@adminforth/open-signup 1.3.1 → 2.0.0

package/build.log

@@ -8,5 +8,5 @@ custom/SignupPage.vue
 custom/SignupUnderLogin.vue
 custom/tsconfig.json
 
-sent 14,167 bytes  received 77 bytes  28,488.00 bytes/sec
+sent 14,163 bytes  received 77 bytes  28,480.00 bytes/sec
 total size is 13,884  speedup is 0.97

package/dist/index.d.ts

@@ -10,6 +10,7 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
     adminforth: IAdminForth;
     constructor(options: PluginOptions);
     modifyResourceConfig(adminforth: IAdminForth, resourceConfig: AdminForthResource): Promise<void>;
+    getAllowedOrigins(): string[];
     validateConfigAfterDiscover(adminforth: IAdminForth, resourceConfig: AdminForthResource): void;
     instanceUniqueRepresentation(pluginOptions: any): string;
     doLogin(email: string, response: any, extra: HttpExtra): Promise<{

package/dist/index.js

@@ -94,8 +94,27 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
                     adminforth.config.auth.beforeLoginConfirmation = [];
                 }
             }
+            const rawOrigins = this.options.expectedOrigin;
+            const originList = Array.isArray(rawOrigins) ? rawOrigins : [rawOrigins];
+            if (!rawOrigins || originList.length === 0 || originList.some(o => !o)) {
+                throw new Error('EmailPasswordReset: expectedOrigin is required. Set it to the admin panel origin(s) ' +
+                    '(e.g. "https://admin.example.com") so reset links can only point to a trusted host.');
+            }
+            for (const origin of originList) {
+                try {
+                    new URL(origin);
+                }
+                catch (_a) {
+                    throw new Error(`EmailPasswordReset: expectedOrigin "${origin}" is not a valid absolute URL/origin.`);
+                }
+            }
         });
     }
+    getAllowedOrigins() {
+        const rawOrigins = this.options.expectedOrigin;
+        const originList = Array.isArray(rawOrigins) ? rawOrigins : [rawOrigins];
+        return originList.map(o => new URL(o).origin);
+    }
     validateConfigAfterDiscover(adminforth, resourceConfig) {
         if (this.options.confirmEmails) {
             this.options.confirmEmails.adapter.validate();
@@ -203,6 +222,18 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
                 if (!this.options.confirmEmails && !password) {
                     return { error: yield tr('Password is required', 'opensignup'), ok: false };
                 }
+                let resetLink;
+                try {
+                    const parsedUrl = new URL(url);
+                    if (!this.getAllowedOrigins().includes(parsedUrl.origin)) {
+                        return { error: 'Invalid reset url', ok: false };
+                    }
+                    parsedUrl.hash = '';
+                    resetLink = parsedUrl.toString();
+                }
+                catch (_d) {
+                    return { error: 'Invalid reset url', ok: false };
+                }
                 const extra = { body, headers, query, cookies, requestUrl: url };
                 // validate email
                 if (this.emailField.validation) {

package/dist/types.d.ts

@@ -54,4 +54,9 @@ export interface PluginOptions extends PluginsCommonOptions {
      * Signup component order inder login button
      */
     loginPageComponentOrder?: number;
+    /**
+    * The origin(s) (scheme + host + optional port) of the admin panel that are
+    * allowed to appear in password reset links, e.g. "https://admin.example.com".
+    */
+    expectedOrigin: string | string[];
 }

package/index.ts

@@ -106,6 +106,28 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
         adminforth.config.auth.beforeLoginConfirmation = [];
       }
     }
+
+    const rawOrigins = this.options.expectedOrigin;
+    const originList = Array.isArray(rawOrigins) ? rawOrigins : [rawOrigins];
+    if (!rawOrigins || originList.length === 0 || originList.some(o => !o)) {
+      throw new Error(
+        'EmailPasswordReset: expectedOrigin is required. Set it to the admin panel origin(s) ' +
+        '(e.g. "https://admin.example.com") so reset links can only point to a trusted host.'
+      );
+    }
+    for (const origin of originList) {
+      try {
+        new URL(origin);
+      } catch {
+        throw new Error(`EmailPasswordReset: expectedOrigin "${origin}" is not a valid absolute URL/origin.`);
+      }
+    }
+  }
+
+  getAllowedOrigins(): string[] {
+    const rawOrigins = this.options.expectedOrigin;
+    const originList = Array.isArray(rawOrigins) ? rawOrigins : [rawOrigins];
+    return originList.map(o => new URL(o).origin);
   }
   
   validateConfigAfterDiscover(adminforth: IAdminForth, resourceConfig: AdminForthResource) {
@@ -232,6 +254,19 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
         if (!this.options.confirmEmails && !password) {
           return { error: await tr('Password is required', 'opensignup'), ok: false };
         }
+
+        let resetLink: string;
+        try {
+          const parsedUrl = new URL(url);
+          if (!this.getAllowedOrigins().includes(parsedUrl.origin)) {
+            return { error: 'Invalid reset url', ok: false };
+          }
+          parsedUrl.hash = '';
+          resetLink = parsedUrl.toString();
+        } catch {
+          return { error: 'Invalid reset url', ok: false };
+        }
+
         const extra = { body, headers, query, cookies, requestUrl: url };
         // validate email
         if (this.emailField.validation) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adminforth/open-signup",
-  "version": "1.3.1",
+  "version": "2.0.0",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "type": "module",

package/types.ts

@@ -70,4 +70,11 @@ export interface PluginOptions extends PluginsCommonOptions {
    * Signup component order inder login button
    */
   loginPageComponentOrder?: number;
+
+   /**
+   * The origin(s) (scheme + host + optional port) of the admin panel that are
+   * allowed to appear in password reset links, e.g. "https://admin.example.com".
+   */
+  expectedOrigin: string | string[];
+
 }