@absolutejs/auth 0.52.0 → 0.53.0

package/dist/index.js

@@ -4868,6 +4868,11 @@ var REFRESH_TTL_DAYS = 30;
 var DEFAULT_ACCESS_TOKEN_TTL_MS2 = MILLISECONDS_IN_AN_HOUR;
 var DEFAULT_ID_TOKEN_TTL_MS = MILLISECONDS_IN_AN_HOUR;
 var DEFAULT_REFRESH_TOKEN_TTL_MS = MILLISECONDS_IN_A_DAY * REFRESH_TTL_DAYS;
+var resolveAccessTtl = (ttl, scopes) => {
+  if (typeof ttl === "function")
+    return ttl({ scopes });
+  return ttl ?? DEFAULT_ACCESS_TOKEN_TTL_MS2;
+};
 var nowSeconds = (milliseconds) => Math.floor(milliseconds / MS_PER_SECOND);
 var narrowScopes = (available, requested) => requested === undefined || requested.length === 0 ? available : requested.filter((scope) => available.includes(scope));
 var RESERVED_ACCESS_CLAIMS = new Set([
@@ -4941,7 +4946,7 @@ var exchangeToken = async ({
     return { error: "invalid_scope", ok: false };
   }
   const scopes = narrowScopes(available, requestedScopes);
-  const ttl = config.accessTokenTtlMs ?? DEFAULT_ACCESS_TOKEN_TTL_MS2;
+  const ttl = resolveAccessTtl(config.accessTokenTtlMs, scopes);
   const extraClaims = await config.getAccessTokenClaims?.({
     audience,
     clientId: actorClientId,
@@ -4978,7 +4983,7 @@ var issueTokenSet = async ({
   scopes,
   sub
 }) => {
-  const accessTtl = config.accessTokenTtlMs ?? DEFAULT_ACCESS_TOKEN_TTL_MS2;
+  const accessTtl = resolveAccessTtl(config.accessTokenTtlMs, scopes);
   const idTtl = config.idTokenTtlMs ?? DEFAULT_ID_TOKEN_TTL_MS;
   const refreshTtl = config.refreshTokenTtlMs ?? DEFAULT_REFRESH_TOKEN_TTL_MS;
   const accessExtra = await config.getAccessTokenClaims?.({
@@ -6435,6 +6440,17 @@ var jsonResponse = (value, status) => new Response(JSON.stringify(value), {
 });
 var oauthError2 = (status, error) => jsonResponse({ error }, status);
 var tokenResponse = (tokens) => jsonResponse(tokens, HTTP_OK2);
+var canonicalizeRequestUrl = (requestUrl, issuer) => {
+  try {
+    const url = new URL(requestUrl);
+    const base = new URL(issuer);
+    url.protocol = base.protocol;
+    url.host = base.host;
+    return url.toString();
+  } catch {
+    return requestUrl;
+  }
+};
 var redirectTo = (url) => new Response(null, { headers: { location: url }, status: HTTP_FOUND });
 var escapeHtmlAttr = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
 var formPostResponse = (redirectUri, params) => {
@@ -6948,7 +6964,7 @@ var oidcProviderRoutes = (config) => {
       if (wantsSilent) {
         return errorRedirect(userSession === undefined ? "login_required" : "interaction_required");
       }
-      return loginUrl === undefined ? jsonResponse({ error: "login_required" }, HTTP_UNAUTHORIZED2) : redirectTo(`${loginUrl}?return_to=${encodeURIComponent(request.url)}`);
+      return loginUrl === undefined ? jsonResponse({ error: "login_required" }, HTTP_UNAUTHORIZED2) : redirectTo(`${loginUrl}?return_to=${encodeURIComponent(canonicalizeRequestUrl(request.url, issuer))}`);
     }
     const requested = scope === undefined || scope.length === 0 ? client.scopes : scope.split(" ").filter((entry) => client.scopes.includes(entry));
     if (config.consentUrl !== undefined && await config.needsConsent?.({
@@ -6960,7 +6976,7 @@ var oidcProviderRoutes = (config) => {
       user: userSession.user
     }) === true) {
       const consentTarget = new URL(config.consentUrl, issuer);
-      consentTarget.searchParams.set("return_to", request.url);
+      consentTarget.searchParams.set("return_to", canonicalizeRequestUrl(request.url, issuer));
       consentTarget.searchParams.set("client_id", client.clientId);
       consentTarget.searchParams.set("client_name", client.name);
       consentTarget.searchParams.set("scope", requested.join(" "));
@@ -28043,5 +28059,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=1C44E17EB1F4FC5164756E2164756E21
+//# debugId=1AA6ADB109ED877964756E2164756E21
 //# sourceMappingURL=index.js.map