/**
 * [Gitea #326] A page's og:url is chosen by the page itself, so a phishing
 * link could serve `og:url = youtube.com/watch?v=…` and render as a playable
 * YouTube card linking to the attacker. Only trust an og:url on the same
 * provider as the link actually posted (including the provider's own
 * short-link domains).
 */
const PROVIDER_ALIASES: Record<string, string> = {
  'youtu.be': 'youtube.com',
  'youtube-nocookie.com': 'youtube.com',
  'spotify.link': 'spotify.com',
  'redd.it': 'reddit.com',
  'x.com': 'twitter.com',
  'twitch.tv': 'twitch.tv',
  'apple.co': 'apple.com',
};

/**
 * Pure: the provider a host belongs to (last two labels, aliases folded). Hosts
 * under two-part public suffixes (`*.co.uk`) share a value, which is harmless
 * here: no embeddable provider lives under one.
 */
export const providerOf = (host: string): string => {
  const parts = host.toLowerCase().replace(/\.$/, '').split('.');
  const base = parts.slice(-2).join('.');
  return PROVIDER_ALIASES[base] ?? base;
};

/** Pure: whether `ogUrl` is on the same provider as the posted `url`. */
export function sameProvider(url: string, ogUrl: string): boolean {
  try {
    return providerOf(new URL(url).hostname) === providerOf(new URL(ogUrl).hostname);
  } catch {
    return false;
  }
}