{% set _tor_node = lookup('config', 'svc-net-tor', 'services.tor.node', '') %}
window.addEventListener("message", function(event) {
  const allowedSuffixes = [".{{ DOMAIN_PRIMARY }}"{% if _tor_node %}, ".{{ _tor_node }}"{% endif %}];
  const origin = event.origin;

  // 1. Only allow messages from an allowed domain suffix (clearnet or onion mirror)
  if (!allowedSuffixes.some(function (suffix) { return origin.endsWith(suffix); })) return;

  const data = event.data;

  // 2. Only process valid iframeLocationChange messages
  if (data && data.type === "iframeLocationChange" && typeof data.href === "string") {
    try {
      const hrefUrl = new URL(data.href);

      // 3. Only allow redirects to an allowed domain suffix
      if (!allowedSuffixes.some(function (suffix) { return hrefUrl.hostname.endsWith(suffix); })) return;

      // 4. Update the ?iframe= parameter in the browser URL
      const newUrl = new URL(window.location);
      newUrl.searchParams.set("iframe", hrefUrl.href);
      window.history.replaceState({}, "", newUrl);
    } catch (e) {
      // Invalid or malformed URL – ignore
    }
  }
});

{% if MODE_DEBUG | bool %}
console.log("[iframe-sync] Listener for iframe messages is active.");
{% endif %}