//! The custom-pages host, described.
//!
//! <!-- wiki: quasi-overview -->
//!
//! `u.makenot.work` serves a creator's own HTML and CSS with a platform strip
//! around it. Both halves are hard to describe: the creator's markup is opaque,
//! and the stylesheet that goes with it is per request. [`Node::Canvas`] and
//! [`Document::style`] are what say them.
//!
//! # What this host is, and why its shell is its own
//!
//! Read `crate::routes::user_pages` for the isolation rules; they are unchanged
//! by the conversion and they are what shapes the shell here:
//!
//!   - **No script, at all.** The CSP is `default-src 'none'`, so a `<script>`
//!     in the head is a console error rather than a feature.
//!     [`Shell::without_scripts`] is the whole of it. Nothing on these pages
//!     calls a route: every control is a link to the apex.
//!   - **No linked stylesheet.** Not because the CSP forbids it -- `style-src`
//!     allows `'self'` -- but because linking the platform sheet would pull
//!     every platform class into scope on the one surface built for creator
//!     control. [`CHROME_CSS`] arrives
//!     through [`Shell::with_head_first`], the way an embed's design system
//!     does.
//!   - **No chrome and no session.** These are cookieless documents for readers
//!     who are not signed in, so `Chrome::new()` and ordinary axum handlers, as
//!     in [`super::embeds`].
//!
//! # The strip is content here, not `Chrome`
//!
//! A [`quasi_router::Chrome`] is built once and held beside the router, and
//! every link in this strip is per request: the canonical URL and the creator's
//! name change with the page. So the header and footer are regions on the
//! screen, [`RegionKind::Band`] each, which is what a band is -- a full-width
//! strip with a title and an actions cluster.
//!
//! They are siblings of the canvas rather than ancestors, which is the whole of
//! the isolation guarantee and is unchanged: `css_sanitizer` re-emits every
//! creator rule nested inside `.user-canvas#uc-{owner}`, so a creator selector
//! naming anything in the strip is emitted under the canvas and matches
//! nothing. No specificity contest, no layer, no `!important`. See
//! `css_sanitizer::platform_chrome_is_unreachable_from_creator_css`.
//!
//! # Every link out of here is [`Action::leaving`]
//!
//! quasi 0.93.0. These pages are a satellite of the apex and the strip exists
//! to send readers to it, so the links replace the page rather than opening
//! tabs, which is what they did as Askama and what `Destination::External`
//! could not say.
//!
//! # The published class names survive the conversion
//!
//! `site-docs/public/guide/custom-pages.md` tells creators that the buy block
//! is `.mnw-buy`, the file list `.mnw-files` and the item block `.mnw-item`,
//! and gives worked CSS against them. Those are a contract with people outside
//! this codebase, so they are carried on [`Node::Canvas`] scopes -- described
//! content under a name the app has promised, which is the second use that
//! member documents. Every class the strip itself uses is this renderer's and
//! [`CHROME_CSS`] is written against them, because nobody outside was ever
//! promised those.
//!
//! What did change is the markup *inside* those blocks, and it had to: a price
//! is a described node now rather than a hand-written div. The one place that
//! is visible to a creator is the call to action, which was an `<a class=
//! "mnw-buy-cta">` and is now that class on the element around the link. The
//! guide's own example sets `color` on it, and a `color` on an ancestor does
//! not reach an anchor -- the UA sheet beats inheritance -- so [`CHROME_CSS`]
//! says `color: inherit` for a link inside one. Without that line the documented
//! example would quietly stop working.

use quasi_axum::Serves as _;
use quasi_declare::declare;
use quasi_router::screen::Document;
use quasi_router::{Chrome, Screen};
use quasi_webview::{Shell, Webview};

