Make Stuffbox linking resilient to cross-origin popup isolation and stale callbacks

Hop-State: A_06FP8WHY25K99094H3X60A8
Hop-Proposal: R_06FP8WGCVDDG61H0VZ1XQJR
Hop-Task: T_06FP8V5D2HSJG08NRN6VS3G
Hop-Attempt: AT_06FP8V5D2KATGJNV2M2SGRR

src/lib/stuffbox/browser-upload.ts

@@ -26,6 +26,7 @@ interface JsonResponse extends Record<string, unknown> {
   error?: string;
   code?: string;
   provider?: string | null;
+  stuffboxUpdatedAt?: string | null;
 }
 
 export type StorageProvider = 'stuffbox' | 's3' | null;
@@ -45,6 +46,21 @@ export async function getStorageProvider(): Promise<StorageProvider> {
     : null;
 }
 
+export async function hasNewStuffboxConnection(startedAt: string): Promise<boolean> {
+  const response = await fetch('/api/storage/configuration', { cache: 'no-store' });
+  const configuration = await json(response);
+  if (!response.ok) {
+    throw new MediaUploadError(configuration.error || 'Unable to verify the Stuffbox connection', undefined, response.status);
+  }
+
+  const updatedAt = typeof configuration.stuffboxUpdatedAt === 'string'
+    ? Date.parse(configuration.stuffboxUpdatedAt)
+    : Number.NaN;
+  return configuration.provider === 'stuffbox'
+    && Number.isFinite(updatedAt)
+    && updatedAt >= Date.parse(startedAt);
+}
+
 function directPut(
   uploadUrl: string,
   file: File,