import assert from 'node:assert/strict';
import { test } from 'node:test';
import { escapeHtml, renderEmbedPage, renderOEmbedJson, renderProjectPage, type ProjectCardData } from '../src/cards.ts';

const malicious: ProjectCardData = {
  actor: 'alice.bsky.social',
  did: 'did:plc:alice',
  rkey: '3la1',
  name: '<script>alert(1)</script>',
  description: 'a "quoted" & <b>tagged</b> description',
};

test('escapeHtml escapes every special character', () => {
  assert.equal(escapeHtml(`<script>& "'`), '&lt;script&gt;&amp; &quot;&#39;');
});

test('renderProjectPage HTML-escapes the project name and carries the exact og:title', () => {
  const html = renderProjectPage(malicious, 'https://nibling.run');
  assert.equal(html.includes('<script>alert(1)</script>'), false);
  assert.equal(
    html.includes('<meta property="og:title" content="&lt;script&gt;alert(1)&lt;/script&gt;">'),
    true,
  );
  assert.equal(
    html.includes('<meta property="og:description" content="a &quot;quoted&quot; &amp; &lt;b&gt;tagged&lt;/b&gt; description">'),
    true,
  );
});

test('renderProjectPage redirects humans via meta refresh to the app URL', () => {
  const html = renderProjectPage(malicious, 'https://nibling.run');
  assert.equal(
    html.includes('<meta http-equiv="refresh" content="0; url=https://nibling.run/alice.bsky.social/3la1">'),
    true,
  );
});

test('renderEmbedPage HTML-escapes the name and embeds the app in an iframe', () => {
  const html = renderEmbedPage(malicious, 'https://nibling.run');
  assert.equal(html.includes('<script>alert(1)</script>'), false);
  assert.equal(
    html.includes('src="https://nibling.run/alice.bsky.social/3la1/embed"'),
    true,
  );
});

test('renderOEmbedJson escapes the embed src and keeps the exact title', () => {
  const oembed = renderOEmbedJson(malicious, 'https://nibling.run');
  assert.equal(oembed.type, 'rich');
  assert.equal(oembed.title, '<script>alert(1)</script>'); // JSON, not HTML: not escaped
  assert.equal(oembed.html.includes('<script>alert(1)</script>'), false);
  assert.equal(oembed.html.includes('src="https://nibling.run/alice.bsky.social/3la1/embed"'), true);
});

test('renderProjectPage uses the slug for the app URL when the card has one', () => {
  const withSlug: ProjectCardData = { ...malicious, slug: 'bouncing-ball' };
  const html = renderProjectPage(withSlug, 'https://nibling.run');
  assert.equal(
    html.includes('<meta property="og:url" content="https://nibling.run/alice.bsky.social/bouncing-ball">'),
    true,
  );
});

test('renderEmbedPage uses the slug for the iframe src when the card has one', () => {
  const withSlug: ProjectCardData = { ...malicious, slug: 'bouncing-ball' };
  const html = renderEmbedPage(withSlug, 'https://nibling.run');
  assert.equal(html.includes('src="https://nibling.run/alice.bsky.social/bouncing-ball/embed"'), true);
});