@absolutejs/auth 0.59.2 → 0.60.0

package/dist/redirect.d.ts

@@ -0,0 +1,2 @@
+export declare const isSafeLocalPath: (value: string) => boolean;
+export declare const toSafeLocalPath: (value: string | undefined, fallback?: string) => string;

package/dist/server.js

@@ -6109,6 +6109,9 @@ var credentialsEmailVerification = ({
   if (!consumed) {
     return status("Bad Request", "Invalid or expired verification token");
   }
+  if (consumed.expiresAt < Date.now()) {
+    return status("Bad Request", "Invalid or expired verification token");
+  }
   await credentialStore.setEmailVerified(consumed.email);
   await onEmailVerified?.({ email: consumed.email });
   return status("OK", { status: "email_verified" });
@@ -6462,6 +6465,9 @@ var credentialsPasswordReset = ({
   if (!consumed) {
     return status("Bad Request", "Invalid or expired reset token");
   }
+  if (consumed.expiresAt < Date.now()) {
+    return status("Bad Request", "Invalid or expired reset token");
+  }
   const policy = await evaluatePassword(password, passwordPolicy);
   if (!policy.ok) {
     return status("Bad Request", {
@@ -11271,6 +11277,12 @@ var resolveProviderClientConfiguration = ({
 // src/routes/authorize.ts
 init_constants();
 import { Elysia as Elysia27, t as t20 } from "elysia";
+
+// src/redirect.ts
+var isSafeLocalPath = (value) => /^\/(?![/\\])/.test(value);
+var toSafeLocalPath = (value, fallback = "/") => value !== undefined && isSafeLocalPath(value) ? value : fallback;
+
+// src/routes/authorize.ts
 var parseReferer = (headerReferer) => {
   if (!headerReferer)
     return "/";
@@ -11278,10 +11290,7 @@ var parseReferer = (headerReferer) => {
     const url = new URL(headerReferer);
     return url.pathname + url.search;
   } catch {
-    if (headerReferer.startsWith("/") && !headerReferer.startsWith("//")) {
-      return headerReferer;
-    }
-    return "/";
+    return toSafeLocalPath(headerReferer);
   }
 };
 var authorize = ({
@@ -11496,7 +11505,7 @@ var callback = ({
   if (requiresPKCE && verifier === undefined) {
     return status("Bad Request", "Code verifier not found and is required");
   }
-  const originUrl = origin_url?.value ?? "/";
+  const originUrl = toSafeLocalPath(origin_url?.value);
   let tokenResponse2;
   try {
     tokenResponse2 = await providerInstance.validateAuthorizationCode(requiresPKCE ? { code, codeVerifier: verifier } : { code });
@@ -12958,7 +12967,7 @@ var parseReferer2 = (referer) => {
     const url = new URL(referer);
     return url.pathname + url.search;
   } catch {
-    return referer.startsWith("/") && !referer.startsWith("//") ? referer : "/";
+    return toSafeLocalPath(referer);
   }
 };
 var oidcSsoRoutes = ({
@@ -13101,18 +13110,13 @@ var oidcSsoRoutes = ({
 
 // src/sso/samlRoutes.ts
 import { Elysia as Elysia39, t as t31 } from "elysia";
-var toLocalPath = (value) => {
-  if (value === undefined || value.length === 0)
-    return "/";
-  return value.startsWith("/") && !value.startsWith("//") ? value : "/";
-};
 var refererPath = (referer) => {
   if (referer === undefined)
     return "/";
   try {
-    return toLocalPath(new URL(referer).pathname);
+    return toSafeLocalPath(new URL(referer).pathname);
   } catch {
-    return toLocalPath(referer);
+    return toSafeLocalPath(referer);
   }
 };
 var settle = async (work) => {
@@ -13215,7 +13219,7 @@ var samlSsoRoutes = ({
         user,
         userSessionId
       });
-      return redirect(toLocalPath(body.RelayState));
+      return redirect(toSafeLocalPath(body.RelayState));
     } catch (error) {
       await onSsoCallbackError?.({ error, organizationId });
       return status("Internal Server Error", "SAML sign-in failed");
@@ -13306,7 +13310,7 @@ var samlSsoRoutes = ({
         sloUrl
       }) ?? Promise.resolve());
       if (!("error" in responseSettled)) {
-        return redirect(toLocalPath(RelayState));
+        return redirect(toSafeLocalPath(RelayState));
       }
       await onSsoCallbackError?.({
         error: responseSettled.error,
@@ -13354,7 +13358,7 @@ var samlSsoRoutes = ({
       });
       return redirect(url);
     }
-    return redirect(toLocalPath(info.relayState ?? RelayState));
+    return redirect(toSafeLocalPath(info.relayState ?? RelayState));
   }, {
     cookie: t31.Cookie({
       user_session_id: t31.Optional(userSessionIdTypebox)
@@ -38708,5 +38712,5 @@ export {
   VerificationProviderError
 };
 
-//# debugId=82A372899BEA4F4564756E2164756E21
+//# debugId=F11B818E3AEEB74B64756E2164756E21
 //# sourceMappingURL=server.js.map