//! Black-box tests for the organization pages: members, teams, settings, the creation policy and
//! the owner choice on the new repo form. They start the real `forge` binary, seed the org rows
//! through the store before the server starts, and then drive the pages over HTTP. Cookies are
//! handled by hand, as in `repo_collaborators_e2e.rs`.

mod common;
use common::{BIN, describe, launch, launch_with, pick_ports, tool_on_path, write_config};
use std::fs;
use std::path::Path;
use std::process::{Command, Output};
use std::time::Duration;

use forge_core::store::orgs::{DefaultRepoRole, OrgMemberRole, OrgSettings};
use forge_core::{Role, Store, Visibility};
use reqwest::header::{COOKIE, HeaderMap, HeaderName, LOCATION, SET_COOKIE};

/// Each test starts its own server, so the tests run one at a time.
static SERIAL: std::sync::LazyLock<tokio::sync::Mutex<()>> =
    std::sync::LazyLock::new(|| tokio::sync::Mutex::new(()));

const PW: &str = "alice-password-123";
/// The one-shot notice cookie of the org pages.
const ORG_NOTICE: &str = "forge_org_notice";

struct Resp {
    status: u16,
    headers: HeaderMap,
    body: String,
}

impl Resp {
    fn header(&self, name: HeaderName) -> Option<String> {
        self.headers
            .get(name)
            .and_then(|v| v.to_str().ok())
            .map(str::to_owned)
    }

    fn set_cookies(&self) -> Vec<String> {
        self.headers
            .get_all(SET_COOKIE)
            .iter()
            .filter_map(|v| v.to_str().ok().map(str::to_owned))
            .collect()
    }
}

struct Http {
    client: reqwest::Client,
    base: String,
}

impl Http {
    fn new(port: u16) -> Self {
        let client = reqwest::Client::builder()
            .redirect(reqwest::redirect::Policy::none())
            .timeout(Duration::from_secs(60))
            .build()
            .expect("http client");
        Self {
            client,
            base: format!("http://127.0.0.1:{port}"),
        }
    }

    async fn get(&self, path: &str, cookie: Option<&str>) -> Resp {
        self.send(self.client.get(format!("{}{path}", self.base)), cookie)
            .await
    }

    async fn post_form(&self, path: &str, form: &[(&str, &str)], cookie: Option<&str>) -> Resp {
        self.send(
            self.client.post(format!("{}{path}", self.base)).form(form),
            cookie,
        )
        .await
    }

    async fn send(&self, req: reqwest::RequestBuilder, cookie: Option<&str>) -> Resp {
        let req = match cookie {
            Some(cookie) => req.header(COOKIE, cookie),
            None => req,
        };
        let res = req.send().await.expect("http request");
        let status = res.status().as_u16();
        let headers = res.headers().clone();
        let body = res.text().await.expect("read body");
        Resp {
            status,
            headers,
            body,
        }
    }
}

/// `name=value` for the cookie whose name ends with `suffix`, ignoring cleared cookies.
fn cookie_named(resp: &Resp, suffix: &str) -> Option<String> {
    resp.set_cookies().iter().find_map(|set| {
        let pair = set.split(';').next()?;
        let (name, value) = pair.split_once('=')?;
        (name.ends_with(suffix) && !value.is_empty()).then(|| format!("{name}={value}"))
    })
}

/// The value of the first `<input name="...">` on a page.
fn input_value(body: &str, name: &str) -> String {
    let doc = scraper::Html::parse_document(body);
    let selector = scraper::Selector::parse(&format!("input[name=\"{name}\"]")).expect("selector");
    doc.select(&selector)
        .next()
        .and_then(|el| el.value().attr("value"))
        .unwrap_or_else(|| panic!("no input named {name} on page"))
        .to_owned()
}

