fluxer/fluxer_admin/tests/htmx_acceptance.rs

// SPDX-License-Identifier: AGPL-3.0-or-later

#![recursion_limit = "256"]

use axum::{
    Json, Router,
    body::{Body, to_bytes},
    http::{HeaderMap, Method, Request, StatusCode, Uri, header},
    response::{IntoResponse, Response},
    routing,
};
use fluxer_admin::{
    api::generated::types as generated_types,
    build_router,
    config::{AdminConfig, ProxyConfig},
    session,
};
use serde_json::{Value, json};
use std::sync::{Arc, Mutex};
use tokio::net::TcpListener;
use tower::ServiceExt;

const SECRET_KEY: &str = "htmx-acceptance-test-secret";
const ADMIN_API_KEY_SECRET: &str = "fa_1900000000000000001_OneTimeSecretForAcceptance";

struct TestApp {
    router: Router,
    session_cookie: String,
}

#[tokio::test]
async fn report_legal_hold_form_places_and_clears_the_hold() {
    let received = Arc::new(Mutex::new(Vec::<Value>::new()));
    let sink = received.clone();
    let api = Router::new()
        .route(
            "/admin/reports/1800000000000000001/legal-hold",
            routing::post(move |Json(body): Json<Value>| {
                let sink = sink.clone();
                async move {
                    sink.lock().unwrap().push(body.clone());
                    if body["legal_hold_reason"] == "rejected" {
                        return (
                            StatusCode::BAD_REQUEST,
                            Json(json!({"code": "INVALID_FORM_BODY", "message": "Invalid"})),
                        )
                            .into_response();
                    }
                    json_response(json!({
                        "report_id": "1800000000000000001",
                        "legal_hold_until": body["legal_hold_until"],
                        "legal_hold_reason": body["legal_hold_reason"]
                    }))
                }
            }),
        )
        .fallback(mock_api);
    let app = setup_with_api(api).await;
    let (headers, page) = get_with_headers(&app, "/reports/1800000000000000001", &[]).await;
    let csrf_token = csrf_cookie(&headers)
        .unwrap_or_else(|| panic!("report page did not set csrf_token cookie\n{page}"));
    assert_form_has_csrf(
        &page,
        "/reports/1800000000000000001/legal-hold",
        &csrf_token,
    );
    let cookie = format!("{}; csrf_token={}", app.session_cookie, csrf_token);
    let post = |body: String| {
        let app = &app;
        let cookie = cookie.clone();
        async move {
            let (status, headers, text) = post_form_with_headers(
                app,
                "/reports/1800000000000000001/legal-hold",
                &[
                    ("HX-Request", "true"),
                    ("HX-Target", "flash-container"),
                    ("Cookie", &cookie),
                ],
                &body,
            )
            .await;
            assert_eq!(status, StatusCode::NO_CONTENT, "{text}");
            headers
                .get("X-Fluxer-Admin-Toast")
                .and_then(|value| value.to_str().ok())
                .unwrap_or_else(|| panic!("missing toast header\n{text}"))
                .to_owned()
        }
    };

    let toast = post(format!(
        "_csrf={csrf_token}&legal_hold_until=2027-01-31&legal_hold_reason=Court+order+42"
    ))
    .await;
    assert!(toast.contains("success"), "{toast}");
    assert!(
        toast.contains("Legal hold placed until Jan 31, 2027, 11:59 PM UTC"),
        "{toast}"
    );
    let toast = post(format!(
        "_csrf={csrf_token}&clear=1&legal_hold_reason=ignored"
    ))
    .await;
    assert!(toast.contains("Legal hold cleared"), "{toast}");
    let toast = post(format!(
        "_csrf={csrf_token}&legal_hold_until=2027-01-31&legal_hold_reason=rejected"
    ))
    .await;
    assert!(toast.contains("error"), "{toast}");
    assert!(toast.contains("The hold must end in the future"), "{toast}");
    assert!(!toast.contains("needs a reason"), "{toast}");
    let toast = post(format!(
        "_csrf={csrf_token}&legal_hold_until=2020-01-01&legal_hold_reason=Past+date"
    ))
    .await;
    assert!(toast.contains("error"), "{toast}");
    assert!(toast.contains("The hold must end in the future"), "{toast}");
    {
        let received = received.lock().unwrap();
        assert_eq!(
            *received,
            vec![
                json!({"legal_hold_until": "2027-01-31T23:59:59.999Z", "legal_hold_reason": "Court order 42"}),
                json!({"legal_hold_until": null, "legal_hold_reason": null}),
                json!({"legal_hold_until": "2027-01-31T23:59:59.999Z", "legal_hold_reason": "rejected"}),
            ]
        );
    }

    let toast = post(format!(
        "_csrf={csrf_token}&legal_hold_until=2027-01-31&legal_hold_reason=+"
    ))
    .await;
    assert!(toast.contains("Give a reason for the hold"), "{toast}");
    let toast = post(format!(
        "_csrf={csrf_token}&legal_hold_until=soon&legal_hold_reason=x"
    ))
    .await;
    assert!(toast.contains("Choose the date the hold ends"), "{toast}");
    assert_eq!(received.lock().unwrap().len(), 3);
}

