import { test } from 'node:test';
import assert from 'node:assert/strict';
import { mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises';
import { tmpdir } from 'node:os';
import { join } from 'node:path';
import Fastify from 'fastify';
import { Db } from '../src/db/index.ts';
import { loadConfig } from '../src/config/index.ts';
import { UserService } from '../src/services/users.ts';
import { signAccessToken } from '../src/services/tokens.ts';
import type { AppContext } from '../src/http/context.ts';
import { registerMediaRoutes } from '../src/http/routes/media.ts';
import { registerErrorHandler } from '../src/http/errors.ts';
import { setTimeout as delay } from 'node:timers/promises';
import { MetadataHttp, MusicBrainzProvider } from '../src/media/metadata-providers.ts';
import {MediaLibraries} from '../src/media/libraries.ts';
import {MediaScanner} from '../src/media/scanner.ts';
import {MediaStoreDatabase} from '../src/media/store-database.ts';
import {activateMediaDatabase} from '../src/media/migrate-database.ts';
import {MediaAccountCleanup} from '../src/media/account-cleanup.ts';
import {DatabaseMediaAccounts} from '../src/media/accounts.ts';

for(const isolated of [false,true])test(`media HTTP enforces authentication, grant changes, configuration privacy and scan lifecycle (isolated=${isolated})`,async t=>{
  const base=await mkdtemp(join(tmpdir(),'media-api-')),root=join(base,'assets');await mkdir(root);
  await mkdir(join(base,'books'));
  process.env.BOOKS_DIR=join(base,'books');process.env.DATA_DIR=join(base,'data');process.env.READER_TOKEN_SECRET='media-api-test-secret';
  const config=loadConfig(),db=new Db(isolated?join(base,'reader.db'):':memory:');
  const users=new UserService(db,config),app=Fastify({logger:false});
  for(const [id,role]of [['admin','admin'],['member','member']])db.run('INSERT INTO users(id,username,password_hash,role,created_at,updated_at) VALUES(?,?,?,?,0,0)',id!,id!,'unused',role!);
  let store:MediaStoreDatabase|undefined;
  if(isolated){
    const scanner=new MediaScanner(db,new MediaLibraries(db));await scanner.close();
    activateMediaDatabase(join(base,'reader.db'),join(base,'media.db'));
    store=new MediaStoreDatabase(join(base,'media.db'));
  }
  const mediaDb=store||db;
  const ctx={db,config,users} as AppContext;
  registerErrorHandler(app);registerMediaRoutes(app,ctx,{database:mediaDb,metadataProviders:[{
    id:'tmdb',label:'TMDB test fixture',kinds:['movie'],configured:true,
    async search(){return [{externalId:'42',title:'Matched movie',year:2024}];},
    async detail(){return {externalId:'42',fields:{title:'Matched movie',year:2024},sourceUrl:'https://www.themoviedb.org/movie/42'};},
  },new MusicBrainzProvider(new MetadataHttp(),'')]});
  t.after(async()=>{await app.close();if(store){assert.equal(db.all('SELECT id FROM media_assets').length,0);assert.equal(store.get("SELECT name FROM sqlite_master WHERE name='books'"),undefined);}store?.close();db.close();await rm(base,{recursive:true,force:true});});
  const admin={authorization:'Bearer '+signAccessToken(config,{id:'admin',role:'admin'}).token};
  const member={authorization:'Bearer '+signAccessToken(config,{id:'member',role:'member'}).token};
  for(const [method,url] of [['GET','library-summaries'],['GET','scan-jobs'],['POST','scan-jobs']] as const){
    const path='/api/v1/media/'+url;
    assert.equal((await app.inject({method,url:path})).statusCode,401);
    assert.equal((await app.inject({method,url:path,headers:member})).statusCode,403);
    const empty=await app.inject({method,url:path,headers:admin});
    assert.equal(empty.statusCode,method==='POST'?202:200);
    assert.deepEqual(empty.json(),method==='POST'?{items:[],skipped:[]}:{items:[]});
  }
  assert.deepEqual((await app.inject({url:'/api/v1/media/scrape-jobs?summary=true',headers:admin})).json(),{items:[]});
  for(const suffix of ['results','retry']){
    const method=suffix==='retry'?'POST' as const:'GET' as const;
    assert.equal((await app.inject({method,url:'/api/v1/media/scrape-jobs/missing/'+suffix,headers:member})).statusCode,403);
    assert.equal((await app.inject({method,url:'/api/v1/media/scrape-jobs/missing/'+suffix,headers:admin})).statusCode,404);
  }
  for(const query of ['limit=51','offset=-1','state=complete'])assert.equal((await app.inject({url:'/api/v1/media/scrape-jobs/missing/results?'+query,headers:admin})).statusCode,400);
  const newItemRequest={method:'POST' as const,url:'/api/v1/media/editions/missing/new-item',payload:{title:'新作品',expectedItemId:'source'}};
  assert.equal((await app.inject(newItemRequest)).statusCode,401);
  assert.equal((await app.inject({...newItemRequest,headers:member})).statusCode,403);
  assert.equal((await app.inject({...newItemRequest,headers:admin,payload:{title:'',expectedItemId:'source'}})).statusCode,400);
  assert.equal((await app.inject({...newItemRequest,headers:admin})).statusCode,404);
  assert.equal((await app.inject({url:'/api/v1/media/search?query=test'})).statusCode,401);
  assert.equal((await app.inject({url:'/api/v1/media/browse?channel=music&kind=album'})).statusCode,401);
  assert.equal((await app.inject({url:'/api/v1/media/browse?channel=music&kind=movie',headers:member})).statusCode,400);
