owpengram-server/internal/app/bots/verifierbot_test.go

package bots

import (
	"context"
	"sort"
	"strings"
	"testing"
	"time"

	"telesrv/internal/domain"
	"telesrv/internal/store/memory"
)

// ---------------------------------------------------------------------------
// Fake third-party verification service
// ---------------------------------------------------------------------------

// fakeCustomVerification is an in-memory stand-in for app/botverification.Service.
// It keeps the properties the dialog leans on: verifier status that an operator may
// or may not have granted, one pending application per (verifier, peer), marks that
// exist independently of the applications, and a revoke that reports whether it
// actually removed anything.
type fakeCustomVerification struct {
	settings      domain.BotVerifierSettings
	settingsFound bool
	settingsErr   error
	requests      map[int64]domain.CustomVerificationRequest
	marks         map[domain.Peer]domain.CustomVerification
	nextID        int64
	creates       int
	revokes       int
	revokedPeers  []domain.Peer
	createErr     error
}

func newFakeCustomVerification() *fakeCustomVerification {
	return &fakeCustomVerification{
		requests: make(map[int64]domain.CustomVerificationRequest),
		marks:    make(map[domain.Peer]domain.CustomVerification),
		nextID:   700,
	}
}

// activated grants the bot the verifier status an operator would grant in the admin
// panel.
func (f *fakeCustomVerification) activated() *fakeCustomVerification {
	f.settings = verifierTestSettings()
	f.settingsFound = true
	return f
}

func verifierTestSettings() domain.BotVerifierSettings {
	return domain.BotVerifierSettings{
		BotID:              domain.VerifierBotUserID,
		IconDocumentID:     990001,
		CompanyName:        "Example Trust",
		DefaultDescription: "Identity checked by Example Trust",
		Enabled:            true,
		GrantedBy:          "operator",
		GrantReason:        "reference verifier of this deployment",
		Version:            1,
	}
}

func (f *fakeCustomVerification) VerifierSettings(_ context.Context, botID int64) (domain.BotVerifierSettings, error) {
	if f.settingsErr != nil {
		return domain.BotVerifierSettings{}, f.settingsErr
	}
	if botID != domain.VerifierBotUserID || !f.settingsFound {
		return domain.BotVerifierSettings{}, domain.ErrVerifierNotFound
	}
	return f.settings, nil
}

func (f *fakeCustomVerification) CreateRequest(_ context.Context, req domain.CustomVerificationRequest) (domain.CustomVerificationRequest, error) {
	f.creates++
	if f.createErr != nil {
		return domain.CustomVerificationRequest{}, f.createErr
	}
	// The record the bot hands over must be a valid one: this is what keeps the dialog
	// from filing paperwork the service would have to reject.
	if err := req.Validate(); err != nil {
		return domain.CustomVerificationRequest{}, err
	}
	for _, existing := range f.requests {
		if existing.VerifierBotID == req.VerifierBotID && existing.Peer == req.Peer &&
			existing.Status == domain.CustomVerificationPending {
			return domain.CustomVerificationRequest{}, domain.ErrCustomVerificationRequestExists
		}
	}
	f.nextID++
	req.ID = f.nextID
	req.CreatedAt = time.Date(2026, 7, 26, 10, 0, 0, 0, time.UTC)
	req.Version = 1
	f.requests[req.ID] = req
	return req, nil
}

func (f *fakeCustomVerification) ApplicantRequests(_ context.Context, applicantUserID int64, limit int) ([]domain.CustomVerificationRequest, error) {
	out := make([]domain.CustomVerificationRequest, 0, len(f.requests))
	for _, req := range f.requests {
		if req.ApplicantUserID == applicantUserID {
			out = append(out, req)
		}
	}
	sort.Slice(out, func(i, j int) bool { return out[i].ID > out[j].ID })
	if limit > 0 && len(out) > limit {
		out = out[:limit]
	}
	return out, nil
}

func (f *fakeCustomVerification) PendingRequest(_ context.Context, verifierBotID int64, peer domain.Peer) (domain.CustomVerificationRequest, error) {
	for _, req := range f.requests {
		if req.VerifierBotID == verifierBotID && req.Peer == peer && req.Status == domain.CustomVerificationPending {
			return req, nil
		}
	}
	return domain.CustomVerificationRequest{}, domain.ErrCustomVerificationRequestNotFound
}

func (f *fakeCustomVerification) RevokeMark(_ context.Context, verifierBotID int64, peer domain.Peer) (bool, error) {
	f.revokes++
	f.revokedPeers = append(f.revokedPeers, peer)
	mark, found := f.marks[peer]
	if !found || mark.VerifierBotID != verifierBotID {
		return false, nil
	}
	delete(f.marks, peer)
	for id, req := range f.requests {
		if req.Peer == peer && req.Status == domain.CustomVerificationApproved {
			req.Status = domain.CustomVerificationRevoked
			req.Version++
			f.requests[id] = req
		}
	}
	return true, nil
}

func (f *fakeCustomVerification) Marks(_ context.Context, filter domain.CustomVerificationFilter) ([]domain.CustomVerification, error) {
	out := make([]domain.CustomVerification, 0, len(f.marks))
	for peer, mark := range f.marks {
		if filter.VerifierBotID != 0 && mark.VerifierBotID != filter.VerifierBotID {
			continue
		}
		if filter.PeerType != "" && peer.Type != filter.PeerType {
			continue
		}
		if filter.PeerID != 0 && peer.ID != filter.PeerID {
			continue
		}
		out = append(out, mark)
	}
	sort.Slice(out, func(i, j int) bool { return out[i].Peer.ID < out[j].Peer.ID })
	if filter.Limit > 0 && len(out) > filter.Limit {
		out = out[:filter.Limit]
	}
	return out, nil
}

