package com.pandoli365.bibimbap.service;

import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertTrue;

import org.junit.jupiter.api.Test;

class PostMarkdownServiceTest {

    private final PostMarkdownService service = new PostMarkdownService();

    @Test
    void stripsScriptTag() {
        String html = service.render("<script>alert(1)</script>");
        assertFalse(html.contains("<script"), "script tag must be removed: " + html);
    }

    @Test
    void stripsOnErrorAttribute() {
        String html = service.render("<img src=x onerror=alert(1)>");
        assertFalse(html.contains("onerror"), "onerror attribute must be removed: " + html);
    }

    @Test
    void stripsJavascriptHref() {
        String html = service.render("[클릭](javascript:alert(1))");
        assertFalse(html.contains("javascript:"), "javascript: protocol must be removed: " + html);
    }

    @Test
    void stripsIframeTag() {
        String html = service.render("<iframe src=\"https://evil.example.com\"></iframe>");
        assertFalse(html.contains("<iframe"), "iframe tag must be removed: " + html);
    }

    @Test
    void preservesSafeContent() {
        String bold = service.render("**굵게**");
        assertTrue(bold.contains("<strong>"), "bold should render <strong>: " + bold);

        String link = service.render("[링크](https://example.com)");
        assertTrue(link.contains("<a"), "link should render <a>: " + link);
        assertTrue(link.contains("href=\"https://example.com\""), "link href preserved: " + link);
        assertTrue(link.contains("rel=\"nofollow noopener\""), "link rel enforced: " + link);

        String list = service.render("- 항목1\n- 항목2");
        assertTrue(list.contains("<ul>"), "list should render <ul>: " + list);
        assertTrue(list.contains("<li>"), "list should render <li>: " + list);

        String heading = service.render("# 제목");
        assertTrue(heading.contains("<h1>"), "heading should render <h1>: " + heading);
    }
}
