@aura-stack/auth 0.4.0-rc.4 → 0.4.0

package/dist/actions/index.d.ts

@@ -4,10 +4,11 @@ export { sessionAction } from './session/session.js';
 export { signOutAction } from './signOut/signOut.js';
 export { csrfTokenAction } from './csrfToken/csrfToken.js';
 import '@aura-stack/router';
+import '../index-CSyIJmCM.js';
 import 'zod';
-import '../index-DkaLJFn8.js';
 import '../schemas.js';
-import '@aura-stack/router/cookie';
+import '../jose.js';
 import '@aura-stack/jose';
 import '@aura-stack/jose/jose';
+import '@aura-stack/router/cookie';
 import '../@types/utility.js';

package/dist/actions/index.js

@@ -1,30 +1,32 @@
 import "../chunk-ITQ7352M.js";
+import {
+  signInAction
+} from "../chunk-7QF22LHP.js";
+import {
+  csrfTokenAction
+} from "../chunk-ICAZ4OVS.js";
 import {
   signOutAction
-} from "../chunk-A3N4PVAT.js";
+} from "../chunk-ALG3GIV4.js";
 import {
   callbackAction
-} from "../chunk-KSWLO5ZU.js";
-import "../chunk-GA2SMTJO.js";
-import "../chunk-IVET23KF.js";
-import {
-  csrfTokenAction
-} from "../chunk-HT4YLL7N.js";
+} from "../chunk-6MXFPFR3.js";
+import "../chunk-TZB6MUXN.js";
+import "../chunk-XGLBNXL4.js";
 import {
   sessionAction
-} from "../chunk-JVFTCTTE.js";
-import {
-  signInAction
-} from "../chunk-3EUWD5BB.js";
-import "../chunk-N4SX7TZT.js";
-import "../chunk-W6LG7BFW.js";
-import "../chunk-STHEPPUZ.js";
-import "../chunk-N2APGLXA.js";
-import "../chunk-CXLATHS5.js";
-import "../chunk-EIL2FPSS.js";
-import "../chunk-RRLIF4PQ.js";
+} from "../chunk-PHFH2MGS.js";
+import "../chunk-XUP6KKNG.js";
 import "../chunk-ZNCZVF6U.js";
-import "../chunk-YRCB5FLE.js";
+import "../chunk-KJBAQZX2.js";
+import "../chunk-NUDITUKX.js";
+import "../chunk-4EKY7655.js";
+import "../chunk-QQVSRXGX.js";
+import "../chunk-5W4BRQYG.js";
+import "../chunk-EBAMFRB7.js";
+import "../chunk-FRJFWTOY.js";
+import "../chunk-4MYWAOLG.js";
+import "../chunk-RRLIF4PQ.js";
 export {
   callbackAction,
   csrfTokenAction,

package/dist/actions/session/session.cjs

@@ -25,6 +25,34 @@ __export(session_exports, {
 module.exports = __toCommonJS(session_exports);
 var import_router2 = require("@aura-stack/router");
 
+// src/headers.ts
+var cacheControl = {
+  "Cache-Control": "no-store",
+  Pragma: "no-cache",
+  Expires: "0",
+  Vary: "Cookie"
+};
+var contentSecurityPolicy = {
+  "Content-Security-Policy": [
+    "default-src 'none'",
+    "script-src 'self'",
+    "frame-src 'none'",
+    "object-src 'none'",
+    "frame-ancestors 'none'",
+    "base-uri 'none'"
+  ].join("; ")
+};
+var secureHeaders = {
+  "X-Content-Type-Options": "nosniff",
+  "X-Frame-Options": "DENY",
+  "Referrer-Policy": "strict-origin-when-cross-origin"
+};
+var secureApiHeaders = {
+  ...cacheControl,
+  ...contentSecurityPolicy,
+  ...secureHeaders
+};
+
 // src/utils.ts
 var import_router = require("@aura-stack/router");
 
