/**
 * The origins allowed to embed Ampelos or read its profile API from a browser.
 *
 * AMPELOS_EMBED_ANCESTORS is the single source of truth for both, and it is
 * read in two places on purpose: next.config.ts needs it at build time to write
 * the CSP `frame-ancestors` header, and route handlers need it at request time
 * to answer CORS. Keeping one env var and two readers is better than a shared
 * module, because next.config.ts cannot use the "@/" path alias.
 *
 * Origins, not hostnames -- scheme included. Both the CSP parser and the CORS
 * Origin header deal in origins, and a bare hostname is silently ignored by the
 * first and never matches the second.
 */
const DEFAULT_ORIGINS = "https://accounts.sticknife.com";

export function embedOrigins(): string[] {
  return (process.env.AMPELOS_EMBED_ANCESTORS ?? DEFAULT_ORIGINS)
    .split(",")
    .map((origin) => origin.trim())
    .filter(Boolean);
}

export function isAllowedOrigin(origin: string | null): origin is string {
  return Boolean(origin) && embedOrigins().includes(origin!);
}