const ALLOWED_PATHS = /^\/[a-zA-Z0-9\-._~:/?#[\]@!$&'()*+,;=%]*$/;

export function sanitizeAuthRedirect(
  rawRedirect: string | null | undefined,
  fallback = "/dashboard",
): string {
  if (!rawRedirect) return fallback;
  try {
    // Reject absolute URLs and protocol-relative
    if (rawRedirect.startsWith("//") || rawRedirect.includes(":")) return fallback;
    if (!ALLOWED_PATHS.test(rawRedirect)) return fallback;
    return rawRedirect;
  } catch {
    return fallback;
  }
}