DodoSSH/tests/DodoSSH.Client.App.Layout.Tests/ScreenLayoutTests.cs

using Avalonia;
using Avalonia.Controls;
using Avalonia.Headless;
using Avalonia.Input;
using Avalonia.Threading;
using Avalonia.VisualTree;
using DodoSSH.Client.Shell.ViewModels;
using DodoSSH.Client.App.Views;
using DodoSSH.Client.Session;
using DodoSSH.Client.Session.Tests;
using DodoSSH.Client.Ssh;
using DodoSSH.Client.Storage;
using DodoSSH.Client.Terminal;
using DodoSSH.Client.Transfer;
using DodoSSH.Crypto;
using NSubstitute;

namespace DodoSSH.Client.App.Layout.Tests;

/// <summary>
/// Whether each screen fits in the space the window gives it.
/// </summary>
/// <remarks>
/// <para>
/// This suite used to measure one control, <c>VaultColumn</c>, because there was one. The design import
/// split it in two — the host list lives beside the terminal, and everything else in the vault has a screen
/// of its own — and added a titlebar, a nav rail and a status bar. That is five things to measure, and the
/// split is what keeps every one of them measurable: none contains the terminal's WebView, and
/// <c>MainWindow</c> still cannot be laid out here at all, because WebView2's adapter refuses the headless
/// dispatcher's MTA thread. <see cref="LayoutHarnessTests"/> pins that.
/// </para>
/// <para>
/// One test per shape a user can put a screen into, because a shape that is never laid out is a shape never
/// checked. The host sidebar has three — list, list with the editor open, and list folded away — and the
/// vault screen has one per category plus one per editor.
/// </para>
/// <para>
/// A real <c>VaultViewModel</c> over a real unlocked vault, rather than a stand-in. Compiled bindings
/// resolve against the declared data type, so a stand-in would have to be the same type anyway — and the
/// editors' height depends on real content: a key with a real armour block in the box is taller than an
/// empty one.
/// </para>
/// </remarks>
public sealed class ScreenLayoutTests : IAsyncLifetime
{
    private const string Passphrase = "a sufficiently long passphrase";
    private const string ServerUrl = "https://dodossh.example";

    /// <remarks>Far below the shipped profile: nothing here attacks a wrap.</remarks>
    private static readonly Argon2Profile CheapProfile =
        Argon2Profile.FromStoredParameters(memoryKibibytes: 8 * 1024, passes: 1, parallelism: 1);

    private readonly FakeAccountServer server = new();
    private readonly StubKeyBinding keyBinding = new();
    private readonly VaultKnownHostStore knownHosts = new();

    private ClientCacheFactory caches = null!;
    private TerminalWorkspace workspace = null!;
    private VaultSession session = null!;
    private VaultViewModel vault = null!;

    /// <remarks>
    /// Constructed and never started: the sign-out card binds to the shell rather than to a vault, and what
    /// it shows comes from properties a fresh one already answers. Starting it would migrate a cache and
    /// read a profile, neither of which any rectangle here depends on.
    /// </remarks>
    private MainWindowViewModel shell = null!;

    /// <remarks>
    /// Over a substitute factory that is never asked for a session. Every shape measured here is one the
    /// screen is in before a connection exists or after one has failed, which is deliberate: the two panes
    /// are at their widest with the local one full and the remote one carrying its explanation, and a
    /// connected pane is the same template with shorter names in it.
    /// </remarks>
    private TransfersViewModel transfers = null!;

    private static CancellationToken Token => TestContext.Current.CancellationToken;

    /// <inheritdoc />
    public async ValueTask InitializeAsync()
    {
        caches = ClientCacheFactory.ForMemory($"layout-{Guid.CreateVersion7():N}");
        await caches.MigrateAsync(Token);

        await new AccountProvisioner(server, keyBinding, caches, TimeProvider.System, CheapProfile)
            .EnrollAsync(ServerUrl, Passphrase, "laptop", "Personal", Token);

        var outcome = await new SessionOpener(caches, TimeProvider.System).UnlockAsync(Passphrase, Token);
        outcome.IsUnlocked.ShouldBeTrue(outcome.Message);
        session = outcome.Session!;