@@ -44,13 +72,11 @@ var AuthInternalError = class extends Error {
 var toISOString = (date) => {
   return new Date(date).toISOString();
 };
-
-// src/headers.ts
-var cacheControl = {
-  "Cache-Control": "no-store",
-  Pragma: "no-cache",
-  Expires: "0",
-  Vary: "Cookie"
+var getErrorName = (error) => {
+  if (error instanceof Error) {
+    return error.name;
+  }
+  return typeof error === "string" ? error : "UnknownError";
 };
 
 // src/cookie.ts
@@ -70,7 +96,8 @@ var oauthCookieOptions = {
 var expiredCookieAttributes = {
   ...defaultCookieOptions,
   expires: /* @__PURE__ */ new Date(0),
-  maxAge: 0
+  maxAge: 0,
+  secure: true
 };
 var getCookie = (request, cookieName) => {
   const cookies = request.headers.get("Cookie");
@@ -88,16 +115,18 @@ var getCookie = (request, cookieName) => {
 var sessionAction = (0, import_router2.createEndpoint)("GET", "/session", async (ctx) => {
   const {
     request,
-    context: { jose, cookies }
+    context: { jose, cookies, logger }
   } = ctx;
   try {
     const session = getCookie(request, cookies.sessionToken.name);
     const decoded = await jose.decodeJWT(session);
+    logger?.log("AUTH_SESSION_VALID");
     const { exp, iat, jti, nbf, ...user } = decoded;
-    const headers = new Headers(cacheControl);
+    const headers = new Headers(secureApiHeaders);
     return Response.json({ user, expires: toISOString(exp * 1e3) }, { headers });
   } catch (error) {
-    const headers = new import_router2.HeadersBuilder(cacheControl).setCookie(cookies.sessionToken.name, "", expiredCookieAttributes).toHeaders();
+    logger?.log("AUTH_SESSION_INVALID", { structuredData: { error_type: getErrorName(error) } });
+    const headers = new import_router2.HeadersBuilder(secureApiHeaders).setCookie(cookies.sessionToken.name, "", expiredCookieAttributes).toHeaders();
     return Response.json({ authenticated: false, message: "Unauthorized" }, { status: 401, headers });
   }
 });

package/dist/actions/session/session.d.ts

@@ -1,7 +1,5 @@
 import * as _aura_stack_router from '@aura-stack/router';
 
-declare const sessionAction: _aura_stack_router.RouteEndpoint<"GET", "/session", {
-    schemas?: _aura_stack_router.EndpointSchemas | undefined;
-}>;
+declare const sessionAction: _aura_stack_router.RouteEndpoint<"GET", "/session", {}>;
 
 export { sessionAction };

package/dist/actions/session/session.js

@@ -1,9 +1,9 @@
 import {
   sessionAction
-} from "../../chunk-JVFTCTTE.js";
-import "../../chunk-W6LG7BFW.js";
-import "../../chunk-STHEPPUZ.js";
-import "../../chunk-CXLATHS5.js";
+} from "../../chunk-PHFH2MGS.js";
+import "../../chunk-QQVSRXGX.js";
+import "../../chunk-5W4BRQYG.js";
+import "../../chunk-EBAMFRB7.js";
 import "../../chunk-RRLIF4PQ.js";
 export {
   sessionAction

package/dist/actions/signIn/authorization.cjs

@@ -23,19 +23,37 @@ __export(authorization_exports, {
   createAuthorizationURL: () => createAuthorizationURL,
   createRedirectTo: () => createRedirectTo,
   createRedirectURI: () => createRedirectURI,
-  getOriginURL: () => getOriginURL
+  getOriginURL: () => getOriginURL,
+  getTrustedOrigins: () => getTrustedOrigins
 });
 module.exports = __toCommonJS(authorization_exports);
 
