Turn a library URL someone pasted into web + library + folder

When to reach for it: a setting like "the library the scanner saves to" or "export target folder". People paste …/Forms/AllItems.aspx, a URL with the opened folder in ?id=, or a direct link (/:f:/r/<path> — measured: it redirects to that same path). Asking them for "server-relative URL of the library" fails; parsing it yourself works. A sharing link with a token (/:f:/s/<token>, /:f:/g/…) does not contain the path at all — refuse it and ask for the address bar URL.

Measured (SharePoint Online, 26 October 2026, browser fetch)

It needs a request digest of the web you POST to; a digest from another site collection answers 403 "security validation … is invalid".

Code

/** OData string literal for a URL path: double apostrophes, then encode (# and % survive). */
const lit = (p: string) => "'" + encodeURIComponent(p.split("'").join("''")) + "'";

function parsePasted(input: string, origin: string): { absolute: string; path: string } | null {
  let u: URL;
  try { u = new URL(input.trim()); } catch { return null; }
  if (u.protocol !== 'https:' || u.origin.toLowerCase() !== origin.toLowerCase()) return null;
  if (/^\/:[a-z]:\/(?!r\/)/i.test(u.pathname)) return null;  // token sharing link: no path in it
  const id = u.searchParams.get('id');                       // opened folder, already decoded
  let path = id && id.startsWith('/') ? id : decodeURIComponent(u.pathname);
  path = path.replace(/^\/:[a-z]:\/r(?=\/)/i, '')           // direct link prefix
             .replace(/\/Forms\/[^/]*$/i, '').replace(/\/[^/]+\.aspx$/i, '').replace(/\/+$/, '');
  if (!path) return null;
  // encode per segment, so a '#' in a folder name does not become a fragment
  return { absolute: u.origin + path.split('/').map(encodeURIComponent).join('/'), path };
}

async function resolveLibrary(currentWeb: string, pasted: string, digest: string) {
  const origin = new URL(currentWeb).origin;
  const p = parsePasted(pasted, origin);
  if (!p) throw new Error('Not a SharePoint URL in this tenant');
  const r = await fetch(`${currentWeb}/_api/SP.Web.GetWebUrlFromPageUrl`, {
    method: 'POST',
    headers: { Accept: 'application/json;odata=nometadata', 'Content-Type': 'application/json;odata=nometadata', 'X-RequestDigest': digest },
    body: JSON.stringify({ pageFullUrl: p.absolute })
  });
  if (!r.ok) throw new Error(r.status === 404 ? 'Site not found or no access' : 'HTTP ' + r.status);
  const webUrl = (await r.json()).value.replace(/\/$/, '');
  const webPath = new URL(webUrl).pathname.replace(/\/$/, '');
  const rest = p.path.slice(webPath.length + 1).split('/').filter(Boolean);
  if (!rest.length) throw new Error('The URL points at the site, not a library');
  const libraryPath = webPath + '/' + rest[0];               // document libraries sit directly under the web
  const list = await fetch(`${webUrl}/_api/web/GetList(@l)?$select=Title,BaseTemplate&@l=${lit(libraryPath)}`,
    { headers: { Accept: 'application/json;odata=nometadata' } }).then((x) => x.ok ? x.json() : null);
  if (!list) throw new Error('Library not found or no access');
  if (list.BaseTemplate !== 101) throw new Error(`"${list.Title}" is not a document library`);
  return { webUrl, libraryPath, folder: rest.slice(1).join('/'), title: list.Title };
}

Notes

• GetWebUrlFromPageUrl only finds the web. A typo in the library name still resolves — GetList is what proves the library exists, and BaseTemplate 101 that it is a document library (a list URL would otherwise pass).
• "First segment under the web" assumes the library's root folder sits directly under the web, which is where the UI creates document libraries (lists go under /Lists/). If that assumption does not hold for some URL, GetList on the guessed path fails and you report it instead of guessing.
• Read and write the folder with the ResourcePath API (GetFolderByServerRelativePath(decodedurl=…), MoveToUsingPath) — a pasted path is exactly where # and % show up: A # or % in a file or folder name.
• Measured the same evening: a file moved with MoveToUsingPath(DecodedUrl=…,moveOperations=0) into a subfolder of the same library keeps its UniqueId, so a key built from UniqueId still matches after the move; moveOperations=0 on an existing target name fails instead of overwriting.
• If the pasted URL can point at your own app's storage, compare libraryPath with it and refuse — otherwise the app reads what it just wrote.