/**
 * Source lints for the silent ClojureScript traps this suite has actually been
 * bitten by. Ported from chat's test/source-hygiene.test.mjs (the canon copy;
 * rooms-kit and game6 carry their own) and retargeted at src/ardegazu/social.
 *
 * WHY THIS FILE EXISTS HERE AT ALL. social-kit had NO source lint until the
 * idiomatic rewrite of the common core. Its sources are on two classpaths —
 * its own build and peer-kit's (`node_modules/ardegazu-social-kit/src` is on
 * peer-kit/deps.edn's :paths) — and nine apps plus the bot fleet run the
 * result, so it is the widest-blast-radius tree in the suite with the thinnest
 * static gate. "When code moves, its gates do not follow": nothing was ever
 * scanning these 3,658 lines for the class of defect that took two apps down.
 *
 * The five checks, in the order they were learned:
 *
 * 1. A local binding named after a core MACRO shadows it inside its own body,
 *    with no warning at any optimization level. odeon's audio.cljs took the
 *    TypeScript's `when` (an AudioContext time) as a parameter name and every
 *    `(when …)` in that function became `when.call(null, …)`. Green build,
 *    green vectors, every drum voice threw at runtime.
 *
 * 2. A `defn`/`def` whose NAME is a core VAR shadows it for the whole
 *    namespace (valley-blocks' `hud.cljs` defined `reset!`). shadow emits a
 *    :redef warning; the build does not fail on warnings.
 *
 * 3./4. The paren-depth pair. chat v24 and board v12 shipped `do-replay` with
 *    an inner `.then` body closed one paren short. The trailing links were
 *    indented perfectly but sat one level deeper, so they became ARGUMENTS to
 *    the `.then` above them — `(.catch (fn …))` with nothing threaded in
 *    compiles to a method call on a function literal, which throws the instant
 *    it runs. Nothing caught it: the layout read correctly, shadow compiles it
 *    without a murmur, and neither black-box suite drove the path. Two
 *    independent detectors, because the defect leaves two traces and a given
 *    instance may leave only one — the LAYOUT trace (a sibling dedented below
 *    the one above it) and the CONSEQUENCE trace (an interop call with a `fn`
 *    literal in target position, which is never valid at any indentation).
 *
 * 5. The 8-pair cliff, which this repo was live on. `#js {}` AND the `js-obj`
 *    MACRO both route their key/value pairs through `(into {})`: at eight
 *    pairs that is a PersistentArrayMap and insertion order survives, at nine
 *    it is a PersistentHashMap and the emitted object literal is in HASH
 *    order, at every optimization level, with no warning. Measured in the
 *    shipped 2.1.0 dist, friends.cljs's 10-pair records emitted as
 *    `{xs,addedTs,petTs,x,name,lastApp,pub,pet,state,lastSeenTs}` — nothing
 *    like the source. Harmless there (those objects are re-parsed and
 *    re-sanitized by every reader, and every signature is over canon(), which
 *    sorts) but it is a trap standing next to the wire, so the construct is
 *    capped at eight pairs and anything wider goes through j/obj, which sets
 *    keys with sequential unchecked-set calls regardless of width.
 *
 * Every lint below ships with an executable non-vacuity probe that feeds it
 * the exact shape that motivated it and asserts the exact hit count.
 */

import test from "node:test";
import assert from "node:assert/strict";
import { readdirSync, readFileSync, statSync } from "node:fs";
import { join } from "node:path";
import { readForms, strip, sym, COLLS } from "./helpers/cljs-reader.mjs";

const SRC = new URL("../src/ardegazu/social", import.meta.url).pathname;

const MACROS = new Set([
  "when", "when-not", "when-let", "when-some", "when-first",
  "if", "if-let", "if-some", "if-not", "cond", "condp", "case",
  "let", "loop", "recur", "for", "doseq", "dotimes", "do", "and", "or", "while",
  "try", "binding", "lazy-seq", "doto", "this-as", "declare", "fn", "defn",
  "->", "->>", "some->", "some->>", "as->", "set!", "new", "var",
  "time", "assert", "comment",
]);