/// The platform strip's styling, and the system slots' defaults.
///
/// Inline rather than linked, and the argument is `crate::routes::user_pages`'s
/// rather than this module's: ~1.3KB against a second request, and a fetch that
/// fails leaves the strip unstyled while the creator's inline CSS still renders.
/// Inline cannot fail that way.
///
/// Written against the classes and ids quasi emits, with two exceptions that
/// are deliberate and are named in the module header: the `mnw-` names are a
/// published contract with creators, and `#chrome-top` / `#chrome-bottom` are
/// region ids this module chose.
const CHROME_CSS: &str = "\
<style>\
html,body{margin:0;padding:0}\
body{font-family:system-ui,-apple-system,\"Segoe UI\",sans-serif}\
#chrome-top,#chrome-bottom{background:#161616;color:#e9e9e9;font-size:.85rem;line-height:1.4}\
#chrome-top{display:flex;justify-content:space-between;align-items:center;gap:1rem;\
padding:.55rem 1rem;border-bottom:1px solid #2c2c2c}\
#chrome-top a,#chrome-bottom a{color:#e9e9e9;text-decoration:none}\
#chrome-top a:hover,#chrome-bottom a:hover{text-decoration:underline}\
#chrome-top a:first-child{font-weight:600;letter-spacing:.01em}\
#chrome-bottom{padding:1rem;text-align:center;border-top:1px solid #2c2c2c;color:#9a9a9a}\
.mnw-buy,.mnw-item{margin:1.5rem 0;padding:1rem;border:1px solid currentColor;border-radius:4px}\
.mnw-buy-cta,.mnw-item-cta{display:inline-block;margin-top:.5rem;padding:.4rem .9rem;\
border:1px solid currentColor;border-radius:4px;font-weight:600}\
.mnw-buy-cta a,.mnw-item-cta a{color:inherit;text-decoration:none}\
.mnw-files ul{margin:0;padding:0;list-style:none}\
.mnw-files{margin:1.5rem 0}\
.mnw-files li{padding:.35rem 0;border-bottom:1px solid currentColor}\
.mnw-price{font-weight:600}\
</style>";

/// One entry in a project's file list.
pub struct File {
    /// What the file is called.
    pub title: String,
    /// Where it is on the apex.
    pub url: String,
}

/// Everything a creator profile draws from.
pub struct UserView {
    /// The document's title.
    pub page_title: String,
    /// The apex, for the brand link.
    pub apex_url: String,
    /// This page's home on the apex.
    pub canonical_url: String,
    /// What to call the creator.
    pub creator_label: String,
    /// The owner id the sanitiser scoped the CSS to.
    pub canvas_id: String,
    /// The creator's stylesheet, sanitised.
    pub sanitized_css: String,
    /// The creator's markup, sanitised.
    pub sanitized_html: String,
}

/// Everything a project page draws from.
pub struct ProjectView {
    /// The profile half, which a project page carries all of.
    pub page: UserView,
    /// What the project costs, as a sentence.
    pub price_label: String,
    /// Where buying happens.
    pub buy_url: String,
    /// The project's published items.
    pub files: Vec<File>,
}

/// Everything an item page draws from.
///
/// No creator markup of any kind: an item page is the trustworthy default
/// layout wearing the parent project's CSS, re-scoped to the item canvas. It
/// takes the head half of the conversion and no part of [`Node::Canvas`]'s
/// markup, which is why it was the one to convert first.
pub struct ItemView {
    /// The document's title.
    pub page_title: String,
    /// The apex, for the brand link.
    pub apex_url: String,
    /// This page's home on the apex.
    pub canonical_url: String,
    /// What to call the creator.
    pub creator_label: String,
    /// The project id the parent's CSS was re-scoped to.
    pub canvas_id: String,
    /// The parent project's stylesheet, re-scoped to the item canvas.
    pub sanitized_css: String,
    /// The item's name.
    pub item_title: String,
    /// What the creator said about it, if anything.
    pub item_description: Option<String>,
    /// What the item costs, as a sentence.
    pub price_label: String,
    /// Where buying happens.
    pub buy_url: String,
}

/// The whole document for one of these screens.
///
/// [`super::embeds::document`]'s shape and for its reasons, with one addition:
/// the screen carries a stylesheet of its own, which the renderer writes last
/// in the head and outside the layer statement. That is what puts the creator's
/// CSS on top of [`CHROME_CSS`] without either of them naming a layer.
#[must_use]
pub fn document(screen: &Screen) -> String {
    let shell = Shell::default()
        .without_scripts()
        .with_chrome(Chrome::new())
        .with_head_first(CHROME_CSS);
    Webview::new().with_shell(shell).screen(screen)
}

