Allow-list & Permissions

<script>
const ADMIN_ORIGIN='admin', EXT_ORIGIN='extension';
let _seq=0, _waiters=new Map();
addEventListener('message', (e) => {
  const d=e.data; if(!d||typeof d!=='object') return;
  if(d.origin!==EXT_ORIGIN) return;
  if(d.type==='RTO_RESPONSE' && d.requestId && _waiters.has(d.requestId)) {
    const fn=_waiters.get(d.requestId); _waiters.delete(d.requestId); fn(d);
  }
});
function ask(action, args={}, timeoutMs=12000){
  const requestId='r'+(++_seq);
  postMessage({ origin:ADMIN_ORIGIN, type:'RTO_REQUEST', requestId, action, args }, '*');
  return new Promise((resolve,reject)=>{
    const t=setTimeout(()=>{ _waiters.delete(requestId); reject(Object.assign(new Error('timeout'),{ code:'TIMEOUT' })); }, timeoutMs);
    _waiters.set(requestId, (resp)=>{ clearTimeout(t); resolve(resp); });
  });
}
// Optional: retry with backoff for transient hiccups (e.g., first-run content script warmup)
async function askBackoff(action, args={}, tries=3, base=300){
  let n=0;
  while(true){
    try{
      const r = await ask(action, args, 12000);
      if(!r.ok) throw Object.assign(new Error(r.error?.message||'error'), r.error||{});
      return r;
    }catch(e){
      if(++n >= tries) throw e;
      await new Promise(r=>setTimeout(r, base*Math.pow(2,n-1)));
    }
  }
}
</script>

<div id="allow-banner" class="alert alert-warning d-none">
  <strong>Allow-list required:</strong>
  Open the extension popup and add <code class="domain">example.com</code>.
    <button class="btn btn-sm btn-outline-primary" id="allow-try">Try again</button>
</div>

<script>
async function ensureAllowed(url){
  const host = new URL(url).host;
  try{
    const r = await ask('navigate', { url, focus:false }, 12000);
    if (r.ok) return true;
    if (r.error?.code === 'DOMAIN_NOT_ALLOWED'){
      const box = document.getElementById('allow-banner');
      box.classList.remove('d-none');
      box.querySelector('.domain').textContent = host;
      document.getElementById('allow-try').onclick = () => location.reload();
      return false;
    }
    // Other structured errors: surface and stop
    throw Object.assign(new Error(r.error?.message||'error'), r.error||{});
  }catch(e){
    // TIMEOUT or older builds that didn't answer → show banner anyway
    const box = document.getElementById('allow-banner');
    if (box){
      box.classList.remove('d-none');
      box.querySelector('.domain').textContent = host;
      document.getElementById('allow-try').onclick = () => location.reload();
    }
    return false;
  }
}
ensureAllowed('https://example.com/');
</script>