"""Origin validation shared by first-install setup and container startup."""

import os
from urllib.parse import urlsplit


def managed_runtime() -> bool:
    # Set by the entrypoint, never by an HTTP header or a database setting.
    return os.environ.get("MAGENT_RUNTIME_MANAGED") == "1"


def normalize_application_origin(value: str) -> str:
    if not isinstance(value, str) or not value or any(
        c.isspace() or ord(c) < 33 or ord(c) == 127 or c in '<>"\\*?#' for c in value
    ):
        raise ValueError("Enter an exact http(s) site address without a path, credentials, query or fragment.")
    try:
        parsed = urlsplit(value)
        if (parsed.scheme not in {"http", "https"} or not parsed.hostname
                or parsed.username is not None or parsed.password is not None
                or parsed.path not in {"", "/"} or parsed.netloc.endswith(":")):
            raise ValueError
        port = parsed.port
        if port is not None and not 1 <= port <= 65535:
            raise ValueError
        host = parsed.hostname.encode("idna").decode("ascii").lower()
        if ":" in host:
            host = f"[{host}]"
        suffix = f":{port}" if port is not None and port != (443 if parsed.scheme == "https" else 80) else ""
        return f"{parsed.scheme}://{host}{suffix}"
    except (ValueError, UnicodeError):
        raise ValueError("Enter an exact http(s) site address without a path, credentials, query or fragment.") from None