#[tokio::test]
async fn instance_config_legal_form_round_trips_the_guidelines_url() {
    let patches = Arc::new(Mutex::new(Vec::<Value>::new()));
    let sink = patches.clone();
    let configured = || {
        let mut config = instance_config();
        config["self_hosted"] = json!(true);
        config["app_public"] = json!({
            "branding": {"product_name": "Fluxer", "premium_product_name": "Premium"},
            "setup": {"configured": true},
            "legal": {
                "terms_url": "https://example.com/terms",
                "privacy_url": null,
                "guidelines_url": "https://example.com/community-guidelines"
            },
            "registration": {"collect_date_of_birth": true}
        });
        config
    };
    let api = Router::new()
        .route(
            "/admin/instance/config",
            routing::get(move || async move { json_response(configured()) }).patch(
                move |Json(body): Json<Value>| {
                    let sink = sink.clone();
                    async move {
                        sink.lock().unwrap().push(body);
                        json_response(configured())
                    }
                },
            ),
        )
        .fallback(mock_api);
    let app = setup_with_api(api).await;
    let (headers, page) = get_with_headers(&app, "/instance-config", &[]).await;
    assert!(
        page.contains(r#"id="app_guidelines_url" name="app_guidelines_url" value="https://example.com/community-guidelines""#),
        "{page}"
    );
    assert!(page.contains("Community Guidelines URL"), "{page}");
    let csrf_token = csrf_cookie(&headers)
        .unwrap_or_else(|| panic!("instance config page did not set csrf_token cookie\n{page}"));
    assert_form_has_csrf(
        &page,
        "/instance-config?action=update_app_legal",
        &csrf_token,
    );
    let cookie = format!("{}; csrf_token={}", app.session_cookie, csrf_token);
    for form in [
        format!(
            "_csrf={csrf_token}&app_terms_url=https%3A%2F%2Fexample.com%2Fterms&app_privacy_url=&app_guidelines_url=https%3A%2F%2Frules.example.org%2Fguidelines"
        ),
        format!("_csrf={csrf_token}&app_terms_url=&app_privacy_url=&app_guidelines_url="),
    ] {
        let (status, _, body) = post_form_with_headers(
            &app,
            "/instance-config?action=update_app_legal",
            &[("Cookie", &cookie)],
            &form,
        )
        .await;
        assert!(
            status.is_redirection() || status.is_success(),
            "{status} {body}"
        );
    }
    let patches = patches.lock().unwrap();
    assert_eq!(
        *patches,
        vec![
            json!({"app_public": {"legal": {
                "terms_url": "https://example.com/terms",
                "privacy_url": null,
                "guidelines_url": "https://rules.example.org/guidelines"
            }}}),
            json!({"app_public": {"legal": {
                "terms_url": null,
                "privacy_url": null,
                "guidelines_url": null
            }}}),
        ]
    );
}

#[tokio::test]
async fn limit_rule_reset_form_sends_the_rule_defaults() {
    let updates = Arc::new(Mutex::new(Vec::<Value>::new()));
    let sink = updates.clone();
    let edited = || {
        let mut config = limit_config();
        config["limit_config"]["rules"][0]["limits"]["maxGuilds"] = json!(150);
        config["limit_config"]["rules"][0]["modifiedFields"] = json!(["maxGuilds"]);
        config
    };
    let api = Router::new()
        .route(
            "/admin/limit-config",
            routing::get(move || async move { json_response(edited()) }).put(
                move |Json(body): Json<Value>| {
                    let sink = sink.clone();
                    async move {
                        sink.lock().unwrap().push(body);
                        json_response(limit_config())
                    }
                },
            ),
        )
        .fallback(mock_api);
    let app = setup_with_api(api).await;
    let (headers, page) = get_with_headers(&app, "/limit-config", &[]).await;
    let csrf_token = csrf_cookie(&headers)
        .unwrap_or_else(|| panic!("limit config page did not set csrf_token cookie\n{page}"));
    assert_form_has_csrf(
        &page,
        "/limit-config?action=reset&amp;rule=default",
        &csrf_token,
    );
    let cookie = format!("{}; csrf_token={}", app.session_cookie, csrf_token);
    let (status, _, body) = post_form_with_headers(
        &app,
        "/limit-config?action=reset&rule=default",
        &[("Cookie", &cookie)],
        &format!("_csrf={csrf_token}"),
    )
    .await;
    assert!(
        status.is_redirection() || status.is_success(),
        "{status} {body}"
    );
    assert_eq!(
        *updates.lock().unwrap(),
        vec![json!({"limit_config": {
            "traitDefinitions": [],
            "rules": [{"id": "default", "limits": {"maxGuilds": 100}}]
        }})]
    );
}

#[tokio::test]
async fn report_resolve_form_sends_the_chosen_resolution_and_refuses_none() {
    let received = Arc::new(Mutex::new(Vec::<Value>::new()));
    let sink = received.clone();
    let api = Router::new()
        .route(
            "/admin/reports/1800000000000000001",
            routing::patch(move |Json(body): Json<Value>| {
                let sink = sink.clone();
                async move {
                    sink.lock().unwrap().push(body);
                    json_response(json!({
                        "report_id": "1800000000000000001",
                        "status": 1,
                        "resolved_at": "2026-05-26T12:03:00.000Z",
                        "public_comment": null
                    }))
                }
            })
            .get(|| async { json_response(searched_report()) }),
        )
        .fallback(mock_api);
    let app = setup_with_api(api).await;
    let (headers, page) = get_with_headers(&app, "/reports/1800000000000000001", &[]).await;
    let csrf_token = csrf_cookie(&headers)
        .unwrap_or_else(|| panic!("report page did not set csrf_token cookie\n{page}"));
    assert_form_has_csrf(&page, "/reports/1800000000000000001/resolve", &csrf_token);
    assert!(
        page.contains(r#"<select id="resolution" name="resolution" required"#),
        "{page}"
    );
    let cookie = format!("{}; csrf_token={}", app.session_cookie, csrf_token);
    let post = |body: String| {
        let app = &app;
        let cookie = cookie.clone();
        async move {
            let (status, headers, text) = post_form_with_headers(
                app,
                "/reports/1800000000000000001/resolve",
                &[
                    ("HX-Request", "true"),
                    ("HX-Target", "flash-container"),
                    ("Cookie", &cookie),
                ],
                &body,
            )
            .await;
            assert_eq!(status, StatusCode::NO_CONTENT, "{text}");
            headers
                .get("X-Fluxer-Admin-Toast")
                .and_then(|value| value.to_str().ok())
                .unwrap_or_else(|| panic!("missing toast header\n{text}"))
                .to_owned()
        }
    };

