const DEFAULT_REDIRECT = "/";

// Pathnames that are NOT user-navigable destinations: fetcher endpoints,

// OAuth/auth callbacks, JSON APIs, the magic-link redemption route, and the

// auth flow routes themselves (which would create a redirect loop). Note

// `/admin/api/` covers admin JSON endpoints while leaving `/admin`,

// `/admin/back-office/*`, `/admin/orgs`, etc. navigable.

const NON_NAVIGABLE_PREFIXES = ["/resources/", "/auth/", "/admin/api/", "/api/", "/engine/"];

const NON_NAVIGABLE_EXACT = new Set([

"/magic",

"/logout",

"/login",

"/login/magic",

"/login/mfa",

"/login/sso",

]);

function isNavigablePath(pathname: string): boolean {

if (NON_NAVIGABLE_EXACT.has(pathname)) return false;

return !NON_NAVIGABLE_PREFIXES.some((prefix) => pathname.startsWith(prefix));

}

/**

* This should be used any time the redirect path is user-provided

* (Like the query string on our login/signup pages). This avoids

* open-redirect vulnerabilities and prevents redirecting users to

* non-page routes (e.g. fetcher endpoints) that would render blank.

* @param {string} path The redirect destination

* @param {string} defaultRedirect The redirect to use if the to is unsafe.

*/

export function sanitizeRedirectPath(

path: string | undefined | null,

defaultRedirect: string = DEFAULT_REDIRECT

): string {

if (!path || typeof path !== "string") {

return defaultRedirect;

}

const pathnameEnd = path.search(/[?#]/);

const rawPathname = pathnameEnd === -1 ? path : path.slice(0, pathnameEnd);

if (!path.startsWith("/") || path.startsWith("//") || rawPathname.includes("\\")) {

return defaultRedirect;

}

try {

// should not parse as a full URL

new URL(path);

return defaultRedirect;

} catch {}

let parsed: URL;

try {

// ensure it's a valid relative path

parsed = new URL(path, "https://example.com");

if (parsed.hostname !== "example.com") {

return defaultRedirect;

}

} catch {

return defaultRedirect;

}

if (!isNavigablePath(parsed.pathname)) {

return defaultRedirect;

}

return path;

}

export function titleCase(original: string): string {

return original

.split(" ")

.map((word) => word[0].toUpperCase() + word.slice(1))

.join(" ");

}

export function appEnvTitleTag(appEnv?: string): string {

if (!appEnv || appEnv === "production") {

return "";

}

return ` (${appEnv})`;

}