import { test } from '@japa/runner'
import {
  sanitizePayload,
  sanitizeRichText,
  sanitizeUrl,
} from '#base_modules/WebManager/services/content_sanitizer'

test.group('Web Manager content sanitizer', () => {
  test('rich text keeps allowed markup and drops event handlers', ({ assert }) => {
    assert.equal(
      sanitizeRichText('<p class="lead" onclick="alert(1)">Hi <em>there</em></p>'),
      '<p class="lead">Hi <em>there</em></p>'
    )
  })

  test('rich text drops dangerous subtrees entirely', ({ assert }) => {
    assert.equal(
      sanitizeRichText('before<script>alert(1)</script><svg><a onload="alert(1)"></a></svg>after'),
      'beforeafter'
    )
  })

  test('rich text rejects unsafe link schemes and normalizes rel', ({ assert }) => {
    assert.equal(
      sanitizeRichText('<a href="javascript:alert(1)" target="_blank" rel="me nofollow">x</a>'),
      '<a target="_blank" rel="noopener noreferrer">x</a>'
    )
    assert.equal(
      sanitizeRichText('<a href="https://example.com" target="_top" rel="me nofollow">x</a>'),
      '<a href="https://example.com" rel="nofollow">x</a>'
    )
  })

  test('url fields allow relative and https urls, reject script schemes', ({ assert }) => {
    assert.equal(sanitizeUrl('/en/about'), '/en/about')
    assert.equal(sanitizeUrl('https://example.com/?a=1&b=2'), 'https://example.com/?a=1&b=2')
    assert.equal(sanitizeUrl('mailto:hi@example.com'), 'mailto:hi@example.com')
    assert.equal(sanitizeUrl('javascript:alert(1)'), '')
    assert.equal(sanitizeUrl(' jav\tascript:alert(1)'), '')
  })

  test('payload pass applies the url policy to known url keys only', ({ assert }) => {
    assert.deepEqual(
      sanitizePayload({
        title: '<b>Hello</b>',
        externalUrl: 'javascript:alert(1)',
        items: [{ url: 'https://example.com/?a=1&b=2' }],
      }),
      {
        title: '<b>Hello</b>',
        externalUrl: '',
        items: [{ url: 'https://example.com/?a=1&b=2' }],
      }
    )
  })
})