package admin

import (
	"fmt"
	"net/http"
	"net/http/httptest"
	"net/url"
	"reflect"
	"regexp"
	"strings"
	"testing"
	"time"

	"github.com/go-chi/chi/v5"

	"alterminal/internal/application"
	"alterminal/internal/auth"
	"alterminal/internal/testdb"
)

// 未帶 auth.Session Cookie 的請求在 requireAdmin 即導向 /login，不觸及資料庫，
// 因此 handler 可傳入 nil db。
func TestAdminApplicationsHandlersRequireLogin(t *testing.T) {
	handlers := map[string]http.HandlerFunc{
		"GET 列表":  ApplicationsPageHandler(nil),
		"GET 註冊頁": ApplicationNewPageHandler(nil),
		"POST 註冊": ApplicationsCreateHandler(nil),
		"GET 編輯頁": ApplicationEditPageHandler(nil),
		"POST 更新": ApplicationUpdateHandler(nil),
		"POST 輪替": ApplicationsRotateSecretHandler(nil),
		"POST 刪除": ApplicationsDeleteHandler(nil),
	}
	for name, h := range handlers {
		t.Run(name, func(t *testing.T) {
			rec := httptest.NewRecorder()
			h(rec, httptest.NewRequest(http.MethodGet, "/admin/applications", nil))
			if rec.Code != http.StatusSeeOther {
				t.Fatalf("status = %d, want 303, body = %s", rec.Code, rec.Body.String())
			}
			if loc := rec.Header().Get("Location"); loc != "/login" {
				t.Fatalf("Location = %q, want /login", loc)
			}
		})
	}
}

func TestNewAdminApplicationRows(t *testing.T) {
	apps := []application.Application{
		{
			ID: 1, ClientID: "cid-a", Name: "官方網站", Type: application.ClientConfidential,
			RedirectURIs: application.RedirectURIs{"https://a.example.com/cb", "https://a.example.com/alt"},
			GrantTypes:   application.GrantTypes{application.GrantAuthorizationCode, application.GrantRefreshToken},
			Scope:        "openid offline_access", CreatedAt: time.Now(),
		},
		{
			ID: 2, ClientID: "cid-b", Name: "行動 App", Type: application.ClientPublic,
			RedirectURIs: application.RedirectURIs{"com.example.app:/cb"},
			GrantTypes:   application.GrantTypes{application.GrantAuthorizationCode},
			CreatedAt:    time.Now(),
		},
	}
	rows := newAdminApplicationRows(apps)
	if len(rows) != 2 {
		t.Fatalf("rows = %d 筆, want 2", len(rows))
	}
	if rows[0].RedirectURIs != "https://a.example.com/cb\nhttps://a.example.com/alt" {
		t.Errorf("RedirectURIs 應以換行分隔，得到 %q", rows[0].RedirectURIs)
	}
	if rows[0].GrantTypes != "authorization_code、refresh_token" {
		t.Errorf("GrantTypes 應以頓號分隔，得到 %q", rows[0].GrantTypes)
	}
	if rows[0].CreatedAt == "" {
		t.Error("CreatedAt 應格式化為本地時間字串")
	}
	if !rows[0].Confidential {
		t.Error("機密式應標記 Confidential（顯示輪替表單）")
	}
	if rows[1].Confidential || rows[1].Type != "public" {
		t.Errorf("公開式 row 不應標記 Confidential，Type = %q", rows[1].Type)
	}
	if rows[1].GrantTypes != "authorization_code" {
		t.Errorf("單一 grant type 不應有分隔符，得到 %q", rows[1].GrantTypes)
	}
}

func TestNewApplicationFormDefaults(t *testing.T) {
	f := newApplicationForm()
	if f.Type != string(application.ClientConfidential) {
		t.Errorf("預設類型應為 confidential，得到 %q", f.Type)
	}
	if !f.GrantAuthCode || f.GrantRefresh || f.GrantClientCred {
		t.Error("預設應僅勾選 authorization_code")
	}
}

func TestApplicationFormFromPost(t *testing.T) {
	vals := url.Values{
		"name":          {"示範應用"},
		"type":          {"public"},
		"redirect_uris": {"https://a.example.com/cb\r\ncom.example.app:/cb\r\n\r\n  https://b.example.com/cb  \n"},
		"grant_types":   {"refresh_token"},
		"scope":         {"openid"},
	}
	vals.Add("grant_types", "client_credentials")
	vals.Add("grant_types", "implicit") // 未知值應略過
	req := httptest.NewRequest(http.MethodPost, "/admin/applications", strings.NewReader(vals.Encode()))
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")

