background.js

/*
 * TableForge by MSSOFT - background service worker.
 * Handles file downloads via the privileged chrome.downloads API so exports work
 * even on pages with a strict Content-Security-Policy (which can block in-page
 * blob/anchor downloads). The content script sends base64 data; we build a data URL.
 */
chrome.runtime.onMessage.addListener((msg, sender, sendResponse) => {
  if (!msg || msg.type !== "download") return false;

  const dataUrl =
    "data:" + (msg.mime || "application/octet-stream") + ";charset=utf-8;base64," + msg.base64;

  try {
    chrome.downloads.download(
      { url: dataUrl, filename: sanitize(msg.filename), saveAs: false },
      (id) => {
        if (chrome.runtime.lastError) {
          sendResponse({ ok: false, error: chrome.runtime.lastError.message });
        } else {
          sendResponse({ ok: true, id });
        }
      }
    );
  } catch (e) {
    sendResponse({ ok: false, error: String(e) });
  }
  return true; // keep the message channel open for the async response
});

// Keep filenames safe and flat (no directory traversal).
function sanitize(name) {
  return String(name || "tableforge-export")
    .replace(/[\\/:*?"<>|]+/g, "_")
    .replace(/\.\.+/g, ".")
    .slice(0, 150);
}