trusty-console 0.12.2

//! Integration tests for `server::build_router` / `build_router_with_self_origins`.
//!
//! Why: split out of `server/mod.rs` (was `server.rs`) to stay under the repo's
//! 500-SLOC production-file cap after the #3268/#3269 same-origin-guard tests
//! pushed the combined prod+test file over its grandfathered budget. This module
//! is classified as a test file (basename `tests.rs`) under the 1500-SLOC
//! test-file cap, so it has ample headroom.
//! What: axum test-client integration tests exercising the router end-to-end
//! (routes, proxy allowlist, and the write-origin guard) without a real TCP
//! listener.
//! Test: this module IS the test suite for `server/mod.rs`.

use super::*;
// #6285: `body::Body` left `server/mod.rs` with the SPA handlers.
use axum::body::Body;
use axum::http::header::CONTENT_TYPE;
use axum::http::{Request, StatusCode};
use http_body_util::BodyExt;
use tower::ServiceExt;

use crate::connector::{ServiceInfo, ServiceStatus};

/// A stub connector for tests — always returns a fixed `ServiceInfo`.
struct StubConnector {
    id: &'static str,
    display_name: &'static str,
    status: ServiceStatus,
}

impl ServiceConnector for StubConnector {
    fn id(&self) -> &'static str {
        self.id
    }
    fn display_name(&self) -> &'static str {
        self.display_name
    }
    fn detect(&self) -> ServiceInfo {
        ServiceInfo {
            id: self.id.to_string(),
            display_name: self.display_name.to_string(),
            status: self.status.clone(),
            version: None,
            url: None,
            hint: None,
            lifecycle: self.lifecycle(),
            cpu_pct: None,
            rss_bytes: None,
        }
    }
}

fn make_test_state() -> AppState {
    AppState::new(vec![
        Box::new(StubConnector {
            id: "trusty-search",
            display_name: "Trusty Search",
            status: ServiceStatus::Running,
        }),
        Box::new(StubConnector {
            id: "trusty-memory",
            display_name: "Trusty Memory",
            status: ServiceStatus::Available,
        }),
        Box::new(StubConnector {
            id: "trusty-analyze",
            display_name: "Trusty Analyze",
            status: ServiceStatus::Absent,
        }),
    ])
}

async fn get_bytes(resp: axum::http::Response<Body>) -> Vec<u8> {
    resp.into_body()
        .collect()
        .await
        .expect("collect body")
        .to_bytes()
        .to_vec()
}

/// Why: the services route must return a valid JSON array with one entry
/// per connector, each containing `id`, `display_name`, and `status`.
/// What: builds the router with stub connectors, issues GET
/// /api/console/services, parses the response.
/// Test: this test itself.
#[tokio::test]
async fn test_services_route_returns_json() {
    let router = build_router(make_test_state());

    let req = Request::builder()
        .uri("/api/console/services")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    assert_eq!(resp.status(), StatusCode::OK);

    let bytes = get_bytes(resp).await;
    let body: Vec<serde_json::Value> = serde_json::from_slice(&bytes).expect("parse json");
    assert_eq!(body.len(), 3);

    assert_eq!(body[0]["id"], "trusty-search");
    assert_eq!(body[0]["status"], "running");
    assert_eq!(body[0]["display_name"], "Trusty Search");

    assert_eq!(body[1]["id"], "trusty-memory");
    assert_eq!(body[1]["status"], "available");

    assert_eq!(body[2]["id"], "trusty-analyze");
    assert_eq!(body[2]["status"], "absent");
}

/// REGRESSION (#6908): `GET /api/console/services` must carry the console's own
/// row, through the same generic path every other member uses.
///
/// Why it goes through the ROUTE with the REAL roster rather than asserting on
/// `all_connectors()`: the roster test next door proves registration, and would
/// still pass if the handler filtered the row back out or the sort dropped it.
/// What the operator sees is the response body, so that is what this reads.
/// Against `origin/main` there is no `trusty-console` entry at all and the
/// `find` below returns `None`.
///
/// Why nothing here is asserted about CPU, RSS or the other six rows: this
/// state has no sampler running, and the six real connectors probe a machine
/// whose daemons this test does not control. The console row is the one whose
/// every asserted field is decided by this process.
/// What: builds the router over `detect::all_connectors()`, issues the request,
/// and asserts the `trusty-console` entry exists with the status, lifecycle and
/// version the connector promises.
/// Test: this test itself.
#[tokio::test]
async fn services_route_lists_the_console_itself() {
    let router = build_router(AppState::new(crate::detect::all_connectors()));

    let req = Request::builder()
        .uri("/api/console/services")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    assert_eq!(resp.status(), StatusCode::OK);

    let bytes = get_bytes(resp).await;
    let body: Vec<serde_json::Value> = serde_json::from_slice(&bytes).expect("parse json");

    let console = body
        .iter()
        .find(|s| s["id"] == "trusty-console")
        .unwrap_or_else(|| {
            panic!("the services response must carry the console's own row; got: {body:?}")
        });
    assert_eq!(console["display_name"], "Trusty Console");
    assert_eq!(
        console["status"], "running",
        "the console can only answer this request while it is running"
    );
    assert_eq!(console["lifecycle"], "daemon");
    assert_eq!(console["version"], env!("CARGO_PKG_VERSION"));
}

/// Why: #6370 — the Overview grid renders the array in response order, so the
/// route must lead with the services that are live rather than with whichever
/// connector `all_connectors()` happens to register first. This test fails on
/// the pre-#6370 handler, which returned registration order untouched.
/// What: registers three connectors in the WORST order (absent, available,
/// running), issues GET /api/console/services, asserts the response inverts it.
/// Test: this test itself.
#[tokio::test]
async fn test_services_route_orders_running_before_absent() {
    let state = AppState::new(vec![
        Box::new(StubConnector {
            id: "trusty-analyze",
            display_name: "Trusty Analyze",
            status: ServiceStatus::Absent,
        }),
        Box::new(StubConnector {
            id: "trusty-memory",
            display_name: "Trusty Memory",
            status: ServiceStatus::Available,
        }),
        Box::new(StubConnector {
            id: "trusty-search",
            display_name: "Trusty Search",
            status: ServiceStatus::Running,
        }),
    ]);

    let router = build_router(state);
    let req = Request::builder()
        .uri("/api/console/services")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    assert_eq!(resp.status(), StatusCode::OK);

    let bytes = get_bytes(resp).await;
    let body: Vec<serde_json::Value> = serde_json::from_slice(&bytes).expect("parse json");
    let ids: Vec<&str> = body.iter().map(|s| s["id"].as_str().unwrap()).collect();
    assert_eq!(
        ids,
        vec!["trusty-search", "trusty-memory", "trusty-analyze"],
        "running must lead, absent must trail; got {body:?}"
    );
}