  assert.equal((await app.inject({url:'/api/v1/media/browse?channel=music&kind=album&limit=201',headers:member})).statusCode,400);
  assert.deepEqual((await app.inject({url:'/api/v1/media/browse?channel=music&kind=album',headers:member})).json(),{items:[],total:0});
  assert.deepEqual((await app.inject({url:'/api/v1/media/browse?channel=video&kind=video',headers:member})).json(),{items:[],total:0});
  assert.equal((await app.inject({url:'/api/v1/media/browse?channel=music&kind=video',headers:member})).statusCode,400);
  assert.equal((await app.inject({url:'/api/v1/media/narrators'})).statusCode,401);
  for(const query of ['query=','query=%20%20','query=test&channel=reading','query=test&kind=book','query=test&limit=201'])
    assert.equal((await app.inject({url:'/api/v1/media/search?'+query,headers:member})).statusCode,400);
  const emptySearch=await app.inject({url:'/api/v1/media/search?query=test&channel=video&kind=movie',headers:member});
  assert.equal(emptySearch.statusCode,200);assert.deepEqual(emptySearch.json(),{items:[],total:0});
  assert.equal((await app.inject({url:'/api/v1/media/metadata/providers',headers:member})).statusCode,403);
  const providers=await app.inject({url:'/api/v1/media/metadata/providers',headers:admin});
  assert.equal(providers.statusCode,200);
  assert.equal(providers.json().items.length,2);
  for(const provider of providers.json().items)assert.deepEqual(Object.keys(provider).sort(),['configured','id','kinds','label']);
  assert.equal((await app.inject({method:'POST',url:'/api/v1/media/items/missing/matches',headers:admin,payload:{provider:'custom-url',query:'x'}})).statusCode,400);
  assert.equal((await app.inject({method:'PUT',url:'/api/v1/media/items/missing/match',headers:member,payload:{candidateId:'candidate'}})).statusCode,403);
  const url='/api/v1/media/libraries';
  assert.equal((await app.inject({url})).statusCode,401);
  assert.equal((await app.inject({method:'POST',url,headers:member,payload:{name:'x',kind:'video',root,access:'all'}})).statusCode,403);
  assert.equal((await app.inject({method:'POST',url,headers:admin,payload:{name:'x',kind:'unknown',root,access:'all'}})).statusCode,400);
  const created=await app.inject({method:'POST',url,headers:admin,payload:{name:'Films',kind:'video',root,access:'restricted'}});
  assert.equal(created.statusCode,201);const id=created.json().id;
  assert.equal((await app.inject({url:url+'/'+id,headers:member})).statusCode,404);
  assert.equal((await app.inject({method:'PUT',url:`${url}/${id}/access`,headers:admin,payload:{access:'restricted',userIds:['member']}})).statusCode,204);
  const visible=await app.inject({url:url+'/'+id,headers:member});assert.equal(visible.statusCode,200);assert.equal('root'in visible.json(),false);
  assert.equal((await app.inject({url:`${url}/${id}/configuration`,headers:member})).statusCode,403);
  await writeFile(join(root,'sample.mp4'),'not-a-real-media-file');
  await writeFile(join(root,'sample.zh-CN.srt'),'1\n00:00:00,000 --> 00:00:05,000\n字幕测试');
  await writeFile(join(root,'unrelated.srt'),'1\n00:00:00,000 --> 00:00:05,000\nunrelated');
  const coverPng=Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+aD1sAAAAASUVORK5CYII=','base64');
  await writeFile(join(root,'cover.png'),coverPng);
  const scan=await app.inject({method:'POST',url:`${url}/${id}/scan`,headers:admin});assert.equal(scan.statusCode,202);
  let job=scan.json();const deadline=Date.now()+35000;
  while(job.state==='running'&&Date.now()<deadline){await delay(25);job=(await app.inject({url:'/api/v1/media/jobs/'+job.id,headers:admin})).json();}
  assert.equal(job.state,'complete');
  const summaries=await app.inject({url:'/api/v1/media/library-summaries',headers:admin});
  assert.equal(summaries.statusCode,200);
  assert.equal(summaries.headers['cache-control'],'private, no-store');
  assert.deepEqual(summaries.json().items,[{id,root,counts:{movie:1},chapters:0,missingFiles:0}]);
  const latest=await app.inject({url:'/api/v1/media/scan-jobs',headers:admin});
  assert.equal(latest.statusCode,200);assert.equal(latest.json().items[0].id,job.id);
  const batch=await app.inject({method:'POST',url:'/api/v1/media/scan-jobs',headers:admin});
  assert.equal(batch.statusCode,202);assert.equal(batch.json().items.length,1);
  let batchJob=batch.json().items[0];
  while(['running','queued'].includes(batchJob.state)&&Date.now()<deadline){await delay(25);batchJob=(await app.inject({url:'/api/v1/media/jobs/'+batchJob.id,headers:admin})).json();}
  assert.equal(batchJob.state,'complete');
  assert.equal((await app.inject({method:'POST',url:'/api/v1/media/jobs/'+job.id+'/cancel',headers:member})).statusCode,403);
  const finishedCancel=await app.inject({method:'POST',url:'/api/v1/media/jobs/'+job.id+'/cancel',headers:admin});
  assert.equal(finishedCancel.statusCode,202);assert.equal(finishedCancel.json().state,'complete');
  const assets=await app.inject({url:`${url}/${id}/assets`,headers:member});assert.equal(assets.statusCode,200);assert.equal(assets.json().total,1);
  const asset=assets.json().items[0];assert.equal(asset.available,true);assert.ok(['failed','unavailable'].includes(asset.probe.status));
  const subtitleListUrl=`/api/v1/media/assets/${asset.id}/subtitles`;
  assert.equal((await app.inject({url:subtitleListUrl})).statusCode,401);