const walk = (dir) =>
  readdirSync(dir).flatMap((n) => {
    const p = join(dir, n);
    return statSync(p).isDirectory() ? walk(p) : p.endsWith(".cljs") ? [p] : [];
  });

const files = () => walk(SRC);

test("the lints actually reach this repo's sources", () => {
  // The gate that fails when the tree moves out from under the scanner: an
  // empty file list makes every deepEqual([], []) below pass vacuously.
  const fs = files();
  assert.ok(fs.length >= 15, `only ${fs.length} .cljs files found under ${SRC}`);
  for (const n of ["friends.cljs", "presence.cljs", "app_boot.cljs", "envelope.cljs",
                   "pair.cljs", "canon.cljs", "selfsync.cljs"]) {
    assert.ok(fs.some((f) => f.endsWith(`/${n}`)), `${n} is not being scanned`);
  }
});

/** The balanced [...] that follows `from`, or null. */
function bracketAfter(src, from) {
  const open = src.indexOf("[", from);
  if (open < 0) return null;
  let depth = 0;
  for (let i = open; i < src.length; i++) {
    if (src[i] === "[") depth++;
    else if (src[i] === "]" && --depth === 0) return src.slice(open + 1, i);
  }
  return null;
}

const TOKEN = /[A-Za-z*!?<>=+/_-][A-Za-z0-9*!?<>=+./'_-]*/g;

/** Top-level forms of a binding vector, metadata dropped. */
function forms(body) {
  const out = [];
  let depth = 0;
  let cur = "";
  for (const ch of body) {
    if ("([{".includes(ch)) depth++;
    if (")]}".includes(ch)) depth--;
    if (depth === 0 && /\s/.test(ch)) {
      if (cur) out.push(cur);
      cur = "";
    } else cur += ch;
  }
  if (cur) out.push(cur);
  return out.filter((f) => f && !f.startsWith("^"));
}

/**
 * The one pre-existing occurrence in this tree, found by this lint on its very
 * first run and left in place deliberately.
 *
 * `(defn- check [cond what] (when-not cond …))` in selftest.cljs shadows the
 * `cond` MACRO for that function's body. It is benign — `check`'s body never
 * uses `cond` in operator position, only as a value — but it is exactly the
 * shape that was fatal in odeon, one edit away from becoming so, and the file
 * it lives in (`selftest.cljs`) is compiled into the `:selftest` module only.
 *
 * It is recorded rather than fixed because selftest.cljs is outside the scope
 * of the commit that added this file, and the entry is asserted EXACTLY: a
 * second occurrence fails, and so does fixing this one without updating the
 * list. Neither direction can drift silently.
 */
const KNOWN_PARAM_SHADOWS = ["selftest.cljs:15 param `cond`"];

test("no defn/fn parameter is named after a core macro", () => {
  const hits = [];
  for (const file of files()) {
    const src = strip(readFileSync(file, "utf8"));
    for (const re of [/\(defn-?\s+[^\s[]+/g, /\(fn\s+(?:[^\s[]+\s+)?(?=\[)/g]) {
      for (const m of src.matchAll(re)) {
        const body = bracketAfter(src, m.index + m[0].length);
        if (body === null) continue;
        for (const t of body.match(TOKEN) ?? []) {
          if (MACROS.has(t)) {
            hits.push(`${file.slice(SRC.length + 1)}:${src.slice(0, m.index).split("\n").length} param \`${t}\``);
          }
        }
      }
    }
  }
  assert.deepEqual(hits, KNOWN_PARAM_SHADOWS, `a parameter shadows a macro:\n${hits.join("\n")}`);
});

/**
 * Every form in this tree whose head is a binding vector. The list is a LIST,
 * not a rule, so it has to be extended whenever a new binding macro arrives —
 * and the trap is that nothing announces the omission: an unlisted form is not
 * an error, it is silence. The regex is anchored on `(` immediately before the
 * head, so `\(let\s` does NOT match `(p/let ` — in chat, the moment the boot
 * path stopped being a js-await ladder the shadowing lint stopped covering
 * sixteen bindings in the one file where "it compiles, the tests pass, and the
 * app does not start" had actually happened.
 *
 * `await` (ardegazu.social.macros) is this repo's own sequential-promise
 * binding form — a macro that expands to nested shadow.cljs.modern/js-await,
 * so it is a binding vector the moment it is read. It went on this list in the
 * same commit that introduced it. `p/*` are promesa's and are inert here (this
 * repo deliberately has no promesa on its classpath — see macros.clj); they
 * are listed so that adding the dependency cannot silently un-cover a file.
 */
const BINDING_FORMS = [
  "let", "loop", "doseq", "dotimes", "if-let", "when-let", "if-some", "when-some",
  "js-await", "await",
  "p/let", "p/plet", "p/loop", "p/doseq",
];

