@designcrowd/library.brand-page 6.0.6-json-prereq-7 → 6.0.6-undo-2

package/lib/src/brand-page-maker/utils/rte-sanitize.util.js

@@ -1,158 +0,0 @@
-import { validateAndSanitizeHref } from './rich-text-editor.util';
-/**
- * BP-5787 — native JSON sanitiser for RTE content.
- *
- * Operates directly on the Tiptap document tree: no editor instantiation, no
- * HTML round-trip, no DOMPurify. This is the hot path (runs on every editor
- * update and on the server sanitise gate), so it is a single, allocation-light
- * recursive walk.
- *
- * Security model (mirrors the HTML allowlist it replaces):
- *  - only allow-listed node and mark types survive; everything else is dropped;
- *  - textStyle / highlight attrs are restricted to known keys whose values must
- *    be "safe CSS values" (no quotes/angle-brackets/extra declarations/url()/
- *    expression()), preventing CSS-injection when the value is later rendered
- *    into a `style="…"` attribute;
- *  - link hrefs go through the same validateAndSanitizeHref used by the HTML
- *    sanitiser; unsafe links lose their href (and the mark);
- *  - heading levels are clamped to 1–6.
- */
-// ProseMirror node types the editor schema can legitimately produce.
-const ALLOWED_NODE_TYPES = new Set([
-    'doc',
-    'paragraph',
-    'heading',
-    'text',
-    'hardBreak',
-    'bulletList',
-    'orderedList',
-    'listItem',
-    'blockquote',
-    'codeBlock',
-    'horizontalRule',
-]);
-// Inline mark types the editor produces (strong/em/u/s/code/span/mark/a).
-const ALLOWED_MARK_TYPES = new Set([
-    'bold',
-    'italic',
-    'underline',
-    'strike',
-    'code',
-    'textStyle',
-    'highlight',
-    'link',
-]);
-// textStyle attrs map to the allow-listed CSS properties (font-weight →
-// bold mark, text-decoration → underline/strike, text-align → node attr,
-// background-color → highlight, so they are intentionally not here).
-const ALLOWED_TEXT_STYLE_ATTRS = new Set([
-    'color',
-    'fontFamily',
-    'fontSize',
-    'letterSpacing',
-    'lineHeight',
-]);
-/**
- * A safe CSS value is a short string free of characters that could inject an
- * extra declaration or escape the attribute, and free of the url()/expression()
- * vectors. Legitimate values — `rgb(255, 0, 0)`, `#FF0000`,
- * `var(--logo-text-color)`, `Open Sans`, `1.5em` — all pass.
- */
-const isSafeCssValue = (value) => typeof value === 'string' &&
-    value.length > 0 &&
-    value.length <= 200 &&
-    !/[<>"';]/.test(value) &&
-    !/url\s*\(/i.test(value) &&
-    !/expression\s*\(/i.test(value);
-const sanitizeTextStyleAttrs = (attrs) => {
-    const clean = {};
-    for (const key of Object.keys(attrs)) {
-        if (!ALLOWED_TEXT_STYLE_ATTRS.has(key))
-            continue;
-        const value = attrs[key];
-        // Tiptap emits '' for unset textStyle slots — preserve them.
-        if (value === '' || value == null) {
-            clean[key] = '';
-        }
-        else if (isSafeCssValue(value)) {
-            clean[key] = value;
-        }
-        // else: drop the unsafe value
-    }
-    return Object.keys(clean).length ? clean : null;
-};
-const sanitizeMark = (mark) => {
-    const type = mark?.type;
-    if (!type || !ALLOWED_MARK_TYPES.has(type))
-        return null;
-    const attrs = mark.attrs;
-    if (type === 'link') {
-        const href = typeof attrs?.href === 'string'
-            ? validateAndSanitizeHref(attrs.href)
-            : null;
-        if (!href)
-            return null; // drop links with unsafe/empty href
-        const cleanAttrs = { href };
-        if (attrs?.target != null)
-            cleanAttrs.target = attrs.target;
-        if (attrs?.rel != null)
-            cleanAttrs.rel = attrs.rel;
-        return { type, attrs: cleanAttrs };
-    }
-    if (type === 'textStyle') {
-        const clean = attrs ? sanitizeTextStyleAttrs(attrs) : null;
-        return clean ? { type, attrs: clean } : null;
-    }
-    if (type === 'highlight') {
-        return isSafeCssValue(attrs?.color)
-            ? { type, attrs: { color: attrs.color } }
-            : { type };
-    }
-    // Plain marks (bold/italic/underline/strike/code) carry no attrs.
-    return { type };
-};
-const ALIGN_VALUES = new Set(['left', 'center', 'right', 'justify']);
-const sanitizeNode = (node) => {
-    const type = node?.type;
-    if (!type || !ALLOWED_NODE_TYPES.has(type))
-        return null;
-    const clean = { type };
-    const attrs = {};
-    if (type === 'heading') {
-        const level = Number(node.attrs?.level);
-        attrs.level = level >= 1 && level <= 6 ? level : 1;
-    }
-    if (type === 'heading' || type === 'paragraph') {
-        const align = node.attrs?.textAlign;
-        if (typeof align === 'string' && ALIGN_VALUES.has(align)) {
-            attrs.textAlign = align;
-        }
-    }
-    if (Object.keys(attrs).length)
-        clean.attrs = attrs;
-    if (typeof node.text === 'string')
-        clean.text = node.text;
-    if (Array.isArray(node.marks)) {
-        const marks = node.marks
-            .map((m) => sanitizeMark(m))
-            .filter(Boolean);
-        if (marks && marks.length)
-            clean.marks = marks;
-    }
-    if (Array.isArray(node.content)) {
-        const content = node.content
-            .map(sanitizeNode)
-            .filter(Boolean);
-        if (content.length)
-            clean.content = content;
-    }
-    return clean;
-};
-/**
- * Sanitise a Tiptap JSON document (returns a new clean doc). Returns a minimal
- * empty doc if the input isn't a usable document.
- */
-export const sanitizeRteJson = (doc) => {
-    const clean = doc && typeof doc === 'object' ? sanitizeNode(doc) : null;
-    return clean && clean.type === 'doc' ? clean : { type: 'doc', content: [] };
-};