  const subtitleList=await app.inject({url:subtitleListUrl,headers:member});
  assert.equal(subtitleList.statusCode,200);assert.equal(subtitleList.json().items.length,1);
  const subtitle=subtitleList.json().items[0];assert.equal(subtitle.language,'zh-CN');assert.equal(subtitle.ref,undefined);
  const subtitleUrl=subtitleListUrl+'/'+subtitle.id;
  const subtitleContent=await app.inject({url:subtitleUrl,headers:member});
  assert.equal(subtitleContent.statusCode,200);assert.ok(subtitleContent.json().webvtt.includes('字幕测试'));
  assert.equal((await app.inject({url:subtitleListUrl+'/forged',headers:member})).statusCode,404);
  const catalog=await app.inject({url:`${url}/${id}/items?kind=movie`,headers:member});
  assert.equal(catalog.statusCode,200);assert.equal(catalog.json().total,1);
  const itemId=catalog.json().items[0].id;
  const originalDetail=(await app.inject({url:`/api/v1/media/items/${itemId}`,headers:admin})).json();
  const assignmentUrl=`/api/v1/media/editions/${originalDetail.editions[0].id}/item`;
  const assignment={targetItemId:itemId,expectedItemId:itemId};
  assert.equal((await app.inject({method:'PUT',url:assignmentUrl,payload:assignment})).statusCode,401);
  assert.equal((await app.inject({method:'PUT',url:assignmentUrl,headers:member,payload:assignment})).statusCode,403);
  assert.equal((await app.inject({method:'PUT',url:assignmentUrl,headers:admin,payload:{targetItemId:itemId}})).statusCode,400);
  assert.equal((await app.inject({method:'PUT',url:assignmentUrl,headers:admin,payload:{...assignment,expectedItemId:'stale'}})).statusCode,409);
  const unchanged=await app.inject({method:'PUT',url:assignmentUrl,headers:admin,payload:assignment});
  assert.equal(unchanged.statusCode,200);assert.equal(unchanged.json().editions[0].id,originalDetail.editions[0].id);
  const editionSnapshot=originalDetail.editions[0];
  const orderUrl=`/api/v1/media/editions/${editionSnapshot.id}/order`,orderBody={expectedRevision:editionSnapshot.revision,partIds:editionSnapshot.parts.map((part:{id:string})=>part.id)};
  assert.equal((await app.inject({method:'PUT',url:orderUrl,payload:orderBody})).statusCode,401);
  assert.equal((await app.inject({method:'PUT',url:orderUrl,headers:member,payload:orderBody})).statusCode,403);
  assert.equal((await app.inject({method:'PUT',url:orderUrl,headers:admin,payload:{...orderBody,partIds:[]}})).statusCode,400);
  assert.equal((await app.inject({method:'PUT',url:orderUrl,headers:admin,payload:{...orderBody,expectedRevision:'0'.repeat(64)}})).statusCode,409);
  const orderSaved=await app.inject({method:'PUT',url:orderUrl,headers:admin,payload:orderBody});assert.equal(orderSaved.statusCode,200);
  const orderReset=await app.inject({method:'PUT',url:orderUrl,headers:admin,payload:{expectedRevision:orderSaved.json().editions[0].revision,partIds:null}});assert.equal(orderReset.statusCode,200);
  for(const [action,payload] of [
    ['split',{expectedRevision:editionSnapshot.revision,assetIds:[editionSnapshot.parts[0].assetId],label:'新版本'}],
    ['merge',{expectedRevision:editionSnapshot.revision,targetEditionId:editionSnapshot.id,targetRevision:editionSnapshot.revision}],
  ] as const){
    const path=`/api/v1/media/editions/${editionSnapshot.id}/${action}`;
    assert.equal((await app.inject({method:'POST',url:path,payload})).statusCode,401);
    assert.equal((await app.inject({method:'POST',url:path,headers:member,payload})).statusCode,403);
    assert.equal((await app.inject({method:'POST',url:path,headers:admin,payload:{}})).statusCode,400);
    assert.equal((await app.inject({method:'POST',url:path,headers:admin,payload:{...payload,expectedRevision:'0'.repeat(64)}})).statusCode,409);
    assert.equal((await app.inject({method:'POST',url:path,headers:admin,payload})).statusCode,400);
  }
  const coverUrl=`/api/v1/media/items/${itemId}/cover`;
  assert.equal((await app.inject({url:coverUrl})).statusCode,401);
  const cover=await app.inject({url:coverUrl,headers:member});
  assert.equal(cover.statusCode,200);assert.equal(cover.headers['content-type'],'image/png');
  assert.deepEqual(cover.rawPayload,coverPng);assert.equal(cover.headers['cache-control'],'private, no-store');
  await writeFile(join(root,'cover.png'),'<svg onload="alert(1)"></svg>');
  assert.equal((await app.inject({url:coverUrl,headers:member})).statusCode,404,'active content disguised as PNG is rejected');
  await writeFile(join(root,'cover.png'),coverPng);
  assert.equal((await app.inject({method:'PATCH',url:`/api/v1/media/items/${itemId}/metadata`,headers:member,payload:{title:'Forbidden'}})).statusCode,403);
  const edited=await app.inject({method:'PATCH',url:`/api/v1/media/items/${itemId}/metadata`,headers:admin,payload:{title:'My movie'}});
  assert.equal(edited.statusCode,200);assert.equal(edited.json().title,'My movie');
  assert.equal(edited.json().editions[0].parts[0].assetId,asset.id);
  const matches=await app.inject({method:'POST',url:`/api/v1/media/items/${itemId}/matches`,headers:admin,payload:{provider:'tmdb',query:'sample'}});
  assert.equal(matches.statusCode,200);
  const previewUrl=`/api/v1/media/items/${itemId}/matches`;
  assert.equal((await app.inject({url:previewUrl})).statusCode,401);
