package authentik

import "strings"

// APIBaseURL normalizes the Authentik API root (includes /auth when deployed under a subpath).
func APIBaseURL(raw string) string {
	raw = strings.TrimRight(strings.TrimSpace(raw), "/")
	if raw == "" {
		return "http://authentik-server:9000/auth"
	}
	if strings.HasSuffix(raw, "/auth") {
		return raw
	}
	return raw + "/auth"
}