import { describe, expect, it } from "vitest"
import { safeImageSrc } from "@/lib/safe-image-src"

describe("safeImageSrc", () => {
  it("allows http URLs", () => {
    expect(safeImageSrc("http://example.com/photo.jpg")).toBe(
      "http://example.com/photo.jpg",
    )
  })

  it("allows https URLs", () => {
    expect(safeImageSrc("https://cdn.example.com/images/hero.webp")).toBe(
      "https://cdn.example.com/images/hero.webp",
    )
  })

  it("allows data:image URIs", () => {
    const uri =
      "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk"
    expect(safeImageSrc(uri)).toBe(uri)
  })

  it("rejects javascript: URLs", () => {
    expect(safeImageSrc("javascript:alert(1)")).toBeNull()
  })

  it("rejects data:text URIs", () => {
    expect(safeImageSrc("data:text/html,<script>alert(1)</script>")).toBeNull()
  })

  it("rejects file: URLs", () => {
    expect(safeImageSrc("file:///etc/passwd")).toBeNull()
  })

  it("rejects empty string", () => {
    expect(safeImageSrc("")).toBeNull()
  })

  it("rejects protocol-relative URL without scheme", () => {
    expect(safeImageSrc("//evil.com/xss.svg")).toBeNull()
  })

  it("rejects blob: URLs", () => {
    expect(safeImageSrc("blob:https://example.com/uuid")).toBeNull()
  })
})
