mod common;

use axum::http::StatusCode;
use serde_json::{json, Value};
use sqlx::PgPool;
use tower::ServiceExt;
use uuid::Uuid;

use common::MultipartBuilder;

async fn genre_id_named(app: &axum::Router, name: &str) -> String {
    let resp = app
        .clone()
        .oneshot(common::get("/api/v1/genres"))
        .await
        .unwrap();
    assert_eq!(resp.status(), StatusCode::OK);
    let body = common::body_json(resp).await;
    body.as_array()
        .unwrap()
        .iter()
        .find(|g| g["name"].as_str() == Some(name))
        .and_then(|g| g["id"].as_str().map(str::to_string))
        .unwrap_or_else(|| panic!("expected seeded genre {name}"))
}

async fn create_manga(
    app: &axum::Router,
    cookie: &str,
    metadata: Value,
) -> Value {
    let resp = app
        .clone()
        .oneshot(common::post_multipart_with_cookie(
            "/api/v1/mangas",
            MultipartBuilder::new().add_json("metadata", metadata),
            cookie,
        ))
        .await
        .unwrap();
    assert_eq!(
        resp.status(),
        StatusCode::CREATED,
        "create_manga failed: {:?}",
        resp.status()
    );
    common::body_json(resp).await
}

fn id_of(body: &Value) -> Uuid {
    Uuid::parse_str(body["id"].as_str().unwrap()).unwrap()
}

#[sqlx::test(migrations = "./migrations")]
async fn create_returns_enriched_detail_with_defaults(pool: PgPool) {
    let h = common::harness(pool);
    let (_, cookie) = common::register_user(&h.app).await;

    let body = create_manga(&h.app, &cookie, json!({ "title": "Solo Manga" })).await;
    assert_eq!(body["title"], "Solo Manga");
    assert_eq!(body["status"], "ongoing");
    assert_eq!(body["alt_titles"], json!([]));
    assert_eq!(body["authors"], json!([]));
    assert_eq!(body["genres"], json!([]));
    assert_eq!(body["tags"], json!([]));
}

#[sqlx::test(migrations = "./migrations")]
async fn create_with_full_metadata_roundtrips(pool: PgPool) {
    let h = common::harness(pool);
    let (_, cookie) = common::register_user(&h.app).await;
    let action_id = genre_id_named(&h.app, "Action").await;
    let fantasy_id = genre_id_named(&h.app, "Fantasy").await;

    let body = create_manga(
        &h.app,
        &cookie,
        json!({
            "title": "Berserk",
            "status": "completed",
            "authors": ["Kentaro Miura", "Studio Gaga"],
            "alt_titles": ["ベルセルク"],
            "genre_ids": [action_id, fantasy_id],
            "description": "Guts wields a big sword."
        }),
    )
    .await;

    assert_eq!(body["status"], "completed");
    assert_eq!(body["alt_titles"], json!(["ベルセルク"]));
    let authors: Vec<&str> = body["authors"]
        .as_array()
        .unwrap()
        .iter()
        .map(|a| a["name"].as_str().unwrap())
        .collect();
    assert_eq!(authors, vec!["Kentaro Miura", "Studio Gaga"]);
    let genres: Vec<&str> = body["genres"]
        .as_array()
        .unwrap()
        .iter()
        .map(|g| g["name"].as_str().unwrap())
        .collect();
    assert_eq!(genres, vec!["Action", "Fantasy"]);

    // GET /mangas/:id returns the same shape.
    let id = id_of(&body);
    let resp = h
        .app
        .oneshot(common::get(&format!("/api/v1/mangas/{id}")))
        .await
        .unwrap();
    let detail = common::body_json(resp).await;
    assert_eq!(detail["status"], "completed");
    assert_eq!(detail["authors"].as_array().unwrap().len(), 2);
}