// grantMark is what an operator's approval leaves behind: an approved application
// and the mark itself.
func (f *fakeCustomVerification) grantMark(applicantUserID int64, peer domain.Peer, title, username string) domain.CustomVerificationRequest {
	f.nextID++
	req := domain.CustomVerificationRequest{
		ID:              f.nextID,
		VerifierBotID:   domain.VerifierBotUserID,
		ApplicantUserID: applicantUserID,
		Peer:            peer,
		PeerTitle:       title,
		PeerUsername:    username,
		Reason:          "the newsroom of the Example Foundation",
		Status:          domain.CustomVerificationApproved,
		DecidedBy:       "operator",
		InternalNote:    "operator note: applicant escalated by email, watch this one",
		CreatedAt:       time.Date(2026, 7, 18, 9, 0, 0, 0, time.UTC),
		ApprovedAt:      time.Date(2026, 7, 20, 9, 0, 0, 0, time.UTC),
		Version:         2,
	}
	f.requests[req.ID] = req
	f.marks[peer] = domain.CustomVerification{
		ID:              req.ID,
		VerifierBotID:   domain.VerifierBotUserID,
		Peer:            peer,
		IconDocumentID:  990001,
		Description:     "Identity checked by Example Trust",
		GrantedByUserID: 1,
		Version:         1,
	}
	return req
}

var _ customVerifications = (*fakeCustomVerification)(nil)

// fakeVerifierTargets is the directory of the applicant's own peers.
type fakeVerifierTargets struct {
	targets []domain.VerificationTarget
	err     error
	calls   int
}

func (f *fakeVerifierTargets) EligibleTargets(_ context.Context, applicantUserID int64) ([]domain.VerificationTarget, error) {
	f.calls++
	if f.err != nil {
		return nil, f.err
	}
	if applicantUserID <= 0 {
		return nil, domain.ErrCustomVerificationRequestInvalid
	}
	return append([]domain.VerificationTarget(nil), f.targets...), nil
}

var _ verifierBotTargets = (*fakeVerifierTargets)(nil)

// ---------------------------------------------------------------------------
// Harness
// ---------------------------------------------------------------------------

func verifierTestTargets(owner domain.User) *fakeVerifierTargets {
	return &fakeVerifierTargets{targets: []domain.VerificationTarget{
		// Eligible=false throughout on purpose: that flag answers "may this peer be
		// filed for the official checkmark", which is a different mechanism, and the
		// third-party picker must not be filtered by it.
		{Type: domain.VerificationTargetChannel, ID: 7001, Title: "Example News", Username: "examplenews"},
		{Type: domain.VerificationTargetBot, ID: 8002, Title: "Example Bot", Username: "examplebot"},
		{Type: domain.VerificationTargetUser, ID: owner.ID, Title: "Owner"},
	}}
}

const verifierNewsPeerID = 7001

func verifierNewsPeer() domain.Peer {
	return domain.Peer{Type: domain.PeerTypeChannel, ID: verifierNewsPeerID}
}

func newVerifierBotTestService(t *testing.T, cv customVerifications, opts ...Option) (*Service, *memory.UserStore, *memory.MessageStore) {
	t.Helper()
	users := memory.NewUserStore()
	bots := memory.NewBotStore(users)
	dialogs := memory.NewDialogStore()
	messages := memory.NewMessageStore(dialogs)
	all := append([]Option{WithCustomVerification(cv)}, opts...)
	return NewService(users, bots, messages, all...), users, messages
}

// verifierReplies returns every @verifierbot message in the user's box, oldest
// first.
func verifierReplies(t *testing.T, messages *memory.MessageStore, userID int64) []domain.Message {
	t.Helper()
	list, err := messages.ListByUser(context.Background(), userID, domain.MessageFilter{
		HasPeer: true,
		Peer:    domain.Peer{Type: domain.PeerTypeUser, ID: domain.VerifierBotUserID},
		Limit:   200,
	})
	if err != nil {
		t.Fatalf("list @verifierbot history: %v", err)
	}
	out := make([]domain.Message, 0, len(list.Messages))
	for _, msg := range list.Messages {
		if msg.From.ID == domain.VerifierBotUserID {
			out = append(out, msg)
		}
	}
	sort.Slice(out, func(i, j int) bool { return out[i].ID < out[j].ID })
	return out
}

func latestVerifierReply(t *testing.T, messages *memory.MessageStore, userID int64) domain.Message {
	t.Helper()
	replies := verifierReplies(t, messages, userID)
	if len(replies) == 0 {
		t.Fatal("no @verifierbot reply")
	}
	latest := replies[len(replies)-1]
	// Every keyboard the bot renders must be a valid, persistable markup: the send
	// path validates before storing, so an invalid one would silently vanish.
	if err := domain.ValidateReplyMarkup(latest.ReplyMarkup); err != nil {
		t.Fatalf("reply markup invalid: %v (%+v)", err, latest.ReplyMarkup)
	}
	for _, row := range verifierRowsOf(latest) {
		for _, button := range row {
			if len(button.Data) > domain.MaxCallbackDataLen {
				t.Fatalf("callback data %q is %d bytes, limit is %d", button.Data, len(button.Data), domain.MaxCallbackDataLen)
			}
		}
	}
	return latest
}

func verifierRowsOf(msg domain.Message) [][]domain.MarkupButton {
	if msg.ReplyMarkup == nil {
		return nil
	}
	return msg.ReplyMarkup.Inline
}

// sendToVerifierBot drives the responder synchronously, bypassing the
// OnPrivateMessage goroutine dispatch for determinism (the same shortcut the
// BotFather, @Stickers and @verifybot tests take).
func sendToVerifierBot(t *testing.T, svc *Service, messages *memory.MessageStore, userID int64, text string) domain.Message {
	t.Helper()
	svc.respondAsVerifier(userID, domain.Message{
		From: domain.Peer{Type: domain.PeerTypeUser, ID: userID},
		Peer: domain.Peer{Type: domain.PeerTypeUser, ID: domain.VerifierBotUserID},
		Body: text,
	})
	return latestVerifierReply(t, messages, userID)
}

func verifierDataOf(msg domain.Message, label string) ([]byte, bool) {
	for _, row := range verifierRowsOf(msg) {
		for _, button := range row {
			if button.Type == domain.MarkupButtonCallback && strings.Contains(button.Text, label) {
				return append([]byte(nil), button.Data...), true
			}
		}
	}
	return nil, false
}

