| 1 | import { isLoopbackHost } from "./preview.ts"; |
| 2 | |
| 3 | /** Only return to a local client or the hosted T3 client, never an arbitrary OAuth-supplied URL. */ |
| 4 | export function providerAuthReturnUrl(value: string | undefined): string | undefined { |
| 5 | if (!value) return undefined; |
| 6 | try { |
| 7 | const url = new URL(value); |
| 8 | const desktop = ["t3code:", "t3code-dev:"].includes(url.protocol) && url.host === "app"; |
| 9 | const web = |
| 10 | ["http:", "https:"].includes(url.protocol) && |
| 11 | (isLoopbackHost(url.hostname) || url.origin === "https://app.t3.codes"); |
| 12 | if ( |
| 13 | url.username || |
| 14 | url.password || |
| 15 | (!desktop && !web) || |
| 16 | (url.pathname !== "/welcome" && |
| 17 | url.pathname !== "/settings" && |
| 18 | !url.pathname.startsWith("/settings/")) |
| 19 | ) |
| 20 | return undefined; |
| 21 | for (const key of Array.from(url.searchParams.keys())) { |
| 22 | if ( |
| 23 | url.pathname === "/welcome" || |
| 24 | !["machine", "project", "checkout", "environmentId", "instanceId"].includes(key) |
| 25 | ) { |
| 26 | url.searchParams.delete(key); |
| 27 | } |
| 28 | } |
| 29 | if (url.pathname !== "/welcome" || !/^#agents:[\w-]+$/u.test(url.hash)) url.hash = ""; |
| 30 | return url.toString(); |
| 31 | } catch { |
| 32 | return undefined; |
| 33 | } |
| 34 | } |