import { describe, test, expect } from 'vitest';
import { SubscribeForm } from './SubscribeForm';

const toHtml = (SubscribeForm as any).toHtml;

describe('SubscribeForm.toHtml hardcoded attributes stay hardcoded (no raw prop breakout)', () => {
  test('form method is always POST regardless of any injected props', () => {
    const { html } = toHtml({ heading: 'Join us', method: 'GET"><script>alert(1)</script>' } as any, '');
    expect(html).toContain('<form method="POST"');
    expect(html).not.toContain('<script');
  });

  test('email input type is always "email" regardless of any injected props', () => {
    const { html } = toHtml({ type: 'text"><img src=x onerror=alert(1)>' } as any, '');
    expect(html).toContain('<input type="email"');
    expect(html).not.toContain('<img');
    expect(html).not.toContain('onerror=');
  });

  test('layout enum only ever feeds one of two fixed literal style strings, never raw', () => {
    const { html: inlineHtml } = toHtml({ layout: 'inline' }, '');
    const { html: stackedHtml } = toHtml({ layout: 'stacked' }, '');
    expect(inlineHtml).toContain('flex-direction:row');
    expect(stackedHtml).toContain('flex-direction:column');
  });

  test('malicious layout value cannot inject raw CSS/attribute breakout (falls through the isInline boolean check to the stacked literal)', () => {
    const { html } = toHtml({ layout: '"><script>alert(1)</script>' as any }, '');
    expect(html).not.toContain('<script');
    expect(html).toContain('flex-direction:column');
  });

  test('normal render still produces expected structure', () => {
    const { html } = toHtml({ heading: 'Subscribe', placeholder: 'you@example.com', buttonText: 'Go' }, '');
    expect(html).toContain('Subscribe');
    expect(html).toContain('placeholder="you@example.com"');
    expect(html).toContain('>Go<');
  });
});