// pressVerifierData drives the internal callback path with raw data, the way
// rpc.Router does once it has validated the click.
func pressVerifierData(t *testing.T, svc *Service, userID int64, msg domain.Message, data []byte) domain.BotCallbackAnswer {
	t.Helper()
	if len(data) > domain.MaxCallbackDataLen {
		t.Fatalf("callback data too long: %d bytes", len(data))
	}
	answer, handled, err := svc.OnCallbackQuery(context.Background(), domain.BotCallbackQuery{
		ID:        1,
		BotUserID: domain.VerifierBotUserID,
		UserID:    userID,
		Peer:      domain.Peer{Type: domain.PeerTypeUser, ID: userID},
		MessageID: msg.ID,
		Data:      data,
	})
	if err != nil {
		t.Fatalf("callback query: %v", err)
	}
	if !handled {
		t.Fatal("callback query reported unhandled for @verifierbot")
	}
	return answer
}

func pressVerifierButton(t *testing.T, svc *Service, userID int64, msg domain.Message, label string) domain.BotCallbackAnswer {
	t.Helper()
	data, found := verifierDataOf(msg, label)
	if !found {
		t.Fatalf("button %q is not in the keyboard of message %d: %+v", label, msg.ID, msg.ReplyMarkup)
	}
	return pressVerifierData(t, svc, userID, msg, data)
}

const verifierTestReason = "Example News is the daily newsroom of the Example Foundation and has published since 2015."

// runVerifierApplication walks the dialog up to (but not including) Confirm and
// returns the summary message.
func runVerifierApplication(t *testing.T, svc *Service, messages *memory.MessageStore, userID int64) domain.Message {
	t.Helper()
	intro := sendToVerifierBot(t, svc, messages, userID, "/start")
	pressVerifierButton(t, svc, userID, intro, verifierApplyButtonText)
	picker := latestVerifierReply(t, messages, userID)

	pressVerifierButton(t, svc, userID, picker, "@examplenews")
	prompt := latestVerifierReply(t, messages, userID)
	if !strings.Contains(prompt.Body, "why Example Trust should vouch for") {
		t.Fatalf("after picking the subject, reply = %q", prompt.Body)
	}
	return sendToVerifierBot(t, svc, messages, userID, verifierTestReason)
}

// ---------------------------------------------------------------------------
// Tests
// ---------------------------------------------------------------------------

// With no verifier row granted by an operator the bot still explains the mechanism,
// but it must not pretend an application is possible.
func TestVerifierBotStartWithoutVerifierStatusIsHonest(t *testing.T) {
	cv := newFakeCustomVerification()
	svc, users, messages := newVerifierBotTestService(t, cv)
	owner := newOwner(t, users, "+7200")
	svc.SetVerifierTargets(verifierTestTargets(owner))

	if !svc.HandlesBot(domain.VerifierBotUserID) {
		t.Fatal("service should handle @verifierbot")
	}
	reply := sendToVerifierBot(t, svc, messages, owner.ID, "/start")
	for _, want := range []string{
		"THIRD-PARTY",
		"NOT the official",
		"cannot accept applications yet",
		"an operator has to give me an icon",
	} {
		if !strings.Contains(reply.Body, want) {
			t.Fatalf("/start without verifier status is missing %q: %q", want, reply.Body)
		}
	}
	if len(verifierRowsOf(reply)) != 0 {
		t.Fatalf("/start without verifier status offered buttons: %+v", reply.ReplyMarkup)
	}
	// /verify is refused the same way, and nothing is filed.
	verify := sendToVerifierBot(t, svc, messages, owner.ID, "/verify")
	if !strings.Contains(verify.Body, "cannot accept applications yet") {
		t.Fatalf("/verify without verifier status = %q", verify.Body)
	}
	if cv.creates != 0 {
		t.Fatalf("CreateRequest called %d times without verifier status", cv.creates)
	}
	// An operator kill switch on an otherwise complete row reads the same way.
	cv.activated()
	cv.settings.Enabled = false
	disabled := sendToVerifierBot(t, svc, messages, owner.ID, "/start")
	if !strings.Contains(disabled.Body, "cannot accept applications yet") || len(verifierRowsOf(disabled)) != 0 {
		t.Fatalf("/start with a disabled verifier row = %q (%+v)", disabled.Body, disabled.ReplyMarkup)
	}
}

func TestVerifierBotStartWithActiveVerifierShowsCompanyAndMark(t *testing.T) {
	cv := newFakeCustomVerification().activated()
	svc, users, messages := newVerifierBotTestService(t, cv)
	owner := newOwner(t, users, "+7201")
	svc.SetVerifierTargets(verifierTestTargets(owner))

	reply := sendToVerifierBot(t, svc, messages, owner.ID, "/start")
	for _, want := range []string{
		"THIRD-PARTY",
		"NOT the official",
		"Example Trust",
		"Identity checked by Example Trust",
		"/verify",
	} {
		if !strings.Contains(reply.Body, want) {
			t.Fatalf("/start missing %q: %q", want, reply.Body)
		}
	}
	data, found := verifierDataOf(reply, verifierApplyButtonText)
	if !found {
		t.Fatalf("/start has no apply button: %+v", reply.ReplyMarkup)
	}
	// The button is an opaque token and nothing else: it cannot name a peer at all.
	token, ok := strings.CutPrefix(string(data), verifierCallbackDataPrefix)
	if !ok || len(token) != 2*verifierOptionTokenBytes {
		t.Fatalf("callback data %q is not <prefix><token>", data)
	}
	if cv.creates != 0 {
		t.Fatalf("CreateRequest called %d times on /start", cv.creates)
	}
}