  assert.equal((await app.inject({url:previewUrl,headers:member})).statusCode,403);
  const preview=await app.inject({url:previewUrl,headers:admin});
  assert.equal(preview.statusCode,200);assert.equal(preview.headers['cache-control'],'private, no-store');
  assert.equal(preview.json().items[0].candidateId,matches.json().items[0].candidateId);
  assert.equal(preview.json().items[0].title,'Matched movie');
  const matchUrl=`/api/v1/media/items/${itemId}/match`;
  const matched=await app.inject({method:'PUT',url:matchUrl,headers:admin,payload:{candidateId:matches.json().items[0].candidateId}});
  assert.equal(matched.statusCode,200);assert.equal(matched.json().title,'My movie','manual title remains authoritative');
  assert.equal(matched.json().metadata.year,2024);
  assert.equal((await app.inject({url:'/api/v1/media/items/'+itemId,headers:member})).json().metadata.onlineMatch.externalId,'42');
  assert.equal((await app.inject({method:'DELETE',url:matchUrl,headers:member})).statusCode,403);
  const unmatched=await app.inject({method:'DELETE',url:matchUrl,headers:admin});
  assert.equal(unmatched.statusCode,200);assert.equal(unmatched.json().metadata.onlineMatch,undefined);assert.equal(unmatched.json().title,'My movie');
  const partId=edited.json().editions[0].parts[0].id;
  assert.equal((await app.inject({url:`/api/v1/media/items/${itemId}/album-playback`})).statusCode,401);
  assert.equal((await app.inject({url:`/api/v1/media/items/${itemId}/album-playback`,headers:member})).statusCode,400);
  assert.equal((await app.inject({url:`/api/v1/media/libraries/${id}/folders`})).statusCode,401);
  const files=await app.inject({url:`/api/v1/media/libraries/${id}/folders`,headers:member});
  assert.equal(files.statusCode,200);assert.equal(files.json().items[0].name,'sample.mp4');
  assert.equal((await app.inject({url:`/api/v1/media/libraries/${id}/folders?path=..`,headers:member})).statusCode,400);
  assert.equal((await app.inject({url:`/api/v1/media/assets/${asset.id}/catalog`})).statusCode,401);
  const fileCatalog=await app.inject({url:`/api/v1/media/assets/${asset.id}/catalog`,headers:member});
  assert.equal(fileCatalog.statusCode,200);assert.equal(fileCatalog.json().items[0].editions[0].parts[0].id,partId);
  assert.equal((await app.inject({url:`/api/v1/media/parts/${partId}/lyrics`})).statusCode,401);
  assert.equal((await app.inject({url:`/api/v1/media/parts/${partId}/lyrics`,headers:admin})).statusCode,404,'video assets do not expose music lyrics');
  const grantResponse=await app.inject({method:'POST',url:'/api/v1/media/background-grants',headers:admin,payload:{partIds:[partId]}});
  assert.equal(grantResponse.statusCode,201);const grant=grantResponse.json();
  assert.ok(grant.expiresAt>Date.now());const grantHeaders={'x-media-background':grant.token};
  assert.equal((await app.inject({url:'/api/v1/media/libraries',headers:grantHeaders})).statusCode,401);
  assert.equal((await app.inject({method:'POST',url:'/api/v1/media/background-grants',headers:grantHeaders,payload:{partIds:[partId]}})).statusCode,401);
  assert.equal((await app.inject({method:'POST',url:'/api/v1/media/background/playback',headers:grantHeaders,payload:{partId:'outside'}})).statusCode,401);
  const backgroundPlay=await app.inject({method:'POST',url:'/api/v1/media/background/playback',headers:grantHeaders,payload:{partId}});
  assert.equal(backgroundPlay.statusCode,201);const bg=backgroundPlay.json();
  const bgSubtitleUrl=`/api/v1/media/background/playback/${bg.id}/subtitles`;
  assert.equal((await app.inject({url:bgSubtitleUrl})).statusCode,401);
  assert.equal((await app.inject({url:bgSubtitleUrl,headers:admin})).statusCode,401);
  const bgSubtitles=await app.inject({url:bgSubtitleUrl,headers:grantHeaders});
  assert.equal(bgSubtitles.statusCode,200);assert.equal(bgSubtitles.headers['cache-control'],'private, no-store');
  assert.equal(bgSubtitles.json().items.length,1);
  const bgText=await app.inject({url:bgSubtitleUrl+'/'+bgSubtitles.json().items[0].id,headers:grantHeaders});
  assert.equal(bgText.statusCode,200);assert.ok(bgText.json().webvtt.includes('字幕测试'));
  assert.equal((await app.inject({url:bgSubtitleUrl+'/forged',headers:grantHeaders})).statusCode,404);
  assert.equal((await app.inject({method:'PUT',url:`/api/v1/media/background/playback/${bg.id}/progress`,headers:grantHeaders,payload:{sequence:0,revision:bg.revision,position:bg.start,completed:false}})).statusCode,200);
  assert.equal((await app.inject({method:'POST',url:`/api/v1/media/background/playback/${bg.id}/renew`,headers:grantHeaders})).statusCode,200);
  assert.equal((await app.inject({method:'DELETE',url:'/api/v1/media/background-grants/current',headers:grantHeaders})).statusCode,204);
  assert.equal((await app.inject({url:bg.streamUrl})).statusCode,401);
  assert.equal((await app.inject({url:bgSubtitleUrl,headers:grantHeaders})).statusCode,401);
  assert.equal((await app.inject({method:'POST',url:`/api/v1/media/background/playback/${bg.id}/renew`,headers:grantHeaders})).statusCode,401);
  const memberGrant=(await app.inject({method:'POST',url:'/api/v1/media/background-grants',headers:member,payload:{partIds:[partId]}})).json();
  const memberBgHeaders={'x-media-background':memberGrant.token};
