@aura-stack/auth 0.4.0-rc.5 → 0.5.0

package/dist/actions/signOut/signOut.cjs

@@ -1,9 +1,7 @@
 "use strict";
-var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -17,14 +15,6 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/actions/signOut/signOut.ts
@@ -33,106 +23,247 @@ __export(signOut_exports, {
   signOutAction: () => signOutAction
 });
 module.exports = __toCommonJS(signOut_exports);
-var import_zod2 = require("zod");
-var import_router2 = require("@aura-stack/router");
-
-// src/secure.ts
-var import_crypto = __toESM(require("crypto"), 1);
+var import_v4 = require("zod/v4");
+var import_router3 = require("@aura-stack/router");
 
 // src/utils.ts
 var import_router = require("@aura-stack/router");
 
 // src/errors.ts
+var AuthInternalError = class extends Error {
+  type = "AUTH_INTERNAL_ERROR";
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.code = code;
+    this.name = new.target.name;
+    Error.captureStackTrace(this, new.target);
+  }
+};
 var AuthSecurityError = class extends Error {
   type = "AUTH_SECURITY_ERROR";
   code;
-  constructor(code, message, options2) {
-    super(message, options2);
+  constructor(code, message, options) {
+    super(message, options);
     this.code = code;
     this.name = new.target.name;
     Error.captureStackTrace(this, new.target);
   }
 };
-var isAuthSecurityError = (error) => {
-  return error instanceof AuthSecurityError;
-};
 
