const PORTAL_TRUSTED_DOMAINS = [
  'portalhq.io',
  'portalhq.dev',
  'portalhq-passkey.io',
  'portalhq-passkey.dev',
]

/**
 * Returns true iff the URL's hostname is owned by Portal.
 *
 * Guards Authorization header injection — prevents credential leakage to
 * third-party RPC providers (Infura, Alchemy, etc.).
 *
 * Localhost trust is intentionally excluded: that is an iframe-only
 * concern (dev CORS proxies) and is handled separately in the iframe.
 */
export function isPortalHostedUrl(url: string): boolean {
  try {
    // Normalise: strip trailing dots from hostname (valid DNS but unusual)
    const hostname = new URL(url).hostname.toLowerCase().replace(/\.$/, '')
    return PORTAL_TRUSTED_DOMAINS.some(
      (domain) => hostname === domain || hostname.endsWith(`.${domain}`),
    )
  } catch {
    return false
  }
}