	f := applicationFormFromPost(req)
	if f.Name != "示範應用" || f.Type != "public" || f.Scope != "openid" {
		t.Errorf("基本欄位還原不符：%+v", f)
	}
	if !f.GrantRefresh || !f.GrantClientCred || f.GrantAuthCode {
		t.Errorf("核取狀態還原不符：%+v", f)
	}
	wantURIs := []string{"https://a.example.com/cb", "com.example.app:/cb", "https://b.example.com/cb"}
	if got := f.redirectURIList(); !reflect.DeepEqual(got, wantURIs) {
		t.Errorf("redirectURIList = %v, want %v（每行一個、去空白、略過空行）", got, wantURIs)
	}
	wantGrants := []application.GrantType{application.GrantRefreshToken, application.GrantClientCredentials}
	if got := f.grantTypeList(); !reflect.DeepEqual(got, wantGrants) {
		t.Errorf("grantTypeList = %v, want %v", got, wantGrants)
	}
}

// 類型選單僅兩值，偽造的值一律回復為 confidential。
func TestApplicationFormFromPostInvalidType(t *testing.T) {
	req := httptest.NewRequest(http.MethodPost, "/admin/applications",
		strings.NewReader("name=A&type=webapp"))
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	if f := applicationFormFromPost(req); f.Type != string(application.ClientConfidential) {
		t.Errorf("非法類型應回復 confidential，得到 %q", f.Type)
	}
}

// applicationFormFromApp：預填既有註冊資料（redirect URI 每行一個）。
func TestApplicationFormFromApp(t *testing.T) {
	a := &application.Application{
		Name:         "官方網站",
		Type:         application.ClientConfidential,
		RedirectURIs: application.RedirectURIs{"https://a.example.com/cb", "com.example.app:/cb"},
		GrantTypes:   application.GrantTypes{application.GrantAuthorizationCode, application.GrantRefreshToken, application.GrantClientCredentials},
		Scope:        "openid profile offline_access",
	}
	f := applicationFormFromApp(a)
	if f.Name != "官方網站" || f.Type != "confidential" || f.Scope != "openid profile offline_access" {
		t.Errorf("基本欄位預填不符：%+v", f)
	}
	if f.RedirectURIs != "https://a.example.com/cb\ncom.example.app:/cb" {
		t.Errorf("RedirectURIs 應以換行分隔預填，得到 %q", f.RedirectURIs)
	}
	if !f.GrantAuthCode || !f.GrantRefresh || !f.GrantClientCred {
		t.Errorf("核取狀態預填不符：%+v", f)
	}
	// 預填後再以 redirectURIList 解析應還原為原清單（textarea 往返）。
	want := []string{"https://a.example.com/cb", "com.example.app:/cb"}
	if got := f.redirectURIList(); !reflect.DeepEqual(got, want) {
		t.Errorf("redirectURIList = %v, want %v", got, want)
	}
}

// renderAdminApplicationsPage 需要資料庫，模板輸出直接以假資料渲染測試。
func TestAdminApplicationsTemplate(t *testing.T) {
	data := adminApplicationsPageData{
		Username: "alice", Email: "alice@example.com", CSRF: "token-A",
		Apps: []adminApplicationRow{
			{ID: 9, ClientID: "cid-conf", Name: "官方網站", Type: "confidential",
				RedirectURIs: "https://app.example.com/cb", GrantTypes: "authorization_code、refresh_token",
				Scope: "openid offline_access", CreatedAt: "2026-10-02 12:00:00 +08:00", Confidential: true},
			{ID: 5, ClientID: "cid-pub", Name: "行動 App", Type: "public",
				RedirectURIs: "com.example.app:/cb", GrantTypes: "authorization_code",
				Scope: "openid", CreatedAt: "2026-10-01 12:00:00 +08:00"},
		},
	}
	rec := httptest.NewRecorder()
	auth.RenderHTML(rec, http.StatusOK, auth.AdminApplicationsTmpl, data)
	body := rec.Body.String()
	for _, want := range []string{
		"應用程式管理",                                // 標題
		`href="/admin/applications/new"`,        // 註冊新應用程式按鈕（獨立頁）
		`href="/admin/applications/9"`,          // 編輯連結（機密式）
		`href="/admin/applications/5"`,          // 編輯連結（公開式）
		`value="token-A"`,                       // CSRF 隱藏欄位
		`action="/admin/applications/9/secret"`, // 機密式的輪替表單
		`action="/admin/applications/9/delete"`, // 刪除表單
		`action="/admin/applications/5/delete"`,
		"cid-conf", "cid-pub", // client_id 欄
		"機密式", "公開式", // 類型徽章
		`href="/admin/applications" aria-current="page"`, // 導覽（目前頁）
		`href="/admin/keys"`,                             // 導覽（金鑰管理）
		`href="/login"`,                                  // 導覽（帳號資訊）
		`action="/logout"`,                               // 側欄頁尾登出表單（版面預設）
		"alice@example.com",
	} {
		if !strings.Contains(body, want) {
			t.Errorf("應用程式管理頁缺少 %s", want)
		}
	}
	for _, absent := range []string{
		"/admin/applications/5/secret", // 公開式無 secret，不應出現輪替表單
		"尚無應用程式",
		"只顯示這一次",                       // 未輪替 secret 時不出現明文面板
		`name="redirect_uris"`,         // 註冊表單已獨立於 /admin/applications/new
		`action="/admin/applications"`, // 註冊不再 POST 到列表頁
	} {
		if strings.Contains(body, absent) {
			t.Errorf("頁面不應出現 %s", absent)
		}
	}
}

