plugin updated to use the refresh flow and security tightened

webextension/popup.js

@@ -16,6 +16,35 @@ const authSession = document.getElementById('auth-session');
 
 const t = window.linklogI18n;
 
+function normalizeBackendOrigin(backendUrl) {
+  try {
+    const url = new URL(backendUrl);
+    if (!['http:', 'https:'].includes(url.protocol)) {
+      return null;
+    }
+    return url.origin;
+  } catch (error) {
+    return null;
+  }
+}
+
+async function ensureExactBackendPermission(backendUrl) {
+  const origin = normalizeBackendOrigin(backendUrl);
+  if (!origin) {
+    return false;
+  }
+
+  try {
+    const hasPermission = await browser.permissions.contains({ origins: [`${origin}/*`] });
+    if (hasPermission) {
+      return true;
+    }
+    return await browser.permissions.request({ origins: [`${origin}/*`] });
+  } catch (error) {
+    return false;
+  }
+}
+
 function setStatus(message, isError = false) {
   statusEl.textContent = message;
   statusEl.classList.remove('hidden');
@@ -24,22 +53,99 @@ function setStatus(message, isError = false) {
 }
 
 async function getSettings() {
-  const result = await browser.storage.local.get([
-    'backendUrl',
-    'accessToken',
-    'tokenExpiresAt',
+  const [localSettings, sessionSettings] = await Promise.all([
+    browser.storage.local.get(['backendUrl']),
+    browser.storage.session.get(['accessToken', 'refreshToken', 'tokenExpiresAt', 'deviceId']),
   ]);
-  return result;
+
+  return {
+    backendUrl: localSettings.backendUrl || '',
+    deviceId: sessionSettings.deviceId || '',
+    accessToken: sessionSettings.accessToken || '',
+    refreshToken: sessionSettings.refreshToken || '',
+    tokenExpiresAt: sessionSettings.tokenExpiresAt || '',
+  };
+}
+
+async function persistSession(session) {
+  await browser.storage.local.set({
+    backendUrl: session.backendUrl || '',
+  });
+
+  await browser.storage.session.set({
+    accessToken: session.accessToken || '',
+    refreshToken: session.refreshToken || '',
+    tokenExpiresAt: session.tokenExpiresAt || '',
+    deviceId: session.deviceId || '',
+  });
+}
+
+async function clearSession() {
+  await Promise.all([
+    browser.storage.local.remove(['accessToken', 'tokenType', 'tokenExpiresAt', 'refreshToken', 'deviceId']),
+    browser.storage.session.remove(['accessToken', 'refreshToken', 'tokenExpiresAt', 'deviceId']),
+  ]);
+}
+
+async function refreshAccessToken() {
+  const settings = await getSettings();
+  if (!settings.backendUrl || !settings.refreshToken || !settings.deviceId) {
+    return null;
+  }
+
+  try {
+    const response = await fetch(`${settings.backendUrl}/api/auth/refresh`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        refresh_token: settings.refreshToken,
+        device_id: settings.deviceId,
+      }),
+    });
+
+    if (!response.ok) {
+      await clearSession();
+      return null;
+    }
+
+    const data = await response.json();
+    const refreshed = {
+      ...settings,
+      accessToken: data.access_token,
+      refreshToken: data.refresh_token,
+      tokenExpiresAt: data.expires_at,
+      deviceId: data.device_id || settings.deviceId,
+    };
+    await persistSession(refreshed);
+    return refreshed;
+  } catch (error) {
+    return null;
+  }
 }
 
 async function validateSession(settings) {
   if (!settings.backendUrl || !settings.accessToken) return null;
+  if (!(await ensureExactBackendPermission(settings.backendUrl))) {
+    await clearSession();
+    return null;
+  }
   try {
     const response = await fetch(`${settings.backendUrl}/api/auth/me`, {
       headers: {'Authorization': `Bearer ${settings.accessToken}`},
     });
     if (!response.ok) {
-      await browser.storage.local.remove(['accessToken', 'tokenType', 'tokenExpiresAt', 'refreshToken']);
+      if (response.status === 401) {
+        const refreshed = await refreshAccessToken();
+        if (refreshed && refreshed.accessToken) {
+          const retry = await fetch(`${refreshed.backendUrl}/api/auth/me`, {
+            headers: {'Authorization': `Bearer ${refreshed.accessToken}`},
+          });
+          if (retry.ok) {
+            return await retry.json();
+          }
+        }
+      }
+      await clearSession();
       return null;
     }
     return await response.json();
@@ -79,11 +185,12 @@ function showSavedState(message) {
 }
 
 async function updateFeedLink() {
-  const settings = await browser.storage.local.get(['backendUrl', 'username', 'accessToken']);
-  if (!settings.backendUrl || !settings.username || !settings.accessToken) return;
+  const settings = await getSettings();
+  if (!settings.backendUrl || !settings.accessToken) return;
+  const username = await browser.storage.local.get(['username']);
   try {
     const backend = new URL(settings.backendUrl);
-    feedLink.href = `${backend.origin}/${encodeURIComponent(settings.username)}/`;
+    feedLink.href = `${backend.origin}/${encodeURIComponent(username.username || settings.deviceId || 'user')}/`;
     feedLink.classList.remove('hidden');
   } catch (error) {
     feedLink.classList.add('hidden');
@@ -181,6 +288,12 @@ async function handleSubmit(event) {
   const token = settings.accessToken;
   const backendUrl = settings.backendUrl;
 
+  if (!backendUrl || !(await ensureExactBackendPermission(backendUrl))) {
+    setStatus(t('configureAndLogIn'), true);
+    browser.runtime.openOptionsPage();
+    return;
+  }
+
   if (!token || !backendUrl) {
     setStatus(t('configureAndLogIn'), true);
     browser.runtime.openOptionsPage();