orca/src/shared/browser-url.ts

import { ORCA_BROWSER_BLANK_URL } from './constants'

const LOCAL_ADDRESS_PATTERN =
  /^(?:localhost|127(?:\.\d{1,3}){3}|0\.0\.0\.0|\[[0-9a-f:]+\])(?::\d+)?(?:[/?#].*)?$/i

// Treat dotted domain-like inputs as navigation; bare prose such as react hooks remains search.
const LOOKS_LIKE_URL_PATTERN = /^[^\s]+\.[a-z]{2,}(\/.*)?$/i
const WINDOWS_ABSOLUTE_PATH_PATTERN = /^[A-Za-z]:[\\/].*$/
const WINDOWS_UNC_PATH_PATTERN = /^\\\\[^\s\\/]+[\\/][^\\/]+(?:[\\/].*)?$/
const UNIX_ABSOLUTE_PATH_PATTERN = /^\/.*$/

export type SearchEngine = 'google' | 'duckduckgo' | 'bing' | 'kagi'

export type SearchUrlOptions = {
  kagiSessionLink?: string | null
}

export const SEARCH_ENGINE_LABELS: Record<SearchEngine, string> = {
  google: 'Google',
  duckduckgo: 'DuckDuckGo',
  bing: 'Bing',
  kagi: 'Kagi'
}

const SEARCH_ENGINE_URLS: Record<SearchEngine, string> = {
  google: 'https://www.google.com/search?q=',
  duckduckgo: 'https://duckduckgo.com/?q=',
  bing: 'https://www.bing.com/search?q=',
  kagi: 'https://kagi.com/search?q='
}

export const DEFAULT_SEARCH_ENGINE: SearchEngine = 'google'

export function classifySchemeLessLocalDevAddress(rawInput: string): URL | null {
  const trimmed = rawInput.trim()
  if (!LOCAL_ADDRESS_PATTERN.test(trimmed)) {
    return null
  }
  try {
    return new URL(`http://${trimmed}`)
  } catch {
    return null
  }
}

function normalizeCertificateHostname(hostname: string): string {
  const lower = hostname.trim().toLowerCase()
  const unbracketed = lower.startsWith('[') && lower.endsWith(']') ? lower.slice(1, -1) : lower
  return unbracketed.endsWith('.') ? unbracketed.slice(0, -1) : unbracketed
}

function isValidDnsName(name: string): boolean {
  if (name.length === 0 || name.length > 253) {
    return false
  }
  return name
    .split('.')
    .every(
      (label) =>
        label.length > 0 && label.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(label)
    )
}

/** Avoids parsing a dotted host and port as a scheme; .localhost defaults to HTTP. */
function classifySchemeLessDomainPortAddress(input: string): URL | null {
  const match = /^([^\s/\\:@?#]+):\d+(?:[/?#].*)?$/.exec(input)
  if (!match || !match[1].includes('.')) {
    return null
  }
  try {
    const url = new URL(`https://${input}`)
    const hostname = normalizeCertificateHostname(url.hostname)
    if (!isValidDnsName(hostname)) {
      return null
    }
    return hostname.endsWith('.localhost') ? new URL(`http://${input}`) : url
  } catch {
    return null
  }
}

function isIpv4Loopback(hostname: string): boolean {
  const octets = hostname.split('.')
  if (octets.length !== 4 || octets.some((octet) => !/^\d{1,3}$/.test(octet))) {
    return false
  }
  const values = octets.map(Number)
  return (
    values[0] === 127 &&
    values.every((value, index) => value >= 0 && value <= 255 && octets[index] === String(value))
  )
}

export function isEligibleLocalCertificateHost(hostname: string): boolean {
  const normalized = normalizeCertificateHostname(hostname)
  if (normalized === '::1' || isIpv4Loopback(normalized)) {
    return true
  }
  if (!isValidDnsName(normalized)) {
    return false
  }
  return normalized === 'localhost' || normalized.endsWith('.localhost')
}

