// HTTP URL validation for client metadata and launcher links:
// `https:` is allowed for any host; `http:` is allowed only for loopback
// hosts (`localhost`, RFC 6761 `.localhost` names, `127.0.0.0/8`,
// `::1`). OAuth redirect URIs additionally follow Better Auth's stricter
// application-type policy; HTTP redirects require an exact loopback host.
//
// Used for OAuth client_uri validation (admin client create) and the
// launcher's display URL. `javascript:`, `data:`, `file:` are rejected
// out of hand.
const normalizeLoopbackHost = (hostname: string): string => {
  let host = hostname.trim().toLowerCase();
  if (host.startsWith("[")) {
    const end = host.indexOf("]");
    if (end !== -1) {
      host = host.slice(1, end);
    }
  } else {
    const firstColon = host.indexOf(":");
    if (firstColon !== -1 && host.indexOf(":", firstColon + 1) === -1) {
      host = host.slice(0, firstColon);
    }
  }
  return host.replace(/\.+$/, "");
};

const isLoopbackIpv4Host = (host: string): boolean => {
  const octets = host.split(".");
  if (octets.length !== 4) return false;
  const numbers = octets.map((octet) => {
    if (!/^\d{1,3}$/.test(octet)) return Number.NaN;
    return Number(octet);
  });
  return numbers[0] === 127 && numbers.every((n) => Number.isInteger(n) && n >= 0 && n <= 255);
};

export const isLoopbackHost = (hostname: string): boolean => {
  const host = normalizeLoopbackHost(hostname);
  return host === "localhost" || host.endsWith(".localhost") || host === "::1" || isLoopbackIpv4Host(host);
};

export const isSafeHttpUrl = (value: string): boolean => {
  let url: URL;
  try {
    url = new URL(value);
  } catch {
    return false;
  }
  if (url.protocol === "https:") return true;
  if (url.protocol === "http:") return isLoopbackHost(url.hostname);
  return false;
};

// Strip trailing slashes from a request pathname so an exact-match
// route check matches both `/foo` and `/foo/`. Better Auth's router
// internally normalizes trailing slashes (`normalizePathname`), so a
// Hono-level exact-match block on `/api/auth/<path>` would otherwise
// miss the trailing-slash variant and let it fall through to the
// catchall, which Better Auth would then dispatch to the same plugin
// endpoint. Falls back to the original path when the input is just
// slashes so the comparison key is never the empty string.
export const stripTrailingSlash = (path: string): string => path.replace(/\/+$/, "") || path;

// Local-path validator for callback URLs forwarded to Better Auth from
// tessera's social sign-in wrapper. Mirrors the client-side
// `normalizeLocalPath` semantics so a non-React caller cannot smuggle an
// absolute or protocol-relative URL through the worker boundary. Pure
// and origin-independent: a placeholder origin is used to detect any
// URL parse that escapes the local path namespace.
export const isSafeLocalPath = (value: string): boolean => {
  if (typeof value !== "string") return false;
  if (value.length === 0) return false;
  if (!value.startsWith("/") || value.startsWith("//") || value.includes("\\")) return false;
  const placeholder = "https://placeholder.invalid";
  let parsed: URL;
  try {
    parsed = new URL(value, placeholder);
  } catch {
    return false;
  }
  return parsed.origin === placeholder;
};