/// Why: health endpoint must return 200 with `status: ok`.
/// What: issues GET /health and checks the JSON body.
/// Test: this test itself.
#[tokio::test]
async fn test_health_route() {
    let router = build_router(make_test_state());

    let req = Request::builder()
        .uri("/health")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    assert_eq!(resp.status(), StatusCode::OK);

    let bytes = get_bytes(resp).await;
    let body: serde_json::Value = serde_json::from_slice(&bytes).expect("parse json");
    assert_eq!(body["status"], "ok");
    assert!(body["version"].is_string());
    // #6908: the console's own details pane reads its uptime from here.
    assert!(
        body["uptime_secs"].is_u64(),
        "health must report uptime_secs: {body}"
    );
}

/// Why: the details pane renders "how long has the console been up", so a
/// constant or a value that resets per request would be a lie the operator
/// cannot detect. The field must count forward from when the state was built.
/// What: builds one state, reads `/health` twice around a short sleep, and
/// asserts the second reading is not behind the first — whole seconds, so the
/// two may legitimately be equal.
/// Test: this test itself.
#[tokio::test]
async fn health_uptime_is_monotonic() {
    async fn read(router: axum::Router) -> u64 {
        let req = Request::builder()
            .uri("/health")
            .body(Body::empty())
            .expect("request");
        let resp = router.oneshot(req).await.expect("response");
        let bytes = get_bytes(resp).await;
        let body: serde_json::Value = serde_json::from_slice(&bytes).expect("parse json");
        body["uptime_secs"].as_u64().expect("uptime_secs")
    }

    let router = build_router(make_test_state());
    let first = read(router.clone()).await;
    tokio::time::sleep(std::time::Duration::from_millis(50)).await;
    let second = read(router).await;
    assert!(
        second >= first,
        "uptime went backwards: {first} -> {second}"
    );
}

/// Why: the services route must serialise `Degraded` status and the
/// `hint` field correctly so the UI can render a distinct badge.
/// What: builds the router with a Degraded stub connector, issues GET
/// /api/console/services, asserts `status == "degraded"` and `hint` present.
/// Test: this test itself.
#[tokio::test]
async fn test_services_route_returns_degraded_with_hint() {
    use crate::connector::ServiceInfo;
    struct DegradedConnector;
    impl ServiceConnector for DegradedConnector {
        fn id(&self) -> &'static str {
            "trusty-analyze"
        }
        fn display_name(&self) -> &'static str {
            "Trusty Analyze"
        }
        fn detect(&self) -> ServiceInfo {
            ServiceInfo {
                id: "trusty-analyze".to_string(),
                display_name: "Trusty Analyze".to_string(),
                status: ServiceStatus::Degraded,
                version: None,
                url: None,
                hint: Some("reachable but `console_metrics` tool not registered".to_string()),
                lifecycle: self.lifecycle(),
                cpu_pct: None,
                rss_bytes: None,
            }
        }
    }
    let state = AppState::new(vec![Box::new(DegradedConnector)]);
    let router = build_router(state);
    let req = Request::builder()
        .uri("/api/console/services")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    assert_eq!(resp.status(), StatusCode::OK);
    let bytes = get_bytes(resp).await;
    let body: Vec<serde_json::Value> = serde_json::from_slice(&bytes).expect("parse json");
    assert_eq!(body.len(), 1);
    assert_eq!(body[0]["status"], "degraded");
    assert!(
        body[0].get("hint").is_some(),
        "degraded service must include hint field"
    );
    assert!(
        body[0]["hint"]
            .as_str()
            .unwrap_or("")
            .contains("console_metrics"),
        "hint must mention console_metrics"
    );
}

/// Why: the root path must serve the embedded HTML (or placeholder).
/// What: issues GET / and asserts 200 + text/html content-type.
/// Test: this test itself.
#[tokio::test]
async fn test_spa_root_returns_html() {
    let router = build_router(make_test_state());

    let req = Request::builder()
        .uri("/")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    assert_eq!(resp.status(), StatusCode::OK);

    let ct = resp
        .headers()
        .get(CONTENT_TYPE)
        .and_then(|v| v.to_str().ok())
        .unwrap_or("")
        .to_string();
    assert!(ct.contains("text/html"), "expected text/html, got: {ct}");
}

/// Why: the phase-4 `.saver` bundle (#6520) loads the screensaver by URL and
/// has no way to report a 404 — a blank WKWebView is all the operator sees. The
/// two spellings reach the shell by different mechanisms (`/ui/screensaver`
/// through the wildcard's SPA fallback, `/screensaver` through its own route),
/// so both are asserted rather than assumed.
/// What: issues GET on each and asserts 200 + text/html.
/// Test: this test itself.
#[tokio::test]
async fn test_screensaver_paths_return_spa_shell() {
    for uri in ["/ui/screensaver", "/screensaver"] {
        let router = build_router(make_test_state());
        let req = Request::builder()
            .uri(uri)
            .body(Body::empty())
            .expect("request");
        let resp = router.oneshot(req).await.expect("response");
        assert_eq!(resp.status(), StatusCode::OK, "{uri} must serve the shell");

        let ct = resp
            .headers()
            .get(CONTENT_TYPE)
            .and_then(|v| v.to_str().ok())
            .unwrap_or("")
            .to_string();
        assert!(
            ct.contains("text/html"),
            "{uri}: expected text/html, got: {ct}"
        );
    }
}