/// The class every creator rule was nested inside.
///
/// `css_sanitizer::sanitize_css`'s, not this module's: the class and the id it
/// pairs with are what every creator rule was rewritten under, so a name
/// changed here silently unstyles every custom page. [`UserView::scope_id`] is
/// the other half.
const SCOPE_CLASS: &str = "user-canvas";

impl UserView {
    /// The id half of the scope the sanitiser rewrote every rule for.
    ///
    /// See [`SCOPE_CLASS`]. Two screens draw this element -- a profile and a
    /// project page -- so the name is read from one place rather than written
    /// out at both.
    fn scope_id(&self) -> String {
        format!("uc-{}", self.canvas_id)
    }
}

impl ItemView {
    /// Whether the creator said anything about this item.
    ///
    /// A predicate rather than an `Option` the description reaches into, which
    /// is the call `super::embeds::ItemView::has_cover` records: the form has
    /// no binding pattern.
    fn has_description(&self) -> bool {
        self.item_description.is_some()
    }

    /// What they said, or nothing.
    ///
    /// R9: the paragraph is built whether or not [`Self::has_description`]
    /// places it, so the case that is not drawn is answered rather than
    /// panicked on.
    fn description(&self) -> &str {
        self.item_description.as_deref().unwrap_or_default()
    }
}

declare! {
    /// The platform strip across the top.
    ///
    /// A region on the screen rather than [`quasi_router::Chrome`], because
    /// every link in it is per request: the canonical URL and the creator's
    /// name change with the page. See the module header.
    shape top(apex_url: &str, canonical_url: &str) -> Slot;

    region "chrome-top" as Band {
        link "makenot.work" to leaving apex_url;
        link "View on makenot.work" to leaving canonical_url;
    }
}

declare! {
    /// The platform strip across the bottom.
    shape footer(creator_label: &str, canonical_url: &str) -> Slot;

    region "chrome-bottom" as Band {
        link "{creator_label} on makenot.work" to leaving canonical_url;
    }
}

declare! {
    /// A creator's profile.
    ///
    /// The strips are siblings of the canvas rather than ancestors, which is
    /// the whole of the isolation guarantee: a creator selector naming anything
    /// in a strip is emitted under the canvas and matches nothing.
    #[must_use]
    pub shape user(view: &UserView) -> Screen;

    screen single &view.page_title {
        documented Document::default().styled(&view.sanitized_css);

        include top(&view.apex_url, &view.canonical_url);
        region "canvas" as Pane {
            canvas &view.sanitized_html {
                classed SCOPE_CLASS;
                identified view.scope_id();
            }
        }
        include footer(&view.creator_label, &view.canonical_url);
    }
}

declare! {
    /// A creator's project page: their markup, then the platform's own blocks
    /// inside the same scope.
    #[must_use]
    pub shape project(view: &ProjectView) -> Screen;

    screen single &view.page.page_title {
        documented Document::default().styled(&view.page.sanitized_css);

        include top(&view.page.apex_url, &view.page.canonical_url);
        region "canvas" as Pane {
            canvas &view.page.sanitized_html {
                classed SCOPE_CLASS;
                identified view.page.scope_id();

                // Inside the canvas and after the markup, which is what the
                // Askama template did and is what lets a creator's sheet reach
                // these blocks at all. Outside would be a different page,
                // quietly.
                include slot_block("mnw-buy", "mnw-buy-cta", &view.price_label, &view.buy_url);
                canvas "" unless view.files.is_empty() {
                    classed "mnw-files";
                    list {
                        for file in view.files.iter() {
                            row &file.title {
                                activate to leaving &file.url;
                            }
                        }
                    }
                }
            }
        }
        include footer(&view.page.creator_label, &view.page.canonical_url);
    }
}

declare! {
    /// An item page, which is the default layout in the parent project's
    /// clothes.
    ///
    /// `item-canvas` and `ic-` are what `sanitize_item_css` scopes to. The two
    /// names travel together and neither is this module's to choose.
    #[must_use]
    pub shape item(view: &ItemView) -> Screen;

    screen single &view.page_title {
        documented Document::default().styled(&view.sanitized_css);

        include top(&view.apex_url, &view.canonical_url);
        region "canvas" as Pane {
            canvas "" {
                classed "item-canvas";
                identified "ic-{view.canvas_id}";

                canvas "" {
                    classed "mnw-item";
                    page &view.item_title;
                    text view.description() when view.has_description();
                    include price(&view.price_label);
                    include cta("mnw-item-cta", &view.buy_url);
                }
            }
        }
        include footer(&view.creator_label, &view.canonical_url);
    }
}

