<?php

namespace MintyPHP\Module\Security\Service;

use League\CommonMark\GithubFlavoredMarkdownConverter;

/**
 * Renders check-template Markdown guidance to sanitized HTML.
 *
 * Hardened config: raw HTML in the source is escaped (html_input=escape) and
 * unsafe links (javascript:, data:, …) are dropped (allow_unsafe_links=false),
 * so author-entered content can never inject markup/script into the workspace.
 *
 * @api Consumed by the security check workspace action to pre-render per-item guidance.
 */
final class SecurityMarkdownGateway
{
    private ?GithubFlavoredMarkdownConverter $converter = null;

    public function toHtml(string $markdown): string
    {
        $markdown = trim($markdown);
        if ($markdown === '') {
            return '';
        }

        $this->converter ??= new GithubFlavoredMarkdownConverter([
            'html_input' => 'escape',
            'allow_unsafe_links' => false,
        ]);

        return (string) $this->converter->convert($markdown);
    }
}