// 可独立测试的 HTML 预览安全策略。脚本和 HTTPS 外部资源可运行，满足图表、
// 地图、WebGL 等通用产物；iframe 保持 opaque origin，不能触达 zcbot 宿主权限。
// 使用同源静态宿主页 + postMessage，而非 iframe.srcdoc / blob URL：部分 WebView
// 对 srcdoc 支持不完整，原生壳的 URL 白名单又常会误拦 blob: 子 frame。
export const HTML_PREVIEW_CSP = "default-src 'none'; " +
  "script-src 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval' https:; " +
  "style-src 'unsafe-inline' https:; img-src data: blob: https:; " +
  "media-src data: blob: https:; font-src data: https:; connect-src https:; " +
  "worker-src blob:; child-src blob: https:; frame-src https:; manifest-src https:; " +
  "object-src 'none'; form-action 'none'; base-uri 'none'";
export const HTML_PREVIEW_SANDBOX = "allow-scripts";
export const HTML_PREVIEW_HOST = "/static/html_preview_host.html";

export function htmlPreviewDocument(text) {
  const meta = `<meta http-equiv="Content-Security-Policy" content="${HTML_PREVIEW_CSP}">`;
  const source = String(text || "");
  if (/<head(?:\s[^>]*)?>/i.test(source)) {
    return source.replace(/<head(?:\s[^>]*)?>/i, (head) => head + meta);
  }
  return `<head>${meta}</head>${source}`;
}

export function configureHtmlPreviewFrame(frame, text, title = "HTML 文件预览") {
  frame.title = title;
  frame.setAttribute("sandbox", HTML_PREVIEW_SANDBOX);
  frame.referrerPolicy = "no-referrer";
  const document = htmlPreviewDocument(text);
  frame.addEventListener("load", () => {
    frame.contentWindow.postMessage({ type: "zcbot-html-preview", document }, "*");
  }, { once: true });
  frame.src = HTML_PREVIEW_HOST;
  return frame;
}
