"use strict";

// SSO callback shim. The issuer redirects here with the signed token in the URL
// *fragment* (#token=…&state=…), which the browser never sends to a server. We
// read it client-side and hand it to /_auth/session, which verifies it and sets
// the HttpOnly session cookie. Then we navigate to the page the user wanted.

(function () {
  function fail(msg) {
    var el = document.getElementById("msg");
    if (el) el.textContent = msg;
  }

  var params = new URLSearchParams(location.hash.replace(/^#/, ""));
  var token = params.get("token");
  var state = params.get("state");
  if (!token) {
    fail("Sign-in failed: no token was returned.");
    return;
  }

  fetch("/_auth/session", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    credentials: "same-origin",
    body: JSON.stringify({ token: token, state: state }),
  })
    .then(function (r) {
      if (!r.ok) throw new Error("HTTP " + r.status);
      return r.json();
    })
    .then(function (data) {
      // Replace so the callback URL (with its fragment) leaves no history entry.
      location.replace(data.next || "/");
    })
    .catch(function () {
      fail("Sign-in failed. Please try again.");
    });
})();