/** Internal path safe to use as a post-login redirect target. */
export function getSafeReturnTo(
  value: string | null | undefined,
): string | null {
  if (!value) return null;
  if (!value.startsWith("/") || value.startsWith("//")) return null;
  if (value === "/login" || value.startsWith("/login?")) return null;
  return value;
}

export function loginPathWithReturnTo(returnTo: string): string {
  const safe = getSafeReturnTo(returnTo);
  if (!safe) return "/login";
  return `/login?returnTo=${encodeURIComponent(safe)}`;
}

export function readReturnToFromLocation(): string {
  if (typeof window === "undefined") return "/";
  const params = new URLSearchParams(window.location.search);
  return getSafeReturnTo(params.get("returnTo")) ?? "/";
}