  const memberBgCreate=()=>app.inject({method:'POST',url:'/api/v1/media/background/playback',headers:memberBgHeaders,payload:{partId}});
  db.run("UPDATE users SET disabled=1 WHERE id='member'");assert.equal((await memberBgCreate()).statusCode,401);db.run("UPDATE users SET disabled=0 WHERE id='member'");
  db.run("UPDATE users SET auth_version=auth_version+1 WHERE id='member'");assert.equal((await memberBgCreate()).statusCode,401);db.run("UPDATE users SET auth_version=auth_version-1 WHERE id='member'");
  const memberBg=(await memberBgCreate()).json();
  assert.equal((await app.inject({method:'POST',url:`/api/v1/media/background/playback/${memberBg.id}/renew`,headers:grantHeaders})).statusCode,401);
  mediaDb.run('UPDATE media_background_grants SET expires_at=0 WHERE id=?',memberGrant.id);
  mediaDb.run('UPDATE media_background_sessions SET expires_at=0 WHERE grant_id=?',memberGrant.id);
  assert.equal((await memberBgCreate()).statusCode,401);assert.equal((await app.inject({url:memberBg.streamUrl})).statusCode,401);
  const version=edited.json().editions[0];
  const renameVersion=(authorization:typeof admin,label:string,expectedLabel:string)=>app.inject({method:'PATCH',url:'/api/v1/media/editions/'+version.id,headers:authorization,payload:{label,expectedLabel}});
  assert.equal((await renameVersion(member,'会员版本',version.label)).statusCode,403);
  assert.equal((await renameVersion(admin,'   ',version.label)).statusCode,400);
  assert.equal((await renameVersion(admin,'国语版',version.label)).statusCode,200);
  assert.equal((await renameVersion(admin,'旧页面覆盖',version.label)).statusCode,409);
  assert.equal((await app.inject({method:'PUT',url:`/api/v1/media/items/${itemId}/favorite`,headers:member,payload:{favorite:true}})).statusCode,200);
  assert.equal((await app.inject({url:'/api/v1/media/favorites',headers:member})).json().items.length,1);
  assert.equal((await app.inject({url:'/api/v1/media/favorites',headers:admin})).json().items.length,0);
  const queue=await app.inject({method:'POST',url:'/api/v1/media/queue',headers:member,payload:{partIds:[partId,partId]}});
  assert.equal(queue.json().items.length,2);
  const [firstEntry,secondEntry]=queue.json().items;
  const moveUrl='/api/v1/media/queue/'+secondEntry.id+'/move';
  assert.equal((await app.inject({method:'POST',url:moveUrl,headers:admin,payload:{direction:'up',neighborId:firstEntry.id}})).statusCode,404);
  const moved=await app.inject({method:'POST',url:moveUrl,headers:member,payload:{direction:'up',neighborId:firstEntry.id}});
  assert.equal(moved.statusCode,200);assert.deepEqual(moved.json().items.map((row:{id:string})=>row.id),[secondEntry.id,firstEntry.id]);
  assert.equal((await app.inject({method:'POST',url:moveUrl,headers:member,payload:{direction:'up',neighborId:firstEntry.id}})).statusCode,409);
  assert.equal((await app.inject({method:'POST',url:moveUrl,headers:member,payload:{direction:'down',neighborId:'foreign'}})).statusCode,409);
  await app.inject({method:'DELETE',url:'/api/v1/media/queue/'+queue.json().items[0].id,headers:admin});
  assert.equal((await app.inject({url:'/api/v1/media/queue',headers:member})).json().items.length,2);
  const clearUrl='/api/v1/media/queue/clear';
  const snapshot=[firstEntry.id,secondEntry.id];
  assert.equal((await app.inject({method:'POST',url:clearUrl,headers:member,payload:{channel:'reading',entryIds:snapshot}})).statusCode,400);
  await app.inject({method:'POST',url:clearUrl,headers:admin,payload:{channel:'video',entryIds:snapshot}});
  const wrongChannel=await app.inject({method:'POST',url:clearUrl,headers:member,payload:{channel:'music',entryIds:snapshot}});
  assert.equal(wrongChannel.json().items.length,2);
  const added=await app.inject({method:'POST',url:'/api/v1/media/queue',headers:member,payload:{partIds:[partId]}});
  const newEntry=added.json().items.find((row:{id:string})=>!snapshot.includes(row.id));
  const cleared=await app.inject({method:'POST',url:clearUrl,headers:member,payload:{channel:'video',entryIds:snapshot}});
  assert.deepEqual(cleared.json().items.map((row:{id:string})=>row.id),[newEntry.id]);
  const queuePreviewUrl='/api/v1/media/queue/preview',saveQueueUrl='/api/v1/media/queue/snapshot';
  assert.equal((await app.inject({method:'POST',url:queuePreviewUrl,payload:{partIds:[partId]}})).statusCode,401);
  const beforeSave=await app.inject({method:'POST',url:queuePreviewUrl,headers:member,payload:{partIds:[partId,partId]}});
  assert.equal(beforeSave.statusCode,200);assert.equal(beforeSave.json().channel,'video');
  await app.inject({method:'POST',url:'/api/v1/media/queue',headers:member,payload:{partIds:[partId]}});
  assert.equal((await app.inject({method:'PUT',url:saveQueueUrl,headers:member,payload:{partIds:[partId,partId],expectedRevision:beforeSave.json().revision}})).statusCode,409);
  const latestPreview=(await app.inject({method:'POST',url:queuePreviewUrl,headers:member,payload:{partIds:[partId,partId]}})).json();
  const savedQueue=await app.inject({method:'PUT',url:saveQueueUrl,headers:member,payload:{partIds:[partId,partId],expectedRevision:latestPreview.revision}});
  assert.equal(savedQueue.statusCode,200);assert.deepEqual(savedQueue.json().items.map((entry:{partId:string})=>entry.partId),[partId,partId]);
