//! The `emacs --batch` ground-truth oracle (spec §5, Phase 0).
//!
//! Every other test in this suite checks orgo against orgo: a snapshot says our
//! output has not *changed*, never that it is *right*. Those two questions are different,
//! and only one of them matters to someone whose site is currently published by Emacs.
//! This file answers the second by exporting the same fixture with org's own HTML
//! exporter — the exporter weblorg wraps to publish the target corpus — and diffing the
//! two.
//!
//! **What is compared.** Byte equality is not a useful goal: org wraps every section in
//! `outline-container` divs keyed by generated ids, and no amount of agreement on
//! semantics would survive that. Both sides are reduced to a *semantic skeleton* — the
//! sequence of element opens, closes, and text runs, with `<div>`s and all attributes
//! except `href`/`src` dropped, whitespace collapsed, and entities decoded. What remains
//! is the question worth asking: does org think this is a `<blockquote><p>`, and do we?
//!
//! **What the result means.** These tests do not assert agreement — they *snapshot the
//! disagreement*. A divergence report that is checked in and reviewed is worth more than
//! a red test nobody can act on, and it makes any new divergence show up as a diff in
//! code review. A few invariants that must never break are asserted outright.
//!
//! The suite skips cleanly when Emacs is absent, so it never blocks a machine or CI
//! runner that has no Emacs.

use std::process::Command;

use camino::Utf8PathBuf;

use orgo::parser::parse;
use orgo::render::{render, Html, SyntectHighlighter};
use orgo::resolve::ResolvedDoc;
use orgo::skeleton::{decode_entities, skeleton};

fn manifest_dir() -> Utf8PathBuf {
    Utf8PathBuf::from(env!("CARGO_MANIFEST_DIR"))
}

/// Is a usable Emacs on PATH? The oracle is a development instrument, not a build
/// dependency, so its absence skips rather than fails.
fn emacs_available() -> bool {
    Command::new("emacs")
        .arg("--version")
        .output()
        .map(|o| o.status.success())
        .unwrap_or(false)
}

/// Emacs and org, as the `+` side of every report below. The ground truth moves: org
/// 9.8 began wrapping source blocks in `<pre><code>`, which orgo already did, so three
/// of these snapshots gained several points without orgo changing. Recorded so that
/// shows in the diff as what it is rather than reading as a regression.
fn oracle_version() -> &'static str {
    static VERSION: std::sync::OnceLock<String> = std::sync::OnceLock::new();
    VERSION.get_or_init(|| {
        let output = Command::new("emacs")
            .args([
                "-Q",
                "--batch",
                "--eval",
                "(progn (require 'org) \
                 (princ (format \"emacs %s, org %s\" emacs-version (org-version))))",
            ])
            .output()
            .expect("run emacs");
        String::from_utf8_lossy(&output.stdout).trim().to_string()
    })
}

/// Export a fixture with org's own HTML exporter.
fn org_export(fixture: &str) -> String {
    let root = manifest_dir();
    let output = Command::new("emacs")
        .args(["-Q", "--batch", "-l"])
        .arg(root.join("tests/oracle.el"))
        .env("ORG_ORACLE_INPUT", root.join("fixtures").join(fixture))
        .current_dir(&root)
        .output()
        .expect("run emacs");
    assert!(
        output.status.success(),
        "emacs export of {fixture} failed:\n{}",
        String::from_utf8_lossy(&output.stderr)
    );
    String::from_utf8(output.stdout).expect("emacs emits UTF-8")
}

/// Render a fixture with orgo.
fn our_export(fixture: &str) -> String {
    let path = manifest_dir().join("fixtures").join(fixture);
    let source = std::fs::read_to_string(&path).expect("read fixture");
    let document = parse(Utf8PathBuf::from(fixture).as_path(), &source).expect("parse");
    let Html(html) = render(&ResolvedDoc { document }, &SyntectHighlighter::new());
    html
}

// ---------------------------------------------------------------------------
// Divergence report
// ---------------------------------------------------------------------------

