use docs_core::{fragment_html, fragment_json, fragment_text};
use yrs::updates::decoder::Decode;
use yrs::{Doc, Options, Transact, Update, Xml, XmlFragment};

fn doc_from(bytes: &[u8]) -> Doc {
    let doc = Doc::with_options(Options::with_guid_and_client_id("fixture".into(), 1));
    let update = Update::decode_v1(bytes).expect("decode fixture");
    doc.transact_mut()
        .apply_update(update)
        .expect("apply fixture");
    doc
}

#[test]
fn reads_paragraphs_as_blocks() {
    let doc = doc_from(include_bytes!("../../fixtures/vectors/fragment/simple.bin"));
    assert_eq!(fragment_text(&doc), "First paragraph.\n\nSecond paragraph.");
}

#[test]
fn renders_paragraphs_as_html() {
    let doc = doc_from(include_bytes!("../../fixtures/vectors/fragment/simple.bin"));
    assert_eq!(
        fragment_html(&doc),
        "<p>First paragraph.</p><p>Second paragraph.</p>"
    );
}

#[test]
fn renders_marks() {
    let doc = doc_from(include_bytes!("../../fixtures/vectors/fragment/marks.bin"));
    let html = fragment_html(&doc);
    assert!(html.contains("<strong>bold</strong>"), "got {html}");
    assert!(html.contains("<em>italic</em>"), "got {html}");
}

#[test]
fn renders_headings_and_lists() {
    let doc = doc_from(include_bytes!("../../fixtures/vectors/fragment/nested.bin"));
    let html = fragment_html(&doc);
    assert_eq!(
        html,
        "<h2>A heading</h2><ul><li><p>One</p></li><li><p>Two</p></li></ul>"
    );
}

// The read view puts this straight into a page. A document whose text
// contains markup must not be able to inject it.
#[test]
fn escapes_html_in_text() {
    let doc = Doc::with_options(Options::with_guid_and_client_id("esc".into(), 1));
    {
        let f = doc.get_or_insert_xml_fragment("prosemirror");
        let mut txn = doc.transact_mut();
        let p = f.push_back(&mut txn, yrs::XmlElementPrelim::empty("paragraph"));
        p.push_back(
            &mut txn,
            yrs::XmlTextPrelim::new("<script>alert(1)</script>"),
        );
    }
    let html = fragment_html(&doc);
    assert!(!html.contains("<script>"), "unescaped script tag: {html}");
    assert!(html.contains("&lt;script&gt;"), "not escaped: {html}");
}

// An empty document is an empty canvas, not an error (show.html's own
// comment says so).
#[test]
fn empty_document_is_empty_output() {
    let doc = Doc::with_options(Options::with_guid_and_client_id("empty".into(), 1));
    assert_eq!(fragment_text(&doc), "");
    assert_eq!(fragment_html(&doc), "");
}

// An unknown node name must not vanish silently and must not panic —
// a future editor version can introduce nodes this build has never
// seen, and dropping their text would be data loss in the read view.
#[test]
fn unknown_nodes_keep_their_text() {
    let doc = Doc::with_options(Options::with_guid_and_client_id("unk".into(), 1));
    {
        let f = doc.get_or_insert_xml_fragment("prosemirror");
        let mut txn = doc.transact_mut();
        let n = f.push_back(&mut txn, yrs::XmlElementPrelim::empty("call_to_action"));
        n.push_back(&mut txn, yrs::XmlTextPrelim::new("keep me"));
    }
    assert!(fragment_text(&doc).contains("keep me"));
    assert!(fragment_html(&doc).contains("keep me"));
}

// Task 1's parked finding (a): a text node siblinged directly ahead of
// a block, with no block of its own — unreachable through
// ProseMirror's own schema, but reachable the moment a client posts
// arbitrary Yjs bytes (Task 5's POST /d/{sqid}/updates). Used to merge
// into the following block's text with no separator ("orphanactual").
#[test]
fn text_sibling_before_a_block_is_separated() {
    let doc = Doc::with_options(Options::with_guid_and_client_id("orphan".into(), 1));
    {
        let f = doc.get_or_insert_xml_fragment("prosemirror");
        let mut txn = doc.transact_mut();
        f.push_back(&mut txn, yrs::XmlTextPrelim::new("orphan"));
        let p = f.push_back(&mut txn, yrs::XmlElementPrelim::empty("paragraph"));
        p.push_back(&mut txn, yrs::XmlTextPrelim::new("actual"));
    }
    assert_eq!(fragment_text(&doc), "orphan\n\nactual");
}