  assert.equal((await app.inject({method:'POST',url:queuePreviewUrl,headers:member,payload:{partIds:['missing']}})).statusCode,404);
  const sessionResponse=await app.inject({method:'POST',url:'/api/v1/media/playback',headers:member,payload:{partId}});
  assert.equal(sessionResponse.statusCode,201);const session=sessionResponse.json();
  const renewUrl=`/api/v1/media/playback/${session.id}/renew`;
  assert.equal((await app.inject({method:'POST',url:renewUrl})).statusCode,401);
  assert.equal((await app.inject({method:'POST',url:renewUrl,headers:admin})).statusCode,404);
  mediaDb.run('UPDATE media_playback_sessions SET expires_at=? WHERE id=?',Date.now()-1000,session.id);
  assert.equal((await app.inject({url:session.streamUrl})).statusCode,401);
  const renewed=await app.inject({method:'POST',url:renewUrl,headers:member});
  assert.equal(renewed.statusCode,200);assert.ok(renewed.json().expiresAt>Date.now());
  assert.equal((await app.inject({url:`/api/v1/media/parts/${partId}/progress`,headers:member})).json().revision,session.revision);
  const bytes=await app.inject({url:session.streamUrl,headers:{range:'bytes=2-5'}});
  assert.equal(bytes.statusCode,206);assert.equal(bytes.body,'t-a-');assert.equal(bytes.headers['content-range'],'bytes 2-5/21');
  const suffix=await app.inject({url:session.streamUrl,headers:{range:'bytes=-4'}});
  assert.equal(suffix.statusCode,206);assert.equal(suffix.body,'file');
  assert.equal((await app.inject({url:session.streamUrl,headers:{range:'bytes=500-'}})).statusCode,416);
  assert.equal((await app.inject({url:session.streamUrl.replace(/ticket=.*/, 'ticket='+'x'.repeat(43))})).statusCode,401);
  const progressUrl=`/api/v1/media/playback/${session.id}/progress`;
  const progress=await app.inject({method:'PUT',url:progressUrl,headers:member,payload:{sequence:0,revision:session.revision,position:15}});
  assert.equal(progress.statusCode,200);assert.equal(progress.json().position,15);
  const history=await app.inject({url:'/api/v1/media/history',headers:member});
  assert.equal(history.json().items[0].title,'My movie');
  assert.equal(history.json().items[0].assetId,asset.id);assert.equal(history.json().items[0].start,0);
  assert.equal((await app.inject({url:'/api/v1/media/queue',headers:member})).json().items[0].title,'My movie');
  mediaDb.run('UPDATE media_parts SET active=0 WHERE id=?',partId);
  assert.equal((await app.inject({url:'/api/v1/media/history',headers:member})).json().items[0].available,0);
  mediaDb.run('UPDATE media_parts SET active=1 WHERE id=?',partId);
  const repeated=await app.inject({method:'PUT',url:progressUrl,headers:member,payload:{sequence:0,revision:session.revision,position:15}});
  assert.equal(repeated.statusCode,200);assert.equal(repeated.json().revision,progress.json().revision);
  assert.equal(repeated.json().updatedAt,progress.json().updatedAt,'retries do not create new history timestamps');
  assert.equal((await app.inject({method:'PUT',url:progressUrl,headers:member,payload:{sequence:0,revision:progress.json().revision,position:3}})).statusCode,409);
  const rewind=await app.inject({method:'PUT',url:progressUrl,headers:member,payload:{sequence:1,revision:progress.json().revision,position:3}});
  assert.equal(rewind.statusCode,200);assert.equal(rewind.json().position,3);
  const takeover=await app.inject({method:'POST',url:'/api/v1/media/playback',headers:member,payload:{partId}});
  assert.equal(takeover.json().position,3);
  assert.equal((await app.inject({method:'POST',url:'/api/v1/media/playback/recover',headers:member,payload:{partId,previousSessionId:session.id}})).statusCode,409);
  assert.equal((await app.inject({method:'POST',url:renewUrl,headers:member})).statusCode,409);
  const currentRenewUrl=`/api/v1/media/playback/${takeover.json().id}/renew`;
  mediaDb.run('UPDATE media_playback_sessions SET auth_version=auth_version+1 WHERE id=?',takeover.json().id);
  assert.equal((await app.inject({method:'POST',url:currentRenewUrl,headers:member})).statusCode,401);
  mediaDb.run('UPDATE media_playback_sessions SET auth_version=auth_version-1,expires_at=? WHERE id=?',Date.now()-25*60*60*1000,takeover.json().id);
  assert.equal((await app.inject({method:'POST',url:currentRenewUrl,headers:member})).statusCode,404);
  mediaDb.run('UPDATE media_playback_sessions SET expires_at=? WHERE id=?',Date.now()+6*60*60*1000,takeover.json().id);
  assert.equal((await app.inject({method:'PUT',url:progressUrl,headers:member,payload:{sequence:2,revision:rewind.json().revision,position:10}})).statusCode,409);
  assert.equal((await app.inject({url:`${url}/${id}/assets?limit=999`,headers:member})).statusCode,400);
  const finished=await app.inject({method:'PUT',url:`/api/v1/media/playback/${takeover.json().id}/progress`,headers:member,payload:{sequence:0,revision:takeover.json().revision,position:30,completed:true}});
  assert.equal(finished.statusCode,200);
  assert.equal((await app.inject({method:'POST',url:'/api/v1/media/playback/recover',headers:member,payload:{partId,previousSessionId:takeover.json().id}})).statusCode,409);
  const replay=await app.inject({method:'POST',url:'/api/v1/media/playback',headers:member,payload:{partId}});
  assert.equal(replay.statusCode,201);assert.equal(replay.json().position,replay.json().start);
