import "server-only";
import { headers } from "next/headers";

// Host and X-Forwarded-* headers are client-controlled, so the canonical
// address comes from configuration. Without PUBLIC_URL (local development),
// URLs fall back to the request's Host header over plain HTTP.
const PUBLIC_URL = process.env.PUBLIC_URL ? new URL(process.env.PUBLIC_URL) : null;

/** Session cookies are marked Secure when the instance is served over HTTPS (or SECURE_COOKIES=1). */
export const SECURE_COOKIES = process.env.SECURE_COOKIES === "1" || PUBLIC_URL?.protocol === "https:";

/** The address users reach this server at, e.g. https://vectrum.cc. */
export async function serverOrigin() {
  if (PUBLIC_URL) return PUBLIC_URL.origin;
  return `http://${(await headers()).get("host") ?? "localhost:3000"}`;
}

/** Host (and port) part of serverOrigin(), e.g. vectrum.cc. */
export async function serverHost() {
  return new URL(await serverOrigin()).host;
}