import { createStore } from '@/shared/lib'

const STORAGE_KEY = 'auth-callback-url'

export const callbackUrl = createStore('')

export function clearCallbackUrl() {
  callbackUrl.set('')
  try {
    sessionStorage.removeItem(STORAGE_KEY)
  } catch {}
}

function isLoopback(hostname: string): boolean {
  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]'
}

function sanitize(raw: string | null | undefined): string {
  if (!raw) return ''
  try {
    const parsed = new URL(raw, location.origin)
    const sameOrigin = parsed.origin === location.origin
    const loopback = isLoopback(parsed.hostname) && isLoopback(location.hostname)
    return (sameOrigin || loopback) && !parsed.username && !parsed.password ? parsed.href : ''
  } catch {
    return ''
  }
}

export function captureCallbackUrl(): string {
  const params = new URLSearchParams(location.search)
  if (params.has('callback_url')) {
    const value = sanitize(params.get('callback_url'))
    if (value) {
      callbackUrl.set(value)
      try {
        sessionStorage.setItem(STORAGE_KEY, value)
      } catch {}
    } else clearCallbackUrl()
    return value
  }
  const current = callbackUrl.get()
  if (current) return current
  let stored = ''
  try {
    stored = sessionStorage.getItem(STORAGE_KEY) || ''
  } catch {}
  const value = sanitize(stored)
  if (value) {
    callbackUrl.set(value)
    try {
      sessionStorage.setItem(STORAGE_KEY, value)
    } catch {}
  }
  return value
}