Expose allowed style properties via extensions

[lluzak]

Summary

• Extensions can now contribute allowed CSS properties through an allowedStyles getter, mirroring how allowedElements contributes tags/attributes.
• Default style allowlist remains color and background-color. Anything beyond that (e.g. text-align, font-weight) is opt-in per-extension.
• buildConfig becomes a pure function returning { config, hooks }. sanitization_helper removes previous hooks and registers the fresh ones before applying the DOMPurify config — no more module-level mutable state or import-time addHook side effects.

Motivation

Host apps embedding Lexxy sometimes need additional style properties sanitized through (e.g. text alignment, custom typography) without forking the editor or exposing the full style attribute. This mirrors the existing allowedElements extension hook so the same pattern works for both tags/attributes and styles.

Usage

class MyExtension extends LexxyExtension {
  get allowedStyles() { return [ "text-align", "font-weight" ] }
}

Test plan

• `yarn test --run` — 87/87 pass (added unit tests for default filtering, opt-in, rebuild reset, strong/em class stripping, and hook shape)
• `yarn lint` — clean
• `yarn build` — rollup bundle rebuilt

[claude]

Claude Code Review

This pull request is from a fork — automated review is disabled. A repository maintainer can comment @claude review to run a one-time review.

[Copilot]

Pull request overview

This PR extends Lexxy’s sanitization pipeline so extensions can opt into additional allowed CSS properties (beyond the default color and background-color) while also refactoring DOMPurify configuration/hook setup to avoid import-time side effects.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

Changes:

• Add an allowedStyles extension hook and aggregate allowed styles across enabled extensions.
• Refactor buildConfig to return { config, hooks }, and re-register DOMPurify hooks on each setSanitizerConfig call.
• Add unit coverage for default style filtering, opt-in properties, rebuild/reset behavior, and element hook behavior.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
test/javascript/unit/config/dom_purify.test.js	Adds unit tests for style allowlisting and hook behavior.
src/helpers/sanitization_helper.js	Rebuilds DOMPurify config + hooks per call and resets existing hooks/config.
src/extensions/lexxy_extension.js	Introduces allowedStyles getter on the extension base class.
src/elements/editor.js	Passes aggregated allowedStyles into sanitizer setup during editor initialization.
src/editor/extensions.js	Aggregates allowed styles from enabled extensions.
src/config/dom_purify.js	Makes sanitizer config building pure and adds style-filter hook factory driven by allowed style properties.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.