276
*/
277
export function toOriginKey(url: string | undefined | null): string {
278
>
// Trim first so leading/trailing whitespace doesn't push otherwise valid
browserPermissions.ts
279
>
// URLs into the catch path. Electron also reports opaque/unique origins
280
>
// (sandboxed frames, data: URLs, etc.) as the literal string "null"; that is
281
>
// not a real host, so treat it as no origin to keep category defaults from
282
>
// applying to it.
283
>
const trimmed = url?.trim();
284
>
if (!trimmed || trimmed === 'null') {
285
return '';
286
}
288
>
const parsed = new URL(trimmed);
289
>
// Host-less schemes such as file: have no meaningful origin (it is
290
>
// reported as "null" in Node but "file://" in Chromium), so key off the
291
>
// scheme and full path instead -- query and fragment are dropped.
292
>
if (!parsed.host) {
293
return `${parsed.protocol}//${parsed.pathname}`;
294
}
296
>
} catch {
297
return trimmed;
298
}
300
301
/** A single recorded grant: which origin, which category, what decision. */