package wang.yaojia.webterm.terminalview

import java.util.Locale

/**
 * The http/https-only allowlist for terminal link taps (plan §6.5: "URL detection → `Intent(ACTION_VIEW)`
 * with an http/https-only allowlist"). Terminal output is attacker-influenced (a session can print any
 * escape/URL), so before the view launches an `ACTION_VIEW` intent it must reject every other scheme —
 * `file:`, `content:`, `intent:`, `javascript:`, custom app schemes — which could otherwise exfiltrate
 * local files or trigger a deep link.
 *
 * Pure + JVM-testable; the view layer calls [isAllowedUrl] before building the intent.
 */
public object LinkPolicy {

    private val ALLOWED_SCHEMES = setOf("http", "https")

    /**
     * True iff [url] carries an explicit `http`/`https` scheme (case-insensitive). A missing or foreign
     * scheme is rejected — no scheme-relative or bare-host guessing (that is how a `file:`/`intent:`
     * payload slips through).
     */
    public fun isAllowedUrl(url: String): Boolean {
        val separator = url.indexOf(':')
        if (separator <= 0) return false
        val scheme = url.substring(0, separator).lowercase(Locale.ROOT)
        return scheme in ALLOWED_SCHEMES
    }
}