    for (value, label) in [
        ("actioned", "Action taken"),
        ("no_violation", "No violation"),
        ("duplicate", "Duplicate"),
    ] {
        let toast = post(format!("_csrf={csrf_token}&resolution={value}")).await;
        assert!(toast.contains("success"), "{toast}");
        assert!(
            toast.contains(&format!("Report resolved: {label}")),
            "{toast}"
        );
    }
    for refused in [
        format!("_csrf={csrf_token}&public_comment=Looks+fine"),
        format!("_csrf={csrf_token}&resolution=&public_comment=Looks+fine"),
        format!("_csrf={csrf_token}&resolution=auto_resolved"),
    ] {
        let toast = post(refused).await;
        assert!(toast.contains("error"), "{toast}");
        assert!(toast.contains("Choose a resolution"), "{toast}");
    }
    let toast = post(format!(
        "_csrf={csrf_token}&resolution=actioned&public_comment=Removed&notify_reporter_present=1"
    ))
    .await;
    assert!(toast.contains("Report resolved: Action taken"), "{toast}");
    let received = received.lock().unwrap();
    assert_eq!(
        *received,
        vec![
            json!({"status": "resolved", "resolution": "actioned", "notify_reporter": true}),
            json!({"status": "resolved", "resolution": "no_violation", "notify_reporter": true}),
            json!({"status": "resolved", "resolution": "duplicate", "notify_reporter": true}),
            json!({"status": "resolved", "resolution": "actioned", "public_comment": "Removed", "notify_reporter": false}),
        ]
    );
}

#[tokio::test]
async fn report_delete_form_confirms_sends_the_reason_and_toasts_a_held_report() {
    let received = Arc::new(Mutex::new(Vec::<Option<String>>::new()));
    let sink = received.clone();
    let api = Router::new()
        .route(
            "/admin/reports/1800000000000000001",
            routing::delete(move |headers: HeaderMap| {
                let sink = sink.clone();
                async move {
                    let reason = headers
                        .get("X-Audit-Log-Reason")
                        .and_then(|value| value.to_str().ok())
                        .map(str::to_owned);
                    sink.lock().unwrap().push(reason.clone());
                    if reason.as_deref() == Some("held") {
                        return (
                            StatusCode::CONFLICT,
                            Json(json!({
                                "code": "REPORT_UNDER_LEGAL_HOLD",
                                "message": "This report is under a legal hold and can't be deleted."
                            })),
                        )
                            .into_response();
                    }
                    StatusCode::NO_CONTENT.into_response()
                }
            })
            .get(|| async { json_response(searched_report()) }),
        )
        .fallback(mock_api);
    let app = setup_with_api(api).await;
    let (headers, page) = get_with_headers(&app, "/reports/1800000000000000001", &[]).await;
    let csrf_token = csrf_cookie(&headers)
        .unwrap_or_else(|| panic!("report page did not set csrf_token cookie\n{page}"));
    assert_form_has_csrf(&page, "/reports/1800000000000000001/delete", &csrf_token);
    let cookie = format!("{}; csrf_token={}", app.session_cookie, csrf_token);
    let post = |body: String| {
        let app = &app;
        let cookie = cookie.clone();
        async move {
            post_form_with_headers(
                app,
                "/reports/1800000000000000001/delete",
                &[
                    ("HX-Request", "true"),
                    ("HX-Target", "flash-container"),
                    ("Cookie", &cookie),
                ],
                &body,
            )
            .await
        }
    };
    let toast = |headers: &HeaderMap| {
        headers
            .get("X-Fluxer-Admin-Toast")
            .and_then(|value| value.to_str().ok())
            .unwrap_or_else(|| panic!("missing toast header {headers:?}"))
            .to_owned()
    };

    let (status, headers, text) = post(format!(
        "_csrf={csrf_token}&audit_log_reason=Erasure+request"
    ))
    .await;
    assert_eq!(status, StatusCode::NO_CONTENT, "{text}");
    let message = toast(&headers);
    assert!(message.contains("error"), "{message}");
    assert!(
        message.contains("Confirm that the report should be deleted"),
        "{message}"
    );
    assert!(headers.get("HX-Redirect").is_none(), "{headers:?}");

