//go:build pgint

package pgint

import (
	"context"
	"errors"
	"sync"
	"testing"
	"time"

	"felis.lolicon.best/internal/api"
)

// ---- login codes and ceremonies that coexist (migration 0029) --------------------

func liveLoginCodes(t *testing.T, userID, purpose string, now time.Time) int {
	t.Helper()
	var n int
	if err := db.QueryRow(`SELECT count(*) FROM email_otps
		WHERE user_id = $1 AND purpose = $2 AND consumed_at IS NULL AND expires_at > $3`,
		userID, purpose, now).Scan(&n); err != nil {
		t.Fatalf("count live codes: %v", err)
	}
	return n
}

// A login start keeps the three newest live codes: a fourth drops the oldest, and
// redeeming any live one spends its siblings too.
func TestAddLoginEmailOTPKeepsNewestThree(t *testing.T) {
	ctx := context.Background()
	u := newUser(t, "user", "otp-keep")
	purpose := "login_email"
	addr := "keep-" + suffix(t) + "@example.net"
	t0 := mustNow().Truncate(time.Second)
	add := func(hash string, at time.Time) {
		t.Helper()
		if err := repo.AddLoginEmailOTP(ctx, "keep-"+suffix(t), u.ID, addr, hash, purpose, at, at.Add(10*time.Minute)); err != nil {
			t.Fatalf("AddLoginEmailOTP(%s): %v", hash, err)
		}
	}
	add("h1", t0)
	add("h2", t0.Add(time.Minute))
	add("h3", t0.Add(2*time.Minute))
	if n := liveLoginCodes(t, u.ID, purpose, t0.Add(2*time.Minute)); n != 3 {
		t.Fatalf("live codes after three starts = %d, want 3", n)
	}
	add("h4", t0.Add(3*time.Minute))
	at := t0.Add(3 * time.Minute)
	if n := liveLoginCodes(t, u.ID, purpose, at); n != 3 {
		t.Fatalf("live codes after four starts = %d, want 3", n)
	}
	if err := repo.ConsumeLoginEmailOTP(ctx, u.ID, purpose, "h1", at); !errors.Is(err, api.ErrOTPInvalid) {
		t.Fatalf("oldest code after a fourth start = %v, want ErrOTPInvalid", err)
	}
	if err := repo.ConsumeLoginEmailOTP(ctx, u.ID, purpose, "h2", at); err != nil {
		t.Fatalf("second code = %v, want nil", err)
	}
	for _, h := range []string{"h3", "h4"} {
		if err := repo.ConsumeLoginEmailOTP(ctx, u.ID, purpose, h, at); !errors.Is(err, api.ErrOTPInvalid) {
			t.Fatalf("sibling %s after a sign-in = %v, want ErrOTPInvalid", h, err)
		}
	}

	// Expired codes leave the allowance: a start after they lapse is the only live one.
	add("h5", t0.Add(4*time.Minute))
	add("h6", t0.Add(5*time.Minute))
	later := t0.Add(20 * time.Minute)
	add("h7", later)
	if n := liveLoginCodes(t, u.ID, purpose, later); n != 1 {
		t.Fatalf("live codes after the others expired = %d, want 1", n)
	}
	var unconsumed int
	if err := db.QueryRow(`SELECT count(*) FROM email_otps WHERE user_id = $1 AND purpose = $2 AND consumed_at IS NULL`,
		u.ID, purpose).Scan(&unconsumed); err != nil {
		t.Fatalf("count unconsumed: %v", err)
	}
	if unconsumed != 1 {
		t.Fatalf("unconsumed rows = %d, want 1 (expired codes are deleted, not kept)", unconsumed)
	}
}

// A wrong guess with several live codes costs each open code one attempt and the
// account one failure; when every live code is spent the door answers ErrOTPLocked,
// and a newer code still signs in.
func TestConsumeLoginEmailOTPAcrossLiveCodes(t *testing.T) {
	ctx := context.Background()
	u := newUser(t, "user", "otp-multi")
	purpose := "op_login"
	addr := "multi-" + suffix(t) + "@example.net"
	t0 := mustNow().Truncate(time.Second)
	add := func(hash string, at time.Time) {
		t.Helper()
		if err := repo.AddLoginEmailOTP(ctx, "multi-"+suffix(t), u.ID, addr, hash, purpose, at, at.Add(10*time.Minute)); err != nil {
			t.Fatalf("AddLoginEmailOTP(%s): %v", hash, err)
		}
	}
	add("h-a", t0)
	add("h-b", t0.Add(time.Minute))
	at := t0.Add(time.Minute)
	attempts := func() map[string]int {
		t.Helper()
		rows, err := db.Query(`SELECT code_hash, attempts FROM email_otps WHERE user_id = $1 AND purpose = $2`, u.ID, purpose)
		if err != nil {
			t.Fatalf("read attempts: %v", err)
		}
		defer rows.Close()
		got := map[string]int{}
		for rows.Next() {
			var h string
			var n int
			if err := rows.Scan(&h, &n); err != nil {
				t.Fatalf("scan: %v", err)
			}
			got[h] = n
		}
		return got
	}