-// src/utils.ts
-var equals = (a, b) => {
-  if (a === null || b === null || a === void 0 || b === void 0) return false;
-  return a === b;
-};
-var sanitizeURL = (url) => {
-  try {
-    let decodedURL = decodeURIComponent(url).trim();
-    const protocolMatch = decodedURL.match(/^([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)/);
-    let protocol = "";
-    let rest = decodedURL;
-    if (protocolMatch) {
-      protocol = protocolMatch[1];
-      rest = decodedURL.slice(protocol.length);
-      const slashIndex = rest.indexOf("/");
-      if (slashIndex === -1) {
-        return protocol + rest;
+// src/env.ts
+var import_meta = {};
+var env = new Proxy({}, {
+  get(_, prop) {
+    if (typeof prop !== "string") return void 0;
+    const hasProperty = (process2) => {
+      return process2 && Object.prototype.hasOwnProperty.call(process2, prop);
+    };
+    try {
+      if (typeof process !== "undefined" && hasProperty(process.env)) {
+        return process.env[prop];
       }
-      const domain = rest.slice(0, slashIndex);
-      let path = rest.slice(slashIndex).replace(/\/\.\.\//g, "/").replace(/\/\.\.$/, "").replace(/\.{2,}/g, "").replace(/\/{2,}/g, "/");
-      if (path !== "/" && path.endsWith("/")) {
-        path = path.replace(/\/+$/, "/");
-      } else if (path !== "/") {
-        path = path.replace(/\/+$/, "");
+      if (typeof import_meta !== "undefined" && hasProperty(import_meta.env)) {
+        return import_meta.env[prop];
       }
-      return protocol + domain + path;
-    }
-    let sanitized = decodedURL.replace(/\/\.\.\//g, "/").replace(/\/\.\.$/, "").replace(/\.{2,}/g, "").replace(/\/{2,}/g, "/");
-    if (sanitized !== "/" && sanitized.endsWith("/")) {
-      sanitized = sanitized.replace(/\/+$/, "/");
-    } else if (sanitized !== "/") {
-      sanitized = sanitized.replace(/\/+$/, "");
+      if (typeof Deno !== "undefined" && Deno.env?.get) {
+        return Deno.env.get(prop);
+      }
+      if (typeof Bun !== "undefined" && hasProperty(Bun.env)) {
+        return Bun.env[prop];
+      }
+      const globalValue = globalThis[prop];
+      return typeof globalValue === "string" ? globalValue : void 0;
+    } catch {
+      return void 0;
     }
-    return sanitized;
+  }
+});
+var getEnv = (key) => {
+  const keys = [`AURA_AUTH_${key.toUpperCase()}`, `AURA_${key.toUpperCase()}`, `AUTH_${key.toUpperCase()}`, key.toUpperCase()];
+  return env[keys.find((k) => env[k]) ?? ""];
+};
+
+// src/assert.ts
+var import_crypto = require("@aura-stack/jose/crypto");
+var unsafeChars = [
+  "<",
+  ">",
+  '"',
+  "`",
+  " ",
+  "\r",
+  "\n",
+  "	",
+  "\\",
+  "%2F",
+  "%5C",
+  "%2f",
+  "%5c",
+  "\r\n",
+  "%0A",
+  "%0D",
+  "%0a",
+  "%0d",
+  "..",
+  "//",
+  "///",
+  "...",
+  "%20",
+  "\0"
+];
+var isValidURL = (value) => {
+  if (!new RegExp(/^https?:\/\/[^/]/).test(value)) {
+    return false;
+  }
+  const match = value.match(/^(https?:\/\/)(.*)$/);
+  if (!match) return false;
+  const rest = match[2];
+  for (const char of unsafeChars) {
+    if (rest.includes(char)) return false;
+  }
+  const regex = /^https?:\/\/(?:[a-zA-Z0-9._-]+|localhost|\[[0-9a-fA-F:]+\])(?::\d{1,5})?(?:\/[a-zA-Z0-9._~!$&'()?#*+,;=:@-]*)*\/?$/;
+  return regex.test(match[0]);
+};
+var isJWTPayloadWithToken = (payload) => {
+  return typeof payload === "object" && payload !== null && "token" in payload && typeof payload?.token === "string";
+};
+var isRelativeURL = (value) => {
+  if (value.length > 100) return false;
+  for (const char of unsafeChars) {
+    if (value.includes(char)) return false;
+  }
+  const regex = /^\/[a-zA-Z0-9\-_\/.?&=#]*\/?$/;
+  return regex.test(value);
+};
+var isSameOrigin = (origin, expected) => {
+  const originURL = new URL(origin);
+  const expectedURL = new URL(expected);
+  return equals(originURL.origin, expectedURL.origin);
+};
+var patternToRegex = (pattern) => {
+  try {
+    if (pattern.length > 2048) return null;
+    pattern = pattern.replace(/\\/g, "");
+    const match = pattern.match(/^(https?):\/\/([a-zA-Z0-9.*-]{1,253})(?::(\d{1,5}|\*))?(?:\/.*)?$/);
+    if (!match) return null;
+    const [, protocol, host, port] = match;
+    const hasWildcard = host.includes("*");
+    if (hasWildcard && !host.startsWith("*.")) return null;
+    if (hasWildcard && host.slice(2).includes("*")) return null;
+    const domain = hasWildcard ? host.slice(2) : host;
+    const escapedDomain = domain.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const hostRegex = hasWildcard ? `[^.]+\\.${escapedDomain}` : escapedDomain;
+    const portRegex = port === "*" ? ":\\d{1,5}" : port ? `:${port}` : "";
+    return new RegExp(`^${protocol}:\\/\\/${hostRegex}${portRegex}$`);
   } catch {
-    return url.trim();
+    return null;
   }
 };
-var getNormalizedOriginPath = (path) => {
+var isTrustedOrigin = (url, trustedOrigins) => {
+  if (!isValidURL(url) || trustedOrigins.length === 0) return false;
   try {
-    const url = new URL(path);
-    url.hash = "";
-    url.search = "";
-    return `${url.origin}${url.pathname}`;
+    const urlOrigin = new URL(url).origin;
+    for (const pattern of trustedOrigins) {
+      const regex = patternToRegex(pattern);
+      if (regex?.test(urlOrigin)) return true;
+      try {
+        if (isValidURL(pattern) && equals(new URL(pattern).origin, urlOrigin)) return true;
+      } catch {
+      }
+    }
   } catch {
-    return sanitizeURL(path);
   }
+  return false;
+};
+var timingSafeEqual = (a, b) => {
+  const bufferA = import_crypto.encoder.encode(a);
+  const bufferB = import_crypto.encoder.encode(b);
+  const len = Math.max(bufferA.length, bufferB.length);
+  let diff = 0;
+  for (let i = 0; i < len; i++) {
+    diff |= (bufferA[i] ?? 0) ^ (bufferB[i] ?? 0);
+  }
+  return diff === 0 && bufferA.length === bufferB.length;
 };
 
