import { SanitizeHtmlService } from '../services/sanitize-html.service';

describe('SanitizeHtmlService', () => {
  const sanitizer = new SanitizeHtmlService();

  it('strips <script> tags', () => {
    const out = sanitizer.sanitizeInquiryMessage('<p>Hi</p><script>alert(1)</script>');
    expect(out).toBe('<p>Hi</p>');
  });

  it('drops inline event handlers like onerror', () => {
    const out = sanitizer.sanitizeInquiryMessage('<img src=x onerror="alert(1)" />');
    expect(out).not.toContain('onerror');
    expect(out).not.toContain('<img');
  });

  it('keeps allow-listed inline tags', () => {
    const out = sanitizer.sanitizeInquiryMessage('<b>bold</b> <i>italic</i><br/><p>para</p>');
    expect(out).toContain('<b>bold</b>');
    expect(out).toContain('<i>italic</i>');
    expect(out).toContain('<br />');
    expect(out).toContain('<p>para</p>');
  });

  it('forces rel and target on <a>', () => {
    const out = sanitizer.sanitizeInquiryMessage('<a href="https://example.com">x</a>');
    expect(out).toContain('href="https://example.com"');
    expect(out).toContain('rel="noopener noreferrer nofollow"');
    expect(out).toContain('target="_blank"');
  });

  it('drops javascript: scheme links', () => {
    const out = sanitizer.sanitizeInquiryMessage('<a href="javascript:alert(1)">x</a>');
    expect(out).not.toContain('javascript:');
  });

  it('returns empty string for nullish input', () => {
    expect(sanitizer.sanitizeInquiryMessage(null)).toBe('');
    expect(sanitizer.sanitizeInquiryMessage(undefined)).toBe('');
    expect(sanitizer.sanitizeInquiryMessage('')).toBe('');
  });

  it('preserves plain Vietnamese text', () => {
    const text = 'Tôi muốn xem nhà vào cuối tuần này, anh sắp xếp giúp ạ.';
    expect(sanitizer.sanitizeInquiryMessage(text)).toBe(text);
  });
});