/// A connector whose `detect()` always panics — simulates a buggy plugin.
struct PanicConnector;

impl ServiceConnector for PanicConnector {
    fn id(&self) -> &'static str {
        "panic-svc"
    }
    fn display_name(&self) -> &'static str {
        "Panic Service"
    }
    fn detect(&self) -> ServiceInfo {
        panic!("intentional test panic from PanicConnector");
    }
}

/// Why: a panicking connector must not silently return HTTP 200 with an
/// empty list — that is indistinguishable from "no services installed".
/// The handler must return HTTP 500 so the UI can display an error state.
/// What: builds the router with a PanicConnector, issues GET
/// /api/console/services, asserts the response status is 500.
/// Test: this test itself.
#[tokio::test]
async fn test_services_handler_returns_500_on_panic() {
    let state = AppState::new(vec![Box::new(PanicConnector)]);
    let router = build_router(state);

    let req = Request::builder()
        .uri("/api/console/services")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    assert_eq!(resp.status(), StatusCode::INTERNAL_SERVER_ERROR);
}

/// Why: with an empty metrics cache the route must return 503 so the UI
/// can show a "not yet available" state rather than empty JSON.
/// What: issues GET /api/console/metrics/analyze on a fresh state,
/// asserts 503.
/// Test: this test itself.
#[tokio::test]
async fn test_metrics_analyze_route_cold_cache_returns_503() {
    let router = build_router(make_test_state());
    let req = Request::builder()
        .uri("/api/console/metrics/analyze")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    assert_eq!(resp.status(), StatusCode::SERVICE_UNAVAILABLE);
}

/// Why: the `/api/{service}/*` proxy route for an unknown service key must
/// return 400 (not a 404 route-miss, since the route pattern matches but the
/// handler rejects the key).
/// What: issues GET /api/unknown/health on the new primary path, asserts 400.
/// Test: this test itself.
#[tokio::test]
async fn test_api_proxy_unknown_service_returns_400() {
    let router = build_router(make_test_state());

    let req = Request::builder()
        .uri("/api/unknown/health")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    assert_eq!(resp.status(), StatusCode::BAD_REQUEST);
}

/// Why: the `/api/{service}/*` route for a known service that is not running
/// must return 503 (cache cold) — proves the route reaches the proxy handler.
/// What: issues GET /api/review/health on a fresh state (no poll), asserts 503
/// SERVICE_UNAVAILABLE. `review` rather than `search` since #6285: search left
/// the proxy allowlist for its own socket-backed route, so it can no longer
/// exercise the cold-cache arm.
/// Test: this test itself (#1849 Phase 2 primary path).
#[tokio::test]
async fn test_api_proxy_known_service_cold_cache_returns_503() {
    let router = build_router(make_test_state());

    let req = Request::builder()
        .uri("/api/review/health")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    assert_eq!(resp.status(), StatusCode::SERVICE_UNAVAILABLE);
}

/// Why: `mpm` must be reachable via the new `/api/mpm/*` path and must NOT
/// return 400 (key absent from allowlist).
/// What: issues GET /api/mpm/health on a fresh state (no poll),
/// asserts 503 SERVICE_UNAVAILABLE (not 400 BAD_REQUEST).
/// Test: this test itself (#1849 Phase 2).
#[tokio::test]
async fn test_api_proxy_mpm_is_in_allowlist_cold_cache_returns_503() {
    let router = build_router(make_test_state());

    let req = Request::builder()
        .uri("/api/mpm/health")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    assert_eq!(
        resp.status(),
        StatusCode::SERVICE_UNAVAILABLE,
        "/api/mpm/health must return 503 (mpm in allowlist, cache cold), not 400"
    );
}

/// Why: the deprecated `/proxy/{daemon}/*` alias must still route to the
/// proxy handler; removing it would break external callers mid-migration.
/// What: issues GET /proxy/review/health on the deprecated path, asserts 503
/// (cache cold, not 404 route-miss or 400 key-rejected). `review` rather than
/// `search` since #6285 — `/proxy/search/*` now has its own literal route to
/// the socket bridge, covered by `deprecated_alias_reaches_the_same_handler` in
/// `tests/search_uds_bridge.rs`.
/// Test: this test itself (backward-compat guard for #1849 Phase 2).
#[tokio::test]
async fn test_deprecated_proxy_alias_still_routes() {
    let router = build_router(make_test_state());

    let req = Request::builder()
        .uri("/proxy/review/health")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    assert_eq!(
        resp.status(),
        StatusCode::SERVICE_UNAVAILABLE,
        "/proxy/review/health must return 503 via deprecated alias, not 404"
    );
}

/// Why: the deprecated `/proxy/*` alias must also reject unknown service keys
/// with 400, not a silent 404 — proves the handler still validates the key.
/// What: issues GET /proxy/unknown/health, asserts 400.
/// Test: this test itself.
#[tokio::test]
async fn test_deprecated_proxy_alias_unknown_key_returns_400() {
    let router = build_router(make_test_state());

    let req = Request::builder()
        .uri("/proxy/unknown/health")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    assert_eq!(resp.status(), StatusCode::BAD_REQUEST);
}

/// Why: #1849 Phase 1 adds `mpm` to the proxy allowlist. A request to
/// `/proxy/mpm/health` must NOT return 400 (unknown daemon) — it must return
/// 503 (cache not yet populated) which proves the key is now in the allowlist.
/// What: issues GET /proxy/mpm/health on a fresh state (no poll),
/// asserts 503 SERVICE_UNAVAILABLE (not 400 BAD_REQUEST).
/// Test: this test itself (regression guard for #1849 Phase 1).
#[tokio::test]
async fn test_proxy_mpm_is_in_allowlist_cold_cache_returns_503() {
    let router = build_router(make_test_state());

    let req = Request::builder()
        .uri("/proxy/mpm/health")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    assert_eq!(
        resp.status(),
        StatusCode::SERVICE_UNAVAILABLE,
        "/proxy/mpm/health must return 503 (mpm in allowlist, cache cold), not 400"
    );
}

