{"version":3,"file":"links.es.mjs","names":[],"sources":["../src/links/isAllowedIframeSrc.ts"],"sourcesContent":["// Hosts allowed to be framed inside sanitized article content. Article HTML is\n// first-party authored in Staffbase, but it renders inside a session-bearing\n// webview, so iframe sources are constrained to known embed providers plus the\n// Staffbase origin rather than allowing arbitrary framing. Promoted from\n// staffbase-alerts.\nconst ALLOWED_IFRAME_HOST_SUFFIXES = [\n  'youtube.com',\n  'youtube-nocookie.com',\n  'youtu.be',\n  'vimeo.com',\n  'player.vimeo.com',\n  'staffbase.com',\n  'staffbase.rocks',\n]\n\n/**\n * Returns true when an iframe src may be rendered. Same-origin sources are\n * always allowed; cross-origin sources must match the embed allowlist. Pair with\n * sanitizeArticleHtml's `isAllowedIframeSrc` option.\n * @param {string} src - The iframe src attribute value.\n * @returns {boolean} True when the iframe may be kept.\n */\nexport const isAllowedIframeSrc = (src: string): boolean => {\n  const trimmed = src.trim()\n  if (!trimmed) return false\n\n  try {\n    const origin =\n      typeof window !== 'undefined'\n        ? window.location.origin\n        : 'https://localhost'\n    const url = new URL(trimmed, origin)\n\n    if (url.protocol !== 'https:' && url.protocol !== 'http:') return false\n    if (url.origin === origin) return true\n\n    const host = url.hostname.toLowerCase()\n    return ALLOWED_IFRAME_HOST_SUFFIXES.some(\n      (suffix) => host === suffix || host.endsWith(`.${suffix}`),\n    )\n  } catch {\n    return false\n  }\n}\n"],"mappings":";;AAKA,IAAM,IAA+B;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;AACF,GASa,KAAsB,MAAyB;CAC1D,IAAM,IAAU,EAAI,KAAK;CACzB,IAAI,CAAC,GAAS,OAAO;CAErB,IAAI;EACF,IAAM,IACJ,OAAO,SAAW,MACd,OAAO,SAAS,SAChB,qBACA,IAAM,IAAI,IAAI,GAAS,CAAM;EAEnC,IAAI,EAAI,aAAa,YAAY,EAAI,aAAa,SAAS,OAAO;EAClE,IAAI,EAAI,WAAW,GAAQ,OAAO;EAElC,IAAM,IAAO,EAAI,SAAS,YAAY;EACtC,OAAO,EAA6B,MACjC,MAAW,MAAS,KAAU,EAAK,SAAS,IAAI,GAAQ,CAC3D;CACF,QAAQ;EACN,OAAO;CACT;AACF"}