type ResolveStorefrontUrlInput = {
  /** `api_details.storefront_url` from the admin settings. */
  configured?: unknown
  /** `STOREFRONT_URL` / `STORE_URL`. */
  envUrl?: unknown
  /** The request's `Origin` header. */
  origin?: unknown
  /** `projectConfig.http.storeCors`: a comma-separated list of origins. */
  storeCors?: unknown
}

const clean = (value: unknown) =>
  typeof value === "string" ? value.trim().replace(/\/+$/, "") : ""

/**
 * The storefront base URL used for PayPal's return/cancel URLs: admin setting,
 * then env, then the request's Origin.
 *
 * The Origin header is caller-controlled, and the result becomes a redirect
 * target, so it only counts when it exactly matches a STORE_CORS entry. Wildcard
 * and regex entries never match, which leaves the URL unset rather than trusted.
 */
export function resolveStorefrontUrl({
  configured,
  envUrl,
  origin,
  storeCors,
}: ResolveStorefrontUrlInput): string | undefined {
  const explicit = clean(configured) || clean(envUrl)
  if (explicit) {
    return explicit
  }

  const requestOrigin = clean(origin)
  if (!requestOrigin || typeof storeCors !== "string") {
    return undefined
  }

  const allowed = storeCors.split(",").map(clean)
  return allowed.includes(requestOrigin) ? requestOrigin : undefined
}