import DOMPurify from "dompurify";

/**
 * Sanitize an HTML string before rendering with dangerouslySetInnerHTML.
 * Strips all executable content (scripts, event handlers, etc.) while
 * preserving safe formatting markup.
 */
export function sanitizeHtml(html: string): string {
  if (!html) return "";
  return DOMPurify.sanitize(html, {
    USE_PROFILES: { html: true },
    FORBID_TAGS: ["script", "style", "iframe", "object", "embed", "form"],
    FORBID_ATTR: ["onerror", "onload", "onclick", "onmouseover"],
  });
}
