import { describe, expect, it } from 'vitest';
import { defaultReview } from '../../src/domain/review';
import { buildRecord } from '../../src/analysis/record-builder';
import { buildDashboardHtml } from '../../src/exports/dashboard-export';

describe('dashboard export', () => {
  it('escapes imported and reviewed values in the generated HTML', () => {
    const record = buildRecord({
      row: ['<img src=x onerror=alert(1)>', 'High'],
      headers: ['Name', 'Severity'],
      index: 0,
      sheetName: 'Findings'
    });
    const html = buildDashboardHtml('<script>alert(1)</script>', [{
      record,
      sheetName: '<b>Sheet</b>',
      review: { ...defaultReview(), owner: '<svg onload=alert(1)>' }
    }], { now: () => new Date('2026-07-17T10:00:00.000Z') });

    expect(html).not.toContain('<script>alert(1)</script>');
    expect(html).not.toContain('<img src=x');
    expect(html).not.toContain('<svg onload');
    expect(html).toContain('&lt;script&gt;alert(1)&lt;/script&gt;');
    expect(html).toContain('2026');
  });
});