/** Allowed domains for satellite image proxy (SEC-06). */
const ALLOWED_HOSTS = [
  "gibs.earthdata.nasa.gov",
  "wvs.earthdata.nasa.gov",
  "map1.vis.earthdata.nasa.gov",
  "map2.vis.earthdata.nasa.gov",
];

export function isAllowedSatelliteUrl(rawUrl: string): boolean {
  try {
    const parsed = new URL(rawUrl);
    if (parsed.protocol !== "https:") return false;
    return ALLOWED_HOSTS.some(
      (host) => parsed.hostname === host || parsed.hostname.endsWith(`.${host}`),
    );
  } catch {
    return false;
  }
}