//! Secret-free navigation and session projections for the terminal interface.

use std::collections::BTreeSet;
use std::net::IpAddr;

use crate::app::{
    ActionEligibility, Application, ApplicationView, ClientDisplay, FirstDeliveryEligibility,
    PeerRecord,
};
use crate::domain::{ApplyStatus, Client, PublicKey};
use crate::runtime::RuntimeObservation;

#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum Screen {
    ClientList,
    ClientDetails,
    Help,
    Progress,
    Message,
}

#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum Focus {
    ClientList,
    Details,
    Dialog,
    Help,
}

#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum DialogKind {
    Rename,
    Delete,
    Create,
    Commit,
    Restart,
    Exit,
}

/// Public client values for both states. No configuration bytes or secrets are
/// retained in a view snapshot.
#[derive(Clone, Debug, Eq, PartialEq)]
pub struct ClientStateRow {
    pub saved: Option<Client>,
    pub draft: Option<Client>,
}

#[derive(Clone, Debug, Eq, PartialEq)]
pub struct SessionView {
    pub generation: u64,
    pub clients: Vec<ClientDisplay>,
    pub client_states: std::collections::BTreeMap<PublicKey, ClientStateRow>,
    /// Number of peer sections in the installed server document, when its
    /// saved bytes can be projected. This includes nonmanaged peers.
    pub saved_peer_count: Option<usize>,
    pub document_issues: Vec<crate::wireguard::DocumentIssue>,
    pub applied: ApplyStatus,
    pub reserved_addresses: BTreeSet<IpAddr>,
    pub statistics: RuntimeObservation,
    pub has_draft: bool,
    pub vault_initialized: bool,
    /// Authoritative application facts used to present action availability.
    /// The parallel fields above are the navigation/rendering projection.
    pub application: Option<ApplicationView>,
}

impl SessionView {
    pub fn from_application(app: &Application, generation: u64) -> Self {
        let application = app.read_model();
        let mut client_states = std::collections::BTreeMap::new();
        for row in &application.clients {
            if let Some(identity) = row.identity {
                if row.saved_client.is_none() && row.draft_client.is_none() {
                    continue;
                }
                let state = client_states
                    .entry(identity)
                    .or_insert_with(|| ClientStateRow {
                        saved: None,
                        draft: None,
                    });
                if state.saved.is_none() {
                    state.saved.clone_from(&row.saved_client);
                }
                if state.draft.is_none() {
                    state.draft.clone_from(&row.draft_client);
                }
            }
        }
        let clients = application
            .clients
            .iter()
            .filter_map(navigation_peer)
            .collect();
        Self {
            generation,
            clients,
            client_states,
            saved_peer_count: Some(application.saved_peer_count),
            document_issues: application.document_issues.clone(),
            applied: application.applied,
            reserved_addresses: application.reservations.committed.iter().copied().collect(),
            statistics: RuntimeObservation::unknown(),
            has_draft: application.has_draft,
            vault_initialized: application.vault_initialized,
            application: Some(application),
        }
    }

    fn application_peer(
        &self,
        identity: PublicKey,
        peer_index: Option<usize>,
    ) -> Option<&PeerRecord> {
        let application = self.application.as_ref()?;
        let mut matching = application
            .clients
            .iter()
            .filter(|peer| peer.identity == Some(identity));
        let peer = matching.next()?;
        if matching.next().is_some() || peer.peer_index != peer_index {
            return None;
        }
        Some(peer)
    }

    pub fn application_record_for_client(&self, client: &ClientDisplay) -> Option<&PeerRecord> {
        let identity = client.identity?;
        self.application_peer(identity, Some(client.peer_index))
    }

    pub fn selected_rename_eligibility(&self, identity: PublicKey, peer_index: usize) -> bool {
        self.application_peer(identity, Some(peer_index))
            .is_some_and(|peer| peer.actions.rename.available)
    }

    pub fn selected_delete_eligibility(&self, identity: PublicKey, peer_index: usize) -> bool {
        self.application_peer(identity, Some(peer_index))
            .is_some_and(|peer| peer.actions.delete.available)
    }