/// The value of the selected option of the `<select name="...">` on a page.
fn selected_value(body: &str, name: &str) -> Option<String> {
    let doc = scraper::Html::parse_document(body);
    let selector = scraper::Selector::parse(&format!("select[name=\"{name}\"] option[selected]"))
        .expect("selector");
    doc.select(&selector)
        .next()
        .and_then(|el| el.value().attr("value"))
        .map(str::to_owned)
}

/// The values of every option of the owner select on the new repo form.
fn owner_options(body: &str) -> Vec<String> {
    let doc = scraper::Html::parse_document(body);
    let selector = scraper::Selector::parse("select[name=\"owner\"] option").expect("selector");
    doc.select(&selector)
        .filter_map(|el| el.value().attr("value").map(str::to_owned))
        .collect()
}

/// Runs an admin subcommand with the password in FORGE_PASSWORD and asserts it succeeded.
fn admin(config: &Path, args: &[&str]) -> Output {
    let out = Command::new(BIN)
        .arg("--config")
        .arg(config)
        .arg("admin")
        .args(args)
        .env("FORGE_PASSWORD", PW)
        .output()
        .expect("run admin command");
    assert!(
        out.status.success(),
        "admin {args:?} failed:\n{}",
        describe(&out)
    );
    out
}

async fn login(http: &Http, username: &str) -> String {
    let page = http.get("/login", None).await;
    assert_eq!(page.status, 200, "GET /login");
    let precsrf_cookie = cookie_named(&page, "forge_precsrf").expect("precsrf cookie");
    let precsrf = input_value(&page.body, "precsrf");
    let res = http
        .post_form(
            "/login",
            &[
                ("username", username),
                ("password", PW),
                ("next", "/"),
                ("precsrf", &precsrf),
            ],
            Some(&precsrf_cookie),
        )
        .await;
    assert_eq!(res.status, 303, "login as {username}: {}", res.body);
    cookie_named(&res, "forge_session").expect("session cookie after login")
}

/// The session's CSRF token, read from a page every signed-in user can open.
async fn csrf_for(http: &Http, session: &str) -> String {
    let page = http.get("/settings/tokens", Some(session)).await;
    assert_eq!(page.status, 200, "GET /settings/tokens");
    input_value(&page.body, "csrf")
}

/// Creates a bare git repo for `repo_id` at its data-dir location, as the create-repo page does.
fn init_bare(data_dir: &Path, repo_id: &str) {
    let path = forge_git::repo::repo_path(data_dir, repo_id).expect("repo path");
    fs::create_dir_all(path.parent().expect("parent")).expect("create repo parent");
    let out = Command::new("git")
        .args(["init", "--bare", "--quiet"])
        .arg(&path)
        .output()
        .expect("run git init");
    assert!(out.status.success(), "git init --bare: {}", describe(&out));
}

/// The org notice cookie from a redirect, joined with the session cookie for the next GET.
fn with_org_notice(session: &str, redirect: &Resp) -> String {
    let notice = cookie_named(redirect, ORG_NOTICE).expect("org notice cookie");
    format!("{session}; {notice}")
}

/// A temp dir short enough for the unix socket path limit.
fn short_temp_dir() -> tempfile::TempDir {
    tempfile::Builder::new()
        .prefix("forg")
        .tempdir_in("/tmp")
        .expect("temp dir")
}

#[tokio::test]
async fn org_members_teams_and_access_end_to_end() {
    let _guard = SERIAL.lock().await;
    if !tool_on_path("git") {
        eprintln!("SKIP orgs_ui_e2e: `git` was not found on PATH");
        return;
    }
    let root = short_temp_dir();
    let dir = root.path().to_path_buf();
    let ports = pick_ports();
    let config = write_config(&dir, ports);

    admin(&config, &["create-user", "root", "--admin"]);
    for name in ["alice", "bob", "carol", "dana"] {
        admin(&config, &["create-user", name]);
    }

