64 lines
2.2 KiB
JavaScript
64 lines
2.2 KiB
JavaScript
import { cookiesUsable, login, loginUnavailable } from "./scram.js";
|
|
|
|
const base = new URL("..", location.href);
|
|
const form = document.getElementById("login");
|
|
const button = form.querySelector("button");
|
|
const progress = document.getElementById("progress");
|
|
const status = document.getElementById("status");
|
|
|
|
// Same origin only: an open redirect would lend this page to phishing
|
|
function nextTarget() {
|
|
const next = new URLSearchParams(location.search).get("next");
|
|
if (!next) return null;
|
|
try {
|
|
const url = new URL(next, location.href);
|
|
return url.origin === location.origin ? url : null;
|
|
} catch {
|
|
return null;
|
|
}
|
|
}
|
|
|
|
form.addEventListener("submit", async (event) => {
|
|
event.preventDefault();
|
|
const fields = new FormData(form);
|
|
button.disabled = true;
|
|
progress.removeAttribute("value");
|
|
progress.hidden = false;
|
|
status.textContent = "Deriving the key, this takes a few seconds…";
|
|
try {
|
|
const session = await login(base, fields.get("username"), fields.get("password"), {
|
|
onProgress: (fraction) => { progress.value = fraction; },
|
|
});
|
|
form.elements.password.value = "";
|
|
const target = nextTarget();
|
|
if (target) {
|
|
location.replace(target.href);
|
|
return;
|
|
}
|
|
status.textContent = `Signed in as ${session.username}.`;
|
|
} catch (err) {
|
|
status.textContent = err.message;
|
|
} finally {
|
|
progress.hidden = true;
|
|
button.disabled = false;
|
|
}
|
|
});
|
|
|
|
// A sign-in here only sets a cookie; the viewer, when the sink serves it,
|
|
// signs in by itself and keeps a token in memory instead
|
|
async function cookiesUnavailable() {
|
|
status.textContent = "This browser keeps no cookie for this site, so a sign-in here would not last.";
|
|
const viewer = await fetch("view", { method: "HEAD", cache: "no-store", redirect: "error" }).catch(() => null);
|
|
if (!viewer?.ok) return;
|
|
const link = document.createElement("a");
|
|
link.href = "view";
|
|
link.textContent = "Sign in on the viewer instead.";
|
|
status.append(" ", link);
|
|
}
|
|
|
|
// Enabled only once this script runs, so a failed load cannot submit the form natively
|
|
const unavailable = loginUnavailable();
|
|
if (unavailable) status.textContent = unavailable;
|
|
else if (cookiesUsable()) button.disabled = false;
|
|
else cookiesUnavailable();
|