const bindingNames = (src, kind) => {
  const out = [];
  for (const m of src.matchAll(new RegExp(`\\(${kind}\\s`, "g"))) {
    const body = bracketAfter(src, m.index + m[0].length);
    if (body === null) continue;
    for (const nm of forms(body).filter((_, i) => i % 2 === 0)) {
      out.push({ nm, line: src.slice(0, m.index).split("\n").length });
    }
  }
  return out;
};

test("no let/loop/doseq/await binding is named after a core macro", () => {
  const hits = [];
  for (const file of files()) {
    const src = strip(readFileSync(file, "utf8"));
    for (const kind of BINDING_FORMS) {
      for (const { nm, line } of bindingNames(src, kind)) {
        if (MACROS.has(nm)) hits.push(`${file}:${line} ${kind} binding \`${nm}\``);
      }
    }
  }
  assert.deepEqual(hits, [], `a binding shadows a macro:\n${hits.join("\n")}`);
});

test("the binding lint reaches this repo's own `await` macro", () => {
  // The regression this guards is not a shadowed name — it is a lint that
  // quietly stopped looking. `(await [when …] …)` must be seen exactly as
  // `(let [when …] …)` is, and `(let …)`'s own pattern must NOT be what sees it.
  const sample = strip("(defn- f [] (await [when (g)] (when true 1)))");
  const seen = (kind) => bindingNames(sample, kind).map((b) => b.nm).filter((nm) => MACROS.has(nm));
  assert.deepEqual(seen("await"), ["when"], "the await pattern must see the binding");
  assert.deepEqual(seen("let"), [], "the bare `let` pattern must NOT match `(await `");
  assert.ok(BINDING_FORMS.includes("await"), "…so await has to be on the list");
});

test("the shadowing lint would have caught the bug that motivated it", () => {
  // the exact shape odeon's audio.cljs shipped for one build
  const sample = strip(`(defn- play-noise [when dur filt g0 tc]
  (let [c @AC]
    (when (nil? @NOISE) (vreset! NOISE (noise-buf c)))))`);
  const m = [...sample.matchAll(/\(defn-?\s+[^\s[]+/g)][0];
  const body = bracketAfter(sample, m.index + m[0].length);
  assert.equal((body.match(TOKEN) ?? []).filter((t) => MACROS.has(t)).length, 1);
});

/** Core VARS (not macros) — a `defn`/`def` with one of these names shadows it
 *  for the entire namespace. Kept separate from MACROS above because the
 *  detection site is different: the def NAME, not a binding. Every one of
 *  `name`, `key`, `count`, `type`, `list`, `get` and `merge` is a natural name
 *  in this domain (petnames, channel keys, friend lists, envelope types). */
const CORE_VARS = new Set([
  "name", "type", "count", "key", "val", "keys", "vals", "first", "rest", "next", "last", "second",
  "list", "map", "set", "get", "str", "seq", "meta", "range", "filter", "remove", "find", "sort",
  "merge", "conj", "assoc", "dissoc", "into", "reduce", "apply", "concat", "reverse", "repeat",
  "max", "min", "int", "long", "float", "double", "char", "boolean", "symbol", "keyword",
  "reset!", "swap!", "deref", "atom", "delay", "force", "identity", "compare", "hash", "empty",
  "print", "println", "pr", "prn", "format", "read", "eval", "load", "test", "some", "every?",
  "replace", "partition", "group-by", "flatten", "take", "drop", "shuffle", "rand", "rand-int",
  "array", "aget", "aset", "clone", "update", "peek", "pop", "push",
  // The predicate family, added after `(defn- object? …)` shadowed
  // cljs.core/object? for the whole of envelope.cljs during the idiomatic
  // rewrite. shadow DID warn (:redef) and `npm run check` still exited 0,
  // which is why scripts/compile-check.mjs now promotes that warning to a
  // failure — this list is the edit-time half of the same guard, and it
  // matters because cljs.core/object? does NOT mean "is a JS object" (it is
  // `(identical? (type x) js/Object)`, false for anything with a prototype).
  "object?", "array?", "string?", "number?", "boolean?", "fn?", "ifn?", "nil?",
  "some?", "seq?", "coll?", "map?", "vector?", "keyword?", "symbol?", "set?",
  "int?", "integer?", "float?", "even?", "odd?", "pos?", "neg?", "zero?",
  "true?", "false?", "contains?", "distinct?", "empty?", "every?", "not-any?",
]);

