Method fetchAuthorScript_

extensions/amp-script/0.1/amp-script.js:436–472

* @param {string} authorUrl * @param {string} debugId An element identifier for error messages. * @return {!Promise }

(authorUrl, debugId)

   * @return {!Promise<string>}
   */
  fetchAuthorScript_(authorUrl, debugId) {
    return Services.xhrFor(this.win)
      .fetchText(authorUrl, {ampCors: false})
      .then((response) => {
        if (response.url && this.sameOrigin_(response.url)) {
          // Disallow non-JS content type for same-origin scripts.
          const contentType = response.headers.get('Content-Type');
          if (
            !contentType ||
            !(
              contentType.startsWith('application/javascript') ||
              contentType.startsWith('text/javascript')
            )
          ) {
            // TODO(#24266): Refactor to %s interpolation when error string
            // extraction is ready.
            throw user().createError(
              TAG,
              'Same-origin "src" requires "Content-Type: text/javascript" or "Content-Type: application/javascript". ' +
                `Fetched source for ${debugId} has "Content-Type: ${contentType}". ` +
                'See https://amp.dev/documentation/components/amp-script/#security-features.'
            );
          }
          return response.text();
        } else {
          // For cross-origin, verify hash of script itself (skip in
          // development and sandboxed mode).
          if (this.development_ || this.sandboxed_) {
            return response.text();
          } else {
            return response.text().then((text) => {
              return this.service_.checkSha384(text, debugId).then(() => text);
            });
          }
        }
      });
  }

  /**
   * Returns true iff `url` has the same origin as the AMP document.