Fix Firefox desktop OIDC callback (#1044)

src/backend/utils/oidc-desktop-callback.test.ts

@@ -0,0 +1,38 @@
+import { describe, expect, it } from "vitest";
+import {
+  getDesktopOidcCallbackUrl,
+  isOidcTokenCallback,
+} from "./oidc-desktop-callback";
+
+describe("getDesktopOidcCallbackUrl", () => {
+  it("uses localhost so browsers do not upgrade the loopback callback", () => {
+    expect(getDesktopOidcCallbackUrl("17850")).toBe(
+      "http://localhost:17850/oidc-callback",
+    );
+  });
+
+  it.each(["", "0", "65536", "17850/path", ["17850"]])(
+    "rejects invalid callback port %j",
+    (port) => {
+      expect(getDesktopOidcCallbackUrl(port)).toBeNull();
+    },
+  );
+});
+
+describe("isOidcTokenCallback", () => {
+  it.each([
+    "http://localhost:17850/oidc-callback",
+    "http://127.0.0.1:17850/oidc-callback",
+    "termix-mobile://oidc-callback",
+  ])("recognizes app callback %s", (url) => {
+    expect(isOidcTokenCallback(url)).toBe(true);
+  });
+
+  it.each([
+    "https://localhost:17850/oidc-callback",
+    "http://example.com:17850/oidc-callback",
+    "http://localhost:17850/other",
+  ])("rejects non-app callback %s", (url) => {
+    expect(isOidcTokenCallback(url)).toBe(false);
+  });
+});

src/backend/utils/oidc-desktop-callback.ts

@@ -0,0 +1,25 @@
+const CALLBACK_PATH = "/oidc-callback";
+
+export function getDesktopOidcCallbackUrl(value: unknown): string | null {
+  if (typeof value !== "string" || !/^\d+$/.test(value)) return null;
+
+  const port = Number(value);
+  if (!Number.isInteger(port) || port < 1 || port > 65535) return null;
+
+  return `http://localhost:${port}${CALLBACK_PATH}`;
+}
+
+export function isOidcTokenCallback(value: string): boolean {
+  if (value.startsWith("termix-mobile:")) return true;
+
+  try {
+    const url = new URL(value);
+    return (
+      url.protocol === "http:" &&
+      (url.hostname === "localhost" || url.hostname === "127.0.0.1") &&
+      url.pathname === CALLBACK_PATH
+    );
+  } catch {
+    return false;
+  }
+}