-// src/assert.ts
-var isValidURL = (value) => {
-  if (value.includes("\r\n") || value.includes("\n") || value.includes("\r")) return false;
-  const regex = /^https?:\/\/(?:[a-zA-Z0-9._-]+|localhost|\[[0-9a-fA-F:]+\])(?::\d{1,5})?(?:\/[a-zA-Z0-9._~!$&'()*+,;=:@-]*)*\/?$/;
-  return regex.test(value);
+// src/errors.ts
+var AuthInternalError = class extends Error {
+  type = "AUTH_INTERNAL_ERROR";
+  code;
+  constructor(code, message, options2) {
+    super(message, options2);
+    this.code = code;
+    this.name = new.target.name;
+    Error.captureStackTrace(this, new.target);
+  }
 };
 
 // src/schemas.ts
 var import_zod = require("zod");
+var OAuthProviderCredentialsSchema = (0, import_zod.object)({
+  id: (0, import_zod.string)(),
+  name: (0, import_zod.string)(),
+  authorizeURL: (0, import_zod.string)().url(),
+  accessToken: (0, import_zod.string)().url(),
+  scope: (0, import_zod.string)(),
+  userInfo: (0, import_zod.string)().url(),
+  responseType: (0, import_zod.enum)(["code", "token", "id_token"]),
+  clientId: (0, import_zod.string)(),
+  clientSecret: (0, import_zod.string)(),
+  profile: import_zod.z.function().optional()
+});
 var OAuthProviderConfigSchema = (0, import_zod.object)({
   authorizeURL: (0, import_zod.string)().url(),
   accessToken: (0, import_zod.string)().url(),
@@ -102,31 +120,6 @@ var OAuthEnvSchema = (0, import_zod.object)({
   clientSecret: import_zod.z.string().min(1, "OAuth Client Secret is required in the environment variables.")
 });
 
