import { describe, it, expect } from 'vitest';
import { sanitizeIframelyHtml } from './iframely-utils';

const SAMPLE_EMBED_HTML = `
<div class="iframely-embed">
  <div class="iframely-responsive" style="height: 140px; padding-bottom: 100%;">
    <a href="https://bsky.app/profile/example.bsky.social/post/abc123" target="_blank"></a>
  </div>
</div>
<script async src="//cdn.iframe.ly/embed.js" charset="utf-8"></script>
`.trim();

describe('sanitizeIframelyHtml', () => {
  it('preserves the padding-bottom style attribute', () => {
    const result = sanitizeIframelyHtml(SAMPLE_EMBED_HTML);
    expect(result).toContain('padding-bottom');
  });

  it('strips script tags', () => {
    const result = sanitizeIframelyHtml(SAMPLE_EMBED_HTML);
    expect(result).not.toContain('<script');
    expect(result).not.toContain('iframe.ly/embed.js');
  });

  it('preserves the iframely wrapper divs', () => {
    const result = sanitizeIframelyHtml(SAMPLE_EMBED_HTML);
    expect(result).toContain('iframely-responsive');
  });

  it('preserves href links', () => {
    const result = sanitizeIframelyHtml(SAMPLE_EMBED_HTML);
    expect(result).toContain('bsky.app');
  });

  it('strips inline event handlers', () => {
    const malicious = '<div onclick="alert(1)">hello</div>';
    const result = sanitizeIframelyHtml(malicious);
    expect(result).not.toContain('onclick');
  });

  it('strips javascript: hrefs', () => {
    const malicious = '<a href="javascript:alert(1)">click</a>';
    const result = sanitizeIframelyHtml(malicious);
    expect(result).not.toContain('javascript:');
  });
});