/// Why: the "console" service key is reserved for the console's own
/// /api/console/* namespace.  Issuing a request like /api/console/hijack
/// must never reach the reverse-proxy and be forwarded to an upstream; the
/// explicit guard in proxy_handler must return 400 before full_id is called.
/// What: issues GET /api/console/hijack on a fresh state, asserts 400.
/// Test: this test itself (#1849 Phase 2 console-key reservation guard).
#[tokio::test]
async fn test_api_proxy_console_key_returns_400() {
    let router = build_router(make_test_state());

    let req = Request::builder()
        .uri("/api/console/hijack")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    assert_eq!(
        resp.status(),
        StatusCode::BAD_REQUEST,
        "/api/console/<unregistered-path> must return 400 from the console guard, not 404"
    );
}

/// Why: with an empty memory metrics cache the route must return 503 so the
/// UI can show a "not yet available" state rather than empty JSON.
/// What: issues GET /api/console/metrics/memory on a fresh state, asserts 503.
/// Test: this test itself.
#[tokio::test]
async fn test_metrics_memory_route_cold_cache_returns_503() {
    let router = build_router(make_test_state());
    let req = Request::builder()
        .uri("/api/console/metrics/memory")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    assert_eq!(resp.status(), StatusCode::SERVICE_UNAVAILABLE);
}

/// Why: with an empty search metrics cache the route must return 503 so the
/// UI can show a "not yet available" state rather than empty JSON.
/// What: issues GET /api/console/metrics/search on a fresh state, asserts 503.
/// Test: this test itself.
#[tokio::test]
async fn test_metrics_search_route_cold_cache_returns_503() {
    let router = build_router(make_test_state());
    let req = Request::builder()
        .uri("/api/console/metrics/search")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    assert_eq!(resp.status(), StatusCode::SERVICE_UNAVAILABLE);
}

/// Why: with an empty review metrics cache the route must return 503 so the
/// UI can show a "not yet available" state rather than empty JSON.
/// What: issues GET /api/console/metrics/review on a fresh state, asserts 503.
/// Test: this test itself.
#[tokio::test]
async fn test_metrics_review_route_cold_cache_returns_503() {
    let router = build_router(make_test_state());
    let req = Request::builder()
        .uri("/api/console/metrics/review")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    assert_eq!(resp.status(), StatusCode::SERVICE_UNAVAILABLE);
}

/// Why: with an empty mpm metrics cache the route must return 503 so the UI
/// can show a "not yet available" state rather than empty JSON (#1222).
/// What: issues GET /api/console/metrics/mpm on a fresh state, asserts 503.
/// Test: this test itself.
#[tokio::test]
async fn test_metrics_mpm_route_cold_cache_returns_503() {
    let router = build_router(make_test_state());
    let req = Request::builder()
        .uri("/api/console/metrics/mpm")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    assert_eq!(resp.status(), StatusCode::SERVICE_UNAVAILABLE);
}

/// Why: the analyze indexes route must return 503 (not 200 with empty data)
/// when the trusty-analyze binary is absent — the handle immediately marks
/// itself Absent and the route converts that to SERVICE_UNAVAILABLE.
/// What: issues GET /api/console/metrics/analyze/indexes on a fresh state
/// (where trusty-analyze is not on PATH in CI), asserts 503.
/// Test: this test itself.
#[tokio::test]
async fn test_analyze_indexes_absent_binary_returns_503() {
    let router = build_router(make_test_state());
    let req = Request::builder()
        .uri("/api/console/metrics/analyze/indexes")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    // Binary absent (or in backoff) → 503; if present and daemon is up → 200.
    // In CI neither condition holds; the route must not return 500.
    assert_ne!(
        resp.status(),
        StatusCode::INTERNAL_SERVER_ERROR,
        "indexes route must not 500 when binary absent"
    );
}

/// Why: the analyze visualize route must return 400 when no `index` param
/// is provided — the endpoint needs it to query the daemon. A 200 with an
/// error field is indistinguishable from a success response to callers that
/// only check the status code.
/// What: issues GET /api/console/metrics/analyze/visualize (no ?index=),
/// asserts HTTP 400 and a JSON body containing `error`.
/// Test: this test itself.
#[tokio::test]
async fn test_analyze_visualize_handler_no_index_returns_json_error() {
    let router = build_router(make_test_state());
    let req = Request::builder()
        .uri("/api/console/metrics/analyze/visualize")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    // Missing index returns 400 BAD_REQUEST with a JSON error body.
    assert_eq!(
        resp.status(),
        StatusCode::BAD_REQUEST,
        "missing index param must return 400"
    );
    let bytes = get_bytes(resp).await;
    let body: serde_json::Value = serde_json::from_slice(&bytes).expect("parse json");
    assert!(
        body.get("error").is_some(),
        "expected error field, got: {body}"
    );
}

/// Why: This is the key regression test for the UAT gap: the connector
/// `detect()` path reports `Running` or `Available` because it only does a
/// TCP/which probe and knows nothing about `tools/list`. When the actual
/// `McpServiceHandle` is in `Degraded` state (tools/list succeeded but
/// `console_metrics` absent), `GET /api/console/services` MUST override that
/// connector result to `degraded` with the remediation hint.
/// What: Builds state whose connector returns `Running` for trusty-search,
/// manually primes the trusty-search `McpServiceHandle` to `Degraded`, then
/// issues GET /api/console/services and asserts `status == "degraded"` with
/// a non-empty `hint`.  A connector that was `Absent` must NOT be overridden
/// (only reachable services can be Degraded by the tools/list probe).
/// This test intentionally does NOT use a hand-stubbed DegradedConnector —
/// it exercises the real `apply_handle_overrides` bridge from
/// `McpServiceHandle.state` → route response.
/// Test: this test itself.
#[tokio::test]
async fn test_services_route_handle_degraded_overlay() {
    // Build state with:
    //  - trusty-search connector returning Running (TCP probe passed)
    //  - trusty-analyze connector returning Absent (binary not found)
    let state = AppState::new(vec![
        Box::new(StubConnector {
            id: "trusty-search",
            display_name: "Trusty Search",
            status: ServiceStatus::Running,
        }),
        Box::new(StubConnector {
            id: "trusty-analyze",
            display_name: "Trusty Analyze",
            status: ServiceStatus::Absent,
        }),
    ]);

