import { describe, expect, it } from 'vitest'
import { safeImageURL } from '../../assets/src/elements/image'

// E7 golem15-seo-image: which stored URLs the preview may load.

describe('E7 safeImageURL', () => {
  it('accepts a path and an http(s) URL', () => {
    for (const url of ['/media/a.png', 'https://cdn.example/a.png', 'HTTP://cdn.example/a.png']) {
      expect(safeImageURL(url), url).toBe(true)
    }
  })

  it('refuses addresses a browser reads as another host or another scheme (WR-20)', () => {
    for (const url of ['//evil.example/x.png', '/\\evil.example/x.png', 'javascript:alert(1)', 'data:image/png;base64,AA', 'a.png', '']) {
      expect(safeImageURL(url), url).toBe(false)
    }
  })
})