@absolutejs/auth 0.63.0 → 0.65.0

package/dist/server.d.ts

@@ -14,6 +14,7 @@ export type { SetupCapability, SetupSession, SetupSessionStore } from './portal/
 export { createSetupSession } from './portal/operations';
 export { createPostgresSetupSessionStore } from './portal/postgresSetupSessionStore';
 export { protectRoutePlugin } from './routes/protectRoute';
+export { readSessionCookie } from './session/cookieReader';
 export { requireAuthPlugin } from './routes/requireAuth';
 export type { ScimConfig } from './scim/config';
 export type { ScimFilter, ScimGroup, ScimGroupInput, ScimTokenStore, ScimUser, ScimUserInput } from './scim/types';

package/dist/server.js

@@ -6149,6 +6149,20 @@ var isTrustedOrigin = (request, trustedOrigins) => {
   const origin = request.headers.get("origin");
   return origin !== null && trustedOrigins.includes(origin);
 };
+var resolveOriginAllowed = async ({
+  enforce = true,
+  onUntrustedOrigin,
+  request,
+  trustedOrigins
+}) => {
+  if (isTrustedOrigin(request, trustedOrigins))
+    return true;
+  await onUntrustedOrigin?.({
+    origin: request.headers.get("origin"),
+    request
+  });
+  return enforce === false;
+};
 
 // src/credentials/import.ts
 init_crypto();
@@ -6345,12 +6359,14 @@ var credentialsLogin = ({
   checkBreachesOnLogin,
   cookieSecure,
   credentialStore,
+  enforceTrustedOrigins,
   getUserByEmail,
   isMfaRequired,
   lockoutGuard,
   loginRoute = "/auth/login",
   onCredentialsLoginError,
   onCredentialsLoginSuccess,
+  onUntrustedOrigin,
   passwordVerifier,
   rehashOnLogin = false,
   requireEmailVerification = false,
@@ -6363,7 +6379,12 @@ var credentialsLogin = ({
   status,
   store: { session, unregisteredSession }
 }) => withSpan("auth.credentials.login", undefined, async (span) => {
-  if (!isTrustedOrigin(request, trustedOrigins)) {
+  if (!await resolveOriginAllowed({
+    enforce: enforceTrustedOrigins,
+    onUntrustedOrigin,
+    request,
+    trustedOrigins
+  })) {
     return status("Forbidden", "Request origin is not allowed");
   }
   const headerBag = {};
@@ -6521,11 +6542,13 @@ var credentialsRegister = ({
   authSessionStore,
   cookieSecure,
   credentialStore,
+  enforceTrustedOrigins,
   onCreateCredentialUser,
   onCredentialsLoginSuccess,
   onExistingAccount,
   onRegistrationSuccess,
   onSendEmail,
+  onUntrustedOrigin,
   passwordPolicy,
   registerRoute = "/auth/register",
   requireEmailVerification = false,
@@ -6540,7 +6563,12 @@ var credentialsRegister = ({
   status,
   store: { session }
 }) => withSpan("auth.credentials.register", undefined, async () => {
-  if (!isTrustedOrigin(request, trustedOrigins)) {
+  if (!await resolveOriginAllowed({
+    enforce: enforceTrustedOrigins,
+    onUntrustedOrigin,
+    request,
+    trustedOrigins
+  })) {
     return status("Forbidden", "Request origin is not allowed");
   }
   const normalizedEmail = email.trim().toLowerCase();
@@ -25633,6 +25661,23 @@ var decodeSessionUserRecord = (value) => {
     throw new TypeError("Persisted session user must be an object");
   return value;
 };
+// src/session/cookieReader.ts
+var SESSION_COOKIE_NAME = "user_session_id";
+var SESSION_COOKIE_PATTERN = new RegExp(`(?:^|;\\s*)${SESSION_COOKIE_NAME}=([^;]*)`);
+var readSessionCookie = (request) => {
+  const header = request.headers.get("cookie");
+  if (header === null)
+    return null;
+  const match = header.match(SESSION_COOKIE_PATTERN);
+  const value = match?.[1];
+  if (value === undefined)
+    return null;
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+};
 // src/session/inMemoryStore.ts
 var cloneSessionData = (value) => ({
   ...value
@@ -38749,6 +38794,7 @@ var auth2 = auth;
 export {
   userSessionIdTypebox,
   requireAuthPlugin,
+  readSessionCookie,
   providers,
   protectRoutePlugin,
   isValidProviderOption,
@@ -38765,5 +38811,5 @@ export {
   VerificationProviderError
 };
 
-//# debugId=015C798311C7C14564756E2164756E21
+//# debugId=59EA26D2A962869F64756E2164756E21
 //# sourceMappingURL=server.js.map