func TestVerifierBotFullFlowFilesExactlyOneRequest(t *testing.T) {
	cv := newFakeCustomVerification().activated()
	svc, users, messages := newVerifierBotTestService(t, cv)
	owner := newOwner(t, users, "+7202")
	targets := verifierTestTargets(owner)
	svc.SetVerifierTargets(targets)

	summary := runVerifierApplication(t, svc, messages, owner.ID)
	for _, want := range []string{
		"Example Trust",
		"Example News (@examplenews)",
		"Identity checked by Example Trust",
		verifierTestReason,
		"not the official",
		verifierConfirmButtonText,
	} {
		if !strings.Contains(summary.Body, want) {
			t.Fatalf("summary missing %q: %q", want, summary.Body)
		}
	}

	pressVerifierButton(t, svc, owner.ID, summary, verifierConfirmButtonText)
	filed := latestVerifierReply(t, messages, owner.ID)
	for _, want := range []string{"#701", "Example News", "operator", "/status"} {
		if !strings.Contains(filed.Body, want) {
			t.Fatalf("filed reply missing %q: %q", want, filed.Body)
		}
	}
	if cv.creates != 1 || len(cv.requests) != 1 {
		t.Fatalf("creates=%d requests=%d, want exactly one of each", cv.creates, len(cv.requests))
	}
	req := cv.requests[701]
	if req.VerifierBotID != domain.VerifierBotUserID || req.ApplicantUserID != owner.ID {
		t.Fatalf("stored request identity = %+v", req)
	}
	if req.Peer != verifierNewsPeer() {
		t.Fatalf("stored peer = %+v, want channel 7001", req.Peer)
	}
	if req.PeerUsername != "examplenews" || req.Reason != verifierTestReason {
		t.Fatalf("stored payload = %+v", req)
	}
	if req.Status != domain.CustomVerificationPending {
		t.Fatalf("stored status = %q, want pending", req.Status)
	}
	// The description is the verifier's own, resolved at grant time; the application
	// must not freeze a copy of it.
	if req.RequestedDescription != "" {
		t.Fatalf("request carries a requested description %q", req.RequestedDescription)
	}
	if req.CorrelationID == "" {
		t.Fatalf("request carries no correlation id: %+v", req)
	}
}

// Both the closed choices and the terminal action must survive a double tap: the
// same answer, and no second application.
func TestVerifierBotRepeatedPressesAreIdempotent(t *testing.T) {
	cv := newFakeCustomVerification().activated()
	svc, users, messages := newVerifierBotTestService(t, cv)
	owner := newOwner(t, users, "+7203")
	svc.SetVerifierTargets(verifierTestTargets(owner))

	intro := sendToVerifierBot(t, svc, messages, owner.ID, "/start")
	pressVerifierButton(t, svc, owner.ID, intro, verifierApplyButtonText)
	picker := latestVerifierReply(t, messages, owner.ID)

	pressVerifierButton(t, svc, owner.ID, picker, "@examplenews")
	first := latestVerifierReply(t, messages, owner.ID)
	pressVerifierButton(t, svc, owner.ID, picker, "@examplenews")
	second := latestVerifierReply(t, messages, owner.ID)
	if first.Body != second.Body {
		t.Fatalf("repeat subject press changed the answer:\nfirst  = %q\nsecond = %q", first.Body, second.Body)
	}

	summary := sendToVerifierBot(t, svc, messages, owner.ID, verifierTestReason)
	pressVerifierButton(t, svc, owner.ID, summary, verifierConfirmButtonText)
	firstFiled := latestVerifierReply(t, messages, owner.ID)
	pressVerifierButton(t, svc, owner.ID, summary, verifierConfirmButtonText)
	secondFiled := latestVerifierReply(t, messages, owner.ID)

	if firstFiled.Body != secondFiled.Body {
		t.Fatalf("repeat confirm changed the answer:\nfirst  = %q\nsecond = %q", firstFiled.Body, secondFiled.Body)
	}
	if cv.creates != 1 || len(cv.requests) != 1 {
		t.Fatalf("creates=%d requests=%d after a double confirm, want 1/1", cv.creates, len(cv.requests))
	}
	// Picking the same subject again once it is pending reports the open application
	// instead of filing a second one.
	again := sendToVerifierBot(t, svc, messages, owner.ID, "/verify")
	pressVerifierButton(t, svc, owner.ID, again, "@examplenews")
	pendingReply := latestVerifierReply(t, messages, owner.ID)
	if !strings.Contains(pendingReply.Body, "#701") || !strings.Contains(pendingReply.Body, "already with the operator") {
		t.Fatalf("re-picking a pending subject = %q", pendingReply.Body)
	}
	if cv.creates != 1 {
		t.Fatalf("creates=%d after re-picking a pending subject", cv.creates)
	}
}

func TestVerifierBotForgedCallbackTokenIsRefused(t *testing.T) {
	cv := newFakeCustomVerification().activated()
	svc, users, messages := newVerifierBotTestService(t, cv)
	owner := newOwner(t, users, "+7204")
	svc.SetVerifierTargets(verifierTestTargets(owner))

	intro := sendToVerifierBot(t, svc, messages, owner.ID, "/start")
	before := len(verifierReplies(t, messages, owner.ID))

	for _, data := range [][]byte{
		[]byte(verifierCallbackDataPrefix + "deadbeefcafe"),
		[]byte("tgt:channel:7001"),
		[]byte(verifierCallbackDataPrefix),
		[]byte(verifyCallbackDataPrefix + "deadbeefcafe"),
	} {
		answer := pressVerifierData(t, svc, owner.ID, intro, data)
		if !answer.Alert || !strings.Contains(answer.Message, "no longer active") {
			t.Fatalf("forged data %q answered %+v, want an explaining alert", data, answer)
		}
	}
	if got := len(verifierReplies(t, messages, owner.ID)); got != before {
		t.Fatalf("forged callbacks produced %d new messages", got-before)
	}
	if cv.creates != 0 || cv.revokes != 0 || len(cv.requests) != 0 {
		t.Fatalf("forged callbacks touched the service: creates=%d revokes=%d requests=%d",
			cv.creates, cv.revokes, len(cv.requests))
	}