        // Never started and never connected through: no screen's layout depends on the terminal, and the
        // substitute is here only because the view model's constructor asks for one.
        workspace = new TerminalWorkspace(
            new InMemoryTerminalAssetProvider(new Dictionary<string, TerminalAsset>(StringComparer.Ordinal)),
            Substitute.For<ISshConnectionFactory>(),
            TimeProvider.System);

        await knownHosts.OpenAsync(session, Token);

        // Offline. A null connection is what these screens show on a laptop with no network, and it keeps
        // every sync pass out of a suite that is only measuring rectangles.
        vault = new VaultViewModel(session, workspace, knownHosts, static () => null);

        shell = new MainWindowViewModel(
            new ClientPaths(Path.Combine(Path.GetTempPath(), $"dodossh-layout-{Guid.CreateVersion7():N}")),
            caches,
            workspace,
            knownHosts,
            new UnavailableDeviceKeyStore(),
            static (_, _) => throw new InvalidOperationException("A layout test has no network."),
            TimeProvider.System,
            Substitute.For<ISftpSessionFactory>(),
            CheapProfile);

        transfers = new TransfersViewModel(
            Substitute.For<ISftpSessionFactory>(), TimeProvider.System);

        await SeedAsync();

        // Attached after seeding, so the host picker has something in it and the local pane has listed this
        // machine's home directory — which is what puts real names of real length into the row template.
        transfers.Attach(vault, knownHosts);
    }

    /// <inheritdoc />
    public async ValueTask DisposeAsync()
    {
        await shell.DisposeAsync();
        await transfers.DisposeAsync();
        await vault.DisposeAsync();
        knownHosts.Close();
        await workspace.DisposeAsync();
        await session.DisposeAsync();
        caches.Dispose();
    }

    // ---- The host sidebar ----

    [Fact]
    public async Task TheHostSidebarFitsWithNoEditorOpen()
    {
        await MeasureSidebarAsync(faults => faults.ShouldBeEmpty());
    }

    /// <remarks>
    /// The tight one, and the reason this suite still exists. The sidebar is 268 pixels wide against the old
    /// column's 340, and the host editor is the tallest thing in it: six fields, an authentication picker
    /// with a two-line item template, a checkbox, a paragraph of hint text and three buttons, all sharing a
    /// column with the list above them.
    /// </remarks>
    [Fact]
    public async Task TheHostSidebarFitsWithItsEditorOpen()
    {
        vault.SelectedHost = vault.Hosts[0];
        vault.EditSelectedHostCommand.Execute(null);

        vault.EditorAuthenticationChoices.Count
            .ShouldBeGreaterThan(1, "the picker has to be populated for this to measure anything");

        // Measured with a credential selected, because an empty picker is shorter than one showing a
        // qualifier beside a label.
        vault.EditorSelectedAuthentication = vault.EditorAuthenticationChoices
            .First(choice => choice.Kind is AuthenticationKind.Credential);

        await MeasureSidebarAsync(faults => faults.ShouldBeEmpty());
    }

    /// <remarks>
    /// Folding the list away is the one thing a user can do to this control that changes which of its parts
    /// is on screen, so it is a shape worth laying out on its own.
    /// </remarks>
    [Fact]
    public async Task TheHostSidebarFitsWithItsListFoldedAway()
    {
        vault.ToggleHostsCommand.Execute(null);
        vault.AreHostsExpanded.ShouldBeFalse();

        await MeasureSidebarAsync(faults => faults.ShouldBeEmpty());
    }

    /// <remarks>
    /// <para>
    /// The one thing a wrong answer here breaks is unrecoverable from the keyboard: <c>MainWindow</c> takes
    /// the keyboard off the terminal's native child window first and then focuses this target, so a target
    /// that cannot take focus leaves the user with no focused element and no way back except the mouse.
    /// </para>
    /// <para>
    /// Which is why this asserts that focus was <i>taken</i> rather than that the right control was named.
    /// A <c>ListBox</c> is not focusable by default, so the call returns false against a list that has not
    /// asked to be — and <c>Focus()</c> on a collapsed control is a no-op that is not replayed when it is
    /// revealed, which is exactly what the folded-away case would hit.
    /// </para>
    /// </remarks>
    [Fact]
    public async Task TheSidebarsKeyboardTargetTakesFocusInBothOfItsShapes()
    {
        await OnTheSidebarAsync((sidebar, _) =>
        {
            sidebar.KeyboardTarget.ShouldBeSameAs(sidebar.HostList);
            sidebar.KeyboardTarget.Focus().ShouldBeTrue("the list is showing");
        });

        vault.ToggleHostsCommand.Execute(null);

        await OnTheSidebarAsync((sidebar, _) =>
        {
            sidebar.KeyboardTarget.ShouldBeSameAs(sidebar.HostFilter);
            sidebar.KeyboardTarget.Focus().ShouldBeTrue("the list is folded away, so the filter takes it");
        });
    }