// Task 1's parked finding (b): fragment_html preserves an empty
// `<p></p>` but fragment_text used to drop the block entirely — an
// asymmetry no test covered until now. A structurally empty block
// keeps a blank line in the text rendering, the same way it keeps an
// empty tag pair in the HTML rendering.
#[test]
fn empty_block_is_preserved_like_html() {
    let doc = Doc::with_options(Options::with_guid_and_client_id("emptyp".into(), 1));
    {
        let f = doc.get_or_insert_xml_fragment("prosemirror");
        let mut txn = doc.transact_mut();
        let p1 = f.push_back(&mut txn, yrs::XmlElementPrelim::empty("paragraph"));
        p1.push_back(&mut txn, yrs::XmlTextPrelim::new("First"));
        f.push_back(&mut txn, yrs::XmlElementPrelim::empty("paragraph"));
        let p3 = f.push_back(&mut txn, yrs::XmlElementPrelim::empty("paragraph"));
        p3.push_back(&mut txn, yrs::XmlTextPrelim::new("Second"));
    }
    assert_eq!(fragment_html(&doc), "<p>First</p><p></p><p>Second</p>");
    assert_eq!(fragment_text(&doc), "First\n\n\n\nSecond");
}

// A block nested inside another block (a paragraph inside a
// list_item, ProseMirror's real shape for a list) must not gain a
// spurious empty segment from the outer block once its inner text has
// already been flushed — the regression the naive "always push on
// is_block" fix for finding (b) would have introduced.
#[test]
fn nested_blocks_do_not_duplicate_their_text() {
    let doc = Doc::with_options(Options::with_guid_and_client_id("nest".into(), 1));
    {
        let f = doc.get_or_insert_xml_fragment("prosemirror");
        let mut txn = doc.transact_mut();
        let li = f.push_back(&mut txn, yrs::XmlElementPrelim::empty("list_item"));
        let p = li.push_back(&mut txn, yrs::XmlElementPrelim::empty("paragraph"));
        p.push_back(&mut txn, yrs::XmlTextPrelim::new("x"));
    }
    assert_eq!(fragment_text(&doc), "x");
}

// --- the font and size marks, and the structured renderer ---

// The class names below are the contract between this renderer and
// views/show.html's stylesheet, and between it and internal/pdf's
// mark handling. They are constants in this binary, never bytes from a
// document — see the MARKS table's own comment.
#[test]
fn renders_font_and_size_marks_as_classed_spans() {
    let doc = doc_from(include_bytes!("../../fixtures/vectors/fragment/styled.bin"));
    assert_eq!(
        fragment_html(&doc),
        concat!(
            "<p>",
            "<span class=\"docs-font-sans\">sans</span>",
            "<span class=\"docs-font-mono\"> mono</span>",
            "<span class=\"docs-size-lg\"> large</span>",
            "<span class=\"docs-font-sans\"><strong> both</strong></span>",
            "</p>",
            "<blockquote><p>Quoted.</p></blockquote>",
            "<ol><li><p>First</p></li><li><p>Second</p></li></ol>",
        )
    );
}

// Every face has a class, and the unmarked run has none.
//
// fonts.bin, not styled.bin: serif could not be said at all until
// font_serif existed, so the older fixture has no run in it. The
// unmarked run at the front is the half that is easy to leave untested
// — whatever the default face is, a run nobody marked must come out as
// bare text with no span at all, because that is what makes a document
// written before any of this existed render as the default rather than
// as whatever the default USED to be.
#[test]
fn renders_every_font_mark_as_a_classed_span() {
    let doc = doc_from(include_bytes!("../../fixtures/vectors/fragment/fonts.bin"));
    assert_eq!(
        fragment_html(&doc),
        concat!(
            "<p>",
            "Unmarked",
            "<span class=\"docs-font-serif\"> serif</span>",
            "<span class=\"docs-font-sans\"> sans</span>",
            "<span class=\"docs-font-mono\"> mono</span>",
            "</p>",
        )
    );
}