export function isWildcardBindHost(hostname: string): boolean {
  const normalized = normalizeCertificateHostname(hostname)
  return normalized === '0.0.0.0' || normalized === '::'
}

export function toSecureCertificateEndpoint(rawUrl: string): string | null {
  try {
    const parsed = new URL(rawUrl)
    if (parsed.protocol !== 'https:' && parsed.protocol !== 'wss:') {
      return null
    }
    const normalizedHostname = normalizeCertificateHostname(parsed.hostname)
    if (!normalizedHostname) {
      return null
    }
    const endpointHost = normalizedHostname.includes(':')
      ? `[${normalizedHostname}]`
      : normalizedHostname
    return `https://${endpointHost}:${parsed.port || '443'}`
  } catch {
    return null
  }
}

// Offer remote-page external opening only for public URLs; remote loopback is unreachable from the desktop browser.
export function resolveRemoteFailureExternalUrl(rawUrl: string): string | null {
  try {
    const parsed = new URL(rawUrl)
    if (isWildcardBindHost(parsed.hostname) || isEligibleLocalCertificateHost(parsed.hostname)) {
      return null
    }
  } catch {
    return null
  }
  return normalizeExternalBrowserUrl(rawUrl)
}

export function normalizeKagiSessionLink(rawLink: string): string | null {
  const trimmed = rawLink.trim()
  if (!trimmed) {
    return null
  }
  try {
    const parsed = new URL(trimmed)
    const hostname = parsed.hostname.toLowerCase()
    const token = parsed.searchParams.get('token')?.trim()
    // Reject credentials/nondefault ports in saved Kagi session URLs; accept /search and /search/ emitted by settings.
    const pathOk = parsed.pathname === '/search' || parsed.pathname === '/search/'
    if (
      parsed.protocol !== 'https:' ||
      (hostname !== 'kagi.com' && hostname !== 'www.kagi.com') ||
      !pathOk ||
      parsed.username !== '' ||
      parsed.password !== '' ||
      parsed.port !== '' ||
      !token
    ) {
      return null
    }
    parsed.searchParams.delete('q')
    // Collapse duplicate token params so Kagi receives one bearer value per search.
    parsed.searchParams.set('token', token)
    parsed.hash = ''
    return parsed.toString()
  } catch {
    return null
  }
}

export function redactKagiSessionToken(rawUrl: string): string {
  try {
    const parsed = new URL(rawUrl)
    const hostname = parsed.hostname.toLowerCase()
    if (
      parsed.protocol === 'https:' &&
      (hostname === 'kagi.com' || hostname === 'www.kagi.com') &&
      (parsed.pathname === '/search' || parsed.pathname === '/search/') &&
      parsed.searchParams.has('token')
    ) {
      // Strip Kagi bearer tokens before display, history or persisted tab state.
      parsed.searchParams.delete('token')
      return parsed.toString()
    }
  } catch {
    // Keep non-URL inputs unchanged.
  }
  return rawUrl
}

function buildKagiSessionSearchUrl(
  query: string,
  sessionLink: string | null | undefined
): string | null {
  if (!sessionLink) {
    return null
  }
  const normalized = normalizeKagiSessionLink(sessionLink)
  if (!normalized) {
    return null
  }
  const parsed = new URL(normalized)
  parsed.searchParams.set('q', query)
  return parsed.toString()
}

export function buildSearchUrl(
  query: string,
  engine: SearchEngine = DEFAULT_SEARCH_ENGINE,
  options: SearchUrlOptions = {}
): string {
  if (engine === 'kagi') {
    const sessionSearchUrl = buildKagiSessionSearchUrl(query, options.kagiSessionLink)
    if (sessionSearchUrl) {
      return sessionSearchUrl
    }
  }
  return `${SEARCH_ENGINE_URLS[engine]}${encodeURIComponent(query.toWellFormed())}`
}

export function looksLikeSearchQuery(input: string): boolean {
  if (input.includes(' ')) {
    return true
  }
  if (LOOKS_LIKE_URL_PATTERN.test(input)) {
    return false
  }
  if (input.includes('.') || input.includes(':')) {
    return false
  }
  return true
}