/// One divergence orgo makes on purpose, so the report can separate "we chose this"
/// from "we got this wrong".
///
/// Without this split the agreement percentage is noise: the timestamps fixture sat at
/// 40% while being entirely correct, because org writes `<2024-01-15 Mon>` as text and
/// orgo writes a `<time datetime>` element. A number that cannot fall when a real
/// defect appears is not measuring anything.
struct Deliberate {
    name: &'static str,
    /// Does this hunk consist only of the difference described? `ours` are the `-` lines,
    /// `theirs` the `+` lines.
    matches: fn(&[String], &[String]) -> bool,
    /// Only applies once the notes section has started. Two footnote definitions differ
    /// by `</li><li>` against `</sup><p>`, which is the same shape difference — but a
    /// list where a paragraph was expected is a real defect anywhere else, so the rule
    /// is not allowed to explain it anywhere else.
    in_notes_only: bool,
}

fn is_tag(line: &str, names: &[&str]) -> bool {
    names
        .iter()
        .any(|n| line == format!("<{n}>") || line == format!("</{n}>"))
}

fn text_of(line: &str) -> Option<&str> {
    line.strip_prefix('"')?.strip_suffix('"')
}

/// The one text run a hunk consists of, if that is all it is.
fn one_text(lines: &[String]) -> Option<&str> {
    match lines {
        [line] => text_of(line),
        _ => None,
    }
}

/// `TODO [#A] Write the parser` → `TODO Write the parser`.
fn without_priority(text: &str) -> Option<String> {
    let open = text.find("[#")?;
    let close = open + text[open..].find(']')?;
    let joined = format!("{}{}", &text[..open], text[close + 1..].trim_start());
    Some(joined.trim().to_string())
}

/// Does this text run contain an org timestamp, `<2024-01-15 Mon>` or `[2024-01-15]`?
fn has_timestamp(line: &str) -> bool {
    let t = match text_of(line) {
        Some(t) => t,
        None => return false,
    };
    t.contains('<') && t.contains('-') || t.contains('[') && t.contains('-')
}

