import DOMPurify from "isomorphic-dompurify";

const safeHtml = DOMPurify.sanitize(userContent);

// Layer 1: Client sanitizes filename
const safe = cleanFileName("../../evil.exe"); // "evil.exe"

// Layer 2: Server constructs safe path
const path = buildSafeStoragePath(formId, fileId, safe);

// Layer 3: Final validation
const validated = sanitizeStoragePath(path);

function getSafeRedirectPath(path: string): string {
  // Must start with /
  if (!path.startsWith("/")) return "/";

  // No protocol injection
  if (path.includes("://")) return "/";

  // No double slashes
  if (path.startsWith("//")) return "/";

  return path;
}

// When in doubt, deny access
try {
  const user = await checkPermission();
  if (!user) throw new Error("No user");
  return user;
} catch {
  // ANY error = no access
  throw new Error("Unauthorized");
}