema::terms::id)
            .first(&mut conn)
            .await
            .expect("the term")
    };

    client
        .post("/admin/appearance/menus")
        .header("cookie", &cookie)
        .form(&form(&[("name", "Primary"), ("location", "primary")]))
        .send()
        .await
        .assert_status(303);
    let menu: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::menus::table
            .select({{crate_name}}::schema::menus::id)
            .first(&mut conn)
            .await
            .expect("the menu")
    };

    // One item of each kind the editor offers.
    for fields in [
        vec![("label", "Deep page"), ("post_id", nested.as_str())],
        vec![("label", "News"), ("term_id", &term.to_string())],
        vec![("label", "Elsewhere"), ("url", "https://example.com/x")],
    ] {
        let mut all = fields.clone();
        all.push(("parent_id", ""));
        client
            .post(&format!("/admin/appearance/menus/{menu}/items"))
            .header("cookie", &cookie)
            .form(&form(&all))
            .send()
            .await
            .assert_status(303);
    }

    sign_out(&client);
    let home = client.get("/").send().await;
    home.assert_ok();
    let home = home.text();
    assert!(
        home.contains("/about/team/alice"),
        "a page target keeps its full ancestry through the batched walk:\n{home}"
    );
    assert!(home.contains("/category/news"), "a term target resolves");
    assert!(
        home.contains("https://example.com/x"),
        "a raw URL passes through"
    );
}

/// A taxonomy whose slug is not a single URL segment is refused.
///
/// `claim_on` checks the `rewrite_base`, never the internal slug — so
/// `product/type` registered cleanly and then named `/admin/terms/product/type`,
/// a path the one-segment route cannot match. The taxonomy had a working term
/// screen it was impossible to reach, and the menu entry built from the
/// registry linked to a 404.
#[test]
fn a_taxonomy_slug_must_be_one_url_segment() {
    let refused = {{crate_name}}::content_types::register_taxonomy({{crate_name}}::content_types::Taxonomy {
        slug: "product/type",
        singular: "Product type",
        plural: "Product types",
        hierarchical: true,
        post_types: &["post"],
        rewrite_base: "product-type",
    });
    let error = refused.expect_err("a slug with a path separator is not a segment");
    assert_eq!(error.field, "slug");

    // A well-shaped one still registers — the check bounds the input rather
    // than closing the door.
    {{crate_name}}::content_types::register_taxonomy({{crate_name}}::content_types::Taxonomy {
        slug: "product-type",
        singular: "Product type",
        plural: "Product types",
        hierarchical: true,
        post_types: &["post"],
        rewrite_base: "product-type",
    })
    .expect("a single-segment slug registers");
}

/// An import that dies between the insert and its marker leaves nothing behind.
///
/// The insert used to sit outside the transaction, because the `Repos`
/// allocator takes a connection of its own. A failure between it and
/// `record_import_source` left an unmarked post, which the next run reads as
/// unrelated local content holding that slug and skips forever — its terms,
/// status and ancestry never restored. The handler's unwind covered a failed
/// statement; nothing covered a process that stops existing.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn an_interrupted_import_leaves_no_unmarked_post() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    // Fail the run *after* the post row is written, which is the window the
    // transaction now closes. A trigger on `post_meta` fires between the insert
    // and the marker's commit, standing in for the process death that would do
    // it in practice.
    let db = TestDb::shared().await;
    try_execute(
        db,
        "CREATE OR REPLACE FUNCTION refuse_marker() RETURNS trigger AS $$
         BEGIN
             IF NEW.meta_key = '_import_source_slug' THEN RAISE EXCEPTION 'boom'; END IF;
             RETURN NEW;
         END; $$ LANGUAGE plpgsql",
    )
    .await
    .expect("create the trigger function");
    try_execute(db, "DROP TRIGGER IF EXISTS refuse_marker ON post_meta")
        .await
        .expect("clear any previous trigger");
    try_execute(
        db,
        "CREATE TRIGGER refuse_marker BEFORE INSERT ON post_meta
         FOR EACH ROW EXECUTE FUNCTION refuse_marker()",
    )
    .await
    .expect("install the trigger");

    let payload = serde_json::json!({
        "version": 3,
        "site_title": "Elsewhere",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "attachments": [],
        "posts": [
            {
                "post_type": "post", "title": "Restored", "slug": "restored",
                "excerpt": "", "body": "Imported body.", "status": "publish",
                "password": "", "comment_status": "open",
                "author": "owner", "terms": [], "comments": [],
                "published_at": null, "parent": null, "sticky": false, "menu_order": 0
            }
        ]
    })
    .to_string();

    let failed = import_export(&client, &cookie, payload.as_str()).await;
    assert_ne!(failed.status, 200, "the import must not report success");

    let rows: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::posts::table
            .filter({{crate_name}}::schema::posts::slug.eq("restored"))
            .count()
            .get_result(&mut conn)
            .await
            .expect("the count")
    };
    assert_eq!(
        rows, 0,
        "an unmarked post is the one state a retry cannot recognise, so the \
         insert has to roll back with the marker"
    );

    try_execute(db, "DROP TRIGGER refuse_marker ON post_meta")
        .await
        .expect("remove the trigger");

    // And the same file imports cleanly once the failure is gone.
    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("1 imported");
}

/// Deleting an author is serialized with re-parenting.
///
/// The orphan check reads rows the deletion does not lock, so being in one
/// transaction is not enough on its own: an editor filing their live page under
/// this author's page in between would commit first, and the deletion would
/// then re-root it having asked the question before the answer changed. Both
/// paths take `PAGE_HIERARCHY_LOCK_KEY`, so one waits for the other.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn deleting_an_author_takes_the_hierarchy_lock() {
    let client = db_client().await;
    let owner = register(&client, "owner").await;

    sign_out(&client);
    let author = register(&client, "author").await;
    client
        .post("/admin/users/2")
        .header("cookie", &owner)
        .form(&form(&[
            ("role", "author"),
            ("email", "author@example.com"),
            ("display_name", "Author"),
            ("bio", ""),
            ("website", ""),
        ]))
        .send()
        .await
        .assert_status(303);

    client
        .post("/admin/content/page")
        .header("cookie", &author)
        .form(&form(&[
            ("title", "Guides"),
            ("slug", "guides"),
            ("excerpt", ""),
            ("body", "Body."),
            ("status", "publish"),
            ("password", ""),
        ]))
        .send()
        .await
        .assert_status(303);

    // The lock is held for the whole deletion, so a re-parent racing it waits
    // rather than slipping between the check and the delete. Held here from
    // another session — a session-level advisory lock conflicts with the
    // transaction-level one `lock_page_hierarchy` takes, they share one lock
    // space — so the deletion cannot start while it is held. If it did not take
    // the lock at all it would return immediately, which is what makes this
    // test discriminating rather than a description.
    {
        use diesel_async::RunQueryDsl;
        let mut holder = TestDb::shared().await.pool().get().await.expect("conn");
        diesel::sql_query(format!(
            "SELECT pg_advisory_lock({})",
            {{crate_name}}::content::PAGE_HIERARCHY_LOCK_KEY
        ))
        .execute(&mut holder)
        .await
        .expect("take the lock");

        let mut worker = TestDb::shared().await.pool().get().await.expect("conn");
        let blocked = tokio::time::timeout(
            std::time::Duration::from_millis(750),
            {{crate_name}}::content::delete_user(&mut worker, 1, 2),
        )
        .await;
        assert!(
            blocked.is_err(),
            "the deletion must wait on the hierarchy lock, not race it"
        );

        diesel::sql_query(format!(
            "SELECT pg_advisory_unlock({})",
            {{crate_name}}::content::PAGE_HIERARCHY_LOCK_KEY
        ))
        .execute(&mut holder)
        .await
        .expect("release the lock");
    }

    // With the lock released it completes.
    let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
    {{crate_name}}::content::delete_user(&mut conn, 1, 2)
        .await
        .expect("the deletion proceeds once the lock is free");
}

/// A locked post shows no thread, and does no work building one.
///
/// The thread used to be rendered and then discarded for a password-protected
/// post, so a deliberately locked public URL handed every anonymous request the
/// most expensive path on the page — a count, up to two hundred comment rows,
/// their authors and the whole tree.
///
/// The saved work is not observable here: the markup was discarded, so the
/// response was already correct and this test passes with the gate removed. It
/// is a correctness guard on the *output* half — that a locked page leaks
/// neither the comments nor their scaffolding, and that unlocking restores
/// both. The cost half is visible only in the diff.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_locked_post_renders_no_comment_thread() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let created = client
        .post("/admin/content/post")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "Secret"),
            ("slug", "secret"),
            ("excerpt", ""),
            ("body", "Body."),
            ("status", "publish"),
            ("password", "hunter2"),
            ("comment_status", "open"),
        ]))
        .send()
        .await;
    assert_eq!(created.status, 303, "body: {}", created.text());
    let id = created
        .header("location")
        .expect("redirect")
        .rsplit('/')
        .next()
        .expect("id")
        .to_owned();

    // A comment already on it, so there is a thread to leak. The comment
    // endpoint requires the password too, so unlock first — which is also what
    // makes the sign-out below a real transition back to locked.
    client
        .post(&format!("/unlock/{id}"))
        .header("cookie", &cookie)
        .form(&form(&[("password", "hunter2")]))
        .send()
        .await
        .assert_status(303);
    client
        .post(&format!("/comments/{id}"))
        .header("cookie", &cookie)
        .form(&form(&[("body", "Insider knowledge.")]))
        .send()
        .await
        .assert_status(303);

    // Locked: the page asks for the password and says nothing about comments.
    sign_out(&client);
    let locked = client.get("/secret").send().await;
    locked.assert_ok();
    let locked = locked.text();
    assert!(
        !locked.contains("Insider knowledge."),
        "a locked post must not render its thread"
    );
    assert!(
        !locked.contains("comments-heading"),
        "and must not render the thread scaffolding either — the work is what \
         this is about, not just the text:\n{locked}"
    );

    // Unlocked, it is all there.
    client
        .post(&format!("/unlock/{id}"))
        .form(&form(&[("password", "hunter2")]))
        .send()
        .await
        .assert_status(303);
    client
        .get("/secret")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Insider knowledge.");
}

/// A thread by many distinct accounts still renders every name.
///
/// The commenter lookup moved from one query per distinct account to a single
/// `WHERE id IN (…)`. That is a cost change rather than a behaviour change and
/// the cost is not observable through the endpoint, so this is a correctness
/// guard: what a batched fetch can quietly lose is a name, or the distinction
/// between a registered commenter's current public name and the name a guest
/// gave at the time.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_thread_by_many_accounts_renders_every_name() {
    let client = db_client().await;
    let owner = register(&client, "owner").await;
    let post_id = create_post(&client, &owner, "Busy", "Body.", "publish").await;

    // Three registered commenters, each with a display name that differs from
    // their username — so a lookup that silently missed would show the wrong
    // thing rather than nothing.
    for n in 1..=3 {
        sign_out(&client);
        let cookie = register(&client, &format!("commenter{n}")).await;
        client
            .post(&format!("/admin/users/{}", n + 1))
            .header("cookie", &owner)
            .form(&form(&[
                ("role", "subscriber"),
                ("email", &format!("commenter{n}@example.com")),
                ("display_name", &format!("Person {n}")),
                ("bio", ""),
                ("website", ""),
            ]))
            .send()
            .await
            .assert_status(303);
        client
            .post(&format!("/comments/{post_id}"))
            .header("cookie", &cookie)
            .form(&form(&[("body", &format!("Comment {n}."))]))
            .send()
            .await
            .assert_status(303);
    }

    // And one guest, who renders under the name they gave rather than an
    // account's.
    sign_out(&client);
    client
        .post(&format!("/comments/{post_id}"))
        .form(&form(&[
            ("body", "Passing through."),
            ("author_name", "Visitor"),
            ("author_email", "visitor@example.com"),
        ]))
        .send()
        .await
        .assert_status(303);
    client
        .post("/admin/comments/4/status?to=approved")
        .header("cookie", &owner)
        .send()
        .await
        .assert_status(303);

    sign_out(&client);
    let page = client.get("/busy").send().await;
    page.assert_ok();
    let page = page.text();
    for n in 1..=3 {
        assert!(
            page.contains(&format!("Person {n}")),
            "every registered commenter renders under their current public name:\n{page}"
        );
    }
    assert!(
        page.contains("Visitor"),
        "and a guest under the name they gave"
    );
}

/// Two pages under different parents may share a slug.
///
/// `/about/team` and `/company/team` are different URLs, and
/// `resolve_page_path` has always disambiguated pages by `parent_id` — but a
/// global `(post_type, slug)` uniqueness, plus a bare-path index that covered
/// every page rather than only the top-level ones, renamed the second to
/// `team-2`. WordPress makes no such rename.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn pages_under_different_parents_may_share_a_slug() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let page = async |title: &str, slug: &str, parent: Option<&str>| -> String {
        let mut fields = vec![
            ("title", title),
            ("slug", slug),
            ("excerpt", ""),
            ("body", "Body."),
            ("status", "publish"),
            ("password", ""),
        ];
        if let Some(parent) = parent {
            fields.push(("parent_id", parent));
        }
        let created = client
            .post("/admin/content/page")
            .header("cookie", &cookie)
            .form(&form(&fields))
            .send()
            .await;
        assert_eq!(created.status, 303, "creating {title}: {}", created.text());
        created
            .header("location")
            .expect("redirect")
            .rsplit('/')
            .next()
            .expect("id")
            .to_owned()
    };

    let about = page("About", "about", None).await;
    let company = page("Company", "company", None).await;
    let first = page("Team", "team", Some(&about)).await;
    let second = page("Team", "team", Some(&company)).await;

    let slug_of = async |id: &str| -> String {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::posts::table
            .find(id.parse::<i64>().expect("id"))
            .select({{crate_name}}::schema::posts::slug)
            .first(&mut conn)
            .await
            .expect("the page")
    };
    assert_eq!(slug_of(&first).await, "team");
    assert_eq!(
        slug_of(&second).await,
        "team",
        "a sibling of a different parent is not a collision"
    );

    // Both resolve, at their own paths.
    sign_out(&client);
    client
        .get("/about/team")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Body.");
    client
        .get("/company/team")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Body.");

    // Siblings still collide — the scope narrowed, it did not disappear.
    let third = page("Team", "team", Some(&about)).await;
    assert_eq!(
        slug_of(&third).await,
        "team-2",
        "two children of the same parent would mint the same URL"
    );

    // And a top-level page still competes with posts for the bare path.
    create_post(&client, &cookie, "Careers", "Body.", "publish").await;
    let bare = page("Careers", "careers", None).await;
    assert_eq!(
        slug_of(&bare).await,
        "careers-2",
        "a top-level page and a post both mint /careers"
    );
}

/// A backup carrying two pages with the same final segment restores both.
///
/// Scoping nested page slugs to their parent made `/about/team` and
/// `/company/team` both legitimate — and left the export/import identity, which
/// was `(post_type, slug)`, unable to tell them apart. The second was skipped
/// as already present, into an empty database, so the CMS silently lost a page
/// out of its own backup.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_backup_with_duplicate_page_slugs_restores_every_page() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let page = async |title: &str, slug: &str, parent: Option<&str>| -> String {
        let body = format!("Body of {slug}.");
        let mut fields = vec![
            ("title", title),
            ("slug", slug),
            ("excerpt", ""),
            ("body", body.as_str()),
            ("status", "publish"),
            ("password", ""),
        ];
        if let Some(parent) = parent {
            fields.push(("parent_id", parent));
        }
        let created = client
            .post("/admin/content/page")
            .header("cookie", &cookie)
            .form(&form(&fields))
            .send()
            .await;
        assert_eq!(created.status, 303, "creating {title}: {}", created.text());
        created
            .header("location")
            .expect("redirect")
            .rsplit('/')
            .next()
            .expect("id")
            .to_owned()
    };

    let about = page("About", "about", None).await;
    let company = page("Company", "company", None).await;
    page("Team", "team", Some(&about)).await;
    page("Team", "team", Some(&company)).await;

    let exported = client
        .get("/admin/tools/export")
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .text();
    let payload: serde_json::Value = serde_json::from_str(&exported).expect("valid export JSON");
    let paths: Vec<&str> = payload["posts"]
        .as_array()
        .expect("array")
        .iter()
        .filter_map(|post| post["path"].as_str())
        .collect();
    assert!(
        paths.contains(&"about/team") && paths.contains(&"company/team"),
        "the export has to say which page each one is: {paths:?}"
    );

    // Restore into an empty site. Both pages must come back, at their own
    // paths.
    let fresh = db_client().await;
    let cookie = register(&fresh, "owner").await;
    import_export(&fresh, &cookie, exported.as_str())
        .await
        .assert_ok()
        .assert_body_contains("4 imported");

    sign_out(&fresh);
    fresh
        .get("/about/team")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Body of team.");
    fresh
        .get("/company/team")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Body of team.");

    // And re-importing the same file changes nothing — the identity has to
    // stay idempotent, not merely become unique.
    import_export(&fresh, &cookie, exported.as_str())
        .await
        .assert_ok()
        .assert_body_contains("4 already present");
}

/// A single run must restore two pathless pages of the same name, each
/// nested under a different parent. Neither must be dropped.
///
/// `identity()` falls back to a page's bare slug when the file has no `path`
/// for it. This is the version-2/3 shape. It also happens when a version-5
/// entry simply omits `path`. The old "shallowest first" sort counted that
/// bare string's slashes. A page nested only through `parent` then sorted as
/// if it were top level, the same as its own not-yet-created parent. Both
/// same-named pages ran before either parent existed. Neither found its
/// parent yet. The importer read one as a duplicate of the other and dropped
/// it — even though the file names nothing at the top level with that slug
/// at all.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn same_run_import_restores_pathless_pages_nested_under_different_parents() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    // Both `Team` pages precede the parents they name, and neither carries a
    // `path` — the version-2/3 shape this file's `version` also declares.
    let payload = serde_json::json!({
        "version": 2,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "Team", "slug": "team", "status": "publish",
             "author": "owner", "parent": "a", "comment_status": "open", "password": ""},
            {"post_type": "page", "title": "Team", "slug": "team", "status": "publish",
             "author": "owner", "parent": "b", "comment_status": "open", "password": ""},
            {"post_type": "page", "title": "A", "slug": "a", "status": "publish",
             "author": "owner", "parent": null, "comment_status": "open", "password": ""},
            {"post_type": "page", "title": "B", "slug": "b", "status": "publish",
             "author": "owner", "parent": null, "comment_status": "open", "password": ""}
        ]
    })
    .to_string();

    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("4 imported, 0 already present");

    sign_out(&client);
    client.get("/a").send().await.assert_ok();
    client.get("/b").send().await.assert_ok();
    client.get("/a/team").send().await.assert_ok();
    client.get("/b/team").send().await.assert_ok();
}

/// A pathless page nested under a real parent must not be dropped merely
/// because its bare slug matches a genuinely top-level page of the same
/// name. Re-importing the same file afterward must not duplicate either one.
///
/// Both `Team` pages here are already in the right order — this test does
/// not depend on `file_depth` at all. It isolates the other half of the fix:
/// `find_local`'s plain slug match must also check that the matched row's
/// parent agrees with this post's own parent before treating it as the same
/// page. The re-import also checks that recording each row's *qualified*
/// identity — not the bare slug both pages share — keeps their two markers
/// distinct, so a later run recognizes each one on its own.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn same_run_import_does_not_confuse_a_top_level_page_with_a_nested_namesake() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    // `Team` at the top level is listed, and created, before `C` and its own,
    // unrelated, nested `Team`.
    let payload = serde_json::json!({
        "version": 2,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "Team", "slug": "team", "status": "publish",
             "author": "owner", "parent": null, "comment_status": "open", "password": ""},
            {"post_type": "page", "title": "C", "slug": "c", "status": "publish",
             "author": "owner", "parent": null, "comment_status": "open", "password": ""},
            {"post_type": "page", "title": "Team", "slug": "team", "status": "publish",
             "author": "owner", "parent": "c", "comment_status": "open", "password": ""}
        ]
    })
    .to_string();