	if err := repo.ConsumeLoginEmailOTP(ctx, u.ID, purpose, "h-wrong", at); !errors.Is(err, api.ErrOTPInvalid) {
		t.Fatalf("wrong guess = %v, want ErrOTPInvalid", err)
	}
	if got := attempts(); got["h-a"] != 1 || got["h-b"] != 1 {
		t.Fatalf("attempts after one wrong guess = %v, want h-a:1 h-b:1", got)
	}
	for i := 2; i <= 5; i++ {
		if err := repo.ConsumeLoginEmailOTP(ctx, u.ID, purpose, "h-wrong", at); !errors.Is(err, api.ErrOTPInvalid) {
			t.Fatalf("wrong guess %d = %v, want ErrOTPInvalid", i, err)
		}
	}
	if err := repo.ConsumeLoginEmailOTP(ctx, u.ID, purpose, "h-a", at); !errors.Is(err, api.ErrOTPLocked) {
		t.Fatalf("right code once every live code is spent = %v, want ErrOTPLocked", err)
	}
	var failures int
	if err := db.QueryRow(`SELECT failures FROM otp_failure_windows WHERE user_id = $1 AND purpose = $2`,
		u.ID, purpose).Scan(&failures); err != nil {
		t.Fatalf("read budget row: %v", err)
	}
	if failures != 5 {
		t.Fatalf("account failures = %d, want 5 (one per wrong guess, not one per code)", failures)
	}

	add("h-c", t0.Add(2*time.Minute))
	at = t0.Add(2 * time.Minute)
	if err := repo.ConsumeLoginEmailOTP(ctx, u.ID, purpose, "h-b", at); !errors.Is(err, api.ErrOTPInvalid) {
		t.Fatalf("spent code beside a fresh one = %v, want ErrOTPInvalid", err)
	}
	if got := attempts(); got["h-c"] != 1 || got["h-a"] != 5 || got["h-b"] != 5 {
		t.Fatalf("attempts after a guess of a spent code = %v, want h-c:1 and the spent codes left at 5", got)
	}
	if err := repo.ConsumeLoginEmailOTP(ctx, u.ID, purpose, "h-c", at); err != nil {
		t.Fatalf("fresh code = %v, want nil", err)
	}
	if n := liveLoginCodes(t, u.ID, purpose, at); n != 0 {
		t.Fatalf("live codes after a sign-in = %d, want 0", n)
	}
}