#[sqlx::test(migrations = "./migrations")]
async fn invalid_status_rejected_with_422(pool: PgPool) {
    let h = common::harness(pool);
    let (_, cookie) = common::register_user(&h.app).await;

    let resp = h
        .app
        .oneshot(common::post_multipart_with_cookie(
            "/api/v1/mangas",
            MultipartBuilder::new()
                .add_json("metadata", json!({ "title": "Foo", "status": "hiatus" })),
            &cookie,
        ))
        .await
        .unwrap();
    assert_eq!(resp.status(), StatusCode::UNPROCESSABLE_ENTITY);
    let body = common::body_json(resp).await;
    assert_eq!(body["error"]["code"], "validation_failed");
    assert!(body["error"]["details"]["status"].is_string());
}

#[sqlx::test(migrations = "./migrations")]
async fn unknown_genre_id_rejected_with_422(pool: PgPool) {
    let h = common::harness(pool);
    let (_, cookie) = common::register_user(&h.app).await;
    let unknown = Uuid::new_v4();

    let resp = h
        .app
        .oneshot(common::post_multipart_with_cookie(
            "/api/v1/mangas",
            MultipartBuilder::new().add_json(
                "metadata",
                json!({ "title": "Foo", "genre_ids": [unknown.to_string()] }),
            ),
            &cookie,
        ))
        .await
        .unwrap();
    assert_eq!(resp.status(), StatusCode::UNPROCESSABLE_ENTITY);
    let body = common::body_json(resp).await;
    assert_eq!(body["error"]["code"], "validation_failed");
}

#[sqlx::test(migrations = "./migrations")]
async fn author_dedups_case_insensitively(pool: PgPool) {
    let h = common::harness(pool);
    let (_, cookie) = common::register_user(&h.app).await;

    let a = create_manga(
        &h.app,
        &cookie,
        json!({ "title": "Berserk", "authors": ["Kentaro Miura"] }),
    )
    .await;
    let b = create_manga(
        &h.app,
        &cookie,
        json!({ "title": "Berserk Prelude", "authors": ["kentaro miura"] }),
    )
    .await;

    // Both mangas resolve the same author id even though the casing differed.
    let id_a = a["authors"][0]["id"].as_str().unwrap();
    let id_b = b["authors"][0]["id"].as_str().unwrap();
    assert_eq!(id_a, id_b);
}

#[sqlx::test(migrations = "./migrations")]
async fn filter_by_status_returns_only_matches(pool: PgPool) {
    let h = common::harness(pool);
    let (_, cookie) = common::register_user(&h.app).await;

    let _ongoing = create_manga(&h.app, &cookie, json!({ "title": "Ongoing One" })).await;
    let _done = create_manga(
        &h.app,
        &cookie,
        json!({ "title": "Wrapped Up", "status": "completed" }),
    )
    .await;

    let resp = h
        .app
        .oneshot(common::get("/api/v1/mangas?status=completed"))
        .await
        .unwrap();
    let body = common::body_json(resp).await;
    let titles: Vec<&str> = body["items"]
        .as_array()
        .unwrap()
        .iter()
        .map(|m| m["title"].as_str().unwrap())
        .collect();
    assert_eq!(titles, vec!["Wrapped Up"]);
    assert_eq!(body["page"]["total"], 1);
}

#[sqlx::test(migrations = "./migrations")]
async fn filter_by_multiple_genres_is_and(pool: PgPool) {
    let h = common::harness(pool);
    let (_, cookie) = common::register_user(&h.app).await;
    let action = genre_id_named(&h.app, "Action").await;
    let fantasy = genre_id_named(&h.app, "Fantasy").await;
    let comedy = genre_id_named(&h.app, "Comedy").await;

    let _both = create_manga(
        &h.app,
        &cookie,
        json!({ "title": "Action+Fantasy", "genre_ids": [action.clone(), fantasy.clone()] }),
    )
    .await;
    let _action_only = create_manga(
        &h.app,
        &cookie,
        json!({ "title": "Action Only", "genre_ids": [action.clone()] }),
    )
    .await;
    let _other = create_manga(
        &h.app,
        &cookie,
        json!({ "title": "Comedy Only", "genre_ids": [comedy] }),
    )
    .await;

    let url = format!("/api/v1/mangas?genre_id={action},{fantasy}");
    let resp = h.app.oneshot(common::get(&url)).await.unwrap();
    let body = common::body_json(resp).await;
    let titles: Vec<&str> = body["items"]
        .as_array()
        .unwrap()
        .iter()
        .map(|m| m["title"].as_str().unwrap())
        .collect();
    // Only the manga tagged with BOTH genres matches — pure AND.
    assert_eq!(titles, vec!["Action+Fantasy"]);
}

