/** Accept an application path, never an external URL or another auth handoff. */
export function safeAuthReturnPath(value: string | null | undefined): string | null {
  if (!value || value.length > 2048 || !value.startsWith("/") || value.startsWith("//")) return null
  if (/[\\\u0000-\u0020\u007f]/.test(value)) return null
  try {
    const url = new URL(value, "https://mmapp.invalid")
    if (url.origin !== "https://mmapp.invalid" || /%/.test(url.pathname)) return null
    if (/^\/(auth|api|access-denied)(\/|$)/.test(url.pathname)) return null
    return url.pathname + url.search
  } catch {
    return null
  }
}

export function permittedAuthReturnPath(
  value: string | null | undefined,
  allowed: (pathname: string) => boolean,
  fallback: string,
): string {
  const path = safeAuthReturnPath(value)
  return path && allowed(new URL(path, "https://mmapp.invalid").pathname) ? path : fallback
}