    /// <remarks>
    /// The editor open with the list still on screen behind it, which is the state a user is most likely to
    /// leave the sidebar in — so it is the state the keyboard answer most has to hold in.
    /// </remarks>
    [Fact]
    public async Task TheSidebarsKeyboardTargetStillTakesFocusWithTheEditorOpen()
    {
        vault.NewHostCommand.Execute(null);

        await OnTheSidebarAsync((sidebar, _) =>
        {
            sidebar.HostList.IsEffectivelyVisible.ShouldBeTrue();
            sidebar.KeyboardTarget.Focus().ShouldBeTrue();
        });
    }

    /// <remarks>
    /// <para>
    /// The strip along the sidebar's bottom edge with the question in it instead of the three buttons. Its
    /// tallest shape is a host with a terminal open on it, which adds a disclosure the ordinary case has
    /// not got — in a 268-pixel column whose middle is a list that has already taken every spare pixel.
    /// </para>
    /// <para>
    /// Worth measuring rather than assuming, because this is the one card in the application a user cannot
    /// scroll: the sidebar's only <c>ScrollViewer</c> is inside the host list, so a button pushed past the
    /// bottom edge here would leave the question unanswerable in either direction.
    /// </para>
    /// </remarks>
    [Fact]
    public async Task TheHostSidebarFitsWithADeletionInQuestion()
    {
        vault.SelectedHost = vault.Hosts[0];
        vault.SelectedHost.IsConnected = true;

        vault.DeleteHostCommand.Execute(null);
        vault.IsConfirmingDeletion.ShouldBeTrue();
        vault.PendingDeletion.ShouldNotBeNull().HasUsage.ShouldBeTrue("the open terminal is the long shape");

        await MeasureSidebarAsync(faults => faults.ShouldBeEmpty());
    }

    /// <remarks>
    /// <para>
    /// What a double-click on a machine does everywhere else, and did not do here: it opens a shell on it.
    /// The gesture is wired in the control rather than bound in the markup, which is exactly the sort of
    /// wiring that compiles whether or not it is connected to anything — so it is worth a test that
    /// performs the gesture.
    /// </para>
    /// <para>
    /// Proved through a connection that is refused before any network is involved. The host is left bound
    /// to a key that has been deleted, which <c>TryBuildAuthentication</c> turns into a sentence on the
    /// status line rather than a socket — so what this asserts is that the command ran, with nothing
    /// timing out to make it flaky.
    /// </para>
    /// </remarks>
    [Fact]
    public async Task DoubleClickingAHostConnectsToIt()
    {
        var keyId = vault.Keys[0].EntityId;

        vault.SelectedHost = vault.Hosts[0];
        vault.EditSelectedHostCommand.Execute(null);
        vault.EditorSelectedAuthentication = vault.EditorAuthenticationChoices
            .Single(choice => choice.Kind is AuthenticationKind.SshKey && choice.EntityId == keyId);
        await vault.SaveHostCommand.ExecuteAsync(null);

        vault.SelectedKey = vault.Keys.Single(row => row.EntityId == keyId);
        vault.DeleteKeyCommand.Execute(null);
        await vault.ConfirmDeleteCommand.ExecuteAsync(null);

        vault.SelectedHost = null;
        vault.Status = string.Empty;

        await OnTheSidebarAsync((sidebar, window) =>
        {
            var row = sidebar.HostList.GetVisualDescendants()
                .OfType<ListBoxItem>()
                .First();

            var centre = row.TranslatePoint(
                new Point(row.Bounds.Width / 2, row.Bounds.Height / 2), window)
                ?? throw new InvalidOperationException("the row is not in this window's tree");

            window.MouseDown(centre, MouseButton.Left);
            window.MouseUp(centre, MouseButton.Left);
            window.MouseDown(centre, MouseButton.Left);
            window.MouseUp(centre, MouseButton.Left);

