/**
 * Referer evaluation guardrail.
 *
 * Two signals:
 *   1. DISALLOWED_REFERER — referer host is in the settings blocklist.
 *   2. NO_REFERER         — no referer header at all (may indicate direct link
 *                           injection or cloaked traffic). Suspicious but NOT
 *                           a hard block — still sets cookie.
 *
 * Hard block (setCookie=false) only fires for DISALLOWED_REFERER.
 */

import type { GuardResult } from './brand-keyword.js';
import { tryParseRefererUrl } from './referer-parse.js';

/**
 * Evaluate referer header.
 *
 * @param refererUrl          - Raw Referer header value (empty string if absent).
 * @param disallowedHosts     - Blocklisted referer hostnames (e.g. ['competitor.com']).
 */
export function evaluateReferer(refererUrl: string, disallowedHosts: string[]): GuardResult {
  if (!refererUrl) {
    // No referer: slightly suspicious but we still set the cookie.
    return {
      isSuspicious: true,
      codes: ['NO_REFERER'],
      setCookie: true,
    };
  }

  const url = tryParseRefererUrl(refererUrl);
  if (!url) {
    return { isSuspicious: false, codes: [], setCookie: true };
  }

  const host = url.hostname.toLowerCase();
  const isDisallowed = disallowedHosts.some(
    (blocked) => host === blocked.toLowerCase() || host.endsWith(`.${blocked.toLowerCase()}`),
  );

  if (isDisallowed) {
    return {
      isSuspicious: true,
      codes: ['DISALLOWED_REFERER'],
      setCookie: false,
    };
  }

  return { isSuspicious: false, codes: [], setCookie: true };
}