const DELIBERATE: &[Deliberate] = &[
    // `<time datetime="…">` instead of org's plain text: the date is data, and a reader's
    // browser can do something with it.
    Deliberate {
        name: "semantic-time",
        matches: |ours, theirs| {
            // Both sides are allowed to carry text, so without the `any` guards this
            // rule matches *any* hunk of differing prose and files it under a rendering
            // choice nobody made. That is how org 9.8's malformed `&nbsp` in the heading
            // tag prefix arrived here labelled `semantic-time`.
            ours.iter().any(|l| is_tag(l, &["time"]))
                && ours
                    .iter()
                    .all(|l| is_tag(l, &["time"]) || text_of(l).is_some())
                && theirs.iter().any(|l| has_timestamp(l))
                && theirs.iter().all(|l| has_timestamp(l) || text_of(l).is_some())
        },
        in_notes_only: false,
    },
    // The priority cookie stays in the heading: the author wrote it, and a reader
    // skimming a task list wants to see it. Org drops it, because
    // `org-export-with-priority` defaults to nil. Heading decoration is a policy
    // difference, not a structural one.
    Deliberate {
        name: "heading-priority-cookie",
        matches: |ours, theirs| match (one_text(ours), one_text(theirs)) {
            (Some(ours), Some(theirs)) => without_priority(ours).as_deref() == Some(theirs),
            _ => false,
        },
        in_notes_only: false,
    },
    // `<figure>`/`<figcaption>` instead of two paragraphs in a div.
    Deliberate {
        name: "figure-element",
        matches: |ours, theirs| {
            ours.iter().any(|l| is_tag(l, &["figure", "figcaption"]))
                && ours
                    .iter()
                    .all(|l| is_tag(l, &["figure", "figcaption"]) || text_of(l).is_some())
                && theirs.iter().all(|l| is_tag(l, &["p"]) || text_of(l).is_some())
        },
        in_notes_only: false,
    },
    // `<em>`/`<strong>` instead of org's presentational `<i>`/`<b>`.
    Deliberate {
        name: "semantic-emphasis",
        matches: |ours, theirs| {
            !ours.is_empty()
                && ours.iter().all(|l| is_tag(l, &["em", "strong", "del"]))
                && theirs.iter().all(|l| is_tag(l, &["i", "b", "s", "del"]))
        },
        in_notes_only: false,
    },
    // `<pre><code>`: the nested element is what every syntax highlighter and every
    // reader's stylesheet expects. Org 9.8 emits it too, so this no longer fires — kept
    // because org 9.7 and earlier write a bare `<pre>`, and the oracle is whatever Emacs
    // is on the machine.
    Deliberate {
        name: "pre-code",
        matches: |ours, theirs| {
            !ours.is_empty() && ours.iter().all(|l| is_tag(l, &["code"])) && theirs.is_empty()
        },
        in_notes_only: false,
    },
    // Org emits a `<colgroup>` of empty `<col>`s to carry column alignment; orgo
    // leaves alignment to the stylesheet.
    Deliberate {
        name: "no-colgroup",
        matches: |ours, theirs| {
            ours.is_empty()
                && !theirs.is_empty()
                && theirs.iter().all(|l| is_tag(l, &["colgroup", "col"]) || l == "<col>")
        },
        in_notes_only: false,
    },
    // Footnote ids: `fn-1` rather than org's `fn.1`, because a dot in an id is awkward in
    // a CSS selector.
    Deliberate {
        name: "footnote-anchor-naming",
        matches: |ours, theirs| {
            ours.len() == 1
                && theirs.len() == 1
                && ours[0].replace("fn-", "fn.") == theirs[0]
                && ours[0].contains("#fn")
        },
        in_notes_only: false,
    },
    // The notes section itself: an `<ol>` under a rule, rather than org's headed div of
    // paragraphs, and a `↩` back-link rather than a repeated superscript number. Same
    // notes, same order, same links, in the shape a screen reader announces as a list.
    Deliberate {
        name: "footnote-section-shape",
        matches: |ours, theirs| {
            let ours_is_notes = ours.iter().all(|l| {
                is_tag(l, &["section", "ol", "li", "a", "sup", "p"])
                    || l == "<hr>"
                    || l.starts_with("<a href=\"#fn")
                    || text_of(l) == Some("↩")
                    || text_of(l).is_some()
            });
            let theirs_is_notes = theirs.iter().all(|l| {
                is_tag(l, &["h2", "sup", "p", "a", "div"])
                    || l.starts_with("<a href=\"#fn")
                    || text_of(l).is_some()
            });
            let touches_notes = ours.iter().chain(theirs).any(|l| {
                l.contains("#fn") || text_of(l) == Some("Footnotes:") || is_tag(l, &["section"])
            });
            touches_notes && ours_is_notes && theirs_is_notes
        },
        in_notes_only: false,
    },
    // Two note definitions abutting: `</li><li>` where org writes `</sup><p>`.
    Deliberate {
        name: "footnote-section-shape",
        matches: |ours, theirs| {
            !ours.is_empty()
                && ours.iter().all(|l| is_tag(l, &["li", "ol", "section"]))
                && theirs.iter().all(|l| is_tag(l, &["p", "sup", "div"]))
        },
        in_notes_only: true,
    },
    // Verse ends without a trailing `<br>`: org emits one for the final newline, which is
    // a blank line at the end of the stanza and nothing else.
    Deliberate {
        name: "verse-trailing-break",
        matches: |ours, theirs| ours.is_empty() && theirs == ["<br>"],
        in_notes_only: false,
    },
    // `[[id:…]]` resolves here and does not in the oracle: a single-file `emacs --batch`
    // export has no id database, so org drops the link and keeps its text. This is a
    // property of the harness, not of either exporter.
    Deliberate {
        name: "id-link-resolution",
        matches: |ours, theirs| {
            ours.iter().any(|l| l.starts_with("<a href=\"#"))
                && ours.iter().all(|l| is_tag(l, &["a"]) || l.starts_with("<a href=") || text_of(l).is_some())
                && theirs.iter().all(|l| text_of(l).is_some())
        },
        in_notes_only: false,
    },
    // A change of bullet starts a new list. Org instead continues the list — two blank
    // lines end one, not a switch from `1.` to `-` — so a dash item written under a
    // numbered list is exported *numbered*. We split, which is what the author drew.
    // Deliberate, and the one entry here that is arguably worth revisiting.
    Deliberate {
        name: "list-per-bullet-type",
        matches: |ours, theirs| {
            !ours.is_empty()
                && ours.iter().all(|l| is_tag(l, &["ol", "ul"]))
                && theirs.iter().all(|l| is_tag(l, &["ol", "ul"]))
        },
        in_notes_only: false,
    },
];