const DEF_RE = /\((?:defn-?|def|defonce)\s+(?:\^[^\s]+\s+)*([^\s()[\]{}]+)/g;

test("no defn/def shadows a core var", () => {
  const hits = [];
  for (const file of files()) {
    const src = strip(readFileSync(file, "utf8"));
    for (const m of src.matchAll(DEF_RE)) {
      const nm = m[1];
      if (CORE_VARS.has(nm) || MACROS.has(nm)) {
        hits.push(`${file}:${src.slice(0, m.index).split("\n").length} def \`${nm}\``);
      }
    }
  }
  assert.deepEqual(hits, [], `a def shadows a core var:\n${hits.join("\n")}`);
});

test("the core-var lint would have caught the bug that motivated it", () => {
  // the exact shape valley-blocks' hud.cljs shipped for one build
  const sample = strip(`(defn- reset! []\n  (set! (.-textContent el) ""))`);
  const m = [...sample.matchAll(DEF_RE)][0];
  assert.equal(m[1], "reset!");
  assert.ok(CORE_VARS.has(m[1]));
});

// ---- the paren-depth pair ----------------------------------------------------

/** Every form's line-leading children, for the layout check. */
function dedents(file, src) {
  const hits = [];
  const lines = src.split("\n");
  for (const nd of readForms(src)) {
    if (!COLLS.has(nd.type)) continue;
    const kids = (nd.children ?? []).filter((k) => k.leading);
    for (const k of kids.slice(1)) {
      if (k.col < kids[0].col) {
        hits.push(`${file}:${k.line} sits at column ${k.col}, its sibling at ${kids[0].line} at column ` +
                  `${kids[0].col} — ${(lines[k.line - 1] ?? "").trim().slice(0, 72)}`);
      }
    }
  }
  return hits;
}

test("no sibling is dedented below the one above it — layout must agree with depth", () => {
  const hits = files().flatMap((f) => dedents(f, readFileSync(f, "utf8")));
  assert.deepEqual(hits, [], `indentation and paren depth disagree:\n${hits.join("\n")}`);
});

test("the indentation lint would have caught the bug that motivated it", () => {
  // do-replay as chat v24 shipped it, reduced: the inner `.then` body is one
  // paren short, so the two trailing links became arguments to it and dedented.
  const sample = [
    '(defn- do-replay [self]',
    '  (-> (js/Promise.resolve nil)',
    '      (.then',
    '       (fn [_]',
    '         (page 0))',
    '      (.catch (fn [err] nil))',
    '      (.then (fn [_] nil)))))',
  ].join("\n");
  // one hit per dedented sibling: both trailing links moved
  assert.equal(dedents("sample", sample).length, 2);
  // and the same code with the paren where it belongs is silent
  const fixed = [
    '(defn- do-replay [self]',
    '  (-> (js/Promise.resolve nil)',
    '      (.then',
    '       (fn [_]',
    '         (page 0)))',
    '      (.catch (fn [err] nil))',
    '      (.then (fn [_] nil))))',
  ].join("\n");
  assert.equal(dedents("sample", fixed).length, 0);
});

/** Forms that supply the interop target implicitly, and the child index from
 *  which they do it — `(-> x (.f))`, `(as-> x y (.f y))`, `(doto x (.f))`. */
const THREADS = { "->": 1, "->>": 1, "some->": 1, "some->>": 1, "cond->": 1, "cond->>": 1,
                  "doto": 1, "as->": 3, "..": 2 };
const FN_LITERAL = new Set(["fn", "fn*", "defn", "defn-"]);