    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("3 imported, 0 already present");

    sign_out(&client);
    client.get("/team").send().await.assert_ok();
    client.get("/c").send().await.assert_ok();
    client.get("/c/team").send().await.assert_ok();

    // Both `Team` rows share a bare identity. Re-importing must still tell
    // them apart and duplicate neither.
    let cookie = sign_in(&client, "owner").await;
    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("0 imported, 3 already present");
}

/// A later, unrelated import must not be dropped merely because an earlier
/// import's pathless page happened to compute the same bare identity, while
/// actually landing somewhere else.
///
/// `_import_source_slug` records a row's *file* identity, not its resolved
/// position. A page imported without `path` leaves that marker keyed on its
/// bare slug, even when it is correctly nested under a parent. A later,
/// separate import can name an unrelated page with an explicit, accurate
/// top-level `path` that computes the same bare string. That page must not
/// match the earlier marker. It must not be silently skipped — it is not
/// already present, it would be lost.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn cross_run_import_does_not_confuse_an_unrelated_page_with_a_pathless_one() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    // Import #1: a top-level `A`, then a *pathless* `Team` correctly nested
    // under it. `Team`'s file entry has no `path`, so its marker is recorded
    // as the bare slug `team`, not `a/team`.
    let first = serde_json::json!({
        "version": 5,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "A", "slug": "a", "status": "publish",
             "author": "owner", "parent": null, "comment_status": "open", "password": ""},
            {"post_type": "page", "title": "Team", "slug": "team", "status": "publish",
             "author": "owner", "parent": "a", "comment_status": "open", "password": ""}
        ]
    })
    .to_string();
    import_export(&client, &cookie, first.as_str())
        .await
        .assert_ok()
        .assert_body_contains("2 imported, 0 already present");
    client.get("/a/team").send().await.assert_ok();

    // Import #2: a separate, later run — a *different* `Team`, explicitly and
    // accurately declaring its own top-level path.
    let second = serde_json::json!({
        "version": 5,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "Team", "slug": "team", "status": "publish",
             "author": "owner", "parent": null, "comment_status": "open", "password": "",
             "path": "team"}
        ]
    })
    .to_string();
    import_export(&client, &cookie, second.as_str())
        .await
        .assert_ok()
        .assert_body_contains("1 imported, 0 already present");

    sign_out(&client);
    client.get("/a/team").send().await.assert_ok();
    client.get("/team").send().await.assert_ok();

    // Idempotent on its own, accurate identity: running the same file again
    // changes nothing.
    import_export(&client, &cookie, second.as_str())
        .await
        .assert_ok()
        .assert_body_contains("0 imported, 1 already present");
}

/// Re-importing a backup must still recognize a page it created earlier, even
/// after an editor moves that page to a different parent. It must not
/// duplicate it, and it must not move it back.
///
/// The marker used to record a page's raw file identity — its bare slug when
/// `path` was omitted. Matching a later import against the row's *current*
/// parent, rather than trusting the marker outright, broke exactly this
/// case: the file still names the old parent, so the row's real parent no
/// longer agrees, the marker match is rejected, and the importer creates a
/// second copy under the old parent instead of leaving the moved one alone.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn re_importing_a_backup_leaves_an_editor_moved_page_alone() {
    use diesel::prelude::*;
    use diesel_async::RunQueryDsl;

    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let payload = serde_json::json!({
        "version": 2,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "A", "slug": "a", "status": "publish",
             "author": "owner", "parent": null, "comment_status": "open", "password": ""},
            {"post_type": "page", "title": "B", "slug": "b", "status": "publish",
             "author": "owner", "parent": null, "comment_status": "open", "password": ""},
            {"post_type": "page", "title": "P", "slug": "p", "status": "publish",
             "author": "owner", "parent": "a", "comment_status": "open", "password": ""}
        ]
    })
    .to_string();

    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("3 imported, 0 already present");
    client.get("/a/p").send().await.assert_ok();

    // An editor moves `P` out from under `A` and files it under `B` instead.
    let (p_id, b_id): (i64, i64) = {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        let p = {{crate_name}}::schema::posts::table
            .filter({{crate_name}}::schema::posts::slug.eq("p"))
            .select({{crate_name}}::schema::posts::id)
            .first(&mut conn)
            .await
            .expect("p");
        let b = {{crate_name}}::schema::posts::table
            .filter({{crate_name}}::schema::posts::slug.eq("b"))
            .select({{crate_name}}::schema::posts::id)
            .first(&mut conn)
            .await
            .expect("b");
        (p, b)
    };
    let b_id_str = b_id.to_string();
    client
        .post(&format!("/admin/content/page/{p_id}"))
        .header("cookie", &cookie)
        .form(
            &edit_form(
                &p_id,
                &[
                    ("title", "P"),
                    ("slug", "p"),
                    ("excerpt", ""),
                    ("body", ""),
                    ("status", "publish"),
                    ("password", ""),
                    ("parent_id", b_id_str.as_str()),
                ],
            )
            .await,
        )
        .send()
        .await
        .assert_status(303);
    sign_out(&client);
    client.get("/b/p").send().await.assert_ok();

    // The same backup again. `P`'s file entry still names `A` as its parent.
    let cookie = sign_in(&client, "owner").await;
    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("0 imported, 3 already present");

    // The editor's move stands, and no duplicate appeared under `A`.
    sign_out(&client);
    client.get("/b/p").send().await.assert_ok();
    assert_eq!(
        client.get("/a/p").send().await.status,
        404,
        "the import must not have created a second `p` under `A`"
    );
}

/// Re-importing a backup must still recognize a nested page whose *parent*
/// the allocator had to suffix, and must not duplicate it.
///
/// A completed marker match skips before adding to `created_ids`, and
/// `find_local` cannot find a suffixed slug by the file's own, unsuffixed
/// one. Resolving the parent through its own marker — recorded under the
/// same bare identity, since a top-level post's qualified identity is just
/// its slug — is what lets the child's own qualified marker come out the
/// same way twice.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn re_importing_a_backup_finds_a_child_under_a_reslugged_parent() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    // `search` is a route the framework itself mounts (`RESERVED_PATHS`), so
    // a top-level page named `search` is suffixed on the way in, no
    // competing post required.
    let payload = serde_json::json!({
        "version": 2,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "Search", "slug": "search", "status": "publish",
             "author": "owner", "parent": null, "comment_status": "open", "password": ""},
            {"post_type": "page", "title": "Team", "slug": "team", "status": "publish",
             "author": "owner", "parent": "search", "comment_status": "open", "password": ""}
        ]
    })
    .to_string();

    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("2 imported, 0 already present");
    sign_out(&client);
    client.get("/search-2/team").send().await.assert_ok();

    // The same backup again. Both rows must be recognized, and neither
    // duplicated.
    let cookie = sign_in(&client, "owner").await;
    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("0 imported, 2 already present");

    sign_out(&client);
    client.get("/search-2/team").send().await.assert_ok();
    assert_eq!(
        client.get("/team").send().await.status,
        404,
        "the import must not have created a second, top-level `team`"
    );
}

/// Re-importing a backup must still recognize a page whose marker a
/// pre-upgrade import recorded under the *old*, bare identity, and must not
/// duplicate it.
///
/// A site that imported content before this fix shipped has exactly this
/// data: a nested page's marker keyed on its bare slug, not the qualified
/// identity `resolved_identity` now records. The lookup falls back to that
/// bare key — guarded by the same parent check the original fix used
/// everywhere, since a bare key is exactly the ambiguous one — so upgrading
/// does not turn every such row into a duplicate on its next re-import.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn re_importing_a_backup_recognizes_a_pre_upgrade_bare_marker() {
    use diesel::prelude::*;
    use diesel_async::RunQueryDsl;

    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let payload = serde_json::json!({
        "version": 2,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "A", "slug": "a", "status": "publish",
             "author": "owner", "parent": null, "comment_status": "open", "password": ""},
            {"post_type": "page", "title": "Team", "slug": "team", "status": "publish",
             "author": "owner", "parent": "a", "comment_status": "open", "password": ""}
        ]
    })
    .to_string();

    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("2 imported, 0 already present");
    client.get("/a/team").send().await.assert_ok();

    // Rewrite `Team`'s marker to the *old*, pre-upgrade shape: its bare
    // slug, as an import before this fix would have recorded it.
    {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        let team_id: i64 = {{crate_name}}::schema::posts::table
            .filter({{crate_name}}::schema::posts::slug.eq("team"))
            .select({{crate_name}}::schema::posts::id)
            .first(&mut conn)
            .await
            .expect("team");
        diesel::update(
            {{crate_name}}::schema::post_meta::table
                .filter({{crate_name}}::schema::post_meta::post_id.eq(team_id))
                .filter({{crate_name}}::schema::post_meta::meta_key.eq({{crate_name}}::content::IMPORT_SOURCE_SLUG_KEY)),
        )
        .set({{crate_name}}::schema::post_meta::meta_value.eq("team"))
        .execute(&mut conn)
        .await
        .expect("rewrite the marker");
    }

    // The same backup again. Both rows must be recognized, and neither
    // duplicated.
    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("0 imported, 2 already present");

    sign_out(&client);
    client.get("/a/team").send().await.assert_ok();
    assert_eq!(
        client.get("/team").send().await.status,
        404,
        "the import must not have created a second, top-level `team`"
    );
}

/// Re-importing a backup must still recognize a page even after an editor
/// moves that page's *parent* — not the page itself — somewhere else.
///
/// A marker qualified by the parent's real, current `local_identity` changes
/// the moment any ancestor moves, since that ancestor's own position is part
/// of the chain. Qualifying by the file's own declared structure instead —
/// what `stable_identity` does — keeps a descendant's marker fixed no matter
/// what an editor does to any ancestor above it.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn re_importing_a_backup_recognizes_a_child_of_a_moved_ancestor() {
    use diesel::prelude::*;
    use diesel_async::RunQueryDsl;

    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let payload = serde_json::json!({
        "version": 2,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "A", "slug": "a", "status": "publish",
             "author": "owner", "parent": null, "comment_status": "open", "password": ""},
            {"post_type": "page", "title": "P", "slug": "p", "status": "publish",
             "author": "owner", "parent": "a", "comment_status": "open", "password": ""}
        ]
    })
    .to_string();

    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("2 imported, 0 already present");
    client.get("/a/p").send().await.assert_ok();

    // A separate top-level page, then the editor moves `A` — the *parent*,
    // not `P` itself — underneath it.
    let x_id = {
        let created = client
            .post("/admin/content/page")
            .header("cookie", &cookie)
            .form(&form(&[
                ("title", "X"),
                ("slug", "x"),
                ("excerpt", ""),
                ("body", "Body."),
                ("status", "publish"),
                ("password", ""),
            ]))
            .send()
            .await;
        assert_eq!(created.status, 303, "creating X: {}", created.text());
        created
            .header("location")
            .expect("redirect")
            .rsplit('/')
            .next()
            .expect("id")
            .to_owned()
    };
    let a_id: i64 = {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::posts::table
            .filter({{crate_name}}::schema::posts::slug.eq("a"))
            .select({{crate_name}}::schema::posts::id)
            .first(&mut conn)
            .await
            .expect("a")
    };
    client
        .post(&format!("/admin/content/page/{a_id}"))
        .header("cookie", &cookie)
        .form(
            &edit_form(
                &a_id,
                &[
                    ("title", "A"),
                    ("slug", "a"),
                    ("excerpt", ""),
                    ("body", ""),
                    ("status", "publish"),
                    ("password", ""),
                    ("parent_id", x_id.as_str()),
                ],
            )
            .await,
        )
        .send()
        .await
        .assert_status(303);
    sign_out(&client);
    client.get("/x/a/p").send().await.assert_ok();

    // The same backup again. `P`'s file entry still names `A`, unqualified,
    // as its parent.
    let cookie = sign_in(&client, "owner").await;
    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("0 imported, 2 already present");

    // `A`'s move stands, and no duplicate `p` appeared anywhere.
    sign_out(&client);
    client.get("/x/a/p").send().await.assert_ok();
    assert_eq!(
        client.get("/a/p").send().await.status,
        404,
        "the import must not have created a second `p` under the old `/a`"
    );
}

/// A re-import must still recognize a page whose parent is external — local
/// content the file itself never declares — even after an editor moves
/// that parent (#2763).
///
/// Only `P` is in the file. `A` already exists. On first import, `P`'s
/// marker anchors to `A`'s row id. An editor then moves `A` under a new
/// parent. The re-import must recompute the same anchor: `A`'s id, not its
/// new position.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn re_importing_a_backup_recognizes_a_moved_external_parent() {
    use diesel::prelude::*;
    use diesel_async::RunQueryDsl;

    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    // `A` is created directly, the same way an editor would — not through
    // an import. The file below never names it as one of its own posts.
    let created = client
        .post("/admin/content/page")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "A"),
            ("slug", "a"),
            ("excerpt", ""),
            ("body", "Body."),
            ("status", "publish"),
            ("password", ""),
        ]))
        .send()
        .await;
    assert_eq!(created.status, 303, "creating A: {}", created.text());

    let payload = serde_json::json!({
        "version": 2,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "P", "slug": "p", "status": "publish",
             "author": "owner", "parent": "a", "comment_status": "open", "password": ""}
        ]
    })
    .to_string();

    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("1 imported, 0 already present");
    client.get("/a/p").send().await.assert_ok();

    // A separate top-level page, then the editor moves `A` underneath it.
    let x_id = {
        let created = client
            .post("/admin/content/page")
            .header("cookie", &cookie)
            .form(&form(&[
                ("title", "X"),
                ("slug", "x"),
                ("excerpt", ""),
                ("body", "Body."),
                ("status", "publish"),
                ("password", ""),
            ]))
            .send()
            .await;
        assert_eq!(created.status, 303, "creating X: {}", created.text());
        created
            .header("location")
            .expect("redirect")
            .rsplit('/')
            .next()
            .expect("id")
            .to_owned()
    };
    let a_id: i64 = {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::posts::table
            .filter({{crate_name}}::schema::posts::slug.eq("a"))
            .select({{crate_name}}::schema::posts::id)
            .first(&mut conn)
            .await
            .expect("a")
    };
    client
        .post(&format!("/admin/content/page/{a_id}"))
        .header("cookie", &cookie)
        .form(
            &edit_form(
                &a_id,
                &[
                    ("title", "A"),
                    ("slug", "a"),
                    ("excerpt", ""),
                    ("body", ""),
                    ("status", "publish"),
                    ("password", ""),
                    ("parent_id", x_id.as_str()),
                ],
            )
            .await,
        )
        .send()
        .await
        .assert_status(303);
    sign_out(&client);
    client.get("/x/a/p").send().await.assert_ok();

    // The same backup again. `P`'s file entry still names `A`, unqualified,
    // as its parent — the file never described `A` at all.
    let cookie = sign_in(&client, "owner").await;
    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("0 imported, 1 already present");

    // `A`'s move stands, and no duplicate `p` appeared anywhere.
    sign_out(&client);
    client.get("/x/a/p").send().await.assert_ok();
    assert_eq!(
        client.get("/a/p").send().await.status,
        404,
        "the import must not have created a second `p` under the old `/a`"
    );
    assert_eq!(
        client.get("/p").send().await.status,
        404,
        "the import must not have created a second, top-level `p`"
    );
}

/// A re-import must still recognize a page whose marker a pre-#2763 site
/// recorded against its external parent's *old* position, when that
/// parent then moved before the site upgraded to this fix (#2763).
///
/// The stored marker (`a/p`) reflects `A`'s position at the *original*
/// import. Recomputing that marker from `A`'s *current* row cannot recover
/// it once `A` has moved since — the old position is gone, not just
/// unreachable by id. Recognizing `P` here must not depend on recomputing
/// any position at all: it must find the old marker by its slug suffix and
/// confirm it by `P`'s real, current parent.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn re_importing_a_backup_recognizes_a_pre_upgrade_marker_after_the_parent_moved() {
    use diesel::prelude::*;
    use diesel_async::RunQueryDsl;

    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let created = client
        .post("/admin/content/page")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "A"),
            ("slug", "a"),
            ("excerpt", ""),
            ("body", "Body."),
            ("status", "publish"),
            ("password", ""),
        ]))
        .send()
        .await;
    assert_eq!(created.status, 303, "creating A: {}", created.text());

    let payload = serde_json::json!({
        "version": 2,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "P", "slug": "p", "status": "publish",
             "author": "owner", "parent": "a", "comment_status": "open", "password": ""}
        ]
    })
    .to_string();

    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("1 imported, 0 already present");

    // Rewrite `P`'s marker to the *pre-#2763* shape: `A`'s position at
    // this import (`a`), not the id-anchored marker this fix now records.
    let p_id: i64 = {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::posts::table
            .filter({{crate_name}}::schema::posts::slug.eq("p"))
            .select({{crate_name}}::schema::posts::id)
            .first(&mut conn)
            .await
            .expect("p")
    };
    {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        diesel::update(
            {{crate_name}}::schema::post_meta::table
                .filter({{crate_name}}::schema::post_meta::post_id.eq(p_id))
                .filter({{crate_name}}::schema::post_meta::meta_key.eq({{crate_name}}::content::IMPORT_SOURCE_SLUG_KEY)),
        )
        .set({{crate_name}}::schema::post_meta::meta_value.eq("a/p"))
        .execute(&mut conn)
        .await
        .expect("rewrite the marker");
    }

    // The editor moves `A` — before the site ever upgrades to this fix.
    let x_id = {
        let created = client
            .post("/admin/content/page")
            .header("cookie", &cookie)
            .form(&form(&[
                ("title", "X"),
                ("slug", "x"),
                ("excerpt", ""),
                ("body", "Body."),
                ("status", "publish"),
                ("password", ""),
            ]))
            .send()
            .await;
        assert_eq!(created.status, 303, "creating X: {}", created.text());
        created
            .header("location")
            .expect("redirect")
            .rsplit('/')
            .next()
            .expect("id")
            .to_owned()
    };
    let a_id: i64 = {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::posts::table
            .filter({{crate_name}}::schema::posts::slug.eq("a"))
            .select({{crate_name}}::schema::posts::id)
            .first(&mut conn)
            .await
            .expect("a")
    };
    client
        .post(&format!("/admin/content/page/{a_id}"))
        .header("cookie", &cookie)
        .form(
            &edit_form(
                &a_id,
                &[
                    ("title", "A"),
                    ("slug", "a"),
                    ("excerpt", ""),
                    ("body", ""),
                    ("status", "publish"),
                    ("password", ""),
                    ("parent_id", x_id.as_str()),
                ],
            )
            .await,
        )
        .send()
        .await
        .assert_status(303);
    sign_out(&client);
    client.get("/x/a/p").send().await.assert_ok();

    // The site now upgrades to this fix and re-imports the same backup.
    // `P`'s marker still reads `a/p`, and `A`'s position is now `x/a`.
    let cookie = sign_in(&client, "owner").await;
    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("0 imported, 1 already present");

    sign_out(&client);
    client.get("/x/a/p").send().await.assert_ok();
    assert_eq!(
        client.get("/a/p").send().await.status,
        404,
        "the import must not have created a second `p` under the old `/a`"
    );
    assert_eq!(
        client.get("/p").send().await.status,
        404,
        "the import must not have created a second, top-level `p`"
    );
}

