/**
 * Blog Content Sanitization Configuration
 *
 * Defines strict sanitization rules for blog content to prevent XSS attacks
 * while allowing safe markdown/MDX elements.
 *
 * Security: This schema is used with rehype-sanitize to filter HTML elements
 * and attributes in blog posts, preventing malicious scripts and unsafe content.
 */

import { defaultSchema } from "rehype-sanitize";

/**
 * Custom sanitization schema for blog content
 * Based on GitHub's sanitization schema with additional restrictions
 */
export const blogSanitizeSchema = {
  ...defaultSchema,
  // Allowed HTML tags (strict whitelist)
  tagNames: [
    // Text formatting
    "p",
    "br",
    "strong",
    "em",
    "b",
    "i",
    "u",
    "s",
    "del",
    "mark",
    "small",
    "sub",
    "sup",
    // Headings
    "h1",
    "h2",
    "h3",
    "h4",
    "h5",
    "h6",
    // Lists
    "ul",
    "ol",
    "li",
    // Links and references
    "a",
    // Code
    "code",
    "pre",
    // Quotes and blocks
    "blockquote",
    "cite",
    // Tables
    "table",
    "thead",
    "tbody",
    "tfoot",
    "tr",
    "th",
    "td",
    // Divisions
    "div",
    "span",
    "section",
    "article",
    // Images (vetted sources only via CSP)
    "img",
    // Horizontal rule
    "hr",
  ],

  // Allowed attributes per tag
  attributes: {
    // All tags can have these safe attributes
    "*": [
      "className",
      "class",
      "id", // Styling (sanitized by CSP)
      "dir",
      "lang", // i18n
      "aria-*",
      "role", // Accessibility
    ],

    // Links - strict validation
    a: [
      "href",
      "title",
      "rel", // e.g., noopener, noreferrer
      "target", // Allow _blank for external links
    ],

    // Images - only safe sources (enforced by CSP)
    img: [
      "src",
      "alt",
      "title",
      "width",
      "height",
      "loading", // lazy loading
    ],

    // Code blocks
    code: ["className", "class"], // For syntax highlighting
    pre: ["className", "class"],

    // Table cells
    th: ["scope", "colspan", "rowspan"],
    td: ["colspan", "rowspan"],
  },

  // Allowed protocols for URLs (strict whitelist)
  protocols: {
    href: ["http", "https", "mailto"],
    src: ["https"], // Only HTTPS images
  },

  // Strip dangerous attributes
  strip: ["script", "style", "iframe", "object", "embed"],

  // Additional security: require rel="noopener noreferrer" for target="_blank"
  required: {
    a: {
      rel: "noopener noreferrer",
    },
  },

  // Allowed URL schemes (very restrictive)
  clobber: ["id", "name"], // Prevent name/id conflicts
};

/**
 * Additional DOMPurify config for client-side sanitization
 * Used for JSON-LD and other dynamic content
 */
export const domPurifyConfig = {
  ALLOWED_TAGS: [
    "p",
    "br",
    "strong",
    "em",
    "b",
    "i",
    "u",
    "s",
    "del",
    "mark",
    "h1",
    "h2",
    "h3",
    "h4",
    "h5",
    "h6",
    "ul",
    "ol",
    "li",
    "a",
    "code",
    "pre",
    "blockquote",
    "cite",
    "table",
    "thead",
    "tbody",
    "tfoot",
    "tr",
    "th",
    "td",
    "div",
    "span",
    "section",
    "article",
    "img",
    "hr",
  ],
  ALLOWED_ATTR: [
    "class",
    "id",
    "href",
    "title",
    "alt",
    "src",
    "rel",
    "target",
    "width",
    "height",
    "loading",
    "scope",
    "colspan",
    "rowspan",
    "aria-label",
    "aria-describedby",
    "role",
    "dir",
    "lang",
  ],
  ALLOWED_URI_REGEXP: /^(?:(?:https?|mailto):)/i,
  FORBID_TAGS: [
    "script",
    "style",
    "iframe",
    "object",
    "embed",
    "form",
    "input",
    "textarea",
    "select",
    "button",
  ],
  FORBID_ATTR: [
    "onerror",
    "onload",
    "onclick",
    "onmouseover",
    "onfocus",
    "onblur",
  ],
  KEEP_CONTENT: true, // Keep text content of removed tags
  RETURN_DOM: false,
  RETURN_DOM_FRAGMENT: false,
};
