@adminforth/open-signup 1.3.1 → 2.0.1

package/dist/index.d.ts

@@ -10,6 +10,7 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
     adminforth: IAdminForth;
     constructor(options: PluginOptions);
     modifyResourceConfig(adminforth: IAdminForth, resourceConfig: AdminForthResource): Promise<void>;
+    getAllowedOrigins(): string[];
     validateConfigAfterDiscover(adminforth: IAdminForth, resourceConfig: AdminForthResource): void;
     instanceUniqueRepresentation(pluginOptions: any): string;
     doLogin(email: string, response: any, extra: HttpExtra): Promise<{

package/dist/index.js

@@ -94,8 +94,27 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
                     adminforth.config.auth.beforeLoginConfirmation = [];
                 }
             }
+            const rawOrigins = this.options.expectedOrigin;
+            const originList = Array.isArray(rawOrigins) ? rawOrigins : [rawOrigins];
+            if (!rawOrigins || originList.length === 0 || originList.some(o => !o)) {
+                throw new Error('EmailPasswordReset: expectedOrigin is required. Set it to the admin panel origin(s) ' +
+                    '(e.g. "https://admin.example.com") so reset links can only point to a trusted host.');
+            }
+            for (const origin of originList) {
+                try {
+                    new URL(origin);
+                }
+                catch (_a) {
+                    throw new Error(`EmailPasswordReset: expectedOrigin "${origin}" is not a valid absolute URL/origin.`);
+                }
+            }
         });
     }
+    getAllowedOrigins() {
+        const rawOrigins = this.options.expectedOrigin;
+        const originList = Array.isArray(rawOrigins) ? rawOrigins : [rawOrigins];
+        return originList.map(o => new URL(o).origin);
+    }
     validateConfigAfterDiscover(adminforth, resourceConfig) {
         if (this.options.confirmEmails) {
             this.options.confirmEmails.adapter.validate();
@@ -203,6 +222,18 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
                 if (!this.options.confirmEmails && !password) {
                     return { error: yield tr('Password is required', 'opensignup'), ok: false };
                 }
+                let resetLink;
+                try {
+                    const parsedUrl = new URL(url);
+                    if (!this.getAllowedOrigins().includes(parsedUrl.origin)) {
+                        return { error: 'Invalid reset url', ok: false };
+                    }
+                    parsedUrl.hash = '';
+                    resetLink = parsedUrl.toString();
+                }
+                catch (_d) {
+                    return { error: 'Invalid reset url', ok: false };
+                }
                 const extra = { body, headers, query, cookies, requestUrl: url };
                 // validate email
                 if (this.emailField.validation) {
@@ -292,7 +323,7 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
                   
                   To confirm your email, click the link below:\n\n
 
-                  {url}?verifyToken={verifyToken}\n\n
+                  {resetLink}?token={verifyToken}\n\n
 
                   If you didn't request this, please ignore this email.\n\n
                   Link is valid for 2 hours.\n\n
@@ -300,7 +331,7 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
                   Thanks,
                   The {brandName} Team
                                     
-                `, 'opensignup', { brandName, url, verifyToken });
+                `, 'opensignup', { brandName, resetLink, verifyToken });
                 const emailData = {
                     greeting: yield tr('Dear user,', 'opensignup'),
                     welcome: yield tr('Welcome to {brandName}!', 'opensignup', { brandName }),
@@ -318,7 +349,7 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
               <p>${emailData.greeting}</p>
               <p>${emailData.welcome}</p>
               <p>${emailData.instruction}</p>
-              <a href="${url}?token=${verifyToken}">${emailData.linkText}</a>
+              <a href="${resetLink}?token=${verifyToken}">${emailData.linkText}</a>
               <p>${emailData.disclaimer}</p>
               <p>${emailData.validity}</p>
               <p>${emailData.thanks}</p>

