Hire Svelte Developers from an AI-Proficient Industry Veteran

// Svelte 5 - Enterprise WebSocket with ARIA, Security & Best Practices
import { untrack } from 'svelte';
import DOMPurify from 'dompurify';
import { toast } from '@zerodevx/svelte-toast';
import { WebSocketManager } from '$lib/services/websocket';
import { logger } from '$lib/services/logging';
import { MessageSchema } from '$lib/schemas/websocket.schema';
import { RateLimiter } from '$lib/utils/rate-limiter';
import { useErrorBoundary } from '$lib/hooks/useErrorBoundary';
import type { Message, ConnectionState } from '$lib/types/chat';

interface Props {
  userId: string;
  roomId: string;
  serverUrl?: string;
  maxReconnectAttempts?: number;
}

let {
  userId,
  roomId,
  serverUrl = import.meta.env.VITE_WS_URL,
  maxReconnectAttempts = 5
}: Props = $props();

// Validate required props early
let initError = $state<string | null>(
  (!userId?.trim() || !roomId?.trim()) ? 'userId and roomId are required' : null
);

// State management with Svelte 5 runes
let messageInput = $state('');
let isTyping = $state(false);
let typingTimer = $state<ReturnType<typeof setTimeout> | null>(null);
let error = $state<string | null>(null);
let isLoading = $state(true);
let liveRegion = $state<HTMLDivElement | null>(null);

// Initialize services
const { handleError, clearError } = useErrorBoundary();
const rateLimiter = new RateLimiter({ maxRequests: 10, windowMs: 1000 });

// WebSocket configuration with security - URL encode to prevent injection
const wsUrl = serverUrl.replace(/^http/, 'ws'); // Ensure ws:// or wss://
const ws = new WebSocketManager({
  url: `${wsUrl}/room/${encodeURIComponent(roomId)}`,
  userId: encodeURIComponent(userId),
  maxReconnectAttempts,
  onConnect: () => {
    isLoading = false;
    announceToScreenReader('Connected to chat');
  },
  onDisconnect: () => {
    announceToScreenReader('Connection lost. Reconnecting...');
  },
  onError: (err) => {
    logger.error('WebSocket error', { error: err, roomId });
    handleError(err);
  }
});

// Reactive derivations
const isConnected = $derived(ws.connectionState === 'connected');
const canSend = $derived(
  isConnected &&
  messageInput.trim().length > 0 &&
  messageInput.length <= 1000 &&
  rateLimiter.canProceed()
);

// ARIA live region announcements for screen readers
function announceToScreenReader(message: string): void {
  if (liveRegion) {
    liveRegion.textContent = message;
  }
}

// Connection lifecycle with cleanup
$effect(() => {
  ws.connect().catch(err => {
    error = 'Unable to connect. Please try again.';
    isLoading = false;
    logger.error('Connection failed', { error: err });
  });

  return () => {
    ws.disconnect();
    if (typingTimer) clearTimeout(typingTimer);
  };
});

// Auto-scroll with user preference respect
$effect(() => {
  if (ws.messages.length === 0) return;

  untrack(() => {
    requestAnimationFrame(() => {
      const container = document.getElementById('messages-container');
      if (!container) return;

      // Respect reduced motion preference (WCAG 2.1)
      const prefersReducedMotion =
        window.matchMedia('(prefers-reduced-motion: reduce)').matches;

      const threshold = 100;
      const isNearBottom =
        container.scrollHeight - container.scrollTop - container.clientHeight < threshold;

      if (isNearBottom) {
        container.scrollTo({
          top: container.scrollHeight,
          behavior: prefersReducedMotion ? 'auto' : 'smooth'
        });
      }
    });
  });
});

// Typing indicator with cleanup
$effect(() => {
  return () => {
    if (typingTimer) {
      clearTimeout(typingTimer);
      ws.sendTypingStatus(false).catch(() => {});
    }
  };
});

// Security: Sanitize and validate message input (XSS prevention)
function sanitizeMessage(input: string): string {
  // Remove HTML/scripts with DOMPurify
  const cleaned = DOMPurify.sanitize(input, { ALLOWED_TAGS: [] });
  // Trim and normalize whitespace
  return cleaned.trim().replace(/\s+/g, ' ');
}

// Send message with rate limiting and validation
async function handleSendMessage(): Promise<void> {
  if (!canSend) return;

  // Client-side rate limiting (10 msg/sec)
  if (!rateLimiter.tryAcquire()) {
    toast.push('Sending too fast. Please slow down.', {
      theme: { '--toastBackground': '#f59e0b' }
    });
    return;
  }

  clearError();

  try {
    const sanitized = sanitizeMessage(messageInput);

    // Validate with Zod schema
    const result = MessageSchema.safeParse({
      id: crypto.randomUUID(),
      text: sanitized,
      userId,
      timestamp: Date.now()
    });

    if (!result.success) {
      throw new Error(result.error.issues[0]?.message || 'Invalid message');
    }

    await ws.sendMessage(result.data);

    messageInput = '';
    announceToScreenReader('Message sent');

    // Reset typing indicator
    if (isTyping) {
      isTyping = false;
      if (typingTimer) clearTimeout(typingTimer);
      await ws.sendTypingStatus(false);
    }
  } catch (err) {
    const msg = err instanceof Error ? err.message : 'Failed to send';
    error = msg;
    logger.error('Send failed', { error: err });
    toast.push(msg, { theme: { '--toastBackground': '#ef4444' } });
  }
}

// Keyboard event handler with accessibility
function handleKeyDown(event: KeyboardEvent): void {
  if (event.key === 'Enter' && !event.shiftKey) {
    event.preventDefault();
    handleSendMessage();
  } else if (event.key === 'Escape') {
    messageInput = '';
  }
}

// Template includes:
// - ARIA live region (role="status", aria-live="polite") for screen readers
// - Messages container with role="log" and aria-live="polite"
// - Accessible form with proper labels and aria-describedby
// - Error alerts with role="alert"
// - Keyboard navigation support (Enter to send, Escape to clear)