module GoToParam

# File lib/go_to_param.rb, line 5
def self.allow_redirect_prefix(prefix)
  allowed_redirect_prefixes << prefix
end

# File lib/go_to_param.rb, line 9
def self.allowed_redirect_prefixes
  reset_allowed_redirect_prefixes unless @allowed_redirect_prefixes
  @allowed_redirect_prefixes
end

# File lib/go_to_param.rb, line 19
def self.included(klass)
  klass.helper_method :hidden_go_to_tag, :hidden_go_to_here_tag,
    :go_to_params, :go_to_here_params,
    :go_to_path, :go_to_path_or
end

# File lib/go_to_param.rb, line 15
def self.reset_allowed_redirect_prefixes
  @allowed_redirect_prefixes = [ "/" ]
end

# File lib/go_to_param.rb, line 37
def go_to_here_params(additional_query_params = {})
  path = go_to_here_path(**additional_query_params)

  if path
    { go_to: path }
  else
    {}
  end
end

# File lib/go_to_param.rb, line 33
def go_to_params(other_params = {})
  { go_to: go_to_path }.merge(other_params)
end

# File lib/go_to_param.rb, line 47
def go_to_path
  return nil if go_to_param_value.nil?

  # Avoid phishing redirects.
  if matches_allowed_redirect_prefixes?
    go_to_param_value
  else
    nil
  end
end

# File lib/go_to_param.rb, line 58
def go_to_path_or(default)
  go_to_path || default
end

# File lib/go_to_param.rb, line 29
def hidden_go_to_here_tag(additional_query_params = {})
  view_context.hidden_field_tag :go_to, go_to_here_params(additional_query_params)[:go_to]
end

# File lib/go_to_param.rb, line 25
def hidden_go_to_tag
  view_context.hidden_field_tag :go_to, go_to_path
end

# File lib/go_to_param.rb, line 84
def _go_to_add_query_string_from_hash(path, hash)
  if hash.empty?
    path
  else
    separator = path.include?("?") ? "&" : "?"
    query_string = hash.map { |k, v| "#{k}=#{CGI.escape v.to_s}" }.join("&")
    [ path, separator, query_string ].join
  end
end

# File lib/go_to_param.rb, line 96
def _go_to_fullpath
  path = request.fullpath
  path.dup.force_encoding("UTF-8").scrub
end

# File lib/go_to_param.rb, line 68
def go_to_here_path(anchor: nil, **additional_query_params)
  if request.get?
    path_without_anchor = _go_to_add_query_string_from_hash(_go_to_fullpath, additional_query_params)
    anchor ? path_without_anchor + "#" + anchor : path_without_anchor
  else
    nil
  end
end

# File lib/go_to_param.rb, line 77
def go_to_param_value
  # We use `to_s` to avoid "not a string" type errors from hack attempts where a hash is passed, e.g. "go_to[foo]=bar".
  value = params[:go_to].to_s
  value == "" ? nil : value
end

# File lib/go_to_param.rb, line 64
def matches_allowed_redirect_prefixes?
  GoToParam.allowed_redirect_prefixes.any? { |prefix| go_to_param_value.start_with?(prefix) }
end