"""HTML-safe variant of the quality-tag helper.

The plaintext ``_format_quality_tag`` is fine when the output is
Markdown/plaintext, but a future HTML-rendered caller that concatenates
an untrusted ``title`` with the tag could introduce XSS. The
``_format_quality_tag_html`` variant escapes the title and appends the
tag so both are rendered as text.
"""

from local_deep_research.utilities.search_utilities import (
    _format_quality_tag,
    _format_quality_tag_html,
)


def test_plaintext_tag_round_trip():
    assert _format_quality_tag(9) == " [Q1 ★★★★★]"
    assert _format_quality_tag(None) == ""


def test_html_variant_escapes_script_tag_in_title():
    out = _format_quality_tag_html(9, title="<script>alert(1)</script>")
    assert "<script>" not in out
    assert "&lt;script&gt;" in out
    assert " [Q1 ★★★★★]" in out


def test_html_variant_escapes_ampersand_and_quotes():
    out = _format_quality_tag_html(6, title='Chris&Keith "quoted" title')
    assert "&amp;" in out
    assert "&quot;" in out
    assert " [Q2 ★★★]" in out


def test_html_variant_accepts_none_quality():
    out = _format_quality_tag_html(None, title="plain title")
    assert out == "plain title"


def test_html_variant_star_characters_are_preserved():
    """Unicode stars are safe and must survive escaping."""
    out = _format_quality_tag_html(10, title="Top journal")
    assert "★★★★★" in out