    // Prime the trusty-search handle to Degraded state (tools/list passed
    // but console_metrics was absent).  This simulates the real-world
    // situation on a machine where the daemon lacks console_metrics.
    {
        let handles = state.mcp_handles();
        let search_handle = handles
            .get("trusty-search")
            .expect("search handle must exist");
        search_handle.prime_degraded_for_test().await;
    }

    let router = build_router(state);
    let req = Request::builder()
        .uri("/api/console/services")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    assert_eq!(resp.status(), StatusCode::OK);

    let bytes = get_bytes(resp).await;
    let body: Vec<serde_json::Value> = serde_json::from_slice(&bytes).expect("parse json");
    assert_eq!(body.len(), 2);

    // trusty-search was Running via connector but Degraded via handle →
    // must be overridden to degraded with a hint.
    let search = body
        .iter()
        .find(|s| s["id"] == "trusty-search")
        .expect("search entry");
    assert_eq!(
        search["status"], "degraded",
        "Running service whose handle is Degraded must report degraded, got: {search}"
    );
    let hint = search["hint"].as_str().unwrap_or("");
    assert!(
        !hint.is_empty(),
        "degraded service must include a non-empty hint"
    );
    assert!(
        hint.contains("console_metrics"),
        "hint must mention console_metrics, got: {hint}"
    );

    // trusty-analyze was Absent via connector — Absent must NOT be overridden
    // even if the handle were somehow Degraded (process-down ≠ degraded).
    let analyze = body
        .iter()
        .find(|s| s["id"] == "trusty-analyze")
        .expect("analyze entry");
    assert_eq!(
        analyze["status"], "absent",
        "Absent service must not be overridden to degraded"
    );
}

/// Why: Regression test for issue #1170 — a stale daemon whose MCP process
/// is running but lacks the `list_analyze_indexes` tool must cause the
/// `/api/console/metrics/analyze/indexes` route to return HTTP 503 with a
/// clean JSON body containing `status: "degraded"` and an actionable `hint`,
/// NOT HTTP 502 with empty body. The capability-gate in `call_tool_checked`
/// must fire before any JSON-RPC call is made to the daemon.
/// What: Builds state with a `trusty-analyze` handle primed to `Connected`
/// but missing `list_analyze_indexes` in the cached tool set. Issues GET
/// /api/console/metrics/analyze/indexes and asserts:
///   1. Status is 503 (SERVICE_UNAVAILABLE), not 502 (BAD_GATEWAY).
///   2. JSON body has `status == "degraded"`.
///   3. JSON body has a non-empty `hint` mentioning the missing tool.
/// Test: this test itself. Key regression for #1170.
#[tokio::test]
#[cfg(unix)]
async fn test_analyze_indexes_tool_unavailable_returns_degraded_hint() {
    let state = make_test_state();

    // Prime the analyze handle to Connected with list_analyze_indexes absent.
    {
        let analyze_handle = state.analyze_handle();
        analyze_handle
            .prime_connected_missing_tool_for_test("list_analyze_indexes")
            .await;
    }

    let router = build_router(state);
    let req = Request::builder()
        .uri("/api/console/metrics/analyze/indexes")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");

    // Must be 503, not 502 — the capability gate fires, not the JSON-RPC call.
    assert_eq!(
        resp.status(),
        StatusCode::SERVICE_UNAVAILABLE,
        "missing tool must return 503 SERVICE_UNAVAILABLE, not 502 BAD_GATEWAY"
    );

    let bytes = get_bytes(resp).await;
    let body: serde_json::Value = serde_json::from_slice(&bytes).expect("parse json body");

    assert_eq!(
        body["status"], "degraded",
        "response body must have status=degraded, got: {body}"
    );

    let hint = body["hint"].as_str().unwrap_or("");
    assert!(
        !hint.is_empty(),
        "response body must include a non-empty hint, got: {body}"
    );
    assert!(
        hint.contains("list_analyze_indexes"),
        "hint must mention the missing tool name, got: {hint}"
    );
}

// ── same-origin guard on destructive session write routes (#1222 review #3) ──

/// Why: a cross-origin browser `POST` to a destructive session route is the
/// CSRF threat the same-origin guard exists to block. With a non-loopback
/// `Origin` header present, the write route must return `403 FORBIDDEN` and
/// never reach the handler (which would otherwise return 503 absent-binary).
/// What: issues `POST /api/console/sessions` with `Origin: http://evil.example`
/// and asserts 403.
/// Test: this test itself (review finding #3 regression guard).
#[tokio::test]
async fn write_route_rejects_cross_origin() {
    let router = build_router(make_test_state());
    let req = Request::builder()
        .method("POST")
        .uri("/api/console/sessions")
        .header("origin", "http://evil.example.com")
        .header("content-type", "application/json")
        .body(Body::from(
            serde_json::json!({"repo_url":"https://x/y","ref":"main","task":"t"}).to_string(),
        ))
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    assert_eq!(
        resp.status(),
        StatusCode::FORBIDDEN,
        "cross-origin write must be rejected with 403"
    );
}

/// Why: the legitimate operator surface (the SPA served from loopback) must
/// still be able to drive write routes — a loopback `Origin` must pass the
/// guard. With no trusty-mpm binary on PATH the handler then returns a 503,
/// so the guard is proven transparent by asserting the status is NOT 403.
/// What: issues `DELETE /api/console/sessions/abc` with a loopback Origin and
/// asserts the response is not 403 (guard passed; handler degraded to 503).
/// Test: this test itself.
#[tokio::test]
async fn write_route_allows_loopback_origin() {
    let router = build_router(make_test_state());
    let req = Request::builder()
        .method("DELETE")
        .uri("/api/console/sessions/abc")
        .header("origin", "http://127.0.0.1:7788")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    assert_ne!(
        resp.status(),
        StatusCode::FORBIDDEN,
        "loopback-origin write must pass the same-origin guard"
    );
}

/// Why: non-browser clients (curl, native tooling, the console's own
/// server-side calls) send no `Origin` header and are not the CSRF threat;
/// they must pass the guard. With no binary present the handler degrades to
/// 503, so we assert the status is NOT 403.
/// What: issues `POST /api/console/sessions/abc/stop` with no Origin header.
/// Test: this test itself.
#[tokio::test]
async fn write_route_allows_missing_origin() {
    let router = build_router(make_test_state());
    let req = Request::builder()
        .method("POST")
        .uri("/api/console/sessions/abc/stop")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    assert_ne!(
        resp.status(),
        StatusCode::FORBIDDEN,
        "missing-Origin write must pass the same-origin guard"
    );
}