// And the structured renderer names the same three marks. An unknown
// mark reaches fragment_json anyway (mark_names carries it through in
// the sorted tail, see its comment), so this test would pass on the
// JSON alone while the read view above silently dropped the span —
// which is exactly why the HTML assertion is the one above and not a
// second look at the same output.
#[test]
fn json_names_every_font_mark() {
    let doc = doc_from(include_bytes!("../../fixtures/vectors/fragment/fonts.bin"));
    assert_eq!(
        fragment_json(&doc),
        concat!(
            "{\"type\":\"doc\",\"content\":[",
            "{\"type\":\"paragraph\",\"content\":[",
            "{\"type\":\"text\",\"text\":\"Unmarked\"},",
            "{\"type\":\"text\",\"text\":\" serif\",\"marks\":[{\"type\":\"font_serif\"}]},",
            "{\"type\":\"text\",\"text\":\" sans\",\"marks\":[{\"type\":\"font_sans\"}]},",
            "{\"type\":\"text\",\"text\":\" mono\",\"marks\":[{\"type\":\"font_mono\"}]}]}]}",
        )
    );
}

#[test]
fn renders_the_document_as_prosemirror_json() {
    let doc = doc_from(include_bytes!("../../fixtures/vectors/fragment/nested.bin"));
    assert_eq!(
        fragment_json(&doc),
        concat!(
            "{\"type\":\"doc\",\"content\":[",
            "{\"type\":\"heading\",\"attrs\":{\"level\":2},\"content\":[",
            "{\"type\":\"text\",\"text\":\"A heading\"}]},",
            "{\"type\":\"bullet_list\",\"content\":[",
            "{\"type\":\"list_item\",\"content\":[{\"type\":\"paragraph\",\"content\":[",
            "{\"type\":\"text\",\"text\":\"One\"}]}]},",
            "{\"type\":\"list_item\",\"content\":[{\"type\":\"paragraph\",\"content\":[",
            "{\"type\":\"text\",\"text\":\"Two\"}]}]}]}]}",
        )
    );
}

// Marks come out in MARKS order, not in whatever order the CRDT's own
// attribute map happens to iterate — see mark_names. A run carrying two
// of them is what actually exercises that.
#[test]
fn json_marks_are_in_a_fixed_order() {
    let doc = doc_from(include_bytes!("../../fixtures/vectors/fragment/styled.bin"));
    let json = fragment_json(&doc);
    assert!(
        json.contains(concat!(
            "{\"type\":\"text\",\"text\":\" both\",\"marks\":[",
            "{\"type\":\"font_sans\"},{\"type\":\"strong\"}]}",
        )),
        "got {json}"
    );
}

// Same document, rendered twice in one process: identical bytes. A
// HashMap-ordered mark list would pass this only by luck, which is why
// the run above carries two marks.
#[test]
fn json_is_deterministic() {
    let doc = doc_from(include_bytes!("../../fixtures/vectors/fragment/styled.bin"));
    assert_eq!(fragment_json(&doc), fragment_json(&doc));
}

// The JSON goes into an HTTP response body and, from there, into a Go
// json.Unmarshal. A document whose text contains quotes, backslashes or
// control characters must not be able to break out of its string.
#[test]
fn escapes_json_in_text() {
    let doc = Doc::with_options(Options::with_guid_and_client_id("jesc".into(), 1));
    {
        let f = doc.get_or_insert_xml_fragment("prosemirror");
        let mut txn = doc.transact_mut();
        let p = f.push_back(&mut txn, yrs::XmlElementPrelim::empty("paragraph"));
        p.push_back(
            &mut txn,
            yrs::XmlTextPrelim::new("a \"quote\" and a \\ and a \u{1}"),
        );
    }
    assert_eq!(
        fragment_json(&doc),
        concat!(
            "{\"type\":\"doc\",\"content\":[{\"type\":\"paragraph\",\"content\":[",
            "{\"type\":\"text\",\"text\":\"a \\\"quote\\\" and a \\\\ and a \\u0001\"}]}]}",
        )
    );
}