    // Acme is alice's org. Bob is a member with no default access, and a team gives him read on
    // acme's private repo. Initech is an empty org, used later for deletion.
    let (alice_id, team_id) = {
        let store = Store::open(&dir.join("forge.db"))
            .await
            .expect("open store");
        let alice = store
            .user_by_username("alice")
            .await
            .unwrap()
            .expect("alice");
        let bob = store.user_by_username("bob").await.unwrap().expect("bob");
        let acme = store.create_org("acme", &alice.id).await.expect("acme");
        store
            .add_org_member(&acme.id, &bob.id, OrgMemberRole::Member)
            .await
            .expect("bob joins acme");
        store
            .set_org_settings(
                &acme.id,
                OrgSettings {
                    default_repo_role: DefaultRepoRole::None,
                    members_can_create_repos: false,
                },
            )
            .await
            .expect("acme settings");
        let proj = store
            .create_repo(&acme.id, "proj", "", Visibility::Private, "main")
            .await
            .expect("acme proj");
        init_bare(&dir, &proj.id);
        let team = store
            .create_team(&acme.id, "devs", "", Role::Read, false)
            .await
            .expect("devs team");
        store
            .add_team_repo(&team.id, &proj.id)
            .await
            .expect("devs covers proj");
        store
            .create_org("initech", &alice.id)
            .await
            .expect("initech");
        (alice.id, team.id)
    };

    let (_server, ports) = launch(&dir, ports).await;
    let http = Http::new(ports.http);
    let alice = login(&http, "alice").await;
    let bob = login(&http, "bob").await;
    let carol = login(&http, "carol").await;
    let dana = login(&http, "dana").await;
    let members = "/org/acme/members";

    // Anonymous visitors go to login. Non-members get 404 on the org pages. Members see the list
    // but no owner controls.
    assert_eq!(http.get(members, None).await.status, 303, "anonymous");
    assert_eq!(
        http.get(members, Some(&carol)).await.status,
        404,
        "carol is not yet a member"
    );
    let bob_view = http.get(members, Some(&bob)).await;
    assert_eq!(bob_view.status, 200, "bob sees the members list");
    assert!(
        !bob_view.body.contains("Add a member"),
        "members get no add form"
    );

    // A member cannot add people. The owner adds carol, and the page shows the notice.
    let bob_csrf = csrf_for(&http, &bob).await;
    let res = http
        .post_form(
            "/org/acme/members/add",
            &[
                ("csrf", &bob_csrf),
                ("username", "carol"),
                ("role", "member"),
            ],
            Some(&bob),
        )
        .await;
    assert_eq!(res.status, 403, "member add is refused: {}", res.body);

    let alice_csrf = csrf_for(&http, &alice).await;
    let res = http
        .post_form(
            "/org/acme/members/add",
            &[
                ("csrf", &alice_csrf),
                ("username", "carol"),
                ("role", "member"),
            ],
            Some(&alice),
        )
        .await;
    assert_eq!(res.status, 303, "owner adds carol: {}", res.body);
    assert_eq!(res.header(LOCATION).as_deref(), Some(members));
    let shown = http
        .get(members, Some(&with_org_notice(&alice, &res)))
        .await;
    assert!(shown.body.contains("Member added."), "notice after add");
    assert!(shown.body.contains("href=\"/carol\""), "carol listed");
    assert_eq!(
        http.get(members, Some(&carol)).await.status,
        200,
        "carol is a member now"
    );

    // The last owner cannot leave. The redirect carries a notice that says why.
    let res = http
        .post_form(
            "/org/acme/members/remove",
            &[("csrf", &alice_csrf), ("user_id", &alice_id)],
            Some(&alice),
        )
        .await;
    assert_eq!(res.status, 303, "leave is answered with a redirect");
    let shown = http
        .get(members, Some(&with_org_notice(&alice, &res)))
        .await;
    assert!(
        shown
            .body
            .contains("An organization needs at least one owner."),
        "last owner notice: {}",
        shown.body
    );

