import { describe, expect, it } from "vitest";
import { compareBodies } from "../../src/core/compare";
import { diagnoseMessage } from "../../src/core/diagnostics";
import { canonicalMessage, redactMessage } from "../../src/core/export";
import { parseMessage } from "../../src/core/mime";
import { sanitizeMailHtml } from "../../src/core/sanitize";

describe("inert rendering and output", () => {
  it("removes active and remote HTML while embedding a deny-all policy", () => {
    const output = sanitizeMailHtml(
      '<script>alert(1)</script><a href="https://bad.test">link</a><img src="https://bad.test/pixel"><p style="background:url(https://bad.test)">safe</p>',
    );
    expect(output).toContain("default-src 'none'");
    expect(output).toContain("safe");
    expect(output).not.toMatch(
      /bad\.test|script|href=|src=|style="background/iu,
    );
  });

  it("produces a bounded line comparison", () => {
    expect(compareBodies("a\nb", "a\nc")).toMatchObject({
      added: 1,
      removed: 1,
      equal: false,
    });
    expect(compareBodies("a\nb", "a\nb")).toMatchObject({ equal: true });
    expect(compareBodies("a\nb\nc", "d\ne\nf", 2).truncated).toBe(true);
  });

  it("labels authentication fields as claims", () => {
    const parsed = parseMessage(
      "From: Ada <ada@example.test>\nDate: Tue, 01 Sep 2026 10:00:00 +0000\nAuthentication-Results: mx.test; spf=pass; dkim=fail\nDKIM-Signature: v=1; d=example.test; s=mail; a=rsa-sha256\n\nbody",
    );
    const diagnostics = diagnoseMessage(parsed);
    expect(
      diagnostics.some(
        (item) => item.code === "auth.claim" && /spf, dkim/u.test(item.summary),
      ),
    ).toBe(true);
    expect(
      diagnostics.find((item) => item.code === "dkim.signature")?.detail,
    ).toMatch(/not cryptographically verified/iu);
  });

  it("normalizes canonical output and reports focused redaction", () => {
    const parsed = parseMessage(
      "From: a@example.test\nReceived: from private.example\nAuthentication-Results: mx; spf=pass\nSubject: hello\n\nline1\nline2",
    );
    expect(canonicalMessage(parsed)).toContain(
      "From: a@example.test\r\nReceived:",
    );
    const redacted = redactMessage(parsed);
    expect(redacted.output).not.toMatch(/Received|Authentication-Results/iu);
    expect(redacted.output).toContain("Subject: hello\r\n\r\nline1\r\nline2");
    expect(JSON.parse(redacted.report)).toMatchObject({
      operation: "mail-header-redaction",
      retainedHeaderCount: 2,
    });
  });
});