{"version":3,"file":"logout-link-override-section.min.js","mappings":"yZA0DO,SAAeA,EACpBC,GACA,QAD2B,IAA3BA,IAAAA,EAA8B,oBACF,aAAxBC,SAASC,YAAuC,qBAATF,GACjB,gBAAxBC,SAASC,WAA+B,CACxC,MAAMC,EAAQC,WAAWL,EAAU,GAEnC,MAD8B,IAAMM,aAAaF,EAEnD,CACEG,iBAAiBN,EAAMD,EAI3B,CCbAQ,CAvCA,WAAmB,IAAAC,EAEjB,GAA0B,MAAtBC,SAASC,SACX,OAIF,GAAID,SAASC,SAASC,SAAS,sBAC7B,OAIF,GAAoD,OAAhDH,EAACI,6BAA6BC,sBAA7BL,EAAiDM,WAAW,KAC/D,OAKF,MAAMC,EAAa,IAAIC,IAAIP,SAASQ,MACpCF,EAAWG,aAAaC,OAAO,aAE/B,MAAMC,EAAYL,EAAWL,SAAWK,EAAWM,OAO7CC,EAAW,YAAYV,6BAA6BC,uBACpDU,EAAUtB,SAASuB,iBAAoCF,GAC7D,IAAK,MAAMG,KAAUF,EAAS,CAG5B,MAAMG,EAAM,IAAIV,IAAIS,EAAOR,MAC3BS,EAAIR,aAAaS,IAAI,aAAcP,GACnCK,EAAOR,KAAOS,EAAIT,IACpB,CACF","sources":["webpack://lange/./lib/dom-ready.ts","webpack://lange/./sections/logout-link-override/index.ts"],"sourcesContent":["/**\n * Releases the handle returned from the ready() function.\n *\n * This is idempotent. Additional calls are pointless but harmless.\n */\nexport type ReleaseHandle = () => void;\n\n/**\n * A subset of events that pertain to document ready state.\n */\ntype LoadingEventMap = Pick<DocumentEventMap, 'DOMContentLoaded' | 'load'>;\n\n/**\n * Calls the provided callback when the document is ready. This works both when the document is\n * already ready and when it is not, so callers do not have to care. This exists because it ensures\n * that each caller consistently expresses its dependency on document readiness, and to save a bit\n * of boilerplate.\n *\n * A document is considered ready when it has been parsed. This corresponds to the ready state of\n * 'interactive'. When the document has been fully loaded, the ready state is 'complete'. The\n * callback runs either way, so callers do not have to check which one they are in.\n *\n * Ready means the html is parsed and the DOM is there to query. It does not mean the page's other\n * scripts have run. Deferred scripts and module scripts run after the ready state turns\n * 'interactive' and before DOMContentLoaded fires, so a callback here can run before them. When a\n * caller needs some other script to have run already, this is the wrong tool, and it should wait on\n * whatever that script produces instead.\n *\n * That remedy has a catch of its own when the calling bundle is loaded with async. An async bundle\n * can execute after DOMContentLoaded has already fired, so a plain listener for that event never\n * runs and the work silently never happens. Nothing here can detect that, because by the time this\n * file executes the event is long gone. Catching it needs something registered at parse time,\n * before any bundle loads.\n *\n * There is a second trap right next to that one, and it applies only when waiting for\n * DOMContentLoaded. The ready state stays 'interactive' after DOMContentLoaded has fired, all the\n * way until 'complete', so the ready state cannot tell you whether DOMContentLoaded is still coming\n * or has already gone. Waiting for load is not exposed to this, because the ready state turns\n * 'complete' and load fires in the same task, so seeing 'complete' means load has fired too.\n *\n * When the document is already ready, the callback is invoked via setTimeout. This way, if the\n * callback throws, the error surfaces to the global error handler in a way that is similar to what\n * happens when an event listener throws.\n *\n * We might one day want to move this to an NPM library.\n *\n * Beware of a quirk here. setTimeout yields, and the busier the frontend, the longer it takes to\n * fire. Page load is exactly when the frontend is busiest. The timeout is a floor and not a\n * guarantee, so there is no real bound on how long that yield lasts. What this means is that using\n * this library can introduce more delay than you might expect. Compare code that runs on async load\n * and checks ready state and invokes immediately to code that runs after setTimeout. The former\n * runs in the same tick, the latter runs in \"some later tick\". That later tick can be surprisingly\n * much later. That can cause initial paint issues.\n *\n * @see https://developer.mozilla.org/en-US/docs/Web/API/Document/readyState\n * @see https://developer.mozilla.org/en-US/docs/Web/API/Document/DOMContentLoaded_event\n * @see https://html.spec.whatwg.org/multipage/parsing.html#the-end\n */\nexport function ready(callback: (event?: Event) => void,\n  type: keyof LoadingEventMap = 'DOMContentLoaded') {\n  if (document.readyState === 'complete' || (type === 'DOMContentLoaded' &&\n    document.readyState === 'interactive')) {\n    const timer = setTimeout(callback, 0);\n    const handle: ReleaseHandle = () => clearTimeout(timer);\n    return handle;\n  } else {\n    addEventListener(type, callback);\n    const handle: ReleaseHandle = () => removeEventListener(type, callback);\n    return handle;\n  }\n}\n","import { ready } from '../../lib/dom-ready.js';\n\ndeclare global {\n  var logout_link_override_section: {\n    account_logout_url: string;\n  };\n}\n\n/**\n * Update logout links to include the return url. This way when an authenticated user clicks on the\n * logout link, they are redirected back to the same page instead of the default home page.\n *\n * When a visitor is not authenticated, the logout links will not be found, in which case this does\n * nothing.\n *\n * SECURITY: Hackers can abuse redirect parameters to redirect users to malicious websites. Please\n * ensure that the return url is sane.\n */\nfunction onReady() {\n  // The homepage is the default return url. In this case we can just do nothing.\n  if (location.pathname === '/') {\n    return;\n  }\n\n  // Avoid setting the return url to a page that only authenticated users can see.\n  if (location.pathname.includes('/customer_identity')) {\n    return;\n  }\n\n  // Bail when Liquid rendered an unexpected value to prevent misbehavior\n  if (!logout_link_override_section.account_logout_url?.startsWith('/')) {\n    return;\n  }\n\n  // Checkout links back to the cart with a logged_in parameter appended for an authenticated\n  // visitor. It says nothing about where to return to, so keep it out of the return url.\n  const currentUrl = new URL(location.href);\n  currentUrl.searchParams.delete('logged_in');\n\n  const returnUrl = currentUrl.pathname + currentUrl.search;\n\n  // The logout redirect url parameter is named \"return_url\", not \"return_to\". The \"return_to\" is\n  // used by the login form.\n\n  // The return url must be absolute.\n\n  const selector = `a[href^=\"${logout_link_override_section.account_logout_url}\"]`;\n  const anchors = document.querySelectorAll<HTMLAnchorElement>(selector);\n  for (const anchor of anchors) {\n    // The href property is the attribute already resolved into an absolute url, so we do not have\n    // to resolve it against a base ourselves.\n    const url = new URL(anchor.href);\n    url.searchParams.set('return_url', returnUrl);\n    anchor.href = url.href;\n  }\n}\n\nready(onReady);\n"],"names":["callback","type","document","readyState","timer","setTimeout","clearTimeout","addEventListener","ready","_logout_link_override","location","pathname","includes","logout_link_override_section","account_logout_url","startsWith","currentUrl","URL","href","searchParams","delete","returnUrl","search","selector","anchors","querySelectorAll","anchor","url","set"],"sourceRoot":""}