Derive callback footer link labels from branding constants

The URLs lived in branding.ts while their display text stayed inline in the
page template, so a rename would have had to touch both. Add matching label
constants and restore the no-external-assets guard to its full strength by
stripping the two intentional footer links before asserting no other
off-machine URL or network call appears.

Author: TheGreatAxios

src/auth/callback-page.test.ts

@@ -1,5 +1,11 @@
 import { describe, expect, test } from "bun:test";
 
+import {
+  PRODUCT_GITHUB_LABEL,
+  PRODUCT_GITHUB_URL,
+  PRODUCT_SITE_LABEL,
+  PRODUCT_SITE_URL,
+} from "../branding.js";
 import { callbackPageHtml, humanizeIdentifier } from "./callback-page.js";
 
 describe("humanizeIdentifier", () => {
@@ -42,19 +48,49 @@ describe("callbackPageHtml", () => {
     );
   });
 
-  test("success footer links to corbits.dev and the GitHub org", () => {
+  test("the footer links to the product site and the GitHub org", () => {
     const html = callbackPageHtml({ subject: "linear" });
-    expect(html).toContain('href="https://corbits.dev"');
-    expect(html).toContain('href="https://github.com/corbitsdev"');
-    expect(html).toContain(">corbits.dev<");
-    expect(html).toContain(">github.com/corbitsdev<");
+    const link = (url: string, label: string) =>
+      `<a href="${url}" target="_blank" rel="noopener noreferrer">${label}</a>`;
+    expect(html).toContain(link(PRODUCT_SITE_URL, PRODUCT_SITE_LABEL));
+    expect(html).toContain(link(PRODUCT_GITHUB_URL, PRODUCT_GITHUB_LABEL));
   });
 
-  test("the page loads no off-machine assets", () => {
-    const html = callbackPageHtml({ subject: "linear" });
-    // Product links in the footer are intentional; nothing else may fetch.
-    expect(html).not.toMatch(/<(?:link|script)\b[^>]+\bsrc=/i);
-    expect(html).not.toMatch(/@import\b/);
-    expect(html).not.toMatch(/url\(\s*["']?https?:/i);
+  test("each footer label names the destination its URL actually points at", () => {
+    expect(PRODUCT_SITE_URL).toContain(PRODUCT_SITE_LABEL);
+    expect(PRODUCT_GITHUB_URL).toContain(PRODUCT_GITHUB_LABEL);
   });
+
+  // An allowlist rather than a shape match: an unexpected origin fails loudly
+  // instead of passing because it happened to be wrapped in an anchor tag.
+  const allowedOrigins = new Set([
+    PRODUCT_SITE_URL,
+    PRODUCT_GITHUB_URL,
+    // The SVG namespace the wordmark declares; a URI, never fetched.
+    "http://www.w3.org/2000/svg",
+  ]);
+
+  const offMachineOrigins = (html: string): readonly string[] => {
+    // Scheme-qualified and protocol-relative alike, since either would load.
+    const found =
+      html.match(
+        /(?:[a-z][a-z0-9+.-]*:)?\/\/[a-z0-9-]+(?:\.[a-z0-9-]+)+[^"'`)\s<>]*/gi,
+      ) ?? [];
+    return found.filter(
+      (ref) => ![...allowedOrigins].some((origin) => ref.startsWith(origin)),
+    );
+  };
+
+  for (const [outcome, page] of [
+    ["success", { subject: "linear" }],
+    ["failure", { subject: "linear", error: "access_denied" }],
+  ] as const) {
+    test(`the ${outcome} page names no off-machine origin beyond the footer links`, () => {
+      const html = callbackPageHtml(page);
+      expect(offMachineOrigins(html)).toEqual([]);
+      expect(html).not.toMatch(
+        /\b(?:fetch|XMLHttpRequest|WebSocket|EventSource|sendBeacon|importScripts)\s*\(/,
+      );
+    });
+  }
 });

src/auth/callback-page.ts

@@ -15,8 +15,10 @@
  */
 
 import {
+  PRODUCT_GITHUB_LABEL,
   PRODUCT_GITHUB_URL,
   PRODUCT_NAME,
+  PRODUCT_SITE_LABEL,
   PRODUCT_SITE_URL,
 } from "../branding.js";
 
@@ -245,6 +247,16 @@ export function humanizeIdentifier(raw: string): string {
   return words.charAt(0).toUpperCase() + words.slice(1);
 }
 
+/**
+ * A footer link, preceded by its separator.
+ *
+ * Opens in a new tab so the operator keeps the tab telling them the
+ * authorization finished and this window is safe to close.
+ */
+function footerLink(url: string, label: string): string {
+  return `<span class="sep" aria-hidden="true">·</span><a href="${url}" target="_blank" rel="noopener noreferrer">${label}</a>`;
+}
+
 export type CallbackPage = {
   /** What was being authorized: an MCP server or provider name. */
   readonly subject?: string;
@@ -292,7 +304,7 @@ export function callbackPageHtml(page: CallbackPage = {}): string {
     `<h1>${heading}</h1>`,
     `<p class="body">${body}</p>`,
     "<hr>",
-    `<footer>${PRODUCT_NAME}<span class="sep" aria-hidden="true">·</span><a href="${PRODUCT_SITE_URL}">corbits.dev</a><span class="sep" aria-hidden="true">·</span><a href="${PRODUCT_GITHUB_URL}">github.com/corbitsdev</a></footer>`,
+    `<footer>${PRODUCT_NAME}${footerLink(PRODUCT_SITE_URL, PRODUCT_SITE_LABEL)}${footerLink(PRODUCT_GITHUB_URL, PRODUCT_GITHUB_LABEL)}</footer>`,
     "</div>",
     "</main></body>",
     `<script>${SCRIPT}</script>`,

src/branding.ts

@@ -11,9 +11,13 @@ export const PRODUCT_NAME = "Corbits Code";
 // Short attribution form used in compact UI (status lines, footers).
 export const PRODUCT_SHORT_NAME = "Corbits";
 
-// Canonical public URLs shown on the OAuth callback page and other brand surfaces.
+// Canonical public URLs, each paired with the text shown in its place. The label
+// is spelled out rather than stripped from the URL so it can diverge from the
+// bare host later without a rendering helper having to special-case it.
 export const PRODUCT_SITE_URL = "https://corbits.dev";
+export const PRODUCT_SITE_LABEL = "corbits.dev";
 export const PRODUCT_GITHUB_URL = "https://github.com/corbitsdev";
+export const PRODUCT_GITHUB_LABEL = "github.com/corbitsdev";
 
 export const COMMAND_NAME = "corbits";