/**
 * Validates a caller-supplied return path (a `callbackUrl` query param,
 * a booking-draft continuation target) is a safe, internal, relative
 * path before it's ever used in a redirect — see the brief's "Accept
 * only safe internal return paths. Prevent open redirects." Auth.js's
 * own `signIn()`/`redirectTo` already restricts to same-origin
 * internally, but this is checked explicitly rather than relied on
 * implicitly, since it guards a value that reached this code from a URL
 * query string, not from a trusted internal source.
 */
export function safeRedirectPath(path: string | null | undefined, fallback: string): string {
  if (!path) return fallback;
  // Must start with exactly one "/" — rejects "//evil.com" (protocol-relative),
  // "https://evil.com", and "javascript:..." in one check.
  if (!path.startsWith("/") || path.startsWith("//")) return fallback;
  if (path.includes("://")) return fallback;
  return path;
}