    // Team coverage: bob cannot see acme's private repo until he joins the devs team. Dana is not
    // in the org and never can see it through a team.
    assert_eq!(
        http.get("/acme/proj", Some(&bob)).await.status,
        404,
        "bob before the team"
    );
    assert_eq!(
        http.get("/acme/proj", Some(&dana)).await.status,
        404,
        "a non-member never sees the private org repo"
    );
    let team_page = format!("/org/acme/teams/{team_id}");
    assert_eq!(
        http.get(&team_page, Some(&bob)).await.status,
        200,
        "members see teams"
    );
    let res = http
        .post_form(
            &format!("{team_page}/members/add"),
            &[("csrf", &alice_csrf), ("username", "bob")],
            Some(&alice),
        )
        .await;
    assert_eq!(res.status, 303, "owner adds bob to devs");
    assert_eq!(
        http.get("/acme/proj", Some(&bob)).await.status,
        200,
        "bob reads the repo through devs"
    );
    assert_eq!(
        http.get("/acme/proj", Some(&carol)).await.status,
        404,
        "carol is not in devs"
    );

    // Dana is not an org member, so the team refuses her.
    let res = http
        .post_form(
            &format!("{team_page}/members/add"),
            &[("csrf", &alice_csrf), ("username", "dana")],
            Some(&alice),
        )
        .await;
    assert_eq!(res.status, 303, "refused add still redirects");
    let shown = http
        .get(&team_page, Some(&with_org_notice(&alice, &res)))
        .await;
    assert!(
        shown
            .body
            .contains("Only members of the organization can join its teams."),
        "non-member refused by the team"
    );

    // The new repo form offers the owner's own name and the orgs it may create in. Bob may not
    // create in acme, so acme is not offered to him, and a forged owner is refused.
    let alice_new = http.get("/new", Some(&alice)).await;
    assert!(
        owner_options(&alice_new.body).contains(&"acme".to_string()),
        "owner choice lists acme"
    );
    let bob_new = http.get("/new", Some(&bob)).await;
    assert_eq!(owner_options(&bob_new.body), vec!["bob".to_string()]);
    let res = http
        .post_form(
            "/new",
            &[
                ("csrf", &bob_csrf),
                ("name", "sneaky"),
                ("visibility", "private"),
                ("default_branch", "main"),
                ("owner", "acme"),
            ],
            Some(&bob),
        )
        .await;
    assert_eq!(res.status, 200, "forged owner re-renders the form");
    assert!(
        res.body
            .contains("you cannot create repositories for that owner"),
        "forged owner refused"
    );
}

#[tokio::test]
async fn org_settings_delete_and_audit_end_to_end() {
    let _guard = SERIAL.lock().await;
    if !tool_on_path("git") {
        eprintln!("SKIP orgs_ui_e2e: `git` was not found on PATH");
        return;
    }
    let root = short_temp_dir();
    let dir = root.path().to_path_buf();
    let ports = pick_ports();
    let config = write_config(&dir, ports);

    admin(&config, &["create-user", "root", "--admin"]);
    for name in ["alice", "bob", "dana"] {
        admin(&config, &["create-user", name]);
    }
    {
        let store = Store::open(&dir.join("forge.db"))
            .await
            .expect("open store");
        let alice = store
            .user_by_username("alice")
            .await
            .unwrap()
            .expect("alice");
        let bob = store.user_by_username("bob").await.unwrap().expect("bob");
        let acme = store.create_org("acme", &alice.id).await.expect("acme");
        store
            .add_org_member(&acme.id, &bob.id, OrgMemberRole::Member)
            .await
            .expect("bob joins acme");
        store
            .create_repo(&acme.id, "proj", "", Visibility::Public, "main")
            .await
            .expect("acme proj");
        store
            .create_org("initech", &alice.id)
            .await
            .expect("initech");
    }

    let (_server, ports) = launch(&dir, ports).await;
    let http = Http::new(ports.http);
    let alice = login(&http, "alice").await;
    let bob = login(&http, "bob").await;
    let dana = login(&http, "dana").await;
    let root_session = login(&http, "root").await;
    let settings = "/org/acme/settings";

