typstify-parser 0.1.8

//! Markdown parser using pulldown-cmark.

use std::path::Path;

use pulldown_cmark::{CodeBlockKind, Event, Options, Parser, Tag, TagEnd};
use thiserror::Error;
use typstify_core::{
    content::{ParsedContent, TocEntry},
    frontmatter::parse_frontmatter,
    utils::{html_escape, slugify},
};

use crate::syntax::SyntaxHighlighter;

/// Markdown parsing errors.
#[derive(Debug, Error)]
pub enum MarkdownError {
    /// Failed to parse frontmatter.
    #[error("frontmatter error: {0}")]
    Frontmatter(#[from] typstify_core::error::CoreError),
}

/// Result type for markdown operations.
pub type Result<T> = std::result::Result<T, MarkdownError>;

/// Markdown parser with syntax highlighting support.
#[derive(Debug)]
pub struct MarkdownParser {
    highlighter: SyntaxHighlighter,
    options: Options,
    sanitize_html: bool,
}

impl Default for MarkdownParser {
    fn default() -> Self {
        Self::new()
    }
}

impl MarkdownParser {
    /// Create a new markdown parser with default options.
    pub fn new() -> Self {
        let mut options = Options::empty();
        options.insert(Options::ENABLE_TABLES);
        options.insert(Options::ENABLE_FOOTNOTES);
        options.insert(Options::ENABLE_STRIKETHROUGH);
        options.insert(Options::ENABLE_TASKLISTS);
        options.insert(Options::ENABLE_HEADING_ATTRIBUTES);

        Self {
            highlighter: SyntaxHighlighter::default(),
            options,
            sanitize_html: false,
        }
    }

    /// Enable or disable HTML sanitization.
    pub fn with_sanitize_html(mut self, sanitize: bool) -> Self {
        self.sanitize_html = sanitize;
        self
    }

    /// Create a parser with a custom syntax theme.
    pub fn with_theme(theme: &str) -> Self {
        let mut parser = Self::new();
        parser.highlighter.set_theme(theme);
        parser
    }

    /// Parse markdown content with frontmatter.
    pub fn parse(&self, content: &str, path: &Path) -> Result<ParsedContent> {
        // Split frontmatter from body
        let (frontmatter, body) = parse_frontmatter(content, path)?;

        // Parse the markdown body
        let (html, toc) = self.render_markdown(&body);

        Ok(ParsedContent {
            frontmatter,
            html,
            raw: body,
            toc,
        })
    }

    /// Parse markdown without frontmatter (body only).
    pub fn parse_body(&self, body: &str) -> (String, Vec<TocEntry>) {
        self.render_markdown(body)
    }

    /// Render markdown to HTML with TOC extraction.
    fn render_markdown(&self, content: &str) -> (String, Vec<TocEntry>) {
        let parser = Parser::new_ext(content, self.options);
        let mut toc = Vec::new();
        let mut html = String::new();
        let mut current_heading: Option<(u8, String)> = None;
        let mut code_block_lang: Option<String> = None;
        let mut code_block_content = String::new();

        for event in parser {
            match event {
                // Handle heading start
                Event::Start(Tag::Heading { level, id, .. }) => {
                    let lvl = level as u8;
                    current_heading = Some((lvl, String::new()));
                    let id_attr = id.map(|i| format!(" id=\"{i}\"")).unwrap_or_default();
                    html.push_str(&format!("<h{lvl}{id_attr}>"));
                }

                // Handle heading end
                Event::End(TagEnd::Heading(level)) => {
                    let lvl = level as u8;
                    if let Some((_, ref text)) = current_heading {
                        let id = slugify(text);
                        toc.push(TocEntry {
                            level: lvl,
                            text: text.clone(),
                            id: id.clone(),
                        });
                    }
                    html.push_str(&format!("</h{lvl}>"));
                    current_heading = None;
                }

                // Handle code block start
                Event::Start(Tag::CodeBlock(kind)) => {
                    code_block_lang = match kind {
                        CodeBlockKind::Fenced(lang) => {
                            let lang = lang.to_string();
                            if lang.is_empty() { None } else { Some(lang) }
                        }
                        CodeBlockKind::Indented => None,
                    };
                    code_block_content.clear();
                }

                // Handle code block end
                Event::End(TagEnd::CodeBlock) => {
                    let highlighted = self
                        .highlighter
                        .highlight(&code_block_content, code_block_lang.as_deref());
                    html.push_str(&highlighted);
                    code_block_lang = None;
                    code_block_content.clear();
                }

                // Handle text inside code blocks
                Event::Text(text)
                    if code_block_lang.is_some() || !code_block_content.is_empty() =>
                {
                    code_block_content.push_str(&text);
                }