#[sqlx::test(migrations = "./migrations")]
async fn filter_by_author_id_matches_only_works_by_that_author(pool: PgPool) {
    let h = common::harness(pool);
    let (_, cookie) = common::register_user(&h.app).await;

    let miura_manga = create_manga(
        &h.app,
        &cookie,
        json!({ "title": "Berserk", "authors": ["Kentaro Miura"] }),
    )
    .await;
    let miura_id = miura_manga["authors"][0]["id"].as_str().unwrap();
    let _oda = create_manga(
        &h.app,
        &cookie,
        json!({ "title": "One Piece", "authors": ["Eiichiro Oda"] }),
    )
    .await;

    let resp = h
        .app
        .oneshot(common::get(&format!("/api/v1/mangas?author_id={miura_id}")))
        .await
        .unwrap();
    let body = common::body_json(resp).await;
    let titles: Vec<&str> = body["items"]
        .as_array()
        .unwrap()
        .iter()
        .map(|m| m["title"].as_str().unwrap())
        .collect();
    assert_eq!(titles, vec!["Berserk"]);
}

#[sqlx::test(migrations = "./migrations")]
async fn patch_updates_status_authors_and_genres(pool: PgPool) {
    let h = common::harness(pool);
    let (_, cookie) = common::register_user(&h.app).await;
    let drama = genre_id_named(&h.app, "Drama").await;

    let created = create_manga(
        &h.app,
        &cookie,
        json!({ "title": "WIP", "authors": ["Old Name"] }),
    )
    .await;
    let id = id_of(&created);

    let resp = h
        .app
        .oneshot(common::patch_json_with_cookie(
            &format!("/api/v1/mangas/{id}"),
            json!({
                "status": "completed",
                "authors": ["Old Name", "New Coauthor"],
                "genre_ids": [drama]
            }),
            &cookie,
        ))
        .await
        .unwrap();
    assert_eq!(resp.status(), StatusCode::OK);
    let body = common::body_json(resp).await;
    assert_eq!(body["status"], "completed");
    let names: Vec<&str> = body["authors"]
        .as_array()
        .unwrap()
        .iter()
        .map(|a| a["name"].as_str().unwrap())
        .collect();
    assert_eq!(names, vec!["Old Name", "New Coauthor"]);
    assert_eq!(body["genres"][0]["name"], "Drama");
}

#[sqlx::test(migrations = "./migrations")]
async fn patch_authors_updates_precomputed_sort_author(pool: PgPool) {
    // The precomputed mangas.sort_author (used by ?sort=author) must track
    // author edits: changing the alphabetically-first author reorders the
    // author sort. Two mangas whose relative author order flips after a PATCH.
    let h = common::harness(pool.clone());
    let (_, cookie) = common::register_user(&h.app).await;

    let a = id_of(&create_manga(&h.app, &cookie, json!({ "title": "A", "authors": ["Zeta"] })).await);
    let _b = id_of(&create_manga(&h.app, &cookie, json!({ "title": "B", "authors": ["Mid"] })).await);

    // Initially: Mid < Zeta, so B before A.
    let ids = list_titles(&h.app, "sort=author&order=asc").await;
    assert_eq!(ids, vec!["B", "A"]);

    // Re-author A to "Alpha", which now sorts first.
    let resp = h
        .app
        .clone()
        .oneshot(common::patch_json_with_cookie(
            &format!("/api/v1/mangas/{a}"),
            json!({ "authors": ["Alpha"] }),
            &cookie,
        ))
        .await
        .unwrap();
    assert_eq!(resp.status(), StatusCode::OK);

    // Now A (Alpha) sorts before B (Mid) — proving sort_author was recomputed.
    let ids = list_titles(&h.app, "sort=author&order=asc").await;
    assert_eq!(ids, vec!["A", "B"]);
}

async fn list_titles(app: &axum::Router, query: &str) -> Vec<String> {
    let resp = app
        .clone()
        .oneshot(common::get(&format!("/api/v1/mangas?{query}")))
        .await
        .unwrap();
    let body = common::body_json(resp).await;
    body["items"]
        .as_array()
        .unwrap()
        .iter()
        .map(|m| m["title"].as_str().unwrap().to_string())
        .collect()
}