    let (status, headers, text) = post(format!(
        "_csrf={csrf_token}&confirm=true&audit_log_reason=Erasure+request"
    ))
    .await;
    assert_eq!(status, StatusCode::NO_CONTENT, "{text}");
    assert_eq!(
        headers.get("HX-Redirect").and_then(|v| v.to_str().ok()),
        Some("/reports"),
        "{headers:?}"
    );
    let message = toast(&headers);
    assert!(message.contains("success"), "{message}");
    assert!(message.contains("Report deleted"), "{message}");
    assert!(
        headers
            .get_all(header::SET_COOKIE)
            .iter()
            .any(|value| value.to_str().is_ok_and(|v| v.starts_with("flash="))),
        "{headers:?}"
    );

    let (status, headers, text) = post(format!(
        "_csrf={csrf_token}&confirm=true&audit_log_reason=held"
    ))
    .await;
    assert_eq!(status, StatusCode::NO_CONTENT, "{text}");
    assert!(headers.get("HX-Redirect").is_none(), "{headers:?}");
    let message = toast(&headers);
    assert!(message.contains("error"), "{message}");
    assert!(
        message.contains("The report is under a legal hold. Clear the hold before deleting it."),
        "{message}"
    );

    let (status, headers, text) = post_form_with_headers(
        &app,
        "/reports/1800000000000000001/delete",
        &[("Cookie", &cookie)],
        &format!("_csrf={csrf_token}&confirm=true&audit_log_reason=+"),
    )
    .await;
    assert!(status.is_redirection(), "{status} {text}");
    assert_eq!(
        headers.get(header::LOCATION).and_then(|v| v.to_str().ok()),
        Some("/reports"),
        "{headers:?}"
    );

    assert_eq!(
        *received.lock().unwrap(),
        vec![
            Some("Erasure request".to_owned()),
            Some("held".to_owned()),
            None
        ]
    );
}

async fn setup_with_api(api: Router) -> TestApp {
    let api_endpoint = spawn_mock_api(api).await;
    let router = build_router(test_config(api_endpoint));
    let session_value = session::create_session("1500000000000000000", "test-token", SECRET_KEY);
    TestApp {
        router,
        session_cookie: format!("{}={session_value}", session::SESSION_COOKIE_NAME),
    }
}

async fn get_with_headers(
    app: &TestApp,
    uri: &str,
    headers: &[(&str, &str)],
) -> (HeaderMap, String) {
    let mut builder = Request::builder()
        .method(Method::GET)
        .uri(uri)
        .header(header::COOKIE, &app.session_cookie);
    for (name, value) in headers {
        builder = builder.header(*name, *value);
    }
    let response = app
        .router
        .clone()
        .oneshot(builder.body(Body::empty()).unwrap())
        .await
        .unwrap();
    let status = response.status();
    let headers = response.headers().clone();
    let body = to_bytes(response.into_body(), usize::MAX).await.unwrap();
    let text = String::from_utf8(body.to_vec()).unwrap();
    assert_eq!(status, StatusCode::OK, "{text}");
    (headers, text)
}

async fn post_form_with_headers(
    app: &TestApp,
    uri: &str,
    headers: &[(&str, &str)],
    body: &str,
) -> (StatusCode, HeaderMap, String) {
    let has_cookie_header = headers
        .iter()
        .any(|(name, _)| name.eq_ignore_ascii_case("cookie"));
    let mut builder = Request::builder()
        .method(Method::POST)
        .uri(uri)
        .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded");
    if !has_cookie_header {
        builder = builder.header(header::COOKIE, &app.session_cookie);
    }
    for (name, value) in headers {
        builder = builder.header(*name, *value);
    }
    let response = app
        .router
        .clone()
        .oneshot(builder.body(Body::from(body.to_owned())).unwrap())
        .await
        .unwrap();
    let status = response.status();
    let headers = response.headers().clone();
    let body = to_bytes(response.into_body(), usize::MAX).await.unwrap();
    let text = String::from_utf8(body.to_vec()).unwrap();
    (status, headers, text)
}

fn csrf_cookie(headers: &HeaderMap) -> Option<String> {
    headers
        .get_all(header::SET_COOKIE)
        .iter()
        .filter_map(|value| value.to_str().ok())
        .find_map(|value| {
            let pair = value.split(';').next()?;
            let token = pair
                .strip_prefix("__Host-csrf_token=")
                .or_else(|| pair.strip_prefix("csrf_token="))?;
            (!token.is_empty()).then(|| token.to_owned())
        })
}

fn assert_form_has_csrf(body: &str, action: &str, csrf_token: &str) {
    let marker = format!(r#"action="{action}""#);
    let Some(action_index) = body.find(&marker) else {
        panic!("missing form action {action:?}\n{body}");
    };
    let csrf_marker = format!(r#"name="_csrf" value="{csrf_token}""#);
    let tail = &body[action_index..];
    let form = tail.find("</form>").map(|end| &tail[..end]).unwrap_or(tail);
    assert!(
        form.contains(&csrf_marker),
        "form {action:?} did not include matching CSRF token {csrf_token:?}\n{body}"
    );
}

async fn spawn_mock_api(api: Router) -> String {
    let listener = TcpListener::bind(("127.0.0.1", 0)).await.unwrap();
    let addr = listener.local_addr().unwrap();
    tokio::spawn(async move {
        axum::serve(listener, api).await.unwrap();
    });
    format!("http://{addr}")
}

