const ALLOWED_PROTOCOLS = /^(https?:\/\/|data:image\/)/

/**
 * Validates an image URL against allowed schemes.
 *
 * Accepts `http://`, `https://`, and `data:image/*` URIs. Rejects
 * everything else (`javascript:`, `data:text/`, `file:`, `blob:`, etc.)
 * to prevent XSS via unsafe `src` attributes in rendered HTML widgets.
 *
 * @param url - The raw URL from user-supplied markdown or drop/paste.
 * @returns The URL unchanged if allowed, or `null` if rejected.
 */
export function safeImageSrc(url: string): string | null {
  if (ALLOWED_PROTOCOLS.test(url)) {
    return url
  }
  return null
}