-// src/errors.ts
-var AuthInternalError = class extends Error {
-  type = "AUTH_INTERNAL_ERROR";
-  code;
-  constructor(code, message, options2) {
-    super(message, options2);
-    this.code = code;
-    this.name = new.target.name;
-    Error.captureStackTrace(this, new.target);
-  }
-};
-var AuthSecurityError = class extends Error {
-  type = "AUTH_SECURITY_ERROR";
-  code;
-  constructor(code, message, options2) {
-    super(message, options2);
-    this.code = code;
-    this.name = new.target.name;
-    Error.captureStackTrace(this, new.target);
-  }
-};
-var isAuthSecurityError = (error) => {
-  return error instanceof AuthSecurityError;
-};
-
 // src/utils.ts
 var import_router = require("@aura-stack/router");
 var toSnakeCase = (str) => {
@@ -145,133 +138,178 @@ var equals = (a, b) => {
   if (a === null || b === null || a === void 0 || b === void 0) return false;
   return a === b;
 };
-var sanitizeURL = (url) => {
-  try {
-    let decodedURL = decodeURIComponent(url).trim();
-    const protocolMatch = decodedURL.match(/^([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)/);
-    let protocol = "";
-    let rest = decodedURL;
-    if (protocolMatch) {
-      protocol = protocolMatch[1];
-      rest = decodedURL.slice(protocol.length);
-      const slashIndex = rest.indexOf("/");
-      if (slashIndex === -1) {
-        return protocol + rest;
-      }
-      const domain = rest.slice(0, slashIndex);
-      let path = rest.slice(slashIndex).replace(/\/\.\.\//g, "/").replace(/\/\.\.$/, "").replace(/\.{2,}/g, "").replace(/\/{2,}/g, "/");
-      if (path !== "/" && path.endsWith("/")) {
-        path = path.replace(/\/+$/, "/");
-      } else if (path !== "/") {
-        path = path.replace(/\/+$/, "");
-      }
-      return protocol + domain + path;
-    }
-    let sanitized = decodedURL.replace(/\/\.\.\//g, "/").replace(/\/\.\.$/, "").replace(/\.{2,}/g, "").replace(/\/{2,}/g, "/");
-    if (sanitized !== "/" && sanitized.endsWith("/")) {
-      sanitized = sanitized.replace(/\/+$/, "/");
-    } else if (sanitized !== "/") {
-      sanitized = sanitized.replace(/\/+$/, "");
-    }
-    return sanitized;
-  } catch {
-    return url.trim();
+var extractPath = (url) => {
+  const pathRegex = /^https?:\/\/[a-zA-Z0-9_\-\.]+(:\d+)?(\/.*)$/;
+  const match = url.match(pathRegex);
+  return match && match[2] ? match[2] : "/";
+};
+
+// src/assert.ts
+var unsafeChars = [
+  "<",
+  ">",
+  '"',
+  "`",
+  " ",
+  "\r",
+  "\n",
+  "	",
+  "\\",
+  "%2F",
+  "%5C",
+  "%2f",
+  "%5c",
+  "\r\n",
+  "%0A",
+  "%0D",
+  "%0a",
+  "%0d",
+  "..",
+  "//",
+  "///",
+  "...",
+  "%20",
+  "\0"
+];
+var isValidURL = (value) => {
+  if (!new RegExp(/^https?:\/\/[^/]/).test(value)) {
+    return false;
   }
+  const match = value.match(/^(https?:\/\/)(.*)$/);
+  if (!match) return false;
+  const rest = match[2];
+  for (const char of unsafeChars) {
+    if (rest.includes(char)) return false;
+  }
+  const regex = /^https?:\/\/(?:[a-zA-Z0-9._-]+|localhost|\[[0-9a-fA-F:]+\])(?::\d{1,5})?(?:\/[a-zA-Z0-9._~!$&'()?#*+,;=:@-]*)*\/?$/;
+  return regex.test(match[0]);
 };
-var getNormalizedOriginPath = (path) => {
+var isRelativeURL = (value) => {
+  if (value.length > 100) return false;
+  for (const char of unsafeChars) {
+    if (value.includes(char)) return false;
+  }
+  const regex = /^\/[a-zA-Z0-9\-_\/.?&=#]*\/?$/;
+  return regex.test(value);
+};
+var isSameOrigin = (origin, expected) => {
+  const originURL = new URL(origin);
+  const expectedURL = new URL(expected);
+  return equals(originURL.origin, expectedURL.origin);
+};
+var patternToRegex = (pattern) => {
   try {
-    const url = new URL(path);
-    url.hash = "";
-    url.search = "";
-    return `${url.origin}${url.pathname}`;
+    if (pattern.length > 2048) return null;
+    pattern = pattern.replace(/\\/g, "");
+    const match = pattern.match(/^(https?):\/\/([a-zA-Z0-9.*-]{1,253})(?::(\d{1,5}|\*))?(?:\/.*)?$/);
+    if (!match) return null;
+    const [, protocol, host, port] = match;
+    const hasWildcard = host.includes("*");
+    if (hasWildcard && !host.startsWith("*.")) return null;
+    if (hasWildcard && host.slice(2).includes("*")) return null;
+    const domain = hasWildcard ? host.slice(2) : host;
+    const escapedDomain = domain.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const hostRegex = hasWildcard ? `[^.]+\\.${escapedDomain}` : escapedDomain;
+    const portRegex = port === "*" ? ":\\d{1,5}" : port ? `:${port}` : "";
+    return new RegExp(`^${protocol}:\\/\\/${hostRegex}${portRegex}$`);
   } catch {
-    return sanitizeURL(path);
+    return null;
   }
 };
-var formatZodError = (error) => {
-  if (!error.issues || error.issues.length === 0) {
-    return {};
-  }
-  return error.issues.reduce((previous, issue) => {
-    const key = issue.path.join(".");
-    return {
-      ...previous,
-      [key]: {
-        code: issue.code,
-        message: issue.message
+var isTrustedOrigin = (url, trustedOrigins) => {
+  if (!isValidURL(url) || trustedOrigins.length === 0) return false;
+  try {
+    const urlOrigin = new URL(url).origin;
+    for (const pattern of trustedOrigins) {
+      const regex = patternToRegex(pattern);
+      if (regex?.test(urlOrigin)) return true;
+      try {
+        if (isValidURL(pattern) && equals(new URL(pattern).origin, urlOrigin)) return true;
+      } catch {
       }
-    };
-  }, {});
+    }
+  } catch {
+  }
+  return false;
 };
 