    pub fn selected_first_delivery_eligibility(
        &self,
        identity: PublicKey,
        peer_index: usize,
    ) -> bool {
        self.application_peer(identity, Some(peer_index))
            .is_some_and(|peer| {
                peer.actions.first_delivery != FirstDeliveryEligibility::Unavailable
            })
    }

    pub fn selected_reissue_eligibility(&self, identity: PublicKey, peer_index: usize) -> bool {
        self.application_peer(identity, Some(peer_index))
            .is_some_and(|peer| peer.actions.reissue.available)
    }

    pub fn restart_eligibility(&self) -> Option<&ActionEligibility> {
        self.application.as_ref().map(|view| &view.restart)
    }

    pub fn is_capability_limitation_issue(
        &self,
        client: &ClientDisplay,
        issue: &crate::wireguard::PeerIssue,
    ) -> bool {
        self.application
            .as_ref()
            .and_then(|application| {
                application.clients.iter().find(|peer| {
                    peer.peer_index == Some(client.peer_index) && peer.identity == client.identity
                })
            })
            .and_then(|peer| {
                peer.classified_issues
                    .iter()
                    .find(|classified| &classified.issue == issue)
            })
            .map_or_else(
                || client.is_capability_limitation_issue(issue),
                |classified| classified.class == crate::app::PeerIssueClass::UnsupportedCapability,
            )
    }

    pub fn presented_issues<'a>(
        &'a self,
        client: &'a ClientDisplay,
    ) -> Vec<&'a crate::wireguard::PeerIssue> {
        client
            .issues
            .iter()
            .filter(|issue| !self.is_capability_limitation_issue(client, issue))
            .collect()
    }

    pub fn client_state_change(
        &self,
        client: &ClientDisplay,
    ) -> Option<crate::app::ClientStateChange> {
        self.application
            .as_ref()?
            .clients
            .iter()
            .find(|peer| {
                peer.peer_index == Some(client.peer_index) && peer.identity == client.identity
            })
            .map(|peer| peer.state_change)
    }

    pub fn saved_managed_client_count(&self) -> usize {
        self.application.as_ref().map_or_else(
            || {
                self.client_states
                    .values()
                    .filter(|row| row.saved.is_some())
                    .count()
            },
            |application| application.saved_client_count,
        )
    }

    pub fn managed_change_count(&self) -> usize {
        self.application.as_ref().map_or_else(
            || {
                self.client_states
                    .values()
                    .filter(|row| row.draft != row.saved)
                    .count()
            },
            |application| {
                application
                    .clients
                    .iter()
                    .filter(|peer| {
                        matches!(
                            peer.state_change,
                            crate::app::ClientStateChange::Added
                                | crate::app::ClientStateChange::Removed
                                | crate::app::ClientStateChange::Changed
                        )
                    })
                    .count()
            },
        )
    }

    pub fn contains_identity(&self, identity: &PublicKey) -> bool {
        self.clients
            .iter()
            .any(|client| client.identity == Some(*identity))
    }

    /// Rows shown in the client table. Document issues are deliberately
    /// excluded because they are summaries, not client action targets.
    pub fn visible_records(&self) -> Vec<VisibleRecord<'_>> {
        let mut records = self
            .clients
            .iter()
            .map(VisibleRecord::Peer)
            .collect::<Vec<_>>();
        if let Some(application) = &self.application {
            records.extend(application.clients.iter().filter_map(|peer| {
                if peer.state_change != crate::app::ClientStateChange::Removed {
                    return None;
                }
                Some(VisibleRecord::DraftRemoved {
                    identity: peer.identity?,
                    peer: Some(peer),
                    client: peer.saved_client.as_ref(),
                })
            }));
        } else {
            records.extend(self.client_states.iter().filter_map(|(identity, row)| {
                let client = row.saved.as_ref()?;
                if row.draft.is_some()
                    || self
                        .clients
                        .iter()
                        .any(|peer| peer.identity == Some(*identity))
                {
                    return None;
                }
                Some(VisibleRecord::DraftRemoved {
                    identity: *identity,
                    peer: None,
                    client: Some(client),
                })
            }));
        }
        records
    }
}

fn navigation_peer(peer: &PeerRecord) -> Option<ClientDisplay> {
    let peer_index = peer.peer_index?;
    Some(ClientDisplay {
        peer_index,
        line: peer.line,
        identity: peer.identity,
        label: peer.label.clone(),
        allowed_ips: peer.allowed_ips.clone(),
        has_subnet_routes: peer.has_subnet_routes,
        issues: peer.issues.clone(),
        mutable_identity: peer.mutable_identity,
    })
}

