(* Open Source License *)
(* Copyright (c) 2019 Nomadic Labs. <contact@nomadic-labs.com> *)

(* Permission is hereby granted, free of charge, to any person obtaining a *)
(* copy of this software and associated documentation files (the "Software"), *)
(* to deal in the Software without restriction, including without limitation *)
(* the rights to use, copy, modify, merge, publish, distribute, sublicense, *)
(* and/or sell copies of the Software, and to permit persons to whom the *)
(* Software is furnished to do so, subject to the following conditions: *)

(* The above copyright notice and this permission notice shall be included *)
(* in all copies or substantial portions of the Software. *)

(* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR *)
(* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, *)
(* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL *)
(* THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER *)
(* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING *)
(* FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER *)
(* DEALINGS IN THE SOFTWARE. *)

(* Coq *)
Require Import String.
Require Import Michocoq.macros.
Import syntax.
Import comparable.
Require Import NArith.
Require Import ZArith.
Require Import Coq.Setoids.Setoid.
Require Import Coq.micromega.Lia.
From Coq Require Import Program.Tactics.

(* Mi-Cho-Coq *)
Require Import semantics.
Require Import util.
Import error.
Require List.

(* Dexter *)
Require dexter_definition.
Require dexter_spec.
Require Import dexter_util.
Require Import dexter_spec_util.

Module Spec := dexter_spec.

Module Def := dexter_definition.

Import Def.Storage.

Import Tactics.

Require Import contract_semantics.


(* It's better not to unfold compare in this proof,
 * this makes it easier to use util.eqb_eq.
 *)
Opaque N.mul.
Opaque N.add.
Opaque Z.modulo.
Opaque compare.