// The module's rule — unknown nodes render their children rather than
// disappearing — holds for the structured renderer too, with the node
// itself reported under its own name so a consumer that grows to
// understand it can. A newer editor build introducing a node this
// binary has never heard of must not lose its text on export.
#[test]
fn json_keeps_unknown_nodes_and_their_children() {
    let doc = Doc::with_options(Options::with_guid_and_client_id("junk".into(), 1));
    {
        let f = doc.get_or_insert_xml_fragment("prosemirror");
        let mut txn = doc.transact_mut();
        let outer = f.push_back(&mut txn, yrs::XmlElementPrelim::empty("table"));
        let p = outer.push_back(&mut txn, yrs::XmlElementPrelim::empty("paragraph"));
        p.push_back(&mut txn, yrs::XmlTextPrelim::new("kept"));
    }
    assert_eq!(
        fragment_json(&doc),
        concat!(
            "{\"type\":\"doc\",\"content\":[{\"type\":\"table\",\"content\":[",
            "{\"type\":\"paragraph\",\"content\":[{\"type\":\"text\",\"text\":\"kept\"}]}]}]}",
        )
    );
}

// A heading level is clamped identically by both renderers. A document
// that reads as an h6 on screen must not export as an h99 — the two
// clamps are written separately, so this is the test that keeps them
// equal.
#[test]
fn json_clamps_heading_level_like_html() {
    let doc = Doc::with_options(Options::with_guid_and_client_id("hclamp".into(), 1));
    {
        let f = doc.get_or_insert_xml_fragment("prosemirror");
        let mut txn = doc.transact_mut();
        let h = f.push_back(&mut txn, yrs::XmlElementPrelim::empty("heading"));
        h.insert_attribute(&mut txn, "level", "99");
        h.push_back(&mut txn, yrs::XmlTextPrelim::new("Shouty"));
    }
    assert!(fragment_html(&doc).starts_with("<h6>"), "html clamp");
    assert!(
        fragment_json(&doc).contains("\"attrs\":{\"level\":6}"),
        "json clamp: {}",
        fragment_json(&doc)
    );
}

// An empty document is still a document: `{"type":"doc","content":[]}`,
// never the empty string. internal/core's json read relies on that —
// see abi.rs's json_string.
#[test]
fn json_of_an_empty_document_is_an_empty_doc_node() {
    let doc = Doc::with_options(Options::with_guid_and_client_id("empty".into(), 1));
    assert_eq!(fragment_json(&doc), "{\"type\":\"doc\",\"content\":[]}");
}

// --- hard_break ---
//
// Shift+Enter's node. It is prosemirror-schema-basic's own
// `hard_break`, and the name is not a choice this file gets to make:
// y-prosemirror builds `Y.XmlElement(node.type.name)` for every
// non-text node, so the tag in the CRDT is whatever the editor's
// schema calls the node. All three renderers have to know it or a
// break is silently dropped — the read view would run two lines
// together as one, and both exporters would too.
#[test]
fn renders_a_hard_break_in_every_renderer() {
    let doc = Doc::with_options(Options::with_guid_and_client_id("brk".into(), 1));
    {
        let f = doc.get_or_insert_xml_fragment("prosemirror");
        let mut txn = doc.transact_mut();
        let p = f.push_back(&mut txn, yrs::XmlElementPrelim::empty("paragraph"));
        p.push_back(&mut txn, yrs::XmlTextPrelim::new("first"));
        p.push_back(&mut txn, yrs::XmlElementPrelim::empty("hard_break"));
        p.push_back(&mut txn, yrs::XmlTextPrelim::new("second"));
    }
    // A void element: `<br>` opens and never closes, so nothing may be
    // emitted after it.
    assert_eq!(fragment_html(&doc), "<p>first<br>second</p>");
    // One newline, not two: the break ends the line and the paragraph
    // continues, where a paragraph boundary is a blank line.
    assert_eq!(fragment_text(&doc), "first\nsecond");
    // A leaf in the structured renderer, reported under its own name
    // so the exporters can see it at all.
    assert_eq!(
        fragment_json(&doc),
        concat!(
            "{\"type\":\"doc\",\"content\":[{\"type\":\"paragraph\",\"content\":[",
            "{\"type\":\"text\",\"text\":\"first\"},",
            "{\"type\":\"hard_break\",\"content\":[]},",
            "{\"type\":\"text\",\"text\":\"second\"}]}]}",
        )
    );
}