// 註冊頁模板：表單欄位與送出目標，導覽同管理頁。
func TestAdminApplicationNewTemplate(t *testing.T) {
	data := adminApplicationNewPageData{
		Username: "alice", Email: "alice@example.com", CSRF: "token-N",
		Form: newApplicationForm(),
	}
	rec := httptest.NewRecorder()
	auth.RenderHTML(rec, http.StatusOK, auth.AdminApplicationNewTmpl, data)
	body := rec.Body.String()
	for _, want := range []string{
		"註冊新應用程式",                          // 標題
		`action="/admin/applications/new"`, // 表單送回本頁
		`value="token-N"`,                  // CSRF 隱藏欄位
		`name="name"`,
		`name="redirect_uris"`,
		`value="authorization_code"`, // grant type 核取方塊（預設勾選）
		`checked`,                    // 預設勾選狀態
		`href="/admin/applications" aria-current="page"`, // 導覽（目前頁同管理頁）
		`href="/admin/keys"`,
		`href="/login"`,
		`action="/logout"`,
		"alice@example.com",
	} {
		if !strings.Contains(body, want) {
			t.Errorf("註冊頁缺少 %s", want)
		}
	}
	if strings.Contains(body, "只顯示這一次") {
		t.Error("未註冊成功時不應出現明文面板")
	}
}

// 註冊機密式成功的一次性明文 client secret 面板（渲染於註冊頁）。
func TestAdminApplicationNewTemplateSecretPanel(t *testing.T) {
	data := adminApplicationNewPageData{
		Username: "alice", Email: "alice@example.com", CSRF: "token-N",
		Form:   newApplicationForm(),
		Secret: &secretPanel{Name: "官方網站", ClientID: "cid-conf", Secret: "plain-secret-value"},
	}
	rec := httptest.NewRecorder()
	auth.RenderHTML(rec, http.StatusOK, auth.AdminApplicationNewTmpl, data)
	body := rec.Body.String()
	for _, want := range []string{"已註冊", "只顯示這一次", "cid-conf", "plain-secret-value"} {
		if !strings.Contains(body, want) {
			t.Errorf("secret 面板缺少 %s", want)
		}
	}
	if strings.Contains(body, "已輪替") {
		t.Error("註冊面板不應出現輪替文案")
	}
}

// 註冊公開式成功的面板：無明文 secret，改顯示 PKCE 提示。
func TestAdminApplicationNewTemplatePublicPanel(t *testing.T) {
	data := adminApplicationNewPageData{
		Username: "alice", Email: "alice@example.com", CSRF: "token-N",
		Form:   newApplicationForm(),
		Secret: &secretPanel{Name: "行動 App", ClientID: "cid-pub", Public: true},
	}
	rec := httptest.NewRecorder()
	auth.RenderHTML(rec, http.StatusOK, auth.AdminApplicationNewTmpl, data)
	body := rec.Body.String()
	for _, want := range []string{"行動 App 已註冊", "PKCE", "cid-pub"} {
		if !strings.Contains(body, want) {
			t.Errorf("公開式面板缺少 %s", want)
		}
	}
	for _, absent := range []string{"只顯示這一次", "client_secret"} {
		if strings.Contains(body, absent) {
			t.Errorf("公開式面板不應出現 %s", absent)
		}
	}
}

