@absolutejs/auth 0.61.0 → 0.62.0

package/dist/server.js

@@ -6141,6 +6141,15 @@ init_constants();
 init_crypto();
 import { Elysia as Elysia11, t as t8 } from "elysia";
 
+// src/csrf.ts
+var isTrustedOrigin = (request, trustedOrigins) => {
+  if (trustedOrigins === undefined || trustedOrigins.length === 0) {
+    return true;
+  }
+  const origin = request.headers.get("origin");
+  return origin !== null && trustedOrigins.includes(origin);
+};
+
 // src/credentials/import.ts
 init_crypto();
 var normalizeEmail = (email) => email.trim().toLowerCase();
@@ -6345,7 +6354,8 @@ var credentialsLogin = ({
   passwordVerifier,
   rehashOnLogin = false,
   requireEmailVerification = false,
-  sessionDurationMs = DEFAULT_CREDENTIAL_SESSION_TTL_MS
+  sessionDurationMs = DEFAULT_CREDENTIAL_SESSION_TTL_MS,
+  trustedOrigins
 }) => new Elysia11().use(sessionStore()).post(loginRoute, async ({
   body: { email, password },
   cookie: { user_session_id },
@@ -6353,6 +6363,9 @@ var credentialsLogin = ({
   status,
   store: { session, unregisteredSession }
 }) => withSpan("auth.credentials.login", undefined, async (span) => {
+  if (!isTrustedOrigin(request, trustedOrigins)) {
+    return status("Forbidden", "Request origin is not allowed");
+  }
   const headerBag = {};
   request.headers.forEach((value, key) => {
     headerBag[key] = value;
@@ -6510,19 +6523,26 @@ var credentialsRegister = ({
   credentialStore,
   onCreateCredentialUser,
   onCredentialsLoginSuccess,
+  onExistingAccount,
   onRegistrationSuccess,
   onSendEmail,
   passwordPolicy,
   registerRoute = "/auth/register",
   requireEmailVerification = false,
+  revealRegistrationConflicts = false,
   sessionDurationMs = DEFAULT_CREDENTIAL_SESSION_TTL_MS,
+  trustedOrigins,
   verificationTokenDurationMs = DEFAULT_VERIFICATION_TOKEN_TTL_MS
 }) => new Elysia13().use(sessionStore()).post(registerRoute, async ({
   body: { email, password, ...extraFields },
   cookie: { user_session_id },
+  request,
   status,
   store: { session }
 }) => withSpan("auth.credentials.register", undefined, async () => {
+  if (!isTrustedOrigin(request, trustedOrigins)) {
+    return status("Forbidden", "Request origin is not allowed");
+  }
   const normalizedEmail = email.trim().toLowerCase();
   if (!normalizedEmail.includes("@")) {
     return status("Bad Request", "A valid email is required");
@@ -6536,7 +6556,13 @@ var credentialsRegister = ({
   }
   const existing = await credentialStore.getCredentialByEmail(normalizedEmail);
   if (existing) {
-    return status("Conflict", "Email is already registered");
+    if (revealRegistrationConflicts) {
+      return status("Conflict", "Email is already registered");
+    }
+    await onExistingAccount?.({ email: normalizedEmail });
+    return status("Created", {
+      status: "verification_required"
+    });
   }
   const created = await onCreateCredentialUser({
     ...extraFields,
@@ -38723,5 +38749,5 @@ export {
   VerificationProviderError
 };
 
-//# debugId=D218332195145BB664756E2164756E21
+//# debugId=E5516A34918E793A64756E2164756E21
 //# sourceMappingURL=server.js.map