// A break is not a block: it ends a line inside its own paragraph and
// nothing else. Two paragraphs either side of one must stay two
// paragraphs — a blank line apart in the text rendering — rather than
// the break's own newline being mistaken for a block boundary.
#[test]
fn a_hard_break_does_not_split_the_block_it_is_in() {
    let doc = Doc::with_options(Options::with_guid_and_client_id("brk2".into(), 1));
    {
        let f = doc.get_or_insert_xml_fragment("prosemirror");
        let mut txn = doc.transact_mut();
        let p1 = f.push_back(&mut txn, yrs::XmlElementPrelim::empty("paragraph"));
        p1.push_back(&mut txn, yrs::XmlTextPrelim::new("one"));
        p1.push_back(&mut txn, yrs::XmlElementPrelim::empty("hard_break"));
        p1.push_back(&mut txn, yrs::XmlTextPrelim::new("two"));
        let p2 = f.push_back(&mut txn, yrs::XmlElementPrelim::empty("paragraph"));
        p2.push_back(&mut txn, yrs::XmlTextPrelim::new("three"));
    }
    assert_eq!(fragment_text(&doc), "one\ntwo\n\nthree");
}

// --- paragraph alignment ---
//
// The first block-level formatting. Unlike a mark it belongs to the
// block and so lives in a real Yjs XML attribute, which is the whole
// reason these tests are worth their length: MARKS can be a closed set
// because a mark's presence IS its meaning, whereas an attribute
// arrives carrying a value, and POST /d/{sqid}/updates accepts any Yjs
// bytes a client cares to send. So the value never reaches the output
// — it is only ever looked up in an allowlist whose right-hand side is
// a literal in this binary.

#[test]
fn renders_paragraph_alignment_as_a_class() {
    let doc = doc_from(include_bytes!(
        "../../fixtures/vectors/fragment/aligned.bin"
    ));
    assert_eq!(
        fragment_html(&doc),
        concat!(
            "<p>Left by default.</p>",
            "<p class=\"docs-align-center\">Centred.</p>",
            "<p class=\"docs-align-right\">Right.</p>",
            // "left" said out loud is still the default, and the
            // default spends no class — the same decision the MARKS
            // table's own comment makes for serif and "normal", for the
            // same reason: it would put an attribute on most of the
            // blocks in most documents.
            "<p>Left, said out loud.</p>",
        )
    );
}

// The exporters cannot see the CRDT, only this JSON — so alignment has
// to be reported here or a centred paragraph exports flush left. It is
// reported ONLY for the two alignments that are not the default, for
// the same reason the HTML emits no class for left: an `attrs` object
// on every paragraph would change the output for every document that
// has never been aligned.
#[test]
fn json_reports_paragraph_alignment() {
    let doc = doc_from(include_bytes!(
        "../../fixtures/vectors/fragment/aligned.bin"
    ));
    assert_eq!(
        fragment_json(&doc),
        concat!(
            "{\"type\":\"doc\",\"content\":[",
            "{\"type\":\"paragraph\",\"content\":[",
            "{\"type\":\"text\",\"text\":\"Left by default.\"}]},",
            "{\"type\":\"paragraph\",\"attrs\":{\"align\":\"center\"},\"content\":[",
            "{\"type\":\"text\",\"text\":\"Centred.\"}]},",
            "{\"type\":\"paragraph\",\"attrs\":{\"align\":\"right\"},\"content\":[",
            "{\"type\":\"text\",\"text\":\"Right.\"}]},",
            "{\"type\":\"paragraph\",\"content\":[",
            "{\"type\":\"text\",\"text\":\"Left, said out loud.\"}]}]}",
        )
    );
}

