simstudioai--sim/apps/sim/app/desktop/auth/validation.ts

const STATE_PATTERN = /^[A-Za-z0-9_-]{16,256}$/
const PORT_PATTERN = /^\d{1,5}$/
const MIN_EPHEMERAL_PORT = 1024
const MAX_PORT = 65535

/**
 * Validates the desktop handoff state parameter: a high-entropy URL-safe
 * value generated by the desktop app. Anything else is rejected before a
 * token is minted.
 */
export function isValidHandoffState(value: unknown): value is string {
  return typeof value === 'string' && STATE_PATTERN.test(value)
}

/**
 * Parses the loopback fallback port the desktop app is listening on.
 * Only non-privileged ports are accepted.
 */
export function parseLoopbackPort(value: unknown): number | null {
  if (typeof value !== 'string' || !PORT_PATTERN.test(value)) {
    return null
  }
  const port = Number(value)
  if (port < MIN_EPHEMERAL_PORT || port > MAX_PORT) {
    return null
  }
  return port
}

/**
 * Rebuilds this page's own path from validated parameters, for use as the
 * post-login callbackUrl.
 */
export function buildDesktopAuthPath(state: string, port: number | null): string {
  const params = new URLSearchParams({ state })
  if (port !== null) {
    params.set('port', String(port))
  }
  return `/desktop/auth?${params.toString()}`
}

/**
 * Builds the loopback callback URL on the `127.0.0.1` IP literal (RFC 8252
 * §7.3 — not `localhost`, which could bind other interfaces). Loopback is the
 * single hand-back channel: it needs no OS scheme registration, so it works
 * identically in dev and packaged builds. It is itself interceptable per RFC
 * 8252 §8.10; the mitigation is the equivalent of PKCE — a single-use,
 * short-TTL token bound to a 128-bit state the app compares in constant time.
 * (RFC's top choice, claimed-`https` universal links, is a future enhancement —
 * it needs an associated-domains entitlement + apple-app-site-association.)
 */
export function buildLoopbackUrl(token: string, state: string, port: number): string {
  const params = new URLSearchParams({ token, state })
  return `http://127.0.0.1:${port}/auth/callback?${params.toString()}`
}