            Dispatcher.UIThread.RunJobs();

            vault.SelectedHost.ShouldNotBeNull("a press on a row selects it");
            vault.Status.ShouldContain(
                "not in this vault any more",
                Case.Insensitive,
                "the double-click has to reach the connect command");
        });
    }

    // ---- The vault screen ----

    [Fact]
    public async Task TheVaultScreenFitsInEveryCategory()
    {
        foreach (var section in new[]
        {
            VaultSection.All, VaultSection.Keys, VaultSection.Credentials, VaultSection.KnownHosts,
        })
        {
            vault.Section = section;

            await MeasureVaultAsync(faults => faults.ShouldBeEmpty($"the {section} category"));
        }
    }

    /// <remarks>
    /// The tall one: a private key needs a real text area, and the vault screen's detail pane is 244 pixels
    /// wide — the narrowest column any form in this application has to fit into.
    /// </remarks>
    [Fact]
    public async Task TheVaultScreenFitsWithTheKeyEditorOpen()
    {
        vault.NewKeyCommand.Execute(null);
        vault.IsEditingKey.ShouldBeTrue();
        vault.ShowsKeys.ShouldBeTrue("opening an editor has to bring its own category into view");

        vault.KeyEditorPrivateKey = string.Join(
            '\n',
            Enumerable.Repeat("b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gt", 6));

        await MeasureVaultAsync(faults => faults.ShouldBeEmpty());
    }

    [Fact]
    public async Task TheVaultScreenFitsWithThePasswordEditorOpen()
    {
        vault.NewCredentialCommand.Execute(null);
        vault.IsEditingCredential.ShouldBeTrue();
        vault.ShowsCredentials.ShouldBeTrue("opening an editor has to bring its own category into view");

        await MeasureVaultAsync(faults => faults.ShouldBeEmpty());
    }

    /// <remarks>
    /// The detail pane with something selected, which is what the design's right-hand column is really about
    /// — and the pin is the one carrying a full fingerprint on a wrapped monospace line.
    /// </remarks>
    [Fact]
    public async Task TheVaultScreenFitsWithAPinSelected()
    {
        vault.Section = VaultSection.KnownHosts;
        vault.VaultItems.ShouldNotBeEmpty("an empty list is the easy case and proves nothing here");

        vault.SelectedVaultItem = vault.VaultItems[0];
        vault.SelectedItemIsPin.ShouldBeTrue();

        await MeasureVaultAsync(faults => faults.ShouldBeEmpty());
    }

    /// <remarks>
    /// The detail pane with the question in place of EDIT and DELETE, in its longest shape: a key several
    /// hosts authenticate with, which is three sentences and a box in the narrowest column in the
    /// application.
    /// </remarks>
    [Fact]
    public async Task TheVaultScreenFitsWithADeletionInQuestion()
    {
        var keyId = vault.Keys[0].EntityId;

        foreach (var host in vault.Hosts.Take(4).ToList())
        {
            vault.SelectedHost = host;
            vault.EditSelectedHostCommand.Execute(null);
            vault.EditorSelectedAuthentication = vault.EditorAuthenticationChoices
                .Single(choice => choice.Kind is AuthenticationKind.SshKey && choice.EntityId == keyId);

            await vault.SaveHostCommand.ExecuteAsync(null);
        }

        vault.Section = VaultSection.Keys;
        vault.SelectedVaultItem = vault.VaultItems.Single(row => row.EntityId == keyId);

        vault.DeleteSelectedItemCommand.Execute(null);

        vault.PendingDeletion.ShouldNotBeNull().HasUsage
            .ShouldBeTrue("four bound hosts are what makes this the long shape");

        await OnTheVaultAsync((screen, window) =>
        {
            LayoutHarness.Unreachable(window).ShouldBeEmpty();