// The one that matters. fragment_html's output is written into the page
// UNESCAPED (internal/docs/store.go's template.HTML), which is safe
// only while no byte of a document reaches attribute position. An
// alignment this build does not know — a typo, a future version's
// `justify`, or the hand-crafted value below — is dropped whole. Never
// escaped and emitted, never passed through, never interpolated: the
// allowlist's right-hand side is the only thing that can appear.
#[test]
fn an_unknown_alignment_is_dropped_from_every_renderer() {
    let hostile = "left\" onmouseover=\"alert(1)\" data-x=\"<script>";
    let doc = Doc::with_options(Options::with_guid_and_client_id("align".into(), 1));
    {
        let f = doc.get_or_insert_xml_fragment("prosemirror");
        let mut txn = doc.transact_mut();
        let p = f.push_back(&mut txn, yrs::XmlElementPrelim::empty("paragraph"));
        p.insert_attribute(&mut txn, "align", hostile);
        p.push_back(&mut txn, yrs::XmlTextPrelim::new("Words."));
        let q = f.push_back(&mut txn, yrs::XmlElementPrelim::empty("paragraph"));
        q.insert_attribute(&mut txn, "align", "justify");
        q.push_back(&mut txn, yrs::XmlTextPrelim::new("Later."));
    }

    // The words survive. Dropping an alignment must never drop the
    // text — the module comment's rule, and the whole reason unknown
    // nodes render their children.
    let html = fragment_html(&doc);
    assert_eq!(html, "<p>Words.</p><p>Later.</p>");

    // Said again as a search rather than as a comparison, because the
    // comparison above would still pass if the value leaked into some
    // other renderer, and because this is the assertion that actually
    // names the defect: no fragment of the attacker's string may appear
    // anywhere in the output.
    for fragment in [hostile, "onmouseover", "alert(1)", "<script", "justify"] {
        assert!(
            !html.contains(fragment),
            "{fragment:?} reached the read view's HTML: {html}"
        );
    }
    let json = fragment_json(&doc);
    for fragment in ["onmouseover", "alert(1)", "script", "justify", "attrs"] {
        assert!(
            !json.contains(fragment),
            "{fragment:?} reached the structured renderer: {json}"
        );
    }
    // And the plain-text rendering is untouched by any of it.
    assert_eq!(fragment_text(&doc), "Words.\n\nLater.");
}

// Alignment is opt-in, and this is what says so in bytes rather than in
// prose: fixtures written before alignment existed render exactly the
// markup and exactly the JSON they rendered before, to the byte. The
// failure it guards is the plausible one — emitting an `attrs` object
// or a `class` on every paragraph — which changes nothing a reader can
// see, changes every document's output, and which the aligned fixture
// above would not notice at all.
#[test]
fn a_document_with_no_alignment_renders_exactly_as_it_did_before() {
    let simple = doc_from(include_bytes!("../../fixtures/vectors/fragment/simple.bin"));
    assert_eq!(
        fragment_html(&simple),
        "<p>First paragraph.</p><p>Second paragraph.</p>"
    );
    assert_eq!(
        fragment_json(&simple),
        concat!(
            "{\"type\":\"doc\",\"content\":[",
            "{\"type\":\"paragraph\",\"content\":[{\"type\":\"text\",\"text\":\"First paragraph.\"}]},",
            "{\"type\":\"paragraph\",\"content\":[{\"type\":\"text\",\"text\":\"Second paragraph.\"}]}]}",
        )
    );