/// One run of differing lines: what we wrote, and what Emacs wrote.
struct Hunk {
    ours: Vec<String>,
    theirs: Vec<String>,
}

impl Hunk {
    fn len(&self) -> usize {
        self.ours.len().max(self.theirs.len())
    }

    fn deliberate(&self, in_notes: bool) -> Option<&'static str> {
        DELIBERATE
            .iter()
            .filter(|d| in_notes || !d.in_notes_only)
            .find(|d| (d.matches)(&self.ours, &self.theirs))
            .map(|d| d.name)
    }

    /// Does this hunk start the footnote section?
    fn starts_notes(&self) -> bool {
        self.ours
            .iter()
            .chain(&self.theirs)
            .any(|l| l == "<section>" || text_of(l) == Some("Footnotes:"))
    }
}

enum Op {
    Same(String),
    Differs(Hunk),
}

/// Longest-common-subsequence walk, grouped into runs of agreement and disagreement.
fn align(ours: &[String], theirs: &[String]) -> Vec<Op> {
    let (n, m) = (ours.len(), theirs.len());
    let mut lcs = vec![vec![0usize; m + 1]; n + 1];
    for i in (0..n).rev() {
        for j in (0..m).rev() {
            lcs[i][j] = if ours[i] == theirs[j] {
                lcs[i + 1][j + 1] + 1
            } else {
                lcs[i + 1][j].max(lcs[i][j + 1])
            };
        }
    }

    let mut out: Vec<Op> = Vec::new();
    let push_diff = |out: &mut Vec<Op>, mine: Option<String>, theirs: Option<String>| {
        if let Some(Op::Differs(h)) = out.last_mut() {
            h.ours.extend(mine);
            h.theirs.extend(theirs);
            return;
        }
        out.push(Op::Differs(Hunk {
            ours: mine.into_iter().collect(),
            theirs: theirs.into_iter().collect(),
        }));
    };

    let (mut i, mut j) = (0, 0);
    while i < n && j < m {
        if ours[i] == theirs[j] {
            out.push(Op::Same(ours[i].clone()));
            i += 1;
            j += 1;
        } else if lcs[i + 1][j] >= lcs[i][j + 1] {
            push_diff(&mut out, Some(ours[i].clone()), None);
            i += 1;
        } else {
            push_diff(&mut out, None, Some(theirs[j].clone()));
            j += 1;
        }
    }
    for line in &ours[i..] {
        push_diff(&mut out, Some(line.clone()), None);
    }
    for line in &theirs[j..] {
        push_diff(&mut out, None, Some(line.clone()));
    }
    out
}

/// A unified diff of the two skeletons, with hunks that are deliberate collapsed to a
/// named line. `-` is orgo, `+` is Emacs.
///
/// The number that matters is the last one: *unexplained* lines. Agreement can be low
/// while unexplained is zero, and that is a passing state.
fn divergence(ours: &[String], theirs: &[String]) -> String {
    let ops = align(ours, theirs);
    let mut agreed = 0usize;
    let mut deliberate = 0usize;
    let mut unexplained = 0usize;
    let mut by_rule: std::collections::BTreeMap<&str, usize> = std::collections::BTreeMap::new();
    let mut body = String::new();
    let mut in_notes = false;

    for op in &ops {
        match op {
            Op::Same(line) => {
                agreed += 1;
                body.push_str(&format!("  {line}\n"));
            }
            Op::Differs(hunk) => {
                in_notes |= hunk.starts_notes();
                match hunk.deliberate(in_notes) {
                Some(rule) => {
                    deliberate += hunk.len();
                    *by_rule.entry(rule).or_default() += 1;
                    body.push_str(&format!("~ {rule} ({} line(s))\n", hunk.len()));
                }
                None => {
                    unexplained += hunk.len();
                    for line in &hunk.ours {
                        body.push_str(&format!("- {line}\n"));
                    }
                    for line in &hunk.theirs {
                        body.push_str(&format!("+ {line}\n"));
                    }
                }
                }
            }
        }
    }

    let total = ours.len().max(theirs.len());
    let pct = if total == 0 {
        100.0
    } else {
        100.0 * agreed as f64 / total as f64
    };
    let rules: Vec<String> = by_rule
        .iter()
        .map(|(name, n)| format!("{name} ×{n}"))
        .collect();
    format!(
        "agreement: {agreed}/{total} skeleton lines ({pct:.1}%)\n\
         deliberate: {deliberate} line(s){}\n\
         unexplained: {unexplained} line(s)\n\
         (- orgo, + emacs, ~ a difference we mean to have)\n\n{body}",
        if rules.is_empty() {
            String::new()
        } else {
            format!(" — {}", rules.join(", "))
        }
    )
}