/// Why: the guard must NOT block safe cross-origin reads — the CORS policy is
/// intentionally open for GETs so the SPA and tooling can read fleet state.
/// A cross-origin `GET` must pass the guard (and then degrade to 503 with no
/// binary), proving the middleware is method-aware.
/// What: issues `GET /api/console/sessions` with a remote Origin; asserts the
/// status is NOT 403.
/// Test: this test itself.
#[tokio::test]
async fn read_route_allows_cross_origin() {
    let router = build_router(make_test_state());
    let req = Request::builder()
        .method("GET")
        .uri("/api/console/sessions")
        .header("origin", "http://evil.example.com")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    assert_ne!(
        resp.status(),
        StatusCode::FORBIDDEN,
        "cross-origin GET (read) must not be blocked by the write guard"
    );
}

// ── router-wide guard coverage on the reverse-proxy routes (#3268) ────────

/// Why: #3268 regression guard — the write-origin guard previously only
/// covered the seven session routes registered before the old
/// `route_layer` call, so a cross-origin `POST`/`DELETE` through the
/// reverse proxy (e.g. `POST /api/search/admin/stop`, `DELETE
/// /api/search/indexes/{id}`) reached the destructive daemon endpoint
/// unguarded. Now that the guard is applied router-wide via `.layer()`,
/// a cross-origin write to a proxied route must be rejected with `403`
/// BEFORE `proxy_handler` ever attempts to reach an upstream daemon (no
/// live daemon required for this test to pass).
/// What: issues `POST /api/search/admin/stop` with a non-loopback,
/// non-self `Origin` header and asserts `403 FORBIDDEN`.
/// Test: this test itself.
#[tokio::test]
async fn proxy_route_rejects_cross_origin_write() {
    let router = build_router(make_test_state());
    let req = Request::builder()
        .method("POST")
        .uri("/api/search/admin/stop")
        .header("origin", "http://evil.example.com")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    assert_eq!(
        resp.status(),
        StatusCode::FORBIDDEN,
        "cross-origin write through the reverse proxy must be rejected with 403"
    );
}

/// Why: #3268 companion — the router-wide guard must still let a
/// cross-origin, safe `GET` through the proxy pass (read traffic is not
/// the CSRF threat model); this proves the router-wide `.layer()` stayed
/// method-aware after replacing the route-scoped `route_layer`.
/// What: issues `GET /api/search/status` with a remote Origin; asserts
/// the response is NOT 403 (it degrades to 503/502 with no live daemon).
/// Test: this test itself.
#[tokio::test]
async fn proxy_route_allows_cross_origin_read() {
    let router = build_router(make_test_state());
    let req = Request::builder()
        .method("GET")
        .uri("/api/search/status")
        .header("origin", "http://evil.example.com")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    assert_ne!(
        resp.status(),
        StatusCode::FORBIDDEN,
        "cross-origin GET through the reverse proxy must not be blocked by the write guard"
    );
}

// ── bind-aware self-origin allowlist (#3269) ───────────────────────────────

/// Why: #3269 regression guard — the full Tailscale write flow. When the
/// console is bound on a Tailscale (non-loopback) address, its own write
/// UI served from that address must be able to drive BOTH the native
/// session routes AND the reverse-proxied destructive routes; a request
/// whose `Origin` is exactly the server's own resolved bind address must
/// pass the guard rather than being 403'd as if it were a random
/// non-loopback origin.
/// What: builds the router via `build_router_with_self_origins` with a
/// `SelfOrigins` allowlist containing `100.64.1.2:7788` (a Tailscale
/// CGNAT address), then issues `POST /api/console/sessions` and `POST
/// /api/search/admin/stop` with `Origin: http://100.64.1.2:7788`; asserts
/// neither is 403 (both degrade to 503/502 with no live
/// trusty-mpm/trusty-search binary — proving the guard, not the handler,
/// is what would have blocked them).
/// Test: this test itself.
#[tokio::test]
async fn proxy_route_allows_self_origin_write() {
    let self_origins = crate::routes::origin_guard::SelfOrigins::from_bind_addrs(&[
        "127.0.0.1:7788".parse().expect("addr"),
        "100.64.1.2:7788".parse().expect("addr"),
    ]);
    let router = build_router_with_self_origins(make_test_state(), self_origins);

    let session_req = Request::builder()
        .method("POST")
        .uri("/api/console/sessions")
        .header("origin", "http://100.64.1.2:7788")
        .header("content-type", "application/json")
        .body(Body::from(
            serde_json::json!({"repo_url":"https://x/y","ref":"main","task":"t"}).to_string(),
        ))
        .expect("request");
    let session_resp = router.clone().oneshot(session_req).await.expect("response");
    assert_ne!(
        session_resp.status(),
        StatusCode::FORBIDDEN,
        "self-origin (Tailscale bind addr) session write must pass the guard"
    );

    let proxy_req = Request::builder()
        .method("POST")
        .uri("/api/search/admin/stop")
        .header("origin", "http://100.64.1.2:7788")
        .body(Body::empty())
        .expect("request");
    let proxy_resp = router.oneshot(proxy_req).await.expect("response");
    assert_ne!(
        proxy_resp.status(),
        StatusCode::FORBIDDEN,
        "self-origin (Tailscale bind addr) proxied write must pass the guard"
    );
}

/// Why: #3269 companion — the self-origin allowlist must stay narrowly
/// scoped to the server's own resolved bind address(es), NOT the whole
/// `100.64.0.0/10` CGNAT range (explicitly called out as the anti-goal in
/// the issue). A different host in that range must still be rejected.
/// What: builds the router trusting only `100.64.1.2:7788`, then issues a
/// write with `Origin: http://100.64.9.9:7788` (a different tailnet host)
/// and asserts `403`.
/// Test: this test itself.
#[tokio::test]
async fn proxy_route_rejects_other_tailnet_host() {
    let self_origins =
        crate::routes::origin_guard::SelfOrigins::from_bind_addrs(&["100.64.1.2:7788"
            .parse()
            .expect("addr")]);
    let router = build_router_with_self_origins(make_test_state(), self_origins);
    let req = Request::builder()
        .method("POST")
        .uri("/api/search/admin/stop")
        .header("origin", "http://100.64.9.9:7788")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    assert_eq!(
        resp.status(),
        StatusCode::FORBIDDEN,
        "a non-self, non-loopback tailnet host must still be rejected — the allowlist must \
         not blanket-trust the whole CGNAT range"
    );
}

