@consilioweb/payload-support 0.15.0 → 1.0.0

package/src/__tests__/integration/mentions-invoice.test.ts

@@ -0,0 +1,50 @@
+import { describe, it, expect } from 'vitest'
+import { buildTestPayload } from './buildTestPayload'
+import { createInvoiceEndpoint } from '../../endpoints/invoice'
+import { resolveSlugs } from '../../utils/slugs'
+
+const slugs = resolveSlugs({ users: 'users' })
+const PW = 'test-pw-12345'
+
+/** @mentions (P2 #6): `@email` in a message resolves to agent IDs on `mentions`. */
+describe('@mentions (P2 #6)', () => {
+  it('resolves @email mentions in a message body to agent IDs', async () => {
+    const payload = await buildTestPayload()
+    const agent = await payload.create({ collection: 'users', data: { email: 'agent@example.com', password: PW } as never, overrideAccess: true })
+    const c = await payload.create({ collection: 'support-clients', data: { email: 'mc@example.com', password: PW, firstName: 'M', lastName: 'C', company: 'C' }, overrideAccess: true })
+    const t = await payload.create({ collection: 'tickets', data: { subject: 'mention', client: c.id, status: 'open', priority: 'normal' }, overrideAccess: true })
+
+    const m = await payload.create({
+      collection: 'ticket-messages',
+      data: { ticket: t.id, body: 'Hey @agent@example.com can you check this?', authorType: 'admin', isInternal: true },
+      overrideAccess: true,
+    })
+
+    const reread = await payload.findByID({ collection: 'ticket-messages', id: m.id, depth: 0, overrideAccess: true })
+    const mentions = (reread as { mentions?: Array<number | string> }).mentions || []
+    expect(mentions.map(String)).toContain(String(agent.id))
+  }, 60_000)
+})
+
+/** Invoice (P2 #6): a print-ready HTML invoice with the correct total. */
+describe('printable invoice (P2 #6)', () => {
+  it('renders an HTML invoice summing billable tickets', async () => {
+    const payload = await buildTestPayload()
+    const c = await payload.create({ collection: 'support-clients', data: { email: 'inv@example.com', password: PW, firstName: 'I', lastName: 'V', company: 'ACME Corp' }, overrideAccess: true })
+    const t1 = await payload.create({ collection: 'tickets', data: { subject: 'inv-a', client: c.id, status: 'resolved', priority: 'normal', billable: true, billedAmount: 100 }, overrideAccess: true })
+    await payload.create({ collection: 'tickets', data: { subject: 'inv-b', client: c.id, status: 'resolved', priority: 'normal', billable: true, billedAmount: 50 }, overrideAccess: true })
+
+    const admin = await payload.create({ collection: 'users', data: { email: 'inv-admin@example.com', password: PW } as never, overrideAccess: true })
+    const from = new Date(Date.now() - 86_400_000).toISOString().slice(0, 10)
+    const to = new Date(Date.now() + 86_400_000).toISOString().slice(0, 10)
+    const ep = createInvoiceEndpoint(slugs)
+    const req = { payload, user: { ...admin, collection: 'users' }, url: `http://localhost/api/support/billing/invoice?from=${from}&to=${to}`, headers: new Headers({}) }
+    const res = await (ep.handler as (r: unknown) => Promise<Response>)(req)
+
+    expect(res.headers.get('content-type')).toMatch(/text\/html/)
+    const body = await res.text()
+    expect(body).toContain('150.00 €') // 100 + 50
+    expect(body).toContain(String(t1.ticketNumber))
+    expect(body).toContain('ACME Corp')
+  }, 60_000)
+})