async fn mock_api(method: Method, uri: Uri) -> Response {
    let path = uri.path().to_owned();
    if method == Method::PATCH && path == "/admin/instance/config" {
        return json_response(instance_config());
    }
    match (method, path.as_str()) {
        (Method::GET, "/admin/users/@me") => json_response(json!({ "user": admin_user() })),
        (Method::GET, "/admin/api-keys") => json_response(json!([])),
        (Method::POST, "/admin/api-keys") => json_response(json!({
            "key_id": "1900000000000000001",
            "key": ADMIN_API_KEY_SECRET,
            "name": "Acceptance key",
            "created_at": "2026-07-10T15:00:00.000Z",
            "expires_at": null,
            "acls": ["*"]
        })),
        (Method::GET, "/admin/users") => {
            json_response(json!({ "users": [searched_user()], "total": 1 }))
        }
        (Method::GET, "/admin/users/1500000000000000001") => {
            json_response(json!({ "users": [searched_user()] }))
        }
        (Method::POST, "/admin/users/1500000000000000001/password-reset") => {
            StatusCode::NO_CONTENT.into_response()
        }
        (Method::GET, "/admin/guilds") => {
            json_response(json!({ "guilds": [searched_guild()], "total": 1 }))
        }
        (Method::GET, "/admin/guilds/1600000000000000001") => {
            json_response(json!({ "guild": searched_guild_detail() }))
        }
        (Method::GET, "/admin/applications") => {
            json_response(json!({ "applications": [searched_application()] }))
        }
        (Method::GET, "/admin/reports")
            if query_value(&uri, "reason").as_deref() == Some("csam") =>
        {
            json_response(json!({
                "reports": [flow_report()],
                "total": 60,
                "offset": 0,
                "limit": 25
            }))
        }
        (Method::GET, "/admin/reports")
            if query_value(&uri, "category").as_deref() == Some("future_value") =>
        {
            json_response(json!({
                "reports": [future_category_report()],
                "total": 60,
                "offset": 0,
                "limit": 25
            }))
        }
        (Method::GET, "/admin/reports")
            if query_value(&uri, "reported_webhook_id").as_deref() == Some(WEBHOOK_ID) =>
        {
            json_response(json!({
                "reports": [webhook_report()],
                "total": 60,
                "offset": 0,
                "limit": 25
            }))
        }
        (Method::GET, "/admin/reports") => json_response(
            json!({ "reports": [searched_report()], "total": 1, "offset": 0, "limit": 25 }),
        ),
        (Method::GET, "/admin/report-reasons") => json_response(report_reasons()),
        (Method::GET, "/admin/reports/1800000000000000001") => json_response(searched_report()),
        (Method::GET, "/admin/reports/1800000000000000003") => json_response(flow_report()),
        (Method::GET, "/admin/reports/1800000000000000004") => json_response(webhook_report()),
        (Method::GET, "/admin/reports/1800000000000000005") => {
            json_response(future_status_report())
        }
        (Method::GET, "/admin/reports/1800000000000000002") => {
            json_response(searched_message_report())
        }
        (Method::PATCH, "/admin/reports/1800000000000000001") => json_response(json!({
            "report_id": "1800000000000000001",
            "status": 1,
            "resolved_at": "2026-05-26T12:03:00.000Z",
            "public_comment": "done"
        })),
        (Method::GET, "/admin/jobs") => {
            json_response(json!({ "jobs": [searched_job()], "next_cursor": null, "cursor": null }))
        }
        (Method::GET, "/admin/jobs/1900000000000000001") => {
            json_response(json!({ "job": searched_job() }))
        }
        (Method::GET, "/admin/instance/config") => json_response(instance_config()),
        (Method::POST, "/admin/instance/registration-urls") => json_response(json!({
            "registration_url": registration_url_fixture(),
            "code": "11111111-1111-4111-8111-111111111111",
            "url": "https://app.example.test/register?registration_url=11111111-1111-4111-8111-111111111111"
        })),
        (Method::DELETE, path) if path.starts_with("/admin/instance/registration-urls/") => {
            json_response(instance_config_without_registration_urls())
        }
        (Method::PATCH, path) if path.starts_with("/admin/instance/pending-registrations/") => {
            json_response(instance_config_without_pending_registrations())
        }
        (Method::GET, "/admin/limit-config") => json_response(limit_config()),
        (Method::GET, "/admin/audit-logs") => {
            let access = uri.query().and_then(|query| {
                url::form_urlencoded::parse(query.as_bytes())
                    .find(|(key, _)| key == "access")
                    .map(|(_, value)| value.into_owned())
            });
            let logs = [
                audit_log_entry("1900000000000000101", "get_user", "read"),
                audit_log_entry("1900000000000000102", "temp_ban", "write"),
            ]
            .into_iter()
            .filter(|entry| {
                access
                    .as_deref()
                    .is_none_or(|access| entry.access.to_string() == access)
            })
            .collect::<Vec<_>>();
            json_response(json!({ "total": logs.len(), "logs": logs }))
        }
        _ => (StatusCode::NOT_FOUND, Json(json!({ "error": "not found" }))).into_response(),
    }
}

fn query_value(uri: &Uri, name: &str) -> Option<String> {
    uri.query().and_then(|query| {
        url::form_urlencoded::parse(query.as_bytes())
            .find(|(key, _)| key == name)
            .map(|(_, value)| value.into_owned())
    })
}

fn json_response(value: Value) -> Response {
    Json(value).into_response()
}

fn admin_user() -> Value {
    let mut user = user("1500000000000000000", "AdminUser");
    user["acls"] = json!(["*"]);
    user
}