/// A re-import must still recognize a page whose own marker predates
/// #2763, when an editor has since moved that *page itself* — not its
/// external parent (#2763).
///
/// `P`'s marker (`a/p`) is a single, unambiguous match for its slug
/// suffix, so recovering it must trust that string directly rather than
/// requiring `P`'s *current* parent to still be `A`: an editor moving `P`
/// away from `A` is exactly the case an ordinary marker match already
/// tolerates elsewhere in this importer, and recovering a legacy marker
/// must not regress it.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn re_importing_a_backup_recognizes_a_pre_upgrade_marker_after_the_child_moved() {
    use diesel::prelude::*;
    use diesel_async::RunQueryDsl;

    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let created = client
        .post("/admin/content/page")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "A"),
            ("slug", "a"),
            ("excerpt", ""),
            ("body", "Body."),
            ("status", "publish"),
            ("password", ""),
        ]))
        .send()
        .await;
    assert_eq!(created.status, 303, "creating A: {}", created.text());

    let payload = serde_json::json!({
        "version": 2,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "P", "slug": "p", "status": "publish",
             "author": "owner", "parent": "a", "comment_status": "open", "password": ""}
        ]
    })
    .to_string();

    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("1 imported, 0 already present");

    // Rewrite `P`'s marker to the *pre-#2763* shape: `A`'s position at
    // this import (`a`), not the id-anchored marker this fix now records.
    let p_id: i64 = {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::posts::table
            .filter({{crate_name}}::schema::posts::slug.eq("p"))
            .select({{crate_name}}::schema::posts::id)
            .first(&mut conn)
            .await
            .expect("p")
    };
    {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        diesel::update(
            {{crate_name}}::schema::post_meta::table
                .filter({{crate_name}}::schema::post_meta::post_id.eq(p_id))
                .filter({{crate_name}}::schema::post_meta::meta_key.eq({{crate_name}}::content::IMPORT_SOURCE_SLUG_KEY)),
        )
        .set({{crate_name}}::schema::post_meta::meta_value.eq("a/p"))
        .execute(&mut conn)
        .await
        .expect("rewrite the marker");
    }

    // The editor moves `P` itself — not `A` — before the site upgrades.
    let b_id = {
        let created = client
            .post("/admin/content/page")
            .header("cookie", &cookie)
            .form(&form(&[
                ("title", "B"),
                ("slug", "b"),
                ("excerpt", ""),
                ("body", "Body."),
                ("status", "publish"),
                ("password", ""),
            ]))
            .send()
            .await;
        assert_eq!(created.status, 303, "creating B: {}", created.text());
        created
            .header("location")
            .expect("redirect")
            .rsplit('/')
            .next()
            .expect("id")
            .to_owned()
    };
    client
        .post(&format!("/admin/content/page/{p_id}"))
        .header("cookie", &cookie)
        .form(
            &edit_form(
                &p_id,
                &[
                    ("title", "P"),
                    ("slug", "p"),
                    ("excerpt", ""),
                    ("body", ""),
                    ("status", "publish"),
                    ("password", ""),
                    ("parent_id", b_id.as_str()),
                ],
            )
            .await,
        )
        .send()
        .await
        .assert_status(303);
    sign_out(&client);
    client.get("/b/p").send().await.assert_ok();

    // The site now upgrades to this fix and re-imports the same backup.
    // `P`'s file entry still names `A`, and `P`'s marker still reads
    // `a/p`, but `P`'s real parent is now `B`.
    let cookie = sign_in(&client, "owner").await;
    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("0 imported, 1 already present");

    // The editor's move stands, and no duplicate `p` appeared under `A`.
    sign_out(&client);
    client.get("/b/p").send().await.assert_ok();
    assert_eq!(
        client.get("/a/p").send().await.status,
        404,
        "the import must not have created a second `p` under `A`"
    );
}

/// Importing a genuinely new page must not be dropped just because an
/// unrelated page, under a different external parent, already carries a
/// pre-#2763 marker ending in the same slug (#2763).
///
/// Recovering a legacy marker by its slug suffix alone cannot tell `p`
/// under `A` apart from an unrelated `p` under `Other` sharing that
/// suffix. Only the candidate's real, current parent can — a shared
/// suffix must not be trusted on its own.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn importing_a_new_page_is_not_confused_with_an_unrelated_pre_upgrade_namesake() {
    use diesel::prelude::*;
    use diesel_async::RunQueryDsl;

    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    // An unrelated page, external to every file this test imports, whose
    // marker predates #2763: `other/p`, not the id-anchored shape this fix
    // now records.
    let created = client
        .post("/admin/content/page")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "Other"),
            ("slug", "other"),
            ("excerpt", ""),
            ("body", "Body."),
            ("status", "publish"),
            ("password", ""),
        ]))
        .send()
        .await;
    assert_eq!(created.status, 303, "creating Other: {}", created.text());

    let unrelated_payload = serde_json::json!({
        "version": 2,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "P", "slug": "p", "status": "publish",
             "author": "owner", "parent": "other", "comment_status": "open", "password": ""}
        ]
    })
    .to_string();
    import_export(&client, &cookie, unrelated_payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("1 imported, 0 already present");

    let unrelated_p_id: i64 = {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::posts::table
            .filter({{crate_name}}::schema::posts::slug.eq("p"))
            .select({{crate_name}}::schema::posts::id)
            .first(&mut conn)
            .await
            .expect("p")
    };
    {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        diesel::update(
            {{crate_name}}::schema::post_meta::table
                .filter({{crate_name}}::schema::post_meta::post_id.eq(unrelated_p_id))
                .filter({{crate_name}}::schema::post_meta::meta_key.eq({{crate_name}}::content::IMPORT_SOURCE_SLUG_KEY)),
        )
        .set({{crate_name}}::schema::post_meta::meta_value.eq("other/p"))
        .execute(&mut conn)
        .await
        .expect("rewrite the marker");
    }

    // A different external parent, never before related to any `p`.
    let created = client
        .post("/admin/content/page")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "A"),
            ("slug", "a"),
            ("excerpt", ""),
            ("body", "Body."),
            ("status", "publish"),
            ("password", ""),
        ]))
        .send()
        .await;
    assert_eq!(created.status, 303, "creating A: {}", created.text());

    // A genuinely new file, naming a `p` this site has never imported
    // under `A`. Its slug collides with the unrelated page above only by
    // coincidence.
    let new_payload = serde_json::json!({
        "version": 2,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "P", "slug": "p", "status": "publish",
             "author": "owner", "parent": "a", "comment_status": "open", "password": ""}
        ]
    })
    .to_string();
    import_export(&client, &cookie, new_payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("1 imported, 0 already present");

    // Both pages exist: the unrelated one, untouched, and the new one.
    sign_out(&client);
    client.get("/other/p").send().await.assert_ok();
    client.get("/a/p").send().await.assert_ok();
}

/// A new descendant of a page whose own marker predates #2763 must nest
/// under that page's real row, not land at the top level (#2763).
///
/// `P`'s marker (`a/p`) is the pre-#2763 shape. `C` names `P` as its
/// parent, and `P` is also declared in this same file, so `C`'s parent
/// resolves through `resolved_post_id` — which needs the same legacy
/// recovery the main loop uses, or it can never find `P`'s real id.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn importing_a_new_descendant_of_a_pre_upgrade_legacy_parent_nests_it_correctly() {
    use diesel::prelude::*;
    use diesel_async::RunQueryDsl;

    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let created = client
        .post("/admin/content/page")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "A"),
            ("slug", "a"),
            ("excerpt", ""),
            ("body", "Body."),
            ("status", "publish"),
            ("password", ""),
        ]))
        .send()
        .await;
    assert_eq!(created.status, 303, "creating A: {}", created.text());

    let first_payload = serde_json::json!({
        "version": 2,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "P", "slug": "p", "status": "publish",
             "author": "owner", "parent": "a", "comment_status": "open", "password": ""}
        ]
    })
    .to_string();
    import_export(&client, &cookie, first_payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("1 imported, 0 already present");

    // Rewrite `P`'s marker to the *pre-#2763* shape.
    let p_id: i64 = {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::posts::table
            .filter({{crate_name}}::schema::posts::slug.eq("p"))
            .select({{crate_name}}::schema::posts::id)
            .first(&mut conn)
            .await
            .expect("p")
    };
    {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        diesel::update(
            {{crate_name}}::schema::post_meta::table
                .filter({{crate_name}}::schema::post_meta::post_id.eq(p_id))
                .filter({{crate_name}}::schema::post_meta::meta_key.eq({{crate_name}}::content::IMPORT_SOURCE_SLUG_KEY)),
        )
        .set({{crate_name}}::schema::post_meta::meta_value.eq("a/p"))
        .execute(&mut conn)
        .await
        .expect("rewrite the marker");
    }

    // A backup that names `P` again, and adds a new child `C` under it.
    let second_payload = serde_json::json!({
        "version": 2,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "P", "slug": "p", "status": "publish",
             "author": "owner", "parent": "a", "comment_status": "open", "password": ""},
            {"post_type": "page", "title": "C", "slug": "c", "status": "publish",
             "author": "owner", "parent": "p", "comment_status": "open", "password": ""}
        ]
    })
    .to_string();
    import_export(&client, &cookie, second_payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("1 imported, 1 already present");

    sign_out(&client);
    client.get("/a/p/c").send().await.assert_ok();
    assert_eq!(
        client.get("/c").send().await.status,
        404,
        "the import must not have created a second, top-level `c`"
    );
}

/// Importing a genuinely new page must not be confused with an unrelated,
/// *current-scheme* marker whose row an editor has since dragged under the
/// same external parent by coincidence (#2763).
///
/// `P`'s marker is `id:<B>/p` — the shape this fix itself now writes, not
/// a legacy one. An editor moving `P` to `A` afterwards must not make the
/// legacy-recovery suffix scan mistake it for a *different* `p` this file
/// is naming under `A` for the first time: an `id:`-anchored marker is
/// never a legacy candidate, no matter whose slug it ends in.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn importing_a_new_page_is_not_confused_with_a_relocated_current_scheme_namesake() {
    use diesel::prelude::*;
    use diesel_async::RunQueryDsl;

    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let created = client
        .post("/admin/content/page")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "B"),
            ("slug", "b"),
            ("excerpt", ""),
            ("body", "Body."),
            ("status", "publish"),
            ("password", ""),
        ]))
        .send()
        .await;
    assert_eq!(created.status, 303, "creating B: {}", created.text());

    let first_payload = serde_json::json!({
        "version": 2,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "P", "slug": "p", "status": "publish",
             "author": "owner", "parent": "b", "comment_status": "open", "password": ""}
        ]
    })
    .to_string();
    import_export(&client, &cookie, first_payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("1 imported, 0 already present");
    client.get("/b/p").send().await.assert_ok();

    // A different external parent, then the editor drags `P` under it
    // directly — not through any import.
    let created = client
        .post("/admin/content/page")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "A"),
            ("slug", "a"),
            ("excerpt", ""),
            ("body", "Body."),
            ("status", "publish"),
            ("password", ""),
        ]))
        .send()
        .await;
    assert_eq!(created.status, 303, "creating A: {}", created.text());
    let (p_id, a_id): (i64, i64) = {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        let p = {{crate_name}}::schema::posts::table
            .filter({{crate_name}}::schema::posts::slug.eq("p"))
            .select({{crate_name}}::schema::posts::id)
            .first(&mut conn)
            .await
            .expect("p");
        let a = {{crate_name}}::schema::posts::table
            .filter({{crate_name}}::schema::posts::slug.eq("a"))
            .select({{crate_name}}::schema::posts::id)
            .first(&mut conn)
            .await
            .expect("a");
        (p, a)
    };
    let a_id_str = a_id.to_string();
    client
        .post(&format!("/admin/content/page/{p_id}"))
        .header("cookie", &cookie)
        .form(
            &edit_form(
                &p_id,
                &[
                    ("title", "P"),
                    ("slug", "p"),
                    ("excerpt", ""),
                    ("body", ""),
                    ("status", "publish"),
                    ("password", ""),
                    ("parent_id", a_id_str.as_str()),
                ],
            )
            .await,
        )
        .send()
        .await
        .assert_status(303);
    sign_out(&client);
    client.get("/a/p").send().await.assert_ok();

    // A genuinely new file, naming a different `P2` under `A` — its slug
    // collides with the relocated page above only by coincidence.
    let cookie = sign_in(&client, "owner").await;
    let new_payload = serde_json::json!({
        "version": 2,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "P2", "slug": "p", "status": "publish",
             "author": "owner", "parent": "a", "comment_status": "open", "password": ""}
        ]
    })
    .to_string();
    import_export(&client, &cookie, new_payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("1 imported, 0 already present");

    // The new page exists under `A`, alongside the relocated one.
    sign_out(&client);
    let new_under_a: i64 = {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::posts::table
            .filter({{crate_name}}::schema::posts::title.eq("P2"))
            .filter({{crate_name}}::schema::posts::parent_id.eq(a_id))
            .count()
            .get_result(&mut conn)
            .await
            .expect("count")
    };
    assert_eq!(new_under_a, 1, "the new `P2` must exist under `A`");
    client.get("/a/p").send().await.assert_ok();
}

/// Importing a genuinely new page must not be confused with an unrelated
/// *legacy-scheme* marker whose row an editor has since dragged under the
/// same external parent by coincidence (#2763).
///
/// `P`'s marker is `b/p` — legacy-shaped, but recorded for parent `B`, not
/// `A`. A shared `/p` suffix and a coincidentally-matching current parent
/// are not enough: the marker's own recorded parent segment (`b`) must
/// also agree with `A`'s slug, or an unrelated page's move can steal a
/// genuinely new page's identity.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn importing_a_new_page_is_not_confused_with_a_relocated_legacy_namesake() {
    use diesel::prelude::*;
    use diesel_async::RunQueryDsl;

    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let created = client
        .post("/admin/content/page")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "B"),
            ("slug", "b"),
            ("excerpt", ""),
            ("body", "Body."),
            ("status", "publish"),
            ("password", ""),
        ]))
        .send()
        .await;
    assert_eq!(created.status, 303, "creating B: {}", created.text());

    let first_payload = serde_json::json!({
        "version": 2,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "P", "slug": "p", "status": "publish",
             "author": "owner", "parent": "b", "comment_status": "open", "password": ""}
        ]
    })
    .to_string();
    import_export(&client, &cookie, first_payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("1 imported, 0 already present");

    // Rewrite `P`'s marker to the *pre-#2763* shape: `B`'s position at
    // this import (`b`), not the id-anchored marker this fix now records.
    let p_id: i64 = {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::posts::table
            .filter({{crate_name}}::schema::posts::slug.eq("p"))
            .select({{crate_name}}::schema::posts::id)
            .first(&mut conn)
            .await
            .expect("p")
    };
    {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        diesel::update(
            {{crate_name}}::schema::post_meta::table
                .filter({{crate_name}}::schema::post_meta::post_id.eq(p_id))
                .filter({{crate_name}}::schema::post_meta::meta_key.eq({{crate_name}}::content::IMPORT_SOURCE_SLUG_KEY)),
        )
        .set({{crate_name}}::schema::post_meta::meta_value.eq("b/p"))
        .execute(&mut conn)
        .await
        .expect("rewrite the marker");
    }

    // A different external parent, then the editor drags `P` under it
    // directly — not through any import.
    let created = client
        .post("/admin/content/page")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "A"),
            ("slug", "a"),
            ("excerpt", ""),
            ("body", "Body."),
            ("status", "publish"),
            ("password", ""),
        ]))
        .send()
        .await;
    assert_eq!(created.status, 303, "creating A: {}", created.text());
    let a_id: i64 = {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::posts::table
            .filter({{crate_name}}::schema::posts::slug.eq("a"))
            .select({{crate_name}}::schema::posts::id)
            .first(&mut conn)
            .await
            .expect("a")
    };
    let a_id_str = a_id.to_string();
    client
        .post(&format!("/admin/content/page/{p_id}"))
        .header("cookie", &cookie)
        .form(
            &edit_form(
                &p_id,
                &[
                    ("title", "P"),
                    ("slug", "p"),
                    ("excerpt", ""),
                    ("body", ""),
                    ("status", "publish"),
                    ("password", ""),
                    ("parent_id", a_id_str.as_str()),
                ],
            )
            .await,
        )
        .send()
        .await
        .assert_status(303);
    sign_out(&client);
    client.get("/a/p").send().await.assert_ok();

    // A genuinely new file, naming a different `P2` under `A` — its slug
    // collides with the relocated page above only by coincidence.
    let cookie = sign_in(&client, "owner").await;
    let new_payload = serde_json::json!({
        "version": 2,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "P2", "slug": "p", "status": "publish",
             "author": "owner", "parent": "a", "comment_status": "open", "password": ""}
        ]
    })
    .to_string();
    import_export(&client, &cookie, new_payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("1 imported, 0 already present");

    // The new page exists under `A`, alongside the relocated one.
    sign_out(&client);
    let new_under_a: i64 = {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::posts::table
            .filter({{crate_name}}::schema::posts::title.eq("P2"))
            .filter({{crate_name}}::schema::posts::parent_id.eq(a_id))
            .count()
            .get_result(&mut conn)
            .await
            .expect("count")
    };
    assert_eq!(new_under_a, 1, "the new `P2` must exist under `A`");
    client.get("/a/p").send().await.assert_ok();
}

/// Re-importing a whole multi-level, pathless backup must still recognize
/// every page in the chain, not just the immediate parent of whichever page
/// is being checked.
///
/// A legacy `parent` reference is always a bare slug, one level at a time.
/// `find_local` cannot match it against a page nested two or more levels
/// deep, and a completed ancestor is skipped before it can be offered
/// through `created_ids`. `stable_identity` sidesteps both: it resolves a
/// pathless post's whole chain through the file's own graph, the same one
/// `file_depth` walks, so a page's marker does not depend on any ancestor
/// having been freshly resolved this run.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn re_importing_a_backup_recognizes_a_three_level_pathless_chain() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let payload = serde_json::json!({
        "version": 2,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "A", "slug": "a", "status": "publish",
             "author": "owner", "parent": null, "comment_status": "open", "password": ""},
            {"post_type": "page", "title": "B", "slug": "b", "status": "publish",
             "author": "owner", "parent": "a", "comment_status": "open", "password": ""},
            {"post_type": "page", "title": "C", "slug": "c", "status": "publish",
             "author": "owner", "parent": "b", "comment_status": "open", "password": ""}
        ]
    })
    .to_string();

    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("3 imported, 0 already present");
    client.get("/a/b/c").send().await.assert_ok();

    // The same backup again. `A` and `B` are both completed, so `C`'s own
    // parent lookup can lean on neither `created_ids` nor an exact
    // `find_local` match.
    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("0 imported, 3 already present");

    sign_out(&client);
    client.get("/a/b/c").send().await.assert_ok();
    assert_eq!(
        client.get("/c").send().await.status,
        404,
        "the import must not have created a second, top-level `c`"
    );
}

