class BaronSafeWebViewPolicy {
  const BaronSafeWebViewPolicy({this.allowedHosts = defaultAllowedHosts});

  static const defaultAllowedHosts = {
    'safe.baron.hmac.kr',
    'safe-staging.baron.hmac.kr',
    'localhost',
    '127.0.0.1',
    '10.0.2.2',
  };

  final Set<String> allowedHosts;

  bool allows(Uri uri) {
    if (!uri.hasScheme || !uri.hasAuthority) {
      return false;
    }

    if (uri.scheme != 'https' && uri.scheme != 'http') {
      return false;
    }

    if (uri.scheme == 'http' && !_isLocalHost(uri.host)) {
      return false;
    }

    return allowedHosts.contains(uri.host.toLowerCase());
  }

  bool _isLocalHost(String host) {
    final normalizedHost = host.toLowerCase();
    return normalizedHost == 'localhost' ||
        normalizedHost == '127.0.0.1' ||
        normalizedHost == '10.0.2.2';
  }
}