import { safeExternalUrl } from '@/lib/seedLots'

/**
 * A link out to where seed came from.
 *
 * The href is a URL somebody pasted, so it is re-checked here before rendering
 * and carries rel="noopener noreferrer" — the server scheme-checks it too (#50),
 * but a link is rendered from whatever the client was handed, and "the backend
 * validated it" is not a reason to hand javascript: to an anchor tag.
 *
 * Renders nothing at all when the URL is absent or unsafe, so callers don't each
 * have to remember to guard.
 */
export function SourceLink({ url, label = 'source' }: { url: string; label?: string }) {
  const safe = safeExternalUrl(url)
  if (!safe) return null
  return (
    <a
      href={safe}
      target="_blank"
      rel="noopener noreferrer"
      className="underline decoration-dotted underline-offset-2 hover:text-fg"
    >
      {label} ↗
    </a>
  )
}