package/lib/src/brand-page-maker/utils/rte-serializer.d.ts

@@ -1,5 +0,0 @@
-import type { JSONContent } from '@tiptap/vue-3';
-/**
- * Serialise a Tiptap JSON document to HTML without an editor/DOM.
- */
-export declare const serializeRteJsonToHtml: (doc: JSONContent) => string;

package/lib/src/brand-page-maker/utils/rte-serializer.js

@@ -1,112 +0,0 @@
-const escapeHtml = (value) => value.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
-const escapeAttr = (value) => escapeHtml(value).replace(/"/g, '&quot;');
-// textStyle attr → CSS property, in a stable order.
-const TEXT_STYLE_PROPS = [
-    ['fontFamily', 'font-family'],
-    ['fontSize', 'font-size'],
-    ['letterSpacing', 'letter-spacing'],
-    ['lineHeight', 'line-height'],
-    ['color', 'color'],
-];
-const textStyleCss = (attrs) => TEXT_STYLE_PROPS.filter(([key]) => typeof attrs[key] === 'string' && attrs[key])
-    .map(([key, css]) => `${css}: ${attrs[key]}`)
-    .join('; ');
-// Outermost → innermost. Reversed at wrap time so links wrap outside spans,
-// which wrap outside the plain formatting marks.
-const MARK_ORDER = [
-    'link',
-    'textStyle',
-    'highlight',
-    'strike',
-    'underline',
-    'italic',
-    'bold',
-    'code',
-];
-const wrapMark = (type, attrs, inner) => {
-    switch (type) {
-        case 'bold':
-            return `<strong>${inner}</strong>`;
-        case 'italic':
-            return `<em>${inner}</em>`;
-        case 'underline':
-            return `<u>${inner}</u>`;
-        case 'strike':
-            return `<s>${inner}</s>`;
-        case 'code':
-            return `<code>${inner}</code>`;
-        case 'textStyle': {
-            const css = textStyleCss(attrs);
-            return css ? `<span style="${escapeAttr(css)}">${inner}</span>` : inner;
-        }
-        case 'highlight': {
-            const color = typeof attrs.color === 'string' ? attrs.color : '';
-            return color
-                ? `<mark data-color="${escapeAttr(color)}" style="background-color: ${escapeAttr(color)}; color: inherit;">${inner}</mark>`
-                : `<mark>${inner}</mark>`;
-        }
-        case 'link': {
-            const href = typeof attrs.href === 'string' ? attrs.href : '';
-            let open = `<a href="${escapeAttr(href)}"`;
-            if (attrs.target)
-                open += ` target="${escapeAttr(String(attrs.target))}"`;
-            if (attrs.rel)
-                open += ` rel="${escapeAttr(String(attrs.rel))}"`;
-            return `${open}>${inner}</a>`;
-        }
-        default:
-            return inner;
-    }
-};
-const renderText = (node) => {
-    let html = escapeHtml(node.text ?? '');
-    const marks = Array.isArray(node.marks) ? node.marks : [];
-    for (const type of [...MARK_ORDER].reverse()) {
-        const mark = marks.find((m) => m?.type === type);
-        if (mark)
-            html = wrapMark(type, mark.attrs ?? {}, html);
-    }
-    return html;
-};
-const alignAttr = (node) => {
-    const align = node.attrs?.textAlign;
-    return typeof align === 'string' && align
-        ? ` style="text-align: ${escapeAttr(align)}"`
-        : '';
-};
-const renderChildren = (node) => (node.content ?? []).map(renderNode).join('');
-const renderNode = (node) => {
-    if (!node || typeof node !== 'object')
-        return '';
-    switch (node.type) {
-        case 'text':
-            return renderText(node);
-        case 'hardBreak':
-            return '<br>';
-        case 'horizontalRule':
-            return '<hr>';
-        case 'paragraph':
-            return `<p${alignAttr(node)}>${renderChildren(node)}</p>`;
