const SAFE_SCHEMES = new Set(["http:", "https:", "mailto:"]);

/**
 * Returns true if the URL string uses a safe scheme (http, https, mailto).
 * Rejects javascript:, data:, vbscript:, and any other dangerous schemes.
 */
export function isSafeUrl(url: string): boolean {
  try {
    const parsed = new URL(url);
    return SAFE_SCHEMES.has(parsed.protocol);
  } catch {
    return false;
  }
}

/**
 * Opens a URL in a new tab only if it uses a safe scheme.
 * Returns true if the URL was opened, false if it was blocked.
 */
export function safeWindowOpen(url: string): boolean {
  if (!isSafeUrl(url)) return false;
  window.open(url, "_blank", "noopener,noreferrer");
  return true;
}