#[derive(Clone, Copy, Debug)]
pub enum VisibleRecord<'a> {
    Peer(&'a ClientDisplay),
    DraftRemoved {
        identity: PublicKey,
        peer: Option<&'a PeerRecord>,
        client: Option<&'a Client>,
    },
}

impl VisibleRecord<'_> {
    pub fn identity(self) -> Option<PublicKey> {
        match self {
            Self::Peer(client) => client.identity,
            Self::DraftRemoved { identity, .. } => Some(identity),
        }
    }

    pub fn peer_index(self) -> Option<usize> {
        match self {
            Self::Peer(client) => Some(client.peer_index),
            Self::DraftRemoved { .. } => None,
        }
    }
}

#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum OperationKind {
    CreateClient,
    RenameClient,
    DeleteClient,
    DiscardDraft,
    Commit,
    CreateBackup,
    ListBackups,
    ImportSelectedFile,
    InitialSetup,
    PreviewRestart,
    Restart,
    DeliverClient,
    Restore,
}

#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub struct PendingOperation {
    pub request_id: u64,
    pub kind: OperationKind,
    pub generation: u64,
}

/// Mutable UI navigation and latest accepted worker projection.
#[derive(Clone, Debug, Eq, PartialEq)]
pub struct UiState {
    pub screen: Screen,
    pub focus: Focus,
    pub dialog: Option<DialogKind>,
    pub selected_identity: Option<PublicKey>,
    /// Authoritative document index used only to inspect malformed peers that
    /// have no public key. Mutating actions must always use selected_identity.
    pub selected_peer_index: Option<usize>,
    pub scroll_offset: usize,
    pub generation: u64,
    pub view: Option<SessionView>,
    pub pending: Option<PendingOperation>,
    pub status_message: Option<String>,
}

impl Default for UiState {
    fn default() -> Self {
        Self {
            screen: Screen::ClientList,
            focus: Focus::ClientList,
            dialog: None,
            selected_identity: None,
            selected_peer_index: None,
            scroll_offset: 0,
            generation: 0,
            view: None,
            pending: None,
            status_message: None,
        }
    }
}

impl UiState {
    /// Replace the view only when it belongs to the current generation. The
    /// selected full public key remains stable through sorting and refreshes.
    pub fn apply_view(&mut self, view: SessionView) -> bool {
        if view.generation != self.generation {
            return false;
        }
        self.reconcile_selection(&view);
        self.view = Some(view);
        true
    }

    fn reconcile_selection(&mut self, view: &SessionView) {
        if let Some(identity) = self.selected_identity {
            let matching = view
                .clients
                .iter()
                .filter(|client| client.identity == Some(identity))
                .collect::<Vec<_>>();
            if matching.len() == 1 {
                self.selected_peer_index = Some(matching[0].peer_index);
                return;
            }
            if matching.len() > 1 {
                if self
                    .selected_peer_index
                    .is_some_and(|index| matching.iter().any(|client| client.peer_index == index))
                {
                    return;
                }
                // The old row disappeared and the key is now ambiguous. Do
                // not guess which peer the administrator meant.
                self.selected_identity = None;
                self.selected_peer_index = None;
                self.select_first_record(view);
                return;
            }
            let removed = view.visible_records().iter().any(|record| {
                matches!(record, VisibleRecord::DraftRemoved { identity: removed, .. } if *removed == identity)
            });
            if removed {
                self.selected_peer_index = None;
                return;
            }
            self.selected_identity = None;
            self.selected_peer_index = None;
        }

        if let Some(peer_index) = self.selected_peer_index {
            if let Some(client) = view
                .clients
                .iter()
                .find(|client| client.peer_index == peer_index)
            {
                self.selected_identity = client.identity;
                return;
            }
            self.selected_peer_index = None;
        }