/// Importing an updated backup that adds a new descendant to an otherwise
/// unchanged, already-settled pathless tree must nest that descendant under
/// its real parent, not leave it at the top level.
///
/// `A` and `B` are unchanged and already completed, so they are skipped
/// before either reaches `created_ids`. Resolving `C`'s parent by the bare
/// legacy identity `b` cannot find the settled `/a/b` row. Resolving it
/// through `resolved_post_id` — which checks `B`'s own qualified marker,
/// not the bare identity — can.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn importing_a_new_descendant_of_a_settled_tree_nests_it_correctly() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let first = serde_json::json!({
        "version": 2,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "A", "slug": "a", "status": "publish",
             "author": "owner", "parent": null, "comment_status": "open", "password": ""},
            {"post_type": "page", "title": "B", "slug": "b", "status": "publish",
             "author": "owner", "parent": "a", "comment_status": "open", "password": ""}
        ]
    })
    .to_string();
    import_export(&client, &cookie, first.as_str())
        .await
        .assert_ok()
        .assert_body_contains("2 imported, 0 already present");
    client.get("/a/b").send().await.assert_ok();

    // The same `A` and `B`, unchanged, plus a brand new `C` nested under `B`.
    let second = serde_json::json!({
        "version": 2,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "A", "slug": "a", "status": "publish",
             "author": "owner", "parent": null, "comment_status": "open", "password": ""},
            {"post_type": "page", "title": "B", "slug": "b", "status": "publish",
             "author": "owner", "parent": "a", "comment_status": "open", "password": ""},
            {"post_type": "page", "title": "C", "slug": "c", "status": "publish",
             "author": "owner", "parent": "b", "comment_status": "open", "password": ""}
        ]
    })
    .to_string();
    import_export(&client, &cookie, second.as_str())
        .await
        .assert_ok()
        .assert_body_contains("1 imported, 2 already present");

    sign_out(&client);
    client.get("/a/b/c").send().await.assert_ok();
    assert_eq!(
        client.get("/c").send().await.status,
        404,
        "the new page must nest under its real parent, not land at the top level"
    );
}

/// A pathless child naming its parent by the legacy, bare `parent` field
/// must still nest correctly even when that parent itself carries an
/// explicit `path`.
///
/// `path: "a/b"` and a bare `parent: "b"` both mean the page slugged `b` —
/// but the file's own identity for `B` is `"a/b"`, not `"b"`. A lookup keyed
/// only on full identity misses it entirely.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_bare_parent_reference_resolves_a_path_carrying_entry() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let payload = serde_json::json!({
        "version": 5,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "A", "slug": "a", "status": "publish",
             "author": "owner", "parent": null, "comment_status": "open", "password": ""},
            {"post_type": "page", "title": "B", "slug": "b", "status": "publish",
             "author": "owner", "parent": "a", "comment_status": "open", "password": "",
             "path": "a/b"},
            {"post_type": "page", "title": "C", "slug": "c", "status": "publish",
             "author": "owner", "parent": "b", "comment_status": "open", "password": ""}
        ]
    })
    .to_string();

    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("3 imported, 0 already present");

    sign_out(&client);
    client.get("/a/b/c").send().await.assert_ok();
    assert_eq!(
        client.get("/c").send().await.status,
        404,
        "C must nest under B's real path, not land at the top level"
    );
}

/// A pre-upgrade site can hold two completed pages that share the *same*
/// old, bare marker. Re-importing both must recognize each one by its own
/// real parent, not duplicate whichever one a query does not happen to
/// return first.
///
/// `imported_source_slugs` keeps every id a bare key names, and the legacy
/// marker fallback tries each of them in turn rather than only the first.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn re_importing_a_backup_recognizes_both_sides_of_a_pre_upgrade_bare_collision() {
    use diesel::prelude::*;
    use diesel_async::RunQueryDsl;

    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let payload = serde_json::json!({
        "version": 2,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "A", "slug": "a", "status": "publish",
             "author": "owner", "parent": null, "comment_status": "open", "password": ""},
            {"post_type": "page", "title": "B", "slug": "b", "status": "publish",
             "author": "owner", "parent": null, "comment_status": "open", "password": ""},
            {"post_type": "page", "title": "Team", "slug": "team", "status": "publish",
             "author": "owner", "parent": "a", "comment_status": "open", "password": ""},
            {"post_type": "page", "title": "Team", "slug": "team", "status": "publish",
             "author": "owner", "parent": "b", "comment_status": "open", "password": ""}
        ]
    })
    .to_string();

    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("4 imported, 0 already present");
    client.get("/a/team").send().await.assert_ok();
    client.get("/b/team").send().await.assert_ok();

    // Rewrite both `Team` markers to the *same* old, pre-upgrade bare shape
    // — a collision the qualified scheme can no longer produce, but that a
    // site upgrading from before this fix can still carry.
    {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        let team_ids: Vec<i64> = {{crate_name}}::schema::posts::table
            .filter({{crate_name}}::schema::posts::slug.eq("team"))
            .select({{crate_name}}::schema::posts::id)
            .load(&mut conn)
            .await
            .expect("both team rows");
        assert_eq!(team_ids.len(), 2, "two Team rows");
        for id in team_ids {
            diesel::update(
                {{crate_name}}::schema::post_meta::table
                    .filter({{crate_name}}::schema::post_meta::post_id.eq(id))
                    .filter(
                        {{crate_name}}::schema::post_meta::meta_key.eq({{crate_name}}::content::IMPORT_SOURCE_SLUG_KEY),
                    ),
            )
            .set({{crate_name}}::schema::post_meta::meta_value.eq("team"))
            .execute(&mut conn)
            .await
            .expect("rewrite the marker");
        }
    }

    // The same backup again. Both rows must be recognized, and neither
    // duplicated.
    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("0 imported, 4 already present");

    sign_out(&client);
    client.get("/a/team").send().await.assert_ok();
    client.get("/b/team").send().await.assert_ok();
}

/// Two *unfinished* pre-upgrade rows can share the same old, bare marker
/// under different parents — an import interrupted right after creating
/// both, before either got its completion marker. Retrying must pair each
/// file post with the row under its own real parent, not whichever
/// unfinished row a query happens to return first.
///
/// `pick_marker_candidate` used to accept the first unfinished candidate
/// outright, without checking whether a later one actually matches the
/// parent. That paired the wrong row, reapplying one file post's terms and
/// ancestry to the other page's row and leaving the true match untouched.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn re_importing_a_backup_prefers_the_unfinished_candidate_with_the_matching_parent() {
    use diesel::prelude::*;
    use diesel_async::RunQueryDsl;

    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let payload = serde_json::json!({
        "version": 2,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "A", "slug": "a", "status": "publish",
             "author": "owner", "parent": null, "comment_status": "open", "password": ""},
            {"post_type": "page", "title": "B", "slug": "b", "status": "publish",
             "author": "owner", "parent": null, "comment_status": "open", "password": ""},
            {"post_type": "page", "title": "Notes", "slug": "notes", "status": "publish",
             "author": "owner", "parent": "a", "comment_status": "open", "password": ""},
            {"post_type": "page", "title": "Notes", "slug": "notes", "status": "publish",
             "author": "owner", "parent": "b", "comment_status": "open", "password": ""}
        ]
    })
    .to_string();

    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("4 imported, 0 already present");
    client.get("/a/notes").send().await.assert_ok();
    client.get("/b/notes").send().await.assert_ok();

    // Downgrade both `Notes` rows to the same old, pre-upgrade bare marker,
    // and strip their completion marker — as if this importer had been
    // interrupted right after creating both, before either was finished.
    {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        let notes_ids: Vec<i64> = {{crate_name}}::schema::posts::table
            .filter({{crate_name}}::schema::posts::slug.eq("notes"))
            .select({{crate_name}}::schema::posts::id)
            .load(&mut conn)
            .await
            .expect("both notes rows");
        assert_eq!(notes_ids.len(), 2, "two Notes rows");
        for id in &notes_ids {
            diesel::update(
                {{crate_name}}::schema::post_meta::table
                    .filter({{crate_name}}::schema::post_meta::post_id.eq(id))
                    .filter(
                        {{crate_name}}::schema::post_meta::meta_key.eq({{crate_name}}::content::IMPORT_SOURCE_SLUG_KEY),
                    ),
            )
            .set({{crate_name}}::schema::post_meta::meta_value.eq("notes"))
            .execute(&mut conn)
            .await
            .expect("rewrite the marker");
            diesel::delete(
                {{crate_name}}::schema::post_meta::table
                    .filter({{crate_name}}::schema::post_meta::post_id.eq(id))
                    .filter(
                        {{crate_name}}::schema::post_meta::meta_key.eq({{crate_name}}::content::IMPORT_COMPLETED_KEY),
                    ),
            )
            .execute(&mut conn)
            .await
            .expect("strip the completion marker");
        }
    }

    // The same backup again. Each Notes row must be recognized under its
    // own real parent, not merged into one row under the other's parent.
    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("0 imported, 4 already present");

    sign_out(&client);
    client.get("/a/notes").send().await.assert_ok();
    client.get("/b/notes").send().await.assert_ok();
}

/// A new, genuinely top-level page must not be paired with an *unfinished*,
/// nested pre-upgrade row that happens to share its bare marker.
///
/// `pick_marker_candidate`'s "trust an unfinished candidate" fallback only
/// makes sense for a post that is itself nested: an unfinished row is
/// trusted because its own ancestry has not settled yet. A genuinely
/// top-level post can never need that excuse, so it must not be paired with
/// somebody else's unsettled nested row.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_new_top_level_page_is_not_paired_with_an_unfinished_nested_marker() {
    use diesel::prelude::*;
    use diesel_async::RunQueryDsl;

    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let first = serde_json::json!({
        "version": 2,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "A", "slug": "a", "status": "publish",
             "author": "owner", "parent": null, "comment_status": "open", "password": ""},
            {"post_type": "page", "title": "Team", "slug": "team", "status": "publish",
             "author": "owner", "parent": "a", "comment_status": "open", "password": ""}
        ]
    })
    .to_string();

    import_export(&client, &cookie, first.as_str())
        .await
        .assert_ok()
        .assert_body_contains("2 imported, 0 already present");
    client.get("/a/team").send().await.assert_ok();

    // Downgrade the nested `Team` row to the old, pre-upgrade bare marker,
    // and strip its completion marker — as if that import had been
    // interrupted right after creating it.
    {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        diesel::update(
            {{crate_name}}::schema::post_meta::table
                .filter(
                    {{crate_name}}::schema::post_meta::post_id.eq_any(
                        {{crate_name}}::schema::posts::table
                            .filter({{crate_name}}::schema::posts::slug.eq("team"))
                            .select({{crate_name}}::schema::posts::id),
                    ),
                )
                .filter({{crate_name}}::schema::post_meta::meta_key.eq({{crate_name}}::content::IMPORT_SOURCE_SLUG_KEY)),
        )
        .set({{crate_name}}::schema::post_meta::meta_value.eq("team"))
        .execute(&mut conn)
        .await
        .expect("rewrite the marker");
        diesel::delete(
            {{crate_name}}::schema::post_meta::table
                .filter(
                    {{crate_name}}::schema::post_meta::post_id.eq_any(
                        {{crate_name}}::schema::posts::table
                            .filter({{crate_name}}::schema::posts::slug.eq("team"))
                            .select({{crate_name}}::schema::posts::id),
                    ),
                )
                .filter({{crate_name}}::schema::post_meta::meta_key.eq({{crate_name}}::content::IMPORT_COMPLETED_KEY)),
        )
        .execute(&mut conn)
        .await
        .expect("strip the completion marker");
    }

    // A distinct, genuinely top-level page that only happens to share the
    // nested row's bare slug.
    let second = serde_json::json!({
        "version": 2,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "Team", "slug": "team", "status": "publish",
             "author": "owner", "parent": null, "comment_status": "open", "password": ""}
        ]
    })
    .to_string();

    import_export(&client, &cookie, second.as_str())
        .await
        .assert_ok()
        .assert_body_contains("1 imported, 0 already present");

    sign_out(&client);
    client.get("/team").send().await.assert_ok();
    client.get("/a/team").send().await.assert_ok();
}

/// A single-segment parent reference derived from an explicit `path` prefix
/// names one specific post — not any post that happens to share that slug.
///
/// `path: "b/c"` gives a one-segment parent identity `b`, indistinguishable
/// by content alone from the legacy `parent: "b"` field. `FileGraph::find`
/// used to route every single-segment reference through the ambiguous,
/// slug-keyed index regardless of which field produced it, so a payload
/// naming both a top-level `b` and a nested `a/b` could resolve `c`'s parent
/// to whichever `b` was inserted first — not necessarily the one `path`
/// actually named.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_path_derived_single_segment_parent_resolves_by_full_identity() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let payload = serde_json::json!({
        "version": 5,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "A", "slug": "a", "status": "publish",
             "author": "owner", "parent": null, "comment_status": "open", "password": "",
             "path": "a"},
            // Nested `b`, listed before the top-level one, so a slug-keyed
            // lookup that ignores which post actually declared `path: "b"`
            // would find this row first.
            {"post_type": "page", "title": "Nested B", "slug": "b", "status": "publish",
             "author": "owner", "parent": "a", "comment_status": "open", "password": "",
             "path": "a/b"},
            // Already occupies slug `c` under the nested `b`, so a
            // misresolved parent forces the real `C` below into a suffix.
            {"post_type": "page", "title": "Decoy C", "slug": "c", "status": "publish",
             "author": "owner", "parent": "b", "comment_status": "open", "password": "",
             "path": "a/b/c"},
            {"post_type": "page", "title": "Top B", "slug": "b", "status": "publish",
             "author": "owner", "parent": null, "comment_status": "open", "password": "",
             "path": "b"},
            {"post_type": "page", "title": "C", "slug": "c", "status": "publish",
             "author": "owner", "parent": "b", "comment_status": "open", "password": "",
             "path": "b/c"}
        ]
    })
    .to_string();

    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("5 imported, 0 already present");

    sign_out(&client);
    client.get("/a/b/c").send().await.assert_ok();
    client.get("/b/c").send().await.assert_ok();
}

/// A new, genuinely top-level page must not be dropped merely because a
/// pre-upgrade site already has a completed, *nested* page whose old, bare
/// marker happens to equal that same slug.
///
/// `stable_identity` gives a top-level post's marker a leading slash
/// (`/team`), so it cannot be confused with an old, unprefixed marker
/// (`team`) left by a pathless post that was actually nested elsewhere.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_new_top_level_page_is_not_confused_with_a_pre_upgrade_nested_marker() {
    use diesel::prelude::*;
    use diesel_async::RunQueryDsl;

    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let first = serde_json::json!({
        "version": 2,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "A", "slug": "a", "status": "publish",
             "author": "owner", "parent": null, "comment_status": "open", "password": ""},
            {"post_type": "page", "title": "Team", "slug": "team", "status": "publish",
             "author": "owner", "parent": "a", "comment_status": "open", "password": ""}
        ]
    })
    .to_string();
    import_export(&client, &cookie, first.as_str())
        .await
        .assert_ok()
        .assert_body_contains("2 imported, 0 already present");
    client.get("/a/team").send().await.assert_ok();

    // Rewrite `Team`'s marker to the old, pre-upgrade bare shape.
    {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        let team_id: i64 = {{crate_name}}::schema::posts::table
            .filter({{crate_name}}::schema::posts::slug.eq("team"))
            .select({{crate_name}}::schema::posts::id)
            .first(&mut conn)
            .await
            .expect("team");
        diesel::update(
            {{crate_name}}::schema::post_meta::table
                .filter({{crate_name}}::schema::post_meta::post_id.eq(team_id))
                .filter({{crate_name}}::schema::post_meta::meta_key.eq({{crate_name}}::content::IMPORT_SOURCE_SLUG_KEY)),
        )
        .set({{crate_name}}::schema::post_meta::meta_value.eq("team"))
        .execute(&mut conn)
        .await
        .expect("rewrite the marker");
    }

    // A separate, later import: a *different*, genuinely top-level `Team`.
    let second = serde_json::json!({
        "version": 2,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "Team", "slug": "team", "status": "publish",
             "author": "owner", "parent": null, "comment_status": "open", "password": ""}
        ]
    })
    .to_string();
    import_export(&client, &cookie, second.as_str())
        .await
        .assert_ok()
        .assert_body_contains("1 imported, 0 already present");

    sign_out(&client);
    client.get("/a/team").send().await.assert_ok();
    client.get("/team").send().await.assert_ok();
}

/// Adding a new descendant to a pre-upgrade tree whose completed ancestors
/// still carry the old, bare markers must still nest the new page under its
/// real parent.
///
/// `resolved_post_id`'s own legacy fallback resolves the parent's expected
/// position recursively — the same way the main loop resolves any other
/// parent — so it is not limited to the qualified marker `stable_identity`
/// now writes going forward.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn importing_a_new_descendant_of_a_pre_upgrade_settled_tree_nests_it_correctly() {
    use diesel::prelude::*;
    use diesel_async::RunQueryDsl;

    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let first = serde_json::json!({
        "version": 2,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "A", "slug": "a", "status": "publish",
             "author": "owner", "parent": null, "comment_status": "open", "password": ""},
            {"post_type": "page", "title": "B", "slug": "b", "status": "publish",
             "author": "owner", "parent": "a", "comment_status": "open", "password": ""}
        ]
    })
    .to_string();
    import_export(&client, &cookie, first.as_str())
        .await
        .assert_ok()
        .assert_body_contains("2 imported, 0 already present");
    client.get("/a/b").send().await.assert_ok();

    // Rewrite both markers to their old, pre-upgrade bare shape.
    {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        for slug in ["a", "b"] {
            let id: i64 = {{crate_name}}::schema::posts::table
                .filter({{crate_name}}::schema::posts::slug.eq(slug))
                .select({{crate_name}}::schema::posts::id)
                .first(&mut conn)
                .await
                .expect("the row");
            diesel::update(
                {{crate_name}}::schema::post_meta::table
                    .filter({{crate_name}}::schema::post_meta::post_id.eq(id))
                    .filter(
                        {{crate_name}}::schema::post_meta::meta_key.eq({{crate_name}}::content::IMPORT_SOURCE_SLUG_KEY),
                    ),
            )
            .set({{crate_name}}::schema::post_meta::meta_value.eq(slug))
            .execute(&mut conn)
            .await
            .expect("rewrite the marker");
        }
    }

    // An updated backup: the same `A` and `B`, plus a brand new `C`.
    let second = serde_json::json!({
        "version": 2,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "A", "slug": "a", "status": "publish",
             "author": "owner", "parent": null, "comment_status": "open", "password": ""},
            {"post_type": "page", "title": "B", "slug": "b", "status": "publish",
             "author": "owner", "parent": "a", "comment_status": "open", "password": ""},
            {"post_type": "page", "title": "C", "slug": "c", "status": "publish",
             "author": "owner", "parent": "b", "comment_status": "open", "password": ""}
        ]
    })
    .to_string();
    import_export(&client, &cookie, second.as_str())
        .await
        .assert_ok()
        .assert_body_contains("1 imported, 2 already present");

    sign_out(&client);
    client.get("/a/b/c").send().await.assert_ok();
    assert_eq!(
        client.get("/c").send().await.status,
        404,
        "the new page must nest under its real parent, not land at the top level"
    );
}

/// A page imported once as a pathless legacy child, later moved by an
/// editor, then re-imported (still naming its *original* position) as an
/// explicit `path` — a newer, version-4/5 export of the same site — must
/// still be recognized as the same page rather than duplicated at its old
/// position.
///
/// `find_local`'s exact ancestry match cannot catch this on its own once
/// the row has moved: it needs `stable_identity`'s recursive composition to
/// never carry its own disambiguating prefix into a parent's contribution,
/// so a chain nested under a pathless top-level post and the identical
/// position spelled out as one explicit `path` compose to the same marker
/// string regardless of where the row sits now.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_pathless_import_and_a_later_explicit_path_import_agree_on_position() {
    use diesel::prelude::*;
    use diesel_async::RunQueryDsl;

