import { safeNotificationActionUrl } from "../src/security/actionUrl";

function assertEqual(actual: unknown, expected: unknown, message: string): void {
  if (actual !== expected) {
    throw new Error(`${message}: expected ${String(expected)}, got ${String(actual)}`);
  }
}

assertEqual(
  safeNotificationActionUrl(" /calendar?event=event-1#details "),
  "/calendar?event=event-1#details",
  "application-relative links remain available"
);

for (const unsafe of [
  "javascript:alert(1)",
  "data:text/html,unsafe",
  "https://attacker.example.test/collect",
  "//attacker.example.test/collect",
  "/\\attacker.example.test/collect",
  "/calendar\nmalformed",
  "/calendar\u007fmalformed"
]) {
  assertEqual(safeNotificationActionUrl(unsafe), null, `unsafe link is suppressed: ${unsafe}`);
}

assertEqual(safeNotificationActionUrl(null), null, "missing links remain absent");