package/src/__tests__/integration/nps.test.ts

@@ -0,0 +1,37 @@
+import { describe, it, expect } from 'vitest'
+import { buildTestPayload } from './buildTestPayload'
+import { createAdminStatsEndpoint } from '../../endpoints/admin-stats'
+import { resolveSlugs } from '../../utils/slugs'
+
+const slugs = resolveSlugs({ users: 'users' })
+const PW = 'test-pw-12345'
+
+/**
+ * NPS (P2): satisfaction surveys can carry an NPS score (0-10), and admin-stats
+ * computes the Net Promoter Score = %promoters(9-10) − %detractors(0-6).
+ */
+describe('NPS (P2)', () => {
+  it('stores NPS scores and computes the NPS in admin-stats', async () => {
+    const payload = await buildTestPayload()
+    const c = await payload.create({ collection: 'support-clients', data: { email: 'nps@example.com', password: PW, firstName: 'N', lastName: 'P', company: 'C' }, overrideAccess: true })
+
+    // 3 promoters (10,9,9), 1 passive (7), 2 detractors (3,5) → (3-2)/6 = 16.67% ≈ 17
+    for (const nps of [10, 9, 9, 7, 3, 5]) {
+      await payload.create({ collection: 'satisfaction-surveys', data: { source: 'ticket', client: c.id, nps }, overrideAccess: true })
+    }
+
+    const admin = await payload.create({ collection: 'users', data: { email: 'nps-admin@example.com', password: PW } as never, overrideAccess: true })
+    const ep = createAdminStatsEndpoint(slugs)
+    const req = {
+      payload,
+      user: { ...admin, collection: 'users' },
+      url: 'http://localhost/api/support/admin-stats',
+      headers: new Headers({}),
+    }
+    const res = await (ep.handler as (r: unknown) => Promise<Response>)(req)
+    const json = await res.json()
+
+    expect(json.npsCount).toBe(6)
+    expect(json.npsScore).toBe(17)
+  }, 60_000)
+})

package/src/__tests__/integration/sanitization.test.ts

@@ -0,0 +1,35 @@
+import { describe, it, expect } from 'vitest'
+import { buildTestPayload } from './buildTestPayload'
+
+const PW = 'test-pw-12345'
+
+/**
+ * Validates that the bodyHtml sanitization (P0-1) is actually wired into the
+ * TicketMessages beforeChange hook — i.e. stored HTML is stripped of script /
+ * event handlers before it can be persisted and later rendered.
+ */
+describe('stored-XSS sanitization on write (P0-1)', () => {
+  it('strips <script> and inline handlers from bodyHtml at persistence', async () => {
+    const payload = await buildTestPayload()
+    const c = await payload.create({ collection: 'support-clients', data: { email: 'xss@example.com', password: PW, firstName: 'X', lastName: 'S', company: 'C' }, overrideAccess: true })
+    const t = await payload.create({ collection: 'tickets', data: { subject: 'xss', client: c.id, status: 'open', priority: 'normal' }, overrideAccess: true })
+
+    const m = await payload.create({
+      collection: 'ticket-messages',
+      data: {
+        ticket: t.id,
+        body: 'hello',
+        bodyHtml: '<img src=x onerror=alert(1)><script>alert(2)</script><a href="javascript:alert(3)">x</a><b>kept</b>',
+        authorType: 'client',
+        authorClient: c.id,
+      },
+      overrideAccess: true,
+    })
+
+    const stored = (m as { bodyHtml?: string }).bodyHtml || ''
+    expect(stored).not.toMatch(/onerror/i)
+    expect(stored).not.toMatch(/<script/i)
+    expect(stored).not.toMatch(/javascript:/i)
+    expect(stored).toContain('<b>kept</b>') // legitimate formatting preserved
+  }, 60_000)
+})

