Function resolveEncryptedSubscriptionURL

app.go:1971–1988

resolveEncryptedSubscriptionURL unwraps an RVSUB1-encrypted URL paste. Returns the decrypted URL when the input is encrypted; an empty string when the input is plaintext (caller keeps the original); an error when the payload decrypts to something that isn't a single http(s) URL.

(input string)

// is plaintext (caller keeps the original); an error when the payload decrypts
// to something that isn't a single http(s) URL.
func resolveEncryptedSubscriptionURL(input string) (string, error) {
	if !proxy.IsEncryptedSubscription(input) {
		return "", nil
	}
	plain, err := proxy.DecryptSubscription(input)
	if err != nil {
		return "", fmt.Errorf("decrypting subscription URL: %w", err)
	}
	plain = strings.TrimSpace(plain)
	if strings.ContainsAny(plain, "\r\n") {
		return "", fmt.Errorf("decrypted payload contains multiple lines — paste it in the content field, not the URL field")
	}
	lower := strings.ToLower(plain)
	if !strings.HasPrefix(lower, "http://") && !strings.HasPrefix(lower, "https://") {
		return "", fmt.Errorf("decrypted payload is not a URL — paste it in the content field instead")
	}
	return plain, nil
}

// impioSubscriptionHost is the impio panel host whose subscription endpoint
// historically required a "/json" path suffix. The panel later dropped the