 // src/actions/signIn/authorization.ts
-var createAuthorizationURL = (oauthConfig, redirectURI, state, codeChallenge, codeChallengeMethod) => {
+var createAuthorizationURL = (oauthConfig, redirectURI, state, codeChallenge, codeChallengeMethod, logger) => {
   const parsed = OAuthAuthorization.safeParse({ ...oauthConfig, redirectURI, state, codeChallenge, codeChallengeMethod });
   if (!parsed.success) {
-    const msg = JSON.stringify(formatZodError(parsed.error), null, 2);
-    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", msg);
+    logger?.log("INVALID_OAUTH_CONFIGURATION", {
+      structuredData: {
+        scope: oauthConfig.scope,
+        redirect_uri: redirectURI,
+        has_state: Boolean(state),
+        has_code_challenge: Boolean(codeChallenge),
+        code_challenge_method: codeChallengeMethod
+      }
+    });
+    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "The OAuth provider configuration is invalid.");
   }
   const { authorizeURL, ...options2 } = parsed.data;
   const { userInfo, accessToken, clientSecret, ...required } = options2;
   const searchParams = new URLSearchParams(toCastCase(required));
   return `${authorizeURL}?${searchParams}`;
 };
-var getOriginURL = (request, trustedProxyHeaders) => {
+var getTrustedOrigins = async (request, trustedOrigins) => {
+  if (!trustedOrigins) return [];
+  const raw = typeof trustedOrigins === "function" ? await trustedOrigins(request) : trustedOrigins;
+  return Array.isArray(raw) ? raw : typeof raw === "string" ? [raw] : [];
+};
+var getOriginURL = async (request, context) => {
   const headers = request.headers;
-  if (trustedProxyHeaders) {
-    const protocol = headers.get("X-Forwarded-Proto") ?? headers.get("Forwarded")?.match(/proto=([^;]+)/i)?.[1] ?? "http";
-    const host = headers.get("X-Forwarded-Host") ?? headers.get("Host") ?? headers.get("Forwarded")?.match(/host=([^;]+)/i)?.[1] ?? null;
-    return new URL(`${protocol}://${host}${getNormalizedOriginPath(new URL(request.url).pathname)}`);
-  } else {
-    return new URL(getNormalizedOriginPath(request.url));
+  let origin = new URL(request.url).origin;
+  const trustedOrigins = await getTrustedOrigins(request, context?.trustedOrigins);
+  trustedOrigins.push(origin);
+  if (context?.trustedProxyHeaders) {
+    const protocol = headers.get("Forwarded")?.match(/proto=([^;]+)/i)?.[1] ?? headers.get("X-Forwarded-Proto") ?? "http";
+    const host = headers.get("Host") ?? headers.get("Forwarded")?.match(/host=([^;]+)/i)?.[1] ?? headers.get("X-Forwarded-Host") ?? null;
+    origin = `${protocol}://${host}`;
+  }
+  if (!isTrustedOrigin(origin, trustedOrigins)) {
+    context?.logger?.log("UNTRUSTED_ORIGIN", { structuredData: { origin } });
+    throw new AuthInternalError("UNTRUSTED_ORIGIN", "The constructed origin URL is not trusted.");
   }
+  return origin;
 };
-var createRedirectURI = (request, oauth, basePath, trustedProxyHeaders) => {
-  const url = getOriginURL(request, trustedProxyHeaders);
-  return `${url.origin}${basePath}/callback/${oauth}`;
+var createRedirectURI = async (request, oauth, context) => {
+  const origin = await getOriginURL(request, context);
+  return `${origin}${context.basePath}/callback/${oauth}`;
 };
-var createRedirectTo = (request, redirectTo, trustedProxyHeaders) => {
