import { SENTRY_ALLOWED_REGION_DOMAINS } from "./constants-BPM_OWt0.js";
import { UserInputError } from "./errors-D_R568zP.js";

//#region src/internal/tool-helpers/validate-region-url.ts
/**
* Validates that a regionUrl is valid.
* Prevents SSRF attacks by only allowing the base host itself or domains from an allowlist.
*
* Rules:
* 1. By default, only the base host itself is allowed as regionUrl
* 2. For other domains, they must be in SENTRY_ALLOWED_REGION_DOMAINS
* 3. Protocol MUST be HTTPS for security
*
* @param regionUrl - The region URL to validate
* @param baseHost - The base host to validate against
* @returns The validated host if valid
* @throws {UserInputError} If the regionUrl is invalid or not allowed
*/
function validateRegionUrl(regionUrl, baseHost) {
	let parsedUrl;
	try {
		parsedUrl = new URL(regionUrl);
	} catch {
		throw new UserInputError(`Invalid regionUrl provided: ${regionUrl}. Must be a valid URL.`);
	}
	if (parsedUrl.protocol !== "https:") throw new UserInputError(`Invalid regionUrl provided: ${regionUrl}. Must use HTTPS protocol for security.`);
	if (parsedUrl.host === "https" || parsedUrl.host === "http") throw new UserInputError(`Invalid regionUrl provided: ${regionUrl}. The host cannot be just a protocol name.`);
	const regionHost = parsedUrl.host.toLowerCase();
	const baseLower = baseHost.toLowerCase();
	if (regionHost === baseLower) return regionHost;
	if (!SENTRY_ALLOWED_REGION_DOMAINS.has(regionHost)) throw new UserInputError(`Invalid regionUrl: ${regionUrl}. The domain '${regionHost}' is not allowed. Allowed domains are: ${Array.from(SENTRY_ALLOWED_REGION_DOMAINS).join(", ")}`);
	return regionHost;
}

//#endregion
export { validateRegionUrl };
//# sourceMappingURL=validate-region-url-CaR6XWB_.js.map