                // Handle regular text
                Event::Text(text) => {
                    if let Some((_, ref mut heading_text)) = current_heading {
                        heading_text.push_str(&text);
                    }
                    html.push_str(&html_escape(&text));
                }

                // Handle code (inline)
                Event::Code(code) => {
                    if let Some((_, ref mut heading_text)) = current_heading {
                        heading_text.push_str(&code);
                    }
                    html.push_str(&format!("<code>{}</code>", html_escape(&code)));
                }

                // Handle soft breaks
                Event::SoftBreak => {
                    html.push('\n');
                }

                // Handle hard breaks
                Event::HardBreak => {
                    html.push_str("<br />\n");
                }

                // Handle other start tags
                Event::Start(tag) => {
                    html.push_str(&tag_to_html_start(&tag));
                }

                // Handle other end tags
                Event::End(tag) => {
                    html.push_str(&tag_to_html_end(&tag));
                }

                // Handle HTML
                Event::Html(raw) | Event::InlineHtml(raw) => {
                    if self.sanitize_html {
                        html.push_str(&sanitize_html_raw(&raw));
                    } else {
                        html.push_str(&raw);
                    }
                }

                // Handle footnote references
                Event::FootnoteReference(name) => {
                    html.push_str(&format!(
                        "<sup class=\"footnote-ref\"><a href=\"#fn-{name}\">[{name}]</a></sup>"
                    ));
                }

                // Handle rules
                Event::Rule => {
                    html.push_str("<hr />\n");
                }

                // Handle task list markers
                Event::TaskListMarker(checked) => {
                    let checkbox = if checked {
                        "<input type=\"checkbox\" checked disabled />"
                    } else {
                        "<input type=\"checkbox\" disabled />"
                    };
                    html.push_str(checkbox);
                }

                Event::InlineMath(math) => {
                    html.push_str(&format!("<span class=\"math inline\">\\({math}\\)</span>"));
                }

                Event::DisplayMath(math) => {
                    html.push_str(&format!("<div class=\"math display\">\\[{math}\\]</div>"));
                }
            }
        }

        (html, toc)
    }
}

/// Strip dangerous HTML tags and on* event handler attributes.
fn sanitize_html_raw(raw: &str) -> String {
    let mut result = raw.to_string();

    // Strip <script>, <iframe>, <object> tags (opening and closing)
    for tag in &["script", "iframe", "object"] {
        let open = format!("<{tag}");
        let close = format!("</{tag}>");
        while let Some(start) = result.to_lowercase().find(&open.to_lowercase()) {
            let tag_end = find_tag_end(&result, start);
            result.replace_range(start..tag_end, "");
        }
        while let Some(pos) = result.to_lowercase().find(&close.to_lowercase()) {
            result.replace_range(pos..pos + close.len(), "");
        }
    }

    // Strip on* event handler attributes from tags
    strip_on_event_handlers(&mut result);

    result
}

/// Find the end of an opening HTML tag (the position after '>').
fn find_tag_end(s: &str, start: usize) -> usize {
    s[start..]
        .find('>')
        .map(|i| start + i + 1)
        .unwrap_or(s.len())
}

/// Strip `on*="..."` and `on*='...'` attributes from HTML tags.
fn strip_on_event_handlers(s: &mut String) {
    let mut result = String::with_capacity(s.len());
    let bytes = s.as_bytes();
    let mut i = 0;

    while i < bytes.len() {
        // Look for 'on' at start of an attribute name
        if bytes[i] == b'o'
            && i + 1 < bytes.len()
            && bytes[i + 1] == b'n'
            && (i == 0 || !bytes[i - 1].is_ascii_alphanumeric())
        {
            // Scan past the rest of the attribute name
            let mut word_end = i + 2;
            while word_end < bytes.len() && bytes[word_end].is_ascii_alphanumeric() {
                word_end += 1;
            }
            // Check if followed by '=' (assignment)
            if word_end > i + 2 && word_end < bytes.len() && bytes[word_end] == b'=' {
                // Skip the on*="..." or on*='...' attribute
                let mut pos = word_end + 1;
                if pos < bytes.len() {
                    let quote = bytes[pos];
                    if quote == b'"' || quote == b'\'' {
                        pos += 1;
                        while pos < bytes.len() && bytes[pos] != quote {
                            pos += 1;
                        }
                        pos += 1; // skip closing quote
                    }
                }
                // Also skip any leading whitespace before the attribute
                i = pos;
                continue;
            }
        }
        result.push(bytes[i] as char);
        i += 1;
    }