fn searched_user() -> Value {
    user("1500000000000000001", "SearchedUser")
}

fn user(id: &str, username: &str) -> Value {
    json!({
        "id": id,
        "username": username,
        "discriminator": 1,
        "avatar": null,
        "banner": null,
        "email": "[email protected]",
        "email_verified": true,
        "email_bounced": false,
        "global_name": username,
        "bio": null,
        "pronouns": null,
        "accent_color": null,
        "date_of_birth": null,
        "locale": "en-US",
        "acls": [],
        "traits": [],
        "flags": "0",
        "premium_flags": 0,
        "bot": false,
        "system": false,
        "premium_type": null,
        "premium_since": null,
        "premium_until": null,
        "premium_grace_ends_at": null,
        "premium_lifetime_sequence": null,
        "has_totp": false,
        "authenticator_types": [],
        "temp_banned_until": null,
        "pending_deletion_at": null,
        "pending_bulk_message_deletion_at": null,
        "deletion_reason_code": null,
        "deletion_public_reason": null,
        "deletion_audit_log_reason": null,
        "deletion_scheduled_by": null,
        "deletion_scheduled_at": null,
        "last_active_at": null,
        "last_active_ip": null,
        "last_active_ip_reverse": null,
        "last_active_location": null
    })
}

fn searched_guild() -> generated_types::GuildAdminResponse {
    serde_json::from_value(json!({
        "id": "1600000000000000001",
        "name": "Searched Guild",
        "icon": null,
        "banner": null,
        "owner_id": "1500000000000000001",
        "owner_username": "SearchedUser",
        "owner_global_name": "SearchedUser",
        "owner_discriminator": "0001",
        "member_count": 12,
        "features": ["COMMUNITY"],
        "nsfw_level": 0,
        "nsfw": false,
        "content_warning_level": 0,
        "content_warning_text": null
    }))
    .expect("guild search fixture must match the generated response contract")
}

fn searched_guild_detail() -> generated_types::LookupGuildResponseGuild {
    serde_json::from_value(json!({
        "id": "1600000000000000001",
        "owner_id": "1500000000000000001",
        "owner_username": "SearchedUser",
        "owner_global_name": "SearchedUser",
        "owner_discriminator": "0001",
        "name": "Searched Guild",
        "vanity_url_code": null,
        "icon": null,
        "banner": null,
        "splash": null,
        "embed_splash": null,
        "features": ["COMMUNITY"],
        "verification_level": 1,
        "mfa_level": 0,
        "nsfw_level": 0,
        "nsfw": false,
        "content_warning_level": 0,
        "content_warning_text": null,
        "explicit_content_filter": 0,
        "default_message_notifications": 0,
        "afk_channel_id": null,
        "afk_timeout": 0,
        "system_channel_id": null,
        "system_channel_flags": 0,
        "rules_channel_id": null,
        "disabled_operations": 0,
        "member_count": 12,
        "channels": [],
        "roles": []
    }))
    .expect("guild detail fixture must match the generated response contract")
}

fn audit_log_entry(
    log_id: &str,
    action: &str,
    access: &str,
) -> generated_types::AdminAuditLogResponseSchema {
    serde_json::from_value(json!({
        "log_id": log_id,
        "admin_user_id": "1500000000000000000",
        "admin_user": null,
        "target_type": "user",
        "target_id": "1500000000000000001",
        "target_user": null,
        "target_guild": null,
        "target_channel": null,
        "related_users": {},
        "related_guilds": {},
        "related_channels": {},
        "action": action,
        "access": access,
        "audit_log_reason": null,
        "metadata": {},
        "created_at": "2026-09-16T12:00:00.000Z"
    }))
    .expect("audit log fixture must match the generated response contract")
}

fn searched_application() -> Value {
    json!({
        "id": "1700000000000000001",
        "name": "Mock Application",
        "owner_user_id": "1500000000000000001",
        "owner_username": "SearchedUser",
        "owner_global_name": "SearchedUser",
        "owner_discriminator": "0001",
        "bot_user_id": null,
        "bot_username": null,
        "bot_global_name": null,
        "bot_discriminator": null,
        "bot_is_public": true,
        "bot_require_code_grant": false,
        "oauth2_redirect_uris": [],
        "has_client_secret": false,
        "has_bot_token": false,
        "bot_token_preview": null,
        "bot_token_created_at": null,
        "client_secret_created_at": null,
        "version": 1
    })
}

fn searched_report() -> Value {
    json!({
        "report_id": "1800000000000000001",
        "reporter_id": "1500000000000000000",
        "reporter_tag": "AdminUser#0001",
        "reported_at": "2026-05-26T12:00:00.000Z",
        "status": 0,
        "report_type": 1,
        "category": "other",
        "additional_info": "Mock report details",
        "reported_user_id": "1500000000000000001",
        "reported_user_tag": "SearchedUser#0001"
    })
}

fn future_category_report() -> Value {
    let mut report = searched_report();
    report["report_id"] = json!("1800000000000000006");
    report["category"] = json!("future_value");
    report
}

fn future_status_report() -> Value {
    let mut report = searched_report();
    report["report_id"] = json!("1800000000000000005");
    report["status"] = json!(7);
    report["report_type"] = json!(9);
    report
}

fn report_reasons() -> Value {
    json!({
        "reasons": [
            {
                "key": "csam",
                "label": "Child sexual abuse material",
                "highest_priority": true,
                "legacy_category_message": "child_safety",
                "legacy_category_user": "child_safety",
                "legacy_category_guild": "child_safety"
            },
            {
                "key": "harassment",
                "label": "Harassment or bullying",
                "highest_priority": false,
                "legacy_category_message": "harassment",
                "legacy_category_user": "harassment",
                "legacy_category_guild": "harassment"
            }
        ]
    })
}

