/**
 * packages/shared — renderMarkdown tests (TASK-0112 SEND_EMAIL).
 *
 * The critical contract is XSS-safety: input is escaped FIRST, then
 * transforms are applied, so no raw HTML survives. Also: the supported
 * inline/block set, safe link targets only (javascript: defanged), and
 * total behavior (any string in → a safe string out).
 */
import { describe, expect, it } from "vitest";
import { renderMarkdown } from "./markdown.js";

describe("renderMarkdown", () => {
  it("escapes raw HTML (the XSS contract)", () => {
    expect(renderMarkdown("<script>alert(1)</script>")).toBe("<p>&lt;script&gt;alert(1)&lt;/script&gt;</p>");
    expect(renderMarkdown('<img src=x onerror="alert(1)">')).toBe("<p>&lt;img src=x onerror=&quot;alert(1)&quot;&gt;</p>");
    expect(renderMarkdown("**bold**")).toContain("<strong>bold</strong>");
    expect(renderMarkdown("**bold**")).not.toContain("<script");
  });
  it("renders headings", () => {
    expect(renderMarkdown("# H1")).toBe("<h1>H1</h1>");
    expect(renderMarkdown("## H2")).toBe("<h2>H2</h2>");
    expect(renderMarkdown("### H3")).toBe("<h3>H3</h3>");
  });
  it("renders bold, italic, code", () => {
    expect(renderMarkdown("**b**")).toContain("<strong>b</strong>");
    expect(renderMarkdown("*i*")).toContain("<em>i</em>");
    expect(renderMarkdown("a `c` b")).toContain("<code>c</code>");
  });
  it("renders unordered + ordered lists", () => {
    expect(renderMarkdown("- a\n- b")).toBe("<ul>\n<li>a</li>\n<li>b</li>\n</ul>");
    expect(renderMarkdown("1. a\n2. b")).toBe("<ol>\n<li>a</li>\n<li>b</li>\n</ol>");
  });
  it("links: http(s) only; javascript: defanged", () => {
    expect(renderMarkdown("[t](https://x.io/a)")).toBe('<p><a href="https://x.io/a" rel="noopener noreferrer">t</a></p>');
    expect(renderMarkdown("[t](javascript:alert(1))")).toContain('href="#"');
    expect(renderMarkdown("[t](javascript:alert(1))")).not.toContain("javascript:");
  });
  it("paragraphs + line breaks", () => {
    expect(renderMarkdown("line1\nline2")).toBe("<p>line1<br>line2</p>");
    expect(renderMarkdown("a\n\nb")).toBe("<p>a</p>\n<p>b</p>");
  });
  it("empty string → empty output", () => {
    expect(renderMarkdown("")).toBe("");
  });
  it("no raw < ever emitted from user text (except our own tags)", () => {
    const out = renderMarkdown("<div class='x'>hi</div>\n<script>evil()</script>");
    expect(out).not.toMatch(/<div|<script|<svg|<iframe/);
  });
});