package/src/__tests__/integration/sla-pause.test.ts

@@ -0,0 +1,39 @@
+import { describe, it, expect } from 'vitest'
+import { buildTestPayload } from './buildTestPayload'
+
+const PW = 'test-pw-12345'
+
+/**
+ * SLA pause-on-hold (P2): time spent waiting on the client must not count against
+ * the resolution SLA — the resolution deadline is pushed forward by the paused span.
+ */
+describe('SLA pause-on-hold (P2)', () => {
+  it('extends the resolution deadline by the time spent in waiting_client', async () => {
+    const payload = await buildTestPayload()
+    await payload.create({ collection: 'sla-policies', data: { name: 'P', priority: 'normal', firstResponseTime: 60, resolutionTime: 240, businessHoursOnly: false, isDefault: true }, overrideAccess: true })
+    const c = await payload.create({ collection: 'support-clients', data: { email: 'pause@example.com', password: PW, firstName: 'P', lastName: 'H', company: 'C' }, overrideAccess: true })
+    const t = await payload.create({ collection: 'tickets', data: { subject: 'pause', client: c.id, status: 'open', priority: 'normal' }, overrideAccess: true })
+
+    const before = await payload.findByID({ collection: 'tickets', id: t.id, overrideAccess: true })
+    const dueBefore = new Date(before.slaResolutionDue as string).getTime()
+    expect(dueBefore).toBeGreaterThan(0)
+
+    // Enter hold → the clock should pause.
+    await payload.update({ collection: 'tickets', id: t.id, data: { status: 'waiting_client' }, overrideAccess: true })
+    const mid = await payload.findByID({ collection: 'tickets', id: t.id, overrideAccess: true })
+    expect(mid.slaPausedAt).toBeTruthy()
+
+    // Simulate ~2h of waiting by backdating the pause marker (status unchanged → hook no-op).
+    const twoHoursAgo = new Date(Date.now() - 2 * 3_600_000).toISOString()
+    await payload.update({ collection: 'tickets', id: t.id, data: { slaPausedAt: twoHoursAgo }, overrideAccess: true })
+
+    // Leave hold → deadline extended, pause cleared.
+    await payload.update({ collection: 'tickets', id: t.id, data: { status: 'open' }, overrideAccess: true })
+    const after = await payload.findByID({ collection: 'tickets', id: t.id, overrideAccess: true })
+
+    expect(after.slaPausedAt).toBeFalsy()
+    const extensionMs = new Date(after.slaResolutionDue as string).getTime() - dueBefore
+    expect(extensionMs).toBeGreaterThan(1.9 * 3_600_000)
+    expect(extensionMs).toBeLessThan(2.2 * 3_600_000)
+  }, 60_000)
+})

package/src/__tests__/integration/smoke.test.ts

@@ -0,0 +1,26 @@
+import { describe, it, expect } from 'vitest'
+import { buildTestPayload } from './buildTestPayload'
+
+describe('integration harness', () => {
+  it('boots Payload with the support plugin and round-trips a ticket', async () => {
+    const payload = await buildTestPayload()
+
+    const client = await payload.create({
+      collection: 'support-clients',
+      data: { email: 'smoke@example.com', password: 'pw-smoke-123', firstName: 'Smoke', lastName: 'Test', company: 'ACME' },
+      overrideAccess: true,
+    })
+
+    const ticket = await payload.create({
+      collection: 'tickets',
+      data: { subject: 'Smoke ticket', client: client.id, status: 'open', priority: 'normal' },
+      overrideAccess: true,
+    })
+
+    expect(ticket.id).toBeTruthy()
+    expect(ticket.ticketNumber).toMatch(/^TK-/)
+
+    const reread = await payload.findByID({ collection: 'tickets', id: ticket.id, overrideAccess: true })
+    expect(reread.subject).toBe('Smoke ticket')
+  }, 60_000)
+})