-        case 'heading': {
-            const level = Math.min(6, Math.max(1, Number(node.attrs?.level) || 1));
-            return `<h${level}${alignAttr(node)}>${renderChildren(node)}</h${level}>`;
-        }
-        case 'bulletList':
-            return `<ul>${renderChildren(node)}</ul>`;
-        case 'orderedList':
-            return `<ol>${renderChildren(node)}</ol>`;
-        case 'listItem':
-            return `<li>${renderChildren(node)}</li>`;
-        case 'blockquote':
-            return `<blockquote>${renderChildren(node)}</blockquote>`;
-        case 'codeBlock':
-            return `<pre><code>${renderChildren(node)}</code></pre>`;
-        // doc and any unknown container: render children.
-        default:
-            return renderChildren(node);
-    }
-};
-/**
- * Serialise a Tiptap JSON document to HTML without an editor/DOM.
- */
-export const serializeRteJsonToHtml = (doc) => renderChildren(doc);

package/src/brand-page/utils/migration/migration-18.test.ts

@@ -1,72 +0,0 @@
-import { describe, test, expect } from 'vitest';
-import { migration18 } from './migration-18';
-import type { MigrationData } from '../migration.util';
-import { isTiptapDocument, getRteJsonPlainText } from '@brand-page-maker/utils';
-
-const createMigrationData = (brandPageData: any): MigrationData =>
-  ({ brandPageModel: brandPageData }) as MigrationData;
-
-const model = (contents: any[]) => ({
-  pages: [{ id: 'p1', title: 'Home', slug: 'home', contents }],
-});
-
-describe('migration18 — HTML RTE → Tiptap JSON', () => {
-  test('converts a top-level HTML RTE field to a JSON document', async () => {
-    const data = model([
-      {
-        id: '1',
-        type: 'banner-section',
-        title:
-          '<p><span style="color: var(--logo-text-color)">Hello</span></p>',
-      },
-    ]);
-
-    const result = await migration18(createMigrationData(data));
-    const title = (result.brandPageModel.pages[0].contents[0] as any).title;
-
-    expect(isTiptapDocument(title)).toBe(true);
-    expect(getRteJsonPlainText(title)).toContain('Hello');
-    // theme token ref preserved through migration
-    expect(JSON.stringify(title)).toContain('var(--logo-text-color)');
-  });
-
-  test('converts RTE inside item arrays (text items / testimonials)', async () => {
-    const data = model([
-      {
-        id: '2',
-        type: 'text',
-        textItems: [{ id: 'ti1', text: '<p><strong>bold</strong> item</p>' }],
-      },
-    ]);
-
-    const result = await migration18(createMigrationData(data));
-    const item = (result.brandPageModel.pages[0].contents[0] as any)
-      .textItems[0];
-
-    expect(isTiptapDocument(item.text)).toBe(true);
-    expect(getRteJsonPlainText(item.text)).toContain('bold');
-  });
-
-  test('leaves plain strings and already-JSON content untouched (idempotent)', async () => {
-    const jsonDoc = {
-      type: 'doc',
-      content: [{ type: 'paragraph', content: [{ type: 'text', text: 'X' }] }],
-    };
-    const data = model([
-      {
-        id: '3',
-        type: 'banner-section',
-        title: jsonDoc, // already JSON
-        url: 'https://example.com', // plain string, not RTE
-        titleStyle: { color: '#fff', fontSize: '1em' }, // style object, untouched
-      },
-    ]);
-
-    const result = await migration18(createMigrationData(data));
-    const c = result.brandPageModel.pages[0].contents[0] as any;
-
-    expect(c.title).toEqual(jsonDoc);
-    expect(c.url).toBe('https://example.com');
-    expect(c.titleStyle).toEqual({ color: '#fff', fontSize: '1em' });
-  });
-});

