Sign in as inbuxa-admin when hosted apart from the server (inbuxa-server contract C-6)

src/lib/oauthClientId.test.ts

@@ -46,6 +46,20 @@ describe('getOAuthClientId', () => {
     expect(getOAuthClientId()).toBe('stalwart-webui');
   });
 
+  it('is inbuxa-admin when hosted apart from the server', async () => {
+    const getOAuthClientId = await loadWithMeta(
+      '<meta name="oauth-client-id" content="" /><meta name="api-base-url" content="https://mail.example.org" />',
+    );
+    expect(getOAuthClientId()).toBe('inbuxa-admin');
+  });
+
+  it('still prefers an injected client id when hosted apart from the server', async () => {
+    const getOAuthClientId = await loadWithMeta(
+      '<meta name="oauth-client-id" content="custom" /><meta name="api-base-url" content="https://mail.example.org" />',
+    );
+    expect(getOAuthClientId()).toBe('custom');
+  });
+
   it('reads the document only once', async () => {
     const getOAuthClientId = await loadWithMeta('<meta name="oauth-client-id" content="pocket-id-client" />');
     expect(getOAuthClientId()).toBe('pocket-id-client');

src/lib/oauthClientId.ts

@@ -4,14 +4,27 @@
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
  */
 
-const DEFAULT_CLIENT_ID = 'stalwart-webui';
+// INBUXA requires OAuth clients to be registered, and registers these two on
+// every start (inbuxa-server contract C-6). Served by the server itself, this
+// is the web interface at /admin, registered as `stalwart-webui`. Hosted
+// anywhere else, with the server's address in <meta name="api-base-url">, it
+// is INBUXA Admin, registered as `inbuxa-admin` from INBUXA_ADMIN_URL.
+const SERVED_BY_SERVER_CLIENT_ID = 'stalwart-webui';
+const HOSTED_ELSEWHERE_CLIENT_ID = 'inbuxa-admin';
 
 let cached: string | undefined;
 
+function metaContent(name: string): string | undefined {
+  return document.querySelector(`meta[name="${name}"]`)?.getAttribute('content')?.trim() || undefined;
+}
+
 export function getOAuthClientId(): string {
   if (cached !== undefined) return cached;
 
-  const injected = document.querySelector('meta[name="oauth-client-id"]')?.getAttribute('content')?.trim();
-  cached = injected ? injected : DEFAULT_CLIENT_ID;
+  const hostedElsewhere = Boolean(
+    (import.meta.env.VITE_API_BASE_URL as string | undefined) || metaContent('api-base-url'),
+  );
+  cached =
+    metaContent('oauth-client-id') ?? (hostedElsewhere ? HOSTED_ELSEWHERE_CLIENT_ID : SERVED_BY_SERVER_CLIENT_ID);
   return cached;
 }