#[sqlx::test(migrations = "./migrations")]
async fn patch_404_on_unknown_id(pool: PgPool) {
    let h = common::harness(pool);
    let (_, cookie) = common::register_user(&h.app).await;
    let resp = h
        .app
        .oneshot(common::patch_json_with_cookie(
            &format!("/api/v1/mangas/{}", Uuid::new_v4()),
            json!({ "status": "completed" }),
            &cookie,
        ))
        .await
        .unwrap();
    assert_eq!(resp.status(), StatusCode::NOT_FOUND);
}

#[sqlx::test(migrations = "./migrations")]
async fn filter_by_unknown_uuid_returns_empty_not_error(pool: PgPool) {
    let h = common::harness(pool);
    let (_, cookie) = common::register_user(&h.app).await;
    let _ = create_manga(&h.app, &cookie, json!({ "title": "Anything" })).await;

    let unknown = Uuid::new_v4();
    let resp = h
        .app
        .oneshot(common::get(&format!("/api/v1/mangas?genre_id={unknown}")))
        .await
        .unwrap();
    assert_eq!(resp.status(), StatusCode::OK);
    let body = common::body_json(resp).await;
    assert_eq!(body["items"], json!([]));
    assert_eq!(body["page"]["total"], 0);
}

#[sqlx::test(migrations = "./migrations")]
async fn filter_combining_status_author_genre_and_tag_is_and(pool: PgPool) {
    let h = common::harness(pool);
    let (_, cookie) = common::register_user(&h.app).await;
    let action = genre_id_named(&h.app, "Action").await;

    // The "winner" matches every facet; the other rows each miss at
    // least one so the combined filter must reject them.
    let winner = create_manga(
        &h.app,
        &cookie,
        json!({
            "title": "Winner",
            "status": "completed",
            "authors": ["Solo Author"],
            "genre_ids": [action.clone()],
        }),
    )
    .await;
    let solo_author_id = winner["authors"][0]["id"].as_str().unwrap().to_string();
    let winner_id = id_of(&winner);

    let _missing_status = create_manga(
        &h.app,
        &cookie,
        json!({
            "title": "Wrong Status",
            "authors": ["Solo Author"],
            "genre_ids": [action.clone()],
        }),
    )
    .await;
    let _missing_author = create_manga(
        &h.app,
        &cookie,
        json!({
            "title": "Wrong Author",
            "status": "completed",
            "authors": ["Other"],
            "genre_ids": [action.clone()],
        }),
    )
    .await;
    let _missing_genre = create_manga(
        &h.app,
        &cookie,
        json!({
            "title": "Missing Genre",
            "status": "completed",
            "authors": ["Solo Author"],
        }),
    )
    .await;

    // Attach a tag to the winner so we can hit all four facets at once.
    let tag_attach = h
        .app
        .clone()
        .oneshot(common::post_json_with_cookie(
            &format!("/api/v1/mangas/{winner_id}/tags"),
            json!({ "name": "Pinned" }),
            &cookie,
        ))
        .await
        .unwrap();
    let tag_id = common::body_json(tag_attach).await["id"].as_str().unwrap().to_string();

    let url = format!(
        "/api/v1/mangas?status=completed&author_id={solo_author_id}&genre_id={action}&tag_id={tag_id}"
    );
    let resp = h.app.oneshot(common::get(&url)).await.unwrap();
    assert_eq!(resp.status(), StatusCode::OK);
    let body = common::body_json(resp).await;
    let titles: Vec<&str> = body["items"]
        .as_array()
        .unwrap()
        .iter()
        .map(|m| m["title"].as_str().unwrap())
        .collect();
    assert_eq!(titles, vec!["Winner"]);
    assert_eq!(body["page"]["total"], 1);
}