package/src/brand-page/utils/migration/migration-18.ts

@@ -1,83 +0,0 @@
-import type { Editor } from '@tiptap/vue-3';
-import type { MigrationData } from '../migration.util';
-import { hasRTEContent } from '../../../brand-page-maker/utils';
-import { useExternalRichTextEditor } from '../../../brand-page-maker/composables/rich-text-editor/useRichTextEditor';
-
-/**
- * BP-5787 — migrate existing inline-HTML RTE content to Tiptap JSON.
- *
- * The editor now emits, and the renderer now reads, Tiptap JSON. Existing
- * published/saved sites still hold RTE fields as HTML strings. This converts
- * them on load:
- *   - maker: the loaded model is JSON, so the next save persists JSON.
- *   - web-renderer: lazy migrate-on-read — old sites render from JSON without
- *     needing a re-save.
- *
- * Runs on EVERY load (runAlways) so it also normalises content the AI section
- * builders still emit as HTML — there is no need to change those builders or
- * widen the content model types.
- *
- * Scope: only HTML-RTE strings (hasRTEContent) are converted. Plain strings,
- * numbers, and already-JSON docs are left untouched, so the migration is
- * idempotent (re-running on JSON content is a no-op — non-string values are
- * skipped). Nested RTE inside item arrays (textItems, testimonials, images…)
- * is handled by recursing into arrays; style objects are intentionally not
- * descended into (they never hold RTE content).
- */
-const convertRteStringsToJson = (value: unknown, editor: Editor): void => {
-  if (Array.isArray(value)) {
-    value.forEach((item) => convertRteStringsToJson(item, editor));
-
-    return;
-  }
-
-  if (!value || typeof value !== 'object') return;
-
-  const record = value as Record<string, unknown>;
-
-  Object.keys(record).forEach((key) => {
-    const field = record[key];
-
-    if (typeof field === 'string' && hasRTEContent(field)) {
-      editor.commands.setContent(field);
-      record[key] = editor.getJSON();
-    } else if (Array.isArray(field)) {
-      convertRteStringsToJson(field, editor);
-    }
-  });
-};
-
-export const migration18 = async (
-  migrationResult: MigrationData,
-): Promise<MigrationData> => {
-  const { brandPageModel } = migrationResult;
-
-  // HTML→JSON parsing needs a DOM (Tiptap's editor). In a DOM-less context
-  // (pure-node SSR or unit tests) we can't parse HTML, so we leave the RTE
-  // fields as HTML strings — the renderer and the fraud/translation extractors
-  // all dual-read HTML, so this is safe. Conversion happens wherever a DOM is
-  // available (the browser editor, jsdom).
-  if (typeof window === 'undefined' || typeof document === 'undefined') {
-    return migrationResult;
-  }
-
-  let externalEditor;
-
-  try {
-    externalEditor = useExternalRichTextEditor().externalEditor;
-  } catch {
-    return migrationResult;
-  }
-
-  try {
-    for (const page of brandPageModel.pages) {
-      for (const content of page.contents) {
-        convertRteStringsToJson(content, externalEditor);
-      }
-    }
-  } finally {
-    externalEditor.destroy();
-  }
-
-  return migrationResult;
-};

