#!/bin/sh
# Plain data only: never source/eval the endpoint file. An explicitly set
# environment variable (including empty) overrides the packaged default.
kss_load_pairing_endpoint() {
    if [ "${KSS_PAIRING_ENDPOINT+x}" = x ]; then
        return 0
    fi
    KSS_PAIRING_ENDPOINT=""
    endpoint_file="$BASE/pairing-endpoint.txt"
    [ -e "$endpoint_file" ] || return 0
    [ -f "$endpoint_file" ] && [ -r "$endpoint_file" ] || return 1
    endpoint_size="$(wc -c < "$endpoint_file" 2>/dev/null)"
    case "$endpoint_size" in ''|*[!0-9]*) return 1 ;; esac
    [ "$endpoint_size" -le 256 ] || return 1
    endpoint_value="$(cat "$endpoint_file")"
    [ -n "$endpoint_value" ] || return 0
    case "$endpoint_value" in
        https://*) ;;
        *) return 1 ;;
    esac
    case "$endpoint_value" in
        *[!a-zA-Z0-9.:/-]*) return 1 ;;
    esac
    # The Go client performs the authoritative origin/TLS validation.
    KSS_PAIRING_ENDPOINT="$endpoint_value"
}