            // And it says something. A card whose bindings did not resolve would lay out perfectly as three
            // empty rows, which is the one failure a fit test cannot see: compiled bindings against the
            // wrong data type are a logged message rather than an exception.
            var card = screen.GetVisualDescendants().OfType<ConfirmDeleteCard>().ShouldHaveSingleItem();

            var said = string.Join(
                " ",
                card.GetVisualDescendants().OfType<TextBlock>().Select(text => text.Text));

            said.ShouldContain("key-0", Case.Insensitive, "the question has to name what is going");
            said.ShouldContain("4 hosts authenticate with it");
            said.ShouldContain("no undo");
        });
    }

    /// <remarks>
    /// The rail is the only way to reach a category, so a button that lands on nothing walls off three
    /// quarters of the screen. The fit tests above prove the buttons are inside the window; this proves they
    /// are the size a pointer can find, which a zero-height row in a collapsed border would not be.
    /// </remarks>
    [Fact]
    public async Task TheCategoryRailIsBigEnoughToClick()
    {
        await OnTheVaultAsync((screen, _) =>
        {
            var buttons = screen.GetVisualDescendants()
                .OfType<Button>()
                .Where(button => button.Classes.Contains("cat"))
                .ToList();

            buttons.Count.ShouldBe(4, "one per category that exists");

            foreach (var button in buttons)
            {
                button.Bounds.Height.ShouldBeGreaterThan(20);
                button.Bounds.Width.ShouldBeGreaterThan(120);
            }
        });
    }

    // ---- The transfers screen ----

    /// <remarks>
    /// <para>
    /// The widest thing in this window and the one with the least room to give: two file listings side by
    /// side, each with four columns, and a queue underneath — all inside 826 pixels once the nav rail has
    /// taken its column. The header row is the tight part, because it holds a host picker, a password box,
    /// a button and a chip on one line.
    /// </para>
    /// <para>
    /// Measured disconnected, which is the state the screen opens in and the one where the local pane is at
    /// its fullest: it lists this machine's home directory, so the row template is exercised with real names
    /// of real length rather than with fixtures chosen to fit.
    /// </para>
    /// </remarks>
    [Fact]
    public async Task TheTransfersScreenFitsBeforeAnythingIsConnected()
    {
        await MeasureTransfersAsync(faults => faults.ShouldBeEmpty());
    }

    /// <remarks>
    /// <para>
    /// The queue is the half of this screen that only exists once something has been asked for, so a shape
    /// nothing puts a row into is a shape never laid out. Three rows, because the row template changes with
    /// the state: a running one shows a bar and a STOP, a stopped one shows RESUME and DISCARD, and a failed
    /// one carries the server's own sentence in the column the other two put a byte count in.
    /// </para>
    /// <para>
    /// The rows are placed directly rather than driven through the queue. What is being measured is the
    /// template at each state, and running a real transfer to reach those states would put a thread-pool
    /// hand-off and a filesystem in the middle of a test about rectangles. What the queue does is measured in
    /// <c>DodoSSH.Client.Transfer.Tests</c>.
    /// </para>
    /// </remarks>
    [Fact]
    public async Task TheTransfersScreenFitsWithTransfersInTheQueue()
    {
        Enqueue(TransferDirection.Download, "artefact.tar.gz", 402_653_184, 149_000_000,
            TransferState.Running, bytesPerSecond: 6_500_000);

        Enqueue(TransferDirection.Upload, "site-backup-2026-07-30.sql.gz", 8_100_000_000, 3_200_000_000,
            TransferState.Cancelled);

        Enqueue(TransferDirection.Upload, "deploy.sh", 4_096, 0, TransferState.Failed,
            failure: "deploy.sh is already in that directory on the host. Rename or remove it first — "
                + "nothing here overwrites a file that is already there.");

        transfers.Transfers.Count.ShouldBe(3);

        await MeasureTransfersAsync(faults => faults.ShouldBeEmpty());
    }

    /// <remarks>
    /// The trust card covers the whole screen, and it is the one thing here a user cannot get past without
    /// pressing something — so a button of its own that fell outside the window would leave the screen
    /// permanently blocked.
    /// </remarks>
    [Fact]
    public async Task TheTransfersScreenFitsWithTheHostKeyCardShowing()
    {
        transfers.PendingHostKey = new HostKeyPresentation(
            "db.internal", 22, "ssh-ed25519", "SHA256:0123456789abcdefghijklmnopqrstuvwxyzABCDEFG");