package/src/__tests__/integration/snooze.test.ts

@@ -0,0 +1,68 @@
+import { describe, it, expect } from 'vitest'
+import { buildTestPayload } from './buildTestPayload'
+import { createProcessSnoozeEndpoint } from '../../endpoints/process-snooze'
+import { resolveSlugs } from '../../utils/slugs'
+
+const PW = 'test-pw-12345'
+const slugs = resolveSlugs({ users: 'users' })
+
+async function makeClient(payload: Awaited<ReturnType<typeof buildTestPayload>>, email: string) {
+  return payload.create({ collection: 'support-clients', data: { email, password: PW, firstName: 'S', lastName: 'N', company: 'C' }, overrideAccess: true })
+}
+
+/**
+ * Snooze wake-up cron (P2): a snoozed ticket must be hidden from the inbox while
+ * `snoozeUntil` is in the future, resurface once it passes, and the cron must
+ * clear expired snoozes (audit trail) while leaving future ones untouched.
+ */
+describe('snooze wake-up cron + inbox hide (P2)', () => {
+  it('cron clears expired snoozeUntil and leaves future ones', async () => {
+    const payload = await buildTestPayload()
+    process.env.CRON_SECRET = 'test-cron-secret'
+    const c = await makeClient(payload, 'snz@example.com')
+    const past = new Date(Date.now() - 3_600_000).toISOString()
+    const future = new Date(Date.now() + 3_600_000).toISOString()
+    const tPast = await payload.create({ collection: 'tickets', data: { subject: 'past', client: c.id, status: 'open', priority: 'normal', snoozeUntil: past }, overrideAccess: true })
+    const tFuture = await payload.create({ collection: 'tickets', data: { subject: 'future', client: c.id, status: 'open', priority: 'normal', snoozeUntil: future }, overrideAccess: true })
+
+    const ep = createProcessSnoozeEndpoint(slugs)
+    const req = { payload, headers: new Headers({ 'x-cron-secret': 'test-cron-secret' }) }
+    const res = await (ep.handler as (r: unknown) => Promise<Response>)(req)
+    const json = await res.json()
+    expect(json.ok).toBe(true)
+    expect(json.processed).toBeGreaterThanOrEqual(1)
+
+    const rePast = await payload.findByID({ collection: 'tickets', id: tPast.id, overrideAccess: true })
+    const reFuture = await payload.findByID({ collection: 'tickets', id: tFuture.id, overrideAccess: true })
+    expect(rePast.snoozeUntil).toBeFalsy() // woken up
+    expect(reFuture.snoozeUntil).toBeTruthy() // still snoozed
+  }, 60_000)
+
+  it('rejects the cron without the secret', async () => {
+    const payload = await buildTestPayload()
+    process.env.CRON_SECRET = 'test-cron-secret'
+    const ep = createProcessSnoozeEndpoint(slugs)
+    const req = { payload, headers: new Headers({}) }
+    const res = await (ep.handler as (r: unknown) => Promise<Response>)(req)
+    expect(res.status).toBe(401)
+  }, 60_000)
+
+  it('the inbox snooze-hide query excludes future-snoozed tickets', async () => {
+    const payload = await buildTestPayload()
+    const c = await makeClient(payload, 'snz2@example.com')
+    const visible = await payload.create({ collection: 'tickets', data: { subject: 'visible', client: c.id, status: 'open', priority: 'normal' }, overrideAccess: true })
+    const hidden = await payload.create({ collection: 'tickets', data: { subject: 'hidden', client: c.id, status: 'open', priority: 'normal', snoozeUntil: new Date(Date.now() + 3_600_000).toISOString() }, overrideAccess: true })
+
+    const nowIso = new Date().toISOString()
+    // Same where the inbox builds via query params.
+    const found = await payload.find({
+      collection: 'tickets',
+      where: { and: [{ or: [{ snoozeUntil: { exists: false } }, { snoozeUntil: { less_than_equal: nowIso } }] }] },
+      limit: 200,
+      overrideAccess: true,
+    })
+    const ids = found.docs.map((t) => t.id)
+    expect(ids).toContain(visible.id)
+    expect(ids).not.toContain(hidden.id)
+  }, 60_000)
+})