    *s = result;
}
fn tag_to_html_start(tag: &Tag) -> String {
    match tag {
        Tag::Paragraph => "<p>".to_string(),
        Tag::Heading { level, id, .. } => {
            let id_attr = id
                .as_ref()
                .map(|i| format!(" id=\"{i}\""))
                .unwrap_or_default();
            format!("<h{}{id_attr}>", *level as u8)
        }
        Tag::BlockQuote(_) => "<blockquote>".to_string(),
        Tag::CodeBlock(_) => String::new(), // Handled separately
        Tag::List(Some(start)) => format!("<ol start=\"{start}\">"),
        Tag::List(None) => "<ul>".to_string(),
        Tag::Item => "<li>".to_string(),
        Tag::FootnoteDefinition(name) => {
            format!("<div class=\"footnote\" id=\"fn-{name}\">")
        }
        Tag::Table(alignments) => {
            let _ = alignments; // Alignments handled per cell
            "<table>".to_string()
        }
        Tag::TableHead => "<thead><tr>".to_string(),
        Tag::TableRow => "<tr>".to_string(),
        Tag::TableCell => "<td>".to_string(),
        Tag::Emphasis => "<em>".to_string(),
        Tag::Strong => "<strong>".to_string(),
        Tag::Strikethrough => "<del>".to_string(),
        Tag::Link {
            dest_url, title, ..
        } => {
            let title_attr = if title.is_empty() {
                String::new()
            } else {
                format!(" title=\"{}\"", html_escape(title))
            };
            format!("<a href=\"{}\"{}> ", html_escape(dest_url), title_attr)
        }
        Tag::Image {
            dest_url, title, ..
        } => {
            let title_attr = if title.is_empty() {
                String::new()
            } else {
                format!(" title=\"{}\"", html_escape(title))
            };
            // Add loading="lazy" and decoding="async" for performance
            format!(
                "<img src=\"{}\" loading=\"lazy\" decoding=\"async\"{}",
                html_escape(dest_url),
                title_attr
            )
        }
        Tag::HtmlBlock => String::new(),
        Tag::MetadataBlock(_) => String::new(),
        Tag::DefinitionList => "<dl>".to_string(),
        Tag::DefinitionListTitle => "<dt>".to_string(),
        Tag::DefinitionListDefinition => "<dd>".to_string(),
        Tag::Superscript => "<sup>".to_string(),
        Tag::Subscript => "<sub>".to_string(),
    }
}

/// Convert a pulldown-cmark tag end to HTML closing tag.
fn tag_to_html_end(tag: &TagEnd) -> String {
    match tag {
        TagEnd::Paragraph => "</p>\n".to_string(),
        TagEnd::Heading(level) => format!("</h{}>\n", *level as u8),
        TagEnd::BlockQuote(_) => "</blockquote>\n".to_string(),
        TagEnd::CodeBlock => String::new(), // Handled separately
        TagEnd::List(ordered) => {
            if *ordered {
                "</ol>\n".to_string()
            } else {
                "</ul>\n".to_string()
            }
        }
        TagEnd::Item => "</li>\n".to_string(),
        TagEnd::FootnoteDefinition => "</div>\n".to_string(),
        TagEnd::Table => "</table>\n".to_string(),
        TagEnd::TableHead => "</tr></thead>\n".to_string(),
        TagEnd::TableRow => "</tr>\n".to_string(),
        TagEnd::TableCell => "</td>".to_string(),
        TagEnd::Emphasis => "</em>".to_string(),
        TagEnd::Strong => "</strong>".to_string(),
        TagEnd::Strikethrough => "</del>".to_string(),
        TagEnd::Link => "</a>".to_string(),
        TagEnd::Image => " />".to_string(),
        TagEnd::HtmlBlock => String::new(),
        TagEnd::MetadataBlock(_) => String::new(),
        TagEnd::DefinitionList => "</dl>\n".to_string(),
        TagEnd::DefinitionListTitle => "</dt>\n".to_string(),
        TagEnd::DefinitionListDefinition => "</dd>\n".to_string(),
        TagEnd::Superscript => "</sup>".to_string(),
        TagEnd::Subscript => "</sub>".to_string(),
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_parse_simple_markdown() {
        let parser = MarkdownParser::new();
        let content = r#"---
title: "Test Post"
---

# Hello World

This is a test."#;

        let result = parser.parse(content, Path::new("test.md")).unwrap();

        assert_eq!(result.frontmatter.title, "Test Post");
        assert!(result.html.contains("<h1"));
        assert!(result.html.contains("Hello World"));
        assert!(result.html.contains("<p>"));
    }