// 編輯頁模板：唯讀欄位（client_id）、預填表單與送出目標；無一次性面板。
func TestAdminApplicationEditTemplate(t *testing.T) {
	data := adminApplicationEditPageData{
		Username: "alice", Email: "alice@example.com", CSRF: "token-E",
		ID: 9, ClientID: "cid-conf", Created: "2026-10-02 12:00:00 +08:00",
		Form: applicationFormFromApp(&application.Application{
			Name:         "官方網站",
			Type:         application.ClientConfidential,
			RedirectURIs: application.RedirectURIs{"https://app.example.com/cb"},
			GrantTypes:   application.GrantTypes{application.GrantAuthorizationCode, application.GrantRefreshToken},
			Scope:        "openid offline_access",
		}),
	}
	rec := httptest.NewRecorder()
	auth.RenderHTML(rec, http.StatusOK, auth.AdminApplicationEditTmpl, data)
	body := rec.Body.String()
	for _, want := range []string{
		"編輯應用程式",                                         // 標題
		`action="/admin/applications/9"`,                 // 表單送回本頁
		`value="token-E"`,                                // CSRF 隱藏欄位
		"cid-conf",                                       // client_id 唯讀顯示
		"2026-10-02 12:00:00 +08:00",                 // 建立時間（html/template 將 + 轉義）
		`value="官方網站"`,                                   // 名稱預填
		`>https://app.example.com/cb</textarea>`,         // redirect URI 預填
		`value="openid offline_access"`,                  // scope 預填
		"checked",                                        // 已啟用 grant type 的核取狀態
		"儲存變更",                                           // 送出按鈕
		`href="/admin/applications" aria-current="page"`, // 導覽（目前頁同管理頁）
		`href="/admin/keys"`,
		`href="/login"`,
		`action="/logout"`,
		"alice@example.com",
	} {
		if !strings.Contains(body, want) {
			t.Errorf("編輯頁缺少 %s", want)
		}
	}
	for _, absent := range []string{
		"只顯示這一次",                           // 編輯無一次性面板
		"已儲存變更",                            // 未帶 ?saved=1 時不出現成功訊息
		`action="/admin/applications/new"`, // 不應送回註冊頁
	} {
		if strings.Contains(body, absent) {
			t.Errorf("編輯頁不應出現 %s", absent)
		}
	}
}

// PRG（?saved=1）後的編輯頁顯示成功訊息。
func TestAdminApplicationEditTemplateSaved(t *testing.T) {
	data := adminApplicationEditPageData{
		Username: "alice", Email: "alice@example.com", CSRF: "token-E",
		ID: 9, ClientID: "cid-conf", Success: "已儲存變更",
		Form: applicationFormFromApp(&application.Application{
			Name: "官方網站", Type: application.ClientConfidential,
			RedirectURIs: application.RedirectURIs{"https://app.example.com/cb"},
		}),
	}
	rec := httptest.NewRecorder()
	auth.RenderHTML(rec, http.StatusOK, auth.AdminApplicationEditTmpl, data)
	if body := rec.Body.String(); !strings.Contains(body, "已儲存變更") {
		t.Error("帶 Success 時應顯示成功訊息")
	}
}

// 輪替成功的一次性明文面板（渲染於管理列表頁）。
func TestAdminApplicationsTemplateRotatePanel(t *testing.T) {
	data := adminApplicationsPageData{
		Username: "alice", Email: "alice@example.com", CSRF: "token-A",
		Secret: &secretPanel{Name: "官方網站", ClientID: "cid-conf", Secret: "plain-secret-value", Rotated: true},
	}
	rec := httptest.NewRecorder()
	auth.RenderHTML(rec, http.StatusOK, auth.AdminApplicationsTmpl, data)
	body := rec.Body.String()
	for _, want := range []string{"已輪替", "只顯示這一次", "cid-conf", "plain-secret-value"} {
		if !strings.Contains(body, want) {
			t.Errorf("輪替面板缺少 %s", want)
		}
	}
}

// 無應用程式時顯示空狀態提示（註冊表單已獨立，不再內嵌於列表頁）。
func TestAdminApplicationsTemplateEmpty(t *testing.T) {
	data := adminApplicationsPageData{
		Username: "alice", Email: "alice@example.com", CSRF: "token-A",
	}
	rec := httptest.NewRecorder()
	auth.RenderHTML(rec, http.StatusOK, auth.AdminApplicationsTmpl, data)
	body := rec.Body.String()
	if !strings.Contains(body, "尚無應用程式") {
		t.Error("應顯示空狀態提示")
	}
	if !strings.Contains(body, `href="/admin/applications/new"`) {
		t.Error("空狀態仍應提供前往註冊頁的按鈕")
	}
	if strings.Contains(body, `name="redirect_uris"`) {
		t.Error("列表頁不應內嵌註冊表單")
	}
}

