<?php
declare(strict_types=1);

final class UrlValidator
{
    public static function assertSafeRedirectPath(string $path): string
    {
        $path = trim($path);
        if ($path === '' || !str_starts_with($path, '/') || str_starts_with($path, '//') || str_contains($path, '\\')) {
            throw new InvalidArgumentException('Invalid redirect path');
        }
        if (!preg_match('/^\/[A-Za-z0-9._~%\/?=+-]*$/', $path)) {
            throw new InvalidArgumentException('Invalid redirect path');
        }
        if (preg_match('/^[a-z][a-z0-9+.-]*:\/\//i', $path)) {
            throw new InvalidArgumentException('Invalid redirect path');
        }
        return $path;
    }

    public static function assertGeneratedLoginUrl(string $url, Settings $settings): string
    {
        $parts = parse_url($url);
        $base = parse_url($settings->targetBaseUrl());
        if (!is_array($parts) || !is_array($base)) {
            throw new InvalidArgumentException('Invalid login URL');
        }
        $scheme = strtolower((string)($parts['scheme'] ?? ''));
        $host = strtolower((string)($parts['host'] ?? ''));
        $baseHost = strtolower((string)($base['host'] ?? ''));
        $port = (int)($parts['port'] ?? ($scheme === 'https' ? 443 : 80));
        $basePort = (int)($base['port'] ?? 443);
        parse_str((string)($parts['query'] ?? ''), $query);
        if ($scheme !== 'https' || $host !== $baseHost || $port !== $basePort || ($parts['path'] ?? '') !== '/api/login/url' || empty($query['key'])) {
            throw new InvalidArgumentException('Invalid login URL');
        }
        return $url;
    }
}