// Email-first passkey ceremonies of one account coexist and are redeemed by the
// challenge the browser signed; one network holds at most 32 live ones.
func TestPasskeyLoginChallengesCoexist(t *testing.T) {
	ctx := context.Background()
	u := newUser(t, "user", "pk-login")
	purpose := "passkey_login"
	source := "203.0.113." + suffix(t)
	now := mustNow()
	add := func(id, source, challenge, session string, expiresAt time.Time) error {
		return repo.AddPasskeyLoginChallenge(ctx, id+"-"+suffix(t), u.ID, purpose, source, challenge, []byte(session), now, expiresAt)
	}
	if err := add("c1", source, "Y2hhbGxlbmdlMQ", "s1", now.Add(5*time.Minute)); err != nil {
		t.Fatalf("add c1: %v", err)
	}
	if err := add("c2", source, "Y2hhbGxlbmdlMg", "s2", now.Add(5*time.Minute)); err != nil {
		t.Fatalf("add c2: %v", err)
	}
	if _, err := repo.ConsumePasskeyLoginChallenge(ctx, u.ID, purpose, "bm9ib2R5", now); !errors.Is(err, api.ErrPasskeyChallengeInvalid) {
		t.Fatalf("unissued challenge = %v, want ErrPasskeyChallengeInvalid", err)
	}
	if sd, err := repo.ConsumePasskeyLoginChallenge(ctx, u.ID, purpose, "Y2hhbGxlbmdlMQ", now); err != nil || string(sd) != "s1" {
		t.Fatalf("earlier ceremony = %q, %v; want s1 (a later begin must not cancel it)", sd, err)
	}
	if _, err := repo.ConsumePasskeyLoginChallenge(ctx, u.ID, purpose, "Y2hhbGxlbmdlMQ", now); !errors.Is(err, api.ErrPasskeyChallengeInvalid) {
		t.Fatalf("replay = %v, want ErrPasskeyChallengeInvalid", err)
	}
	if sd, err := repo.ConsumePasskeyLoginChallenge(ctx, u.ID, purpose, "Y2hhbGxlbmdlMg", now); err != nil || string(sd) != "s2" {
		t.Fatalf("later ceremony = %q, %v; want s2", sd, err)
	}
	// The same challenge under another purpose is a different door.
	if err := add("c3", source, "Y2hhbGxlbmdlMw", "s3", now.Add(5*time.Minute)); err != nil {
		t.Fatalf("add c3: %v", err)
	}
	if _, err := repo.ConsumePasskeyLoginChallenge(ctx, u.ID, "passkey_register", "Y2hhbGxlbmdlMw", now); !errors.Is(err, api.ErrPasskeyChallengeInvalid) {
		t.Fatalf("other purpose = %v, want ErrPasskeyChallengeInvalid", err)
	}
	if _, err := repo.ConsumePasskeyLoginChallenge(ctx, u.ID, purpose, "Y2hhbGxlbmdlMw", now.Add(6*time.Minute)); !errors.Is(err, api.ErrPasskeyChallengeInvalid) {
		t.Fatalf("expired ceremony = %v, want ErrPasskeyChallengeInvalid", err)
	}

	// Other accounts' spent rows from the same source hold no slot: one expired, one
	// redeemed. Two accounts, since an account's own begin reaps its spent rows.
	other := newUser(t, "user", "pk-login-other")
	if err := repo.AddPasskeyLoginChallenge(ctx, "ox-"+suffix(t), other.ID, purpose, source, "ZXhwaXJlZA", []byte("s"), now, now.Add(-time.Second)); err != nil {
		t.Fatalf("other account's expired begin: %v", err)
	}
	third := newUser(t, "user", "pk-login-third")
	if err := repo.AddPasskeyLoginChallenge(ctx, "oc-"+suffix(t), third.ID, purpose, source, "cmVkZWVtZWQ", []byte("s"), now, now.Add(5*time.Minute)); err != nil {
		t.Fatalf("third account's begin: %v", err)
	}
	if _, err := repo.ConsumePasskeyLoginChallenge(ctx, third.ID, purpose, "cmVkZWVtZWQ", now); err != nil {
		t.Fatalf("third account's finish: %v", err)
	}

	// Per-source bound: c3 is still live at now, so 31 more fill the allowance.
	for i := 0; i < 31; i++ {
		if err := add("cap", source, "Y2Fw", "s", now.Add(5*time.Minute)); err != nil {
			t.Fatalf("add %d from the source: %v", i+2, err)
		}
	}
	if err := add("over", source, "b3Zlcg", "s", now.Add(5*time.Minute)); !errors.Is(err, api.ErrTooManyPasskeyChallenges) {
		t.Fatalf("33rd live challenge from one source = %v, want ErrTooManyPasskeyChallenges", err)
	}
	if err := repo.AddPasskeyLoginChallenge(ctx, "x-"+suffix(t), other.ID, purpose, source, "eA", []byte("s"), now, now.Add(5*time.Minute)); !errors.Is(err, api.ErrTooManyPasskeyChallenges) {
		t.Fatalf("another account's begin from the full source = %v, want ErrTooManyPasskeyChallenges", err)
	}
	if err := add("elsewhere", "198.51.100."+suffix(t), "ZWxzZXdoZXJl", "s", now.Add(5*time.Minute)); err != nil {
		t.Fatalf("begin from another source: %v", err)
	}
	// A redeemed ceremony frees its slot.
	if _, err := repo.ConsumePasskeyLoginChallenge(ctx, u.ID, purpose, "b3Zlcg", now); !errors.Is(err, api.ErrPasskeyChallengeInvalid) {
		t.Fatalf("the refused begin left a row: %v", err)
	}
	var capID string
	if err := db.QueryRow(`SELECT challenge FROM webauthn_challenges WHERE user_id = $1 AND source = $2 AND consumed_at IS NULL LIMIT 1`,
		u.ID, source).Scan(&capID); err != nil {
		t.Fatalf("pick a live challenge: %v", err)
	}
	if _, err := repo.ConsumePasskeyLoginChallenge(ctx, u.ID, purpose, capID, now); err != nil {
		t.Fatalf("redeem one from the full source: %v", err)
	}
	if err := add("after", source, "YWZ0ZXI", "s", now.Add(5*time.Minute)); err != nil {
		t.Fatalf("begin after one was redeemed = %v, want nil", err)
	}
}