// --- 整合測試：需要本機 PostgreSQL，連不上時跳過 ---

// secretInBody 從頁面抽出一次性明文 client secret：面板以 <code>/<dd> 包裹
// 43 字元 base64url（CSRF token 在屬性值內、client_id 僅 22 字元，皆不符）。
var secretInBody = regexp.MustCompile(`>([A-Za-z0-9_-]{43})<`)

func TestAdminApplicationsIntegration(t *testing.T) {
	db := testdb.New(t)

	admin := &auth.User{Username: "appadmin", Email: "appadmin@example.com", Role: auth.RoleAdmin}
	if err := admin.SetPassword("sup3r-secret"); err != nil {
		t.Fatal(err)
	}
	if err := db.Create(admin).Error; err != nil {
		t.Fatal(err)
	}
	member := &auth.User{Username: "appuser", Email: "appuser@example.com", Role: auth.RoleUser}
	if err := member.SetPassword("sup3r-secret"); err != nil {
		t.Fatal(err)
	}
	if err := db.Create(member).Error; err != nil {
		t.Fatal(err)
	}
	adminSess, err := auth.CreateSession(db, admin.ID)
	if err != nil {
		t.Fatal(err)
	}
	memberSess, err := auth.CreateSession(db, member.ID)
	if err != nil {
		t.Fatal(err)
	}

	r := chi.NewRouter()
	r.Get("/admin/applications", ApplicationsPageHandler(db))
	r.Get("/admin/applications/new", ApplicationNewPageHandler(db))
	r.Post("/admin/applications/new", ApplicationsCreateHandler(db))
	r.Get("/admin/applications/{id}", ApplicationEditPageHandler(db))
	r.Post("/admin/applications/{id}", ApplicationUpdateHandler(db))
	r.Post("/admin/applications/{id}/secret", ApplicationsRotateSecretHandler(db))
	r.Post("/admin/applications/{id}/delete", ApplicationsDeleteHandler(db))

	appCount := func(t *testing.T) int64 {
		t.Helper()
		var n int64
		if err := db.Model(&application.Application{}).Count(&n).Error; err != nil {
			t.Fatal(err)
		}
		return n
	}

	t.Run("非 admin 存取回 403", func(t *testing.T) {
		for _, path := range []string{"/admin/applications", "/admin/applications/new", "/admin/applications/1"} {
			rec := httptest.NewRecorder()
			r.ServeHTTP(rec, adminGet(path, memberSess))
			if rec.Code != http.StatusForbidden {
				t.Fatalf("GET %s status = %d, want 403", path, rec.Code)
			}
		}
	})

	t.Run("admin 首次檢視為空狀態", func(t *testing.T) {
		rec := httptest.NewRecorder()
		r.ServeHTTP(rec, adminGet("/admin/applications", adminSess))
		if rec.Code != http.StatusOK {
			t.Fatalf("status = %d", rec.Code)
		}
		if !strings.Contains(rec.Body.String(), "尚無應用程式") {
			t.Fatalf("應顯示空狀態提示：%s", rec.Body.String())
		}
	})

	t.Run("admin 檢視註冊頁含表單", func(t *testing.T) {
		rec := httptest.NewRecorder()
		r.ServeHTTP(rec, adminGet("/admin/applications/new", adminSess))
		if rec.Code != http.StatusOK {
			t.Fatalf("status = %d", rec.Code)
		}
		body := rec.Body.String()
		if !strings.Contains(body, `action="/admin/applications/new"`) || !strings.Contains(body, `name="redirect_uris"`) {
			t.Fatal("註冊頁應含送回本頁的表單")
		}
	})

	// currentCSRF 以一次 GET 取得最新的 CSRF Cookie 與頁面 token（每次
	// 渲染都會輪替）；註冊表單位於 /admin/applications/new。
	currentCSRF := func(t *testing.T) *http.Cookie {
		t.Helper()
		rec := httptest.NewRecorder()
		r.ServeHTTP(rec, adminGet("/admin/applications/new", adminSess))
		if rec.Code != http.StatusOK {
			t.Fatalf("GET /admin/applications/new status = %d", rec.Code)
		}
		return csrfCookieOf(t, rec)
	}

	postForm := func(t *testing.T, path string, vals url.Values) *httptest.ResponseRecorder {
		t.Helper()
		cookie := currentCSRF(t)
		vals.Set("csrf_token", cookie.Value)
		rec := httptest.NewRecorder()
		r.ServeHTTP(rec, adminPost(path, vals.Encode(), adminSess, cookie))
		return rec
	}

	t.Run("CSRF 不符回 403", func(t *testing.T) {
		cookie := currentCSRF(t)
		rec := httptest.NewRecorder()
		r.ServeHTTP(rec, adminPost("/admin/applications/new", "csrf_token=wrong", adminSess, cookie))
		if rec.Code != http.StatusForbidden {
			t.Fatalf("status = %d, want 403", rec.Code)
		}
		if !strings.Contains(rec.Body.String(), "表單驗證失敗") {
			t.Fatal("應顯示 CSRF 錯誤訊息")
		}
	})