  const recoverBody={partId,previousSessionId:replay.json().id};
  assert.equal((await app.inject({method:'POST',url:'/api/v1/media/playback/recover',payload:recoverBody})).statusCode,401);
  const recovered=await app.inject({method:'POST',url:'/api/v1/media/playback/recover',headers:member,payload:recoverBody});
  assert.equal(recovered.statusCode,201);assert.equal(recovered.headers['cache-control'],'no-store');
  assert.notEqual(recovered.json().id,replay.json().id);assert.equal(recovered.json().position,replay.json().position);
  assert.equal((await app.inject({method:'POST',url:'/api/v1/media/playback/recover',headers:member,payload:recoverBody})).statusCode,409);
  assert.equal((await app.inject({url:`/api/v1/media/parts/${partId}/progress`,headers:member})).json().completed,false);
  mediaDb.run('UPDATE media_parts SET start_seconds=10,end_seconds=20 WHERE id=?',partId);
  mediaDb.run('UPDATE media_progress SET position=50 WHERE user_id=? AND part_id=?','member',partId);
  const clippedEnd=await app.inject({method:'POST',url:'/api/v1/media/playback',headers:member,payload:{partId}});
  assert.equal(clippedEnd.json().position,20);
  mediaDb.run('UPDATE media_progress SET position=1 WHERE user_id=? AND part_id=?','member',partId);
  const clippedStart=await app.inject({method:'POST',url:'/api/v1/media/playback',headers:member,payload:{partId}});
  assert.equal(clippedStart.json().position,10);
  mediaDb.run('UPDATE media_parts SET start_seconds=0,end_seconds=NULL WHERE id=?',partId);
  await app.inject({method:'PUT',url:`${url}/${id}/access`,headers:admin,payload:{access:'restricted',userIds:[]}});
  assert.equal((await app.inject({url:subtitleListUrl,headers:member})).statusCode,404);
  assert.equal((await app.inject({url:subtitleUrl,headers:member})).statusCode,404);
  assert.equal((await app.inject({url:coverUrl,headers:member})).statusCode,404);
  assert.equal((await app.inject({method:'POST',url:`/api/v1/media/playback/${takeover.json().id}/renew`,headers:member})).statusCode,404);
  assert.equal((await app.inject({url:'/api/v1/media/assets/'+asset.id,headers:member})).statusCode,404);
  assert.equal((await app.inject({url:'/api/v1/media/jobs/'+job.id,headers:member})).statusCode,404);
  assert.equal((await app.inject({url:'/api/v1/media/items/'+itemId,headers:member})).statusCode,404);
  assert.equal((await app.inject({url:session.streamUrl})).statusCode,404);
  for(const path of ['queue','history','favorites'])assert.equal((await app.inject({url:'/api/v1/media/'+path,headers:member})).json().items.length,0);
  // Exercise the public hierarchy schemas and admin boundary, not just catalog methods.
  mediaDb.run("INSERT INTO media_items(id,library_id,kind,local_key,title,metadata_json) VALUES('hierarchy-show',?,'series','hierarchy-show','原剧集','{}')",id);
  mediaDb.run("INSERT INTO media_items(id,library_id,kind,parent_id,local_key,title,ordinal,metadata_json) VALUES('hierarchy-season',?,'season','hierarchy-show','hierarchy-season','第一季',1,'{}')",id);
  mediaDb.run("INSERT INTO media_items(id,library_id,kind,parent_id,local_key,title,ordinal,metadata_json) VALUES('hierarchy-episode',?,'episode','hierarchy-season','hierarchy-episode','第一集',1,'{}')",id);
  const hierarchyUrl='/api/v1/media/items/hierarchy-episode/hierarchy';
  const newHierarchy={seriesTitle:'新剧集',seasonOrdinal:0,ordinal:1,expectedParentId:'hierarchy-season',expectedOrdinal:1};
  const hierarchyCount=()=>mediaDb.get<{n:number}>('SELECT count(*) n FROM media_items')!.n;
  const originalCount=hierarchyCount();
  assert.equal((await app.inject({method:'POST',url:hierarchyUrl,payload:newHierarchy})).statusCode,401);
  assert.equal((await app.inject({method:'POST',url:hierarchyUrl,headers:member,payload:newHierarchy})).statusCode,403);
  for(const payload of [{...newHierarchy,seasonOrdinal:-1},{...newHierarchy,ordinal:1.5},{...newHierarchy,seriesTitle:' '},{...newHierarchy,targetSeriesId:'hierarchy-show'},{...newHierarchy,ordinal:0}]){
    assert.equal((await app.inject({method:'POST',url:hierarchyUrl,headers:admin,payload})).statusCode,400);
    assert.equal(hierarchyCount(),originalCount,'rejected creation must not leave parent records');
  }
  const creation=await app.inject({method:'POST',url:hierarchyUrl,headers:admin,payload:newHierarchy});
  assert.equal(creation.statusCode,201);assert.equal(hierarchyCount(),originalCount+2);
  assert.equal((await app.inject({method:'POST',url:hierarchyUrl,headers:admin,payload:newHierarchy})).statusCode,409);
  assert.equal(hierarchyCount(),originalCount+2);
  const moveHierarchy={targetParentId:'hierarchy-season',ordinal:2,expectedParentId:creation.json().parentId,expectedOrdinal:1};
  assert.equal((await app.inject({method:'PUT',url:hierarchyUrl,headers:member,payload:moveHierarchy})).statusCode,403);
  assert.equal((await app.inject({method:'PUT',url:hierarchyUrl,headers:admin,payload:{...moveHierarchy,ordinal:-1}})).statusCode,400);
  const movedHierarchy=await app.inject({method:'PUT',url:hierarchyUrl,headers:admin,payload:moveHierarchy});
  assert.equal(movedHierarchy.statusCode,200);assert.equal(movedHierarchy.json().parentId,'hierarchy-season');assert.equal(movedHierarchy.json().ordinal,2);
  // These accounts did not exist when the independent database was migrated.
