defmodule VavPipeline.SourceExternalTest do
  @moduledoc """
  Item 6 of vehaya §6 — keep the source external.

  TORAH ANCHORS:

  Devarim 4:2 — לֹא תֹסִפוּ עַל־הַדָּבָר אֲשֶׁר אָנֹכִי מְצַוֶּה אֶתְכֶם
  וְלֹא תִגְרְעוּ מִמֶּנּוּ. The injunction is bidirectional:
  do not add, do not subtract. Both directions are addressed to
  the keeper.

  Vayikra 22:31 — וּשְׁמַרְתֶּם מִצְוֺתַי וַעֲשִׂיתֶם אֹתָם.
  KEEP my mitzvot and DO them. Two verbs (shmor, asoh) — guarding
  and performing. Both are received-acts. Neither is an
  authoring-act.

  THE ARCHITECTURAL COMMITMENT:

  The system READS L1 (the Torah scroll); it does NOT write to L1.
  The Form 1 commit (b136c75) closed the EXTERNAL → INTERNAL
  direction (no module installs external models in YHVH's slot).
  This test closes the INTERNAL → SOURCE direction (no module
  modifies the source itself). Together: the source is external
  AND inviolable from the system side.

  L1 is the only canonical reference to the Torah text. If the
  system could write to it, the system would be authoring its own
  source — the same shape as Form 1 but inverted (the system in
  the source's seat instead of the source-substitute in the
  system's seat). Both are forbidden by Devarim 4:35 (ein od
  milvado — there is no other source position).

  ENFORCEMENT: any source file that contains File.write, File.cp,
  File.rm, File.rename, File.touch, or File.mkdir with an L1 path
  fails this test.

  The L1 mount path is configurable (`@l1_mount_point` in
  L1Reader); operators can mount L1 read-only at the filesystem
  layer, but this test defends against in-code attempts to
  modify even when the filesystem permits it.
  """

  use ExUnit.Case, async: true

  @vav_pipeline_lib "lib/vav_pipeline"
  @korban_processor "../korban_processor/src"
  @azazel_processor "../azazel_processor/src"

  # Files that legitimately mention L1-write patterns:
  # - L1Reader's docstring describes the read-only invariant
  #   (mentions "no writes" for documentation; not an actual write)
  # - This test file (which mentions File.write etc. in its docstring)
  @write_to_l1_exclusions [
    "lib/vav_pipeline/l1_reader.ex",
    "lib/vav_pipeline/doorpost.ex"
  ]

  defp source_files do
    Path.wildcard("#{@vav_pipeline_lib}/**/*.ex")
    |> Enum.reject(fn path -> path in @write_to_l1_exclusions end)
  end

  # Patterns that would write to L1: any File.* mutation function
  # called with a path that includes "/l1/" or starts with the
  # configured mount point. We grep for the function names + a path
  # that suggests L1; precise enough to catch accidents and false-
  # positive on legitimate writes to other paths is unlikely because
  # most file-mutation calls are explicit about their target.
  @l1_write_patterns [
    ~r/File\.write[!]?\s*\([^)]*l1\//,
    ~r/File\.cp[!]?\s*\([^)]*l1\//,
    ~r/File\.cp_r[!]?\s*\([^)]*l1\//,
    ~r/File\.rm[!]?\s*\([^)]*l1\//,
    ~r/File\.rm_rf[!]?\s*\([^)]*l1\//,
    ~r/File\.rename[!]?\s*\([^)]*l1\//,
    ~r/File\.touch[!]?\s*\([^)]*l1\//,
    ~r/File\.mkdir[!]?\s*\([^)]*l1\//,
    ~r/File\.mkdir_p[!]?\s*\([^)]*l1\//,
    ~r/File\.open\s*\([^)]*l1\/.*\[[^\]]*:write/
  ]

  test "no Elixir module writes to the L1 mount" do
    offenders =
      for path <- source_files(),
          text = File.read!(path),
          pattern <- @l1_write_patterns,
          match = Regex.scan(pattern, text),
          match != [] do
        {path, inspect(pattern)}
      end

    assert offenders == [], (
      "L1 write detected in: #{inspect(offenders)}. The source is " <>
        "external and inviolable (Devarim 4:2 lo tosif/lo tigra; " <>
        "Vayikra 22:31 u'shmartem … va'asitem — keep and do, do not " <>
        "author). L1 is read-only by architectural commitment. Mount " <>
        "permissions defend at the filesystem layer; this CI invariant " <>
        "defends in code so future contributors cannot bypass."
    )
  end

  test "no Python module in korban_processor writes to L1" do
    py_paths =
      Path.wildcard("#{@korban_processor}/**/*.py")
      |> Enum.reject(fn p -> String.contains?(p, "/test") end)

    py_l1_write_patterns = [
      ~r/open\s*\([^)]*l1\/[^)]*['"]w/,
      ~r/Path\([^)]*l1\/[^)]*\)\.write/,
      ~r/shutil\.(copy|move|rmtree)\s*\([^)]*l1\//,
      ~r/os\.(remove|rename|mkdir)\s*\([^)]*l1\//
    ]

    offenders =
      for path <- py_paths,
          text = File.read!(path),
          pattern <- py_l1_write_patterns,
          match = Regex.scan(pattern, text),
          match != [] do
        {path, inspect(pattern)}
      end

    assert offenders == []
  end

  test "no Python module in azazel_processor writes to L1" do
    py_paths =
      Path.wildcard("#{@azazel_processor}/**/*.py")
      |> Enum.reject(fn p -> String.contains?(p, "/test") end)

    offenders =
      for path <- py_paths,
          text = File.read!(path),
          String.contains?(text, "l1/") and
            (String.contains?(text, "open(") and String.contains?(text, "'w'")) do
        path
      end

    assert offenders == []
  end

  test "no Prolog module asserts into L1 facts" do
    pl_paths =
      Path.wildcard("../talmudic_engine/src/**/*.pl")

    # Prolog can't easily write to a filesystem; the relevant
    # bypass shape is asserta/assertz to L1-shape predicates.
    # The L1-shape predicates (verse/5, mitzvah/4, etc.) live in
    # specification/ and are loaded as facts; assertions FROM
    # outside specification/ that would mutate them is the
    # architectural breach.
    offenders =
      for path <- pl_paths,
          not String.contains?(path, "/specification/"),
          not String.contains?(path, "/test/"),
          text = File.read!(path),
          Regex.match?(~r/assert[az]\s*\(\s*verse\s*\(/, text) or
            Regex.match?(~r/assert[az]\s*\(\s*mitzvah\s*\(/, text) do
        path
      end

    assert offenders == []
  end
end