/** Build OIDC login URL (full navigation — never use Next.js Link). */
export function buildOidcLoginUrl(options?: {
  returnTo?: string
  intent?: "add_account"
  prompt?: string
}) {
  const returnTo = options?.returnTo ?? "/mail/inbox"
  const params = new URLSearchParams({
    returnTo,
  })
  if (options?.intent === "add_account") {
    params.set("intent", "add_account")
  }
  if (options?.prompt) {
    params.set("prompt", options.prompt)
  }
  return `/api/auth/login?${params.toString()}`
}

/** Normalize BFF /flows/complete redirect (MAIL_APP_URL may wrongly include /mail). */
export function resolveAuthLoginRedirect(redirectUrl: string): string {
  try {
    const target = new URL(redirectUrl, window.location.origin)
    if (target.pathname.startsWith("/mail/api/auth/")) {
      target.pathname = target.pathname.slice("/mail".length)
    }
    return target.toString()
  } catch {
    return redirectUrl.replace(/^\/mail(?=\/api\/auth\/)/, "")
  }
}