import { describe, it, expect } from "vitest";
import { sanitizeHtml } from "./sanitize-html";

describe("sanitizeHtml", () => {
  it("preserves a full HTML e-mail document (doctype, head, inline-styled tables)", () => {
    const html = `<!DOCTYPE html>
<html lang="pt-BR">
<head>
  <meta charset="UTF-8" />
  <title>E-mail Marketing</title>
  <style>body { margin: 0; }</style>
</head>
<body style="margin:0; padding:20px;">
  <table role="presentation" width="100%" cellspacing="0" cellpadding="0" border="0">
    <tr><td align="center">Olá!</td></tr>
  </table>
</body>
</html>`;

    const result = sanitizeHtml(html);

    expect(result).toContain("<html");
    expect(result).toContain("<style>body { margin: 0; }</style>");
    expect(result).toContain('style="margin:0;padding:20px"');
    expect(result).toContain("<table");
    expect(result).toContain('role="presentation"');
    expect(result).toContain("Olá!");
  });

  it("allows data: URIs on images (used by the editor's file upload)", () => {
    const html = '<img src="data:image/png;base64,iVBORw0KGgo=" alt="logo" />';

    const result = sanitizeHtml(html);

    expect(result).toContain('src="data:image/png;base64,iVBORw0KGgo="');
  });

  it("strips <script> tags", () => {
    const html = '<p>Hello</p><script>alert("xss")</script>';

    const result = sanitizeHtml(html);

    expect(result).not.toContain("<script");
    expect(result).not.toContain("alert(");
    expect(result).toContain("Hello");
  });

  it("strips inline event handler attributes", () => {
    const html = '<button onclick="alert(1)">Click</button>';

    const result = sanitizeHtml(html);

    expect(result).not.toContain("onclick");
  });
});
