/**
 * Link Analytics render helpers — extracted from link_analytics.html inline
 * script (PR #3095 follow-up). Surgical extraction mirroring PR #4584.
 *
 * This module exposes updateEnhancedDomainList on window for the inline
 * script's wrapper (lines 856-861 of link_analytics.html) to reassign,
 * and as a CommonJS export for Vitest regression tests.
 *
 * Security note: every untrusted string interpolation in this function is
 * either wrapped in Number()/Math.round() (numeric coercion) or passed
 * through window.escapeHtml / encodeURIComponent / encodeURI. External
 * hrefs are additionally screened by URLValidator.isSafeUrl to reject
 * javascript:/data: schemes, with a console.warn on rejection for
 * debuggability. Tests at tests/js/pages/link-analytics-xss.test.js
 * pin these escape sites.
 */
(function() {
    'use strict';

    /**
     * Build a safe `https://<domain>` href, rejecting anything URLValidator
     * flags as an unsafe scheme. Domains here come from the link_analytics
     * DB (the user's own research browsing history), but we still screen
     * at render time as defense-in-depth.
     */
    function safeExternalHref(domain) {
        const url = 'https://' + domain;
        const validator = (typeof window !== 'undefined' && window.URLValidator) || null;
        if (validator && !validator.isSafeUrl(url)) {
            window.SafeLogger.warn('link_analytics: rejected unsafe external href for domain', domain);
            return '#';
        }
        return 'https://' + encodeURI(domain);
    }

    function updateEnhancedDomainList(domains, domainMetrics) {
        const container = document.getElementById('domain-list');
        container.innerHTML = '';

        if (domains.length === 0) {
            container.innerHTML = '<div style="text-align: center; color: var(--text-secondary); padding: 1rem;">No domain data available</div>';
            return;
        }

        domains.forEach(domain => {
            const metrics = domainMetrics[domain.domain] || {};
            const usageCount = metrics.usage_count || domain.count || 0;
            const usagePercentage = metrics.usage_percentage || domain.percentage || 0;
            const researchDiversity = metrics.research_diversity || domain.research_count || 0;
            const rank = Number(metrics.frequency_rank) || 0;

            const item = document.createElement('div');
            item.className = 'ldr-domain-item-expanded';

            let researchLinksHtml = '';
            if (domain.recent_researches && domain.recent_researches.length > 0) {
                researchLinksHtml = `
                    <div class="ldr-research-links">
                        <div class="ldr-research-links-title">Recent Researches (${Number(researchDiversity) || 0} total)</div>
                        ${domain.recent_researches.map(r => `
                            <a href="/research/${encodeURIComponent(r.id)}" class="ldr-research-link" title="${window.escapeHtml(r.query)}">
                                ${window.escapeHtml(r.query.length > 30 ? r.query.substring(0, 30) + '...' : r.query)}
                            </a>
                        `).join('')}
                    </div>
                `;
            }

            // Add classification if available
            let classificationHtml = '';
            if (domain.classification) {
                classificationHtml = `
                    <span class="ldr-classified-badge" title="${window.escapeHtml(domain.classification.subcategory)} (${Math.round(Number(domain.classification.confidence) * 100)}% confidence)">
                        ${window.escapeHtml(domain.classification.category)}
                    </span>
                `;
            }

            // bearer:disable javascript_lang_dangerous_insert_html
            // eslint-disable-next-line no-unsanitized/property -- audited: every interpolation uses Number()/Math.round(), escapeHtml, encodeURIComponent, encodeURI, or safeExternalHref (URLValidator-screened).
            item.innerHTML = `
                <div class="ldr-domain-header">
                    <span class="ldr-domain-name" style="font-size: 1rem; font-weight: 600;">
                        ${rank ? `#${rank}` : ''} <a href="${safeExternalHref(domain.domain)}" target="_blank" rel="noopener noreferrer" style="color: var(--accent-primary); text-decoration: none; border-bottom: 1px dotted var(--accent-primary); transition: all 0.2s ease;" onmouseover="this.style.borderBottom='2px solid var(--accent-primary)'" onmouseout="this.style.borderBottom='1px dotted var(--accent-primary)'">${window.escapeHtml(domain.domain)}</a>
                        ${classificationHtml}
                    </span>
                    <div class="ldr-domain-stats">
                        <span class="ldr-metric-badge ldr-frequency">
                            📊 ${Number(usageCount) || 0} uses (${Number(usagePercentage) || 0}%)
                        </span>
                        <span class="ldr-metric-badge ldr-diversity">
                            🔍 ${Number(researchDiversity) || 0} researches
                        </span>
                    </div>
                </div>
                ${researchLinksHtml}
            `;
            container.appendChild(item);
        });
    }

    if (typeof window !== 'undefined') {
        window.updateEnhancedDomainList = updateEnhancedDomainList;
    }
    if (typeof module !== 'undefined' && module.exports) {
        module.exports = { updateEnhancedDomainList };
    }
})();