  for(const account of ['late','grant-only','disabled-late'])db.run('INSERT INTO users(id,username,password_hash,role,created_at,updated_at) VALUES(?,?,?,\'member\',0,0)',account,account,'private');
  const late={authorization:'Bearer '+signAccessToken(config,{id:'late',role:'member'}).token};
  assert.equal((await app.inject({method:'PUT',url:`${url}/${id}/access`,headers:admin,payload:{access:'all',userIds:[]}})).statusCode,204);
  const favoriteUrl='/api/v1/media/items/hierarchy-show/favorite';
  assert.equal((await app.inject({method:'PUT',url:favoriteUrl,headers:late,payload:{favorite:true}})).statusCode,200);
  assert.ok(mediaDb.get("SELECT user_id FROM media_favorites WHERE user_id='late'"));
  assert.equal((await app.inject({method:'PUT',url:`${url}/${id}/access`,headers:admin,payload:{access:'restricted',userIds:['late','grant-only']}})).statusCode,204);
  assert.ok(mediaDb.get("SELECT id FROM users WHERE id='grant-only'"));
  db.run("UPDATE users SET disabled=1 WHERE id='disabled-late'");
  const disabledLate={authorization:'Bearer '+signAccessToken(config,{id:'disabled-late',role:'member'}).token};
  assert.equal((await app.inject({method:'PUT',url:favoriteUrl,headers:disabledLate,payload:{favorite:true}})).statusCode,403);
  assert.equal((await app.inject({method:'PUT',url:`${url}/${id}/access`,headers:admin,payload:{access:'restricted',userIds:['disabled-late']}})).statusCode,400);
  if(store){
    assert.deepEqual(store.all<{name:string}>('PRAGMA table_info(users)').map(row=>row.name),['id']);
    assert.equal(store.get("SELECT id FROM users WHERE id='disabled-late'"),undefined);
  }
  db.run("DELETE FROM users WHERE id='late'");
  assert.equal((await app.inject({method:'PUT',url:favoriteUrl,headers:late,payload:{favorite:false}})).statusCode,401);
  if(store){
    assert.ok(store.get("SELECT user_id FROM media_favorites WHERE user_id='late'"),'cleanup is asynchronous; authentication already denies access');
    const cleanup=new MediaAccountCleanup(store,new DatabaseMediaAccounts(db));
    assert.equal(cleanup.sweep(),1);
    assert.equal(store.get("SELECT id FROM users WHERE id='late'"),undefined);
    assert.equal(store.get("SELECT user_id FROM media_favorites WHERE user_id='late'"),undefined);
    assert.equal(store.get("SELECT user_id FROM media_library_users WHERE user_id='late'"),undefined);
    db.run("UPDATE users SET disabled=1 WHERE id='grant-only'");
    assert.equal(cleanup.sweep(),0);assert.ok(store.get("SELECT id FROM users WHERE id='grant-only'"));
    assert.ok(store.get("SELECT id FROM media_items WHERE id='hierarchy-show'"),'shared catalog survives user cleanup');
  }
  const cleanupUrl=`${url}/${id}/missing-resources`;
  assert.equal((await app.inject({url:cleanupUrl+'?path='})).statusCode,401);
  assert.equal((await app.inject({url:cleanupUrl+'?path=',headers:member})).statusCode,403);
  assert.equal((await app.inject({url:cleanupUrl,headers:admin})).statusCode,400);
  assert.equal((await app.inject({url:cleanupUrl+'?path=..',headers:admin})).statusCode,400);
  const absent=await app.inject({url:cleanupUrl+'?path=',headers:admin});assert.equal(absent.statusCode,200);assert.equal(absent.headers['cache-control'],'no-store');
  const cleanupRequest={method:'POST' as const,url:cleanupUrl+'/cleanup',payload:{path:'',revision:absent.json().revision}};
  assert.equal((await app.inject(cleanupRequest)).statusCode,401);
  assert.equal((await app.inject({...cleanupRequest,headers:member})).statusCode,403);
  assert.equal((await app.inject({...cleanupRequest,headers:admin,payload:{path:''}})).statusCode,400);
  assert.equal((await app.inject({...cleanupRequest,headers:admin,payload:{path:'',revision:'0'.repeat(64)}})).statusCode,409);
  const cleaned=await app.inject({...cleanupRequest,headers:admin});assert.equal(cleaned.statusCode,200,cleaned.body);
  assert.deepEqual(mediaDb.all('PRAGMA foreign_key_check'),[]);

  const ruleUrl=`${url}/${id}/recognition-rule`;
  assert.equal((await app.inject({url:ruleUrl+'?path='})).statusCode,401);
  assert.equal((await app.inject({url:ruleUrl+'?path=',headers:member})).statusCode,403);
  const ruleResponse=await app.inject({url:ruleUrl+'?path=',headers:admin});assert.equal(ruleResponse.statusCode,200);
  const ruleWrite={method:'PUT' as const,url:ruleUrl,headers:admin,payload:{path:'Review',revision:ruleResponse.json().revision,rule:{path:'Review',mode:'season',season:2,title:'测试剧集'}}};
  const savedRule=await app.inject(ruleWrite);assert.equal(savedRule.statusCode,200,savedRule.body);
  const loadedRule=await app.inject({url:ruleUrl+'?path=Review',headers:admin});assert.deepEqual(loadedRule.json().rule,ruleWrite.payload.rule);
  assert.equal((await app.inject(ruleWrite)).statusCode,409);
  assert.equal((await app.inject({...ruleWrite,payload:{...ruleWrite.payload,revision:savedRule.json().revision,rule:{path:'Review',mode:'season',season:-1,title:'invalid'}}})).statusCode,400);
  const previewRequest={method:'POST' as const,url:`${url}/${id}/recognition-preview`,payload:{path:'Review'}};
  assert.equal((await app.inject({...previewRequest,headers:member})).statusCode,403);
  const recognitionPreview=await app.inject({...previewRequest,headers:admin});assert.equal(recognitionPreview.statusCode,200,recognitionPreview.body);assert.deepEqual(recognitionPreview.json().items,[]);
  const applyRequest={method:'POST' as const,url:`${url}/${id}/recognition-apply`,payload:{path:'Review',previewId:recognitionPreview.json().id,assetIds:['missing']}};
  assert.equal((await app.inject({...applyRequest,headers:member})).statusCode,403);
  assert.equal((await app.inject({...applyRequest,headers:admin})).statusCode,400);

});