	// A token minted for one applicant is meaningless for another.
	attacker := newOwner(t, users, "+7205")
	stolen, found := verifierDataOf(intro, verifierApplyButtonText)
	if !found {
		t.Fatal("intro has no apply button")
	}
	attackerIntro := sendToVerifierBot(t, svc, messages, attacker.ID, "/start")
	if answer := pressVerifierData(t, svc, attacker.ID, attackerIntro, stolen); !answer.Alert {
		t.Fatalf("stolen token answered %+v, want an alert", answer)
	}
	for _, req := range cv.requests {
		if req.ApplicantUserID == attacker.ID {
			t.Fatalf("stolen token created an application for the attacker: %+v", req)
		}
	}
}

func TestVerifierBotStatusListsRequestsAndMarksWithoutInternalNotes(t *testing.T) {
	cv := newFakeCustomVerification().activated()
	svc, users, messages := newVerifierBotTestService(t, cv)
	owner := newOwner(t, users, "+7206")
	svc.SetVerifierTargets(verifierTestTargets(owner))

	if empty := sendToVerifierBot(t, svc, messages, owner.ID, "/status"); empty.Body != verifierNoRequestsText {
		t.Fatalf("/status with nothing filed = %q", empty.Body)
	}

	cv.grantMark(owner.ID, verifierNewsPeer(), "Example News", "examplenews")
	cv.requests[810] = domain.CustomVerificationRequest{
		ID: 810, VerifierBotID: domain.VerifierBotUserID, ApplicantUserID: owner.ID,
		Peer: domain.Peer{Type: domain.PeerTypeUser, ID: 8002}, PeerUsername: "examplebot",
		Status: domain.CustomVerificationPending, CreatedAt: time.Date(2026, 7, 25, 9, 0, 0, 0, time.UTC),
	}
	cv.requests[811] = domain.CustomVerificationRequest{
		ID: 811, VerifierBotID: domain.VerifierBotUserID, ApplicantUserID: owner.ID,
		Peer: domain.Peer{Type: domain.PeerTypeChannel, ID: 7009}, PeerTitle: "Side Project",
		Status: domain.CustomVerificationRejected, DecisionReason: "the company behind it could not be confirmed",
		InternalNote: "operator note: obvious reseller, do not engage",
		RejectedAt:   time.Date(2026, 7, 22, 9, 0, 0, 0, time.UTC),
	}
	cv.requests[812] = domain.CustomVerificationRequest{
		ID: 812, VerifierBotID: domain.VerifierBotUserID, ApplicantUserID: owner.ID,
		Peer: domain.Peer{Type: domain.PeerTypeUser, ID: owner.ID}, PeerTitle: "Owner",
		Status: domain.CustomVerificationRevoked, DecisionReason: "the account changed hands",
		InternalNote: "operator note: internal escalation thread 4711",
		CreatedAt:    time.Date(2026, 7, 10, 9, 0, 0, 0, time.UTC),
	}

	reply := sendToVerifierBot(t, svc, messages, owner.ID, "/status")
	for _, want := range []string{
		"#701", "Example News (@examplenews)", "approved, the mark was granted", "Mark: live",
		"Identity checked by Example Trust", "granted 2026-07-20",
		"#810", "@examplebot", "waiting for an operator",
		"#811", "Side Project", "not approved", "the company behind it could not be confirmed",
		"#812", "the mark was taken away", "the account changed hands",
		"/revoke",
	} {
		if !strings.Contains(reply.Body, want) {
			t.Fatalf("/status missing %q: %q", want, reply.Body)
		}
	}
	for _, forbidden := range []string{"obvious reseller", "escalation thread", "operator note"} {
		if strings.Contains(reply.Body, forbidden) {
			t.Fatalf("/status leaked an internal note (%q): %q", forbidden, reply.Body)
		}
	}

	// An approved application whose mark is gone is reported as such rather than
	// claiming a badge the peer does not carry.
	delete(cv.marks, verifierNewsPeer())
	stale := sendToVerifierBot(t, svc, messages, owner.ID, "/status")
	if !strings.Contains(stale.Body, "Mark: not on the peer any more") {
		t.Fatalf("/status after the mark went away = %q", stale.Body)
	}
}

func TestVerifierBotRevokeAsksForConfirmationThenRemovesTheMark(t *testing.T) {
	cv := newFakeCustomVerification().activated()
	svc, users, messages := newVerifierBotTestService(t, cv)
	owner := newOwner(t, users, "+7207")
	svc.SetVerifierTargets(verifierTestTargets(owner))

	if nothing := sendToVerifierBot(t, svc, messages, owner.ID, "/revoke"); nothing.Body != verifierNothingToRevokeText {
		t.Fatalf("/revoke with no marks = %q", nothing.Body)
	}

	granted := cv.grantMark(owner.ID, verifierNewsPeer(), "Example News", "examplenews")
	picker := sendToVerifierBot(t, svc, messages, owner.ID, "/revoke")
	if !strings.Contains(picker.Body, "Which mark should I remove") {
		t.Fatalf("/revoke = %q", picker.Body)
	}
	pressVerifierButton(t, svc, owner.ID, picker, "@examplenews")
	confirm := latestVerifierReply(t, messages, owner.ID)
	rendered := confirm.Body + "\n" + strings.Join(buttonLabels(confirm), "\n")
	for _, want := range []string{"Remove my mark from", "Example News", verifierRevokeButtonText, verifierRevokeCancelButtonText} {
		if !strings.Contains(rendered, want) {
			t.Fatalf("revoke confirmation missing %q: %q", want, rendered)
		}
	}
	// Nothing is removed until the confirmation is pressed.
	if cv.revokes != 0 {
		t.Fatalf("RevokeMark called %d times before confirmation", cv.revokes)
	}

