@adminforth/open-signup 1.3.0 → 2.0.0

package/build.log

@@ -8,5 +8,5 @@ custom/SignupPage.vue
 custom/SignupUnderLogin.vue
 custom/tsconfig.json
 
-sent 14,167 bytes  received 77 bytes  28,488.00 bytes/sec
+sent 14,163 bytes  received 77 bytes  28,480.00 bytes/sec
 total size is 13,884  speedup is 0.97

package/dist/index.d.ts

@@ -10,6 +10,7 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
     adminforth: IAdminForth;
     constructor(options: PluginOptions);
     modifyResourceConfig(adminforth: IAdminForth, resourceConfig: AdminForthResource): Promise<void>;
+    getAllowedOrigins(): string[];
     validateConfigAfterDiscover(adminforth: IAdminForth, resourceConfig: AdminForthResource): void;
     instanceUniqueRepresentation(pluginOptions: any): string;
     doLogin(email: string, response: any, extra: HttpExtra): Promise<{

package/dist/index.js

@@ -7,7 +7,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-import AdminForth, { AdminForthPlugin, parseBody, Filters, suggestIfTypo, AdminForthDataTypes } from "adminforth";
+import AdminForth, { AdminForthPlugin, Filters, suggestIfTypo, AdminForthDataTypes } from "adminforth";
 import { z } from "zod";
 const completeVerifiedSignupBodySchema = z.object({
     token: z.string(),
@@ -94,8 +94,27 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
                     adminforth.config.auth.beforeLoginConfirmation = [];
                 }
             }
+            const rawOrigins = this.options.expectedOrigin;
+            const originList = Array.isArray(rawOrigins) ? rawOrigins : [rawOrigins];
+            if (!rawOrigins || originList.length === 0 || originList.some(o => !o)) {
+                throw new Error('EmailPasswordReset: expectedOrigin is required. Set it to the admin panel origin(s) ' +
+                    '(e.g. "https://admin.example.com") so reset links can only point to a trusted host.');
+            }
+            for (const origin of originList) {
+                try {
+                    new URL(origin);
+                }
+                catch (_a) {
+                    throw new Error(`EmailPasswordReset: expectedOrigin "${origin}" is not a valid absolute URL/origin.`);
+                }
+            }
         });
     }
+    getAllowedOrigins() {
+        const rawOrigins = this.options.expectedOrigin;
+        const originList = Array.isArray(rawOrigins) ? rawOrigins : [rawOrigins];
+        return originList.map(o => new URL(o).origin);
+    }
     validateConfigAfterDiscover(adminforth, resourceConfig) {
         if (this.options.confirmEmails) {
             this.options.confirmEmails.adapter.validate();
@@ -159,11 +178,9 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
             method: 'POST',
             path: `/plugin/${this.pluginInstanceId}/complete-verified-signup`,
             noAuth: true,
+            request_schema: completeVerifiedSignupBodySchema,
             handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, response, headers, query, cookies, tr, requestUrl }) {
-                const parsed = parseBody(completeVerifiedSignupBodySchema, body, response);
-                if ('error' in parsed)
-                    return parsed.error;
-                const data = parsed.data;
+                const data = body;
                 const { token, password } = data;
                 if (!token) {
                     return { error: yield tr('Invalid token', 'opensignup'), ok: false };
@@ -194,12 +211,10 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
             method: 'POST',
             path: `/plugin/${this.pluginInstanceId}/signup`,
             noAuth: true,
+            request_schema: signupBodySchema,
             handler: (_a) => __awaiter(this, [_a], void 0, function* ({ body, response, headers, query, cookies, tr, requestUrl }) {
                 var _b, _c;
-                const parsed = parseBody(signupBodySchema, body, response);
-                if ('error' in parsed)
-                    return parsed.error;
-                const data = parsed.data;
+                const data = body;
                 const { email, url, password } = data;
                 if (!email || typeof email !== 'string') {
                     return { error: yield tr('Email is required', 'opensignup'), ok: false };
@@ -207,6 +222,18 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
                 if (!this.options.confirmEmails && !password) {
                     return { error: yield tr('Password is required', 'opensignup'), ok: false };
                 }
+                let resetLink;
+                try {
+                    const parsedUrl = new URL(url);
+                    if (!this.getAllowedOrigins().includes(parsedUrl.origin)) {
+                        return { error: 'Invalid reset url', ok: false };
+                    }
+                    parsedUrl.hash = '';
+                    resetLink = parsedUrl.toString();
+                }
+                catch (_d) {
+                    return { error: 'Invalid reset url', ok: false };
+                }
                 const extra = { body, headers, query, cookies, requestUrl: url };
                 // validate email
                 if (this.emailField.validation) {

package/dist/types.d.ts

@@ -54,4 +54,9 @@ export interface PluginOptions extends PluginsCommonOptions {
      * Signup component order inder login button
      */
     loginPageComponentOrder?: number;
+    /**
+    * The origin(s) (scheme + host + optional port) of the admin panel that are
+    * allowed to appear in password reset links, e.g. "https://admin.example.com".
+    */
+    expectedOrigin: string | string[];
 }

