// Package render converts markdown to HTML using goldmark.
//
// Zero-trust posture: raw HTML in markdown is escaped. Even though content comes from
// an operator-mounted volume (not a request), defense-in-depth keeps a stray <script>
// or <iframe> in a tutorial from running in a visitor's browser. Authors get goldmark
// + GFM + footnotes; raw HTML in .md is rendered as text.
package render

import (
	"bytes"

	"github.com/yuin/goldmark"
	"github.com/yuin/goldmark/extension"
	"github.com/yuin/goldmark/parser"
)

var md = goldmark.New(
	goldmark.WithExtensions(
		extension.GFM, // tables, strikethrough, autolink, tasklist
		extension.Footnote,
	),
	goldmark.WithParserOptions(
		parser.WithAutoHeadingID(),
	),
	// No WithUnsafe() — raw HTML stays escaped.
)

// Markdown renders a markdown body to HTML.
func Markdown(source []byte) (string, error) {
	var buf bytes.Buffer
	if err := md.Convert(source, &buf); err != nil {
		return "", err
	}
	return buf.String(), nil
}