	pressVerifierButton(t, svc, owner.ID, confirm, verifierRevokeButtonText)
	removed := latestVerifierReply(t, messages, owner.ID)
	if !strings.Contains(removed.Body, "removed from") || !strings.Contains(removed.Body, "Example News") {
		t.Fatalf("revoked reply = %q", removed.Body)
	}
	if cv.revokes != 1 {
		t.Fatalf("RevokeMark called %d times, want 1", cv.revokes)
	}
	// The store signature carries no actor or reason: 0155 has no revocation audit
	// column, so the dialog logs them instead. What must be true here is that the
	// mark of this verifier on this peer is gone.
	if len(cv.revokedPeers) != 1 {
		t.Fatalf("revoked peers = %+v, want exactly the picked peer", cv.revokedPeers)
	}
	if _, still := cv.marks[verifierNewsPeer()]; still {
		t.Fatal("the mark is still granted after a confirmed revoke")
	}
	if got := cv.requests[granted.ID].Status; got != domain.CustomVerificationRevoked {
		t.Fatalf("application status after revoke = %q", got)
	}

	// A second press of the same confirmation replays the same answer and does not
	// call the service again.
	pressVerifierButton(t, svc, owner.ID, confirm, verifierRevokeButtonText)
	repeat := latestVerifierReply(t, messages, owner.ID)
	if repeat.Body != removed.Body {
		t.Fatalf("repeat revoke changed the answer:\nfirst  = %q\nsecond = %q", removed.Body, repeat.Body)
	}
	if cv.revokes != 1 {
		t.Fatalf("RevokeMark called %d times after a double press, want 1", cv.revokes)
	}
}

// A confirmation button names the peer it was rendered for, so pressing an old one
// acts on that peer and never on whatever the dialog is pointing at now.
func TestVerifierBotStaleRevokeConfirmationActsOnItsOwnPeer(t *testing.T) {
	cv := newFakeCustomVerification().activated()
	svc, users, messages := newVerifierBotTestService(t, cv)
	owner := newOwner(t, users, "+7214")
	svc.SetVerifierTargets(verifierTestTargets(owner))

	botPeer := domain.Peer{Type: domain.PeerTypeUser, ID: 8002}
	cv.grantMark(owner.ID, verifierNewsPeer(), "Example News", "examplenews")
	cv.grantMark(owner.ID, botPeer, "Example Bot", "examplebot")

	// Confirm screen for the channel, then walk away and open the one for the bot.
	pressVerifierButton(t, svc, owner.ID, sendToVerifierBot(t, svc, messages, owner.ID, "/revoke"), "@examplenews")
	channelConfirm := latestVerifierReply(t, messages, owner.ID)
	pressVerifierButton(t, svc, owner.ID, sendToVerifierBot(t, svc, messages, owner.ID, "/revoke"), "@examplebot")

	// The dialog now points at the bot; the stale button still means the channel.
	pressVerifierButton(t, svc, owner.ID, channelConfirm, verifierRevokeButtonText)
	removed := latestVerifierReply(t, messages, owner.ID)
	if !strings.Contains(removed.Body, "@examplenews") || strings.Contains(removed.Body, "@examplebot") {
		t.Fatalf("stale confirmation removed the wrong peer: %q", removed.Body)
	}
	if len(cv.revokedPeers) != 1 || cv.revokedPeers[0] != verifierNewsPeer() {
		t.Fatalf("revoked peers = %+v, want only the channel", cv.revokedPeers)
	}
	if _, still := cv.marks[botPeer]; !still {
		t.Fatal("the bot lost its mark to a confirmation rendered for the channel")
	}
}

// A subject that already carries the mark is told so, and offered the only action
// that makes sense on it.
func TestVerifierBotAlreadyMarkedSubjectOffersRemoval(t *testing.T) {
	cv := newFakeCustomVerification().activated()
	svc, users, messages := newVerifierBotTestService(t, cv)
	owner := newOwner(t, users, "+7215")
	svc.SetVerifierTargets(verifierTestTargets(owner))

	cv.grantMark(owner.ID, verifierNewsPeer(), "Example News", "examplenews")
	picker := sendToVerifierBot(t, svc, messages, owner.ID, "/verify")
	pressVerifierButton(t, svc, owner.ID, picker, "@examplenews")
	reply := latestVerifierReply(t, messages, owner.ID)
	for _, want := range []string{"already carries my mark", "Identity checked by Example Trust", "/revoke"} {
		if !strings.Contains(reply.Body, want) {
			t.Fatalf("already-marked reply missing %q: %q", want, reply.Body)
		}
	}
	if cv.creates != 0 {
		t.Fatalf("creates=%d for an already-marked subject", cv.creates)
	}
	pressVerifierButton(t, svc, owner.ID, reply, verifierRevokeMenuButtonText)
	if got := latestVerifierReply(t, messages, owner.ID); !strings.Contains(got.Body, "Which mark should I remove") {
		t.Fatalf("removal button did not open the picker: %q", got.Body)
	}
}

// buttonLabels flattens a message's keyboard so a test can assert on the labels
// without caring about the row layout.
func buttonLabels(msg domain.Message) []string {
	var out []string
	for _, row := range verifierRowsOf(msg) {
		for _, button := range row {
			out = append(out, button.Text)
		}
	}
	return out
}

func TestVerifierBotHelpAndIdleText(t *testing.T) {
	// Nothing injected at all: this is the deployment that never wired third-party
	// verification.
	svc, users, messages := newVerifierBotTestService(t, nil)
	owner := newOwner(t, users, "+7208")

