const SIGN_IN_PATH = "/signin";

/** Safe internal redirect target (prevents open redirects). */
export function sanitizeRedirectPath(path: string | null | undefined, fallback = "/"): string {
  if (!path || typeof path !== "string") return fallback;
  const trimmed = path.trim();
  if (!trimmed.startsWith("/") || trimmed.startsWith("//") || trimmed.startsWith("/signin")) {
    return fallback;
  }
  return trimmed;
}

export function signInPathWithRedirect(fromPath: string): string {
  const safe = sanitizeRedirectPath(fromPath);
  if (safe === "/") return SIGN_IN_PATH;
  return `${SIGN_IN_PATH}?redirect=${encodeURIComponent(safe)}`;
}

export function redirectFromSearch(search: string, fallback = "/"): string {
  const params = new URLSearchParams(search);
  return sanitizeRedirectPath(params.get("redirect"), fallback);
}

export { SIGN_IN_PATH };