    let styled = doc_from(include_bytes!("../../fixtures/vectors/fragment/styled.bin"));
    assert_eq!(
        fragment_json(&styled),
        concat!(
            "{\"type\":\"doc\",\"content\":[",
            "{\"type\":\"paragraph\",\"content\":[",
            "{\"type\":\"text\",\"text\":\"sans\",\"marks\":[{\"type\":\"font_sans\"}]},",
            "{\"type\":\"text\",\"text\":\" mono\",\"marks\":[{\"type\":\"font_mono\"}]},",
            "{\"type\":\"text\",\"text\":\" large\",\"marks\":[{\"type\":\"size_lg\"}]},",
            "{\"type\":\"text\",\"text\":\" both\",\"marks\":[{\"type\":\"font_sans\"},{\"type\":\"strong\"}]}]},",
            "{\"type\":\"blockquote\",\"content\":[{\"type\":\"paragraph\",\"content\":[",
            "{\"type\":\"text\",\"text\":\"Quoted.\"}]}]},",
            "{\"type\":\"ordered_list\",\"content\":[",
            "{\"type\":\"list_item\",\"content\":[{\"type\":\"paragraph\",\"content\":[",
            "{\"type\":\"text\",\"text\":\"First\"}]}]},",
            "{\"type\":\"list_item\",\"content\":[{\"type\":\"paragraph\",\"content\":[",
            "{\"type\":\"text\",\"text\":\"Second\"}]}]}]}]}",
        )
    );
}

// Indent is the second block attribute, and the first whose value is a
// NUMBER. Alignment's is a string, so the only safe handling is a table
// lookup that emits the table's own right-hand side; a number is parsed
// and clamped instead, which is a different mechanism with a different
// set of ways to be wrong.
//
// The three paragraphs at the end are where that difference lives. No
// editor produces them; POST /d/{sqid}/updates accepts raw Yjs bytes
// from any client, so all three are reachable, and fragment_html's
// output is written into the page unescaped. A build that interpolated
// the attribute into a class name rather than a clamped integer would
// satisfy every assertion about the first four paragraphs and fail
// these.
#[test]
fn renders_block_indent_as_a_class() {
    let doc = doc_from(include_bytes!(
        "../../fixtures/vectors/fragment/indented.bin"
    ));
    assert_eq!(
        fragment_html(&doc),
        concat!(
            // No attribute at all: byte-identical to a document written
            // before indent existed, and spends no class.
            "<p>Flush left, no attribute.</p>",
            "<p class=\"docs-indent-1\">One step.</p>",
            "<p class=\"docs-indent-8\">The deepest step.</p>",
            // Headings indent and do not align — a real asymmetry in the
            // schema, pinned here so a renderer cannot quietly drop one
            // of the two.
            "<h2 class=\"docs-indent-2\">An indented heading.</h2>",
            // Both attributes on one paragraph, alignment first, exactly
            // one space between them.
            "<p class=\"docs-align-center docs-indent-3\">Centred and indented.</p>",
            // Clamped, not emitted: never docs-indent-99.
            "<p class=\"docs-indent-8\">Past the maximum; clamps.</p>",
            // Zero is the same answer as no attribute.
            "<p>Zero is no indent.</p>",
            // Does not parse as a number, so it renders flush left. The
            // value never reaches attribute position, which is the
            // property the whole module exists to hold.
            "<p>Not a number at all.</p>",
            // The four JavaScript's Number() accepts and this once did
            // not. "400" overflowed a u8 and rendered flush left while
            // the editor rendered it at 8; the other three are values
            // Number() coerces and a digits-only rule rejects. Both
            // sides now apply the same two rules, so these pin the
            // AGREEMENT rather than the clamp.
            "<p class=\"docs-indent-8\">Too large for a u8; still clamps.</p>",
            "<p>Leading space is not a number.</p>",
            "<p>Nor is a decimal point.</p>",
            "<p>Nor is hex.</p>",
        )
    );
}

// The exporters cannot see the CRDT, only this JSON, so indent has to
// survive the crossing — and this is also where the attrs object itself
// is pinned.
//
// That object used to be written by two independent arms, one for a
// heading's level and one for a paragraph's alignment, each emitting a
// complete "attrs":{…}. It was correct only while no node could carry
// two attributes. An indented heading carries level AND indent, and an
// indented centred paragraph carries align AND indent, so the old shape
// would have emitted "attrs" twice in one object — which every JSON
// parser accepts, none agrees on, and nothing would have reported.
#[test]
fn reports_block_indent_to_the_exporters() {
    let doc = doc_from(include_bytes!(
        "../../fixtures/vectors/fragment/indented.bin"
    ));
    let json = fragment_json(&doc);

