/**
 * Single-source HTML sanitizer for merchant-authored content.
 *
 * Brainerce returns RICH_TEXT.html, PAGE.html, and FAQ answer values as raw
 * HTML — the server does NOT pre-sanitize because some merchants embed
 * iframes (e.g. YouTube). Run every merchant-authored HTML string through
 * this wrapper before injecting via `dangerouslySetInnerHTML`.
 *
 *   const safe = sanitizeHtml(rawHtml);
 *   <div dangerouslySetInnerHTML={{ __html: safe }} />
 *
 * Uses isomorphic-dompurify so the same call works in Server Components and
 * Client Components.
 */
import DOMPurify from 'isomorphic-dompurify';

const DEFAULT_CONFIG = {
  // Allow iframes for embedded videos/maps the merchant may include.
  ADD_TAGS: ['iframe'],
  ADD_ATTR: ['allow', 'allowfullscreen', 'frameborder', 'scrolling', 'target', 'rel'],
};

export function sanitizeHtml(html: string | null | undefined): string {
  if (!html) return '';
  return DOMPurify.sanitize(html, DEFAULT_CONFIG) as unknown as string;
}