/// Why (#6517): before the background host sampler has produced a snapshot, the
/// machine-status route must answer 503 so the UI can show "not yet available"
/// rather than empty JSON — the same contract as the per-service metrics routes.
/// What: GET /api/console/machine-status on a fresh state (host cache cold),
/// asserts 503.
/// Test: this test itself.
#[tokio::test]
async fn machine_status_route_cold_cache_returns_503() {
    let router = build_router(make_test_state());
    let req = Request::builder()
        .uri("/api/console/machine-status")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    assert_eq!(resp.status(), StatusCode::SERVICE_UNAVAILABLE);
}

/// Why (#6517): once the host cache is warm, the route must assemble and return
/// the aggregated MachineStatus JSON, folding in whichever per-service reports
/// are cached.
/// What: warms the host cache with a real sample and one service report, issues
/// GET /api/console/machine-status, asserts 200 and that the body parses as a
/// MachineStatus whose rollup counts the one warm service.
/// Test: this test itself.
#[tokio::test]
async fn machine_status_route_warm_cache_returns_json() {
    use trusty_common::console_metrics::machine_status::MachineStatus;
    use trusty_common::console_metrics::{ServiceHealth, make_report};
    use trusty_common::host_metrics::HostSampler;

    let state = make_test_state();
    state
        .host_metrics_cache()
        .set(HostSampler::new().sample())
        .await;
    state
        .metrics_cache()
        .set(make_report(
            "trusty-analyze",
            "Analyze",
            "0.7.0",
            ServiceHealth::Ok,
            serde_json::json!({ "files": 1 }),
            1,
        ))
        .await;

    let router = build_router(state);
    let req = Request::builder()
        .uri("/api/console/machine-status")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    assert_eq!(resp.status(), StatusCode::OK);

    let bytes = resp
        .into_body()
        .collect()
        .await
        .expect("collect body")
        .to_bytes();
    let status: MachineStatus = serde_json::from_slice(&bytes).expect("parse MachineStatus");
    assert_eq!(status.services.total, 1);
    assert_eq!(status.services.ok, 1);
    assert!(status.host.cpu.logical_cores >= 1);
}

/// Why (#6641): the graph must render an empty axis before the first sample
/// rather than an error. Unlike the point-in-time route above, "no samples yet"
/// is a complete answer, so the history route answers 200 with empty arrays —
/// this test pins that difference so a later change cannot quietly make it a 503.
/// What: GET /api/console/machine-status/history on a fresh state, asserts 200
/// and a body whose two arrays are empty while the capacities and interval are
/// still advertised.
/// Test: this test itself.
#[tokio::test]
async fn machine_history_route_cold_cache_returns_empty_200() {
    let router = build_router(make_test_state());
    let req = Request::builder()
        .uri("/api/console/machine-status/history")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    assert_eq!(
        resp.status(),
        StatusCode::OK,
        "an empty window is a 200, not a 503"
    );

    let bytes = resp
        .into_body()
        .collect()
        .await
        .expect("collect body")
        .to_bytes();
    let snap: crate::machine_history::HistorySnapshot =
        serde_json::from_slice(&bytes).expect("parse HistorySnapshot");
    assert!(snap.samples.is_empty());
    assert!(snap.transitions.is_empty());
    // #6642: read from the constants rather than restating 600 × 1, so the next
    // cadence change fails in ONE place — history.rs's own window test.
    assert_eq!(
        snap.sample_capacity,
        trusty_common::host_metrics::history::HOST_HISTORY_CAPACITY
    );
    assert_eq!(
        snap.sample_interval_secs,
        trusty_common::host_metrics::history::HOST_SAMPLE_INTERVAL_SECS
    );
    // #6642: the per-service rings share the host window and start empty.
    assert!(snap.service_samples.is_empty());
    assert_eq!(
        snap.service_sample_capacity,
        crate::machine_history::service_samples::SERVICE_HISTORY_CAPACITY
    );
    assert_eq!(
        snap.schema_version,
        crate::machine_history::MACHINE_HISTORY_SCHEMA_VERSION
    );
}

/// Why (#6641): the history endpoint is what a page load reads before it opens a
/// stream, so it must return the recorded window oldest-first together with the
/// transition log — not one or the other.
/// What: records two samples and drives one service from `ok` to `error`, then
/// asserts the JSON carries both samples and the single transition.
/// Test: this test itself.
#[tokio::test]
async fn machine_history_route_returns_recorded_samples() {
    use trusty_common::console_metrics::{ServiceHealth, make_report};
    use trusty_common::host_metrics::HostSampler;

    let state = make_test_state();
    let mut sampler = HostSampler::new();
    state
        .machine_history()
        .record_sample(sampler.sample())
        .await;
    state
        .machine_history()
        .record_sample(sampler.sample())
        .await;
    for status in [ServiceHealth::Ok, ServiceHealth::Error] {
        state
            .machine_history()
            .observe_services(&[make_report(
                "trusty-search",
                "Trusty Search",
                "1.0.0",
                status,
                serde_json::json!({}),
                1,
            )])
            .await;
    }

    let router = build_router(state);
    let req = Request::builder()
        .uri("/api/console/machine-status/history")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    assert_eq!(resp.status(), StatusCode::OK);

    let bytes = resp
        .into_body()
        .collect()
        .await
        .expect("collect body")
        .to_bytes();
    let snap: crate::machine_history::HistorySnapshot =
        serde_json::from_slice(&bytes).expect("parse HistorySnapshot");
    assert_eq!(snap.samples.len(), 2);
    assert_eq!(
        snap.transitions.len(),
        1,
        "only the ok→error change is logged, got {:?}",
        snap.transitions
    );
    assert_eq!(
        snap.transitions[0].to,
        crate::machine_history::transitions::ServiceState::Down
    );
}