    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let first = serde_json::json!({
        "version": 2,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "A", "slug": "a", "status": "publish",
             "author": "owner", "parent": null, "comment_status": "open", "password": ""},
            {"post_type": "page", "title": "X", "slug": "x", "status": "publish",
             "author": "owner", "parent": null, "comment_status": "open", "password": ""},
            {"post_type": "page", "title": "Team", "slug": "team", "status": "publish",
             "author": "owner", "parent": "a", "comment_status": "open", "password": ""}
        ]
    })
    .to_string();
    import_export(&client, &cookie, first.as_str())
        .await
        .assert_ok()
        .assert_body_contains("3 imported, 0 already present");
    client.get("/a/team").send().await.assert_ok();

    // An editor moves `Team` out from under `A` and files it under `X`.
    let (team_id, x_id): (i64, i64) = {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        let team = {{crate_name}}::schema::posts::table
            .filter({{crate_name}}::schema::posts::slug.eq("team"))
            .select({{crate_name}}::schema::posts::id)
            .first(&mut conn)
            .await
            .expect("team");
        let x = {{crate_name}}::schema::posts::table
            .filter({{crate_name}}::schema::posts::slug.eq("x"))
            .select({{crate_name}}::schema::posts::id)
            .first(&mut conn)
            .await
            .expect("x");
        (team, x)
    };
    let x_id_str = x_id.to_string();
    client
        .post(&format!("/admin/content/page/{team_id}"))
        .header("cookie", &cookie)
        .form(
            &edit_form(
                &team_id,
                &[
                    ("title", "Team"),
                    ("slug", "team"),
                    ("excerpt", ""),
                    ("body", ""),
                    ("status", "publish"),
                    ("password", ""),
                    ("parent_id", x_id_str.as_str()),
                ],
            )
            .await,
        )
        .send()
        .await
        .assert_status(303);
    sign_out(&client);
    client.get("/x/team").send().await.assert_ok();

    // A newer, version-5 export of the same site, taken *before* the move —
    // it still names `Team`'s original position under `A`.
    let cookie = sign_in(&client, "owner").await;
    let second = serde_json::json!({
        "version": 5,
        "site_title": "repro",
        "exported_at": "2026-02-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "A", "slug": "a", "status": "publish",
             "author": "owner", "parent": null, "comment_status": "open", "password": "",
             "path": "a"},
            {"post_type": "page", "title": "X", "slug": "x", "status": "publish",
             "author": "owner", "parent": null, "comment_status": "open", "password": "",
             "path": "x"},
            {"post_type": "page", "title": "Team", "slug": "team", "status": "publish",
             "author": "owner", "parent": "a", "comment_status": "open", "password": "",
             "path": "a/team"}
        ]
    })
    .to_string();
    import_export(&client, &cookie, second.as_str())
        .await
        .assert_ok()
        .assert_body_contains("0 imported, 3 already present");

    // The editor's move stands, and no duplicate appeared at the old
    // position.
    sign_out(&client);
    client.get("/x/team").send().await.assert_ok();
    assert_eq!(
        client.get("/a/team").send().await.status,
        404,
        "the explicit-path re-import must not have created a duplicate at Team's old position"
    );
}

/// A file where two pages name each other as legacy parent, both already
/// carrying pre-upgrade bare markers, must not hang the import.
///
/// `resolved_post_id`'s own legacy-fallback recursion — unlike
/// `file_depth` and `stable_identity` — is new code with no other route to
/// it, so nothing else exercises its depth bound.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_cyclic_legacy_parent_reference_with_pre_upgrade_markers_does_not_hang() {
    use diesel::prelude::*;
    use diesel_async::RunQueryDsl;

    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let payload = serde_json::json!({
        "version": 2,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "A", "slug": "a", "status": "publish",
             "author": "owner", "parent": "b", "comment_status": "open", "password": ""},
            {"post_type": "page", "title": "B", "slug": "b", "status": "publish",
             "author": "owner", "parent": "a", "comment_status": "open", "password": ""}
        ]
    })
    .to_string();
    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("2 imported");

    // Rewrite both markers to their old, pre-upgrade bare shape.
    {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        for slug in ["a", "b"] {
            let id: i64 = {{crate_name}}::schema::posts::table
                .filter({{crate_name}}::schema::posts::slug.eq(slug))
                .select({{crate_name}}::schema::posts::id)
                .first(&mut conn)
                .await
                .expect("the row");
            diesel::update(
                {{crate_name}}::schema::post_meta::table
                    .filter({{crate_name}}::schema::post_meta::post_id.eq(id))
                    .filter(
                        {{crate_name}}::schema::post_meta::meta_key.eq({{crate_name}}::content::IMPORT_SOURCE_SLUG_KEY),
                    ),
            )
            .set({{crate_name}}::schema::post_meta::meta_value.eq(slug))
            .execute(&mut conn)
            .await
            .expect("rewrite the marker");
        }
    }

    // The same cyclic backup again. It must complete rather than hang.
    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok();
}

/// A file where two pages name each other as parent must not hang or crash
/// the import, and must not create an actual cycle in the database.
///
/// `file_depth`'s own seen-set is new code. Nothing else makes an import walk
/// a chain of the file's own parent references, so nothing else exercises
/// this guard.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn an_import_with_a_cyclic_parent_reference_does_not_hang() {
    use diesel::prelude::*;
    use diesel_async::RunQueryDsl;

    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let payload = serde_json::json!({
        "version": 2,
        "site_title": "repro",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {"post_type": "page", "title": "A", "slug": "a", "status": "publish",
             "author": "owner", "parent": "b", "comment_status": "open", "password": ""},
            {"post_type": "page", "title": "B", "slug": "b", "status": "publish",
             "author": "owner", "parent": "a", "comment_status": "open", "password": ""}
        ]
    })
    .to_string();

    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("2 imported");

    // Both rows exist, and the hierarchy lock's own cycle guard — not this
    // test — decides where they land. What matters here is that neither
    // parent link points back the other way: that would be a real cycle.
    let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
    let rows: std::collections::HashMap<String, (i64, Option<i64>)> = {{crate_name}}::schema::posts::table
        .filter({{crate_name}}::schema::posts::slug.eq_any(["a", "b"]))
        .select((
            {{crate_name}}::schema::posts::slug,
            {{crate_name}}::schema::posts::id,
            {{crate_name}}::schema::posts::parent_id,
        ))
        .load::<(String, i64, Option<i64>)>(&mut conn)
        .await
        .expect("both rows")
        .into_iter()
        .map(|(slug, id, parent_id)| (slug, (id, parent_id)))
        .collect();
    assert_eq!(rows.len(), 2, "both pages were imported: {rows:?}");
    let (a_id, a_parent) = rows["a"];
    let (b_id, b_parent) = rows["b"];
    assert!(
        !(a_parent == Some(b_id) && b_parent == Some(a_id)),
        "the two pages must not end up parents of each other"
    );
}

/// A malformed email is refused at registration.
///
/// `register_user` inserts through direct Diesel, so the model's
/// `#[validate(email)]` never runs — and the form approximated it with
/// `contains('@')`, which accepts `user@`.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_malformed_email_cannot_register() {
    let client = db_client().await;

    for address in ["user@", "@example.com", "no-at-sign", "a@b@c.com"] {
        let refused = client
            .post("/register")
            .form(&form(&[
                ("username", "someone"),
                ("email", address),
                ("password", "correct horse battery staple"),
            ]))
            .send()
            .await;
        assert_ne!(
            refused.status,
            303,
            "`{address}` is not a valid address: {}",
            refused.text()
        );
    }

    let accounts: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::users::table
            .count()
            .get_result(&mut conn)
            .await
            .expect("the count")
    };
    assert_eq!(accounts, 0, "no malformed address may have been stored");

    // A real one still registers.
    client
        .post("/register")
        .form(&form(&[
            ("username", "someone"),
            ("email", "someone@example.com"),
            ("password", "correct horse battery staple"),
        ]))
        .send()
        .await
        .assert_status(303);
}

/// A creation that fails part-way leaves no post behind.
///
/// The insert used to commit on its own, with the revision, the filings and any
/// deferred transition following as separate transactions behind an unwind. An
/// unwind covers a failed statement; it does not cover a cancelled request or a
/// process that stops existing, either of which left an immediately-public post
/// with no taxonomy or revision history, or a requested private post stuck as a
/// draft, with no marker a retry could resume from.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn an_interrupted_creation_leaves_no_post() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    // Fail the run after the row is written but before the work that completes
    // it, which is the window the transaction closes. A trigger on `revisions`
    // stands in for the process death that would do it in practice.
    let db = TestDb::shared().await;
    try_execute(
        db,
        "CREATE OR REPLACE FUNCTION refuse_revision() RETURNS trigger AS $$
         BEGIN
             IF NEW.summary = 'Created' THEN RAISE EXCEPTION 'boom'; END IF;
             RETURN NEW;
         END; $$ LANGUAGE plpgsql",
    )
    .await
    .expect("create the trigger function");
    try_execute(db, "DROP TRIGGER IF EXISTS refuse_revision ON revisions")
        .await
        .expect("clear any previous trigger");
    try_execute(
        db,
        "CREATE TRIGGER refuse_revision BEFORE INSERT ON revisions
         FOR EACH ROW EXECUTE FUNCTION refuse_revision()",
    )
    .await
    .expect("install the trigger");

    let failed = client
        .post("/admin/content/post")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "Half Made"),
            ("slug", "half-made"),
            ("excerpt", ""),
            ("body", "Body."),
            ("status", "publish"),
            ("password", ""),
        ]))
        .send()
        .await;
    assert_ne!(failed.status, 303, "the creation must not report success");

    let rows: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::posts::table
            .filter({{crate_name}}::schema::posts::slug.eq("half-made"))
            .count()
            .get_result(&mut conn)
            .await
            .expect("the count")
    };
    assert_eq!(
        rows, 0,
        "the insert has to roll back with the work that completes it"
    );

    try_execute(db, "DROP TRIGGER refuse_revision ON revisions")
        .await
        .expect("remove the trigger");

    // And the same submission succeeds once the failure is gone, with its
    // revision in place.
    let created = client
        .post("/admin/content/post")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "Half Made"),
            ("slug", "half-made"),
            ("excerpt", ""),
            ("body", "Body."),
            ("status", "publish"),
            ("password", ""),
        ]))
        .send()
        .await;
    assert_eq!(created.status, 303, "body: {}", created.text());
    let id = created
        .header("location")
        .expect("redirect")
        .rsplit('/')
        .next()
        .expect("id")
        .to_owned();
    client
        .get(&format!("/admin/content/post/{id}/revisions"))
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Created");
}

/// An API creation that fails part-way leaves no post behind.
///
/// `private` is reached by transitioning a draft, and the insert used to commit
/// on its own with the transition following behind an unwind — which covers a
/// failed statement, not a cancelled request or a process that stops existing.
/// The caller then received no post while a draft stayed behind, and each retry
/// consumed another suffixed slug.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn an_interrupted_api_creation_leaves_no_post() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let db = TestDb::shared().await;
    try_execute(
        db,
        "CREATE OR REPLACE FUNCTION refuse_private() RETURNS trigger AS $$
         BEGIN
             IF NEW.status = 'private' THEN RAISE EXCEPTION 'boom'; END IF;
             RETURN NEW;
         END; $$ LANGUAGE plpgsql",
    )
    .await
    .expect("create the trigger function");
    try_execute(db, "DROP TRIGGER IF EXISTS refuse_private ON posts")
        .await
        .expect("clear any previous trigger");
    try_execute(
        db,
        "CREATE TRIGGER refuse_private BEFORE UPDATE ON posts
         FOR EACH ROW EXECUTE FUNCTION refuse_private()",
    )
    .await
    .expect("install the trigger");

    let refused = client
        .post("/api/v1/posts")
        .header("cookie", &cookie)
        .json(&serde_json::json!({
            "title": "Behind Closed Doors",
            "body": "Body.",
            "status": "private"
        }))
        .send()
        .await;
    assert_ne!(
        refused.status,
        201,
        "the creation must not report success: {}",
        refused.text()
    );

    let rows: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::posts::table
            .count()
            .get_result(&mut conn)
            .await
            .expect("the count")
    };
    assert_eq!(
        rows, 0,
        "the insert has to roll back with the transition that completes it"
    );

    try_execute(db, "DROP TRIGGER refuse_private ON posts")
        .await
        .expect("remove the trigger");

    // The same request succeeds once the failure is gone.
    let created = client
        .post("/api/v1/posts")
        .header("cookie", &cookie)
        .json(&serde_json::json!({
            "title": "Behind Closed Doors",
            "body": "Body.",
            "status": "private"
        }))
        .send()
        .await;
    assert_eq!(created.status, 201, "body: {}", created.text());
    assert_eq!(
        created.json::<serde_json::Value>()["slug"],
        "behind-closed-doors"
    );
}

/// A malformed email cannot be stored on an existing account either.
///
/// The registration path applies the model's declared validator; the admin edit
/// is a direct Diesel update, so fixing only the create path left `user@`
/// storable on an account that already existed.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_malformed_email_cannot_be_saved_on_an_existing_account() {
    let client = db_client().await;
    let owner = register(&client, "owner").await;
    sign_out(&client);
    register(&client, "editor").await;

    let refused = client
        .post("/admin/users/2")
        .header("cookie", &owner)
        .form(&form(&[
            ("role", "editor"),
            ("email", "editor@"),
            ("display_name", "Editor"),
            ("bio", ""),
            ("website", ""),
        ]))
        .send()
        .await;
    assert_eq!(
        refused.status,
        422,
        "the edit path applies the same rule the create path does: {}",
        refused.text()
    );

    let stored: String = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::users::table
            .find(2_i64)
            .select({{crate_name}}::schema::users::email)
            .first(&mut conn)
            .await
            .expect("the account")
    };
    assert_eq!(stored, "editor@example.com", "the address is unchanged");

    // A valid one still saves.
    client
        .post("/admin/users/2")
        .header("cookie", &owner)
        .form(&form(&[
            ("role", "editor"),
            ("email", "editor@elsewhere.test"),
            ("display_name", "Editor"),
            ("bio", ""),
            ("website", ""),
        ]))
        .send()
        .await
        .assert_status(303);
}

/// A comment is refused when the post's password moved under the lock.
///
/// The locked re-read checked status, type and `comment_status` — everything
/// about "may this person see it" except the password. An editor protecting a
/// post between the handler's unlock check and this transaction would otherwise
/// have a signed-in submission land approved on content the commenter never
/// unlocked.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_comment_is_refused_when_the_password_moved_under_the_lock() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let post_id = create_post(&client, &cookie, "Open Then Shut", "Body.", "publish").await;

    // Protect it behind the handler's back, the way a concurrent edit would.
    try_execute(
        TestDb::shared().await,
        &format!("UPDATE posts SET password = 'hunter2' WHERE id = {post_id}"),
    )
    .await
    .expect("protect the post");

    // The handler observed no password; the locked read sees one.
    let refused = {{crate_name}}::content::create_comment(
        &mut TestDb::shared().await.pool().get().await.expect("conn"),
        {{crate_name}}::models::NewComment {
            post_id,
            parent_id: None,
            author_id: None,
            author_name: "Guest".to_owned(),
            author_email: "guest@example.com".to_owned(),
            author_url: String::new(),
            author_ip: String::new(),
            body: "Slipped through".to_owned(),
            status: "approved".to_owned(),
        },
        "",
    )
    .await;
    assert!(
        refused.is_err(),
        "the insert must re-check the password, not only the status"
    );

    // With the password the handler actually observed, it is accepted — the
    // check is on the gate having *moved*, not on protection as such.
    {{crate_name}}::content::create_comment(
        &mut TestDb::shared().await.pool().get().await.expect("conn"),
        {{crate_name}}::models::NewComment {
            post_id,
            parent_id: None,
            author_id: None,
            author_name: "Guest".to_owned(),
            author_email: "guest@example.com".to_owned(),
            author_url: String::new(),
            author_ip: String::new(),
            body: "Unlocked properly".to_owned(),
            status: "approved".to_owned(),
        },
        "hunter2",
    )
    .await
    .expect("an unlocked commenter may still comment");
}

/// The Appearance screen bounds the menus it loads.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn the_appearance_menu_list_is_bounded() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    try_execute(
        TestDb::shared().await,
        "INSERT INTO menus (name, slug, location)
         SELECT 'Menu ' || lpad(g::text, 3, '0'),
                'menu-' || lpad(g::text, 3, '0'),
                ''
         FROM generate_series(1, 45) AS g",
    )
    .await
    .expect("seed the menus");

    let first = client
        .get("/admin/appearance")
        .header("cookie", &cookie)
        .send()
        .await;
    first.assert_ok();
    let first = first.text();
    assert!(first.contains("Menu 001"), "the first menus are shown");
    assert!(
        !first.contains("Menu 021"),
        "the screen must not render every menu"
    );
    assert!(first.contains("Page 1 of 3"));

    let last = client
        .get("/admin/appearance?page=3")
        .header("cookie", &cookie)
        .send()
        .await;
    last.assert_ok();
    let last = last.text();
    assert!(last.contains("Menu 045"), "the tail is reachable");
    assert!(!last.contains("Menu 001"), "page three is not page one");
}

/// An import cannot store a term name past the model's cap.
///
/// Found by sweeping for the shape rather than by a review: `import_terms`
/// inserts through direct Diesel so the rows and their ancestry commit
/// together, which means the model's `#[validate(length(max = 200))]` never
/// runs — and the cap the editor's own box has enforced since round twenty-seven
/// lived as a local constant there rather than in the shared normalizer.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn an_import_cannot_store_an_oversized_term_name() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let payload = serde_json::json!({
        "version": 4,
        "site_title": "Elsewhere",
        "exported_at": "2026-01-01T00:00:00Z",
        "attachments": [],
        "posts": [],
        "terms": [
            {"taxonomy": "category", "name": "x".repeat(201), "slug": "huge", "description": ""}
        ]
    })
    .to_string();

    let refused = import_export(&client, &cookie, payload.as_str()).await;
    assert_ne!(refused.status, 200, "the import must not report success");

    let terms: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::terms::table
            .count()
            .get_result(&mut conn)
            .await
            .expect("the count")
    };
    assert_eq!(terms, 0, "and must store nothing");

    // A name at the cap still imports — the bound is the model's, not tighter.
    let payload = serde_json::json!({
        "version": 4,
        "site_title": "Elsewhere",
        "exported_at": "2026-01-01T00:00:00Z",
        "attachments": [],
        "posts": [],
        "terms": [
            {"taxonomy": "category", "name": "x".repeat(200), "slug": "big", "description": ""}
        ]
    })
    .to_string();
    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok();
    let terms: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::terms::table
            .count()
            .get_result(&mut conn)
            .await
            .expect("the count")
    };
    assert_eq!(terms, 1);
}

/// A menu assigned to the footer location is rendered there.
///
/// The Appearance screen has always offered `Footer` beside `Primary
/// navigation`, and nothing resolved it: an administrator could build a menu,
/// assign it, save successfully, and have visitors never see it.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_menu_assigned_to_the_footer_is_rendered() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    client
        .post("/admin/appearance/menus")
        .header("cookie", &cookie)
        .form(&form(&[("name", "Legal"), ("location", "footer")]))
        .send()
        .await
        .assert_status(303);
    let menu: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::menus::table
            .filter({{crate_name}}::schema::menus::location.eq("footer"))
            .select({{crate_name}}::schema::menus::id)
            .first(&mut conn)
            .await
            .expect("the menu")
    };
    client
        .post(&format!("/admin/appearance/menus/{menu}/items"))
        .header("cookie", &cookie)
        .form(&form(&[
            ("label", "Privacy"),
            ("url", "/privacy"),
            ("parent_id", ""),
        ]))
        .send()
        .await
        .assert_status(303);

    sign_out(&client);
    let home = client.get("/").send().await;
    home.assert_ok();
    let home = home.text();
    assert!(
        home.contains("Privacy") && home.contains("/privacy"),
        "a footer menu must reach the page it was assigned to:\n{home}"
    );
    assert!(
        home.contains(r#"aria-label="Footer""#),
        "and be labelled as navigation rather than loose links"
    );
}

