import { describe, test, expect } from 'vitest';
import { MapEmbed } from './MapEmbed';

const toHtml = (MapEmbed as any).toHtml;

describe('MapEmbed.toHtml iframe accessibility (F2.4)', () => {
  test('iframe has a non-empty title attribute', () => {
    const { html } = toHtml({ address: 'New York, NY' }, '');
    expect(html).toMatch(/<iframe[^>]*title="[^"]+"/);
  });

  test('title reflects the configured address', () => {
    const { html } = toHtml({ address: 'Golden Gate Bridge' }, '');
    expect(html).toContain('title="Map of Golden Gate Bridge"');
  });
});

describe('MapEmbed.toHtml iframe src ampersand encoding (F-export review Minor)', () => {
  test('the iframe src (built by string concatenation with literal &) emits &amp; in the attribute, not a raw &', () => {
    const { html } = toHtml({ address: 'New York, NY', zoom: 14 }, '');
    const srcMatch = html.match(/<iframe src="([^"]+)"/);
    expect(srcMatch).toBeTruthy();
    // The raw src is `...q=...&z=14&output=embed` -- concatenated with
    // literal `&`s -- so the emitted attribute must HTML-encode them.
    expect(srcMatch![1]).toContain('&amp;z=14');
    expect(srcMatch![1]).toContain('&amp;output=embed');
    expect(srcMatch![1]).not.toMatch(/&(?!amp;)/);
  });
});

describe('MapEmbed.toHtml box-model styles (margin/padding/border/shadow/opacity)', () => {
  test('margin/padding/border/box-shadow/opacity all flow into the wrapper style attribute', () => {
    const { html } = toHtml(
      {
        address: 'New York, NY',
        style: {
          marginTop: '16px',
          paddingRight: '4px',
          border: '1px solid #cccccc',
          boxShadow: '0 4px 8px rgba(0,0,0,0.12)',
          opacity: '0.95',
        },
      },
      ''
    );
    expect(html).toContain('margin-top:16px');
    expect(html).toContain('padding-right:4px');
    expect(html).toContain('border:1px solid #cccccc');
    expect(html).toContain('box-shadow:0 4px 8px rgba(0,0,0,0.12)');
    expect(html).toContain('opacity:0.95');
  });
});

describe('MapEmbed.craft.props exposes the animation/visibility rollout', () => {
  test('animation, animationDelay, hideOnDesktop/Tablet/Mobile are present with blank/false defaults', () => {
    const props = (MapEmbed as any).craft.props;
    expect(props.animation).toBe('');
    expect(props.animationDelay).toBe('0');
    expect(props.hideOnDesktop).toBe(false);
    expect(props.hideOnTablet).toBe(false);
    expect(props.hideOnMobile).toBe(false);
  });

  test('style carries blank/default box-model keys', () => {
    const style = (MapEmbed as any).craft.props.style;
    expect(style).toHaveProperty('marginTop');
    expect(style).toHaveProperty('paddingTop');
    expect(style.border).toBe('none');
    expect(style.boxShadow).toBe('none');
    expect(style.opacity).toBe('1');
  });
});

describe('MapEmbed.toHtml address/zoom/height XSS hardening', () => {
  test('a malicious address cannot break out of the src or title attribute', () => {
    const malicious = 'X" onerror="alert(1)';
    const { html } = toHtml({ address: malicious }, '');
    expect(html).not.toContain('onerror="alert(1)"');
  });

  test('a wrong-typed zoom (string with attribute-breakout chars) cannot break out of the src attribute', () => {
    const malicious = '14"><script>alert(1)</script>' as any;
    const { html } = toHtml({ address: 'X', zoom: malicious }, '');
    expect(html).not.toContain('<script>alert(1)</script>');
    expect(html).not.toContain('"><script');
  });

  test('a wrong-typed zoom is coerced to a safe numeric value in the exported URL (defense in depth beyond escaping)', () => {
    const malicious = '14"><script>alert(1)</script>' as any;
    const { html } = toHtml({ address: 'X', zoom: malicious }, '');
    const srcMatch = html.match(/<iframe src="([^"]+)"/);
    expect(srcMatch).toBeTruthy();
    // Decode the entity-escaped src back to a plain string and confirm the
    // `z=` param is a bare, well-formed number -- not the raw attacker string.
    const decoded = srcMatch![1].replace(/&amp;/g, '&').replace(/&quot;/g, '"').replace(/&lt;/g, '<').replace(/&gt;/g, '>');
    expect(decoded).toMatch(/[&?]z=\d+(&|$)/);
  });

  test('a malicious height cannot break out of the iframe style attribute', () => {
    const malicious = '400px" onmouseover="alert(1)';
    const { html } = toHtml({ address: 'X', height: malicious }, '');
    expect(html).not.toContain('onmouseover="alert(1)"');
  });

  test('a normal zoom/height still renders correctly', () => {
    const { html } = toHtml({ address: 'X', zoom: 10, height: '300px' }, '');
    expect(html).toContain('z=10');
    expect(html).toContain('height:300px');
  });
});