/// Snapshot the divergence between orgo and Emacs for one fixture.
fn compare(fixture: &str) -> Option<String> {
    if !emacs_available() {
        eprintln!("skipping oracle comparison for {fixture}: no emacs on PATH");
        return None;
    }
    let ours = skeleton(&our_export(fixture));
    let theirs = skeleton(&org_export(fixture));
    Some(format!(
        "oracle: {}\n{}",
        oracle_version(),
        divergence(&ours, &theirs)
    ))
}

macro_rules! oracle_test {
    ($name:ident, $fixture:literal) => {
        #[test]
        fn $name() {
            if let Some(report) = compare($fixture) {
                insta::assert_snapshot!(report);
            }
        }
    };
}

oracle_test!(oracle_minimal, "minimal.org");
oracle_test!(oracle_core, "core.org");
oracle_test!(oracle_headings, "headings.org");
oracle_test!(oracle_lists, "lists.org");
oracle_test!(oracle_blocks, "blocks.org");
oracle_test!(oracle_table, "table.org");
oracle_test!(oracle_footnote, "footnote.org");
oracle_test!(oracle_timestamps, "timestamps.org");
oracle_test!(oracle_images, "images.org");
oracle_test!(oracle_elements, "elements.org");

/// The gate the snapshots cannot be: *every* divergence from Emacs must be one we chose.
///
/// The percentages above are context, not a target — the timestamps fixture agrees on
/// 40% of its lines and is entirely correct, because org writes a date as text where
/// orgo writes `<time datetime>`. What must hold is that nothing diverges for a
/// reason nobody has written down. A new unexplained line means either a defect to fix
/// or a decision to record in `DELIBERATE`.
#[test]
fn every_divergence_from_emacs_is_deliberate() {
    let fixtures = [
        "minimal.org",
        "core.org",
        "headings.org",
        "lists.org",
        "blocks.org",
        "table.org",
        "footnote.org",
        "timestamps.org",
        "images.org",
        "elements.org",
        "tblfm.org",
        "audit-entities.org",
    ];
    let mut offenders = Vec::new();
    for fixture in fixtures {
        let Some(report) = compare(fixture) else {
            return; // no emacs on PATH; the suite skips cleanly
        };
        if !report.contains("unexplained: 0 line(s)") {
            let count = report
                .lines()
                .find(|l| l.starts_with("unexplained:"))
                .unwrap_or("unexplained: ?");
            offenders.push(format!("{fixture}: {count}"));
        }
    }
    assert!(
        offenders.is_empty(),
        "these fixtures diverge from Emacs for unrecorded reasons — fix the defect, or \
         add a rule to DELIBERATE saying why the difference is wanted:\n  {}",
        offenders.join("\n  ")
    );
}

// ---------------------------------------------------------------------------
// Invariants that must hold against the oracle, not merely be snapshotted
// ---------------------------------------------------------------------------

/// org 9.8 writes the heading tag prefix as `&nbsp;&nbsp;&nbsp` — the last reference
/// unterminated. HTML5 decodes the legacy named set without the semicolon, so a browser
/// reads that as three non-breaking spaces; the skeleton has to as well, or a heading
/// carrying tags reads as `A Subheading &nbsptag1 tag2` and the whole report shifts.
/// Asserted here rather than left to the snapshots because it must hold whichever Emacs
/// is installed, including none.
#[test]
fn unterminated_named_references_decode_like_a_browser() {
    assert_eq!(
        decode_entities("A Subheading&nbsp;&nbsp;&nbsptag1&nbsp;tag2"),
        "A Subheading   tag1 tag2"
    );
    assert_eq!(decode_entities("a &amp b"), "a & b");
    assert_eq!(decode_entities("Q&A"), "Q&A");
}

