/**
 * Referer evaluation guardrail.
 *
 * Two signals:
 *   1. DISALLOWED_REFERER — referer host is in the settings blocklist.
 *   2. NO_REFERER         — no referer header at all (may indicate direct link
 *                           injection or cloaked traffic). Suspicious but NOT
 *                           a hard block — still sets cookie.
 *
 * Hard block (setCookie=false) only fires for DISALLOWED_REFERER.
 */

import type { GuardResult } from './brand-keyword.js'

/**
 * Evaluate referer header.
 *
 * @param refererUrl          - Raw Referer header value (empty string if absent).
 * @param disallowedHosts     - Blocklisted referer hostnames (e.g. ['competitor.com']).
 */
export function evaluateReferer(refererUrl: string, disallowedHosts: string[]): GuardResult {
  if (!refererUrl) {
    // No referer: slightly suspicious but we still set the cookie.
    return {
      isSuspicious: true,
      codes: ['NO_REFERER'],
      setCookie: true,
    }
  }

  let url: URL
  try {
    url = new URL(refererUrl)
  } catch {
    return { isSuspicious: false, codes: [], setCookie: true }
  }

  const host = url.hostname.toLowerCase()
  const isDisallowed = disallowedHosts.some(
    (blocked) => host === blocked.toLowerCase() || host.endsWith(`.${blocked.toLowerCase()}`),
  )

  if (isDisallowed) {
    return {
      isSuspicious: true,
      codes: ['DISALLOWED_REFERER'],
      setCookie: false,
    }
  }

  return { isSuspicious: false, codes: [], setCookie: true }
}