#!/usr/bin/env bash
set -euo pipefail

root_dir=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
source "$root_dir/scripts/fossil-env.sh"
fixture_dir="$root_dir/tests/fixtures/org"
output_dir=$(mktemp -d -t copland-org-renderer.XXXXXX)

for fixture in all security; do
  "$FOSSIL" test-org-render "$fixture_dir/$fixture.org" >"$output_dir/$fixture.html"
  diff -u "$fixture_dir/$fixture.html" "$output_dir/$fixture.html"
done

"$FOSSIL" test-org-render --text "$fixture_dir/all.org" >"$output_dir/all.txt"
diff -u "$fixture_dir/all.txt" "$output_dir/all.txt"

sed 's/$/\r/' "$fixture_dir/all.org" >"$output_dir/all-crlf.org"
"$FOSSIL" test-org-render "$output_dir/all-crlf.org" >"$output_dir/all-crlf.html"
diff -u "$fixture_dir/all.html" "$output_dir/all-crlf.html"

if rg -n '<script|<img[^>]*onerror|href="javascript:' "$output_dir"/*.html; then
  printf 'Unsafe active HTML escaped into Org renderer output.\n' >&2
  exit 1
fi
if ! rg -q '&lt;script&gt;|&lt;img' "$output_dir/security.html"; then
  printf 'Escaped security fixture content is missing.\n' >&2
  exit 1
fi

printf 'Org renderer golden and security tests passed.\n'