/// How many headings a document has and at what depth is the shape of the document.
/// Getting it wrong reorganizes someone's writing, so it is asserted rather than
/// snapshotted. Heading *decoration* (priority cookies, tag markup) is a policy
/// difference and is left to the snapshots.
#[test]
fn heading_structure_matches_emacs() {
    if !emacs_available() {
        eprintln!("skipping: no emacs on PATH");
        return;
    }
    for fixture in ["minimal.org", "core.org", "headings.org", "lists.org"] {
        let ours = heading_levels(&skeleton(&our_export(fixture)));
        let theirs = heading_levels(&skeleton(&org_export(fixture)));
        assert_eq!(
            ours, theirs,
            "heading structure diverges from Emacs in {fixture}"
        );
    }
}

/// The sequence of heading open tags, e.g. `["<h1>", "<h2>", "<h1>"]`.
fn heading_levels(skeleton: &[String]) -> Vec<String> {
    skeleton
        .iter()
        .filter(|l| l.starts_with("<h") && l[2..].starts_with(|c: char| c.is_ascii_digit()))
        .cloned()
        .collect()
}

/// A list is the construct where nesting is easiest to get subtly wrong, and where being
/// wrong changes the meaning of the document rather than its looks.
#[test]
fn list_nesting_matches_emacs() {
    if !emacs_available() {
        eprintln!("skipping: no emacs on PATH");
        return;
    }
    let ours = list_shape(&skeleton(&our_export("lists.org")));
    let theirs = list_shape(&skeleton(&org_export("lists.org")));
    assert_eq!(ours, theirs, "list nesting diverges from Emacs");
}

/// The sequence of list opens/closes, ignoring content — the shape of the nesting.
fn list_shape(skeleton: &[String]) -> Vec<String> {
    skeleton
        .iter()
        .filter(|l| {
            matches!(
                l.as_str(),
                "<ul>" | "</ul>" | "<ol>" | "</ol>" | "<li>" | "</li>" | "<dl>" | "</dl>"
                    | "<dt>" | "</dt>" | "<dd>" | "</dd>"
            )
        })
        .cloned()
        .collect()
}

/// Code must survive verbatim. Highlighting markup differs by construction (syntect
/// spans vs htmlize), but if the *characters of the program* differ, we have corrupted
/// the author's content.
#[test]
fn source_block_text_matches_emacs() {
    if !emacs_available() {
        eprintln!("skipping: no emacs on PATH");
        return;
    }
    for fixture in ["blocks.org", "core.org", "elements.org"] {
        let ours = code_text(&our_export(fixture));
        let theirs = code_text(&org_export(fixture));
        assert_eq!(ours, theirs, "source block text diverges from Emacs in {fixture}");
    }
}

/// All text inside `<pre>` blocks, with tags stripped and whitespace collapsed.
fn code_text(html: &str) -> Vec<String> {
    let mut out = Vec::new();
    let mut rest = html;
    while let Some(start) = rest.find("<pre") {
        let after = &rest[start..];
        let Some(open_end) = after.find('>') else { break };
        let Some(close) = after.find("</pre>") else { break };
        let inner = &after[open_end + 1..close];
        out.push(strip_tags(inner));
        rest = &after[close + 6..];
    }
    out
}

/// All text in a fragment with tags removed and entities decoded, then whitespace
/// collapsed once at the end.
///
/// [`skeleton`] cannot do this job: it trims each text run individually, which is
/// invisible for prose (one run per paragraph) but destructive for highlighted code,
/// where syntect splits a line into one run per token and the spaces *between* tokens
/// live at the edges of those runs. Trimming each run turns `def greet` into `defgreet`.
fn strip_tags(html: &str) -> String {
    let mut text = String::new();
    let mut rest = html;
    while let Some(open) = rest.find('<') {
        text.push_str(&rest[..open]);
        match rest[open..].find('>') {
            Some(close) => rest = &rest[open + close + 1..],
            None => {
                rest = "";
                break;
            }
        }
    }
    text.push_str(rest);
    decode_entities(&text)
        .split_whitespace()
        .collect::<Vec<_>>()
        .join(" ")
}