declare! {
    /// A system slot: a price and the way to buy, under a published class name.
    shape slot_block(
        block_class: &str,
        cta_class: &str,
        price_label: &str,
        buy_url: &str,
    ) -> Node;

    canvas "" {
        classed block_class;
        include price(price_label);
        include cta(cta_class, buy_url);
    }
}

declare! {
    /// What it costs, under the class the guide names.
    shape price(label: &str) -> Node;

    canvas "" {
        classed "mnw-price";
        text label;
    }
}

declare! {
    /// The way to buy, under the class the guide names.
    shape cta(class: &str, buy_url: &str) -> Node;

    canvas "" {
        classed class;
        link "Get on makenot.work" to leaving buy_url;
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    /// Everything from the open `<body>` tag on.
    ///
    /// Every assertion about what is *drawn* uses this rather than the whole
    /// document, because `CHROME_CSS` names `.mnw-files` and `.mnw-price` in
    /// the head: a search over the document finds the rule and concludes the
    /// block is on the page.
    fn body(html: &str) -> &str {
        &html[html.find("<body").expect("a document has a body")..]
    }

    fn a_user() -> UserView {
        UserView {
            page_title: "Ada - makenot.work".into(),
            apex_url: "https://makenot.work".into(),
            canonical_url: "https://makenot.work/u/ada".into(),
            creator_label: "Ada".into(),
            canvas_id: "11111111".into(),
            sanitized_css: ".user-canvas#uc-11111111 p{color:red}".into(),
            sanitized_html: "<h1>Ada</h1>".into(),
        }
    }

    #[test]
    fn the_canvas_carries_the_scope_the_sanitiser_rewrote_every_rule_for() {
        // `css_sanitizer` nests every creator rule inside
        // `.user-canvas#uc-{owner}`. If the element stops carrying both halves,
        // every custom page silently loses its styling, so this is the
        // load-bearing assertion in the module.
        let html = document(&user(&a_user()));

        assert!(
            html.contains("<div class=\"user-canvas\" id=\"uc-11111111\"><h1>Ada</h1></div>"),
            "{html}"
        );
    }

    #[test]
    fn the_creators_stylesheet_is_in_the_head_after_the_platforms() {
        // Both are inline and neither is layered, so the later one wins. The
        // creator's is the screen's own and the renderer writes it last.
        let html = document(&user(&a_user()));
        let chrome = html.find("#chrome-top").expect("the strip is styled");
        let creator = html
            .find(".user-canvas#uc-11111111 p{color:red}")
            .expect("the creator's sheet is written");
        let head_end = html.find("</head>").expect("the head closes");

        assert!(chrome < creator, "{html}");
        assert!(creator < head_end, "{html}");
    }

    #[test]
    fn the_strip_is_a_sibling_of_the_canvas_and_not_an_ancestor() {
        // The whole isolation guarantee. A creator selector naming anything in
        // the strip is emitted under the canvas and matches nothing, which only
        // holds while the strip is outside it.
        let html = document(&user(&a_user()));
        let body = body(&html);
        let top = body.find("id=\"chrome-top\"").expect("the top strip");
        let canvas = body.find("class=\"user-canvas\"").expect("the canvas");
        let bottom = body.find("id=\"chrome-bottom\"").expect("the bottom strip");

        assert!(top < canvas && canvas < bottom, "{body}");
        // Not nested: the canvas region closes before the footer opens.
        assert!(!body[canvas..bottom].contains("id=\"chrome-"), "{body}");
    }

    #[test]
    fn no_script_reaches_a_page_whose_csp_forbids_every_one() {
        // `default-src 'none'`. A script element here is a console error.
        let html = document(&user(&a_user()));

        assert!(!html.contains("<script"), "{html}");
        assert!(!html.contains("<link"), "{html}");
    }

    #[test]
    fn every_way_off_this_page_replaces_it_rather_than_opening_a_tab() {
        // These pages are a satellite of the apex and the strip exists to send
        // readers to it. This is what the Askama version did.
        let html = document(&user(&a_user()));

        assert!(!html.contains("target=\"_blank\""), "{html}");
        assert!(html.contains("href=\"https://makenot.work\""), "{html}");
    }

