//! Markdown rendering helpers for creator content.
//!
//! Wraps `docengine` with media URL rewriting so relative image/video
//! references in markdown (`![](folder/file.png)`) resolve to CDN URLs.
//!
//! Sanitization policy (deliberate, ultra-fuzz Run 4 decision 2026-06-23): creator
//! markdown (blog posts, issues, project sections) is rendered via
//! `docengine::render_permissive`, which runs `ammonia` (strips script /
//! event-handlers / dangerous URL schemes) but PERMITS ordinary external
//! `http(s)`/`mailto` links, creators legitimately link out from prose. This is
//! intentionally MORE permissive than the custom-pages surface, which uses a
//! closed-system sanitizer restricting URLs to on-platform targets. Both paths are
//! XSS-safe; they differ only in whether external links are allowed, and that
//! difference is by design (long-form prose vs. a templated page builder). Keep the
//! two policies distinct rather than collapsing them.

use crate::db::UserId;

/// Render creator-authored markdown to HTML with media URL resolution.
///
/// Pipeline:
/// 1. Rewrite relative `![](path)` references to absolute CDN URLs
/// 2. Render markdown to HTML via `docengine::render_permissive`
/// 3. Convert `<img>` tags with video extensions to `<video>` elements
pub fn render_creator_markdown(markdown: &str, user_id: UserId, cdn_base: &str) -> String {
    let md = docengine::rewrite_media_paths(markdown, cdn_base, &user_id.to_string());
    let html = docengine::render_permissive(&md);
    // Strip off-platform media loads (tracking pixels) while keeping external
    // text links, fuzz 2026-07-06 UX. Runs on the `<img>` output, before the
    // img->video conversion. Relative + CDN-host media stay.
    let html = docengine::restrict_media_hosts(&html, cdn_base);
    docengine::img_to_video(&html)
}