validateSsoRedirectUri function

void validateSsoRedirectUri(String redirectUri)

Rejects redirect URIs the API would refuse, so a misconfigured app fails with a clear message here instead of an opaque error from the server.

Mirrors assertAllowedRedirectUri on the API: HTTPS only, no fragment and no embedded credentials.

Implementation

void validateSsoRedirectUri(String redirectUri) {
  if (redirectUri.isEmpty) {
    throw ArgumentError.value(
      redirectUri,
      'redirectUri',
      'An SSO redirect URI is required',
    );
  }

  final uri = Uri.tryParse(redirectUri);
  if (uri == null || !uri.hasScheme || uri.host.isEmpty) {
    throw ArgumentError.value(redirectUri, 'redirectUri', 'Is not a valid URL');
  }

  // The operating system only verifies app ownership of HTTPS domains, so a
  // plain http:// or custom scheme callback cannot be trusted.
  if (uri.scheme != 'https') {
    throw ArgumentError.value(redirectUri, 'redirectUri', 'Must use https');
  }

  if (uri.hasFragment) {
    throw ArgumentError.value(
      redirectUri,
      'redirectUri',
      'Must not contain a fragment',
    );
  }

  if (uri.userInfo.isNotEmpty) {
    throw ArgumentError.value(
      redirectUri,
      'redirectUri',
      'Must not contain credentials',
    );
  }
}