/**
 * Buy-ticket URL for the arrival popup (Angular parity: `getLink`).
 *
 * Base path + fixed params are hardcoded to the Russian-locale Aeroflot
 * search page. The routes triple `{dep}.{date}.{arr}` is the only variable
 * part of the URL.
 */

const BASE = "https://www.aeroflot.ru/sb/app/ru-ru#/search";
const FIXED_PARAMS =
  "adults=1&cabin=economy&children=0&infants=0&autosearch=Y" +
  "&utm_source=aflwebbot&utm_medium=referral" +
  "&utm_campaign=ref_3015_general_rf_button.index__all_flight.map";

/**
 * @param departure 3-letter city code (e.g. "MOW").
 * @param arrival 3-letter city code (e.g. "LED").
 * @param date YYYYMMDD — typically filter.date or today.
 */
export function buildBuyTicketUrl(
  departure: string,
  arrival: string,
  date: string,
): string {
  return `${BASE}?${FIXED_PARAMS}&routes=${departure}.${date}.${arrival}`;
}

/**
 * Minimal HTML escape for popup content — prevents injection via
 * city names containing `& < > "`.
 */
export function escapeHtml(s: string): string {
  return s
    .replace(/&/g, "&amp;")
    .replace(/</g, "&lt;")
    .replace(/>/g, "&gt;")
    .replace(/"/g, "&quot;");
}
