/**
 * Only allow in-app relative paths (blocks open redirects via ?r=).
 */
export function getSafeRedirectUrl(
	raw: string | null | undefined,
	fallback = '/dashboard/rests'
): string {
	if (!raw) {
		return fallback;
	}

	let url: string;
	try {
		url = decodeURIComponent(raw).trim();
	} catch {
		return fallback;
	}

	if (!url.startsWith('/') || url.startsWith('//') || url.includes('://')) {
		return fallback;
	}

	return url;
}
