import { describe, expect, it } from "vitest";
import { renderIntroMarkdown } from "./markdown.js";

/**
 * TASK-0107 DoD — "XSS vectors stripped (sanitizer test list)".
 *
 * `renderIntroMarkdown` is the ONLY way a form's `config.intro` (an
 * OWNER-supplied, publicly rendered string) reaches the DOM. The contract
 * (see markdown.ts) is: HTML-escape the ENTIRE input first, then apply a
 * strict block grammar + an allow-list of inline transforms
 * (strong / em / http(s)-only links). So the ONLY HTML the function can emit
 * is the literal tags it inserts itself. This suite pins that contract.
 *
 * Two assertions per vector class:
 *   1. the DANGEROUS token never appears as a live tag/attribute in the
 *      output (it is either escaped or dropped), AND
 *   2. the legitimate transforms the feature actually promises still work
 *      (the sanitizer is not so aggressive it breaks the feature).
 */

const VECTORS = [
  // classic script injection
  "<script>alert(1)</script>",
  "<SCRIPT SRC=//evil.example/x.js></SCRIPT>",
  "<script src='//evil.example/a.js'></script>",
  // event-handler injection on common elements
  "<img src=x onerror=alert(1)>",
  "<svg/onload=alert(1)>",
  "<body onload=alert(1)>",
  "<input onfocus=alert(1) autofocus>",
  // iframe / object embedding
  "<iframe src=//evil.example></iframe>",
  "<iframe src='javascript:alert(1)'></iframe>",
  "<object data='//evil.example/x.swf'></object>",
  // javascript: URI in a link (both raw and markdown form)
  '<a href="javascript:alert(1)">click</a>',
  "[click](javascript:alert(1))",
  "[click](data:text/html,<script>alert(1)</script>)",
  // null-byte / whitespace obfuscation
  "<scr\u0000ipt>alert(1)</script>",
  "<script\t>alert(1)</script>",
  "<img src=x onerror=\talert(1)>",
  // style / expression injection
  "<div style='width:expression(alert(1))'>",
  "<style>body{display:none}</style>",
  // double-encode attempt (should just be escaped text)
  "&lt;script&gt;alert(1)&lt;/script&gt;"
];

describe("renderIntroMarkdown — XSS sanitizer (TASK-0107 DoD)", () => {
  it("never emits a live <script> tag for any vector", () => {
    for (const v of VECTORS) {
      const out = renderIntroMarkdown(v);
      expect(out, `vector ${JSON.stringify(v)}`).not.toMatch(/<script/i);
    }
  });

  it("never emits a live iframe/object/embed tag for any vector", () => {
    for (const v of VECTORS) {
      const out = renderIntroMarkdown(v);
      expect(out, `vector ${JSON.stringify(v)}`).not.toMatch(/<(iframe|object|embed|applet)\b/i);
    }
  });

  it("never emits a LIVE event-handler attribute (on*) for any vector", () => {
    for (const v of VECTORS) {
      const out = renderIntroMarkdown(v);
      // Only UNESCAPED `<…>` tags can be live. The function's own output is
      // limited to its whitelist (p/br/ul/ol/li/strong/em/a), none of which
      // ever carries an on* attribute. Escaped text (`&lt;img onerror=…&gt;`)
      // is inert and must NOT be flagged — so inspect only real tags.
      const liveTags = out.match(/<[a-zA-Z][^>]*>/g) ?? [];
      for (const tag of liveTags) {
        expect(tag, `live handler in ${tag} (vector ${JSON.stringify(v)})`).not.toMatch(/\bon\w+\s*=/i);
      }
    }
  });

  it("never emits a javascript: / data: URI in any href/src for any vector", () => {
    for (const v of VECTORS) {
      const out = renderIntroMarkdown(v);
      expect(out, `vector ${JSON.stringify(v)}`).not.toMatch(/(href|src)\s*=\s*["']?\s*(javascript|data|vbscript):/i);
    }
  });

  it("escapes raw `<` / `>` to entities (no raw tag boundary at all)", () => {
    for (const v of VECTORS) {
      const out = renderIntroMarkdown(v);
      // the only `<` allowed are the closing/whitelist tags the function
      // inserts: <p>, <br>, <ul>, <ol>, <li>, <strong>, <em>, <a …>.
      expect(out, `vector ${JSON.stringify(v)}`).not.toMatch(/<\/?(script|iframe|object|embed|img|svg|body|input|style|meta|link|form|button|textarea|select|div)\b/i);
    }
  });

  it("the legitimate transforms still work (feature is preserved)", () => {
    // strong
    expect(renderIntroMarkdown("Hello **world**")).toBe("<p>Hello <strong>world</strong></p>");
    // em
    expect(renderIntroMarkdown("an _italic_ word")).toBe("<p>an <em>italic</em> word</p>");
    // http(s) link → safe anchor with rel/target
    expect(renderIntroMarkdown("[docs](https://example.com/a)")).toBe(
      '<p><a href="https://example.com/a" rel="noopener noreferrer" target="_blank">docs</a></p>',
    );
    // lists
    expect(renderIntroMarkdown("- one\n- two")).toBe("<ul><li>one</li><li>two</li></ul>");
    expect(renderIntroMarkdown("1. one\n2. two")).toBe("<ol><li>one</li><li>two</li></ol>");
  });

  it("non-http markdown links are left as literal text (no anchor)", () => {
    const out = renderIntroMarkdown("[x](javascript:alert(1))");
    expect(out).not.toContain("<a");
    expect(out).toContain("javascript:alert(1)"); // visible as inert text
  });

  it("degrades gracefully on empty / non-string / over-long input (never throws)", () => {
    expect(renderIntroMarkdown("")).toBe("");
    expect(renderIntroMarkdown(undefined as unknown as string)).toBe("");
    const long = "<script>".repeat(20_000);
    expect(() => renderIntroMarkdown(long)).not.toThrow();
    expect(renderIntroMarkdown(long)).not.toMatch(/<script/i);
  });
});