from backend.app.utils.html_sanitize import (
    extract_img_srcs,
    rewrite_img_srcs,
    sanitize_post_html,
)


def test_none_and_blank_return_none():
    assert sanitize_post_html(None) is None
    assert sanitize_post_html("") is None
    assert sanitize_post_html("   \n  ") is None


def test_allowed_tags_survive():
    out = sanitize_post_html("<p>hi <strong>there</strong><br><em>x</em></p>")
    assert "<p>" in out and "<strong>" in out and "<br>" in out and "<em>" in out


def test_disallowed_tags_and_attrs_stripped_text_kept():
    out = sanitize_post_html('<script>alert(1)</script><p onclick="x">body</p>')
    assert "<script>" not in out
    assert "alert(1)" not in out  # clean_content removes script *content* too
    assert "onclick" not in out
    assert "body" in out


def test_div_stripped_but_text_preserved():
    out = sanitize_post_html("<div><span>keep</span> me</div>")
    assert "<div>" not in out and "<span>" not in out
    assert "keep" in out and "me" in out


def test_links_get_rel_and_keep_http():
    out = sanitize_post_html('<a href="https://example.com/p">link</a>')
    assert 'href="https://example.com/p"' in out
    assert 'rel="noopener noreferrer"' in out


def test_javascript_href_dropped():
    out = sanitize_post_html('<a href="javascript:alert(1)">x</a>')
    assert "javascript:" not in out
    assert "x" in out  # text preserved, dangerous href removed


def test_headings_lists_and_images_survive():
    out = sanitize_post_html(
        '<h2>Title</h2><p>x</p>'
        '<img src="https://cdn.test/a.jpg" alt="art" width="200">'
        '<ul><li>one</li></ul><blockquote>q</blockquote>'
    )
    assert "<h2>" in out
    assert '<img' in out and 'src="https://cdn.test/a.jpg"' in out and 'alt="art"' in out
    assert "<li>" in out and "<blockquote>" in out


def test_image_javascript_src_dropped():
    out = sanitize_post_html('<img src="javascript:alert(1)" alt="x">')
    assert "javascript:" not in out


# --- inline-image localization helpers (#830 Phase 2) ----------------------


def test_extract_img_srcs_in_order_deduped():
    html = (
        '<p>a</p><img src="https://cdn.test/1.jpg">'
        '<img alt="x" src="https://cdn.test/2.jpg" width="10">'
        '<img src="https://cdn.test/1.jpg">'
    )
    assert extract_img_srcs(html) == [
        "https://cdn.test/1.jpg",
        "https://cdn.test/2.jpg",
    ]


def test_extract_img_srcs_empty():
    assert extract_img_srcs(None) == []
    assert extract_img_srcs("<p>no images</p>") == []


def test_rewrite_img_srcs_swaps_only_mapped():
    html = (
        '<img src="https://cdn.test/1.jpg" alt="a">'
        '<img src="https://cdn.test/2.jpg">'
    )
    out = rewrite_img_srcs(html, {"https://cdn.test/1.jpg": "/images/local/1.jpg"})
    assert 'src="/images/local/1.jpg"' in out
    assert 'alt="a"' in out  # other attributes preserved
    assert 'src="https://cdn.test/2.jpg"' in out  # unmapped left alone


def test_rewrite_img_srcs_noop_on_empty():
    html = '<img src="https://cdn.test/1.jpg">'
    assert rewrite_img_srcs(html, {}) == html
    assert rewrite_img_srcs(None, {"a": "b"}) is None