package/src/brand-page/utils/text.util.test.ts

@@ -1,47 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { escapeContentText, getRenderText } from './text.util';
-
-/**
- * BP-5787 — escapeContentText / getRenderText must accept either a legacy
- * inline-HTML string or a Tiptap JSON document without throwing. Section
- * components call these on RTE fields (e.g. banner description), which are now
- * JSON; the previous string-only versions threw `.replace is not a function`
- * and broke the field's reactivity (strike/format edits stopped rendering).
- */
-const doc = {
-  type: 'doc',
-  content: [
-    {
-      type: 'paragraph',
-      content: [
-        { type: 'text', text: 'WARNING', marks: [{ type: 'strike' }] },
-        { type: 'text', text: ': take flight' },
-      ],
-    },
-  ],
-};
-
-describe('escapeContentText (BP-5787 dual-read)', () => {
-  it('extracts plain text from a Tiptap JSON document', () => {
-    expect(escapeContentText(doc)).toBe('WARNING : take flight');
-  });
-
-  it('still strips tags from a legacy HTML string', () => {
-    expect(escapeContentText('<p><s>WARNING</s></p>')).toBe('WARNING');
-  });
-
-  it('returns falsy input unchanged', () => {
-    expect(escapeContentText('')).toBe('');
-    expect(escapeContentText(undefined)).toBeUndefined();
-  });
-});
-
-describe('getRenderText (BP-5787 JSON-safe)', () => {
-  it('passes a Tiptap JSON document through untouched (no throw)', () => {
-    expect(getRenderText(doc as unknown as string)).toBe(doc);
-  });
-
-  it('still converts newlines to <br/> for plain strings', () => {
-    expect(getRenderText('a\nb')).toBe('a<br/>b');
-  });
-});

package/src/brand-page/utils/view-model.pageid-rte.test.ts

@@ -1,104 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { resolvePageIdsInRteJson } from './view-model.util';
-import type { NavViewModel } from '../view-models';
-
-/**
- * BP-5847 — internal RTE hyperlinks are stored as `href="pageid:<id>"`. On the
- * published site these must resolve to the page's relative path. The string
- * (legacy HTML) path already did this; once RTE moved to Tiptap JSON the link
- * marks were skipped, so links rendered as raw `pageid:` and didn't navigate.
- */
-describe('resolvePageIdsInRteJson (BP-5847)', () => {
-  const nav: NavViewModel = {
-    navItems: [
-      {
-        pageId: 'home-id',
-        slug: 'home',
-        displayName: 'Home',
-        routeName: 'home',
-        routeParams: { slug: 'mysite' },
-        isRoot: true,
-        isHidden: false,
-        relativePath: '',
-        nestedNavItems: [],
-      },
-      {
-        pageId: 'about-id',
-        slug: 'about',
-        displayName: 'About',
-        routeName: 'about',
-        routeParams: { slug: 'mysite' },
-        isRoot: false,
-        isHidden: false,
-        relativePath: 'about',
-        nestedNavItems: [],
-      },
-    ],
-  };
-
-  const options = { brandPageSlug: 'mysite' } as any;
-
-  const docWithLink = (href: string) => ({
-    type: 'doc',
-    content: [
-      {
-        type: 'paragraph',
-        content: [
-          {
-            type: 'text',
-            text: 'link',
-            marks: [{ type: 'link', attrs: { href, target: '_blank' } }],
-          },
-        ],
-      },
-    ],
-  });
-
-  const linkHref = (doc: any) => doc.content[0].content[0].marks[0].attrs.href;
-
-  it('resolves a pageid link to a sub-page relative path', () => {
-    const out = resolvePageIdsInRteJson(
-      docWithLink('pageid:about-id'),
-      nav,
-      options,
-    );
-
-    expect(linkHref(out)).toBe('/mysite/about');
-  });
-
-  it('resolves a root pageid link to the site root', () => {
-    const out = resolvePageIdsInRteJson(
-      docWithLink('pageid:home-id'),
-      nav,
-      options,
-    );
-
-    expect(linkHref(out)).toBe('/mysite');
-  });
-
-  it('falls back to root when the pageid cannot be matched', () => {
-    const out = resolvePageIdsInRteJson(
-      docWithLink('pageid:missing-id'),
-      nav,
-      options,
-    );
-
-    expect(linkHref(out)).toBe('/mysite');
-  });
-
-  it('leaves external links untouched and returns the same reference', () => {
-    const doc = docWithLink('https://example.com');
-    const out = resolvePageIdsInRteJson(doc, nav, options);
-
-    expect(linkHref(out)).toBe('https://example.com');
-    expect(out).toBe(doc);
-  });
-
-  it('does not mutate the source doc (returns a new object) when resolving', () => {
-    const doc = docWithLink('pageid:about-id');
-    const out = resolvePageIdsInRteJson(doc, nav, options);
-
-    expect(out).not.toBe(doc);
-    expect(linkHref(doc)).toBe('pageid:about-id');
-  });
-});

