import { describe, it, expect } from 'vitest';
import { safeExternalHref } from './safeHref';

describe('safeExternalHref', () => {
    it('passes through http and https URLs', () => {
        expect(safeExternalHref('http://example.com/manga/1')).toBe(
            'http://example.com/manga/1'
        );
        expect(safeExternalHref('https://example.com/x?y=1#z')).toBe(
            'https://example.com/x?y=1#z'
        );
    });

    it('rejects dangerous schemes', () => {
        expect(safeExternalHref('javascript:alert(document.cookie)')).toBeNull();
        expect(safeExternalHref('JavaScript:alert(1)')).toBeNull();
        expect(safeExternalHref('data:text/html,<script>alert(1)</script>')).toBeNull();
        expect(safeExternalHref('vbscript:msgbox(1)')).toBeNull();
        expect(safeExternalHref('file:///etc/passwd')).toBeNull();
    });

    it('rejects relative, malformed, empty, and nullish input', () => {
        expect(safeExternalHref('/relative/path')).toBeNull();
        expect(safeExternalHref('not a url')).toBeNull();
        expect(safeExternalHref('')).toBeNull();
        expect(safeExternalHref(null)).toBeNull();
        expect(safeExternalHref(undefined)).toBeNull();
    });
});