	var secret1 string
	t.Run("註冊機密式應用程式顯示一次性 secret", func(t *testing.T) {
		rec := postForm(t, "/admin/applications/new", url.Values{
			"name":          {"官方網站"},
			"type":          {"confidential"},
			"redirect_uris": {"https://app.example.com/oidc/callback"},
			"grant_types":   {"authorization_code", "refresh_token"},
			"scope":         {"openid offline_access"},
		})
		if rec.Code != http.StatusOK {
			t.Fatalf("status = %d, body = %s", rec.Code, rec.Body.String())
		}
		body := rec.Body.String()
		if !strings.Contains(body, "只顯示這一次") {
			t.Fatal("應顯示一次性 secret 面板")
		}
		m := secretInBody.FindStringSubmatch(body)
		if m == nil {
			t.Fatal("頁面應包含 43 字元明文 client secret")
		}
		secret1 = m[1]

		var app application.Application
		if err := db.First(&app).Error; err != nil {
			t.Fatal(err)
		}
		if app.Name != "官方網站" || app.IsPublic() || !app.CheckSecret(secret1) {
			t.Errorf("儲存的應用程式與表單輸入不符或 secret 驗證失敗：%+v", app)
		}
		if !app.GrantTypes.Contains(application.GrantRefreshToken) {
			t.Errorf("應啟用 refresh_token，得到 %v", app.GrantTypes)
		}
		if !strings.Contains(body, app.ClientID) {
			t.Error("頁面應顯示新註冊的 client_id")
		}
		if n := appCount(t); n != 1 {
			t.Fatalf("資料庫應用程式數 = %d, want 1", n)
		}
	})

	t.Run("註冊驗證失敗回 400 並保留輸入", func(t *testing.T) {
		rec := postForm(t, "/admin/applications/new", url.Values{
			"name":          {"後台系統"},
			"type":          {"confidential"},
			"redirect_uris": {"http://app.example.com/cb"}, // 非 loopback 的 http
		})
		if rec.Code != http.StatusBadRequest {
			t.Fatalf("status = %d, want 400, body = %s", rec.Code, rec.Body.String())
		}
		body := rec.Body.String()
		if !strings.Contains(body, "loopback") {
			t.Fatal("應顯示 redirect URI 驗證錯誤")
		}
		if !strings.Contains(body, `value="後台系統"`) {
			t.Fatal("重繪時應保留已輸入的名稱")
		}
		if n := appCount(t); n != 1 {
			t.Fatalf("驗證失敗不應寫入，資料庫應用程式數 = %d, want 1", n)
		}
	})

	var publicApp application.Application
	t.Run("註冊公開式應用程式顯示 PKCE 面板", func(t *testing.T) {
		rec := postForm(t, "/admin/applications/new", url.Values{
			"name":          {"行動 App"},
			"type":          {"public"},
			"redirect_uris": {"com.example.app:/cb"},
		})
		if rec.Code != http.StatusOK {
			t.Fatalf("status = %d, body = %s", rec.Code, rec.Body.String())
		}
		body := rec.Body.String()
		if !strings.Contains(body, "行動 App 已註冊") || !strings.Contains(body, "PKCE") {
			t.Fatal("公開式註冊成功應顯示 PKCE 面板")
		}
		if strings.Contains(body, "只顯示這一次") {
			t.Fatal("公開式無 client secret，不應顯示明文警告")
		}
		if err := db.Where("type = ?", application.ClientPublic).First(&publicApp).Error; err != nil {
			t.Fatal(err)
		}
		if !strings.Contains(body, publicApp.ClientID) {
			t.Error("面板應顯示新註冊的 client_id")
		}
		if n := appCount(t); n != 2 {
			t.Fatalf("資料庫應用程式數 = %d, want 2", n)
		}
	})

	t.Run("輪替機密式 secret", func(t *testing.T) {
		var conf application.Application
		if err := db.Where("type = ?", application.ClientConfidential).First(&conf).Error; err != nil {
			t.Fatal(err)
		}
		rec := postForm(t, fmt.Sprintf("/admin/applications/%d/secret", conf.ID), url.Values{})
		if rec.Code != http.StatusOK {
			t.Fatalf("status = %d, body = %s", rec.Code, rec.Body.String())
		}
		m := secretInBody.FindStringSubmatch(rec.Body.String())
		if m == nil {
			t.Fatal("輪替後應顯示新的明文 client secret")
		}

		var reloaded application.Application
		if err := db.First(&reloaded, conf.ID).Error; err != nil {
			t.Fatal(err)
		}
		if reloaded.CheckSecret(secret1) {
			t.Error("輪替後舊 client secret 應失效")
		}
		if !reloaded.CheckSecret(m[1]) {
			t.Error("新 client secret 應可驗證")
		}
	})

