/** Safe post-auth redirect path from `?next=` (SSR + client). */
const BLOCKED_NEXT_PREFIXES = ["/login", "/signup", "/logout", "/forgot-password", "/reset-password"] as const;

function isBlockedNextPath(path: string): boolean {
  return BLOCKED_NEXT_PREFIXES.some(
    (prefix) => path === prefix || path.startsWith(`${prefix}?`) || path.startsWith(`${prefix}/`),
  );
}

export function resolveNextPath(
  requested: string | null | undefined,
  fallback = "/study-chat",
): string {
  if (!requested || !requested.startsWith("/") || requested.startsWith("//")) {
    return fallback;
  }
  if (isBlockedNextPath(requested)) {
    return fallback;
  }
  return requested;
}