20 lines
1.1 KiB
JavaScript
20 lines
1.1 KiB
JavaScript
|
"use strict";
|
||
|
|
|
||
|
|
/** Desktop-dev has no tabs. Resolve only an opaque action on its own Next
|
||
|
|
* server, then open the owner-validated provider page outside the renderer.
|
||
|
|
* The caller must authenticate its trusted app main frame first. */
|
||
|
|
async function openWebSubscriptionBrowser(action, origin, { fetch: request = globalThis.fetch, openExternal }) {
|
||
|
|
if (typeof action !== "string" || !/^\/api\/subscriptions\/browser\?id=[0-9a-f-]{36}$/.test(action)) throw new Error("Invalid sign-in action.");
|
||
|
|
const response = await request(new URL(action, origin), {
|
||
|
|
method: "POST", redirect: "manual", credentials: "omit",
|
||
|
|
headers: { origin, "x-learnharness-subscriptions": "1" },
|
||
|
|
signal: AbortSignal.timeout(15000),
|
||
|
|
});
|
||
|
|
const target = response.headers.get("location");
|
||
|
|
if (response.status !== 303 || !target) throw new Error("Sign-in action expired.");
|
||
|
|
const parsed = new URL(target);
|
||
|
|
if (parsed.protocol !== "https:" || parsed.username || parsed.password) throw new Error("Invalid provider page.");
|
||
|
|
await openExternal(target);
|
||
|
|
}
|
||
|
|
module.exports = { openWebSubscriptionBrowser };
|