Function assertSafeOauthServerUrl

apps/sim/lib/mcp/oauth/url-validation.ts:14–25

(rawUrl: string | null | undefined)

 * http allowed only for loopback addresses during local development.
 */
export function assertSafeOauthServerUrl(rawUrl: string | null | undefined): URL {
  if (!rawUrl) throw new McpOauthInsecureUrlError(String(rawUrl))
  let parsed: URL
  try {
    parsed = new URL(rawUrl)
  } catch {
    throw new McpOauthInsecureUrlError(rawUrl)
  }
  if (parsed.protocol === 'https:') return parsed
  if (parsed.protocol === 'http:' && isLoopbackHostname(parsed.hostname)) return parsed
  throw new McpOauthInsecureUrlError(rawUrl)
}