        if self.selected_identity.is_some_and(|identity| {
            view.visible_records().iter().any(|record| {
                matches!(record, VisibleRecord::DraftRemoved { identity: removed, .. } if *removed == identity)
            })
        }) {
            return;
        }

        self.select_first_record(view);
    }

    fn select_first_record(&mut self, view: &SessionView) {
        match view.visible_records().first().copied() {
            Some(VisibleRecord::Peer(client)) => {
                self.selected_peer_index = Some(client.peer_index);
                self.selected_identity = client.identity;
            }
            Some(VisibleRecord::DraftRemoved { identity, .. }) => {
                self.selected_peer_index = None;
                self.selected_identity = Some(identity);
            }
            None => {
                self.selected_peer_index = None;
                self.selected_identity = None;
            }
        }
    }

    /// Apply only statistics sampled from the still-current saved/draft view.
    /// This never changes the applied-state marker.
    pub fn apply_statistics(&mut self, generation: u64, statistics: RuntimeObservation) -> bool {
        if generation != self.generation {
            return false;
        }
        let Some(view) = self.view.as_mut() else {
            return false;
        };
        if view.generation != generation {
            return false;
        }
        view.statistics = statistics;
        true
    }

    pub fn begin_operation(&mut self, operation: PendingOperation) -> bool {
        if self.pending.is_some() || operation.generation < self.generation {
            return false;
        }
        self.generation = operation.generation;
        self.pending = Some(operation);
        self.screen = Screen::Progress;
        true
    }

    /// Close a form/dialog without cancelling work already submitted to the
    /// application worker. The pending progress state remains visible.
    pub fn cancel_dialog(&mut self) {
        self.dialog = None;
        if self.pending.is_some() {
            self.screen = Screen::Progress;
        } else {
            self.screen = if self.selected_identity.is_some() {
                Screen::ClientDetails
            } else {
                Screen::ClientList
            };
        }
    }

    pub fn finish_operation(&mut self, operation: PendingOperation) -> bool {
        if self.pending != Some(operation) {
            return false;
        }
        self.pending = None;
        self.screen = if self.dialog.is_some() {
            Screen::Message
        } else if self.selected_identity.is_some() {
            Screen::ClientDetails
        } else {
            Screen::ClientList
        };
        true
    }

    pub fn select(&mut self, identity: PublicKey) -> bool {
        let Some(view) = &self.view else { return false };
        let mut matching = view
            .clients
            .iter()
            .filter(|row| row.identity == Some(identity));
        let Some(client) = matching.next() else {
            return false;
        };
        if matching.next().is_some() {
            return false;
        }
        self.selected_identity = Some(identity);
        self.selected_peer_index = Some(client.peer_index);
        self.screen = Screen::ClientDetails;
        true
    }

    pub fn select_peer_index(&mut self, peer_index: usize) -> bool {
        if !self.highlight_peer_index(peer_index) {
            return false;
        }
        self.screen = Screen::ClientDetails;
        true
    }

    /// Move the client-list highlight without changing the active screen.
    pub fn highlight_peer_index(&mut self, peer_index: usize) -> bool {
        let Some(client) = self.view.as_ref().and_then(|view| {
            view.clients
                .iter()
                .find(|client| client.peer_index == peer_index)
        }) else {
            return false;
        };
        self.selected_peer_index = Some(peer_index);
        self.selected_identity = client.identity;
        true
    }

    pub fn selected_record(&self) -> Option<VisibleRecord<'_>> {
        let view = self.view.as_ref()?;
        let records = view.visible_records();
        self.selected_visible_index(&records)
            .and_then(|index| records.get(index).copied())
    }

    pub fn selected_visible_index(&self, records: &[VisibleRecord<'_>]) -> Option<usize> {
        self.selected_peer_index
            .and_then(|peer_index| {
                records
                    .iter()
                    .position(|record| record.peer_index() == Some(peer_index))
            })
            .or_else(|| {
                self.selected_identity.and_then(|identity| {
                    records
                        .iter()
                        .position(|record| record.identity() == Some(identity))
                })
            })
            .or_else(|| (!records.is_empty()).then_some(0))
    }

