feat: enable subscription connections in web and dev

src/server/web-subscription-http.ts

@@ -0,0 +1,68 @@
+import { NATIVE_SUBSCRIPTIONS } from "../core/contracts/subscriptions.ts";
+import { webSubscriptionOwner, webSubscriptionsEnabled, webSubscriptionStatus } from "./web-subscriptions.ts";
+
+const HEADERS = { "Cache-Control": "no-store", "Referrer-Policy": "no-referrer", "X-Content-Type-Options": "nosniff" };
+/** Same-origin browser controls, not user authentication. Web/dev deliberately
+ * retains the existing shared-server/API-key trust model. Never trust forwarded
+ * origins or add CORS grants here. A public deployment needs its own access gate. */
+export function subscriptionRequestOrigin(request: Request): string | undefined {
+	try {
+		const url = new URL(request.url);
+		const host = request.headers.get("host") ?? url.host;
+		const addressed = new URL(`${url.protocol}//${host}`);
+		if (!["http:", "https:"].includes(addressed.protocol) || addressed.username || addressed.password || addressed.pathname !== "/" || addressed.search || addressed.hash) return;
+		return addressed.origin;
+	} catch { return; }
+}
+function authorized(request: Request): boolean {
+	const origin = subscriptionRequestOrigin(request);
+	if (!origin || request.headers.get("x-learnharness-subscriptions") !== "1") return false;
+	if (request.headers.get("sec-fetch-site") === "cross-site") return false;
+	const supplied = request.headers.get("origin");
+	return request.method === "GET" ? !supplied || supplied === origin : supplied === origin;
+}
+function error(message: string, status: number) { return Response.json({ error: message }, { status, headers: HEADERS }); }
+export async function subscriptionControlsResponse(request: Request): Promise<Response> {
+	if (!webSubscriptionsEnabled()) return error("Web subscription controls are unavailable in desktop-owned mode.", 404);
+	if (!authorized(request)) return error("Subscription controls require a same-origin LearnHarness request.", 403);
+	try {
+		if (request.method === "GET") return Response.json(await webSubscriptionStatus(), { headers: HEADERS });
+		if (request.method !== "POST") return error("Unsupported method.", 405);
+		if (request.headers.get("content-type")?.split(";")[0]?.trim() !== "application/json") return error("Expected JSON.", 415);
+		// Bound both advertised and streamed input before parsing commands.
+		if (Number(request.headers.get("content-length")) > 16384) return error("Request too large.", 413);
+		const reader = request.body?.getReader();
+		if (!reader) return error("Expected a command.", 400);
+		const chunks: Uint8Array[] = []; let size = 0;
+		try {
+			for (;;) {
+				const next = await reader.read(); if (next.done) break;
+				size += next.value.byteLength;
+				if (size > 16384) { await reader.cancel(); return error("Request too large.", 413); }
+				chunks.push(next.value);
+			}
+		} finally { reader.releaseLock(); }
+		const command: unknown = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+		if (!command || typeof command !== "object" || Array.isArray(command)) return error("Invalid command.", 400);
+		const fields = command as Record<string, unknown>;
+		const providerId = fields.providerId;
+		if (providerId !== "chatgpt" && !NATIVE_SUBSCRIPTIONS.some((provider) => provider.providerId === providerId)) return error("Unsupported connection.", 400);
+		const allowed = providerId === "chatgpt" ? ["login", "cancel", "select", "disconnect", "logout", "consent"] : ["login", "cancel", "respond", "open", "retry", "disconnect", "consent"];
+		if (typeof fields.op !== "string" || !allowed.includes(fields.op)) return error("Unsupported control.", 400);
+		return Response.json(await webSubscriptionOwner().control(providerId as string, fields, subscriptionRequestOrigin(request)!), { headers: HEADERS });
+	} catch {
+		return error("The subscription connection could not be changed. Retry or reconnect in Providers.", 400);
+	}
+}
+/** One-use same-origin navigation. Full provider authorization URLs go only to
+ * a top-level browser redirect, never status JSON, the SSE bus or application JS. */
+export async function subscriptionBrowserResponse(request: Request): Promise<Response> {
+	if (!webSubscriptionsEnabled()) return error("Unavailable.", 404);
+	const origin = subscriptionRequestOrigin(request);
+	if (!origin || (request.method === "POST" ? !authorized(request) : request.headers.get("sec-fetch-site") !== "same-origin")) return error("Open sign-in from LearnHarness.", 403);
+	const id = new URL(request.url).searchParams.get("id");
+	if (!id || !/^[0-9a-f-]{36}$/.test(id)) return error("This sign-in action is no longer available.", 410);
+	const target = await webSubscriptionOwner().takeBrowserAction(id, origin);
+	if (!target) return error("This sign-in action is no longer available.", 410);
+	return new Response(null, { status: 303, headers: { ...HEADERS, Location: target } });
+}