// Shared URL-safety predicate for outbound JSON probes (fediverse-probe,
// mobilizon-enrichment). Both probes accept a URL pulled from a remote
// payload — a nodeinfo `links[].href`, a user-pasted Mobilizon event URL —
// and were happy to issue requests to LAN-internal targets (`192.168.1.1`,
// `localhost`). The mobile SSRF impact is bounded but the device sits inside
// the user's home LAN, where router admin panels and the like are reachable.
//
// One predicate, two call sites — keeps the rule in one place so a future
// extension (RFC-1918 denylist, IPv6 link-local, etc.) lands once.
export function isPublicHttpsHost(url: string): boolean {
  let parsed: URL
  try {
    parsed = new URL(url)
  } catch {
    return false
  }
  if (parsed.protocol !== 'https:') return false
  const hostname = parsed.hostname
  if (hostname === 'localhost') return false
  // Reject IPv4 literal hosts (dotted-quad). Legitimate fediverse hosts are
  // domain names; an IP literal can only be reached for SSRF-flavoured
  // targets (router admin panels, internal dashboards, …).
  if (/^[\d.]+$/.test(hostname)) return false
  // IPv6 literal hosts arrive bracketed (`[::1]`) — reject the same way.
  if (hostname.startsWith('[')) return false
  return true
}
