'use client'

const blockedHtmlPreviewTags = new Set(['embed', 'link', 'meta', 'object', 'script', 'style'])

const urlAttributes = new Set(['href', 'src'])

export function sanitizeHtmlPreview(html: string) {
  const template = document.createElement('template')
  template.innerHTML = html
  const elementsToRemove: Element[] = []
  const walker = document.createTreeWalker(template.content, NodeFilter.SHOW_ELEMENT)

  while (walker.nextNode()) {
    const element = walker.currentNode as HTMLElement
    const tagName = element.tagName.toLowerCase()

    if (blockedHtmlPreviewTags.has(tagName)) {
      elementsToRemove.push(element)
      continue
    }

    for (const attr of Array.from(element.attributes)) {
      const attrName = attr.name.toLowerCase()
      const attrValue = attr.value.trim().toLowerCase()

      if (
        attrName.startsWith('on') ||
        attrName === 'srcdoc' ||
        (urlAttributes.has(attrName) && attrValue.startsWith('javascript:'))
      ) {
        element.removeAttribute(attr.name)
      }
    }
  }

  for (const element of elementsToRemove) {
    element.remove()
  }

  return template.innerHTML
}