import { describe, it, expect } from 'vitest';
import { sanitizeHtml, stripHtml } from '../../security/sanitize.js';
describe('sanitizeHtml', () => {
    it('strips script tags', () => {
        const input = '<p>Hello</p><script>alert("xss")</script>';
        const result = sanitizeHtml(input);
        expect(result).not.toContain('<script');
        expect(result).toContain('<p>Hello</p>');
    });
    it('strips onerror attributes', () => {
        const input = '<img src="x" onerror="alert(1)" alt="test" />';
        const result = sanitizeHtml(input);
        expect(result).not.toContain('onerror');
        expect(result).toContain('alt="test"');
    });
    it('strips javascript: URLs from hrefs', () => {
        const input = '<a href="javascript:alert(1)">click</a>';
        const result = sanitizeHtml(input);
        expect(result).not.toContain('javascript:');
    });
    it('preserves safe HTML', () => {
        const input = '<h1>Title</h1><p>Text with <strong>bold</strong> and <a href="https://example.com">link</a></p>';
        const result = sanitizeHtml(input);
        expect(result).toContain('<h1>');
        expect(result).toContain('<strong>bold</strong>');
        expect(result).toContain('href="https://example.com"');
    });
    it('preserves image tags with allowed attributes', () => {
        const input = '<img src="https://example.com/img.jpg" alt="photo" width="100" />';
        const result = sanitizeHtml(input);
        expect(result).toContain('src="https://example.com/img.jpg"');
        expect(result).toContain('alt="photo"');
    });
    it('preserves tables', () => {
        const input = '<table><thead><tr><th>Header</th></tr></thead><tbody><tr><td>Cell</td></tr></tbody></table>';
        const result = sanitizeHtml(input);
        expect(result).toContain('<table>');
        expect(result).toContain('<th>Header</th>');
        expect(result).toContain('<td>Cell</td>');
    });
    it('strips everything with stripAll option', () => {
        const input = '<p>Hello <strong>world</strong></p>';
        const result = sanitizeHtml(input, { stripAll: true });
        expect(result).toBe('Hello world');
    });
    it('strips style tags', () => {
        const input = '<style>body{display:none}</style><p>visible</p>';
        const result = sanitizeHtml(input);
        expect(result).not.toContain('<style');
        expect(result).toContain('<p>visible</p>');
    });
    it('strips iframe tags', () => {
        const input = '<iframe src="https://evil.com"></iframe><p>safe</p>';
        const result = sanitizeHtml(input);
        expect(result).not.toContain('<iframe');
        expect(result).toContain('<p>safe</p>');
    });
});
describe('stripHtml', () => {
    it('returns plain text from HTML', () => {
        const input = '<p>Hello <strong>world</strong></p>';
        expect(stripHtml(input)).toBe('Hello world');
    });
    it('handles empty string', () => {
        expect(stripHtml('')).toBe('');
    });
    it('strips nested tags', () => {
        const input = '<div><ul><li>Item 1</li><li>Item 2</li></ul></div>';
        const result = stripHtml(input);
        expect(result).toContain('Item 1');
        expect(result).toContain('Item 2');
        expect(result).not.toContain('<');
    });
});
//# sourceMappingURL=sanitize.test.js.map