@clerk/shared/dist/internal/clerk-js/windowNavigate.mjs.map

Internal package utils used by the Clerk SDKs

{"version":3,"file":"windowNavigate.mjs","names":[],"sources":["../../../src/internal/clerk-js/windowNavigate.ts"],"sourcesContent":["export const CLERK_BEFORE_UNLOAD_EVENT = 'clerk:beforeunload';\n\n/**\n * Additional protocols can be provided using the `allowedRedirectProtocols` Clerk option.\n */\nexport const ALLOWED_PROTOCOLS = [\n  'http:',\n  'https:',\n  // Refers to https://wails.io/\n  'wails:',\n  'chrome-extension:',\n];\n\nexport type WindowNavigateOptions = {\n  /**\n   * Protocol allowlist applied to the resolved URL. Defaults to `ALLOWED_PROTOCOLS`. Pass an\n   * extended list (e.g. `Clerk`'s `#allowedRedirectProtocols`) to honor the customer-supplied\n   * `allowedRedirectProtocols` option.\n   */\n  allowedProtocols?: ReadonlyArray<string>;\n};\n\nconst SCHEME_RELATIVE_PREFIX = /^[/\\\\][/\\\\]/;\n\n/**\n * Normalizes a string the same way the WHATWG URL parser does before it parses: strip leading C0\n * control and space characters, then remove ASCII tab/LF/CR from anywhere. Without this, inputs\n * like `/\\t/evil.com` or `\\x00//evil.com` slip past the scheme-relative check yet still resolve\n * scheme-relative (inheriting the base's allowlisted scheme) and redirect cross-origin.\n */\nfunction stripUrlParserIgnoredChars(to: string): string {\n  let start = 0;\n  while (start < to.length && to.charCodeAt(start) <= 0x20) {\n    start++;\n  }\n  let result = '';\n  for (let i = start; i < to.length; i++) {\n    const code = to.charCodeAt(i);\n    if (code !== 0x09 && code !== 0x0a && code !== 0x0d) {\n      result += to[i];\n    }\n  }\n  return result;\n}\n\n/**\n * Helper utility to navigate via window.location.href. Also dispatches a clerk:beforeunload custom event.\n *\n * Navigations whose protocol is not in the allowlist (e.g. `javascript:`, `data:`) are aborted.\n * Scheme-relative inputs (`//host`, `\\\\host`) are also rejected: they adopt the base URL's scheme,\n * which is always in the allowlist, so they would otherwise pass the protocol check while\n * redirecting cross-origin.\n *\n * Callers that have already validated against an extended allowlist should pass it via\n * `options.allowedProtocols` so legitimate custom protocols (Wails, Tauri, etc.) are honored.\n *\n * @deprecated Use `clerk.__internal_windowNavigate` instead. It honors the customer-supplied\n * `allowedRedirectProtocols` option by default, so internal call sites can't accidentally\n * bypass it by forgetting to pass `options.allowedProtocols`. The bare export will be removed\n * in the next major version.\n */\nexport function windowNavigate(to: URL | string, options?: WindowNavigateOptions): void {\n  if (typeof to === 'string' && SCHEME_RELATIVE_PREFIX.test(stripUrlParserIgnoredChars(to))) {\n    console.warn(\n      `Clerk: scheme-relative navigation to \"${to}\" is not allowed. Provide a same-origin path or an absolute URL.`,\n    );\n    return;\n  }\n  const toURL = new URL(to, window.location.href);\n  const allowedProtocols = options?.allowedProtocols ?? ALLOWED_PROTOCOLS;\n  if (!allowedProtocols.includes(toURL.protocol)) {\n    console.warn(\n      `Clerk: \"${toURL.protocol}\" is not a valid navigation protocol. Aborting navigation. If you think this is a mistake, please open an issue.`,\n    );\n    return;\n  }\n  window.dispatchEvent(new CustomEvent(CLERK_BEFORE_UNLOAD_EVENT));\n  window.location.href = toURL.href;\n}\n"],"mappings":";AAAA,MAAa,4BAA4B;;;;AAKzC,MAAa,oBAAoB;CAC/B;CACA;CAEA;CACA;AACF;AAWA,MAAM,yBAAyB;;;;;;;AAQ/B,SAAS,2BAA2B,IAAoB;CACtD,IAAI,QAAQ;CACZ,OAAO,QAAQ,GAAG,UAAU,GAAG,WAAW,KAAK,KAAK,IAClD;CAEF,IAAI,SAAS;CACb,KAAK,IAAI,IAAI,OAAO,IAAI,GAAG,QAAQ,KAAK;EACtC,MAAM,OAAO,GAAG,WAAW,CAAC;EAC5B,IAAI,SAAS,KAAQ,SAAS,MAAQ,SAAS,IAC7C,UAAU,GAAG;CAEjB;CACA,OAAO;AACT;;;;;;;;;;;;;;;;;AAkBA,SAAgB,eAAe,IAAkB,SAAuC;CACtF,IAAI,OAAO,OAAO,YAAY,uBAAuB,KAAK,2BAA2B,EAAE,CAAC,GAAG;EACzF,QAAQ,KACN,yCAAyC,GAAG,iEAC9C;EACA;CACF;CACA,MAAM,QAAQ,IAAI,IAAI,IAAI,OAAO,SAAS,IAAI;CAE9C,IAAI,EADqB,SAAS,oBAAoB,kBACjC,CAAC,SAAS,MAAM,QAAQ,GAAG;EAC9C,QAAQ,KACN,WAAW,MAAM,SAAS,iHAC5B;EACA;CACF;CACA,OAAO,cAAc,IAAI,YAAY,yBAAyB,CAAC;CAC/D,OAAO,SAAS,OAAO,MAAM;AAC/B"}