package/src/__tests__/integration/teams.test.ts

@@ -0,0 +1,38 @@
+import { describe, it, expect } from 'vitest'
+import { buildTestPayload } from './buildTestPayload'
+
+const PW = 'test-pw-12345'
+
+/**
+ * Multi-team / workspaces (roadmap): with `SUPPORT_TEAM_SCOPING` enabled, an agent
+ * only sees tickets of the teams they belong to (plus team-less tickets).
+ */
+describe('multi-team scoping (roadmap)', () => {
+  it('scopes ticket visibility to the agent\'s teams when enabled', async () => {
+    process.env.SUPPORT_TEAM_SCOPING = '1'
+    const payload = await buildTestPayload()
+
+    const agentA = await payload.create({ collection: 'users', data: { email: 'team-a@example.com', password: PW } as never, overrideAccess: true })
+    const agentB = await payload.create({ collection: 'users', data: { email: 'team-b@example.com', password: PW } as never, overrideAccess: true })
+    const teamA = await payload.create({ collection: 'support-teams', data: { name: 'Team A', members: [agentA.id] }, overrideAccess: true })
+    const teamB = await payload.create({ collection: 'support-teams', data: { name: 'Team B', members: [agentB.id] }, overrideAccess: true })
+
+    const c = await payload.create({ collection: 'support-clients', data: { email: 'team-c@example.com', password: PW, firstName: 'T', lastName: 'C', company: 'C' }, overrideAccess: true })
+    const tA = await payload.create({ collection: 'tickets', data: { subject: 'A', client: c.id, status: 'open', priority: 'normal', team: teamA.id }, overrideAccess: true })
+    const tB = await payload.create({ collection: 'tickets', data: { subject: 'B', client: c.id, status: 'open', priority: 'normal', team: teamB.id }, overrideAccess: true })
+    const tNone = await payload.create({ collection: 'tickets', data: { subject: 'none', client: c.id, status: 'open', priority: 'normal' }, overrideAccess: true })
+
+    const asA = await payload.find({
+      collection: 'tickets',
+      overrideAccess: false,
+      user: { ...agentA, collection: 'users' } as never,
+      limit: 200,
+    })
+    const ids = asA.docs.map((t) => String(t.id))
+    expect(ids).toContain(String(tA.id))
+    expect(ids).toContain(String(tNone.id)) // team-less tickets stay visible
+    expect(ids).not.toContain(String(tB.id)) // other team's ticket hidden
+
+    delete process.env.SUPPORT_TEAM_SCOPING
+  }, 60_000)
+})

package/src/__tests__/rateLimiter.test.ts

@@ -0,0 +1,89 @@
+import { describe, it, expect, vi, afterEach } from 'vitest'
+import { RateLimiter } from '../utils/rateLimiter'
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('RateLimiter — under the limit', () => {
+  it('allows the first request', () => {
+    const limiter = new RateLimiter(60_000, 5)
+    expect(limiter.check('user:1')).toBe(false)
+  })
+
+  it('allows requests up to the maximum (maxRequests = 3)', () => {
+    const limiter = new RateLimiter(60_000, 3)
+    expect(limiter.check('key')).toBe(false) // count = 1
+    expect(limiter.check('key')).toBe(false) // count = 2
+    expect(limiter.check('key')).toBe(false) // count = 3
+  })
+})
+
+describe('RateLimiter — exceeding the limit', () => {
+  it('blocks the request when count exceeds maxRequests', () => {
+    const limiter = new RateLimiter(60_000, 2)
+    limiter.check('key') // count = 1
+    limiter.check('key') // count = 2
+    // count = 3 > maxRequests(2) → blocked
+    expect(limiter.check('key')).toBe(true)
+  })
+
+  it('keeps blocking subsequent requests after limit exceeded', () => {
+    const limiter = new RateLimiter(60_000, 1)
+    limiter.check('key') // count = 1, passes
+    expect(limiter.check('key')).toBe(true)  // count = 2 → blocked
+    expect(limiter.check('key')).toBe(true)  // count = 3 → still blocked
+  })
+})
+
+describe('RateLimiter — reset', () => {
+  it('allows requests again after manual reset', () => {
+    const limiter = new RateLimiter(60_000, 1)
+    limiter.check('key') // count = 1
+    expect(limiter.check('key')).toBe(true) // blocked
+    limiter.reset('key')
+    expect(limiter.check('key')).toBe(false) // reset → allowed again
+  })
+
+  it('reset only affects the targeted key', () => {
+    const limiter = new RateLimiter(60_000, 1)
+    limiter.check('keyA')
+    limiter.check('keyA') // keyA blocked
+    limiter.check('keyB')
+    limiter.check('keyB') // keyB blocked
+
+    limiter.reset('keyA')
+    expect(limiter.check('keyA')).toBe(false) // keyA allowed
+    expect(limiter.check('keyB')).toBe(true)  // keyB still blocked
+  })
+})
+
+describe('RateLimiter — window expiry', () => {
+  it('resets the counter automatically after the window expires', () => {
+    vi.useFakeTimers()
+    const windowMs = 1_000
+    const limiter = new RateLimiter(windowMs, 2)
+
+    limiter.check('key') // count = 1
+    limiter.check('key') // count = 2
+    expect(limiter.check('key')).toBe(true) // blocked
+
+    // Advance past the window
+    vi.advanceTimersByTime(windowMs + 1)
+
+    // The next check should open a new window
+    expect(limiter.check('key')).toBe(false) // new window, count = 1
+  })
+})
+
+describe('RateLimiter — key independence', () => {
+  it('tracks different keys independently', () => {
+    const limiter = new RateLimiter(60_000, 1)
+    // key-A hits limit
+    limiter.check('key-A') // count = 1
+    expect(limiter.check('key-A')).toBe(true) // blocked
+
+    // key-B untouched
+    expect(limiter.check('key-B')).toBe(false) // fresh key, allowed
+  })
+})