	// /help answers even with no verification service wired at all: it describes the
	// bot rather than reading any state.
	help := sendToVerifierBot(t, svc, messages, owner.ID, "/help")
	if help.Body != verifierBotHelpText {
		t.Fatalf("/help = %q", help.Body)
	}
	for _, want := range []string{"/start", "/verify", "/status", "/revoke", "/help", "not the official"} {
		if !strings.Contains(help.Body, want) {
			t.Fatalf("/help missing %q", want)
		}
	}
	if idle := sendToVerifierBot(t, svc, messages, owner.ID, "hello there"); idle.Body != verifierBotIdleText {
		t.Fatalf("idle chatter = %q", idle.Body)
	}
	unknown := sendToVerifierBot(t, svc, messages, owner.ID, "/teleport")
	if !strings.Contains(unknown.Body, "do not know that command") {
		t.Fatalf("unknown command = %q", unknown.Body)
	}

	// With no service wired, every stateful command says so instead of half-running.
	for _, cmd := range []string{"/start", "/verify", "/status", "/revoke"} {
		if reply := sendToVerifierBot(t, svc, messages, owner.ID, cmd); reply.Body != verifierUnavailableText {
			t.Fatalf("%s without a service = %q", cmd, reply.Body)
		}
	}
}

func TestVerifierBotGlobalCommandsWorkMidStep(t *testing.T) {
	cv := newFakeCustomVerification().activated()
	svc, users, messages := newVerifierBotTestService(t, cv)
	owner := newOwner(t, users, "+7209")
	svc.SetVerifierTargets(verifierTestTargets(owner))

	intro := sendToVerifierBot(t, svc, messages, owner.ID, "/start")
	pressVerifierButton(t, svc, owner.ID, intro, verifierApplyButtonText)
	pressVerifierButton(t, svc, owner.ID, latestVerifierReply(t, messages, owner.ID), "@examplenews")

	// /help and /status in the middle of the reason step answer and keep the step.
	if help := sendToVerifierBot(t, svc, messages, owner.ID, "/help"); help.Body != verifierBotHelpText {
		t.Fatalf("/help mid-step = %q", help.Body)
	}
	if status := sendToVerifierBot(t, svc, messages, owner.ID, "/status"); status.Body != verifierNoRequestsText {
		t.Fatalf("/status mid-step = %q", status.Body)
	}
	// An unknown command is never swallowed as the reason.
	if unknown := sendToVerifierBot(t, svc, messages, owner.ID, "/nope"); !strings.Contains(unknown.Body, "do not know that command") {
		t.Fatalf("unknown command mid-step = %q", unknown.Body)
	}
	// A too-short reason is explained rather than accepted.
	if short := sendToVerifierBot(t, svc, messages, owner.ID, "please"); !strings.Contains(short.Body, "at least") {
		t.Fatalf("short reason = %q", short.Body)
	}

	summary := sendToVerifierBot(t, svc, messages, owner.ID, verifierTestReason)
	if !strings.Contains(summary.Body, verifierTestReason) || !strings.Contains(summary.Body, "Example Trust") {
		t.Fatalf("reason not accepted after the global commands: %q", summary.Body)
	}
	// A button-only step says so instead of eating the text as a field.
	if chatter := sendToVerifierBot(t, svc, messages, owner.ID, "yes do it"); chatter.Body != verifierPickButtonsText {
		t.Fatalf("text at the confirm step = %q", chatter.Body)
	}
	// /cancel drops the dialog without filing anything.
	cancelled := sendToVerifierBot(t, svc, messages, owner.ID, "/cancel")
	if !strings.Contains(cancelled.Body, "nothing was filed") {
		t.Fatalf("/cancel mid-dialog = %q", cancelled.Body)
	}
	if cv.creates != 0 {
		t.Fatalf("creates=%d after cancelling", cv.creates)
	}
	if again := sendToVerifierBot(t, svc, messages, owner.ID, "/cancel"); again.Body != verifierNothingToCancelText {
		t.Fatalf("second /cancel = %q", again.Body)
	}
}

func TestVerifierBotWithoutTargetsExplainsInsteadOfFailing(t *testing.T) {
	cv := newFakeCustomVerification().activated()
	svc, users, messages := newVerifierBotTestService(t, cv, WithVerifierTargets(&fakeVerifierTargets{}))
	owner := newOwner(t, users, "+7210")

	if reply := sendToVerifierBot(t, svc, messages, owner.ID, "/verify"); reply.Body != verifierNoTargetsText {
		t.Fatalf("/verify with no candidates = %q", reply.Body)
	}
	// A directory outage is reported honestly, not as an empty picker.
	broken := &fakeVerifierTargets{err: context.DeadlineExceeded}
	svc.SetVerifierTargets(broken)
	if reply := sendToVerifierBot(t, svc, messages, owner.ID, "/verify"); reply.Body != verifierNoTargetSourceText {
		t.Fatalf("/verify with a broken directory = %q", reply.Body)
	}
	if cv.creates != 0 {
		t.Fatalf("creates=%d, want 0", cv.creates)
	}
}

