// 登录返回只允许助手路由与编号；拒绝任意returnUrl，重新登录后仍由服务端校验归属。
export function assistantReturnPath(assessmentId: string, productIds: string, chatId: string, from: string): string {
    const valid = (id: string): boolean => /^[1-9][0-9]{0,9}$/.test(id)
    if ((assessmentId.length > 0 && !valid(assessmentId)) || (chatId.length > 0 && !valid(chatId))) return ''
    const ids = productIds.length == 0 ? [] as string[] : productIds.split(',')
    if (ids.length > 3 || (ids.length > 0 && assessmentId.length == 0)) return ''
    const seen: string[] = []
    for (let i = 0; i < ids.length; i++) { if (!valid(ids[i]) || seen.includes(ids[i])) return ''; seen.push(ids[i]) }
    if (!['','matches','product','compare','report','next-step','archive'].includes(from)) return ''
    return '/packages/finance/assistant/assistant?from=' + from + (assessmentId.length > 0 ? '&assessmentId=' + assessmentId + '&productIds=' + productIds : '') + (chatId.length > 0 ? '&chatId=' + chatId : '')
}