/** True for input shaped like an absolute filesystem path (POSIX, Windows drive, or UNC). */
export function isAbsoluteFilesystemPathInput(input: string): boolean {
  return (
    UNIX_ABSOLUTE_PATH_PATTERN.test(input) ||
    WINDOWS_ABSOLUTE_PATH_PATTERN.test(input) ||
    WINDOWS_UNC_PATH_PATTERN.test(input)
  )
}

function absolutePathToFileUrl(filePath: string): string {
  const normalizedPath = filePath.replaceAll('\\', '/')
  const segments = normalizedPath.split('/').map((segment, index) => {
    if (index === 0 && /^[A-Za-z]:$/.test(segment)) {
      return segment
    }
    return encodeURIComponent(segment)
  })
  return normalizedPath.startsWith('/')
    ? `file://${segments.join('/')}`
    : `file:///${segments.join('/')}`
}

function windowsUncPathToFileUrl(filePath: string): string {
  const normalizedPath = filePath.replaceAll('\\', '/').replace(/^\/+/, '')
  const [host, ...pathSegments] = normalizedPath.split('/')
  return `file://${host}/${pathSegments.map(encodeURIComponent).join('/')}`
}

export function normalizeBrowserNavigationUrl(
  rawUrl: string,
  searchEngine?: SearchEngine | null,
  options: SearchUrlOptions = {}
): string | null {
  const trimmed = rawUrl.trim()
  if (trimmed.length === 0 || trimmed === 'about:blank' || trimmed === ORCA_BROWSER_BLANK_URL) {
    return ORCA_BROWSER_BLANK_URL
  }

  const localDevAddress = classifySchemeLessLocalDevAddress(trimmed)
  if (localDevAddress) {
    return localDevAddress.toString()
  }

  if (WINDOWS_UNC_PATH_PATTERN.test(trimmed)) {
    return windowsUncPathToFileUrl(trimmed)
  }

  if (UNIX_ABSOLUTE_PATH_PATTERN.test(trimmed) || WINDOWS_ABSOLUTE_PATH_PATTERN.test(trimmed)) {
    return absolutePathToFileUrl(trimmed)
  }

  const domainPortAddress = classifySchemeLessDomainPortAddress(trimmed)
  if (domainPortAddress) {
    return domainPortAddress.toString()
  }

  try {
    const parsed = new URL(trimmed)
    // Allow local file previews only in sandboxed guests (no Node, isolated context, web security); continue rejecting javascript/arbitrary data schemes.
    return parsed.protocol === 'http:' ||
      parsed.protocol === 'https:' ||
      parsed.protocol === 'file:'
      ? parsed.toString()
      : null
  } catch {
    // Only address bars opt into search fallback; main navigation/webview validation must reject non-URLs.
    const searchEnabled = searchEngine !== undefined
    try {
      const withScheme = new URL(`https://${trimmed}`)
      if (!searchEnabled || !looksLikeSearchQuery(trimmed)) {
        return withScheme.toString()
      }
    } catch {
      // Not a valid URL even with https:// prefix
    }

    if (!searchEnabled) {
      return null
    }
    return buildSearchUrl(trimmed, searchEngine ?? DEFAULT_SEARCH_ENGINE, options)
  }
}

export function normalizeExternalBrowserUrl(rawUrl: string): string | null {
  const normalized = normalizeBrowserNavigationUrl(rawUrl)
  if (normalized === null || normalized === ORCA_BROWSER_BLANK_URL) {
    return null
  }
  // OS handoff accepts HTTP(S) only; file URLs stay in sandboxed previews so remote pages cannot open arbitrary Finder/Explorer paths.
  if (normalized.startsWith('file:')) {
    return null
  }
  return normalized
}