import "server-only";
import { marked } from "marked";
import sanitizeHtml from "sanitize-html";

const ALLOWED = {
  allowedTags: [
    "h1",
    "h2",
    "h3",
    "h4",
    "h5",
    "h6",
    "p",
    "br",
    "hr",
    "ul",
    "ol",
    "li",
    "blockquote",
    "pre",
    "code",
    "em",
    "strong",
    "del",
    "a",
    "table",
    "thead",
    "tbody",
    "tr",
    "th",
    "td",
    "sup",
    "sub",
    "span",
  ],
  allowedAttributes: {
    a: ["href", "title", "rel"],
    code: ["class"],
    span: ["class"],
    th: ["align"],
    td: ["align"],
  },
  allowedSchemes: ["http", "https", "mailto"],
  allowProtocolRelative: false,
  transformTags: { a: sanitizeHtml.simpleTransform("a", { rel: "nofollow noopener noreferrer" }) },
  disallowedTagsMode: "discard" as const,
};

/** Markdown → sanitized HTML with a strict allowlist (no images, no scripts, no raw HTML passthrough). */
export function renderMarkdown(md: string): string {
  const html = marked.parse(md, { async: false, gfm: true, breaks: false }) as string;
  return sanitizeHtml(html, ALLOWED);
}