type PortalUrlSettings = {
    portalDomain?: string | null
    publicUrl?: string
    apiBaseUrl?: string
}

/** Use deployment configuration, never request headers, for links sent by email. */
export function getPortalLoginUrl({ portalDomain, publicUrl, apiBaseUrl }: PortalUrlSettings) {
    const domain = portalDomain?.trim()
    const candidates = [
        { value: domain ? (/^https?:\/\//i.test(domain) ? domain : `https://${domain}`) : undefined },
        { value: publicUrl?.trim() },
        { value: apiBaseUrl?.trim(), originOnly: true },
    ]

    for (const { value, originOnly } of candidates) {
        if (!value) continue
        try {
            const url = new URL(value)
            if (!["http:", "https:"].includes(url.protocol) || url.username || url.password) continue
            url.pathname = `${originOnly ? "" : url.pathname.replace(/\/+$/, "")}/login`
            url.search = ""
            url.hash = ""
            return url.toString()
        } catch { /* Try the next configured address. */ }
    }

    throw new Error("Für die Portal-Einladung fehlt eine gültige öffentliche FEDEO-Adresse.")
}