/**
 * @vitest-environment jsdom
 */
import { describe, it, expect } from 'vitest'
import { sanitize } from '../sanitize'

describe('sanitize', () => {
  it('keeps safe HTML content', () => {
    const result = sanitize('<p>Hello <strong>world</strong></p>')
    expect(result).toContain('Hello')
    expect(result).toContain('<strong>world</strong>')
  })

  it('strips script tags', () => {
    const result = sanitize('<p>Safe</p><script>alert("xss")</script>')
    expect(result).toContain('Safe')
    expect(result).not.toContain('alert')
  })

  it('strips event handlers', () => {
    const result = sanitize('<img src="x" onerror="alert(1)">')
    expect(result).not.toContain('onerror')
  })

  it('handles empty string', () => {
    expect(sanitize('')).toBe('')
  })
})