/// `Menu::name` declares `#[validate(length(min = 1, max = 200))]`, but
/// `replace_menu_at_location` writes the row through a raw
/// `diesel::insert_into` that never runs the model's generated
/// `validator::Validate` — so `create_menu` was the only place left to
/// enforce it, and it did not. A blank (including whitespace-only, which the
/// browser's `required` attribute does not reject) or overlong name is now
/// refused at 422, with the "New menu" card's location choice preserved,
/// instead of being silently persisted — an empty name previously fell back
/// to a hashed slug and inserted a menu with a blank display name.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn an_invalid_menu_name_is_refused_and_redisplayed() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    for name in ["   ", &"x".repeat(201)] {
        let resp = client
            .post("/admin/appearance/menus")
            .header("cookie", &cookie)
            .form(&form(&[("name", name), ("location", "primary")]))
            .send()
            .await;
        resp.assert_status(422);
        assert!(
            resp.header("location").is_none(),
            "a rejected submission must not redirect"
        );
        resp.assert_body_contains("must be between 1 and 200 characters")
            .assert_body_contains(r#"value="primary" selected"#);
    }

    let count: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::menus::table
            .count()
            .get_result(&mut conn)
            .await
            .expect("the count")
    };
    assert_eq!(count, 0, "neither invalid name may be persisted");
}

/// A refused menu item or widget is redisplayed in its own card, not replaced
/// by the generic error page.
///
/// `create_menu_item` and `create_widget` reported every refusal — a blank
/// label (which `required` does not reject when it is whitespace), a parent
/// that vanished since the form was rendered, a full sidebar — by returning
/// the error, so the administrator lost the whole Appearance screen and
/// everything typed into the card. Each is now a 422 that keeps the values and
/// puts the reason (`role="alert"`) inside the card it belongs to.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_refused_menu_item_or_widget_is_redisplayed_with_its_input() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    client
        .post("/admin/appearance/menus")
        .header("cookie", &cookie)
        .form(&form(&[("name", "Main"), ("location", "primary")]))
        .send()
        .await
        .assert_status(303);

    // Blank label: the URL the administrator typed survives.
    let blank = client
        .post("/admin/appearance/menus/1/items")
        .header("cookie", &cookie)
        .form(&form(&[("label", "   "), ("url", "/keep-me")]))
        .send()
        .await;
    blank.assert_status(422);
    assert!(blank.header("location").is_none());
    blank
        .assert_body_contains("A menu item needs a label")
        .assert_body_contains(r#"role="alert""#)
        .assert_body_contains(r#"value="/keep-me""#)
        .assert_body_contains("autofocus");

    // A parent that does not exist (deleted in another tab) is refused with the
    // label and URL intact.
    let stale = client
        .post("/admin/appearance/menus/1/items")
        .header("cookie", &cookie)
        .form(&form(&[
            ("label", "Products"),
            ("url", "/products"),
            ("parent_id", "999"),
        ]))
        .send()
        .await;
    stale.assert_status(422);
    stale
        .assert_body_contains("can only nest under a top-level item")
        .assert_body_contains(r#"value="Products""#)
        .assert_body_contains(r#"value="/products""#);

    // An oversized widget title: kind, text and position survive.
    let long_title = client
        .post("/admin/appearance/widgets")
        .header("cookie", &cookie)
        .form(&form(&[
            ("kind", "text"),
            ("title", &"t".repeat(201)),
            ("text", "Keep this blurb."),
            ("position", "7"),
        ]))
        .send()
        .await;
    long_title.assert_status(422);
    long_title
        .assert_body_contains("A widget title must be at most 200 characters")
        .assert_body_contains(r#"role="alert""#)
        .assert_body_contains("Keep this blurb.")
        .assert_body_contains(r#"value="7""#)
        .assert_body_contains(r#"value="text" selected"#);

    // A full sidebar: the refusal is the store's own message, shown in the card.
    for _ in 0..30 {
        client
            .post("/admin/appearance/widgets")
            .header("cookie", &cookie)
            .form(&form(&[("kind", "text"), ("text", "x"), ("position", "0")]))
            .send()
            .await
            .assert_status(303);
    }
    let full = client
        .post("/admin/appearance/widgets")
        .header("cookie", &cookie)
        .form(&form(&[("kind", "text"), ("text", "One too many.")]))
        .send()
        .await;
    full.assert_status(422);
    full.assert_body_contains("Remove one before adding another")
        .assert_body_contains("One too many.");

    let (items, widgets): (i64, i64) = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        (
            {{crate_name}}::schema::menu_items::table
                .count()
                .get_result(&mut conn)
                .await
                .expect("item count"),
            {{crate_name}}::schema::widgets::table
                .count()
                .get_result(&mut conn)
                .await
                .expect("widget count"),
        )
    };
    assert_eq!(items, 0, "no refused item may be stored");
    assert_eq!(widgets, 30, "only the widgets that fit were stored");
}

/// A refused item is redisplayed beside its own menu even when that menu is
/// not on the first page of the Appearance screen — the page is resolved from
/// the menu, not from the (possibly stale) page the form was rendered on.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_refused_item_on_a_later_menu_page_still_shows_its_message() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    for n in 1..=21 {
        client
            .post("/admin/appearance/menus")
            .header("cookie", &cookie)
            .form(&form(&[
                ("name", &format!("Menu {n:02}")),
                ("location", ""),
            ]))
            .send()
            .await
            .assert_status(303);
    }

    // Menu 21 is id 21 and sorts last: page 2 at 20 menus per page.
    let refused = client
        .post("/admin/appearance/menus/21/items")
        .header("cookie", &cookie)
        .form(&form(&[("label", " "), ("url", "/kept")]))
        .send()
        .await;
    refused.assert_status(422);
    refused
        .assert_body_contains("A menu item needs a label")
        .assert_body_contains("Menu 21")
        .assert_body_contains(r#"value="/kept""#);
}

/// A refused item keeps its category target even when the bounded category
/// list no longer includes it — otherwise the browser would select "No
/// category" and the resubmitted item would silently lose its target.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_refused_item_keeps_a_target_outside_the_bounded_lists() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    client
        .post("/admin/appearance/menus")
        .header("cookie", &cookie)
        .form(&form(&[("name", "Primary"), ("location", "primary")]))
        .send()
        .await
        .assert_status(303);
    try_execute(
        TestDb::shared().await,
        "INSERT INTO terms (taxonomy, name, slug, description, post_count)
         SELECT 'category', 'cat-' || lpad(g::text, 3, '0'),
                'cat-' || lpad(g::text, 3, '0'), '', 0
         FROM generate_series(1, 250) AS g",
    )
    .await
    .expect("seed the terms");

    // cat-250 (id 250) is beyond the first 200 offered.
    let refused = client
        .post("/admin/appearance/menus/1/items")
        .header("cookie", &cookie)
        .form(&form(&[("label", " "), ("term_id", "250")]))
        .send()
        .await;
    refused.assert_status(422);
    refused.assert_body_contains(r#"<option value="250" selected>cat-250"#);
}

/// Only one menu can hold a theme location, under concurrency.
///
/// The replacement cleared the incumbent and inserted, with nothing
/// serializing the two — so two administrators assigning `primary` at once
/// each cleared what they saw and both committed, after which the renderer
/// picked one of two with no defined ordering.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn only_one_menu_can_hold_a_location() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    for name in ["First", "Second", "Third"] {
        client
            .post("/admin/appearance/menus")
            .header("cookie", &cookie)
            .form(&form(&[("name", name), ("location", "primary")]))
            .send()
            .await
            .assert_status(303);
    }

    let holders: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::menus::table
            .filter({{crate_name}}::schema::menus::location.eq("primary"))
            .count()
            .get_result(&mut conn)
            .await
            .expect("the count")
    };
    assert_eq!(holders, 1, "the location has exactly one holder");

    // The database enforces it, not only the application: a direct write that
    // skips `replace_menu_at_location` is refused.
    let refused = try_execute(
        TestDb::shared().await,
        "UPDATE menus SET location = 'primary' WHERE name = 'First'",
    )
    .await;
    assert!(
        refused.is_err(),
        "a second holder must be impossible to store at all"
    );
}

/// A page's ancestry is either complete or absent, never truncated.
///
/// `.ok()` on an ancestor lookup turned a pool or database failure into "no
/// parent", so `/about/team` would be published as `/team` — a URL that 404s,
/// into listings, feeds and caches. That is now propagated, at this and seven
/// other call sites with the same shape.
///
/// The error path itself is not covered here, and I would rather say so than
/// imply it is: a failing `SELECT` cannot be induced through the HTTP surface,
/// and the change is `.ok().flatten()` becoming `?`. What this pins is the
/// distinction the fix has to preserve — a nested page keeps its full path, and
/// a page with genuinely no parent still resolves to `Ok(None)` and keeps its
/// bare one, rather than the two collapsing into each other.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_failed_ancestor_lookup_does_not_truncate_a_permalink() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let about = client
        .post("/admin/content/page")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "About"),
            ("slug", "about"),
            ("excerpt", ""),
            ("body", "Body."),
            ("status", "publish"),
            ("password", ""),
        ]))
        .send()
        .await;
    assert_eq!(about.status, 303, "body: {}", about.text());
    let about_id = about
        .header("location")
        .expect("redirect")
        .rsplit('/')
        .next()
        .expect("id")
        .to_owned();

    client
        .post("/admin/content/page")
        .header("cookie", &cookie)
        .form(&form(&[
            ("title", "Team"),
            ("slug", "team"),
            ("excerpt", ""),
            ("body", "Body."),
            ("status", "publish"),
            ("password", ""),
            ("parent_id", about_id.as_str()),
        ]))
        .send()
        .await
        .assert_status(303);

    // The healthy path, so the failure below is the only variable.
    sign_out(&client);
    let listed: serde_json::Value = client
        .get("/api/v1/posts?post_type=page")
        .send()
        .await
        .assert_ok()
        .json();
    let urls: Vec<&str> = listed
        .as_array()
        .expect("array")
        .iter()
        .filter_map(|post| post["url"].as_str())
        .collect();
    assert!(
        urls.contains(&"/about/team"),
        "the nested page is published at its full path: {urls:?}"
    );

    // A page with genuinely no parent is the `Ok(None)` case, which has to keep
    // behaving exactly as it did — the fix must not turn "no parent" into an
    // error any more than it left an error looking like "no parent".
    try_execute(
        TestDb::shared().await,
        "UPDATE posts SET parent_id = NULL WHERE slug = 'team'",
    )
    .await
    .expect("detach");
    let listed: serde_json::Value = client
        .get("/api/v1/posts?post_type=page")
        .send()
        .await
        .assert_ok()
        .json();
    let urls: Vec<&str> = listed
        .as_array()
        .expect("array")
        .iter()
        .filter_map(|post| post["url"].as_str())
        .collect();
    assert!(
        urls.contains(&"/team"),
        "a page with genuinely no parent is `Ok(None)` and keeps its bare path: {urls:?}"
    );
}

/// A menu item whose target stops being public disappears from the nav.
///
/// A menu names a post by id, and that post can be drafted, scheduled, made
/// private or trashed afterwards — the menu has no idea. Every page of the site
/// carried a link to a 404 until somebody noticed and edited the menu by hand.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_menu_item_pointing_at_hidden_content_is_not_rendered() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let post_id = create_post(&client, &cookie, "Announcement", "Body.", "publish").await;

    client
        .post("/admin/appearance/menus")
        .header("cookie", &cookie)
        .form(&form(&[("name", "Primary"), ("location", "primary")]))
        .send()
        .await
        .assert_status(303);
    let menu: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::menus::table
            .select({{crate_name}}::schema::menus::id)
            .first(&mut conn)
            .await
            .expect("the menu")
    };
    for fields in [
        vec![("label", "News"), ("post_id", &post_id.to_string()[..])],
        vec![("label", "Elsewhere"), ("url", "https://example.com/x")],
    ] {
        let mut all = fields.clone();
        all.push(("parent_id", ""));
        client
            .post(&format!("/admin/appearance/menus/{menu}/items"))
            .header("cookie", &cookie)
            .form(&form(&all))
            .send()
            .await
            .assert_status(303);
    }

    // While it is published, it is in the nav.
    sign_out(&client);
    let home = client.get("/").send().await;
    home.assert_ok();
    assert!(home.text().contains("News"), "a live target is linked");

    // Unpublish it. The link must go, and the rest of the menu must stay.
    client
        .post(&format!("/admin/content/post/{post_id}/status?to=draft"))
        .header("cookie", &cookie)
        .send()
        .await
        .assert_status(303);

    sign_out(&client);
    let home = client.get("/").send().await;
    home.assert_ok();
    let home = home.text();
    assert!(
        !home.contains(">News<"),
        "a menu item pointing at hidden content must not render a dead link:\n{home}"
    );
    assert!(
        home.contains("Elsewhere"),
        "and the rest of the menu is untouched"
    );
}

/// A dashboard count that cannot be read is an error, not a zero.
///
/// `unwrap_or(0)` rendered a transient database failure as "you have no
/// published posts" — a screen that lies plausibly, with nothing to suggest
/// looking at the logs.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_dashboard_count_failure_is_not_reported_as_zero() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    create_post(&client, &cookie, "Live", "Body.", "publish").await;

    // The healthy reading first, so the failure below is the only variable.
    client
        .get("/admin")
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Posts");

    // A count that cannot be answered. The dashboard must fail rather than
    // report an inaccurate figure.
    let db = TestDb::shared().await;
    try_execute(db, "ALTER TABLE posts RENAME TO posts_hidden")
        .await
        .expect("hide the table");
    let broken = client.get("/admin").header("cookie", &cookie).send().await;
    let status = broken.status;
    try_execute(db, "ALTER TABLE posts_hidden RENAME TO posts")
        .await
        .expect("restore the table");
    assert_ne!(
        status, 200,
        "a dashboard that cannot count must say so rather than render zeros"
    );

    // And it recovers once the fault is gone.
    client
        .get("/admin")
        .header("cookie", &cookie)
        .send()
        .await
        .assert_ok();
}

/// The public sidebar renders a bounded number of widgets.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn the_sidebar_renders_a_bounded_number_of_widgets() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    try_execute(
        TestDb::shared().await,
        "INSERT INTO widgets (sidebar, kind, title, settings, position)
         SELECT 'primary', 'text', 'Widget ' || lpad(g::text, 3, '0'),
                '{\"text\": \"Body.\"}'::jsonb, g
         FROM generate_series(1, 50) AS g",
    )
    .await
    .expect("seed the widgets");

    sign_out(&client);
    let home = client.get("/").send().await;
    home.assert_ok();
    let home = home.text();
    assert!(home.contains("Widget 001"), "the first widgets render");
    assert!(
        !home.contains("Widget 031"),
        "the sidebar must not render every widget somebody has placed"
    );

    // The Appearance screen shows the same set, so what an administrator
    // manages is what visitors see.
    let screen = client
        .get("/admin/appearance")
        .header("cookie", &cookie)
        .send()
        .await;
    screen.assert_ok();
    let screen = screen.text();
    assert!(screen.contains("Widget 001"));
    assert!(!screen.contains("Widget 031"));
}

/// A widget's title and body are capped.
///
/// A sidebar widget renders on *every* public page, so its size is paid
/// site-wide rather than on the one page that carries it — and the model
/// declares no length rule, so the form's `maxlength` was the whole defence
/// against a body bounded only by the request limit.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_widget_cannot_carry_an_unbounded_title_or_body() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let refused = client
        .post("/admin/appearance/widgets")
        .header("cookie", &cookie)
        .form(&form(&[
            ("kind", "text"),
            ("title", &"t".repeat(201)),
            ("text", "Body."),
            ("position", "0"),
        ]))
        .send()
        .await;
    assert_eq!(
        refused.status,
        422,
        "an oversized title must be refused: {}",
        refused.text()
    );

    let refused = client
        .post("/admin/appearance/widgets")
        .header("cookie", &cookie)
        .form(&form(&[
            ("kind", "text"),
            ("title", "About"),
            ("text", &"x".repeat(10_001)),
            ("position", "0"),
        ]))
        .send()
        .await;
    assert_eq!(
        refused.status,
        422,
        "an oversized body must be refused: {}",
        refused.text()
    );

    let placed: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::widgets::table
            .count()
            .get_result(&mut conn)
            .await
            .expect("the count")
    };
    assert_eq!(placed, 0, "neither refused submission may have been stored");

    // At the cap, both still save — the bound is the stated one.
    client
        .post("/admin/appearance/widgets")
        .header("cookie", &cookie)
        .form(&form(&[
            ("kind", "text"),
            ("title", &"t".repeat(200)),
            ("text", &"x".repeat(10_000)),
            ("position", "0"),
        ]))
        .send()
        .await
        .assert_status(303);
}

/// The seeder skips content whose bare path is already taken by another type.
///
/// `post` and top-level `page` share the bare URL namespace, and
/// `idx_posts_bare_path_slug` enforces it — so a same-type existence check
/// reported "not present" for a *page* named `about`, and the seeder's direct
/// insert then failed on the constraint, taking the rest of the seed with it
/// after the settings and terms had already committed.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn seeding_skips_a_slug_the_other_bare_type_already_holds() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    // Deliberately the *opposite* types to the ones the seed wants: it seeds a
    // post at `/hello-world` and a page at `/about`, so a page at
    // `/hello-world` and a post at `/about` are invisible to a same-type check
    // and fatal to the insert that follows it. (My first version of this test
    // used the matching types, which the old check already caught — it passed
    // with the fix reverted and proved nothing.)
    for (post_type, title, slug) in [("page", "Hello", "hello-world"), ("post", "About", "about")] {
        let created = client
            .post(&format!("/admin/content/{post_type}"))
            .header("cookie", &cookie)
            .form(&form(&[
                ("title", title),
                ("slug", slug),
                ("excerpt", ""),
                ("body", "Mine, not the seed's."),
                ("status", "publish"),
                ("password", ""),
            ]))
            .send()
            .await;
        assert_eq!(created.status, 303, "body: {}", created.text());
    }

    let author: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::users::table
            .select({{crate_name}}::schema::users::id)
            .first(&mut conn)
            .await
            .expect("the owner")
    };

    // The seed must complete rather than abort on the constraint.
    {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::seed::seed_posts(&mut conn, author, chrono::Utc::now().naive_utc())
            .await
            .expect("the seed skips what is already there rather than failing");
    }

    // The existing content is untouched, and nothing was duplicated.
    sign_out(&client);
    client
        .get("/hello-world")
        .send()
        .await
        .assert_ok()
        .assert_body_contains("Mine, not the seed's.");
    let taken: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::posts::table
            .filter({{crate_name}}::schema::posts::slug.eq("hello-world"))
            .count()
            .get_result(&mut conn)
            .await
            .expect("the count")
    };
    assert_eq!(taken, 1, "the seed must not duplicate a taken bare path");
}