/** `(.m (fn …))` / `(.-f (fn …))` outside a threading form: always fatal. */
function interopOnFn(file, src) {
  const hits = [];
  const lines = src.split("\n");
  for (const nd of readForms(src)) {
    const h = sym(nd);
    if (!h || !h.startsWith(".") || h === "." || h === "..") continue;
    const outer = nd.parent ? sym(nd.parent) : null;
    const from = outer !== null && outer in THREADS ? THREADS[outer] : null;
    if (from !== null && nd.parent.children.indexOf(nd) >= from) continue;   // target is threaded in
    const target = nd.children?.[1];
    if (!target) continue;
    if (target.type === "fn-literal" || FN_LITERAL.has(sym(target))) {
      hits.push(`${file}:${nd.line} \`${h}\` is called on a function literal — ` +
                `${(lines[nd.line - 1] ?? "").trim().slice(0, 72)}`);
    }
  }
  return hits;
}

test("no interop call has a function literal in target position", () => {
  const hits = files().flatMap((f) => interopOnFn(f, readFileSync(f, "utf8")));
  assert.deepEqual(hits, [], `a method is called on a function, which throws:\n${hits.join("\n")}`);
});

test("the interop lint would have caught the bug that motivated it", () => {
  // the second instance of the same defect in chat: the page loop's closing
  // paren landed one form early, so `0` became a body form of `page` and
  // `(.then (fn …))` became `page`'s argument.
  const sample = [
    '(-> ((fn page [n]',
    '       (if (>= n 200) nil (page (inc n)))',
    '     0)',
    '    (.then (fn [_] nil))))',
  ].join("\n");
  assert.equal(interopOnFn("sample", sample).length, 1);
  // threaded, the identical text is correct — and must stay silent
  const fixed = [
    '(-> ((fn page [n]',
    '       (if (>= n 200) nil (page (inc n))))',
    '     0)',
    '    (.then (fn [_] nil)))',
  ].join("\n");
  assert.equal(interopOnFn("sample", fixed).length, 0);
});

// ---- the 8-pair cliff --------------------------------------------------------

/**
 * `#js {…}` and the `js-obj` MACRO both build their pair list with `(into {})`.
 * Eight pairs is a PersistentArrayMap, whose seq is insertion order; nine is a
 * PersistentHashMap, whose seq is hash order — and the emitted object literal
 * follows it, at every optimization level, silently.
 *
 * This is not theoretical here. Measured in the shipped 2.1.0 dist, before this
 * lint existed:
 *
 *   {xs:g.xs,addedTs:oa(b.ts),petTs:0,x:g.x,name:g.name,lastApp:"",
 *    pub:c,pet:"",state:"in",lastSeenTs:0}
 *
 * for a source that reads pub,x,xs,pet,name,state,addedTs,petTs,lastSeenTs,
 * lastApp. Nothing broke — every reader of those records re-parses and
 * re-sanitizes them, and every signature in this kit is over canon(), which
 * sorts — but a construct that silently reorders keys does not belong next to a
 * wire, so anything above eight pairs goes through ardegazu.social.macros/obj,
 * which emits sequential unchecked-set calls and holds order at any width.
 */
const MAX_LITERAL_PAIRS = 8;

function wideLiterals(file, src) {
  const hits = [];
  for (const nd of readForms(src)) {
    let pairs = null;
    let what = null;
    if (sym(nd) === "js-obj") {
      pairs = (nd.children.length - 1) / 2;
      what = "(js-obj …)";
    } else if (nd.type === "map" && src.slice(nd.start, nd.start + 3) === "#js") {
      pairs = nd.children.length / 2;
      what = "#js {…}";
    }
    if (pairs !== null && pairs > MAX_LITERAL_PAIRS) {
      hits.push(`${file}:${nd.line} ${what} with ${pairs} pairs — key order is HASH order here`);
    }
  }
  return hits;
}

