forked from BasedHardware/omi
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathauth_callback.html
More file actions
207 lines (186 loc) · 7.96 KB
/
Copy pathauth_callback.html
File metadata and controls
207 lines (186 loc) · 7.96 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Authentication Successful - Omi</title>
<style>
body {
font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
display: flex;
flex-direction: column;
align-items: center;
justify-content: center;
min-height: 100vh;
margin: 0;
background-color: #f7f7f7;
color: #333;
}
.card {
background-color: white;
border-radius: 8px;
box-shadow: 0 4px 12px rgba(0, 0, 0, 0.1);
padding: 48px 32px;
text-align: center;
max-width: 400px;
}
.icon {
font-size: 48px;
margin-bottom: 16px;
}
h1 {
font-size: 24px;
font-weight: 600;
margin: 0 0 16px 0;
}
p {
font-size: 16px;
color: #555;
margin: 0;
}
.spinner {
display: inline-block;
width: 40px;
height: 40px;
margin-top: 24px;
border: 4px solid #f3f3f3;
border-top: 4px solid #333;
border-radius: 50%;
animation: spin 1s linear infinite;
}
@keyframes spin {
0% { transform: rotate(0deg); }
100% { transform: rotate(360deg); }
}
.error {
color: #d32f2f;
margin-top: 16px;
font-size: 14px;
}
.manual-link {
display: inline-block;
margin-top: 24px;
padding: 12px 24px;
background-color: #333;
color: white;
text-decoration: none;
border-radius: 6px;
font-weight: 500;
}
.manual-link:hover {
background-color: #555;
}
</style>
</head>
<body>
<div class="card">
<div class="icon">✓</div>
<h1>Authentication Successful</h1>
<p id="message">Redirecting you back to the app...</p>
<div class="spinner" id="spinner"></div>
<div class="error" id="error"></div>
<!-- Keep the server-rendered native-app link visible: mobile browsers
can block script-driven custom-scheme navigation, but honor a
user-initiated link tap even without JavaScript. -->
<a href="{{ redirect_url | default('#') }}" id="manualLink" class="manual-link">Open App Manually</a>
</div>
<script>
// Get values from template variables (passed from backend).
// Use |tojson for safe JS interpolation (prevents XSS via template injection).
// ``redirectUrl`` was built from the redirect URI validated server-side
// at /authorize time. Re-check the scheme/host before navigating as
// defense in depth against a misconfigured upstream.
const code = {{ code | tojson }};
const state = {{ state | tojson }};
const error = {{ (error if error is defined else '') | tojson }};
const redirectUrl = {{ redirect_url | default('') | tojson }};
const errorElement = document.getElementById('error');
const messageElement = document.getElementById('message');
const spinnerElement = document.getElementById('spinner');
const manualLinkElement = document.getElementById('manualLink');
function isAllowedRedirect(uri) {
// Mirrors the server-side allowlist in backend/routers/auth.py
// (see _validate_redirect_uri / _FORBIDDEN_REDIRECT_SCHEMES).
// Must accept ALL native app schemes the Omi family registers
// (omi://, omi-computer://, omi-computer-dev://, com.omi.app://, ...)
// plus http loopback for the CLI; reject https and any
// browser-executable scheme.
if (!uri) return false;
// Pull out the scheme via regex so we don't depend on URL parser
// behavior with unusual custom schemes across browsers.
const m = uri.match(/^([a-zA-Z][a-zA-Z0-9+\-.]*):/);
if (!m) return false;
const scheme = m[1].toLowerCase();
const forbidden = ['https', 'javascript', 'data', 'vbscript', 'file', 'blob', 'filesystem', 'about'];
if (forbidden.indexOf(scheme) !== -1) return false;
if (scheme === 'http') {
try {
const u = new URL(uri);
// URL.hostname returns the bracketless form for IPv6 — compare
// against the bare ``::1`` rather than ``[::1]``.
const host = u.hostname.toLowerCase();
return host === 'localhost' || host === '127.0.0.1' || host === '::1';
} catch (_) {
return false;
}
}
// Native-app custom scheme (omi://, omi-computer://, etc.)
return true;
}
if (error) {
// Handle OAuth error
errorElement.textContent = 'Authentication failed: ' + error;
spinnerElement.style.display = 'none';
messageElement.textContent = 'Please close this window and try again.';
} else if (code) {
if (!isAllowedRedirect(redirectUrl)) {
errorElement.textContent = 'Invalid redirect target. Please close this window.';
spinnerElement.style.display = 'none';
manualLinkElement.style.display = 'none';
messageElement.textContent = '';
} else {
const isLoopback = redirectUrl.indexOf('http://') === 0;
// Loopback users (CLI / desktop apps) get a "you can close this tab" hint —
// their localhost server picks up the code automatically. Mobile users get
// the existing manual-link fallback in case the deep link doesn't fire.
if (isLoopback) {
messageElement.textContent = 'Signing you in — you can close this tab.';
} else {
messageElement.textContent = 'Redirecting you back to the app...';
}
if (isLoopback) {
manualLinkElement.textContent = 'Open Manually';
}
// Attempt automatic redirect
try {
console.log('Redirecting to:', redirectUrl);
window.location.assign(redirectUrl);
// Show manual link after 3 seconds if automatic redirect doesn't work
setTimeout(() => {
if (isLoopback) {
messageElement.textContent = 'If nothing happened, click below:';
} else {
messageElement.textContent = 'If the app doesn\'t open automatically, click below:';
}
spinnerElement.style.display = 'none';
manualLinkElement.style.display = 'inline-block';
}, 3000);
} catch (e) {
console.error('Redirect error:', e);
errorElement.textContent = isLoopback
? 'Could not automatically continue sign-in.'
: 'Could not automatically redirect to the app.';
messageElement.textContent = 'Please click below to continue:';
spinnerElement.style.display = 'none';
manualLinkElement.style.display = 'inline-block';
}
}
} else {
// No code or error in URL
errorElement.textContent = 'Invalid authentication response.';
spinnerElement.style.display = 'none';
messageElement.textContent = 'Please close this window and try again.';
}
</script>
</body>
</html>