        await MeasureTransfersAsync(faults => faults.ShouldBeEmpty());
    }

    /// <remarks>
    /// The question in front of deleting something on the host, which takes a row out of the remote pane's
    /// column while the listing under it is still showing. A directory, because that is the longer of the
    /// two warnings, and a path deep enough to wrap in a pane a third of the window wide.
    /// </remarks>
    [Fact]
    public async Task TheTransfersScreenFitsWithADeletionInQuestion()
    {
        transfers.PendingRemoteDeletion = new RemoteDeletionRequest(
            "2026-07-30",
            "/srv/releases/site/backups/nightly/2026-07-30",
            IsDirectory: true);

        await MeasureTransfersAsync(faults => faults.ShouldBeEmpty());
    }

    // ---- The chrome ----

    /// <remarks>
    /// <para>
    /// The two constants the whole height budget is subtracted from, held against the markup that declares
    /// them. If either bar grows, every screen gets less room than this suite thinks it does and every
    /// measurement above quietly becomes optimistic.
    /// </para>
    /// <para>
    /// Laid out with no data context, which is the point: these are fixed-height strips and their geometry
    /// must not depend on what is bound into them. A binding that made one of them grow with its contents
    /// would fail here.
    /// </para>
    /// </remarks>
    [Fact]
    public async Task TheChromeIsTheHeightTheBudgetAssumes()
    {
        await LayoutHarness.OnTheUiThreadAsync(
            () =>
            {
                var titleBar = new TitleBar();
                var titleWindow = LayoutHarness.HostAtMinimumSize(
                    titleBar, LayoutHarness.MinimumWidth, LayoutHarness.TitleBarHeight);

                try
                {
                    titleBar.Bounds.Height.ShouldBe(LayoutHarness.TitleBarHeight);
                    LayoutHarness.Unreachable(titleWindow).ShouldBeEmpty();
                }
                finally
                {
                    titleWindow.Close();
                }

                var statusBar = new StatusBar();
                var statusWindow = LayoutHarness.HostAtMinimumSize(
                    statusBar, LayoutHarness.MinimumWidth, LayoutHarness.StatusBarHeight);

                try
                {
                    statusBar.Bounds.Height.ShouldBe(LayoutHarness.StatusBarHeight);
                }
                finally
                {
                    statusWindow.Close();
                }
            },
            Token);
    }

    /// <remarks>
    /// Five destinations in a 54-pixel column. The rail runs vertically, so what runs out here is height
    /// rather than width — at the window's minimum the five entries have to leave room for each other, which
    /// is the same failure the old four-button selector was one label away from.
    /// </remarks>
    [Fact]
    public async Task TheNavRailHoldsFiveDestinationsAtTheWindowsMinimum()
    {
        await LayoutHarness.OnTheUiThreadAsync(
            () =>
            {
                var rail = new NavRail();
                var window = LayoutHarness.HostAtMinimumSize(
                    rail, LayoutHarness.NavRailWidth, LayoutHarness.ScreenHeight);

                try
                {
                    var buttons = rail.GetVisualDescendants().OfType<Button>().ToList();

                    buttons.Count.ShouldBe(5, "one per screen the rail reaches");

                    foreach (var button in buttons)
                    {
                        button.Bounds.Height.ShouldBeGreaterThan(20);

                        // One pixel narrower than the rail, because the rail draws its own divider down its
                        // right edge and that comes out of the content. Stated exactly rather than as a
                        // lower bound: a button that stopped filling the rail would leave a dead strip
                        // beside every destination, which is precisely the kind of near-miss a bound hides.
                        button.Bounds.Width.ShouldBe(LayoutHarness.NavRailWidth - 1);
                    }

                    LayoutHarness.Unreachable(window).ShouldBeEmpty();
                }
                finally
                {
                    window.Close();
                }
            },
            Token);
    }