#[sqlx::test(migrations = "./migrations")]
async fn duplicate_genre_ids_accepted_not_treated_as_unknown(pool: PgPool) {
    let h = common::harness(pool);
    let (_, cookie) = common::register_user(&h.app).await;
    let action = genre_id_named(&h.app, "Action").await;

    let body = create_manga(
        &h.app,
        &cookie,
        json!({
            "title": "Dup Genres",
            "genre_ids": [action.clone(), action]
        }),
    )
    .await;
    // The repeated id resolves to a single attachment (the join table
    // de-dupes via the composite PK + `ON CONFLICT DO NOTHING`), so
    // the response carries one genre, not two.
    let names: Vec<&str> = body["genres"]
        .as_array()
        .unwrap()
        .iter()
        .map(|g| g["name"].as_str().unwrap())
        .collect();
    assert_eq!(names, vec!["Action"]);
}

#[sqlx::test(migrations = "./migrations")]
async fn patch_explicit_null_description_clears_it(pool: PgPool) {
    let h = common::harness(pool);
    let (_, cookie) = common::register_user(&h.app).await;
    let created = create_manga(
        &h.app,
        &cookie,
        json!({ "title": "With desc", "description": "Original" }),
    )
    .await;
    let id = id_of(&created);
    assert_eq!(created["description"], "Original");

    let resp = h
        .app
        .oneshot(common::patch_json_with_cookie(
            &format!("/api/v1/mangas/{id}"),
            json!({ "description": null }),
            &cookie,
        ))
        .await
        .unwrap();
    assert_eq!(resp.status(), StatusCode::OK);
    let body = common::body_json(resp).await;
    assert!(body["description"].is_null(), "expected description cleared");
}

#[sqlx::test(migrations = "./migrations")]
async fn patch_omitting_description_leaves_it_alone(pool: PgPool) {
    let h = common::harness(pool);
    let (_, cookie) = common::register_user(&h.app).await;
    let created = create_manga(
        &h.app,
        &cookie,
        json!({ "title": "With desc", "description": "Keep me" }),
    )
    .await;
    let id = id_of(&created);

    let resp = h
        .app
        .oneshot(common::patch_json_with_cookie(
            &format!("/api/v1/mangas/{id}"),
            json!({ "status": "completed" }),
            &cookie,
        ))
        .await
        .unwrap();
    assert_eq!(resp.status(), StatusCode::OK);
    let body = common::body_json(resp).await;
    assert_eq!(body["description"], "Keep me");
    assert_eq!(body["status"], "completed");
}

#[sqlx::test(migrations = "./migrations")]
async fn patch_empty_alt_titles_clears_them(pool: PgPool) {
    let h = common::harness(pool);
    let (_, cookie) = common::register_user(&h.app).await;
    let created = create_manga(
        &h.app,
        &cookie,
        json!({ "title": "Has alts", "alt_titles": ["a", "b"] }),
    )
    .await;
    let id = id_of(&created);
    assert_eq!(created["alt_titles"], json!(["a", "b"]));

    let resp = h
        .app
        .oneshot(common::patch_json_with_cookie(
            &format!("/api/v1/mangas/{id}"),
            json!({ "alt_titles": [] }),
            &cookie,
        ))
        .await
        .unwrap();
    let body = common::body_json(resp).await;
    assert_eq!(body["alt_titles"], json!([]));
}

#[sqlx::test(migrations = "./migrations")]
async fn patch_requires_authentication(pool: PgPool) {
    let h = common::harness(pool);
    let (_, cookie) = common::register_user(&h.app).await;
    let created = create_manga(&h.app, &cookie, json!({ "title": "Auth Check" })).await;
    let id = id_of(&created);
    let resp = h
        .app
        .oneshot(common::patch_json(
            &format!("/api/v1/mangas/{id}"),
            json!({ "status": "completed" }),
        ))
        .await
        .unwrap();
    assert_eq!(resp.status(), StatusCode::UNAUTHORIZED);
}