/// Filing a post under a term takes the term's lock before writing the join
/// rows, not after.
///
/// Inserting a `post_terms` row makes PostgreSQL take `FOR KEY SHARE` on the
/// referenced term to enforce the foreign key, and `recount_term` then asks the
/// same row for `FOR UPDATE`. Two editors filing different posts under one term
/// both hold a key-share lock and both try to upgrade: PostgreSQL breaks the
/// cycle by aborting one editor's save as a deadlock.
///
/// The race itself is timing-dependent, so this asserts the property that makes
/// it impossible instead: while the save is blocked on the term, it must hold
/// no lock on `post_terms` — i.e. it stopped at the term before writing
/// anything. That is observable from a third connection, and it is exactly the
/// ordering a deadlock needs violated.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_term_is_locked_before_its_relationships_are_written() {
    use diesel::prelude::*;
    use diesel_async::RunQueryDsl;

    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let post_id = create_post(&client, &cookie, "Filed", "Body.", "publish").await;

    client
        .post("/admin/terms/category")
        .header("cookie", &cookie)
        .form(&form(&[("name", "Contended"), ("slug", "contended")]))
        .send()
        .await
        .assert_status(303);
    let term_id: i64 = {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::terms::table
            .filter({{crate_name}}::schema::terms::slug.eq("contended"))
            .select({{crate_name}}::schema::terms::id)
            .first(&mut conn)
            .await
            .expect("the term")
    };

    // A held `FOR UPDATE` on the term, from a session that keeps its
    // transaction open. Anything the save does to that term now blocks.
    let mut holder = TestDb::shared().await.pool().get().await.expect("conn");
    diesel::sql_query("BEGIN")
        .execute(&mut holder)
        .await
        .expect("begin");
    diesel::sql_query(format!(
        "SELECT id FROM terms WHERE id = {term_id} FOR UPDATE"
    ))
    .execute(&mut holder)
    .await
    .expect("hold the term");

    let save = tokio::spawn(async move {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::content::set_post_terms(&mut conn, post_id, vec![term_id]).await
    });

    let blocked_pid = wait_for_a_blocked_backend().await;

    // The discriminating question: has the blocked transaction already written
    // to `post_terms`? A write there takes a `RowExclusiveLock` on the table,
    // which is granted and visible for as long as the transaction lives.
    let held = granted_locks(blocked_pid, "post_terms", "RowExclusiveLock").await;
    assert_eq!(
        held, 0,
        "the save must take the term's lock before writing any post_terms row; \
         holding one while waiting to upgrade is the deadlock"
    );

    // Releasing the holder lets the save finish, and it finishes correctly.
    diesel::sql_query("COMMIT")
        .execute(&mut holder)
        .await
        .expect("commit");
    save.await.expect("the task").expect("the save succeeds");

    let filed: i64 = {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::post_terms::table
            .filter({{crate_name}}::schema::post_terms::post_id.eq(post_id))
            .filter({{crate_name}}::schema::post_terms::term_id.eq(term_id))
            .count()
            .get_result(&mut conn)
            .await
            .expect("the count")
    };
    assert_eq!(filed, 1, "the post is filed under the term");
}

/// The post is locked before its terms, so the lock order is the same
/// everywhere.
///
/// `transition_status` and the scheduled-publish sweep both update the post row
/// and then recount its terms. A taxonomy save that took a term lock first and
/// then blocked on the post — the relationship insert key-shares it through the
/// foreign key — closes the cycle, and PostgreSQL aborts one of them.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_post_is_locked_before_its_terms() {
    use diesel::prelude::*;
    use diesel_async::RunQueryDsl;

    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let post_id = create_post(&client, &cookie, "Ordered", "Body.", "publish").await;

    client
        .post("/admin/terms/category")
        .header("cookie", &cookie)
        .form(&form(&[("name", "Ordered"), ("slug", "ordered")]))
        .send()
        .await
        .assert_status(303);
    let term_id: i64 = {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::terms::table
            .filter({{crate_name}}::schema::terms::slug.eq("ordered"))
            .select({{crate_name}}::schema::terms::id)
            .first(&mut conn)
            .await
            .expect("the term")
    };

    // The *post* held this time, not the term.
    let mut holder = TestDb::shared().await.pool().get().await.expect("conn");
    diesel::sql_query("BEGIN")
        .execute(&mut holder)
        .await
        .expect("begin");
    diesel::sql_query(format!(
        "SELECT id FROM posts WHERE id = {post_id} FOR UPDATE"
    ))
    .execute(&mut holder)
    .await
    .expect("hold the post");

    let save = tokio::spawn(async move {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::content::set_post_terms(&mut conn, post_id, vec![term_id]).await
    });

    let blocked_pid = wait_for_a_blocked_backend().await;

    // A `SELECT ... FOR UPDATE` on `terms` takes a `RowShareLock` on the table
    // and keeps it for the transaction. Holding one while blocked on the post
    // is the inverted order.
    let held = granted_locks(blocked_pid, "terms", "RowShareLock").await;
    assert_eq!(
        held, 0,
        "the save must reach the post's lock before it takes any lock on terms"
    );

    diesel::sql_query("COMMIT")
        .execute(&mut holder)
        .await
        .expect("commit");
    save.await.expect("the task").expect("the save succeeds");
}

/// A term id can go stale between when a caller resolved it and when
/// `set_post_terms` actually runs — an editor's form round trip, or (the
/// case that motivated this) an import that batch-resolves every post's
/// term references up front and then assigns them one post at a time, so a
/// term deleted midway through a long-running import is still in a later
/// post's `wanted` list. `lock_terms` already tolerates a missing row for
/// locking and recounting; `set_post_terms` must not then try to insert a
/// `post_terms` row for it, which would violate the foreign key and abort
/// the whole save (and, in the batched-import case, every post still to
/// come) instead of just silently omitting that one stale reference —
/// exactly what the old unbatched per-post lookup did by finding nothing.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_term_deleted_after_resolution_is_dropped_not_a_hard_failure() {
    use diesel::prelude::*;
    use diesel_async::RunQueryDsl;

    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let post_id = create_post(&client, &cookie, "Tagged", "Body.", "publish").await;

    for slug in ["kept", "vanishes"] {
        client
            .post("/admin/terms/category")
            .header("cookie", &cookie)
            .form(&form(&[("name", slug), ("slug", slug)]))
            .send()
            .await
            .assert_status(303);
    }
    let (kept_id, vanishing_id): (i64, i64) = {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        let kept = {{crate_name}}::schema::terms::table
            .filter({{crate_name}}::schema::terms::slug.eq("kept"))
            .select({{crate_name}}::schema::terms::id)
            .first(&mut conn)
            .await
            .expect("the kept term");
        let vanishing = {{crate_name}}::schema::terms::table
            .filter({{crate_name}}::schema::terms::slug.eq("vanishes"))
            .select({{crate_name}}::schema::terms::id)
            .first(&mut conn)
            .await
            .expect("the vanishing term");
        (kept, vanishing)
    };

    // Stands in for another admin deleting the term between when a caller
    // resolved `vanishing_id` and when this save runs.
    {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        diesel::delete({{crate_name}}::schema::terms::table.filter({{crate_name}}::schema::terms::id.eq(vanishing_id)))
            .execute(&mut conn)
            .await
            .expect("delete the term out from under the save");
    }

    let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
    {{crate_name}}::content::set_post_terms(&mut conn, post_id, vec![kept_id, vanishing_id])
        .await
        .expect(
            "the save succeeds despite the stale reference, instead of failing its foreign key",
        );

    let filed: Vec<i64> = {{crate_name}}::schema::post_terms::table
        .filter({{crate_name}}::schema::post_terms::post_id.eq(post_id))
        .select({{crate_name}}::schema::post_terms::term_id)
        .load(&mut conn)
        .await
        .expect("the post's filed terms");
    assert_eq!(
        filed,
        vec![kept_id],
        "the deleted term must be silently dropped, and the still-live one still filed"
    );
}

/// The export reads every table from one snapshot.
///
/// The reads were separate repository calls, each on its own pooled connection
/// and therefore its own snapshot, so a rename landing between two of them
/// could write a page into the file under its old slug and name it as a child's
/// ancestor under the new one. A restore then cannot resolve the parent and
/// files the child at the top level.
///
/// Held here deterministically: the export is blocked part-way through by an
/// exclusive lock on `posts`, a row is committed to a table it has not read
/// yet, and the finished file must not contain it.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn the_export_reads_one_snapshot() {
    use diesel_async::RunQueryDsl;

    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    create_post(&client, &cookie, "Exported", "Body.", "publish").await;

    // `posts` is read after `terms` and before `attachments`, so locking it
    // stops the export with its snapshot already fixed.
    let mut holder = TestDb::shared().await.pool().get().await.expect("conn");
    diesel::sql_query("BEGIN")
        .execute(&mut holder)
        .await
        .expect("begin");
    diesel::sql_query("LOCK TABLE posts IN ACCESS EXCLUSIVE MODE")
        .execute(&mut holder)
        .await
        .expect("lock posts");

    let export = tokio::spawn(async move {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::content::export_snapshot(&mut conn).await
    });

    wait_for_a_blocked_backend().await;

    // Committed after the export began, into a table it has not reached.
    try_execute(
        TestDb::shared().await,
        "INSERT INTO attachments (title, slug, mime_type, byte_size, alt_text, caption)
         VALUES ('Late', 'after-the-export-began', 'image/png', 1, '', '')",
    )
    .await
    .expect("insert the late attachment");

    diesel::sql_query("COMMIT")
        .execute(&mut holder)
        .await
        .expect("commit");
    let rows = export.await.expect("the task").expect("the export");

    assert!(
        rows.attachments
            .iter()
            .all(|attachment| attachment.slug != "after-the-export-began"),
        "a row committed after the export began must not be in the file"
    );
}

/// A page cannot come back out of the trash while an ancestor is still in it.
///
/// The trash guard was one-directional: trashing a parent is refused while it
/// has a live child, but restoring a child under a trashed parent was not. So
/// trash the child, trash the parent, restore the child — and the child is a
/// live draft whose canonical URL contains a trashed ancestor, which
/// `resolve_page_path` refuses. Listings and the sitemap then advertise a URL
/// that always 404s: the same orphaned permalink, reached from the other side.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_page_cannot_leave_the_trash_under_a_trashed_ancestor() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let page = async |title: &str, parent: &str| -> String {
        let mut fields = vec![
            ("title", title),
            ("slug", ""),
            ("excerpt", ""),
            ("body", "Body."),
            ("status", "publish"),
            ("password", ""),
            ("taxonomy_names[post_tag]", ""),
        ];
        if !parent.is_empty() {
            fields.push(("parent_id", parent));
        }
        let response = client
            .post("/admin/content/page")
            .header("cookie", &cookie)
            .form(&form(&fields))
            .send()
            .await;
        assert_eq!(response.status, 303, "create: {}", response.text());
        response
            .header("location")
            .expect("redirect")
            .rsplit('/')
            .next()
            .expect("id")
            .to_owned()
    };
    let parent_id = page("Company", "").await;
    let child_id = page("Team", &parent_id).await;

    let trash = async |id: &str| {
        client
            .post(&format!("/admin/content/page/{id}/status?to=trash"))
            .header("cookie", &cookie)
            .send()
            .await
    };
    // The child first — trashing the parent while the child is live is already
    // refused, which is the guard this one is the inverse of.
    trash(&child_id).await.assert_status(303);
    trash(&parent_id).await.assert_status(303);

    // Bringing the child back now would leave it live under a trashed ancestor.
    let restored = client
        .post(&format!("/admin/content/page/{child_id}/status?to=draft"))
        .header("cookie", &cookie)
        .send()
        .await;
    assert_ne!(
        restored.status, 303,
        "restoring under a trashed ancestor must be refused, not redirected"
    );
    assert!(
        restored.text().contains("Company"),
        "and must name the ancestor to restore first:\n{}",
        restored.text()
    );

    // The order that works: the ancestor first, then the child.
    client
        .post(&format!("/admin/content/page/{parent_id}/status?to=draft"))
        .header("cookie", &cookie)
        .send()
        .await
        .assert_status(303);
    client
        .post(&format!("/admin/content/page/{child_id}/status?to=draft"))
        .header("cookie", &cookie)
        .send()
        .await
        .assert_status(303);
}

/// A file that names the trash restores a draft, not a deletion.
///
/// The exporter excludes trash, so a file carrying it was hand-edited or came
/// from another tool. Restoring straight into the trash is meaningless — a
/// backup restores content, not deletions — and `trash` is the one status whose
/// transition reaches for the page-hierarchy lock, which on the import path
/// would be taken behind the post row lock `set_post_terms` already holds.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn an_import_never_restores_into_the_trash() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;

    let payload = serde_json::json!({
        "version": 2,
        "site_title": "Imported",
        "exported_at": "2026-01-01T00:00:00Z",
        "terms": [],
        "posts": [
            {
                "post_type": "post", "title": "Deleted Elsewhere", "slug": "deleted-elsewhere",
                "excerpt": "", "body": "Body.", "status": "trash",
                "comment_status": "open", "password": "", "author": "owner",
                "published_at": null, "parent": null, "terms": []
            }
        ]
    })
    .to_string();

    import_export(&client, &cookie, payload.as_str())
        .await
        .assert_ok()
        .assert_body_contains("1 imported");

    let status: String = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::posts::table
            .filter({{crate_name}}::schema::posts::slug.eq("deleted-elsewhere"))
            .select({{crate_name}}::schema::posts::status)
            .first(&mut conn)
            .await
            .expect("the imported row")
    };
    assert_eq!(
        status, "draft",
        "a trashed row in a file must land as a visible draft"
    );
}

/// The page-hierarchy lock is taken before any post row lock.
///
/// Every create and re-parent takes the hierarchy lock and then key-shares the
/// parent row through the foreign key. Trashing did the reverse — the post row
/// `FOR UPDATE` first, the hierarchy lock only once the guard was reached — so
/// a create beneath a parent that another request was trashing left each
/// holding what the other waited for, and PostgreSQL aborted one of them.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn the_hierarchy_lock_comes_before_any_post_row_lock() {
    use diesel_async::RunQueryDsl;

    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let post_id = create_post(&client, &cookie, "Doomed", "Body.", "publish").await;

    // Another session holding the hierarchy lock, which is what a concurrent
    // create beneath a parent holds while it waits for that parent's row.
    let mut holder = TestDb::shared().await.pool().get().await.expect("conn");
    diesel::sql_query("BEGIN")
        .execute(&mut holder)
        .await
        .expect("begin");
    diesel::sql_query(format!(
        "SELECT pg_advisory_xact_lock({})",
        {{crate_name}}::content::PAGE_HIERARCHY_LOCK_KEY
    ))
    .execute(&mut holder)
    .await
    .expect("hold the hierarchy");

    let trash = tokio::spawn(async move {
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::content::transition_status(&mut conn, post_id, "trash", None, None).await
    });

    let blocked_pid = wait_for_a_blocked_backend().await;

    // `SELECT ... FOR UPDATE` on `posts` takes a `RowShareLock` on the table and
    // keeps it for the transaction. Holding one while waiting for the hierarchy
    // lock is the inverted order — the half of the cycle a create closes.
    let held = granted_locks(blocked_pid, "posts", "RowShareLock").await;
    assert_eq!(
        held, 0,
        "the trash must reach the hierarchy lock before it locks the post row"
    );

    diesel::sql_query("COMMIT")
        .execute(&mut holder)
        .await
        .expect("commit");
    trash.await.expect("the task").expect("the trash succeeds");
}

/// Poll until some backend is waiting on a lock, and return its pid.
///
/// A row-level wait shows up as an ungranted lock on the *transaction* holding
/// the row, not on the relation — filtering to relation locks finds nothing
/// however long you poll.
async fn wait_for_a_blocked_backend() -> i32 {
    use diesel_async::RunQueryDsl;

    #[derive(diesel::QueryableByName)]
    struct Pid {
        #[diesel(sql_type = diesel::sql_types::Integer)]
        pid: i32,
    }
    for _ in 0..100 {
        tokio::time::sleep(std::time::Duration::from_millis(50)).await;
        let mut probe = TestDb::shared().await.pool().get().await.expect("conn");
        let waiting: Vec<Pid> = diesel::sql_query(
            "SELECT pid FROM pg_locks WHERE NOT granted AND pid <> pg_backend_pid()",
        )
        .load(&mut probe)
        .await
        .expect("pg_locks");
        if let Some(found) = waiting.into_iter().next() {
            return found.pid;
        }
    }
    panic!("nothing blocked on a lock");
}

/// How many granted locks of `mode` a backend holds on `relation`.
async fn granted_locks(pid: i32, relation: &str, mode: &str) -> i64 {
    use diesel_async::RunQueryDsl;

    #[derive(diesel::QueryableByName)]
    struct Count {
        #[diesel(sql_type = diesel::sql_types::BigInt)]
        n: i64,
    }
    let mut probe = TestDb::shared().await.pool().get().await.expect("conn");
    let rows: Vec<Count> = diesel::sql_query(format!(
        "SELECT count(*) AS n
         FROM pg_locks l JOIN pg_class c ON c.oid = l.relation
         WHERE l.pid = {pid} AND l.granted
           AND c.relname = '{relation}' AND l.mode = '{mode}'"
    ))
    .load(&mut probe)
    .await
    .expect("pg_locks");
    rows.into_iter().next().map_or(0, |row| row.n)
}

/// A comment the page cannot render is refused rather than anchored.
///
/// A page is capped at `MAX_THREAD_COMMENTS`, so on a thread past the cap a new
/// reply can belong to a page with no room left for it. Redirecting to
/// `#comment-<id>` for a comment that is not on the page it lands on is a
/// broken promise, and accepting it counts a comment no reader can reach; the
/// write path refuses it with a 422.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_comment_the_page_cannot_render_is_not_anchored() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let post_id = create_post(&client, &cookie, "Overfull", "Body.", "publish").await;

    try_execute(
        TestDb::shared().await,
        &format!(
            "INSERT INTO comments (post_id, parent_id, author_id, author_name, author_email,
                                   author_url, author_ip, body, status, created_at)
             VALUES ({post_id}, NULL, 1, 'Owner', 'owner@example.com', '', '',
                     'The root', 'approved', NOW())"
        ),
    )
    .await
    .expect("seed the root");
    try_execute(
        TestDb::shared().await,
        &format!(
            "INSERT INTO comments (post_id, parent_id, author_id, author_name, author_email,
                                   author_url, author_ip, body, status, created_at)
             SELECT {post_id}, (SELECT id FROM comments WHERE body = 'The root'),
                    1, 'Owner', 'owner@example.com', '', '',
                    'Reply ' || lpad(g::text, 5, '0'), 'approved',
                    NOW() - ((2000 - g) || ' seconds')::interval
             FROM generate_series(1, 1500) AS g"
        ),
    )
    .await
    .expect("seed the replies");

    // A signed-in reply is approved immediately, and it is the newest comment
    // on a page that is already full — so it is exactly what truncation drops,
    // which takes the oldest rows first.
    let root_id: i64 = {
        use diesel::prelude::*;
        use diesel_async::RunQueryDsl;
        let mut conn = TestDb::shared().await.pool().get().await.expect("conn");
        {{crate_name}}::schema::comments::table
            .filter({{crate_name}}::schema::comments::body.eq("The root"))
            .select({{crate_name}}::schema::comments::id)
            .first(&mut conn)
            .await
            .expect("the root")
    };
    let posted = client
        .post(&format!("/comments/{post_id}"))
        .header("cookie", &cookie)
        .form(&form(&[
            ("body", "One reply too many"),
            ("reply_to", &root_id.to_string()),
        ]))
        .send()
        .await;
    // Accepting it would count a comment no reader can reach, and redirect to
    // an anchor the page does not render. The write path refuses instead, so
    // there is no such comment to promise an anchor for.
    posted
        .assert_status(422)
        .assert_body_contains("This conversation has reached its display limit");
}

