Derive callback footer link labels from branding constants

The URLs lived in branding.ts while their display text stayed inline in the
page template, so a rename would have had to touch both. Add matching label
constants and restore the no-external-assets guard to its full strength by
stripping the two intentional footer links before asserting no other
off-machine URL or network call appears.

Author: TheGreatAxios

src/auth/callback-page.test.ts

@@ -1,5 +1,11 @@
 import { describe, expect, test } from "bun:test";
 
+import {
+  PRODUCT_GITHUB_LABEL,
+  PRODUCT_GITHUB_URL,
+  PRODUCT_SITE_LABEL,
+  PRODUCT_SITE_URL,
+} from "../branding.js";
 import { callbackPageHtml, humanizeIdentifier } from "./callback-page.js";
 
 describe("humanizeIdentifier", () => {
@@ -42,19 +48,25 @@ describe("callbackPageHtml", () => {
     );
   });
 
-  test("success footer links to corbits.dev and the GitHub org", () => {
+  test("the footer links to the product site and the GitHub org", () => {
     const html = callbackPageHtml({ subject: "linear" });
-    expect(html).toContain('href="https://corbits.dev"');
-    expect(html).toContain('href="https://github.com/corbitsdev"');
-    expect(html).toContain(">corbits.dev<");
-    expect(html).toContain(">github.com/corbitsdev<");
+    const link = (url: string, label: string) =>
+      `<a href="${url}" target="_blank" rel="noopener noreferrer">${label}</a>`;
+    expect(html).toContain(link(PRODUCT_SITE_URL, PRODUCT_SITE_LABEL));
+    expect(html).toContain(link(PRODUCT_GITHUB_URL, PRODUCT_GITHUB_LABEL));
   });
 
-  test("the page loads no off-machine assets", () => {
+  test("the page names no off-machine origin beyond the footer links", () => {
+    // An allowlist rather than a shape match: a fifth URL fails loudly instead
+    // of passing because it happened to be wrapped in an anchor tag.
+    const allowed = new Set([
+      PRODUCT_SITE_URL,
+      PRODUCT_GITHUB_URL,
+      "http://www.w3.org/2000/svg",
+    ]);
     const html = callbackPageHtml({ subject: "linear" });
-    // Product links in the footer are intentional; nothing else may fetch.
-    expect(html).not.toMatch(/<(?:link|script)\b[^>]+\bsrc=/i);
-    expect(html).not.toMatch(/@import\b/);
-    expect(html).not.toMatch(/url\(\s*["']?https?:/i);
+    const found = html.match(/https?:\/\/[^"')\s]+/g) ?? [];
+    expect(found.filter((url) => !allowed.has(url))).toEqual([]);
+    expect(html).not.toMatch(/\b(?:fetch|XMLHttpRequest|WebSocket|sendBeacon)\s*\(/);
   });
 });

src/auth/callback-page.ts

@@ -15,8 +15,10 @@
  */
 
 import {
+  PRODUCT_GITHUB_LABEL,
   PRODUCT_GITHUB_URL,
   PRODUCT_NAME,
+  PRODUCT_SITE_LABEL,
   PRODUCT_SITE_URL,
 } from "../branding.js";
 
@@ -245,6 +247,16 @@ export function humanizeIdentifier(raw: string): string {
   return words.charAt(0).toUpperCase() + words.slice(1);
 }
 
+/**
+ * A footer link, preceded by its separator.
+ *
+ * Opens in a new tab so the operator keeps the tab telling them the
+ * authorization finished and this window is safe to close.
+ */
+function footerLink(url: string, label: string): string {
+  return `<span class="sep" aria-hidden="true">·</span><a href="${url}" target="_blank" rel="noopener noreferrer">${label}</a>`;
+}
+
 export type CallbackPage = {
   /** What was being authorized: an MCP server or provider name. */
   readonly subject?: string;
@@ -292,7 +304,7 @@ export function callbackPageHtml(page: CallbackPage = {}): string {
     `<h1>${heading}</h1>`,
     `<p class="body">${body}</p>`,
     "<hr>",
-    `<footer>${PRODUCT_NAME}<span class="sep" aria-hidden="true">·</span><a href="${PRODUCT_SITE_URL}">corbits.dev</a><span class="sep" aria-hidden="true">·</span><a href="${PRODUCT_GITHUB_URL}">github.com/corbitsdev</a></footer>`,
+    `<footer>${PRODUCT_NAME}${footerLink(PRODUCT_SITE_URL, PRODUCT_SITE_LABEL)}${footerLink(PRODUCT_GITHUB_URL, PRODUCT_GITHUB_LABEL)}</footer>`,
     "</div>",
     "</main></body>",
     `<script>${SCRIPT}</script>`,

src/branding.ts

@@ -11,9 +11,12 @@ export const PRODUCT_NAME = "Corbits Code";
 // Short attribution form used in compact UI (status lines, footers).
 export const PRODUCT_SHORT_NAME = "Corbits";
 
-// Canonical public URLs shown on the OAuth callback page and other brand surfaces.
+// Canonical public URLs, with the display text that accompanies each, so a link
+// and its label cannot drift apart when a domain or org name changes.
 export const PRODUCT_SITE_URL = "https://corbits.dev";
+export const PRODUCT_SITE_LABEL = "corbits.dev";
 export const PRODUCT_GITHUB_URL = "https://github.com/corbitsdev";
+export const PRODUCT_GITHUB_LABEL = "github.com/corbitsdev";
 
 export const COMMAND_NAME = "corbits";