@absolutejs/auth 0.59.3 → 0.60.0

package/dist/server.js

@@ -6109,6 +6109,9 @@ var credentialsEmailVerification = ({
   if (!consumed) {
     return status("Bad Request", "Invalid or expired verification token");
   }
+  if (consumed.expiresAt < Date.now()) {
+    return status("Bad Request", "Invalid or expired verification token");
+  }
   await credentialStore.setEmailVerified(consumed.email);
   await onEmailVerified?.({ email: consumed.email });
   return status("OK", { status: "email_verified" });
@@ -6462,6 +6465,9 @@ var credentialsPasswordReset = ({
   if (!consumed) {
     return status("Bad Request", "Invalid or expired reset token");
   }
+  if (consumed.expiresAt < Date.now()) {
+    return status("Bad Request", "Invalid or expired reset token");
+  }
   const policy = await evaluatePassword(password, passwordPolicy);
   if (!policy.ok) {
     return status("Bad Request", {
@@ -11499,7 +11505,7 @@ var callback = ({
   if (requiresPKCE && verifier === undefined) {
     return status("Bad Request", "Code verifier not found and is required");
   }
-  const originUrl = origin_url?.value ?? "/";
+  const originUrl = toSafeLocalPath(origin_url?.value);
   let tokenResponse2;
   try {
     tokenResponse2 = await providerInstance.validateAuthorizationCode(requiresPKCE ? { code, codeVerifier: verifier } : { code });
@@ -38706,5 +38712,5 @@ export {
   VerificationProviderError
 };
 
-//# debugId=D7D259888A27730164756E2164756E21
+//# debugId=F11B818E3AEEB74B64756E2164756E21
 //# sourceMappingURL=server.js.map