    pub fn select_visible_index(&mut self, selected: usize) -> bool {
        let Some(record) = self
            .view
            .as_ref()
            .and_then(|view| view.visible_records().get(selected).copied())
        else {
            return false;
        };
        match record {
            VisibleRecord::Peer(client) => {
                self.selected_peer_index = Some(client.peer_index);
                self.selected_identity = client.identity;
            }
            VisibleRecord::DraftRemoved { identity, .. } => {
                self.selected_peer_index = None;
                self.selected_identity = Some(identity);
            }
        }
        self.scroll_offset = 0;
        true
    }

    pub fn open_selected_record(&mut self) -> bool {
        let Some(view) = &self.view else { return false };
        let records = view.visible_records();
        let Some(index) = self.selected_visible_index(&records) else {
            return false;
        };
        self.select_visible_index(index);
        self.screen = Screen::ClientDetails;
        self.scroll_offset = 0;
        true
    }

    pub fn selected_client_mutable(&self) -> bool {
        let Some(identity) = self.selected_identity else {
            return false;
        };
        self.view.as_ref().is_some_and(|view| {
            let mut matching = view
                .clients
                .iter()
                .filter(|client| client.identity == Some(identity));
            let Some(client) = matching.next() else {
                return false;
            };
            matching.next().is_none()
                && self
                    .selected_peer_index
                    .is_none_or(|peer_index| peer_index == client.peer_index)
                && client.mutable_identity == Some(identity)
        })
    }

    pub fn selected_rename_available(&self) -> bool {
        self.view.as_ref().is_some_and(|view| {
            view.application.as_ref().map_or_else(
                || self.selected_client_mutable(),
                |_| self.selected_peer_action(|peer| peer.actions.rename.available),
            )
        })
    }

    pub fn selected_delete_available(&self) -> bool {
        self.view.as_ref().is_some_and(|view| {
            view.application.as_ref().map_or_else(
                || self.selected_client_mutable(),
                |_| self.selected_peer_action(|peer| peer.actions.delete.available),
            )
        })
    }

    pub fn selected_first_delivery_available(&self) -> bool {
        self.view.as_ref().is_some_and(|view| {
            view.application.as_ref().map_or_else(
                || self.selected_client_is_saved(),
                |_| {
                    self.selected_peer_action(|peer| {
                        peer.actions.first_delivery != FirstDeliveryEligibility::Unavailable
                    })
                },
            )
        })
    }

    pub fn selected_reissue_available(&self) -> bool {
        self.view.as_ref().is_some_and(|view| {
            view.application.as_ref().map_or_else(
                || self.selected_client_is_saved(),
                |_| self.selected_peer_action(|peer| peer.actions.reissue.available),
            )
        })
    }

    fn selected_client_is_saved(&self) -> bool {
        self.selected_identity.is_some_and(|identity| {
            self.view
                .as_ref()
                .and_then(|view| view.client_states.get(&identity))
                .is_some_and(|row| row.saved.is_some())
        })
    }

    fn selected_peer_action(&self, action: impl FnOnce(&PeerRecord) -> bool) -> bool {
        let (Some(identity), Some(peer_index)) = (self.selected_identity, self.selected_peer_index)
        else {
            return false;
        };
        self.view
            .as_ref()
            .and_then(|view| view.application_peer(identity, Some(peer_index)))
            .is_some_and(action)
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::app::{
        ActionEligibility, ActionUnavailableReason, ClientActions, ClientStateChange,
        FirstDeliveryEligibility, PeerIssueClass, ReservationFacts,
    };
    use crate::domain::PublicKey;
    use crate::wireguard::PeerIssue;

    fn row(identity: PublicKey, label: &str, mutable: bool) -> ClientDisplay {
        ClientDisplay {
            peer_index: 0,
            line: 1,
            identity: Some(identity),
            label: label.to_owned(),
            allowed_ips: vec!["10.0.0.2/32".to_owned()],
            has_subnet_routes: false,
            issues: if mutable {
                Vec::new()
            } else {
                vec![PeerIssue::MissingIpv4HostRoute]
            },
            mutable_identity: mutable.then_some(identity),
        }
    }