/**
 * The two occurrences left standing, both outside the common core this lint
 * arrived with, both asserted EXACTLY so a third cannot appear unnoticed:
 *
 *  - `text.cljs` is the EN string table. It is a lookup map with 28 entries; it
 *    is never serialized, and gen-text-dts.mjs sorts the keys it extracts, so
 *    there is no order to lose.
 *  - `selftest.cljs` builds a fixture friend record for the dev-only selftest
 *    module, which feeds it straight back into sanitizeFriend.
 *
 * Both are inert for the same reason the shipped friends.cljs records were, but
 * "inert" is a property of today's callers, not of the construct.
 */
const KNOWN_WIDE_LITERALS = [
  "selftest.cljs:126 (js-obj …) with 10 pairs — key order is HASH order here",
  "text.cljs:15 (js-obj …) with 28 pairs — key order is HASH order here",
];

test("no #js {} or js-obj literal wider than eight pairs — use macros/obj", () => {
  const hits = files().flatMap((f) => wideLiterals(f.slice(SRC.length + 1), readFileSync(f, "utf8")));
  assert.deepEqual(hits, KNOWN_WIDE_LITERALS, `key order silently becomes hash order:\n${hits.join("\n")}`);
});

test("the 8-pair lint would have caught what this repo actually shipped", () => {
  // friends.cljs's `base` record as 2.1.0 wrote it — ten pairs.
  const ten = '(js-obj "pub" p "x" x "xs" xs "pet" "" "name" n "state" "in" ' +
              '"addedTs" t "petTs" 0 "lastSeenTs" 0 "lastApp" "")';
  assert.equal(wideLiterals("sample", ten).length, 1);
  // eight is the last safe width and must stay silent
  const eight = '(js-obj "a" 1 "b" 2 "c" 3 "d" 4 "e" 5 "f" 6 "g" 7 "h" 8)';
  assert.equal(wideLiterals("sample", eight).length, 0);
  // nine is not
  const nine = '(js-obj "a" 1 "b" 2 "c" 3 "d" 4 "e" 5 "f" 6 "g" 7 "h" 8 "i" 9)';
  assert.equal(wideLiterals("sample", nine).length, 1);
  // and the same width through #js {} is the same defect
  const wideJs = '#js {:a 1 :b 2 :c 3 :d 4 :e 5 :f 6 :g 7 :h 8 :i 9}';
  assert.equal(wideLiterals("sample", wideJs).length, 1);
});

// ---- HTML sinks --------------------------------------------------------------

/**
 * Every assignment to innerHTML/outerHTML/insertAdjacentHTML in the tree,
 * pinned EXACTLY. All three surviving sites are static string literals with no
 * interpolation, so none of them is a vulnerability today — the point is that
 * "no interpolation" is a property of the current line, not of the construct,
 * and the sheet in app_boot renders friend-supplied names one element away
 * from where its markup used to be parsed.
 *
 * app_boot.cljs is at ZERO after the idiomatic rewrite (its two row/chip
 * templates became element construction, with textContent the only way text
 * enters the DOM there). This assertion is what keeps it there, and what makes
 * adding a fourth site a deliberate act rather than an edit.
 */
const HTML_SINKS = ["-innerHTML", "-outerHTML", "insertAdjacentHTML"];

const sinkSites = () => {
  const hits = [];
  for (const file of files()) {
    const src = strip(readFileSync(file, "utf8"));
    for (const sink of HTML_SINKS) {
      let from = 0;
      for (;;) {
        const at = src.indexOf(sink, from);
        if (at < 0) break;
        hits.push(`${file.slice(SRC.length + 1)}:${src.slice(0, at).split("\n").length} ${sink}`);
        from = at + sink.length;
      }
    }
  }
  return hits.sort();
};

test("the HTML sinks in this tree are exactly the ones on record", () => {
  assert.deepEqual(sinkSites(), [
    "join.cljs:50 -innerHTML",
    "join.cljs:58 -innerHTML",
    "notify.cljs:46 -innerHTML",
  ]);
});

test("the sink lint is not vacuous", () => {
  // it must count occurrences, not merely notice the word exists
  assert.ok(sinkSites().length === 3, `found ${sinkSites().length}`);
  assert.ok(HTML_SINKS.every((s) => typeof s === "string" && s.length > 5));
});