async function getJWT(client_id, hostname) {
   hostname = encodeURIComponent(hostname);
   client_id = encodeURIComponent(client_id);

   const res = await fetch(
      `/api/user/jwt?client_id=${client_id}&origin=${hostname}`
   ).then((res) => res.json());

   return res;
}

let acceptPromise;

window.allow = () => acceptPromise();
window.deny = () => window.close();

function start() {
   let started = false;
   window.addEventListener("message", async (msg) => {
      if (!started) {
         started = true;
         const url = new URL(msg.origin);
         document.getElementById("hostname").innerText = url.hostname;
         await new Promise((yes) => (acceptPromise = yes));
         const res = await getJWT(msg.data.client_id, url.hostname);
         msg.source.postMessage(res, msg.origin);
         window.close();
      }
   });
}

start();