    // Owners only: members get 403, non-members 404, anonymous visitors go to login.
    assert_eq!(http.get(settings, None).await.status, 303, "anonymous");
    assert_eq!(http.get(settings, Some(&bob)).await.status, 403, "member");
    assert_eq!(
        http.get(settings, Some(&dana)).await.status,
        404,
        "outsider"
    );

    // The owner saves the description and the default role. The page shows the new values.
    let csrf = csrf_for(&http, &alice).await;
    let res = http
        .post_form(
            settings,
            &[
                ("csrf", &csrf),
                ("description", "Anvils and more"),
                ("default_repo_role", "write"),
                ("members_can_create", "on"),
            ],
            Some(&alice),
        )
        .await;
    assert_eq!(res.status, 303, "save settings: {}", res.body);
    let shown = http
        .get(settings, Some(&with_org_notice(&alice, &res)))
        .await;
    assert!(shown.body.contains("Settings saved."), "saved notice");
    assert!(shown.body.contains("Anvils and more"), "description saved");
    assert_eq!(
        selected_value(&shown.body, "default_repo_role").as_deref(),
        Some("write"),
        "default role saved"
    );

    // Deleting acme is refused while it owns a repo, and the name must be typed again.
    let res = http
        .post_form(
            "/org/acme/settings/delete",
            &[("csrf", &csrf), ("confirm", "acme")],
            Some(&alice),
        )
        .await;
    assert_eq!(res.status, 303, "refused delete still redirects");
    let shown = http
        .get(settings, Some(&with_org_notice(&alice, &res)))
        .await;
    assert!(
        shown.body.contains("Transfer or delete the organization"),
        "repos block the delete"
    );
    assert_eq!(
        http.get("/acme", None).await.status,
        200,
        "acme still exists"
    );

    // Initech has no repos, so alice can delete it once she types its name.
    let initech_settings = "/org/initech/settings";
    let res = http
        .post_form(
            "/org/initech/settings/delete",
            &[("csrf", &csrf), ("confirm", "wrong")],
            Some(&alice),
        )
        .await;
    assert_eq!(res.status, 303, "wrong name still redirects");
    assert_eq!(
        http.get(initech_settings, Some(&alice)).await.status,
        200,
        "initech survives a wrong name"
    );
    let res = http
        .post_form(
            "/org/initech/settings/delete",
            &[("csrf", &csrf), ("confirm", "initech")],
            Some(&alice),
        )
        .await;
    assert_eq!(res.status, 303, "delete initech");
    assert_eq!(res.header(LOCATION).as_deref(), Some("/"));
    assert_eq!(
        http.get("/initech", None).await.status,
        404,
        "initech is gone"
    );

    // The admin audit log holds the org actions, by their stored names.
    let audit = http
        .get(
            "/admin/audit?action=org_settings_updated",
            Some(&root_session),
        )
        .await;
    assert_eq!(audit.status, 200, "audit page");
    assert!(
        audit.body.contains("<code>org_settings_updated</code>"),
        "settings change is audited"
    );
    let audit = http
        .get("/admin/audit?action=org_deleted", Some(&root_session))
        .await;
    assert!(
        audit.body.contains("<code>org_deleted</code>"),
        "org deletion is audited"
    );
}