    // One attrs key per node, never two — the regression the single
    // collected object exists to prevent.
    for node in json.split("{\"type\":\"").skip(1) {
        assert!(
            node.matches("\"attrs\":").count() <= 1,
            "a node emitted more than one attrs object: {node}"
        );
    }

    assert!(json.contains("{\"type\":\"paragraph\",\"attrs\":{\"indent\":1},"));
    assert!(json.contains("{\"type\":\"paragraph\",\"attrs\":{\"indent\":8},"));
    // Level and indent together, level first.
    assert!(json.contains("{\"type\":\"heading\",\"attrs\":{\"level\":2,\"indent\":2},"));
    // Align and indent together, align first.
    assert!(json.contains("{\"type\":\"paragraph\",\"attrs\":{\"align\":\"center\",\"indent\":3},"));
    // Clamped, zero dropped, unparseable dropped — the same three cases
    // the HTML test pins, checked again here because the two renderers
    // read the attribute independently and a document must not indent
    // one distance on screen and another on paper.
    assert!(json.contains("\"text\":\"Past the maximum; clamps.\""));
    assert!(json.contains("{\"type\":\"paragraph\",\"attrs\":{\"indent\":8},\"content\":[{\"type\":\"text\",\"text\":\"Past the maximum; clamps.\"}]}"));
    assert!(json.contains("{\"type\":\"paragraph\",\"content\":[{\"type\":\"text\",\"text\":\"Zero is no indent.\"}]}"));
    assert!(json.contains("{\"type\":\"paragraph\",\"content\":[{\"type\":\"text\",\"text\":\"Not a number at all.\"}]}"));
}

// The point ladder, and the four-step scale it replaced.
//
// Both halves matter and they matter for different reasons. The ladder
// is what the editor writes today; a mark missing from MARKS renders as
// nothing for a reader with no JavaScript, which is this module's own
// "silence here is data loss". The legacy marks are what the editor
// STOPPED writing, and they have to go on being understood forever —
// documents in the wild carry them, and dropping one would silently
// strip the size out of every document using it.
#[test]
fn renders_the_point_ladder_and_the_scale_it_replaced() {
    let doc = doc_from(include_bytes!("../../fixtures/vectors/fragment/sizes.bin"));
    let html = fragment_html(&doc);

    // 12pt is the default and carries no mark, so "Body" is bare text
    // with no span at all — the same rule that keeps the default face
    // and "normal" out of MARKS.
    assert!(
        html.contains("<p>Body"),
        "the default size spent a span: {html}"
    );

    assert!(html.contains("<span class=\"docs-size-8\"> eight</span>"));
    assert!(html.contains("<span class=\"docs-size-14\"> fourteen</span>"));
    assert!(html.contains("<span class=\"docs-size-72\"> seventy-two</span>"));

    assert!(html.contains("<span class=\"docs-size-sm\">Small</span>"));
    assert!(html.contains("<span class=\"docs-size-lg\"> Large</span>"));
    assert!(html.contains("<span class=\"docs-size-xl\"> Extra</span>"));

    // A run carrying a ladder mark and a legacy one at once: impossible
    // through the editor's schema, reachable through
    // POST /d/{sqid}/updates. It renders both spans nested in MARKS
    // order rather than dropping either — the module never suppresses
    // text — and internal/export/pdf.go resolves the same run to one
    // size by consulting sizeOrder, ladder first. Neither is wrong; they
    // answer different questions, and both are stable.
    // The nesting, not merely the text. This asserted only that the
    // words survived, while its own comment claimed to pin the order —
    // an assertion that could not fail against the thing it named.
    // MARKS lists the ladder before the legacy names, and spans are
    // pushed in table order and closed reversed, so size_24 is the
    // outer span and size_lg the inner one.
    assert!(
        html.contains(
            "<span class=\"docs-size-24\"><span class=\"docs-size-lg\">Both at once</span></span>"
        ),
        "the two size spans did not nest in MARKS order: {html}"
    );
}