+var createRedirectTo = async (request, redirectTo, context) => {
   try {
     const headers = request.headers;
-    const origin = headers.get("Origin");
-    const referer = headers.get("Referer");
-    let hostedURL = getOriginURL(request, trustedProxyHeaders);
-    if (redirectTo) {
-      if (redirectTo.startsWith("/")) {
-        return sanitizeURL(redirectTo);
+    const requestOrigin = await getOriginURL(request, context);
+    const origins = await getTrustedOrigins(request, context?.trustedOrigins);
+    const validateURL = (url) => {
+      if (!isRelativeURL(url) && !isValidURL(url)) return "/";
+      if (isRelativeURL(url)) return url;
+      if (origins.length > 0) {
+        if (isTrustedOrigin(url, origins)) {
+          const urlOrigin = new URL(url).origin;
+          for (const pattern of origins) {
+            const regex = patternToRegex(pattern);
+            if (regex?.test(urlOrigin)) {
+              return isSameOrigin(url, request.url) ? extractPath(url) : url;
+            }
+            if (isValidURL(pattern) && equals(new URL(pattern).origin, urlOrigin)) return url;
+          }
+        }
+        context?.logger?.log("OPEN_REDIRECT_ATTACK");
+        return "/";
       }
-      const redirectToURL = new URL(sanitizeURL(getNormalizedOriginPath(redirectTo)));
-      if (!isValidURL(redirectTo) || !equals(redirectToURL.origin, hostedURL.origin)) {
-        throw new AuthSecurityError(
-          "POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED",
-          "The redirectTo parameter does not match the hosted origin."
-        );
+      if (isSameOrigin(url, requestOrigin)) {
+        return extractPath(url);
       }
-      return sanitizeURL(redirectToURL.pathname);
-    }
-    if (referer) {
-      const refererURL = new URL(sanitizeURL(referer));
-      if (!isValidURL(referer) || !equals(refererURL.origin, hostedURL.origin)) {
-        throw new AuthSecurityError(
-          "POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED",
-          "The referer of the request does not match the hosted origin."
-        );
-      }
-      return sanitizeURL(refererURL.pathname);
-    }
-    if (origin) {
-      const originURL = new URL(sanitizeURL(getNormalizedOriginPath(origin)));
-      if (!isValidURL(origin) || !equals(originURL.origin, hostedURL.origin)) {
-        throw new AuthSecurityError("POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED", "Invalid origin (potential CSRF).");
-      }
-      return sanitizeURL(originURL.pathname);
-    }
-    return "/";
+      context?.logger?.log("OPEN_REDIRECT_ATTACK");
+      return "/";
+    };
+    return validateURL(redirectTo ?? headers.get("Referer") ?? headers.get("Origin") ?? "/");
   } catch (error) {
-    if (isAuthSecurityError(error)) {
-      throw error;
-    }
-    throw new AuthSecurityError("POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED", "Invalid origin (potential CSRF).");
+    context?.logger?.log("POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED");
+    return "/";
   }
 };
 // Annotate the CommonJS export names for ESM import in node:
@@ -279,5 +317,6 @@ var createRedirectTo = (request, redirectTo, trustedProxyHeaders) => {
   createAuthorizationURL,
   createRedirectTo,
   createRedirectURI,
-  getOriginURL
+  getOriginURL,
+  getTrustedOrigins
 });

