feat(speaking): markdown render + sanitise utility for class report

src/views/Student/components/SpeakingClassPanel/renderReport.ts

@@ -0,0 +1,23 @@
+import MarkdownIt from 'markdown-it'
+import DOMPurify from 'dompurify'
+
+const md = new MarkdownIt({ html: true, breaks: false, linkify: false })
+
+// markdown-it produces table/heading/list HTML; the only raw HTML the LLM
+// emits is <span style="color:red">…</span> for highlights. Allow exactly that.
+const ALLOWED_TAGS = [
+  'h1', 'h2', 'h3', 'h4', 'h5', 'p', 'br', 'hr',
+  'ul', 'ol', 'li', 'strong', 'em', 'del', 'code', 'pre',
+  'blockquote', 'span',
+  'table', 'thead', 'tbody', 'tr', 'th', 'td',
+]
+const ALLOWED_ATTR = ['style', 'align']
+
+/** Render class-report Markdown to sanitised HTML safe for v-html. */
+export function renderReportMarkdown(src: string): string {
+  const rawHtml = md.render(src || '')
+  return DOMPurify.sanitize(rawHtml, {
+    ALLOWED_TAGS,
+    ALLOWED_ATTR,
+  })
+}