import validator from 'validator';

/**
 * Escapa caracteres HTML peligrosos y elimina espacios sobrantes.
 * Protege contra XSS stored e inyección HTML en campos de texto libre.
 */
export function sanitizeText(input: string | undefined | null): string {
  if (input === undefined || input === null) return '';
  return validator.escape(validator.trim(String(input)));
}

/**
 * Sanitiza un objeto plano recursivamente (solo strings de primer nivel).
 */
export function sanitizeObject<T extends Record<string, unknown>>(obj: T): T {
  const result = { ...obj };
  for (const key in result) {
    if (typeof result[key] === 'string') {
      (result as Record<string, unknown>)[key] = sanitizeText(result[key] as string);
    }
  }
  return result;
}

/**
 * Valida que un string sea un UUID v4 válido.
 */
export function isValidUUID(id: string): boolean {
  return validator.isUUID(id, '4');
}

/**
 * Valida y normaliza un email.
 */
export function sanitizeEmail(email: string): string | null {
  const trimmed = validator.trim(email).toLowerCase();
  if (!validator.isEmail(trimmed)) return null;
  return validator.normalizeEmail(trimmed) || null;
}

/**
 * Elimina caracteres no numéricos (para montos, cantidades).
 */
export function sanitizeNumericString(input: string): string {
  return input.replace(/[^0-9.]/g, '');
}