// Package referer reduces a Referer header to its scheme and host, so
// that a URL path, which on the receiver route carries the entrypoint
// UUID, never reaches a log line or an error report.
package referer

import "net/url"

// redacted stands in for a Referer that cannot be reduced to its
// scheme and host.
const redacted = "(redacted)"

// SchemeAndHost returns a Referer's scheme and host, never its path or
// query. The path can be an entrypoint URL, which carries the UUID: a
// sender that follows a redirect from http:// to https:// sends the
// URL it was redirected from, and a browser sends the 404 page's URL
// under /h/ when it fetches that page's stylesheet. A Referer without
// both a scheme and a host comes back as "(redacted)".
//
// It is the access log's referer field, and the Referer header the
// Sentry hook sends.
func SchemeAndHost(referer string) string {
	if referer == "" {
		return ""
	}

	parsed, err := url.Parse(referer)
	if err != nil || parsed.Scheme == "" || parsed.Host == "" {
		return redacted
	}

	return parsed.Scheme + "://" + parsed.Host
}