fn flow_report() -> Value {
    json!({
        "report_id": "1800000000000000003",
        "reporter_id": "1500000000000000000",
        "reporter_tag": "AdminUser#0001",
        "reported_at": "2026-05-26T12:00:00.000Z",
        "status": 0,
        "report_type": 0,
        "category": "child_safety",
        "additional_info": "Mock flow report details",
        "reported_user_id": "1500000000000000001",
        "reported_user_tag": "SearchedUser#0001",
        "reported_message_id": "1800000000000001001",
        "reported_channel_id": "1600000000000000101",
        "reason": "csam",
        "reason_label": "Child sexual abuse material",
        "reason_highest_priority": true,
        "reporter_good_faith_confirmed": true,
        "flow": {
            "revision_hash": "b7667e8b32c98c40",
            "surface": "dsa",
            "locale": "fr",
            "steps": [
                {
                    "screen_id": "root_message",
                    "screen_title": "Report message",
                    "option_id": "abuse",
                    "option_label": "Abusive or harmful content",
                    "items": []
                },
                {
                    "screen_id": "private_info",
                    "screen_title": "What private information is shared?",
                    "option_id": null,
                    "option_label": null,
                    "items": [
                        {"id": "email", "label": "Email address"},
                        {"id": "phone", "label": "Phone number"}
                    ]
                },
                {
                    "screen_id": "profile_intro",
                    "screen_title": "Report profile",
                    "option_id": null,
                    "option_label": null,
                    "items": []
                }
            ]
        }
    })
}

const WEBHOOK_ID: &str = "1700000000000000500";

fn webhook_report() -> Value {
    json!({
        "report_id": "1800000000000000004",
        "reporter_id": "1500000000000000000",
        "reporter_tag": "AdminUser#0001",
        "reported_at": "2026-05-26T12:00:00.000Z",
        "status": 0,
        "report_type": 0,
        "category": "spam",
        "additional_info": null,
        "reported_user_id": null,
        "reported_user_tag": null,
        "reported_webhook_id": WEBHOOK_ID,
        "reported_webhook_name": "Harbor Bulletin",
        "reported_webhook_avatar_hash": "abc123",
        "reported_webhook_default_name": "Harbor Hook",
        "reported_webhook_default_avatar_hash": null,
        "reported_webhook_type": 1,
        "reported_webhook_application_id": null,
        "reported_webhook_channel_id": "1600000000000000101",
        "reported_webhook_guild_id": "1600000000000000001",
        "reported_webhook_created_at": "2026-05-20T08:30:00.000Z",
        "reported_webhook_creator_id": "1500000000000000002",
        "reported_webhook_creator_tag": "HookOwner#0002",
        "reported_webhook_creator_username": "HookOwner",
        "reported_webhook_creator_global_name": null,
        "reported_webhook_creator_discriminator": "0002",
        "reported_webhook_creator_avatar_hash": null,
        "reported_message_id": "1800000000000001004",
        "reported_channel_id": "1600000000000000101",
        "reported_channel_name": "general",
        "reported_guild_id": "1600000000000000001",
        "reported_guild_name": "Searched Guild",
        "reason": "spam",
        "reason_label": "Spam",
        "reason_highest_priority": false,
        "message_context": [
            {
                "id": "1800000000000001003",
                "content": "Member message before the webhook",
                "timestamp": "2026-05-26T12:00:30.000Z",
                "author_id": "1500000000000000001",
                "author_username": "SearchedUser",
                "author_global_name": null,
                "author_discriminator": "0001",
                "author_avatar": null,
                "webhook_id": null,
                "channel_id": "1600000000000000101",
                "attachments": []
            },
            {
                "id": "1800000000000001004",
                "content": "Webhook spam in drawer",
                "timestamp": "2026-05-26T12:01:00.000Z",
                "author_id": WEBHOOK_ID,
                "author_username": "Harbor Bulletin",
                "author_global_name": null,
                "author_discriminator": "0000",
                "author_avatar": "abc123",
                "webhook_id": WEBHOOK_ID,
                "channel_id": "1600000000000000101",
                "attachments": []
            }
        ]
    })
}

fn searched_message_report() -> Value {
    json!({
        "report_id": "1800000000000000002",
        "reporter_id": "1500000000000000000",
        "reporter_tag": "AdminUser#0001",
        "reported_at": "2026-05-26T12:00:00.000Z",
        "status": 0,
        "report_type": 0,
        "category": "spam",
        "additional_info": "Mock message report details",
        "reported_user_id": "1500000000000000001",
        "reported_user_tag": "SearchedUser#0001",
        "reported_message_id": "1800000000000001001",
        "reported_channel_id": "1600000000000000101",
        "reported_channel_name": "general",
        "message_context": [{
            "id": "1800000000000001001",
            "content": "Reported message in drawer",
            "timestamp": "2026-05-26T12:01:00.000Z",
            "author_id": "1500000000000000001",
            "author_username": "SearchedUser",
            "author_global_name": "SearchedUser",
            "author_discriminator": "0001",
            "author_avatar": null,
            "channel_id": "1600000000000000101",
            "attachments": []
        }]
    })
}

