const fs = require('fs');

// 1. Add escapeHtml to auth-helper.js
const authHelperFile = 'c:/Users/kde/Desktop/wassili_V2/public_html/js/auth-helper.js';
let authHelper = fs.readFileSync(authHelperFile, 'utf8');
if (!authHelper.includes('window.escapeHtml')) {
    authHelper = `// Utility for XSS protection
window.escapeHtml = function(str) {
    if (!str) return '';
    return String(str).replace(/[&<>"'/]/g, function (s) {
        return {
            '&': '&amp;',
            '<': '&lt;',
            '>': '&gt;',
            '"': '&quot;',
            "'": '&#39;',
            '/': '&#x2F;'
        }[s];
    });
};

` + authHelper;
    fs.writeFileSync(authHelperFile, authHelper);
    console.log("Added escapeHtml to auth-helper.js");
}

// 2. Fix merchant-dashboard.html
const dbFile = 'c:/Users/kde/Desktop/wassili_V2/public_html/merchant-dashboard.html';
let dbHtml = fs.readFileSync(dbFile, 'utf8');
dbHtml = dbHtml.replace(
    /\(o\.client\?\.name \|\| 'عميل'\)\.replace\(\/<\//g,
    `window.escapeHtml(o.client?.name || 'عميل')`
);
dbHtml = dbHtml.replace(
    /\(o\.client\?\.name \|\| 'عميل'\)\.replace\(\/<\//, // Fallback if the regex missed the exact g
    `window.escapeHtml(o.client?.name || 'عميل')`
);
// Make sure it actually replaces it properly. The original was: ${(o.client?.name || 'عميل').replace(/</g,'&lt;')}
dbHtml = dbHtml.replace(
    /\$\{\(o\.client\?\.name \|\| 'عميل'\)\.replace\(\/<\//g,
    `\${window.escapeHtml(o.client?.name || 'عميل')`
);
// Let's just do a simpler replace
dbHtml = dbHtml.replace(
    /\(o\.client\?\.name \|\| 'عميل'\)\.replace\(\/<\//g,
    `window.escapeHtml(o.client?.name || 'عميل')`
);
fs.writeFileSync(dbFile, dbHtml);

// 3. Fix merchant-orders.html
const ordersFile = 'c:/Users/kde/Desktop/wassili_V2/public_html/merchant-orders.html';
let ordersHtml = fs.readFileSync(ordersFile, 'utf8');
ordersHtml = ordersHtml.replace(
    /\$\{item\.name\}/g,
    `\${window.escapeHtml(item.name)}`
);
ordersHtml = ordersHtml.replace(
    /\$\{o\.client\?\.name \|\| 'عميل'\}/g,
    `\${window.escapeHtml(o.client?.name || 'عميل')}`
);
ordersHtml = ordersHtml.replace(
    /\$\{o\.dropoff\?\.address \|\| ''\}/g,
    `\${window.escapeHtml(o.dropoff?.address || '')}`
);
ordersHtml = ordersHtml.replace(
    /\$\{o\.dropoff\?\.receiverName \|\| ''\}/g,
    `\${window.escapeHtml(o.dropoff?.receiverName || '')}`
);
ordersHtml = ordersHtml.replace(
    /\$\{o\.notes\}/g,
    `\${window.escapeHtml(o.notes)}`
);
fs.writeFileSync(ordersFile, ordersHtml);

// 4. Fix merchant-conversations.html
const convFile = 'c:/Users/kde/Desktop/wassili_V2/public_html/merchant-conversations.html';
let convHtml = fs.readFileSync(convFile, 'utf8');
convHtml = convHtml.replace(
    /\$\{conv\.user\?\.name \|\| 'عميل'\}/g,
    `\${window.escapeHtml(conv.user?.name || 'عميل')}`
);
convHtml = convHtml.replace(
    /\$\{conv\.lastMessage \|\| 'بدأ المحادثة'\}/g,
    `\${window.escapeHtml(conv.lastMessage || 'بدأ المحادثة')}`
);
fs.writeFileSync(convFile, convHtml);

console.log("XSS fixes applied to merchant HTML files.");
