mirror of
https://github.com/bulwarkmail/webmail.git
synced 2026-11-01 08:12:43 +00:00
39 lines
1.4 KiB
TypeScript
39 lines
1.4 KiB
TypeScript
/**
|
|
* RFC 8707 resource indicator for the authorization request (#1461).
|
|
*
|
|
* Providers that issue access tokens per API, such as Pocket ID, only set the
|
|
* token's audience to the mail server (and grant its scopes) when the client
|
|
* names that API with `resource`. Stalwart 1.0 rejects tokens whose audience
|
|
* isn't one of its resource identifiers.
|
|
*
|
|
* No server imports, so the login page can share the rule.
|
|
*/
|
|
|
|
/**
|
|
* The resource as it goes on the wire, or undefined when the value can't be a
|
|
* resource indicator: RFC 8707 requires an absolute URI without a fragment.
|
|
*/
|
|
export function normalizeOauthResource(value: unknown): string | undefined {
|
|
if (typeof value !== 'string') return undefined;
|
|
const trimmed = value.trim();
|
|
if (!trimmed || trimmed.includes('#')) return undefined;
|
|
try {
|
|
// Throws for relative references; a scheme makes it absolute.
|
|
new URL(trimmed);
|
|
} catch {
|
|
return undefined;
|
|
}
|
|
return trimmed;
|
|
}
|
|
|
|
/**
|
|
* Adds `resource` to an authorization request built in the browser. The
|
|
* configured resource names an API of the global provider, so like the issuer
|
|
* (#952) it is left out when signing in to a server entry.
|
|
*/
|
|
export function addOauthResource(authUrl: URL, resource: unknown, forServerEntry: boolean): void {
|
|
if (forServerEntry) return;
|
|
const value = normalizeOauthResource(resource);
|
|
if (value) authUrl.searchParams.set('resource', value);
|
|
}
|