#[tokio::test]
async fn org_creation_can_be_limited_to_admins() {
    let _guard = SERIAL.lock().await;
    let root = short_temp_dir();
    let dir = root.path().to_path_buf();
    let ports = pick_ports();
    let config = write_config(&dir, ports);
    admin(&config, &["create-user", "root", "--admin"]);
    admin(&config, &["create-user", "alice"]);

    let (_server, ports) = launch_with(&dir, ports, "[orgs]\ncreation = \"admin\"\n").await;
    let http = Http::new(ports.http);
    let alice = login(&http, "alice").await;
    let root_session = login(&http, "root").await;

    assert_eq!(
        http.get("/org/new", Some(&alice)).await.status,
        403,
        "a person may not create orgs under the admin policy"
    );
    let csrf = csrf_for(&http, &alice).await;
    let res = http
        .post_form(
            "/org/new",
            &[("csrf", &csrf), ("name", "globex"), ("description", "")],
            Some(&alice),
        )
        .await;
    assert_eq!(res.status, 403, "the POST is refused too");

    assert_eq!(
        http.get("/org/new", Some(&root_session)).await.status,
        200,
        "an admin may create orgs"
    );
    let root_csrf = csrf_for(&http, &root_session).await;
    let res = http
        .post_form(
            "/org/new",
            &[
                ("csrf", &root_csrf),
                ("name", "globex"),
                ("description", "Globals"),
            ],
            Some(&root_session),
        )
        .await;
    assert_eq!(res.status, 303, "admin creates globex: {}", res.body);
    assert_eq!(res.header(LOCATION).as_deref(), Some("/globex"));
    let profile = http.get("/globex", None).await;
    assert_eq!(profile.status, 200, "the org has a public page");
    assert!(
        profile.body.contains("Globals"),
        "description on the profile"
    );
    assert!(profile.body.contains("Organization"), "marked as an org");
}

/// Git on the command line, with no credential helper and no prompts.
fn git(cwd: &Path, args: &[&str]) -> Output {
    Command::new("git")
        .current_dir(cwd)
        .args(["-c", "credential.helper="])
        .args(args)
        .env("GIT_TERMINAL_PROMPT", "0")
        .output()
        .expect("run git")
}

/// Commits one file with a fixed identity.
fn commit_file(repo: &Path, name: &str, content: &str) {
    fs::write(repo.join(name), content).expect("write file");
    let out = git(repo, &["add", name]);
    assert!(out.status.success(), "git add: {}", describe(&out));
    let out = git(
        repo,
        &[
            "-c",
            "user.name=forge",
            "-c",
            "user.email=forge@example.test",
            "-c",
            "commit.gpgsign=false",
            "commit",
            "-q",
            "-m",
            "push over https",
        ],
    );
    assert!(out.status.success(), "git commit: {}", describe(&out));
}

/// A new access token for the session, read from the page that shows it once.
async fn create_token(http: &Http, session: &str) -> String {
    let csrf = csrf_for(http, session).await;
    let res = http
        .post_form(
            "/settings/tokens",
            &[("csrf", &csrf), ("name", "e2e"), ("expires", "30")],
            Some(session),
        )
        .await;
    assert_eq!(res.status, 200, "create token: {}", res.body);
    let doc = scraper::Html::parse_document(&res.body);
    let selector = scraper::Selector::parse("pre.code code").expect("selector");
    doc.select(&selector)
        .next()
        .expect("token shown after creation")
        .text()
        .collect::<String>()
        .trim()
        .to_owned()
}

/// The value of the first option of the `<select name="...">` on a page.
fn first_option(body: &str, name: &str) -> String {
    let doc = scraper::Html::parse_document(body);
    let selector =
        scraper::Selector::parse(&format!("select[name=\"{name}\"] option")).expect("selector");
    doc.select(&selector)
        .next()
        .and_then(|el| el.value().attr("value"))
        .unwrap_or_else(|| panic!("no option in select {name}"))
        .to_owned()
}

