Function validateRedirectUriFormat

shared/auth/api-key-creation.ts:67–92

(redirectUri: string)

};

export function validateRedirectUriFormat(redirectUri: string): void {
    if (!/^[a-z][a-z0-9+\-.]*:\/\/.+/.test(redirectUri)) {
        throw new HTTPException(400, {
            message: "Must be a valid URL with a scheme (e.g. https://...)",
        });
    }
    let parsed: URL;
    try {
        parsed = new URL(redirectUri);
    } catch {
        throw new HTTPException(400, {
            message: "Must be a valid URL with a scheme (e.g. https://...)",
        });
    }
    if (parsed.hash) {
        throw new HTTPException(400, {
            message: "Redirect URI must not include a fragment",
        });
    }
    if (!isAllowedRedirectUrl(parsed)) {
        throw new HTTPException(400, {
            message:
                "Redirect URI must use https://, except http:// is allowed for loopback hosts",
        });
    }
}

function parseMetadata(
    raw: string | null | undefined,