    fn view(generation: u64, clients: Vec<ClientDisplay>) -> SessionView {
        SessionView {
            generation,
            clients,
            client_states: Default::default(),
            saved_peer_count: None,
            document_issues: Vec::new(),
            applied: ApplyStatus::Unknown,
            reserved_addresses: BTreeSet::new(),
            statistics: RuntimeObservation::unknown(),
            has_draft: false,
            vault_initialized: true,
            application: None,
        }
    }

    fn application_peer(
        identity: PublicKey,
        peer_index: usize,
        actions: ClientActions,
    ) -> PeerRecord {
        PeerRecord {
            peer_index: Some(peer_index),
            draft_peer_index: Some(peer_index),
            saved_peer_index: Some(peer_index),
            line: peer_index + 1,
            identity: Some(identity),
            label: "inspect-only peer".to_owned(),
            allowed_ips: vec!["10.0.0.2/32".to_owned()],
            has_subnet_routes: false,
            issues: vec![PeerIssue::MissingIpv4HostRoute],
            classified_issues: vec![crate::app::ClassifiedPeerIssue {
                issue: PeerIssue::MissingIpv4HostRoute,
                class: PeerIssueClass::MalformedOrAmbiguous,
            }],
            mutable_identity: None,
            draft_client: None,
            saved_client: None,
            state_change: ClientStateChange::UnsupportedOrUnmanaged,
            actions,
        }
    }

    fn available_actions(delete: bool) -> ClientActions {
        let unavailable = ActionEligibility {
            available: false,
            reason: Some(ActionUnavailableReason::UnsafePeerOrDocument),
        };
        ClientActions {
            rename: unavailable.clone(),
            delete: if delete {
                ActionEligibility {
                    available: true,
                    reason: None,
                }
            } else {
                unavailable.clone()
            },
            first_delivery: FirstDeliveryEligibility::Unavailable,
            reissue: unavailable,
        }
    }

    fn application_view(records: Vec<PeerRecord>) -> ApplicationView {
        ApplicationView {
            clients: records,
            document_issues: Vec::new(),
            saved_peer_count: 1,
            draft_client_count: 0,
            saved_client_count: 0,
            reservations: ReservationFacts::default(),
            applied: ApplyStatus::Unknown,
            vault_initialized: false,
            has_draft: false,
            restart: ActionEligibility {
                available: true,
                reason: None,
            },
        }
    }

    #[test]
    fn refresh_preserves_selection_by_public_key_not_alias_or_row_position() {
        let a = PublicKey::from_bytes([1; 32]);
        let b = PublicKey::from_bytes([2; 32]);
        let mut state = UiState::default();
        assert!(state.apply_view(view(
            0,
            vec![row(a, "same alias", true), row(b, "same alias", true)]
        )));
        assert!(state.select(b));
        assert!(state.apply_view(view(
            0,
            vec![row(b, "renamed", true), row(a, "same alias", true)]
        )));
        assert_eq!(state.selected_identity, Some(b));
    }

    #[test]
    fn stale_view_is_rejected_and_unsupported_selected_peer_is_not_mutable() {
        let key = PublicKey::from_bytes([3; 32]);
        let mut state = UiState::default();
        assert!(state.apply_view(view(0, vec![row(key, "legacy", false)])));
        assert!(state.select(key));
        assert!(!state.selected_client_mutable());
        state.generation = 1;
        assert!(!state.apply_view(view(0, vec![row(key, "stale", true)])));
        assert_eq!(state.selected_identity, Some(key));
    }

    #[test]
    fn malformed_peer_can_be_inspected_by_document_location_without_mutation_identity() {
        let mut malformed = row(PublicKey::from_bytes([8; 32]), "malformed", false);
        malformed.identity = None;
        malformed.mutable_identity = None;
        malformed.peer_index = 3;
        let mut state = UiState::default();
        assert!(state.apply_view(view(0, vec![malformed])));
        assert!(state.select_peer_index(3));
        assert_eq!(state.selected_identity, None);
        assert_eq!(state.selected_peer_index, Some(3));
        assert!(!state.selected_client_mutable());
    }