#[tokio::test]
async fn org_member_pushes_over_https_through_a_write_team() {
    let _guard = SERIAL.lock().await;
    if !tool_on_path("git") {
        eprintln!("SKIP orgs_ui_e2e: `git` was not found on PATH");
        return;
    }
    let root = short_temp_dir();
    let dir = root.path().to_path_buf();
    let ports = pick_ports();
    let config = write_config(&dir, ports);

    admin(&config, &["create-user", "root", "--admin"]);
    for name in ["alice", "bob", "dana"] {
        admin(&config, &["create-user", name]);
    }
    {
        let store = Store::open(&dir.join("forge.db"))
            .await
            .expect("open store");
        let alice = store
            .user_by_username("alice")
            .await
            .unwrap()
            .expect("alice");
        let bob = store.user_by_username("bob").await.unwrap().expect("bob");
        let acme = store.create_org("acme", &alice.id).await.expect("acme");
        store
            .add_org_member(&acme.id, &bob.id, OrgMemberRole::Member)
            .await
            .expect("bob joins acme");
        store
            .set_org_settings(
                &acme.id,
                OrgSettings {
                    default_repo_role: DefaultRepoRole::None,
                    members_can_create_repos: false,
                },
            )
            .await
            .expect("acme settings");
    }

    let (_server, ports) = launch(&dir, ports).await;
    let http = Http::new(ports.http);
    let alice = login(&http, "alice").await;
    let bob = login(&http, "bob").await;
    let dana = login(&http, "dana").await;

    // Alice creates a private repo under acme through the new repo form.
    let csrf = csrf_for(&http, &alice).await;
    let res = http
        .post_form(
            "/new",
            &[
                ("csrf", &csrf),
                ("name", "pushme"),
                ("visibility", "private"),
                ("default_branch", "main"),
                ("owner", "acme"),
            ],
            Some(&alice),
        )
        .await;
    assert_eq!(res.status, 303, "create acme/pushme: {}", res.body);
    assert_eq!(res.header(LOCATION).as_deref(), Some("/acme/pushme"));

    // A write team takes the repo, and bob joins the team.
    let res = http
        .post_form(
            "/org/acme/teams/new",
            &[
                ("csrf", &csrf),
                ("name", "writers"),
                ("role", "write"),
                ("description", ""),
            ],
            Some(&alice),
        )
        .await;
    assert_eq!(res.status, 303, "create writers: {}", res.body);
    let team_url = res.header(LOCATION).expect("team location");
    let team = http.get(&team_url, Some(&alice)).await;
    assert_eq!(team.status, 200, "team page");
    let repo_id = first_option(&team.body, "repo_id");
    let res = http
        .post_form(
            &format!("{team_url}/repos/add"),
            &[("csrf", &csrf), ("repo_id", &repo_id)],
            Some(&alice),
        )
        .await;
    assert_eq!(res.status, 303, "link pushme to writers");
    let res = http
        .post_form(
            &format!("{team_url}/members/add"),
            &[("csrf", &csrf), ("username", "bob")],
            Some(&alice),
        )
        .await;
    assert_eq!(res.status, 303, "bob joins writers");

    // Bob pushes over HTTPS with his token. Dana is not in the org, so her clone is refused.
    let bob_token = create_token(&http, &bob).await;
    let dana_token = create_token(&http, &dana).await;
    let bob_url = format!(
        "http://bob:{bob_token}@127.0.0.1:{}/acme/pushme.git",
        ports.http
    );
    let dana_url = format!(
        "http://dana:{dana_token}@127.0.0.1:{}/acme/pushme.git",
        ports.http
    );

    let refused = git(&dir, &["clone", &dana_url, "dana-work"]);
    assert!(!refused.status.success(), "dana cannot clone acme/pushme");

    let work = dir.join("bob-work");
    let work_str = work.to_str().expect("utf8 path");
    let clone = git(&dir, &["clone", &bob_url, work_str]);
    assert!(clone.status.success(), "bob clones: {}", describe(&clone));
    commit_file(&work, "hello.txt", "hello over https\n");
    let push = git(&work, &["push", "origin", "HEAD:main"]);
    assert!(push.status.success(), "bob pushes: {}", describe(&push));
}