    #[test]
    fn test_parse_code_block() {
        let parser = MarkdownParser::new();
        let (html, _) = parser.parse_body(
            r#"```rust
fn main() {
    println!("Hello");
}
```"#,
        );

        assert!(html.contains("fn"));
        assert!(html.contains("main"));
    }

    #[test]
    fn test_toc_extraction() {
        let parser = MarkdownParser::new();
        let (_, toc) = parser.parse_body(
            r#"# Heading 1
## Heading 2
### Heading 3"#,
        );

        assert_eq!(toc.len(), 3);
        assert_eq!(toc[0].level, 1);
        assert_eq!(toc[0].text, "Heading 1");
        assert_eq!(toc[1].level, 2);
        assert_eq!(toc[2].level, 3);
    }

    #[test]
    fn test_table_rendering() {
        let parser = MarkdownParser::new();
        let (html, _) = parser.parse_body(
            r#"| Header 1 | Header 2 |
|----------|----------|
| Cell 1   | Cell 2   |"#,
        );

        assert!(html.contains("<table>"));
        assert!(html.contains("<thead>"));
        assert!(html.contains("<tr>"));
        assert!(html.contains("<td>"));
    }

    #[test]
    fn test_task_list() {
        let parser = MarkdownParser::new();
        let (html, _) = parser.parse_body(
            r#"- [x] Done
- [ ] Not done"#,
        );

        assert!(html.contains("checkbox"));
        assert!(html.contains("checked"));
    }

    #[test]
    fn test_no_frontmatter() {
        let parser = MarkdownParser::new();
        let content = "# Just Content\n\nNo frontmatter here.";
        let result = parser.parse(content, Path::new("test.md")).unwrap();

        assert!(result.frontmatter.title.is_empty());
        assert!(result.html.contains("Just Content"));
    }

    #[test]
    fn test_sanitize_html_strips_script_tags() {
        let parser = MarkdownParser::new().with_sanitize_html(true);
        let content = "Hello\n\n<script>alert(1)</script>\n\nWorld";
        let (html, _) = parser.render_markdown(content);
        assert!(!html.contains("<script>"), "script tag should be stripped");
        assert!(html.contains("Hello"), "content before script preserved");
        assert!(html.contains("World"), "content after script preserved");
    }

    #[test]
    fn test_sanitize_html_disabled_preserves() {
        let parser = MarkdownParser::new().with_sanitize_html(false);
        let content = "Hello\n\n<script>alert(1)</script>\n\nWorld";
        let (html, _) = parser.render_markdown(content);
        assert!(
            html.contains("<script>alert(1)</script>"),
            "raw HTML preserved when disabled"
        );
    }

    #[test]
    fn test_sanitize_html_strips_iframe() {
        let parser = MarkdownParser::new().with_sanitize_html(true);
        let content = "Before\n\n<iframe src=\"evil.com\"></iframe>\n\nAfter";
        let (html, _) = parser.render_markdown(content);
        assert!(!html.contains("<iframe>"), "iframe tag should be stripped");
        assert!(html.contains("Before"));
        assert!(html.contains("After"));
    }

    #[test]
    fn test_sanitize_html_strips_object() {
        let parser = MarkdownParser::new().with_sanitize_html(true);
        let content = "Before\n\n<object data=\"evil.swf\"></object>\n\nAfter";
        let (html, _) = parser.render_markdown(content);
        assert!(!html.contains("<object>"), "object tag should be stripped");
        assert!(html.contains("Before"));
        assert!(html.contains("After"));
    }

    #[test]
    fn test_sanitize_html_strips_onclick() {
        let parser = MarkdownParser::new().with_sanitize_html(true);
        let content = "Hello\n\n<div onclick=\"alert(1)\">content</div>\n\nWorld";
        let (html, _) = parser.render_markdown(content);
        assert!(
            !html.contains("onclick"),
            "onclick attribute should be stripped"
        );
        assert!(html.contains("content"));
    }

    #[test]
    fn test_sanitize_html_preserves_safe_tags() {
        let parser = MarkdownParser::new().with_sanitize_html(true);
        let content = "Hello\n\n<div class=\"safe\">content</div>\n\nWorld";
        let (html, _) = parser.render_markdown(content);
        assert!(html.contains("<div"), "safe div tag preserved");
        assert!(html.contains("content"));
    }

    #[test]
    fn test_sanitize_html_default_is_false() {
        let parser = MarkdownParser::new();
        let content = "Hello\n\n<script>alert(1)</script>\n\nWorld";
        let (html, _) = parser.render_markdown(content);
        assert!(
            html.contains("<script>alert(1)</script>"),
            "default behavior preserves raw HTML"
        );
    }
}