package/src/brand-page-maker/__fixtures__/complex-rte.fixture.ts

@@ -1,23 +0,0 @@
-/**
- * BP-5787 — golden-master fixture for the RTE HTML→JSON migration.
- *
- * A single rich-text value that exercises every mark/node the editor can emit,
- * so one snapshot guards the whole serialisation surface. Captured as a baseline
- * on the current HTML pipeline; after the migration the JSON pipeline must
- * reproduce byte-identical rendered output (see rte-render-parity.test.ts).
- *
- * Coverage:
- *  - block nodes: heading (h2), paragraph, text-align (center / right)
- *  - inline marks: bold, italic, underline, strike
- *  - textStyle attrs: fontFamily, fontSize (em), letterSpacing (em), lineHeight (unitless)
- *  - colour: theme TOKEN ref (var(--logo-text-color)) AND a literal hex (#FF0000)
- *  - highlight (background colour via <mark>)
- *  - links: internal (target=_self) and external (target=_blank rel=noopener)
- */
-export const COMPLEX_RTE_HTML = `<h2 style="text-align: center"><span style="color: var(--logo-text-color)">Themed heading</span></h2><p><strong>bold</strong> <em>italic</em> <u>underline</u> <s>strike</s> <span style="font-family: Montserrat; font-size: 1.5em; letter-spacing: 0.05em; line-height: 1.4">styled span</span> <mark data-color="#ffe08a" style="background-color: #ffe08a">highlight</mark> <span style="color: #FF0000">literal hex</span> <a target="_self" href="/about">internal link</a> <a target="_blank" rel="noopener noreferrer nofollow" href="https://example.com">external link</a></p><p style="text-align: right">second paragraph, right-aligned</p>`;
-
-/**
- * The theme-token CSS variable that MUST survive the HTML→JSON round-trip
- * (BP-5787 stores token refs instead of flattening them to rgb()).
- */
-export const THEME_TOKEN_REF = 'var(--logo-text-color)';

package/src/brand-page-maker/composables/rich-text-editor/extensions/FontFamily.test.ts

@@ -1,52 +0,0 @@
-import { describe, it, expect, afterEach } from 'vitest';
-import { Editor } from '@tiptap/vue-3';
-import { getRteExtensions } from '../getRteExtensions';
-import { sanitizeRteJson } from '@brand-page-maker/utils/rte-sanitize.util';
-
-/**
- * BP-5787 — multi-word font families ("Open Sans") are quoted in CSS, so
- * re-parsing HTML (pasting RTE-styled text between editors) previously yielded
- * a value WITH quote chars, which the native sanitiser then dropped — losing
- * the font. The custom FontFamily extension strips the quotes on parse.
- */
-describe('FontFamily — quote-stripping parse (BP-5787)', () => {
-  let editors: Editor[] = [];
-  const mk = () => {
-    const e = new Editor({
-      extensions: getRteExtensions({ restrictStarterKit: true }),
-    });
-
-    editors.push(e);
-
-    return e;
-  };
-
-  afterEach(() => {
-    editors.forEach((e) => e.destroy());
-    editors = [];
-  });
-
-  const fontFamilyOf = (json: any) =>
-    json.content?.[0]?.content?.[0]?.marks?.find(
-      (m: any) => m.type === 'textStyle',
-    )?.attrs?.fontFamily;
-
-  for (const font of ['Montserrat', 'Open Sans', 'Playwrite AU']) {
-    it(`"${font}" survives an HTML re-parse + sanitise unquoted`, () => {
-      const src = mk();
-
-      src.commands.setContent('<p>Hello world</p>');
-      src.commands.selectAll();
-      src.commands.setFontFamily(font);
-
-      // Re-parse the serialised HTML — mirrors an RTE→RTE paste.
-      const tgt = mk();
-
-      tgt.commands.setContent(src.getHTML());
-
-      expect(fontFamilyOf(tgt.getJSON())).toBe(font);
-      // and the sanitiser must keep it (isSafeCssValue rejects quote chars).
-      expect(fontFamilyOf(sanitizeRteJson(tgt.getJSON()))).toBe(font);
-    });
-  }
-});