import { describe, expect, it } from 'vitest'
import { sanitizeRichText } from '../server/utils/rich-text'

describe('sanitizeRichText', () => {
  it('keeps supported article formatting', () => {
    const html = '<h2 style="text-align:center">标题</h2><p><strong>重点</strong><span style="font-size:20px;color:#17364e">正文</span></p>'
    expect(sanitizeRichText(html)).toBe(html)
  })

  it('removes scripts, event handlers and unsafe links', () => {
    const html = '<p onclick="alert(1)">正文<script>alert(1)</script><a href="javascript:alert(1)">危险链接</a></p>'
    const cleaned = sanitizeRichText(html)
    expect(cleaned).not.toContain('script')
    expect(cleaned).not.toContain('onclick')
    expect(cleaned).not.toContain('javascript:')
  })

  it('adds isolation attributes to new-window links', () => {
    expect(sanitizeRichText('<a href="https://example.com" target="_blank">示例</a>'))
      .toContain('rel="noopener noreferrer"')
  })
})