	t.Run("輪替公開式回 409", func(t *testing.T) {
		rec := postForm(t, fmt.Sprintf("/admin/applications/%d/secret", publicApp.ID), url.Values{})
		if rec.Code != http.StatusConflict {
			t.Fatalf("status = %d, want 409, body = %s", rec.Code, rec.Body.String())
		}
		if !strings.Contains(rec.Body.String(), "公開式 Client 不持有 client secret") {
			t.Fatal("應顯示公開式不可輪替的訊息")
		}
	})

	t.Run("刪除應用程式後 PRG 導回", func(t *testing.T) {
		rec := postForm(t, fmt.Sprintf("/admin/applications/%d/delete", publicApp.ID), url.Values{})
		if rec.Code != http.StatusSeeOther {
			t.Fatalf("status = %d, want 303, body = %s", rec.Code, rec.Body.String())
		}
		if loc := rec.Header().Get("Location"); loc != "/admin/applications" {
			t.Fatalf("Location = %q, want /admin/applications", loc)
		}
		if n := appCount(t); n != 1 {
			t.Fatalf("刪除後資料庫應用程式數 = %d, want 1", n)
		}

		rec = httptest.NewRecorder()
		r.ServeHTTP(rec, adminGet("/admin/applications", adminSess))
		if strings.Contains(rec.Body.String(), "行動 App") {
			t.Error("刪除後列表不應再出現該應用程式")
		}
	})

	t.Run("刪除不存在的應用程式回 404", func(t *testing.T) {
		rec := postForm(t, "/admin/applications/99999/delete", url.Values{})
		if rec.Code != http.StatusNotFound {
			t.Fatalf("status = %d, want 404", rec.Code)
		}
		if !strings.Contains(rec.Body.String(), "應用程式不存在") {
			t.Fatal("應顯示應用程式不存在")
		}
	})

	// 以下編輯流程子測試：此時資料庫僅剩註冊時輪替過一次 secret 的機密式
	// 應用程式（公開式已於前述子測試刪除）。
	confidential := func(t *testing.T) application.Application {
		t.Helper()
		var a application.Application
		if err := db.Where("type = ?", application.ClientConfidential).First(&a).Error; err != nil {
			t.Fatal(err)
		}
		return a
	}

	t.Run("編輯頁預填既有註冊內容", func(t *testing.T) {
		conf := confidential(t)
		rec := httptest.NewRecorder()
		r.ServeHTTP(rec, adminGet(fmt.Sprintf("/admin/applications/%d", conf.ID), adminSess))
		if rec.Code != http.StatusOK {
			t.Fatalf("status = %d, body = %s", rec.Code, rec.Body.String())
		}
		body := rec.Body.String()
		for _, want := range []string{
			fmt.Sprintf(`action="/admin/applications/%d"`, conf.ID),
			conf.ClientID,               // 唯讀顯示
			`value="` + conf.Name + `"`, // 名稱預填
			conf.RedirectURIs[0],        // redirect URI 預填
		} {
			if !strings.Contains(body, want) {
				t.Errorf("編輯頁缺少 %s", want)
			}
		}
	})

	t.Run("編輯不存在的應用程式回 404", func(t *testing.T) {
		rec := httptest.NewRecorder()
		r.ServeHTTP(rec, adminGet("/admin/applications/99999", adminSess))
		if rec.Code != http.StatusNotFound {
			t.Fatalf("status = %d, want 404", rec.Code)
		}
		if !strings.Contains(rec.Body.String(), "應用程式不存在") {
			t.Fatal("應顯示應用程式不存在")
		}
	})

	t.Run("編輯儲存後 PRG 並更新資料庫", func(t *testing.T) {
		conf := confidential(t)
		rec := postForm(t, fmt.Sprintf("/admin/applications/%d", conf.ID), url.Values{
			"name":          {"官方網站 2.0"},
			"type":          {"confidential"},
			"redirect_uris": {"https://app.example.com/oidc/callback\nhttps://alt.example.com/cb"},
			"grant_types":   {"authorization_code", "refresh_token", "client_credentials"},
			"scope":         {"openid profile email offline_access"},
		})
		if rec.Code != http.StatusSeeOther {
			t.Fatalf("status = %d, want 303, body = %s", rec.Code, rec.Body.String())
		}
		if want := fmt.Sprintf("/admin/applications/%d?saved=1", conf.ID); rec.Header().Get("Location") != want {
			t.Fatalf("Location = %q, want %q", rec.Header().Get("Location"), want)
		}

