// markup renders client-side, so no renderer can hold the camo secret and
// the web route signs on demand, a public oracle by construction. this
// bounds what that oracle can aim the worker at. camo/src/index.js mirrors
// it, the two deploy independently
const BLOCKED_SUFFIXES = [".localhost", ".local", ".internal", ".home.arpa"];
const IPV4 = /^(?:\d{1,3}\.){3}\d{1,3}$/;

export const signableTarget = (url: URL): boolean => {
	const host = url.hostname.toLowerCase();
	// ipv6 literals keep their colons in hostname
	if (host === "" || host.includes(":") || IPV4.test(host)) return false;
	// single-label names are compose/k8s service names, not public hosts
	if (!host.includes(".")) return false;
	return !BLOCKED_SUFFIXES.some((suffix) => host.endsWith(suffix));
};