package/src/__tests__/sanitizeHtml.test.ts

@@ -0,0 +1,165 @@
+import { describe, it, expect } from 'vitest'
+import { sanitizeMessageHtml } from '../utils/sanitizeHtml'
+
+describe('sanitizeMessageHtml — XSS vectors stripped', () => {
+  it('strips <script> tags entirely', () => {
+    const result = sanitizeMessageHtml('<script>alert(1)</script>hi')
+    expect(result).not.toContain('<script')
+    expect(result).not.toContain('alert')
+    expect(result).toContain('hi')
+  })
+
+  it('strips <script> with attributes', () => {
+    const result = sanitizeMessageHtml('<script src="evil.js" type="text/javascript"></script>safe')
+    expect(result).not.toContain('<script')
+    expect(result).toContain('safe')
+  })
+
+  it('strips onerror inline event handlers on <img>', () => {
+    const result = sanitizeMessageHtml('<img src="x" onerror="alert(1)">')
+    expect(result).not.toContain('onerror')
+  })
+
+  it('strips onclick inline event handlers', () => {
+    const result = sanitizeMessageHtml('<span onclick="stealCookies()">click me</span>')
+    expect(result).not.toContain('onclick')
+    expect(result).toContain('click me')
+  })
+
+  it('strips onmouseover event handler', () => {
+    const result = sanitizeMessageHtml('<div onmouseover="evil()">hover</div>')
+    expect(result).not.toContain('onmouseover')
+  })
+
+  it('strips javascript: URI in anchor href', () => {
+    const result = sanitizeMessageHtml('<a href="javascript:alert(1)">x</a>')
+    expect(result).not.toContain('javascript:')
+  })
+
+  it('strips javascript: URI with mixed case', () => {
+    const result = sanitizeMessageHtml('<a href="JaVaScRiPt:alert(1)">x</a>')
+    expect(result).not.toContain('avascript:')
+    expect(result).not.toContain('href="JaVaScRiPt')
+  })
+
+  it('strips <iframe>', () => {
+    const result = sanitizeMessageHtml('<iframe src="https://evil.com"></iframe>text')
+    expect(result).not.toContain('<iframe')
+    expect(result).toContain('text')
+  })
+
+  it('strips <embed>', () => {
+    const result = sanitizeMessageHtml('<embed src="payload.swf">text')
+    expect(result).not.toContain('<embed')
+    expect(result).toContain('text')
+  })
+
+  it('strips <object>', () => {
+    const result = sanitizeMessageHtml('<object data="evil.swf"></object>after')
+    expect(result).not.toContain('<object')
+    expect(result).toContain('after')
+  })
+})
+
+describe('sanitizeMessageHtml — legitimate formatting preserved', () => {
+  it('preserves <b> tag', () => {
+    const result = sanitizeMessageHtml('<b>bold text</b>')
+    expect(result).toContain('<b>bold text</b>')
+  })
+
+  it('preserves <strong> tag', () => {
+    const result = sanitizeMessageHtml('<strong>important</strong>')
+    expect(result).toContain('<strong>important</strong>')
+  })
+
+  it('preserves <a href="https://..."> anchor', () => {
+    const result = sanitizeMessageHtml('<a href="https://example.com">link</a>')
+    expect(result).toContain('href="https://example.com"')
+    expect(result).toContain('link')
+  })
+
+  it('adds rel="noopener noreferrer nofollow" to links (tabnabbing defense)', () => {
