package token

import (
	"net"
	"strings"
)

// NormalizeService reduces a registry service identifier to the bare,
// port-stripped, lowercased hostname used to key registry domains.
//
// It tolerates the forms that actually reach us: a bare host ("atcr.io"), a
// host:port ("127.0.0.1:5000"), and a full URL ("https://atcr.io"), which is
// what the credential helper sends as ?service= when it validates stored
// credentials (pkg/credhelper/device_auth.go).
//
// Ports are stripped so the result matches the port-stripped r.Host that
// DomainRoutingMiddleware compares registry domains against. Returns "" when
// there is no recognisable host.
func NormalizeService(s string) string {
	s = strings.TrimSpace(s)

	// Drop any scheme, then anything from the first path/query delimiter on,
	// leaving just the authority.
	if i := strings.Index(s, "://"); i >= 0 {
		s = s[i+3:]
	}
	if i := strings.IndexAny(s, "/?#"); i >= 0 {
		s = s[:i]
	}

	// SplitHostPort only succeeds when a port is present; a bare host errors
	// and is used as-is. Brackets survive that path for an IPv6 literal.
	if host, _, err := net.SplitHostPort(s); err == nil {
		s = host
	}

	return strings.ToLower(strings.Trim(s, "[]"))
}