import { describe, it, expect } from "vitest"
import { sanitizeSvg } from "@/lib/sanitize"

describe("sanitizeSvg", () => {
  it("strips script tags", () => {
    const input = `<svg><script>alert('xss')</script><rect width="100" height="100"/></svg>`
    const result = sanitizeSvg(input)
    expect(result).not.toContain("script")
    expect(result).toContain("<svg")
    expect(result).toContain("<rect")
  })

  it("strips event handler attributes", () => {
    const input = `<svg onload="alert(1)"><rect width="100" height="100"/></svg>`
    const result = sanitizeSvg(input)
    expect(result).not.toContain("onload")
    expect(result).toContain("<svg")
    expect(result).toContain("<rect")
  })

  it("strips onclick attributes", () => {
    const input = `<svg><rect onclick="evil()" width="100" height="100"/></svg>`
    const result = sanitizeSvg(input)
    expect(result).not.toContain("onclick")
    expect(result).toContain("<rect")
    expect(result).toContain('width="100"')
  })

  it("removes javascript: URLs", () => {
    const input = `<svg><a href="javascript:alert(1)">click</a></svg>`
    const result = sanitizeSvg(input)
    expect(result).not.toContain("javascript:")
  })

  it("passes through clean SVGs unchanged (except whitespace)", () => {
    const input = `<svg viewBox="0 0 24 24"><circle cx="12" cy="12" r="10"/></svg>`
    const result = sanitizeSvg(input)
    expect(result).toContain("viewBox")
    expect(result).toContain("<circle")
    expect(result).toContain('cx="12"')
  })
})