@bash-app/bash-common 30.220.0 → 30.221.0

package/src/utils/urlUtils.ts

@@ -206,3 +206,48 @@ export function redirectToStripeWithTimeout(
     }
   }
 }
+
+/**
+ * Builds a safe absolute URL for `<a href>` from user-edited service/profile links.
+ *
+ * Browsers resolve `href="example.com"` as a **relative** URL (under the current path),
+ * not `https://example.com`, so bare domains must be prefixed with `https://`.
+ * Stores sometimes save Instagram as `@handle` instead of a full URL — those are mapped
+ * to `https://www.instagram.com/{handle}/`.
+ *
+ * @returns `"#"` when the value is empty or unsafe (`javascript:`, `data:`).
+ */
+export function toExternalLinkHref(raw: string | undefined | null): string {
+  if (raw == null) {
+    return "#";
+  }
+  const trimmed = raw.trim();
+  if (trimmed === "") {
+    return "#";
+  }
+
+  const lower = trimmed.toLowerCase();
+  if (lower.startsWith("javascript:") || lower.startsWith("data:")) {
+    return "#";
+  }
+
+  if (/^https?:\/\//i.test(trimmed)) {
+    return trimmed;
+  }
+  if (/^mailto:/i.test(trimmed) || /^tel:/i.test(trimmed)) {
+    return trimmed;
+  }
+
+  // Instagram @handle (often stored as a handle instead of a URL)
+  if (trimmed.startsWith("@")) {
+    const handle = trimmed
+      .slice(1)
+      .trim()
+      .replace(/^@+/, "");
+    if (/^[a-zA-Z0-9._]{1,30}$/.test(handle)) {
+      return `https://www.instagram.com/${handle}/`;
+    }
+  }
+
+  return `https://${trimmed}`;
+}