+    const result = sanitizeMessageHtml('<a href="https://example.com">link</a>')
+    expect(result).toContain('rel="noopener noreferrer nofollow"')
+  })
+
+  it('preserves <ul><li> list structure', () => {
+    const result = sanitizeMessageHtml('<ul><li>item 1</li><li>item 2</li></ul>')
+    expect(result).toContain('<ul>')
+    expect(result).toContain('<li>item 1</li>')
+    expect(result).toContain('<li>item 2</li>')
+  })
+
+  it('preserves <ol> numbered list', () => {
+    const result = sanitizeMessageHtml('<ol><li>first</li></ol>')
+    expect(result).toContain('<ol>')
+    expect(result).toContain('<li>first</li>')
+  })
+
+  it('preserves safe inline style: color', () => {
+    const result = sanitizeMessageHtml('<span style="color: red">colored</span>')
+    // sanitize-html normalises CSS by stripping the space after ':'
+    expect(result).toContain('color:red')
+    expect(result).toContain('colored')
+  })
+
+  it('preserves safe inline style: color hex', () => {
+    const result = sanitizeMessageHtml('<span style="color: #ff0000">red</span>')
+    expect(result).toContain('color:#ff0000')
+  })
+
+  it('preserves text-align style', () => {
+    const result = sanitizeMessageHtml('<p style="text-align: center">centered</p>')
+    // sanitize-html normalises CSS by stripping the space after ':'
+    expect(result).toContain('text-align:center')
+  })
+
+  it('preserves <blockquote>', () => {
+    const result = sanitizeMessageHtml('<blockquote>quoted text</blockquote>')
+    expect(result).toContain('<blockquote>')
+    expect(result).toContain('quoted text')
+  })
+
+  it('preserves <code> and <pre>', () => {
+    const result = sanitizeMessageHtml('<pre><code>const x = 1;</code></pre>')
+    expect(result).toContain('<pre>')
+    expect(result).toContain('<code>')
+    expect(result).toContain('const x = 1;')
+  })
+
+  it('preserves heading tags h1-h3', () => {
+    const result = sanitizeMessageHtml('<h1>Title</h1><h2>Sub</h2><h3>Sub2</h3>')
+    expect(result).toContain('<h1>Title</h1>')
+    expect(result).toContain('<h2>Sub</h2>')
+    expect(result).toContain('<h3>Sub2</h3>')
+  })
+})
+
+describe('sanitizeMessageHtml — dangerous style values stripped', () => {
+  it('strips expression() from style (IE CSS injection)', () => {
+    const result = sanitizeMessageHtml('<span style="width: expression(alert(1))">x</span>')
+    expect(result).not.toContain('expression')
+  })
+
+  it('strips url() from style', () => {
+    const result = sanitizeMessageHtml('<span style="background: url(javascript:alert(1))">x</span>')
+    expect(result).not.toContain('url(')
+  })
+})
+
+describe('sanitizeMessageHtml — edge cases', () => {
+  it('returns empty string unchanged when falsy', () => {
+    expect(sanitizeMessageHtml('')).toBe('')
+  })
+
+  it('handles plain text without HTML', () => {
+    const result = sanitizeMessageHtml('Hello world')
+    expect(result).toBe('Hello world')
+  })
+
+  it('does not escape regular ampersands in text', () => {
+    const result = sanitizeMessageHtml('Tom &amp; Jerry')
+    expect(result).toContain('Tom')
+    expect(result).toContain('Jerry')
+  })
+})