/**
 * 安全重定向 301、302跳转只允许白名单中的URL
 *
 * @author: Aiden Xu<aiden.xu@yoho.cn>
 * @date: 2016/6/22
 */

'use strict';

const url = require('url');
const domains = require('../../config/safe-domain').domains;
const _ = require('lodash');

/**
 * 检查域名安全性
 *
 * @param uri
 */
const safeRedirect = (uri) => {
    let result = url.parse(uri);
    const ret = _.some(domains, (item)=> {
        return item === result.host;
    });

    return ret ? uri : '/';
};

const middleware = () => {
    return (req, res, next) => {
        const expressRedirect = res.redirect;

        res.redirect = function(uri) {
            safeRedirect(uri);
            return expressRedirect.apply(res, arguments);
        };

        next();
    };
};


module.exports = {
    safeRedirect,
    middleware
};