package/dist/actions/signIn/authorization.d.ts

@@ -1,9 +1,11 @@
-import { h as OAuthProviderCredentials } from '../../index-DkaLJFn8.js';
+import { GlobalContext } from '@aura-stack/router';
+import { h as OAuthProviderCredentials, I as InternalLogger, d as AuthConfig } from '../../index-CSyIJmCM.js';
 import 'zod';
 import '../../schemas.js';
-import '@aura-stack/router/cookie';
+import '../../jose.js';
 import '@aura-stack/jose';
 import '@aura-stack/jose/jose';
+import '@aura-stack/router/cookie';
 import '../../@types/utility.js';
 
 /**
@@ -18,26 +20,34 @@ import '../../@types/utility.js';
  * @param redirectURI - The redirect URI where the OAuth service will send the user after authorization.
  * @param state - A unique string used to maintain state between the request and callback.
  */
-declare const createAuthorizationURL: (oauthConfig: OAuthProviderCredentials, redirectURI: string, state: string, codeChallenge: string, codeChallengeMethod: string) => string;
-declare const getOriginURL: (request: Request, trustedProxyHeaders?: boolean) => URL;
+declare const createAuthorizationURL: (oauthConfig: OAuthProviderCredentials, redirectURI: string, state: string, codeChallenge: string, codeChallengeMethod: string, logger?: InternalLogger) => string;
+/**
+ * Resolves trusted origins from config (array or function).
+ */
+declare const getTrustedOrigins: (request: Request, trustedOrigins: AuthConfig["trustedOrigins"]) => Promise<string[]>;
+declare const getOriginURL: (request: Request, context?: GlobalContext) => Promise<string>;
 /**
  * Creates the redirect URI for the OAuth callback based on the original request URL and the OAuth provider.
  *
  * @param requestURL - the original request URL
  * @param oauth - OAuth provider name
+ * @param context - Global context containing configuration and utilities
  * @returns The redirect URI for the OAuth callback.
  */
-declare const createRedirectURI: (request: Request, oauth: string, basePath: string, trustedProxyHeaders?: boolean) => string;
+declare const createRedirectURI: (request: Request, oauth: string, context: GlobalContext) => Promise<string>;
 /**
  * Verifies if the request's origin matches the expected origin. It accepts the redirectTo search
- * parameter for redirection. It checks the 'Referer' header of the request with the origin where
- * the authentication flow is hosted. If they do not match, it throws an AuthError to avoid
- * potential `Open URL Redirection` attacks.
+ * parameter for redirection. It checks the Referer and Origin headers and the request URL against
+ * the trusted origins list. If they do not match, it returns "/" to avoid potential open redirect attacks.
+ *
+ * When `trustedOrigins` is provided, URLs are validated against that list. When not provided,
+ * the request's derived origin (from request.url or proxy headers) is used as the only trusted origin.
  *
  * @param request The incoming request object
  * @param redirectTo Optional redirectTo parameter to override the referer
- * @returns The pathname of the referer URL if origins match
+ * @param context Global context containing configuration and utilities
+ * @returns A safe URL to redirect to after authentication, or "/" if the URL is not considered safe.
  */
-declare const createRedirectTo: (request: Request, redirectTo?: string, trustedProxyHeaders?: boolean) => string;
+declare const createRedirectTo: (request: Request, redirectTo?: string, context?: GlobalContext) => Promise<string>;
 
-export { createAuthorizationURL, createRedirectTo, createRedirectURI, getOriginURL };
+export { createAuthorizationURL, createRedirectTo, createRedirectURI, getOriginURL, getTrustedOrigins };

package/dist/actions/signIn/authorization.js

@@ -2,15 +2,17 @@ import {
   createAuthorizationURL,
   createRedirectTo,
   createRedirectURI,
-  getOriginURL
-} from "../../chunk-N4SX7TZT.js";
-import "../../chunk-CXLATHS5.js";
-import "../../chunk-EIL2FPSS.js";
+  getOriginURL,
+  getTrustedOrigins
+} from "../../chunk-XUP6KKNG.js";
+import "../../chunk-KJBAQZX2.js";
+import "../../chunk-4EKY7655.js";
+import "../../chunk-QQVSRXGX.js";
 import "../../chunk-RRLIF4PQ.js";
-import "../../chunk-YRCB5FLE.js";
 export {
   createAuthorizationURL,
   createRedirectTo,
   createRedirectURI,
-  getOriginURL
+  getOriginURL,
+  getTrustedOrigins
 };