/// A signed-in user who didn't upload the manga must not be able to
/// PATCH it. Without the uploader-gate this returned 200 — see
/// REVIEW.md "manga PATCH / cover endpoints don't check ownership".
#[sqlx::test(migrations = "./migrations")]
async fn patch_forbidden_for_non_uploader(pool: PgPool) {
    let h = common::harness(pool);
    let (_, owner_cookie) = common::register_user(&h.app).await;
    let (_, intruder_cookie) = common::register_user(&h.app).await;

    let created = create_manga(&h.app, &owner_cookie, json!({ "title": "Mine" })).await;
    let id = id_of(&created);

    let resp = h
        .app
        .oneshot(common::patch_json_with_cookie(
            &format!("/api/v1/mangas/{id}"),
            json!({ "status": "completed" }),
            &intruder_cookie,
        ))
        .await
        .unwrap();
    assert_eq!(resp.status(), StatusCode::FORBIDDEN);
}

/// Owner can still edit their own manga (regression guard for the
/// authz fix).
#[sqlx::test(migrations = "./migrations")]
async fn patch_allowed_for_uploader(pool: PgPool) {
    let h = common::harness(pool);
    let (_, cookie) = common::register_user(&h.app).await;
    let created = create_manga(&h.app, &cookie, json!({ "title": "Owned" })).await;
    let id = id_of(&created);
    let resp = h
        .app
        .oneshot(common::patch_json_with_cookie(
            &format!("/api/v1/mangas/{id}"),
            json!({ "status": "completed" }),
            &cookie,
        ))
        .await
        .unwrap();
    assert_eq!(resp.status(), StatusCode::OK);
}

/// Rows with `uploaded_by IS NULL` — crawler-imported plus any pre-0011
/// legacy rows — are admin-only. A regular user editing them used to be
/// allowed; that meant `register → PATCH /mangas/<id>` rewrote the
/// catalog for free.
#[sqlx::test(migrations = "./migrations")]
async fn patch_null_uploader_rejected_for_non_admin(pool: PgPool) {
    let h = common::harness(pool.clone());
    let (_, cookie) = common::register_user(&h.app).await;
    let created = create_manga(&h.app, &cookie, json!({ "title": "Catalog" })).await;
    let id = id_of(&created);

    // Simulate a crawler-imported / pre-0011 row: clear uploaded_by.
    sqlx::query("UPDATE mangas SET uploaded_by = NULL WHERE id = $1")
        .bind(id)
        .execute(&pool)
        .await
        .unwrap();

    let (_, other_cookie) = common::register_user(&h.app).await;
    let resp = h
        .app
        .oneshot(common::patch_json_with_cookie(
            &format!("/api/v1/mangas/{id}"),
            json!({ "status": "completed" }),
            &other_cookie,
        ))
        .await
        .unwrap();
    assert_eq!(resp.status(), StatusCode::FORBIDDEN);
}

/// The original uploader-of-record (when one exists) must keep editing
/// their own row even after admin gating tightens, so a legitimate
/// uploader on the same auth surface isn't locked out alongside drive-by
/// attackers. Re-runs the patch as the original cookie.
#[sqlx::test(migrations = "./migrations")]
async fn patch_owner_can_still_edit_after_admin_gate(pool: PgPool) {
    let h = common::harness(pool.clone());
    let (_, cookie) = common::register_user(&h.app).await;
    let created = create_manga(&h.app, &cookie, json!({ "title": "Owner" })).await;
    let id = id_of(&created);
    // Row keeps uploaded_by set to the creating user (no NULL twiddle).
    let resp = h
        .app
        .oneshot(common::patch_json_with_cookie(
            &format!("/api/v1/mangas/{id}"),
            json!({ "status": "completed" }),
            &cookie,
        ))
        .await
        .unwrap();
    assert_eq!(resp.status(), StatusCode::OK);
}

