fixing rolodex and search

static/js/__tests__/alerts.test.js

@@ -0,0 +1,58 @@
+/** @jest-environment jsdom */
+
+const path = require('path');
+// Load sanitizer utility first so alerts can delegate to it
+require(path.join(__dirname, '..', 'sanitizer.js'));
+// Load the alerts module (IIFE attaches itself to window)
+require(path.join(__dirname, '..', 'alerts.js'));
+
+describe('alerts._sanitize', () => {
+  const sanitize = window.alerts && window.alerts._sanitize;
+
+  it('should be a function', () => {
+    expect(typeof sanitize).toBe('function');
+  });
+
+  it('removes <script> tags and event-handler attributes', () => {
+    const dirty = '<img src="x" onerror="alert(1)"><script>alert("x")</script><p>Hello</p>';
+    const clean = sanitize(dirty);
+    expect(clean).toContain('<img src="x">');
+    expect(clean).toContain('<p>Hello</p>');
+    expect(clean).not.toMatch(/<script/i);
+    expect(clean).not.toMatch(/onerror/i);
+  });
+
+  it('uses DOMPurify after it is lazily loaded', async () => {
+    // Ensure DOMPurify is not present initially
+    delete window.DOMPurify;
+
+    const mockPurify = {
+      sanitize: jest.fn((html) => `CLEAN:${html}`)
+    };
+
+    // Spy on the shared sanitizer loader and inject DOMPurify once called
+    const loaderSpy = jest
+      .spyOn(window.htmlSanitizer, 'ensureDOMPurifyLoaded')
+      .mockImplementation(() => {
+        window.DOMPurify = mockPurify;
+        return Promise.resolve(mockPurify);
+      });
+
+    const dirty = '<span onclick="evil()">Hi</span>';
+
+    // First call: fallback sanitizer, DOMPurify not used yet
+    const first = sanitize(dirty);
+    expect(mockPurify.sanitize).not.toHaveBeenCalled();
+    expect(loaderSpy).toHaveBeenCalledTimes(1);
+
+    // Wait for loader promise to resolve
+    await loaderSpy.mock.results[0].value;
+
+    // Second call: should use DOMPurify
+    const second = sanitize(dirty);
+    expect(mockPurify.sanitize).toHaveBeenCalledTimes(1);
+    expect(second).toBe(`CLEAN:${dirty}`);
+
+    loaderSpy.mockRestore();
+  });
+});