    // ---- The unlock screen ----

    /// <remarks>
    /// <para>
    /// The card a locked application is entirely made of, in its two shapes: an ordinary launch, and one
    /// where shells were left running and the disclosure about them appears. It was extracted from
    /// <c>MainWindow.axaml</c> to be measurable at all — that window cannot be shown here, so anything
    /// inside it is unmeasured by construction — and it is the card with the least room to spare.
    /// </para>
    /// <para>
    /// The status line is set to something long on purpose. It is bound to whatever the last thing that
    /// happened said, and the longest of those is a sentence about an expired sign-in, which is exactly the
    /// message this screen is most likely to be carrying on the launch where the extra rows also appear.
    /// </para>
    /// </remarks>
    [Theory]
    [InlineData(0)]
    [InlineData(2)]
    public async Task TheUnlockCardFitsTheCardItIsShownIn(int liveSessions)
    {
        shell.LiveSessionCount = liveSessions;
        shell.CanUnlockWithDevice = true;
        shell.StatusMessage = "Your sign-in has expired, so this machine is offline: the token endpoint "
            + "returned 400: Invalid refresh token. Sign in again from Preferences to start syncing.";

        await MeasureCardAsync(new UnlockCard());
    }

    [Fact]
    public async Task TheUnlockBoxTakesEnterAsUnlock()
    {
        // Enter is how everybody finishes typing a password, and this screen had no answer to it until the
        // gesture below existed: the passphrase box is where locking puts the keyboard, so the one thing a
        // user does without thinking did nothing at all until they found the button.
        //
        // The gesture is what can be asserted; that pressing it unlocks is ShellFlowTests' business,
        // against the command this binds to.
        await LayoutHarness.OnTheUiThreadAsync(
            () =>
            {
                var card = new UnlockCard { DataContext = shell };
                var window = LayoutHarness.HostAtMinimumSize(
                    card, LayoutHarness.CardContentWidth, LayoutHarness.CardContentHeight);

                try
                {
                    var binding = card.PassphraseBox.KeyBindings.ShouldHaveSingleItem();

                    binding.Gesture.ShouldBe(new KeyGesture(Key.Enter));
                    binding.Command.ShouldBeSameAs(shell.UnlockCommand);
                }
                finally
                {
                    window.Close();
                }
            },
            Token);
    }

    // ---- The sign-out confirmation ----

    /// <remarks>
    /// <para>
    /// The one new card that has to share a screen with an unlock prompt, and the only one whose height
    /// depends on what it is saying: the warning is a sentence about the outbox, and the disclosure about
    /// shells left running appears only when there are some. Both are wrapped paragraphs, which is the
    /// shape that grows.
    /// </para>
    /// <para>
    /// Measured in the space a card gives its contents rather than inside <c>MainWindow</c>, which cannot
    /// be laid out here — see <c>LayoutHarnessTests.WhyTheWindowItselfIsNeverShown</c>. What that leaves
    /// unchecked is the card's own frame, which is a fixed border and a constant padding.
    /// </para>
    /// </remarks>
    [Fact]
    public async Task TheSignOutCardFitsTheCardItIsShownIn()
    {
        // Its tallest shape: a shell left running adds a disclosure box that an ordinary sign-out does not
        // have, an open transfer session adds a line beneath it, and a locked vault carries the longer of
        // the two warnings.
        shell.LiveSessionCount = 1;
        shell.Transfers.IsConnected = true;

        await MeasureCardAsync(new SignOutCard());
    }

    /// <summary>Lays a setup-screen card out in the space <c>Border.card</c> gives its contents.</summary>
    private Task MeasureCardAsync(Control card) =>
        LayoutHarness.OnTheUiThreadAsync(
            () =>
            {
                card.DataContext = shell;

                var window = LayoutHarness.HostAtMinimumSize(
                    card, LayoutHarness.CardContentWidth, LayoutHarness.CardContentHeight);

                try
                {
                    LayoutHarness.Unreachable(window).ShouldBeEmpty();
                }
                finally
                {
                    window.Close();
                }
            },
            Token);

    // ---- Helpers ----

    /// <summary>Lays the sidebar out at the width the hosts screen gives it.</summary>
    private Task MeasureSidebarAsync(Action<IReadOnlyList<string>> assert) =>
        OnTheSidebarAsync((_, window) => assert(LayoutHarness.Unreachable(window)));

    private Task OnTheSidebarAsync(Action<HostSidebar, Window> body) =>
        LayoutHarness.OnTheUiThreadAsync(
            () =>
            {
                var sidebar = new HostSidebar { DataContext = vault };

                var window = LayoutHarness.HostAtMinimumSize(
                    sidebar, LayoutHarness.HostSidebarWidth, LayoutHarness.ScreenHeight);

                try
                {
                    body(sidebar, window);
                }
                finally
                {
                    window.Close();
                }
            },
            Token);