    #[test]
    fn the_published_system_slot_names_survive_the_conversion() {
        // `site-docs/public/guide/custom-pages.md` names these to creators and
        // gives worked CSS against them, so they are a contract with people
        // outside this codebase rather than class names this module picked.
        let view = ProjectView {
            page: a_user(),
            price_label: "$12".into(),
            buy_url: "https://makenot.work/p/thing".into(),
            files: vec![File {
                title: "one.wav".into(),
                url: "https://makenot.work/i/1".into(),
            }],
        };
        let html = document(&project(&view));

        assert!(html.contains("class=\"mnw-buy\""), "{html}");
        assert!(html.contains("class=\"mnw-buy-cta\""), "{html}");
        assert!(html.contains("class=\"mnw-price\""), "{html}");
        assert!(html.contains("class=\"mnw-files\""), "{html}");
    }

    #[test]
    fn the_platform_blocks_sit_inside_the_creators_scope_after_their_markup() {
        // What the Askama template did, and what lets a creator's sheet reach
        // the buy block at all. Outside would be a different page, quietly.
        let view = ProjectView {
            page: a_user(),
            price_label: "$12".into(),
            buy_url: "https://makenot.work/p/thing".into(),
            files: Vec::new(),
        };
        let html = document(&project(&view));
        let canvas = html
            .find("class=\"user-canvas\"")
            .expect("the canvas opens");
        let markup = html.find("<h1>Ada</h1>").expect("the creator's markup");
        let buy = html.find("class=\"mnw-buy\"").expect("the buy block");

        assert!(canvas < markup && markup < buy, "{html}");
    }

    #[test]
    fn a_project_with_no_published_items_draws_no_file_list() {
        // The template guarded on `items.is_empty()`, and an empty bordered box
        // is worse than no box.
        let view = ProjectView {
            page: a_user(),
            price_label: "Free".into(),
            buy_url: "https://makenot.work/p/thing".into(),
            files: Vec::new(),
        };

        assert!(!body(&document(&project(&view))).contains("mnw-files"));
    }

    #[test]
    fn an_item_page_wears_the_parents_stylesheet_under_the_item_canvas() {
        // `sanitize_item_css` scopes to `.item-canvas#ic-{project}`, so the two
        // names travel together and neither is this module's to choose. An item
        // page has no creator markup of its own.
        let html = document(&item(&ItemView {
            page_title: "Track - makenot.work".into(),
            apex_url: "https://makenot.work".into(),
            canonical_url: "https://makenot.work/i/9".into(),
            creator_label: "Ada".into(),
            canvas_id: "22222222".into(),
            sanitized_css: ".item-canvas#ic-22222222 p{color:red}".into(),
            item_title: "Track".into(),
            item_description: Some("A track.".into()),
            price_label: "$3".into(),
            buy_url: "https://makenot.work/i/9".into(),
        }));

        assert!(
            html.contains("<div class=\"item-canvas\" id=\"ic-22222222\">"),
            "{html}"
        );
        assert!(html.contains("class=\"mnw-item\""), "{html}");
        assert!(html.contains("class=\"mnw-item-cta\""), "{html}");
        assert!(!html.contains("user-canvas"), "{html}");
    }

    #[test]
    fn an_item_with_no_description_draws_none() {
        let html = document(&item(&ItemView {
            page_title: "Track - makenot.work".into(),
            apex_url: "https://makenot.work".into(),
            canonical_url: "https://makenot.work/i/9".into(),
            creator_label: "Ada".into(),
            canvas_id: "22222222".into(),
            sanitized_css: String::new(),
            item_title: "Track".into(),
            item_description: None,
            price_label: "$3".into(),
            buy_url: "https://makenot.work/i/9".into(),
        }));

        // The heading, the price and the call to action, and nothing between
        // the first two.
        let drawn = body(&html);
        let heading = drawn.find("<h1").expect("the item is named");
        let price = drawn.find("mnw-price").expect("the price is drawn");
        assert!(!drawn[heading..price].contains("class=\"text\""), "{drawn}");
    }

    #[test]
    fn a_locked_creator_gets_the_strip_and_an_empty_canvas() {
        // The route passes empty strings for a locked owner, and the page still
        // has to be a page.
        let mut view = a_user();
        view.sanitized_html = String::new();
        view.sanitized_css = String::new();
        let html = document(&user(&view));

        assert!(
            html.contains("<div class=\"user-canvas\" id=\"uc-11111111\">"),
            "{html}"
        );
        assert!(html.contains("id=\"chrome-top\""), "{html}");
        assert!(html.contains("id=\"chrome-bottom\""), "{html}");
    }
}