// The usernameless store holds each source to 32 live challenges and the whole
// table to 16384.
func TestDiscoverableChallengeBounds(t *testing.T) {
	ctx := context.Background()
	now := mustNow()
	source := "2001:db8:" + suffix(t)[:4] + "::/48"
	t.Cleanup(func() {
		db.Exec(`DELETE FROM webauthn_discoverable_challenges WHERE source LIKE 'pgint-bulk-%' OR source = $1`, source) //nolint:errcheck
	})
	var ids []string
	for i := 0; i < 32; i++ {
		id := "disc-" + suffix(t)
		if err := repo.CreateDiscoverableChallenge(ctx, id, source, []byte("s"), now, now.Add(5*time.Minute)); err != nil {
			t.Fatalf("create %d: %v", i+1, err)
		}
		ids = append(ids, id)
	}
	if err := repo.CreateDiscoverableChallenge(ctx, "disc-over-"+suffix(t), source, []byte("s"), now, now.Add(5*time.Minute)); !errors.Is(err, api.ErrTooManyPasskeyChallenges) {
		t.Fatalf("33rd from one source = %v, want ErrTooManyPasskeyChallenges", err)
	}
	if err := repo.CreateDiscoverableChallenge(ctx, "disc-else-"+suffix(t), "pgint-bulk-else", []byte("s"), now, now.Add(5*time.Minute)); err != nil {
		t.Fatalf("another source: %v", err)
	}
	if _, err := repo.ConsumeDiscoverableChallenge(ctx, ids[0], now); err != nil {
		t.Fatalf("consume: %v", err)
	}
	if err := repo.CreateDiscoverableChallenge(ctx, "disc-after-"+suffix(t), source, []byte("s"), now, now.Add(5*time.Minute)); err != nil {
		t.Fatalf("after a redeem freed a slot = %v, want nil", err)
	}

	// Fill the table to its store-wide bound from many sources, none of them full.
	var live int
	if err := db.QueryRow(`SELECT count(*) FROM webauthn_discoverable_challenges WHERE consumed_at IS NULL AND expires_at > $1`, now).Scan(&live); err != nil {
		t.Fatalf("count: %v", err)
	}
	if _, err := db.Exec(`INSERT INTO webauthn_discoverable_challenges (id, session_data, expires_at, source)
		SELECT 'bulk-' || $1 || '-' || i, '\x00'::bytea, $2, 'pgint-bulk-' || (i % 1000)
		FROM generate_series(1, $3) AS i`, suffix(t), now.Add(5*time.Minute), 16384-live); err != nil {
		t.Fatalf("bulk insert: %v", err)
	}
	if err := repo.CreateDiscoverableChallenge(ctx, "disc-full-"+suffix(t), "pgint-bulk-fresh", []byte("s"), now, now.Add(5*time.Minute)); !errors.Is(err, api.ErrTooManyPasskeyChallenges) {
		t.Fatalf("begin with the table full = %v, want ErrTooManyPasskeyChallenges", err)
	}
}

// ---- enrollment and step-up ceremonies (migration 0007) ---------------------------

func challengeRows(t *testing.T, userID, purpose string) int {
	t.Helper()
	var n int
	if err := db.QueryRow(`SELECT count(*) FROM webauthn_challenges WHERE user_id = $1 AND purpose = $2`,
		userID, purpose).Scan(&n); err != nil {
		t.Fatalf("count challenges: %v", err)
	}
	return n
}

