import { relative, resolve, sep } from "node:path";

export const PROTECTED_PATHS = ["auth.json", "sessions", "ultrapi/raw-vault", "ultrapi/hmac.key", "ultrapi/vault.key", "ultrapi/role-memory"] as const;

export function isProtectedPath(root: string, candidate: string): boolean {
  const path = relative(resolve(root), resolve(root, candidate)).split(sep).join("/");
  return path === ".." || path.startsWith("../") || PROTECTED_PATHS.some((protectedPath) => path === protectedPath || path.startsWith(`${protectedPath}/`));
}

export function assertUnprotectedPath(root: string, candidate: string): void {
  if (isProtectedPath(root, candidate)) throw new Error("UltraPi workers cannot access protected profile data");
}