fn searched_job() -> Value {
    json!({
        "job_id": "1900000000000000001",
        "task_type": "mockJobSync",
        "status": "running",
        "created_at": "2026-05-26T12:00:00.000Z",
        "progress_current": 4,
        "progress_total": 10,
        "progress_message": null,
        "error_message": null,
        "started_at": "2026-05-26T12:00:05.000Z",
        "completed_at": null,
        "attempts": 1,
        "max_attempts": 3,
        "requested_by_user_id": "1500000000000000000",
        "audit_log_reason": null,
        "jet_stream_lane": null,
        "jet_stream_seq": null,
        "run_at": null,
        "cancel_requested": false,
        "context_link": null,
        "payload": null,
        "result": null
    })
}

fn instance_config() -> Value {
    json!({
        "sso": {
            "enabled": false,
            "enforced": false,
            "display_name": null,
            "issuer": null,
            "authorization_url": null,
            "token_url": null,
            "userinfo_url": null,
            "jwks_url": null,
            "client_id": null,
            "client_secret_set": false,
            "scope": null,
            "allowed_domains": [],
            "auto_provision": false,
            "redirect_uri": "https://admin.example.test/oauth2_callback"
        },
        "gateway_rollout": {
            "session_rollout_percentage": 100,
            "session_rollout_mode": "modulo",
            "guild_rollout_percentage": 100,
            "rpc_request_timeout_ms": 5000,
            "max_concurrent_session_starts": 16,
            "max_concurrent_guild_starts": 16,
            "voice_e2ee_scope": "guild_feature_only"
        },
        "domain_migration": {
            "enabled": false,
            "config_version": 0,
            "rollout_basis_points": 0,
            "rollout_salt": "domain-migration-v1",
            "included_user_ids": [],
            "excluded_user_ids": [],
            "anonymous_rollout_basis_points": 0,
            "standalone_forwarding": false
        },
        "voice_p2p": {
            "enabled": false,
            "config_version": 0,
            "rollout_basis_points": 0,
            "rollout_country_codes": [],
            "rollout_salt": "voice-p2p-v1",
            "included_user_ids": [],
            "excluded_user_ids": [],
            "max_participants": 2
        },
        "experiment_delivery": {
            "poll_interval_seconds": 300,
            "poll_jitter_percent": 15
        },
        "registration": registration_config(),
        "self_hosted": false
    })
}

fn registration_config() -> Value {
    json!({
        "mode": "approval",
        "admin_registration_urls_enabled": true,
        "urls": [registration_url_fixture()],
        "pending_registrations": [pending_registration_fixture()]
    })
}

fn registration_url_fixture() -> Value {
    json!({
        "id": "11111111-1111-4111-8111-111111111111",
        "label": "Support batch",
        "created_by_user_id": "1500000000000000000",
        "created_at": "2026-05-26T12:00:00.000Z",
        "expires_at": null,
        "max_uses": 5,
        "use_count": 0,
        "revoked_at": null,
        "approval_required": true,
        "last_used_at": null,
        "last_used_by_user_id": null
    })
}

fn pending_registration_fixture() -> Value {
    json!({
        "user_id": "1500000000000000002",
        "username": "PendingUser",
        "discriminator": 0,
        "global_name": "Pending User",
        "email": "[email protected]",
        "requested_at": "2026-05-26T12:10:00.000Z",
        "registration_url_id": "11111111-1111-4111-8111-111111111111",
        "client_ip": "203.0.113.24"
    })
}

fn instance_config_without_pending_registrations() -> Value {
    let mut config = instance_config();
    config["registration"]["pending_registrations"] = json!([]);
    config
}

fn instance_config_without_registration_urls() -> Value {
    let mut config = instance_config();
    config["registration"]["urls"] = json!([]);
    config
}

fn limit_config() -> Value {
    json!({
        "limit_config": {
            "traitDefinitions": [],
            "rules": [{
                "id": "default",
                "filters": null,
                "limits": { "maxGuilds": 100 }
            }]
        },
        "limit_config_json": "{\"traitDefinitions\":[],\"rules\":[]}",
        "self_hosted": false,
        "defaults": {
            "default": { "maxGuilds": 100 }
        },
        "metadata": {
            "maxGuilds": {
                "key": "maxGuilds",
                "label": "Max Guilds",
                "description": "Maximum guild memberships.",
                "category": "account",
                "scope": "user",
                "isToggle": false,
                "unit": null,
                "min": 0,
                "max": 1000
            }
        },
        "categories": { "account": "Account" },
        "limit_keys": ["maxGuilds"],
        "bounds": null
    })
}

fn test_config(api_endpoint: String) -> AdminConfig {
    AdminConfig {
        host: "127.0.0.1".to_owned(),
        port: 0,
        secret_key_base: SECRET_KEY.to_owned(),
        base_path: String::new(),
        api_endpoint,
        media_endpoint: "https://media.example.test".to_owned(),
        static_cdn_endpoint: "https://static.example.test".to_owned(),
        reports_bucket_origin: "https://reports.example.test".to_owned(),
        admin_endpoint: "https://admin.example.test".to_owned(),
        web_app_endpoint: "https://app.example.test".to_owned(),
        oauth_client_id: "admin-client".to_owned(),
        oauth_client_secret: "admin-secret".to_owned(),
        oauth_redirect_uri: "https://admin.example.test/callback".to_owned(),
        build_version: "test".to_owned(),
        self_hosted: false,
        proxy: ProxyConfig {
            trust_client_ip_header: false,
            client_ip_header_name: "x-forwarded-for".to_owned(),
        },
    }
}