peter
ef99f7b5c7
- /auth/google/connect is a navigation and carries no headers: the tab names the account it was built for in `expect`, checked by the same comparison as the request header (built_for_another_account); a mismatch lands on /?account=changed - the link marker names the OAuth state of its own flow: an older flow coming back no longer spends the marker of the connect still open (which then returned as a plain sign-in) - a 401 account_changed reloads the tab with a one-time flag, and the reloaded tab says it now shows the account signed in - a refused switch to a suspended or not-yet-approved account says so in the signed-in app's words, naming the address a request was recorded for - the prefs merge locks FOR NO KEY UPDATE, so a transaction that only added a row referring to the account does not hold the save up; a test pins the lock - giving up a lost page closes a channel page open over it - e2e README names the chromium-only specs
25 lines
1.2 KiB
TypeScript
25 lines
1.2 KiB
TypeScript
// Every in-app Google round-trip starts at one backend route (auth.py `google_connect`): attaching a
|
|
// Google sign-in to the account (`identity`), or granting YouTube access on top (`read`, `write`).
|
|
// The page navigates away to Google and comes back through the shared callback, which lands on
|
|
// `?link=…` (App.tsx) for `identity` and on the app itself for a grant. A navigation carries no
|
|
// headers, so it names the account the tab was built for in the query (`expect`) — the check every
|
|
// request gets (`identityHeaders`): a tab still showing the account signed in before would otherwise
|
|
// attach Google to the one signed in now.
|
|
|
|
import { claimedAccount } from "./storage";
|
|
|
|
export const GOOGLE_ACCESS = ["identity", "read", "write"] as const;
|
|
export type GoogleAccess = (typeof GOOGLE_ACCESS)[number];
|
|
|
|
export function googleConnectUrl(access: GoogleAccess): string {
|
|
const params = new URLSearchParams({ access });
|
|
const account = claimedAccount();
|
|
if (account) params.set("expect", account);
|
|
return `/auth/google/connect?${params.toString()}`;
|
|
}
|
|
|
|
/** Leave for Google's sign-in or consent screen. */
|
|
export function connectGoogle(access: GoogleAccess): void {
|
|
window.location.href = googleConnectUrl(access);
|
|
}
|