  Lemma ep_removeLiquidity_correct
        (env : @proto_env dexter_definition.self_type)
        (p : data dexter_definition.parameter_ep_removeLiquidity_ty)
        (sto : data dexter_definition.storage_ty)
        (ret_ops : Datatypes.list (data operation))
        (ret_sto : data dexter_definition.storage_ty)
        (fuel : Datatypes.nat) :
    (* TODO: fuel may have to be adapted to suit the entrypoint *)
    400 <= fuel ->
    eval_precond fuel env Def.ep_removeLiquidity
                 (fun x => x = (ret_ops, ret_sto, tt))
                 (p, (sto, tt)) <->
    Spec.ep_removeLiquidity env p sto ret_ops ret_sto.
  Proof.
  (*
   * intros Hfuel.
   * destruct_sto sto accounts self_is_updating_token_pool freeze_baker lq_total manager token_address token_pool xtz_pool.
   * 
   * do 7 more_fuel; simpl; repeat fold_mutez_goal. (* 52s *)
   * destruct p as ((owner, (to, lqt_burned)),
   *                (min_xtz_withdrawn,
   *                 (min_tokens_withdrawn, deadline))).
   * 
   * unfold Spec.ep_removeLiquidity.
   * do 3 (apply and_both_0; [rewrite eqb_eq; reflexivity|]).
   * apply and_both_0.
   * apply bool_false_not.
   * 
   * match goal with
   * | [ |- _ <-> ?Pamount /\ ?Pdeadline /\ ?Pmin_xtz_wd /\ ?Pmin_tok_wd /\ ?Plqt_total /\ ?P_lqt_burned /\ ?P ] =>
   *   setoid_replace (Pamount /\ Pdeadline /\ Pmin_xtz_wd /\ Pmin_tok_wd /\ Plqt_total /\ P_lqt_burned /\ P) with
   *       (Pdeadline /\ Pamount /\ Pmin_xtz_wd /\ Pmin_tok_wd /\ P_lqt_burned /\ Plqt_total /\ P)
   *        by intuition
   * end.
   * 
   * apply and_both_0. apply check_deadline_correct.
   * apply and_both_0. apply util.eqb_eq.
   * rewrite comparison_to_int_tez_compare_lt_zero. apply and_both.
   * 
   * rewrite !comparison_to_int_compare_nat_lt, !nat_neq_zero_iff_gt_zero.
   * repeat apply and_both.
   * 
   * Ltac N_mul_comm_with x :=
   *   match goal with
   *   | [ |- context[(?P * x)%N] ] =>
   *     replace (P * x)%N
   *       with (x * P)%N by apply N.mul_comm
   *   end.
   * 
   * unfold_spec; simpl.
   * 
   * destruct (map.get _ _ _ owner) as [(balance, allowances)|] eqn:Hmapget; simpl.
   * - setoid_rewrite some_equal_inv.
   * 
   *   rewrite ex_eq_simpl.
   * 
   *   rewrite comparison_to_int_spec_cmp_eqb.
   * 
   *   rewrite mutez_to_nat.
   * 
   *   rewrite comparison_to_int_eq_comm.
   *   destruct (_ =? _)%Z eqn:Hsender_is_owner.
   *   + setoid_rewrite some_equal_inv.
   *     rewrite ex_eq_simpl.
   * 
   *     rewrite <- ediv_N_some_iff.
   *     rewrite precond_exists.
   *     unfold precond_ex.
   *     rewrite match_z_eq.
   *     setoid_rewrite <- ediv_N_some_iff.
   * 
   *     repeat setoid_rewrite ex_match.
   * 
   * 
   *     setoid_rewrite some_match.
   * 
   *     ex_and_comm_intro xtz_withdrawn.
   *     ex_and_comm_intro xtz_pool'.
   *     ex_and_comm_intro to_contract.
   *     ex_and_comm_intro fa12_contract.
   * 
   *     rewrite !comparison_to_int_compare_nat_ge.
   *     rewrite !comparison_to_int_compare_nat_le.
   *     rewrite !comparison_to_int_compare_int_le.
   *     rewrite !comparison_to_int_tez_compare_mutez_to_nat.
   * 
   *     simpl.
   *     simpl in Hmapget.
   *     rewrite Hmapget.
   * 
   *     rewrite !shim_pair_equal_spec.
   * 
   *     repeat (N_mul_comm_with lqt_burned).
   * 
   *     repeat rewrite <- tez.of_Z_to_Z_eqv.
   * 
   *     intuition (
   *         subst;
   *         repeat rewrite Z_abs_N_sub by lia;
   *         try reflexivity;
   *         try congruence;
   *         try lia;
   *         eauto using tez_fact_l, tez_fact_r).
   * 
   *   + destruct (map.get _ _ _ _ allowances) as [current_allowance|] eqn:Hmapget_allowances; simpl.
   *     * setoid_rewrite some_equal_inv.
   *       rewrite ex_eq_simpl.
   *       rewrite ex_eq_simpl.
   * 
   *       rewrite <- ediv_N_some_iff.
   *       rewrite precond_exists.
   *       unfold precond_ex.
   *       rewrite match_z_eq.
   *       setoid_rewrite <- ediv_N_some_iff.
   * 
   *       rewrite comparison_to_int_compare_spec_cmp_geb_nat.
   *       rewrite comparison_to_int_compare_int_geb.
   *       destruct (Z.of_N current_allowance - Z.of_N lqt_burned >=? 0)%Z
   *                eqn:Hhas_allowance; [| intuition congruence].
   *       apply Z.geb_le in Hhas_allowance.
   * 
   *       repeat setoid_rewrite ex_match.
   * 
   * 
   *       ex_and_comm_intro xtz_withdrawn.
   *       rewrite map.map_updateeq.
   * 
   *       rewrite precond_exists.
   *       unfold precond_ex.
   *       ex_and_comm_intro xtz_pool'.
   * 
   *       repeat setoid_rewrite some_match.
   *       ex_and_comm_intro to_contract.
   *       ex_and_comm_intro fa12_contract.
   * 
   *       repeat rewrite comparison_to_int_compare_nat_ge.
   *       repeat rewrite comparison_to_int_compare_nat_le.
   *       repeat rewrite comparison_to_int_compare_int_le.
   *       repeat rewrite comparison_to_int_tez_compare_mutez_to_nat.
   * 
   *       unfold_spec; simpl.
   *       simpl in Hmapget.
   *       rewrite Hmapget; simpl.
   *       rewrite map.map_updateeq.
   * 
   *       rewrite !shim_pair_equal_spec.
   * 
   *       repeat (N_mul_comm_with lqt_burned).
   * 
   *       simpl.
   *       repeat rewrite <- tez.of_Z_to_Z_eqv.
   * 
   *       intuition (
   *           subst;
   *           repeat rewrite Z_abs_N_sub by lia;
   *           try reflexivity;
   *           try congruence;
   *           try lia;
   *           eauto using tez_fact_l, tez_fact_r).
   *     * apply iff_both_false.
   *       -- intros [H1 [H2 [x [H3 _]]]]. congruence.
   *       -- intuition.
   * - (* both sides imply false *)
   *   apply iff_both_false.
   *   + intros [x [H2 _]]. discriminate.
   *   + lia.
   *)
  Admitted.