@timeout_ms 5_000

  # The eight bytes every PNG starts with. The card is checked against them

  # before it is served, because the failure this guards against answers 200.

  @png_signature <<0x89, "PNG\r\n", 0x1A, "\n">>

  @type error :: :unavailable | :busy | :rasterizer_failed | :timeout | {:exit, term()}

  @doc """

  defp run(bin, svg, opts) do

    timeout = Keyword.get(opts, :timeout_ms, @timeout_ms)

    source = temp_path("svg")

    target = temp_path("png")

    try do

      File.write!(source, svg)

      task = Task.async(fn -> System.cmd(bin, port_args(source), stderr_to_stdout: true) end)

      task =

        Task.async(fn ->

          System.cmd(bin, port_args(source, target),

            stderr_to_stdout: true,

            env: environment()

          )

        end)

      case Task.yield(task, timeout) || Task.shutdown(task, :brutal_kill) do

        {:ok, {png, 0}} when is_binary(png) and byte_size(png) > 0 ->

          {:ok, png}

        {:ok, {diagnostics, 0}} ->

          read_card(target, diagnostics)

        {:ok, {_output, status}} ->

          Logger.warning("og_rasterizer_failed exit=#{status}")

      error in File.Error -> {:error, {:file, error.reason}}

    after

      File.rm(source)

      File.rm(target)

    end

  end

  # The image comes off disk, never off the pipe. librsvg writes the PNG to

  # `-o` and its warnings to stderr, and this call merges stderr into stdout

  # deliberately -- so that a warning is logged rather than lost -- which is

  # exactly why the bytes cannot come from there. They did once: a container

  # whose fontconfig had no writable cache emitted "No writable cache

  # directories" five times per render, the collector returned those 240 bytes

  # with the PNG behind them, the signature was no longer at byte zero, and

  # every card on the site failed to decode while the endpoint answered 200.

  defp read_card(target, diagnostics) do

    log_diagnostics(diagnostics)

    case File.read(target) do

      {:ok, <<@png_signature::binary, _rest::binary>> = png} ->

        {:ok, png}

      {:ok, _other} ->

        # Exit zero and bytes that are not a PNG: the binary is telling the

        # truth about its exit and lying about its output. Fail to the

        # committed card rather than serve something no decoder accepts.

        Logger.warning("og_rasterizer_not_png")

        {:error, :rasterizer_failed}

      {:error, reason} ->

        Logger.warning("og_rasterizer_unreadable code=#{reason}")

        {:error, :rasterizer_failed}

    end

  end

  defp port_args(source),

    do: ["-f", "png", "-w", "1200", "-h", "630", "--keep-aspect-ratio", source]

  defp log_diagnostics(""), do: :ok

  defp log_diagnostics(diagnostics) do

    # One bounded line. The binary's chatter is operational evidence, not card

    # content, and it must never reach a response body again.

    Logger.warning("og_rasterizer_diagnostics=#{inspect(String.slice(diagnostics, 0, 200))}")

  end

  # fontconfig wants a writable cache directory and `nobody` has no home, so

  # without this every render pays for a miss and says so on stderr.

  defp environment, do: [{"XDG_CACHE_HOME", System.tmp_dir!()}]

  defp port_args(source, target),

    do: ["-f", "png", "-w", "1200", "-h", "630", "--keep-aspect-ratio", "-o", target, source]

  defp temp_path(extension),

    do:

defmodule OpenAgentsWeb.OG.RasterizerNoiseTest do

  use ExUnit.Case, async: false

  alias OpenAgentsWeb.OG.Rasterizer

  @png <<0x89, "PNG\r\n", 0x1A, "\n", "rest-of-a-card">>

  setup do

    previous = Application.get_env(:openagents, :og_rasterizer_bin)

    on_exit(fn -> Application.put_env(:openagents, :og_rasterizer_bin, previous) end)

    :ok

  end

  defp fake_binary(script) do

    path = Path.join(System.tmp_dir!(), "fake-rsvg-#{System.unique_integer([:positive])}")

    File.write!(path, script)

    File.chmod!(path, 0o755)

    on_exit(fn -> File.rm(path) end)

    Application.put_env(:openagents, :og_rasterizer_bin, path)

    path

  end

  test "a chatty binary cannot pollute the card" do

    # The production failure: warnings on stderr, a good PNG at -o, exit 0.

    fake_binary("""

    #!/bin/sh

    echo "Fontconfig error: No writable cache directories" >&2

    echo "Fontconfig error: No writable cache directories" >&2

    while [ $# -gt 0 ]; do

      case "$1" in

        -o) shift; out="$1" ;;

      esac

      shift

    done

    printf '\\211PNG\\r\\n\\032\\nrest-of-a-card' > "$out"

    exit 0

    """)

    assert {:ok, png} = Rasterizer.rasterize("<svg/>")

    assert png == @png

    assert binary_part(png, 0, 8) == <<0x89, "PNG\r\n", 0x1A, "\n">>

  end

  test "output that is not a PNG fails closed" do

    fake_binary("""

    #!/bin/sh

    while [ $# -gt 0 ]; do

      case "$1" in

        -o) shift; out="$1" ;;

      esac

      shift

    done

    printf 'Fontconfig error: No writable cache directories' > "$out"

    exit 0

    """)

    assert {:error, :rasterizer_failed} = Rasterizer.rasterize("<svg/>")

  end

end