// An enrollment begin supersedes the account's earlier one for the same purpose and
// sweeps the row its last finish spent, so (user, purpose) holds one row; finish is
// single-use, dies at expires_at, and never crosses purposes or accounts.
func TestPasskeyChallengeByUserContract(t *testing.T) {
	ctx := context.Background()
	u := newUser(t, "user", "pk-reg")
	other := newUser(t, "user", "pk-reg-other")
	const reg = "passkey_register"
	t0 := mustNow().Truncate(time.Second)
	begin := func(userID, purpose, session string, expiresAt time.Time) {
		t.Helper()
		if err := repo.CreatePasskeyChallenge(ctx, "reg-"+suffix(t), userID, purpose, []byte(session), expiresAt); err != nil {
			t.Fatalf("CreatePasskeyChallenge(%s): %v", session, err)
		}
	}
	finish := func(userID, purpose string, at time.Time) (string, error) {
		sd, err := repo.ConsumePasskeyChallengeByUser(ctx, userID, purpose, at)
		return string(sd), err
	}

	if _, err := finish(u.ID, reg, t0); !errors.Is(err, api.ErrPasskeyChallengeInvalid) {
		t.Fatalf("finish with no begin = %v, want ErrPasskeyChallengeInvalid", err)
	}
	begin(u.ID, reg, "s1", t0.Add(5*time.Minute))
	begin(other.ID, reg, "o1", t0.Add(5*time.Minute))
	begin(u.ID, reg, "s2", t0.Add(5*time.Minute))
	if n := challengeRows(t, u.ID, reg); n != 1 {
		t.Fatalf("rows after two begins = %d, want 1", n)
	}
	if sd, err := finish(u.ID, reg, t0); err != nil || sd != "s2" {
		t.Fatalf("finish = %q, %v; want s2", sd, err)
	}
	if _, err := finish(u.ID, reg, t0); !errors.Is(err, api.ErrPasskeyChallengeInvalid) {
		t.Fatalf("replayed finish = %v, want ErrPasskeyChallengeInvalid", err)
	}
	if sd, err := finish(other.ID, reg, t0); err != nil || sd != "o1" {
		t.Fatalf("other account's finish = %q, %v; want o1 (a begin never touches another account)", sd, err)
	}

	// The spent row goes with the next begin.
	begin(u.ID, reg, "s3", t0.Add(5*time.Minute))
	if n := challengeRows(t, u.ID, reg); n != 1 {
		t.Fatalf("rows after finish then begin = %d, want 1", n)
	}

	// A step-up ceremony is its own door.
	begin(u.ID, "reauth", "r1", t0.Add(5*time.Minute))
	if n := challengeRows(t, u.ID, reg); n != 1 {
		t.Fatalf("a reauth begin touched the enrollment row: %d rows, want 1", n)
	}
	if sd, err := finish(u.ID, "reauth", t0); err != nil || sd != "r1" {
		t.Fatalf("reauth finish = %q, %v; want r1", sd, err)
	}
	if _, err := finish(u.ID, "reauth", t0); !errors.Is(err, api.ErrPasskeyChallengeInvalid) {
		t.Fatalf("reauth replay = %v, want ErrPasskeyChallengeInvalid", err)
	}

	// Expiry: at expires_at the ceremony is dead; a second earlier it still redeems.
	if _, err := finish(u.ID, reg, t0.Add(5*time.Minute)); !errors.Is(err, api.ErrPasskeyChallengeInvalid) {
		t.Fatalf("finish at expires_at = %v, want ErrPasskeyChallengeInvalid", err)
	}
	if sd, err := finish(u.ID, reg, t0.Add(5*time.Minute-time.Second)); err != nil || sd != "s3" {
		t.Fatalf("finish a second before expiry = %q, %v; want s3", sd, err)
	}
}

// Begins that race for one (user, purpose) leave exactly one row, and finishes that
// race for one ceremony redeem it once.
func TestPasskeyChallengeByUserUnderConcurrency(t *testing.T) {
	ctx := context.Background()
	const reg = "passkey_register"
	now := mustNow()
	for round := 0; round < 5; round++ {
		u := newUser(t, "user", "pk-race")
		var wg sync.WaitGroup
		errs := make([]error, 8)
		for i := range errs {
			wg.Add(1)
			go func(i int) {
				defer wg.Done()
				errs[i] = repo.CreatePasskeyChallenge(ctx, "race-"+suffix(t), u.ID, reg, []byte("s"), now.Add(5*time.Minute))
			}(i)
		}
		wg.Wait()
		for i, err := range errs {
			if err != nil {
				t.Fatalf("round %d: begin %d: %v", round, i, err)
			}
		}
		if n := challengeRows(t, u.ID, reg); n != 1 {
			t.Fatalf("round %d: rows after 8 racing begins = %d, want 1", round, n)
		}

