module.exports = {
    friendlyName: 'Sanitize HTML content',

    description: 'Sanitize HTML content to prevent XSS attacks',

    inputs: {
        html: {
            type: 'string',
            required: true,
            description: 'HTML content to sanitize'
        },
        allowedTags: {
            type: 'ref',
            defaultsTo: ['p', 'ul', 'ol', 'li', 'b', 'i', 'strong', 'em', 'a', 'br', 'h1', 'h2', 'h3', 'span', 'div'],
            description: 'Array of allowed HTML tags'
        },
        allowedAttributes: {
            type: 'ref',
            defaultsTo: {
                'a': ['href', 'title', 'target'],
                'img': ['src', 'alt', 'title'],
                'span': ['class'],
                'div': ['class']
            },
            description: 'Object defining allowed attributes per tag'
        }
    },

    fn: async function (inputs, exits) {
        const { html, allowedTags, allowedAttributes } = inputs;

        if (!html || typeof html !== 'string') {
            return exits.success('');
        }

        try {
            // Vérifier si sanitize-html est disponible
            if (typeof sanitizeHtml === 'undefined') {
                // Fallback basique si la bibliothèque n'est pas disponible
                sails.log.warn('sanitize-html library not available, using basic sanitization');

                // Supprimer tous les tags HTML et garder seulement le texte
                const basicSanitized = html
                    .replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '')
                    .replace(/<[^>]*>/g, '')
                    .replace(/&/g, '&amp;')
                    .replace(/</g, '&lt;')
                    .replace(/>/g, '&gt;')
                    .replace(/"/g, '&quot;')
                    .replace(/'/g, '&#x27;');

                return exits.success(basicSanitized);
            }

            // Utiliser sanitize-html avec les options sécurisées
            const sanitized = sanitizeHtml(html, {
                allowedTags: allowedTags,
                allowedAttributes: allowedAttributes,
                allowedSchemes: ['http', 'https', 'mailto', 'tel'],
                allowedSchemesByTag: {
                    'a': ['http', 'https', 'mailto', 'tel'],
                    'img': ['http', 'https', 'data']
                },
                allowedSchemesAppliedToAttributes: ['href', 'src'],
                allowProtocolRelative: false,
                enforceHtmlBoundary: true,
                disallowedTagsMode: 'recursiveEscape'
            });

            return exits.success(sanitized);

        } catch (error) {
            sails.log.error('Error in HTML sanitization:', error);
            // En cas d'erreur, retourner le HTML échappé de manière sécurisée
            const fallbackSanitized = html
                .replace(/<[^>]*>/g, '')
                .replace(/&/g, '&amp;')
                .replace(/</g, '&lt;')
                .replace(/>/g, '&gt;');

            return exits.success(fallbackSanitized);
        }
    }
};
