nuxt-app/app/utils/auth-routes.ts

import { FRONTEND_PAGE_ALLOWLIST, FRONTEND_PAGE_GUEST_ONLY } from "common/config"
import { normalizePath } from "common/utils/path"

const PUBLIC_ROUTE_PREFIXES: string[] = [];

export const DEFAULT_AUTHENTICATED_LANDING_PATH = "/";

function matchesExactOrPrefix(path: string, exact: Set<string>, prefixes: string[]) {
  const normalized = normalizePath(path);
  if (exact.has(normalized)) {
    return true;
  }
  return prefixes.some((prefix) => normalized.startsWith(prefix));
}

export function isPublicRoute(path: string) {
  return matchesExactOrPrefix(path, FRONTEND_PAGE_ALLOWLIST, PUBLIC_ROUTE_PREFIXES);
}

export function isGuestOnlyRoute(path: string) {
  return FRONTEND_PAGE_GUEST_ONLY.has(normalizePath(path));
}

export function normalizeSafeRedirect(
  value: unknown,
  fallback = DEFAULT_AUTHENTICATED_LANDING_PATH,
) {
  if (typeof value !== "string") {
    return fallback;
  }

  const candidate = value.trim();
  if (!candidate || !candidate.startsWith("/") || candidate.startsWith("//")) {
    return fallback;
  }

  const lower = candidate.toLowerCase();
  if (
    lower.startsWith("/http:") ||
    lower.startsWith("/https:") ||
    lower.startsWith("/javascript:")
  ) {
    return fallback;
  }

  return candidate;
}