// A built-in service account is never offered as a subject, and the enumeration's
// official-verification verdicts are ignored: they answer a different question.
func TestVerifierBotPickerFiltersSystemPeersAndIgnoresOfficialEligibility(t *testing.T) {
	cv := newFakeCustomVerification().activated()
	svc, users, messages := newVerifierBotTestService(t, cv, WithVerifierTargets(&fakeVerifierTargets{targets: []domain.VerificationTarget{
		{Type: domain.VerificationTargetBot, ID: domain.VerifyBotUserID, Username: "verifybot", Eligible: true},
		{Type: domain.VerificationTargetChannel, ID: 7001, Title: "Example News", Username: "examplenews",
			Eligible: false, Reason: domain.ErrVerificationTargetAlreadyVerified.Error()},
	}}))
	owner := newOwner(t, users, "+7211")

	picker := sendToVerifierBot(t, svc, messages, owner.ID, "/verify")
	labels := buttonLabels(picker)
	for _, label := range labels {
		if strings.Contains(label, "verifybot") {
			t.Fatalf("picker offered a built-in service account: %v", labels)
		}
	}
	if _, found := verifierDataOf(picker, "@examplenews"); !found {
		t.Fatalf("picker dropped an officially ineligible peer: %v", labels)
	}
}

func TestVerifierBotSendVerificationDecisionCoversEveryOutcome(t *testing.T) {
	cv := newFakeCustomVerification().activated()
	svc, users, messages := newVerifierBotTestService(t, cv)
	owner := newOwner(t, users, "+7212")
	ctx := context.Background()

	req := domain.CustomVerificationRequest{
		ID: 909, VerifierBotID: domain.VerifierBotUserID, ApplicantUserID: owner.ID,
		Peer: verifierNewsPeer(), PeerTitle: "Example News", PeerUsername: "examplenews",
		DecisionReason: "the company behind it could not be confirmed",
		InternalNote:   "operator note: repeat applicant, escalate next time",
	}

	req.Status = domain.CustomVerificationApproved
	if err := svc.SendVerificationDecision(ctx, owner.ID, req); err != nil {
		t.Fatalf("approved decision: %v", err)
	}
	approved := latestVerifierReply(t, messages, owner.ID)
	for _, want := range []string{"#909", "Example News", "@examplenews", "approved", "not the official", "/revoke"} {
		if !strings.Contains(approved.Body, want) {
			t.Fatalf("approved decision missing %q: %q", want, approved.Body)
		}
	}

	req.Status = domain.CustomVerificationRejected
	if err := svc.SendVerificationDecision(ctx, owner.ID, req); err != nil {
		t.Fatalf("rejected decision: %v", err)
	}
	rejected := latestVerifierReply(t, messages, owner.ID)
	for _, want := range []string{"#909", "not approved", "could not be confirmed", "/verify"} {
		if !strings.Contains(rejected.Body, want) {
			t.Fatalf("rejected decision missing %q: %q", want, rejected.Body)
		}
	}

	req.Status = domain.CustomVerificationRevoked
	if err := svc.SendVerificationDecision(ctx, owner.ID, req); err != nil {
		t.Fatalf("revoked decision: %v", err)
	}
	revoked := latestVerifierReply(t, messages, owner.ID)
	for _, want := range []string{"taken off", "Example News", "could not be confirmed"} {
		if !strings.Contains(revoked.Body, want) {
			t.Fatalf("revoked decision missing %q: %q", want, revoked.Body)
		}
	}

	// The operator's private note never reaches the applicant, under any outcome.
	for _, msg := range verifierReplies(t, messages, owner.ID) {
		for _, forbidden := range []string{"repeat applicant", "escalate next time", "operator note"} {
			if strings.Contains(msg.Body, forbidden) {
				t.Fatalf("decision message leaked the internal note (%q): %q", forbidden, msg.Body)
			}
		}
	}

	// Pending is not a decision, and neither is an unmodelled status: both are
	// reported so the queued notification stays pending instead of being marked
	// delivered as an empty message.
	before := len(verifierReplies(t, messages, owner.ID))
	for _, status := range []domain.CustomVerificationRequestStatus{domain.CustomVerificationPending, "teleported"} {
		req.Status = status
		if err := svc.SendVerificationDecision(ctx, owner.ID, req); err == nil {
			t.Fatalf("status %q reported a delivered decision", status)
		}
	}
	req.Status = domain.CustomVerificationApproved
	if err := svc.SendVerificationDecision(ctx, 0, req); err == nil {
		t.Fatal("empty recipient reported success")
	}
	if got := len(verifierReplies(t, messages, owner.ID)); got != before {
		t.Fatalf("undeliverable decisions sent %d messages", got-before)
	}
}

// The callback router must claim @verifierbot clicks and only those.
func TestVerifierBotCallbackRouting(t *testing.T) {
	cv := newFakeCustomVerification().activated()
	svc, users, messages := newVerifierBotTestService(t, cv)
	owner := newOwner(t, users, "+7213")
	svc.SetVerifierTargets(verifierTestTargets(owner))

	// No dialog state at all: the click is claimed and explained, never left hanging.
	answer, handled, err := svc.OnCallbackQuery(context.Background(), domain.BotCallbackQuery{
		BotUserID: domain.VerifierBotUserID, UserID: owner.ID,
		Data: []byte(verifierCallbackDataPrefix + "0011223344"),
	})
	if err != nil || !handled {
		t.Fatalf("callback without state: handled=%v err=%v", handled, err)
	}
	if !answer.Alert || !strings.Contains(answer.Message, "no longer active") {
		t.Fatalf("callback without state = %+v", answer)
	}
	if _, handled, err := svc.OnCallbackQuery(context.Background(), domain.BotCallbackQuery{
		BotUserID: 555111, UserID: owner.ID, Data: []byte(verifierCallbackDataPrefix + "x"),
	}); handled || err != nil {
		t.Fatalf("foreign bot callback handled=%v err=%v, want (false, nil)", handled, err)
	}
	// A click from the bot itself is not a dialog action.
	if _, handled, err := svc.OnCallbackQuery(context.Background(), domain.BotCallbackQuery{
		BotUserID: domain.VerifierBotUserID, UserID: domain.VerifierBotUserID,
		Data: []byte(verifierCallbackDataPrefix + "x"),
	}); handled || err != nil {
		t.Fatalf("self callback handled=%v err=%v, want (false, nil)", handled, err)
	}
	if len(verifierReplies(t, messages, owner.ID)) != 0 {
		t.Fatal("refused callbacks wrote messages")
	}
}