/// A comment URL survives the one permalink structure that is already a query.
///
/// `Plain` renders `/?p=123`, so appending `?comments=2` produced
/// `/?p=123?comments=2` — one parameter named `p` whose value is
/// `123?comments=2`, which does not parse as the `i64` the handler declares. On
/// that structure every pager link and the post-a-comment redirect landed on a
/// page that could not find the post.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn comment_urls_survive_the_plain_permalink_structure() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let post_id = create_post(&client, &cookie, "Plain Thread", "Body.", "publish").await;

    client
        .post("/admin/settings")
        .header("cookie", &cookie)
        .form(&settings_form(&[("permalink_structure", "plain")]))
        .send()
        .await
        .assert_status(303);

    // More than one page of roots, so a pager renders at all.
    try_execute(
        TestDb::shared().await,
        &format!(
            "INSERT INTO comments (post_id, parent_id, author_id, author_name, author_email,
                                   author_url, author_ip, body, status, created_at)
             SELECT {post_id}, NULL, 1, 'Owner', 'owner@example.com', '', '',
                    'Plain ' || lpad(g::text, 3, '0'), 'approved',
                    NOW() - ((100 - g) || ' minutes')::interval
             FROM generate_series(1, 60) AS g"
        ),
    )
    .await
    .expect("seed the roots");

    let first = client.get(&format!("/?p={post_id}")).send().await;
    let html = first.assert_ok().text();
    // maud escapes the ampersand for HTML; the browser sends `&`.
    assert!(
        html.contains(&format!("/?p={post_id}&amp;comments=2")),
        "the pager must extend the existing query, not start a second one:\n{html}"
    );

    // And the URL it minted actually resolves to page two of this post.
    let second = client
        .get(&format!("/?p={post_id}&comments=2"))
        .send()
        .await;
    second
        .assert_ok()
        .assert_body_contains("Plain 060")
        .assert_body_contains("Page 2 of 2");

    // The redirect the comment form issues is built the same way, and the held
    // banner it promises is rendered on arrival.
    client
        .post("/admin/settings")
        .header("cookie", &cookie)
        .form(&settings_form(&[
            ("permalink_structure", "plain"),
            ("comment_moderation", "on"),
        ]))
        .send()
        .await
        .assert_status(303);
    sign_out(&client);
    let posted = client
        .post(&format!("/comments/{post_id}"))
        .form(&form(&[
            ("body", "A guest comment"),
            ("author_name", "Guest"),
            ("author_email", "guest@example.com"),
        ]))
        .send()
        .await;
    let location = posted
        .assert_status(303)
        .header("location")
        .expect("a redirect");
    assert_eq!(
        location,
        format!("/?p={post_id}&moderated=1"),
        "the marker must be a second parameter, not part of `p`"
    );
    client
        .get(location)
        .send()
        .await
        .assert_ok()
        .assert_body_contains("awaiting moderation");
}

/// A new comment lands on the page of the thread that actually holds it.
///
/// The redirect always targeted the unpaginated permalink, so once a post had
/// more than one page of roots the commenter was dropped on page one with an
/// `#comment-<id>` anchor for a comment that is not there — indistinguishable
/// from a comment that was silently thrown away.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_new_comment_redirects_to_the_page_that_holds_it() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let post_id = create_post(&client, &cookie, "Deep Thread", "Body.", "publish").await;

    // Exactly one full page of roots, so the next root starts page two.
    try_execute(
        TestDb::shared().await,
        &format!(
            "INSERT INTO comments (post_id, parent_id, author_id, author_name, author_email,
                                   author_url, author_ip, body, status, created_at)
             SELECT {post_id}, NULL, 1, 'Owner', 'owner@example.com', '', '',
                    'Seed ' || lpad(g::text, 3, '0'), 'approved',
                    NOW() - ((100 - g) || ' minutes')::interval
             FROM generate_series(1, 50) AS g"
        ),
    )
    .await
    .expect("seed a full page of roots");

    // A signed-in comment is approved immediately, so it is the 51st root.
    let posted = client
        .post(&format!("/comments/{post_id}"))
        .header("cookie", &cookie)
        .form(&form(&[("body", "The fifty-first root")]))
        .send()
        .await;
    let location = posted
        .assert_status(303)
        .header("location")
        .expect("a redirect");
    assert!(
        location.contains("comments=2"),
        "a root past the first page belongs on page two: {location}"
    );
    let anchor = location
        .rsplit_once('#')
        .expect("an anchor to the new comment")
        .1
        .to_owned();
    // The promise the anchor makes has to hold on the page it points at.
    let landed = client.get(location).send().await;
    let html = landed.assert_ok().text();
    assert!(
        html.contains(&format!("id=\"{anchor}\"")),
        "the anchor must exist on the page the redirect chose:\n{html}"
    );

    // A reply travels with its root, so it belongs on the root's page too —
    // even though the reply itself is the newest comment on the post.
    let reply = client
        .post(&format!("/comments/{post_id}"))
        .header("cookie", &cookie)
        .form(&form(&[
            ("body", "A reply to the first root"),
            ("reply_to", "1"),
        ]))
        .send()
        .await;
    let reply_location = reply
        .assert_status(303)
        .header("location")
        .expect("a redirect");
    assert!(
        !reply_location.contains("comments="),
        "a reply to a root on page one belongs on page one: {reply_location}"
    );
}

/// One popular root cannot make a public page view unbounded.
///
/// Pagination bounds the roots and the write path bounds the nesting, but
/// neither bounds breadth: every approved descendant of the fifty roots on a
/// page was loaded with no row limit, so a single root with a hundred thousand
/// replies made an ordinary post request transfer, resolve authors for and
/// render all of them.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn one_popular_root_cannot_unbound_a_comment_page() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let post_id = create_post(&client, &cookie, "Popular", "Body.", "publish").await;

    try_execute(
        TestDb::shared().await,
        &format!(
            "INSERT INTO comments (post_id, parent_id, author_id, author_name, author_email,
                                   author_url, author_ip, body, status, created_at)
             VALUES ({post_id}, NULL, 1, 'Owner', 'owner@example.com', '', '',
                     'The root', 'approved', NOW())"
        ),
    )
    .await
    .expect("seed the root");
    // Comfortably past `MAX_THREAD_COMMENTS`, all one level down so the depth
    // cap has nothing to say about them.
    try_execute(
        TestDb::shared().await,
        &format!(
            "INSERT INTO comments (post_id, parent_id, author_id, author_name, author_email,
                                   author_url, author_ip, body, status, created_at)
             SELECT {post_id}, (SELECT id FROM comments WHERE body = 'The root'),
                    1, 'Owner', 'owner@example.com', '', '',
                    'Reply ' || lpad(g::text, 5, '0'), 'approved',
                    NOW() + (g || ' seconds')::interval
             FROM generate_series(1, 2500) AS g"
        ),
    )
    .await
    .expect("seed the replies");

    sign_out(&client);
    let page = client.get("/popular").send().await;
    let html = page.assert_ok().text();
    let rendered = html.matches("id=\"comment-").count();
    assert!(
        rendered <= 1000,
        "a page must stay bounded whatever one root collects, rendered {rendered}"
    );
    assert!(
        html.contains("some replies are not shown"),
        "and must say so rather than pretending the thread is complete:\n{}",
        &html[..html.len().min(4000)]
    );
    // The tree still assembles: what is dropped is the tail, never a parent.
    assert!(
        html.contains("The root") && html.contains("Reply 00001"),
        "the oldest replies are the ones kept"
    );
}

/// Every approved comment is reachable, however long the thread gets.
///
/// The thread loaded a flat window of the oldest 200, so once a post passed
/// that, every later comment was permanently invisible: no page to turn to, and
/// a signed-in commenter redirected to an anchor that was not on the page they
/// landed on. Taking the newest 200 instead would have detached replies whose
/// roots fell off the front, so the window is a page of *roots* and every reply
/// travels with the root it belongs to.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn every_approved_comment_stays_reachable() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let post_id = create_post(&client, &cookie, "Busy Thread", "Body.", "publish").await;

    // 60 roots, more than one page, plus a reply on the last one — which is the
    // comment a flat oldest-first window loses first.
    try_execute(
        TestDb::shared().await,
        &format!(
            "INSERT INTO comments (post_id, parent_id, author_id, author_name, author_email,
                                   author_url, author_ip, body, status, created_at)
             SELECT {post_id}, NULL, 1, 'Owner', 'owner@example.com', '', '',
                    'Root ' || lpad(g::text, 3, '0'), 'approved',
                    NOW() - ((100 - g) || ' minutes')::interval
             FROM generate_series(1, 60) AS g"
        ),
    )
    .await
    .expect("seed the roots");
    try_execute(
        TestDb::shared().await,
        &format!(
            "INSERT INTO comments (post_id, parent_id, author_id, author_name, author_email,
                                   author_url, author_ip, body, status, created_at)
             SELECT {post_id},
                    (SELECT id FROM comments WHERE body = 'Root 060'),
                    1, 'Owner', 'owner@example.com', '', '',
                    'A late reply', 'approved', NOW()"
        ),
    )
    .await
    .expect("seed the reply");

    sign_out(&client);
    let first = client.get("/busy-thread").send().await;
    first.assert_ok();
    let first = first.text();
    assert!(
        first.contains("Root 001"),
        "the first page starts at the top"
    );
    assert!(
        !first.contains("Root 060"),
        "and stops at the page size rather than the whole thread"
    );
    assert!(first.contains("Page 1 of 2"), "with a pager:\n{first}");

    // The later roots are reachable, and the reply came with its root rather
    // than being stranded.
    let second = client.get("/busy-thread?comments=2").send().await;
    second.assert_ok();
    let second = second.text();
    assert!(second.contains("Root 060"), "the tail is reachable");
    assert!(
        second.contains("A late reply"),
        "and a reply renders on the page its root is on:\n{second}"
    );
    assert!(!second.contains("Root 001"), "page two is not page one");
}

/// A visitor's comment must not read as a finished import.
///
/// `import_comments` used to skip the whole backup thread when the post
/// already had *any* comment — so a crash (or a concurrent visitor) between
/// the status transition committing and the comment import running made the
/// retry drop the backup's discussion and mark the post complete. Completion
/// is now a dedicated marker written in the same transaction as the rows, and
/// only the marker skips the import.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn import_comments_ignores_unrelated_existing_comments() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let post_id = create_post(&client, &cookie, "Thread", "Body.", "publish").await;
    let mut conn = TestDb::shared().await.pool().get().await.expect("conn");

    // A visitor comment that has nothing to do with the backup.
    {{crate_name}}::content::create_comment(
        &mut conn,
        {{crate_name}}::models::NewComment {
            post_id,
            parent_id: None,
            author_id: None,
            author_name: "Visitor".to_owned(),
            author_email: "visitor@example.com".to_owned(),
            author_url: String::new(),
            author_ip: String::new(),
            body: "Unrelated visitor comment".to_owned(),
            status: "approved".to_owned(),
        },
        "",
    )
    .await
    .expect("visitor comment");

    let incoming = vec![{{crate_name}}::content::ImportedComment {
        author_username: None,
        author_name: "Archivist".to_owned(),
        author_email: "archivist@example.com".to_owned(),
        author_url: String::new(),
        body: "From the backup".to_owned(),
        status: "approved".to_owned(),
        created_at: chrono::NaiveDate::from_ymd_opt(2024, 1, 15)
            .expect("date")
            .and_hms_opt(12, 0, 0)
            .expect("time"),
        replies: vec![],
    }];

    // The backup's discussion still imports — one row, not zero.
    let created = {{crate_name}}::content::import_comments(&mut conn, post_id, &incoming)
        .await
        .expect("import");
    assert_eq!(created, 1, "the backup's thread must not be dropped");

    // And the retry is still safe: the marker — not the count — skips it, so
    // no second copy is appended.
    let again = {{crate_name}}::content::import_comments(&mut conn, post_id, &incoming)
        .await
        .expect("retry");
    assert_eq!(again, 0, "a re-run must not append a second copy");
}

/// Create a page through the admin editor and return its id.
async fn create_page(client: &TestClient, cookie: &str, title: &str) -> i64 {
    let resp = client
        .post("/admin/content/page")
        .header("cookie", cookie)
        .form(&form(&[
            ("title", title),
            ("slug", ""),
            ("excerpt", ""),
            ("body", "Body."),
            ("status", "publish"),
            ("password", ""),
        ]))
        .send()
        .await;
    assert_eq!(resp.status, 303, "create should redirect: {}", resp.text());
    resp.header("location")
        .expect("redirect to the editor")
        .rsplit('/')
        .next()
        .expect("id is the last path segment")
        .parse()
        .expect("id is numeric")
}

/// A refused parent is a skipped link; a failed check is a failed import.
///
/// `set_post_parent` used to treat *any* `validate_parent` error as an
/// expected refusal and return `Ok(false)` — so an operational failure (a
/// query error, a timeout) read as a deliberate orphaning, and the import
/// marked the page complete at the top level instead of failing and staying
/// resumable. Refusals still return `Ok(false)`; the failure half of the
/// distinction is pinned without a database by
/// `content::parent_check_tests`.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn set_post_parent_distinguishes_refusal_from_failure() {
    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let parent = create_page(&client, &cookie, "Parent").await;
    let child = create_page(&client, &cookie, "Child").await;
    let mut conn = TestDb::shared().await.pool().get().await.expect("conn");

    // A good link applies.
    assert!(
        {{crate_name}}::content::set_post_parent(&mut conn, child, parent)
            .await
            .expect("a valid link applies"),
        "the link must be applied"
    );

    // A cycle is an expected refusal: Ok(false), not an error.
    assert!(
        !{{crate_name}}::content::set_post_parent(&mut conn, parent, child)
            .await
            .expect("a refusal is not an error"),
        "a cycle must decline the link, not fail the import"
    );

    // A parent that does not exist is an expected refusal too.
    assert!(
        !{{crate_name}}::content::set_post_parent(&mut conn, child, 999_999_999)
            .await
            .expect("a refusal is not an error"),
        "a missing parent must decline the link, not fail the import"
    );
}

/// A reply past the thread's display budget is refused, not silently dropped.
///
/// `approved_thread_page` caps a page at `MAX_THREAD_COMMENTS`, keeping the
/// oldest rows where the budget runs out — so an accepted reply past the cap
/// was counted in `comment_count` but appeared on no page. The write path now
/// refuses it, and moderation refuses to approve one, under the post's lock.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn a_reply_past_the_display_budget_is_refused() {
    use {{crate_name}}::schema::comments;
    use diesel::prelude::*;
    use diesel_async::RunQueryDsl;

    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let post_id = create_post(&client, &cookie, "Crowded", "Body.", "publish").await;
    let mut conn = TestDb::shared().await.pool().get().await.expect("conn");

    // One root, then enough approved children to fill the page's budget: the
    // root takes one slot of `MAX_THREAD_COMMENTS`, so 999 children fill it
    // and the thousandth reply has no renderable window.
    let root_id: i64 = diesel::insert_into(comments::table)
        .values((
            comments::post_id.eq(post_id),
            comments::parent_id.eq(None::<i64>),
            comments::author_id.eq(None::<i64>),
            comments::author_name.eq("Crowd"),
            comments::author_email.eq("crowd@example.com"),
            comments::author_url.eq(""),
            comments::author_ip.eq(""),
            comments::body.eq("Root"),
            comments::status.eq("approved"),
        ))
        .returning(comments::id)
        .get_result(&mut conn)
        .await
        .expect("seed root");
    let children: Vec<_> = (0..999)
        .map(|i| {
            (
                comments::post_id.eq(post_id),
                comments::parent_id.eq(Some(root_id)),
                comments::author_id.eq(None::<i64>),
                comments::author_name.eq("Crowd"),
                comments::author_email.eq("crowd@example.com"),
                comments::author_url.eq(""),
                comments::author_ip.eq(""),
                comments::body.eq(format!("Child {i}")),
                comments::status.eq("approved"),
            )
        })
        .collect();
    diesel::insert_into(comments::table)
        .values(&children)
        .execute(&mut conn)
        .await
        .expect("seed children");

    let refused = {{crate_name}}::content::create_comment(
        &mut conn,
        {{crate_name}}::models::NewComment {
            post_id,
            parent_id: Some(root_id),
            author_id: None,
            author_name: "Latecomer".to_owned(),
            author_email: "late@example.com".to_owned(),
            author_url: String::new(),
            author_ip: String::new(),
            body: "One too many".to_owned(),
            status: "approved".to_owned(),
        },
        "",
    )
    .await;
    assert!(
        refused.is_err(),
        "a reply past the display budget must be refused, not accepted and left unreadable"
    );

    // Approving a pending reply onto the same full thread is refused too.
    let pending_id: i64 = diesel::insert_into(comments::table)
        .values((
            comments::post_id.eq(post_id),
            comments::parent_id.eq(Some(root_id)),
            comments::author_id.eq(None::<i64>),
            comments::author_name.eq("Waiting"),
            comments::author_email.eq("waiting@example.com"),
            comments::author_url.eq(""),
            comments::author_ip.eq(""),
            comments::body.eq("Pending past the budget"),
            comments::status.eq("pending"),
        ))
        .returning(comments::id)
        .get_result(&mut conn)
        .await
        .expect("seed pending");
    let approval = {{crate_name}}::content::moderate_comment(&mut conn, pending_id, "approved").await;
    assert!(
        approval.is_err(),
        "approving a reply with no renderable window must be refused"
    );
}

/// The moderation queue pages, and the pager keeps the selected queue.
///
/// 51 pending comments spill onto a second page. The first page links to the
/// second with the status preserved; a stale far-future page clamps to the
/// last page instead of rendering an empty one.
#[tokio::test]
#[ignore = "requires Docker (testcontainers)"]
async fn moderation_queue_renders_a_pager() {
    use {{crate_name}}::schema::comments;
    use diesel::prelude::*;
    use diesel_async::RunQueryDsl;

    let client = db_client().await;
    let cookie = register(&client, "owner").await;
    let post_id = create_post(&client, &cookie, "Flood", "Body.", "publish").await;
    let mut conn = TestDb::shared().await.pool().get().await.expect("conn");

    let pending: Vec<_> = (0..51)
        .map(|i| {
            (
                comments::post_id.eq(post_id),
                comments::parent_id.eq(None::<i64>),
                comments::author_id.eq(None::<i64>),
                comments::author_name.eq("Spammer"),
                comments::author_email.eq("spam@example.com"),
                comments::author_url.eq(""),
                comments::author_ip.eq(""),
                comments::body.eq(format!("Spam {i}")),
                comments::status.eq("pending"),
            )
        })
        .collect();
    diesel::insert_into(comments::table)
        .values(&pending)
        .execute(&mut conn)
        .await
        .expect("seed queue");

    let first = client
        .get("/admin/comments?status=pending")
        .header("cookie", &cookie)
        .send()
        .await;
    first
        .assert_ok()
        .assert_body_contains("Page 1 of 2")
        .assert_body_contains("/admin/comments?status=pending&amp;page=2");

    // A stale bookmark past the end clamps to the last page.
    let stale = client
        .get("/admin/comments?status=pending&page=99")
        .header("cookie", &cookie)
        .send()
        .await;
    stale
        .assert_ok()
        .assert_body_contains("Page 2 of 2")
        .assert_body_contains("/admin/comments?status=pending&amp;page=1");
}