/// Cover endpoints share `require_can_edit` with PATCH but write blob
/// state to `storage`, so a regression that lets non-admins through
/// `put_cover` would let any registered user replace a crawler-imported
/// cover. `delete_cover` would wipe blobs entirely. Tests both, mirroring
/// the PATCH guard tests above.
#[sqlx::test(migrations = "./migrations")]
async fn put_cover_null_uploader_rejected_for_non_admin(pool: PgPool) {
    let h = common::harness(pool.clone());
    let (_, cookie) = common::register_user(&h.app).await;
    let created = create_manga(&h.app, &cookie, json!({ "title": "Catalog" })).await;
    let id = id_of(&created);
    sqlx::query("UPDATE mangas SET uploaded_by = NULL WHERE id = $1")
        .bind(id)
        .execute(&pool)
        .await
        .unwrap();
    let (_, other_cookie) = common::register_user(&h.app).await;
    // Tiny PNG `cover` part is what put_cover expects to look at.
    let png = common::fake_png_bytes();
    let mp = common::MultipartBuilder::new()
        .add_file("cover", "cover.png", "image/png", &png);
    let resp = h
        .app
        .oneshot(common::put_multipart_with_cookie(
            &format!("/api/v1/mangas/{id}/cover"),
            mp,
            &other_cookie,
        ))
        .await
        .unwrap();
    assert_eq!(resp.status(), StatusCode::FORBIDDEN);
}

#[sqlx::test(migrations = "./migrations")]
async fn delete_cover_null_uploader_rejected_for_non_admin(pool: PgPool) {
    let h = common::harness(pool.clone());
    let (_, cookie) = common::register_user(&h.app).await;
    let created = create_manga(&h.app, &cookie, json!({ "title": "Catalog" })).await;
    let id = id_of(&created);
    sqlx::query("UPDATE mangas SET uploaded_by = NULL WHERE id = $1")
        .bind(id)
        .execute(&pool)
        .await
        .unwrap();
    let (_, other_cookie) = common::register_user(&h.app).await;
    let resp = h
        .app
        .oneshot(common::delete_with_cookie(
            &format!("/api/v1/mangas/{id}/cover"),
            &other_cookie,
        ))
        .await
        .unwrap();
    assert_eq!(resp.status(), StatusCode::FORBIDDEN);
}

/// Admins CAN edit NULL-`uploaded_by` rows, since they're the operators
/// curating the crawled catalog. Mirror of the test above with the
/// caller promoted.
#[sqlx::test(migrations = "./migrations")]
async fn patch_null_uploader_allowed_for_admin(pool: PgPool) {
    let h = common::harness(pool.clone());
    let (_, cookie) = common::register_user(&h.app).await;
    let created = create_manga(&h.app, &cookie, json!({ "title": "Catalog" })).await;
    let id = id_of(&created);

    sqlx::query("UPDATE mangas SET uploaded_by = NULL WHERE id = $1")
        .bind(id)
        .execute(&pool)
        .await
        .unwrap();

    // Mint an admin and let them edit the row.
    let (admin_name, admin_cookie) = common::register_user(&h.app).await;
    let admin = mangalord::repo::user::find_by_username(&pool, &admin_name)
        .await
        .unwrap()
        .unwrap();
    mangalord::repo::user::set_is_admin_unchecked(&pool, admin.id, true)
        .await
        .unwrap();
    let resp = h
        .app
        .oneshot(common::patch_json_with_cookie(
            &format!("/api/v1/mangas/{id}"),
            json!({ "status": "completed" }),
            &admin_cookie,
        ))
        .await
        .unwrap();
    assert_eq!(resp.status(), StatusCode::OK);
}

/// 0.87.10 split `require_can_edit` so admin authority must come via a
/// session cookie — bearer tokens (bot callers) DO NOT carry admin
/// powers per the auth-module contract. A bearer-authed admin trying
/// to PATCH/PUT-cover/DELETE-cover a NULL-`uploaded_by` row must be
/// rejected. Mechanical revert of `admin_via_session(&session)` to
/// `user.is_admin` would let bearer-authed admins through and pass
/// the 0.87.10 cookie tests; this is the missing axis the rereview
/// asked for.
#[sqlx::test(migrations = "./migrations")]
async fn bearer_authed_admin_cannot_edit_null_uploader(pool: PgPool) {
    let h = common::harness(pool.clone());

    // Catalog row with NULL uploaded_by (the crawler shape).
    let (_, owner_cookie) = common::register_user(&h.app).await;
    let created = create_manga(&h.app, &owner_cookie, json!({ "title": "Catalog" })).await;
    let id = id_of(&created);
    sqlx::query("UPDATE mangas SET uploaded_by = NULL WHERE id = $1")
        .bind(id)
        .execute(&pool)
        .await
        .unwrap();