    /// <summary>Lays the transfers screen out at the width it gets beside the nav rail.</summary>
    private Task MeasureTransfersAsync(Action<IReadOnlyList<string>> assert) =>
        LayoutHarness.OnTheUiThreadAsync(
            () =>
            {
                var screen = new TransfersScreen { DataContext = transfers };

                var window = LayoutHarness.HostAtMinimumSize(
                    screen, LayoutHarness.ScreenWidth, LayoutHarness.ScreenHeight);

                try
                {
                    assert(LayoutHarness.Unreachable(window));
                }
                finally
                {
                    window.Close();
                }
            },
            Token);

    /// <summary>Puts one transfer on the queue in a given state, without moving a byte.</summary>
    private void Enqueue(
        TransferDirection direction,
        string name,
        long length,
        long transferred,
        TransferState state,
        double bytesPerSecond = 0,
        string? failure = null) =>
        transfers.Transfers.Add(new TransferRowViewModel(new TransferSnapshot(
            Guid.CreateVersion7(),
            direction,
            name,
            Path.Combine(Path.GetTempPath(), name),
            SftpPath.Combine("/srv/releases", name),
            length,
            transferred,
            state,
            bytesPerSecond,
            failure)));

    /// <summary>Lays the vault screen out at the width it gets once the nav rail has taken its column.</summary>
    private Task MeasureVaultAsync(Action<IReadOnlyList<string>> assert) =>
        OnTheVaultAsync((_, window) => assert(LayoutHarness.Unreachable(window)));

    private Task OnTheVaultAsync(Action<VaultScreen, Window> body) =>
        LayoutHarness.OnTheUiThreadAsync(
            () =>
            {
                var screen = new VaultScreen { DataContext = vault };

                var window = LayoutHarness.HostAtMinimumSize(
                    screen, LayoutHarness.ScreenWidth, LayoutHarness.ScreenHeight);

                try
                {
                    body(screen, window);
                }
                finally
                {
                    window.Close();
                }
            },
            Token);

    /// <remarks>
    /// Enough rows in every list that none is empty, because an empty list is the easiest case and the one
    /// least worth certifying.
    /// </remarks>
    private async Task SeedAsync()
    {
        for (var i = 0; i < 6; i++)
        {
            vault.NewHostCommand.Execute(null);
            vault.EditorLabel = $"host-{i}";
            vault.EditorHostname = $"host-{i}.internal";
            vault.EditorUsername = "deploy";
            await vault.SaveHostCommand.ExecuteAsync(null);
        }

        for (var i = 0; i < 4; i++)
        {
            vault.NewKeyCommand.Execute(null);
            vault.KeyEditorLabel = $"key-{i}";
            vault.KeyEditorPrivateKey =
                $"-----BEGIN OPENSSH PRIVATE KEY-----\nMATERIAL-{i}\n-----END OPENSSH PRIVATE KEY-----\n";
            await vault.SaveKeyCommand.ExecuteAsync(null);
        }

        for (var i = 0; i < 3; i++)
        {
            vault.NewCredentialCommand.Execute(null);
            vault.CredentialEditorLabel = $"credential-{i}";
            vault.CredentialEditorPassword = $"password-{i}";
            vault.CredentialEditorUsername = $"account-{i}";
            await vault.SaveCredentialCommand.ExecuteAsync(null);
        }

        // Pins come from approving a fingerprint at connect time, not from an editor, so they are seeded
        // through the store the connect path writes to. Two for one endpoint, because a host offering keys
        // of two algorithms is ordinary and the duplicate is one of the things this list has to show.
        foreach (var (host, algorithm) in new[]
        {
            ("host-0.internal", "ssh-ed25519"),
            ("host-0.internal", "ecdsa-sha2-nistp256"),
            ("gone.internal", "ssh-ed25519"),
        })
        {
            await knownHosts.TrustAsync(
                new HostKeyPresentation(
                    host, 22, algorithm, $"SHA256:{algorithm}-fingerprint-0123456789abcdefghijklmnop"),
                Token);
        }

        // Back to where the vault screen opens, so every test starts from the state a user would see.
        vault.Section = VaultSection.All;

        await vault.LoadAsync(Token);
    }
}