		var reloaded application.Application
		if err := db.First(&reloaded, conf.ID).Error; err != nil {
			t.Fatal(err)
		}
		if reloaded.Name != "官方網站 2.0" || reloaded.ClientID != conf.ClientID {
			t.Errorf("名稱應更新且 client_id 不變：%+v", reloaded)
		}
		if len(reloaded.RedirectURIs) != 2 || !reloaded.RedirectURIs.Contains("https://alt.example.com/cb") {
			t.Errorf("RedirectURIs 應更新，得到 %v", reloaded.RedirectURIs)
		}
		if !reloaded.GrantTypes.Contains(application.GrantClientCredentials) {
			t.Errorf("GrantTypes 應更新，得到 %v", reloaded.GrantTypes)
		}
		if reloaded.ClientSecretHash != conf.ClientSecretHash {
			t.Error("編輯不應更動 client secret 雜湊")
		}
	})

	t.Run("PRG 後的編輯頁顯示成功訊息與新值", func(t *testing.T) {
		conf := confidential(t)
		rec := httptest.NewRecorder()
		r.ServeHTTP(rec, adminGet(fmt.Sprintf("/admin/applications/%d?saved=1", conf.ID), adminSess))
		if rec.Code != http.StatusOK {
			t.Fatalf("status = %d, body = %s", rec.Code, rec.Body.String())
		}
		body := rec.Body.String()
		for _, want := range []string{"已儲存變更", `value="官方網站 2.0"`, "https://alt.example.com/cb"} {
			if !strings.Contains(body, want) {
				t.Errorf("儲存後的編輯頁缺少 %s", want)
			}
		}
	})

	t.Run("編輯驗證失敗回 400 保留輸入且不寫入", func(t *testing.T) {
		conf := confidential(t)
		rec := postForm(t, fmt.Sprintf("/admin/applications/%d", conf.ID), url.Values{
			"name":          {"壞 URI 練習"},
			"type":          {"confidential"},
			"redirect_uris": {"http://app.example.com/cb"}, // 非 loopback 的 http
		})
		if rec.Code != http.StatusBadRequest {
			t.Fatalf("status = %d, want 400, body = %s", rec.Code, rec.Body.String())
		}
		body := rec.Body.String()
		if !strings.Contains(body, "loopback") {
			t.Fatal("應顯示 redirect URI 驗證錯誤")
		}
		if !strings.Contains(body, `value="壞 URI 練習"`) {
			t.Fatal("重繪時應保留已輸入的名稱")
		}
		var reloaded application.Application
		if err := db.First(&reloaded, conf.ID).Error; err != nil {
			t.Fatal(err)
		}
		if reloaded.Name != "官方網站 2.0" {
			t.Errorf("驗證失敗不應寫入，名稱 = %q", reloaded.Name)
		}
	})

	t.Run("改為公開式清除 secret 並停用輪替", func(t *testing.T) {
		conf := confidential(t)
		edit := func(t *testing.T, typ string) {
			t.Helper()
			rec := postForm(t, fmt.Sprintf("/admin/applications/%d", conf.ID), url.Values{
				"name":          {"官方網站 2.0"},
				"type":          {typ},
				"redirect_uris": {"https://app.example.com/oidc/callback"},
			})
			if rec.Code != http.StatusSeeOther {
				t.Fatalf("改為 %s status = %d, body = %s", typ, rec.Code, rec.Body.String())
			}
		}

		edit(t, "public")
		var pub application.Application
		if err := db.First(&pub, conf.ID).Error; err != nil {
			t.Fatal(err)
		}
		if !pub.IsPublic() || pub.ClientSecretHash != "" {
			t.Fatalf("改為公開式後應清除 secret 雜湊：%+v", pub)
		}

		// 公開式不持有 secret，輪替回 409。
		rec := postForm(t, fmt.Sprintf("/admin/applications/%d/secret", conf.ID), url.Values{})
		if rec.Code != http.StatusConflict {
			t.Fatalf("公開式輪替 status = %d, want 409", rec.Code)
		}

		// 改回機密式：雜湊不應復活，須重新輪替取得新 secret。
		edit(t, "confidential")
		var back application.Application
		if err := db.First(&back, conf.ID).Error; err != nil {
			t.Fatal(err)
		}
		if back.IsPublic() || back.ClientSecretHash != "" {
			t.Fatalf("改回機密式不應復活舊 secret 雜湊：%+v", back)
		}
		rec = postForm(t, fmt.Sprintf("/admin/applications/%d/secret", conf.ID), url.Values{})
		if rec.Code != http.StatusOK {
			t.Fatalf("改回機密式後輪替 status = %d, body = %s", rec.Code, rec.Body.String())
		}
		m := secretInBody.FindStringSubmatch(rec.Body.String())
		if m == nil {
			t.Fatal("輪替後應顯示新的明文 client secret")
		}
		var rotated application.Application
		if err := db.First(&rotated, conf.ID).Error; err != nil {
			t.Fatal(err)
		}
		if !rotated.CheckSecret(m[1]) {
			t.Error("重新輪替的新 client secret 應可驗證")
		}
	})
}