package/index.ts

@@ -1,4 +1,4 @@
-import AdminForth, { AdminForthPlugin, parseBody, Filters, suggestIfTypo, AdminForthDataTypes } from "adminforth";
+import AdminForth, { AdminForthPlugin, Filters, suggestIfTypo, AdminForthDataTypes } from "adminforth";
 import type { IAdminForth, IHttpServer, AdminForthComponentDeclaration, AdminForthResourceColumn, AdminForthResource, BeforeLoginConfirmationFunction, HttpExtra } from "adminforth";
 import type { PluginOptions } from './types.js';
 import { z } from "zod";
@@ -106,6 +106,28 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
         adminforth.config.auth.beforeLoginConfirmation = [];
       }
     }
+
+    const rawOrigins = this.options.expectedOrigin;
+    const originList = Array.isArray(rawOrigins) ? rawOrigins : [rawOrigins];
+    if (!rawOrigins || originList.length === 0 || originList.some(o => !o)) {
+      throw new Error(
+        'EmailPasswordReset: expectedOrigin is required. Set it to the admin panel origin(s) ' +
+        '(e.g. "https://admin.example.com") so reset links can only point to a trusted host.'
+      );
+    }
+    for (const origin of originList) {
+      try {
+        new URL(origin);
+      } catch {
+        throw new Error(`EmailPasswordReset: expectedOrigin "${origin}" is not a valid absolute URL/origin.`);
+      }
+    }
+  }
+
+  getAllowedOrigins(): string[] {
+    const rawOrigins = this.options.expectedOrigin;
+    const originList = Array.isArray(rawOrigins) ? rawOrigins : [rawOrigins];
+    return originList.map(o => new URL(o).origin);
   }
   
   validateConfigAfterDiscover(adminforth: IAdminForth, resourceConfig: AdminForthResource) {
@@ -185,10 +207,9 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
       method: 'POST',
       path: `/plugin/${this.pluginInstanceId}/complete-verified-signup`,
       noAuth: true,
+      request_schema: completeVerifiedSignupBodySchema,
       handler: async ({ body, response, headers, query, cookies, tr, requestUrl }) => {
-        const parsed = parseBody(completeVerifiedSignupBodySchema, body, response);
-        if ('error' in parsed) return parsed.error;
-        const data = parsed.data;
+        const data = body as z.infer<typeof completeVerifiedSignupBodySchema>;
         const { token, password } = data;
         if (!token) {
           return { error: await tr('Invalid token', 'opensignup'), ok: false };
@@ -223,10 +244,9 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
       method: 'POST',
       path: `/plugin/${this.pluginInstanceId}/signup`,
       noAuth: true,
+      request_schema: signupBodySchema,
       handler: async ({ body, response, headers, query, cookies, tr, requestUrl }) => {
-        const parsed = parseBody(signupBodySchema, body, response);
-        if ('error' in parsed) return parsed.error;
-        const data = parsed.data;
+        const data = body as z.infer<typeof signupBodySchema>;
         const { email, url, password } = data;
         if (!email || typeof email !== 'string') {
           return { error: await tr('Email is required', 'opensignup'), ok: false };
@@ -234,6 +254,19 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
         if (!this.options.confirmEmails && !password) {
           return { error: await tr('Password is required', 'opensignup'), ok: false };
         }
+
+        let resetLink: string;
+        try {
+          const parsedUrl = new URL(url);
+          if (!this.getAllowedOrigins().includes(parsedUrl.origin)) {
+            return { error: 'Invalid reset url', ok: false };
+          }
+          parsedUrl.hash = '';
+          resetLink = parsedUrl.toString();
+        } catch {
+          return { error: 'Invalid reset url', ok: false };
+        }
+
         const extra = { body, headers, query, cookies, requestUrl: url };
         // validate email
         if (this.emailField.validation) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adminforth/open-signup",
-  "version": "1.3.0",
+  "version": "2.0.0",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "type": "module",
@@ -27,11 +27,11 @@
     "zod": "^4.3.6"
   },
   "peerDependencies": {
-    "adminforth": "^3.7.1"
+    "adminforth": "^3.8.2"
   },
   "devDependencies": {
     "@types/node": "^22.10.7",
-    "adminforth": "^3.7.1",
+    "adminforth": "^3.8.2",
     "semantic-release": "^24.2.1",
     "semantic-release-slack-bot": "^4.0.2",
     "typescript": "^5.7.3"

package/types.ts

@@ -70,4 +70,11 @@ export interface PluginOptions extends PluginsCommonOptions {
    * Signup component order inder login button
    */
   loginPageComponentOrder?: number;
+
+   /**
+   * The origin(s) (scheme + host + optional port) of the admin panel that are
+   * allowed to appear in password reset links, e.g. "https://admin.example.com".
+   */
+  expectedOrigin: string | string[];
+
 }