    #[test]
    fn selection_uses_peer_position_for_duplicate_keys_and_disables_mutation() {
        let key = PublicKey::from_bytes([12; 32]);
        let mut first = row(key, "first duplicate", true);
        first.peer_index = 3;
        let mut second = row(key, "second duplicate", true);
        second.peer_index = 8;
        let mut state = UiState::default();
        assert!(state.apply_view(view(0, vec![first, second])));
        assert_eq!(state.selected_peer_index, Some(3));
        assert!(!state.selected_client_mutable());
        assert!(state.highlight_peer_index(8));
        assert_eq!(state.selected_record().unwrap().peer_index(), Some(8));
        assert_eq!(
            match state.selected_record().unwrap() {
                VisibleRecord::Peer(client) => client.label.as_str(),
                VisibleRecord::DraftRemoved { .. } => panic!("duplicate resolved to removal"),
            },
            "second duplicate"
        );
        assert!(!state.selected_client_mutable());

        let mut refreshed_first = row(key, "refreshed first", true);
        refreshed_first.peer_index = 3;
        let mut refreshed_second = row(key, "refreshed second", true);
        refreshed_second.peer_index = 8;
        assert!(state.apply_view(view(0, vec![refreshed_second, refreshed_first])));
        assert_eq!(state.selected_peer_index, Some(8));
        assert_eq!(
            match state.selected_record().unwrap() {
                VisibleRecord::Peer(client) => client.label.as_str(),
                VisibleRecord::DraftRemoved { .. } => panic!("duplicate resolved to removal"),
            },
            "refreshed second"
        );
        assert!(!state.selected_client_mutable());
    }

    #[test]
    fn action_eligibility_is_per_action_and_bound_to_the_selected_peer_position() {
        let identity = PublicKey::from_bytes([40; 32]);
        let mut peer = application_peer(identity, 6, available_actions(true));
        let mut session = view(
            0,
            vec![ClientDisplay {
                peer_index: 6,
                line: 7,
                identity: Some(identity),
                label: peer.label.clone(),
                allowed_ips: peer.allowed_ips.clone(),
                has_subnet_routes: false,
                issues: peer.issues.clone(),
                mutable_identity: None,
            }],
        );
        session.application = Some(application_view(vec![peer.clone()]));
        let mut state = UiState {
            view: Some(session),
            ..UiState::default()
        };
        assert!(state.select_peer_index(6));
        assert!(!state.selected_client_mutable());
        assert!(!state.selected_rename_available());
        assert!(state.selected_delete_available());
        assert!(!state.selected_first_delivery_available());
        assert!(!state.selected_reissue_available());

        state.selected_peer_index = Some(7);
        assert!(!state.selected_delete_available());

        peer.peer_index = Some(7);
        if let Some(application) = state
            .view
            .as_mut()
            .and_then(|view| view.application.as_mut())
        {
            application.clients.push(peer);
        }
        state.selected_peer_index = Some(6);
        assert!(!state.selected_delete_available());
    }

    #[test]
    fn malformed_peer_inspection_never_inherits_keyed_action_eligibility() {
        let identity = PublicKey::from_bytes([41; 32]);
        let keyed = application_peer(identity, 2, available_actions(true));
        let mut malformed = keyed.clone();
        malformed.peer_index = Some(9);
        malformed.draft_peer_index = Some(9);
        malformed.identity = None;
        let mut inspection = row(identity, "peer", false);
        inspection.peer_index = 9;
        inspection.identity = None;
        let mut state_view = view(0, vec![inspection]);
        state_view.application = Some(application_view(vec![keyed.clone(), malformed]));
        let mut state = UiState {
            view: Some(state_view),
            ..UiState::default()
        };
        assert!(state.select_peer_index(9));
        assert_eq!(state.selected_identity, None);
        assert!(!state.selected_delete_available());
    }

    #[test]
    fn removed_saved_client_is_visible_and_never_mutable() {
        let key = PublicKey::from_bytes([13; 32]);
        let removed = Client::new(
            key,
            "removed alias",
            crate::domain::ClientAddresses {
                ipv4: "10.0.0.9".parse().unwrap(),
                ipv6: None,
            },
        )
        .unwrap();
        let mut view = view(0, Vec::new());
        view.client_states.insert(
            key,
            ClientStateRow {
                saved: Some(removed),
                draft: None,
            },
        );
        view.document_issues
            .push(crate::wireguard::DocumentIssue::MalformedSectionHeader { line: 5 });
        let mut state = UiState::default();
        assert!(state.apply_view(view));
        assert_eq!(state.selected_identity, Some(key));
        assert_eq!(
            state.selected_visible_index(&state.view.as_ref().unwrap().visible_records()),
            Some(0)
        );
        assert!(matches!(
            state.selected_record(),
            Some(VisibleRecord::DraftRemoved { identity, .. }) if identity == key
        ));
        assert!(!state.selected_client_mutable());
        assert_eq!(state.view.as_ref().unwrap().visible_records().len(), 1);
    }

