packages/forkhorse-gatekeeper/app/owner-origin.ts

1/** Public metadata only. Do not turn a credential-bearing URL into an apparently safe link. */
2export function publicCoreOrigin(value: string | undefined): string | undefined {
3  if (!value || value.length > 2048) return;
4  try {
5    const url = new URL(value);
6    if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash ||
7        url.pathname !== "/") return;
8    return url.origin;
9  } catch { return; }
10}
11
12/** The account supplies only its already authenticated public Core origin, never its credentials. */
13export function sidebarWithCoreOrigin(html: string, value: string | undefined): string {
14  const origin = publicCoreOrigin(value);
15  if (!origin) return html;
16  const escaped = origin.replace(/[&<>"']/g, (character) => ({
17    "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;",
18  })[character]!);
19  return html.replace('<div id="sidebar">', () => `<div id="sidebar" data-core-origin="${escaped}">`);
20}
21