/// Why (#6641): `EventSource` refuses any response whose content type is not
/// `text/event-stream`, and a buffering reverse proxy turns a correct stream into
/// a dead one — so the status and the three headers are the contract.
/// What: GET /api/console/machine-status/stream, asserts 200 with the SSE
/// content type, `no-cache`, and `X-Accel-Buffering: no`, then reads the first
/// body frame and asserts it is the `history` event.
/// Test: this test itself.
#[tokio::test]
async fn machine_history_stream_route_is_an_event_stream() {
    let router = build_router(make_test_state());
    let req = Request::builder()
        .uri("/api/console/machine-status/stream")
        .body(Body::empty())
        .expect("request");
    let resp = router.oneshot(req).await.expect("response");
    assert_eq!(resp.status(), StatusCode::OK);
    assert_eq!(
        resp.headers()
            .get(CONTENT_TYPE)
            .and_then(|v| v.to_str().ok()),
        Some("text/event-stream")
    );
    assert_eq!(
        resp.headers()
            .get("cache-control")
            .and_then(|v| v.to_str().ok()),
        Some("no-cache")
    );
    assert_eq!(
        resp.headers()
            .get("x-accel-buffering")
            .and_then(|v| v.to_str().ok()),
        Some("no")
    );

    // #6641: the stream never ends on its own, so read exactly the first frame
    // rather than collecting the body.
    let mut body = resp.into_body();
    let frame = body
        .frame()
        .await
        .expect("a first frame")
        .expect("frame ok")
        .into_data()
        .expect("data frame");
    let text = String::from_utf8(frame.to_vec()).expect("utf8 frame");
    assert!(
        text.starts_with("event: history\ndata: {"),
        "the stream opens with the current window, got {text:?}"
    );
}

// ── #9474: the Architect dashboard link ─────────────────────────────────────

/// What the dashboard-link route answers when the Architect data dir holds
/// `addr` (or no `http_addr` file at all, for `None`).
///
/// Why a sync test driving its own runtime: the route reads the discovery file
/// through `TRUSTY_DATA_DIR_OVERRIDE`, a process-global variable every
/// env-mutating test serialises on `crate::detect::ENV_LOCK`. Holding that std
/// mutex across an `.await` is the `await_holding_lock` hazard, so the lock is
/// taken outside the runtime and the request runs inside it.
/// What: points the override at a fresh tempdir, writes
/// `<tmp>/trusty-architect/http_addr` when `addr` is `Some`, issues
/// `GET /api/console/architect-dashboard`, asserts a 200, and returns the
/// body's `url` field.
fn architect_link_for(addr: Option<&str>) -> serde_json::Value {
    let _guard = crate::detect::ENV_LOCK
        .lock()
        .unwrap_or_else(|e| e.into_inner());
    let data = tempfile::TempDir::new().expect("data tempdir");
    if let Some(addr) = addr {
        let dir = data.path().join("trusty-architect");
        std::fs::create_dir_all(&dir).expect("architect data dir");
        std::fs::write(dir.join("http_addr"), addr).expect("write http_addr");
    }
    // SAFETY: serialised on the crate's one TRUSTY_DATA_DIR_OVERRIDE lock.
    unsafe {
        std::env::set_var(trusty_common::DATA_DIR_OVERRIDE_ENV, data.path());
    }
    let runtime = tokio::runtime::Builder::new_current_thread()
        .enable_all()
        .build()
        .expect("runtime");
    let result = runtime.block_on(async {
        let router = build_router(make_test_state());
        let req = Request::builder()
            .uri("/api/console/architect-dashboard")
            .body(Body::empty())
            .expect("request");
        let resp = router.oneshot(req).await.expect("response");
        let status = resp.status();
        let bytes = get_bytes(resp).await;
        (status, bytes)
    });
    // SAFETY: still under the same lock.
    unsafe {
        std::env::remove_var(trusty_common::DATA_DIR_OVERRIDE_ENV);
    }
    let (status, bytes) = result;
    assert_eq!(status, StatusCode::OK, "the link route always answers 200");
    let body: serde_json::Value = serde_json::from_slice(&bytes).expect("json body");
    body.get("url").cloned().expect("body carries a url field")
}

/// #9474: a dashboard that recorded its address and is listening gets a link.
///
/// What: binds a loopback listener (the stand-in dashboard), records its
/// address, and expects the route to hand back the normalised URL.
/// Test: this test itself.
#[test]
fn architect_link_present_when_dashboard_discovered_and_live() {
    let listener = std::net::TcpListener::bind("127.0.0.1:0").expect("bind");
    let addr = listener.local_addr().expect("local addr");
    let url = architect_link_for(Some(&addr.to_string()));
    assert_eq!(url, serde_json::json!(format!("http://{addr}/")));
    drop(listener);
}

/// #9474: a host with no Architect has no discovery file, so no link.
/// Test: this test itself.
#[test]
fn architect_link_absent_without_discovery_file() {
    assert_eq!(architect_link_for(None), serde_json::Value::Null);
}

/// #9474: a stale discovery file whose dashboard has stopped gives no link.
///
/// What: binds then drops a listener so the recorded port is closed.
/// Test: this test itself.
#[test]
fn architect_link_absent_when_dashboard_not_live() {
    let listener = std::net::TcpListener::bind("127.0.0.1:0").expect("bind");
    let addr = listener.local_addr().expect("local addr");
    drop(listener);
    assert_eq!(
        architect_link_for(Some(&addr.to_string())),
        serde_json::Value::Null
    );
}

/// #9474: a recorded URL naming any host other than loopback is refused.
///
/// What: each address names a non-loopback host; the route must answer `null`
/// for every one. RFC 5737 TEST-NET and `.invalid` keep a broken allowlist from
/// reaching a real machine.
/// Test: this test itself.
#[test]
fn architect_link_refuses_non_localhost_url() {
    for addr in [
        "http://dashboard.invalid:7890/",
        "192.0.2.1:7890",
        "0.0.0.0:7890",
        "http://127.0.0.1@dashboard.invalid:7890/",
    ] {
        assert_eq!(
            architect_link_for(Some(addr)),
            serde_json::Value::Null,
            "{addr} must not produce a link"
        );
    }
}