package/dist/types.d.ts

@@ -54,4 +54,9 @@ export interface PluginOptions extends PluginsCommonOptions {
      * Signup component order inder login button
      */
     loginPageComponentOrder?: number;
+    /**
+    * The origin(s) (scheme + host + optional port) of the admin panel that are
+    * allowed to appear in password reset links, e.g. "https://admin.example.com".
+    */
+    expectedOrigin: string | string[];
 }

package/index.ts

@@ -106,6 +106,28 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
         adminforth.config.auth.beforeLoginConfirmation = [];
       }
     }
+
+    const rawOrigins = this.options.expectedOrigin;
+    const originList = Array.isArray(rawOrigins) ? rawOrigins : [rawOrigins];
+    if (!rawOrigins || originList.length === 0 || originList.some(o => !o)) {
+      throw new Error(
+        'EmailPasswordReset: expectedOrigin is required. Set it to the admin panel origin(s) ' +
+        '(e.g. "https://admin.example.com") so reset links can only point to a trusted host.'
+      );
+    }
+    for (const origin of originList) {
+      try {
+        new URL(origin);
+      } catch {
+        throw new Error(`EmailPasswordReset: expectedOrigin "${origin}" is not a valid absolute URL/origin.`);
+      }
+    }
+  }
+
+  getAllowedOrigins(): string[] {
+    const rawOrigins = this.options.expectedOrigin;
+    const originList = Array.isArray(rawOrigins) ? rawOrigins : [rawOrigins];
+    return originList.map(o => new URL(o).origin);
   }
   
   validateConfigAfterDiscover(adminforth: IAdminForth, resourceConfig: AdminForthResource) {
@@ -232,6 +254,19 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
         if (!this.options.confirmEmails && !password) {
           return { error: await tr('Password is required', 'opensignup'), ok: false };
         }
+
+        let resetLink: string;
+        try {
+          const parsedUrl = new URL(url);
+          if (!this.getAllowedOrigins().includes(parsedUrl.origin)) {
+            return { error: 'Invalid reset url', ok: false };
+          }
+          parsedUrl.hash = '';
+          resetLink = parsedUrl.toString();
+        } catch {
+          return { error: 'Invalid reset url', ok: false };
+        }
+
         const extra = { body, headers, query, cookies, requestUrl: url };
         // validate email
         if (this.emailField.validation) {
@@ -338,7 +373,7 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
                   
                   To confirm your email, click the link below:\n\n
 
-                  {url}?verifyToken={verifyToken}\n\n
+                  {resetLink}?token={verifyToken}\n\n
 
                   If you didn't request this, please ignore this email.\n\n
                   Link is valid for 2 hours.\n\n
@@ -346,7 +381,7 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
                   Thanks,
                   The {brandName} Team
                                     
-                `, 'opensignup', { brandName, url, verifyToken }
+                `, 'opensignup', { brandName, resetLink, verifyToken }
         );
 
         const emailData = {
@@ -367,7 +402,7 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
               <p>${emailData.greeting}</p>
               <p>${emailData.welcome}</p>
               <p>${emailData.instruction}</p>
-              <a href="${url}?token=${verifyToken}">${emailData.linkText}</a>
+              <a href="${resetLink}?token=${verifyToken}">${emailData.linkText}</a>
               <p>${emailData.disclaimer}</p>
               <p>${emailData.validity}</p>
               <p>${emailData.thanks}</p>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adminforth/open-signup",
-  "version": "1.3.1",
+  "version": "2.0.1",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "type": "module",

package/types.ts

@@ -70,4 +70,11 @@ export interface PluginOptions extends PluginsCommonOptions {
    * Signup component order inder login button
    */
   loginPageComponentOrder?: number;
+
+   /**
+   * The origin(s) (scheme + host + optional port) of the admin panel that are
+   * allowed to appear in password reset links, e.g. "https://admin.example.com".
+   */
+  expectedOrigin: string | string[];
+
 }