Something went wrong. Try again.
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930import { ANY_SITE, isOpen } from "./originPolicy";
/** * Which origins a device may act on (#68). Three things must all agree: the extension was BUILT for the origin (its manifest, a ceiling nothing at run time can raise), * the central system ENROLLED the device for it, and the person at the device APPROVED it. A job can only narrow what is left, never widen it. Nothing is approved until * the person says so, and an approval is for one enrolled device: enrolling again asks again. */
/** What the person is asked about: built for and enrolled for. With no enrolment list (a device set up by hand) it is everything the build allows. */export function askedOrigins(built: string[], granted: string[] | undefined): string[] { if (granted === undefined) return [...built]; if (isOpen(built)) return [...granted]; // an open build is limited by what it was enrolled for, which is everything when that is open too if (isOpen(granted)) return [...built]; return built.filter((o) => granted.includes(o));}
/** What a job may name: the approved origins that are also asked about. Approving something outside that adds nothing. */export function effectiveOrigins(built: string[], granted: string[] | undefined, approved: string[]): string[] { const asked = askedOrigins(built, granted); return isOpen(asked) ? [ANY_SITE] : asked.filter((o) => approved.includes(o)); // open on both counts: any site, with nothing to approve (the person's deny list still applies)}
export function validateApproval(list: unknown, asked: string[]): { ok: true; origins: string[] } | { ok: false; message: string } { if (isOpen(asked)) return { ok: false, message: "this device is open: it tests any site except the ones on its list of sites it does not allow, so there is nothing to approve" }; if (!Array.isArray(list) || !list.every((o) => typeof o === "string")) return { ok: false, message: "approve a list of origins, as text" }; const unknown = (list as string[]).find((o) => !asked.includes(o)); if (unknown !== undefined) return { ok: false, message: `${unknown} is not an origin this extension was built for and this device was enrolled for, so it cannot be approved` }; return { ok: true, origins: [...new Set(list as string[])] };}