    #[test]
    fn read_model_removed_rows_remain_visible_without_state_map_reconstruction() {
        let identity = PublicKey::from_bytes([42; 32]);
        let removed = Client::new(
            identity,
            "removed by draft",
            crate::domain::ClientAddresses {
                ipv4: "10.0.0.42".parse().unwrap(),
                ipv6: None,
            },
        )
        .unwrap();
        let mut peer = application_peer(identity, 0, available_actions(false));
        peer.peer_index = None;
        peer.draft_peer_index = None;
        peer.saved_client = Some(removed.clone());
        peer.state_change = ClientStateChange::Removed;
        let mut session = view(0, Vec::new());
        session.application = Some(application_view(vec![peer]));

        let mut state = UiState::default();
        assert!(state.apply_view(session));
        assert_eq!(state.selected_identity, Some(identity));
        assert!(matches!(
            state.selected_record(),
            Some(VisibleRecord::DraftRemoved {
                identity: selected,
                client: Some(client),
                ..
            }) if selected == identity && client == &removed
        ));
        assert!(state.view.as_ref().unwrap().client_states.is_empty());
        assert!(!state.selected_delete_available());
    }

    #[test]
    fn removed_unprojectable_authoritative_peer_stays_selectable_without_actions() {
        let identity = PublicKey::from_bytes([43; 32]);
        let mut peer = application_peer(identity, 0, available_actions(true));
        peer.peer_index = None;
        peer.draft_peer_index = None;
        peer.saved_peer_index = Some(4);
        peer.label = "legacy route peer".to_owned();
        peer.allowed_ips = vec!["10.0.0.43/32".to_owned()];
        peer.saved_client = None;
        peer.state_change = ClientStateChange::Removed;
        let mut session = view(0, Vec::new());
        session.application = Some(application_view(vec![peer]));

        let mut state = UiState::default();
        assert!(state.apply_view(session));
        assert_eq!(state.selected_identity, Some(identity));
        assert_eq!(state.selected_peer_index, None);
        assert!(matches!(
            state.selected_record(),
            Some(VisibleRecord::DraftRemoved {
                identity: selected,
                peer: Some(record),
                client: None,
            }) if selected == identity && record.label == "legacy route peer"
        ));
        assert!(!state.selected_client_mutable());
        assert!(!state.selected_rename_available());
        assert!(!state.selected_delete_available());
        assert!(!state.selected_first_delivery_available());
        assert!(!state.selected_reissue_available());
        assert!(state.open_selected_record());
        assert_eq!(state.screen, Screen::ClientDetails);
    }

    #[test]
    fn cancelling_a_dialog_does_not_claim_submitted_work_was_cancelled() {
        let mut state = UiState {
            dialog: Some(DialogKind::Commit),
            ..UiState::default()
        };
        let operation = PendingOperation {
            request_id: 4,
            kind: OperationKind::Commit,
            generation: 1,
        };
        assert!(state.begin_operation(operation));
        state.cancel_dialog();
        assert_eq!(state.pending, Some(operation));
        assert_eq!(state.screen, Screen::Progress);
    }

    #[test]
    fn statistics_refresh_is_generation_bound_and_never_changes_applied_state() {
        let key = PublicKey::from_bytes([4; 32]);
        let mut state = UiState::default();
        assert!(state.apply_view(view(0, vec![row(key, "client", true)])));
        assert!(state.apply_statistics(0, RuntimeObservation::unknown()));
        assert_eq!(state.view.as_ref().unwrap().applied, ApplyStatus::Unknown);
        state.generation = 1;
        assert!(!state.apply_statistics(0, RuntimeObservation::unknown()));
    }
}