		won, lost := 0, 0
		for i := range errs {
			wg.Add(1)
			go func(i int) {
				defer wg.Done()
				_, errs[i] = repo.ConsumePasskeyChallengeByUser(ctx, u.ID, reg, now)
			}(i)
		}
		wg.Wait()
		for i, err := range errs {
			switch {
			case err == nil:
				won++
			case errors.Is(err, api.ErrPasskeyChallengeInvalid):
				lost++
			default:
				t.Fatalf("round %d: finish %d: %v", round, i, err)
			}
		}
		if won != 1 || lost != 7 {
			t.Fatalf("round %d: racing finishes: %d redeemed, %d refused; want 1, 7", round, won, lost)
		}
	}
}

// Racing begins from one source still stop at 32 live challenges, in both login
// stores: the count and the insert are one decision.
func TestLoginChallengeSourceBoundUnderConcurrency(t *testing.T) {
	ctx := context.Background()
	now := mustNow()
	race := func(t *testing.T, begin func(i int) error) (ok, refused int) {
		t.Helper()
		var wg sync.WaitGroup
		errs := make([]error, 64)
		for i := range errs {
			wg.Add(1)
			go func(i int) {
				defer wg.Done()
				errs[i] = begin(i)
			}(i)
		}
		wg.Wait()
		for i, err := range errs {
			switch {
			case err == nil:
				ok++
			case errors.Is(err, api.ErrTooManyPasskeyChallenges):
				refused++
			default:
				t.Fatalf("begin %d: %v", i, err)
			}
		}
		return ok, refused
	}

	t.Run("discoverable", func(t *testing.T) {
		source := "2001:db8:" + suffix(t)[:4] + "::/48"
		t.Cleanup(func() {
			db.Exec(`DELETE FROM webauthn_discoverable_challenges WHERE source = $1`, source) //nolint:errcheck
		})
		ok, refused := race(t, func(int) error {
			return repo.CreateDiscoverableChallenge(ctx, "drace-"+suffix(t), source, []byte("s"), now, now.Add(5*time.Minute))
		})
		var stored int
		if err := db.QueryRow(`SELECT count(*) FROM webauthn_discoverable_challenges WHERE source = $1`, source).Scan(&stored); err != nil {
			t.Fatalf("count: %v", err)
		}
		if ok != 32 || refused != 32 || stored != 32 {
			t.Fatalf("64 racing begins: %d stored, %d refused, %d rows; want 32, 32, 32", ok, refused, stored)
		}
	})

	t.Run("email-first", func(t *testing.T) {
		u := newUser(t, "user", "pk-login-race")
		source := "203.0.113." + suffix(t)
		ok, refused := race(t, func(int) error {
			return repo.AddPasskeyLoginChallenge(ctx, "lrace-"+suffix(t), u.ID, "passkey_login", source, "c-"+suffix(t), []byte("s"), now, now.Add(5*time.Minute))
		})
		var stored int
		if err := db.QueryRow(`SELECT count(*) FROM webauthn_challenges WHERE source = $1`, source).Scan(&stored); err != nil {
			t.Fatalf("count: %v", err)
		}
		if ok != 32 || refused != 32 || stored != 32 {
			t.Fatalf("64 racing begins: %d stored, %d refused, %d rows; want 32, 32, 32", ok, refused, stored)
		}
	})

	t.Run("discoverable finish", func(t *testing.T) {
		id := "dfin-" + suffix(t)
		if err := repo.CreateDiscoverableChallenge(ctx, id, "pgint-fin-"+suffix(t), []byte("s"), now, now.Add(5*time.Minute)); err != nil {
			t.Fatalf("begin: %v", err)
		}
		var wg sync.WaitGroup
		errs := make([]error, 8)
		for i := range errs {
			wg.Add(1)
			go func(i int) {
				defer wg.Done()
				_, errs[i] = repo.ConsumeDiscoverableChallenge(ctx, id, now)
			}(i)
		}
		wg.Wait()
		won, lost := 0, 0
		for i, err := range errs {
			switch {
			case err == nil:
				won++
			case errors.Is(err, api.ErrPasskeyChallengeInvalid):
				lost++
			default:
				t.Fatalf("finish %d: %v", i, err)
			}
		}
		if won != 1 || lost != 7 {
			t.Fatalf("racing finishes: %d redeemed, %d refused; want 1, 7", won, lost)
		}
	})
}