    // Register a user, promote to admin, mint a bearer token from
    // their session.
    let (admin_name, admin_cookie) = common::register_user(&h.app).await;
    let admin = mangalord::repo::user::find_by_username(&pool, &admin_name)
        .await
        .unwrap()
        .unwrap();
    mangalord::repo::user::set_is_admin_unchecked(&pool, admin.id, true)
        .await
        .unwrap();
    let mint_resp = h
        .app
        .clone()
        .oneshot(common::post_json_with_cookie(
            "/api/v1/auth/tokens",
            json!({ "name": "ci-bot" }),
            &admin_cookie,
        ))
        .await
        .unwrap();
    assert_eq!(mint_resp.status(), StatusCode::CREATED);
    let bearer = common::body_json(mint_resp).await["bearer"]
        .as_str()
        .unwrap()
        .to_string();

    // PATCH via bearer — must 403 even though the user behind the
    // token IS an admin. CurrentUser admits the call, but
    // `admin_via_session` reads off `Option<CurrentSessionUser>`
    // which is None on a bearer request.
    let patch_resp = h
        .app
        .clone()
        .oneshot({
            let body = json!({ "status": "completed" });
            axum::http::Request::builder()
                .method("PATCH")
                .uri(format!("/api/v1/mangas/{id}"))
                .header(axum::http::header::CONTENT_TYPE, "application/json")
                .header(axum::http::header::AUTHORIZATION, format!("Bearer {bearer}"))
                .body(axum::body::Body::from(body.to_string()))
                .unwrap()
        })
        .await
        .unwrap();
    assert_eq!(
        patch_resp.status(),
        StatusCode::FORBIDDEN,
        "bearer-authed admin must NOT be able to PATCH a NULL-uploader manga"
    );

    // PUT cover via bearer — same gate, same answer.
    let png = common::fake_png_bytes();
    let (boundary, body) = common::MultipartBuilder::new()
        .add_file("cover", "cover.png", "image/png", &png)
        .finalize();
    let put_resp = h
        .app
        .clone()
        .oneshot({
            axum::http::Request::builder()
                .method("PUT")
                .uri(format!("/api/v1/mangas/{id}/cover"))
                .header(
                    axum::http::header::CONTENT_TYPE,
                    format!("multipart/form-data; boundary={boundary}"),
                )
                .header(axum::http::header::AUTHORIZATION, format!("Bearer {bearer}"))
                .body(axum::body::Body::from(body))
                .unwrap()
        })
        .await
        .unwrap();
    assert_eq!(
        put_resp.status(),
        StatusCode::FORBIDDEN,
        "bearer-authed admin must NOT be able to put_cover on a NULL-uploader manga"
    );

    // DELETE cover via bearer.
    let delete_resp = h
        .app
        .oneshot(
            axum::http::Request::builder()
                .method("DELETE")
                .uri(format!("/api/v1/mangas/{id}/cover"))
                .header(axum::http::header::AUTHORIZATION, format!("Bearer {bearer}"))
                .body(axum::body::Body::empty())
                .unwrap(),
        )
        .await
        .unwrap();
    assert_eq!(
        delete_resp.status(),
        StatusCode::FORBIDDEN,
        "bearer-authed admin must NOT be able to delete_cover on a NULL-uploader manga"
    );
}


#[sqlx::test(migrations = "./migrations")]
async fn create_rejects_oversized_metadata_part(pool: PgPool) {
    // The metadata JSON part is capped well below the 200 MiB request limit so a
    // client can't force the server to buffer a huge JSON blob in memory before
    // any validation runs. A ~200 KiB description blows the metadata cap.
    let h = common::harness(pool);
    let (_, cookie) = common::register_user(&h.app).await;

    let huge = "A".repeat(200 * 1024);
    let resp = h
        .app
        .oneshot(common::post_multipart_with_cookie(
            "/api/v1/mangas",
            MultipartBuilder::new()
                .add_json("metadata", json!({ "title": "Big", "description": huge })),
            &cookie,
        ))
        .await
        .unwrap();
    assert_eq!(resp.status(), StatusCode::PAYLOAD_TOO_LARGE);
}