/**
 * Where a signed-in user should land, from the proxy's `?next=` hint.
 *
 * ── Why this is shared rather than inlined ───────────────────────────────
 * Two things redirect after a successful sign-in and they RACE: the login form
 * (which knows the attempt just succeeded) and GuestGuard (which reacts to the
 * session becoming authenticated). Measured: signing in from
 * `/login?next=/settings/billing` landed on /dashboard, because the guard's
 * effect fired first with a hardcoded destination and the form's redirect was
 * replaced. Both now resolve through this function, so whichever wins, the
 * user arrives at the same place.
 *
 * ── Why the validation matters ───────────────────────────────────────────
 * `next` is attacker-controllable — it is a query parameter on a public page.
 * Anything that is not a same-origin absolute path is discarded, which closes
 * the open-redirect that `router.replace(next)` would otherwise be:
 *
 *   /settings/billing   → allowed
 *   https://evil.test   → rejected (absolute URL)
 *   //evil.test         → rejected (protocol-relative — still leaves the site)
 *   settings/billing    → rejected (relative; resolves against the current path)
 */

export const DEFAULT_DESTINATION = '/dashboard';

export function resolveRedirectTarget(next: string | null): string {
  if (!next || !next.startsWith('/') || next.startsWith('//')) {
    return DEFAULT_DESTINATION;
  }
  return next;
}
