<?php

namespace Tests\Unit;

use App\Support\HtmlSanitizer;
use PHPUnit\Framework\TestCase;

class HtmlSanitizerTest extends TestCase
{
    public function test_it_removes_scripts_event_handlers_and_javascript_urls(): void
    {
        $sanitized = (new HtmlSanitizer())->sanitize(
            '<p onclick="alert(1)">Hello<script>alert(1)</script><a href="javascript:alert(2)" target="_blank">Click</a><img src="x" onerror="alert(3)"></p>'
        );

        $this->assertStringNotContainsString('<script', $sanitized);
        $this->assertStringNotContainsString('onclick=', $sanitized);
        $this->assertStringNotContainsString('onerror=', $sanitized);
        $this->assertStringNotContainsString('javascript:', $sanitized);
        $this->assertStringContainsString('<p>Hello', $sanitized);
    }

    public function test_it_keeps_basic_editor_markup_and_secures_blank_links(): void
    {
        $sanitized = (new HtmlSanitizer())->sanitize(
            '<h2>Title</h2><p><strong>Safe</strong> <a href="https://example.com" target="_blank">Read</a></p><ul><li>One</li></ul>'
        );

        $this->assertStringContainsString('<h2>Title</h2>', $sanitized);
        $this->assertStringContainsString('<strong>Safe</strong>', $sanitized);
        $this->assertStringContainsString('href="https://example.com"', $sanitized);
        $this->assertStringContainsString('rel="noopener noreferrer"', $sanitized);
        $this->assertStringContainsString('<ul><li>One</li></ul>', $sanitized);
    }
}