-// src/assert.ts
-var isValidURL = (value) => {
-  if (value.includes("\r\n") || value.includes("\n") || value.includes("\r")) return false;
-  const regex = /^https?:\/\/(?:[a-zA-Z0-9._-]+|localhost|\[[0-9a-fA-F:]+\])(?::\d{1,5})?(?:\/[a-zA-Z0-9._~!$&'()*+,;=:@-]*)*\/?$/;
-  return regex.test(value);
+// src/utils.ts
+var equals = (a, b) => {
+  if (a === null || b === null || a === void 0 || b === void 0) return false;
+  return a === b;
 };
-var isJWTPayloadWithToken = (payload) => {
-  return typeof payload === "object" && payload !== null && "token" in payload && typeof payload?.token === "string";
+var getBaseURL = (request) => {
+  const url = new URL(request.url);
+  return `${url.origin}${url.pathname}`;
+};
+var extractPath = (url) => {
+  const pathRegex = /^https?:\/\/[a-zA-Z0-9_\-\.]+(:\d+)?(\/.*)$/;
+  const match = url.match(pathRegex);
+  return match && match[2] ? match[2] : "/";
+};
+var getErrorName = (error) => {
+  if (error instanceof Error) {
+    return error.name;
+  }
+  return typeof error === "string" ? error : "UnknownError";
+};
+
+// src/cookie.ts
+var import_cookie = require("@aura-stack/router/cookie");
+var defaultCookieOptions = {
+  httpOnly: true,
+  sameSite: "lax",
+  path: "/",
+  maxAge: 60 * 60 * 24 * 15
+};
+var oauthCookieOptions = {
+  httpOnly: true,
+  maxAge: 5 * 60,
+  sameSite: "lax",
+  expires: new Date(Date.now() + 5 * 60 * 1e3)
+};
+var expiredCookieAttributes = {
+  ...defaultCookieOptions,
+  expires: /* @__PURE__ */ new Date(0),
+  maxAge: 0,
+  secure: true
+};
+var getCookie = (request, cookieName) => {
+  const cookies = request instanceof Request ? request.headers.get("Cookie") : request.get("Cookie");
+  if (!cookies) {
+    throw new AuthInternalError("COOKIE_NOT_FOUND", "No cookies found. There is no active session");
+  }
+  const value = (0, import_cookie.parse)(cookies)[cookieName];
+  if (!value) {
+    throw new AuthInternalError("COOKIE_NOT_FOUND", `Cookie "${cookieName}" not found. There is no active session`);
+  }
+  return value;
+};
+
+// src/jose.ts
+var import_jose = require("@aura-stack/jose");
+var import_jose2 = require("@aura-stack/jose/jose");
+var import_crypto2 = require("@aura-stack/jose/crypto");
+var jwtVerificationOptions = {
+  algorithms: ["HS256"],
+  typ: "JWT"
 };
 
 // src/secure.ts
 var verifyCSRF = async (jose, cookie, header) => {
   try {
-    const cookiePayload = await jose.verifyJWS(cookie);
-    const headerPayload = await jose.verifyJWS(header);
+    const cookiePayload = await jose.verifyJWS(cookie, jwtVerificationOptions);
+    const headerPayload = await jose.verifyJWS(header, jwtVerificationOptions);
     if (!isJWTPayloadWithToken(cookiePayload)) {
       throw new AuthSecurityError("CSRF_TOKEN_INVALID", "Cookie payload missing token field.");
     }
     if (!isJWTPayloadWithToken(headerPayload)) {
       throw new AuthSecurityError("CSRF_TOKEN_INVALID", "Header payload missing token field.");
     }
-    const cookieBuffer = Buffer.from(cookiePayload.token);
-    const headerBuffer = Buffer.from(headerPayload.token);
-    if (!equals(headerBuffer.length, cookieBuffer.length)) {
+    if (!equals(cookiePayload.token.length, headerPayload.token.length)) {
       throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
     }
-    if (!import_crypto.default.timingSafeEqual(cookieBuffer, headerBuffer)) {
+    if (!timingSafeEqual(cookiePayload.token, headerPayload.token)) {
       throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
     }
     return true;
@@ -148,193 +279,210 @@ var cacheControl = {
   Expires: "0",
   Vary: "Cookie"
 };
-
-// src/cookie.ts
-var import_cookie = require("@aura-stack/router/cookie");
-var defaultCookieOptions = {
-  httpOnly: true,
-  sameSite: "lax",
-  path: "/",
-  maxAge: 60 * 60 * 24 * 15
+var contentSecurityPolicy = {
+  "Content-Security-Policy": [
+    "default-src 'none'",
+    "script-src 'self'",
+    "frame-src 'none'",
+    "object-src 'none'",
+    "frame-ancestors 'none'",
+    "base-uri 'none'"
+  ].join("; ")
 };
-var oauthCookieOptions = {
-  httpOnly: true,
-  maxAge: 5 * 60,
-  sameSite: "lax",
-  expires: new Date(Date.now() + 5 * 60 * 1e3)
+var secureHeaders = {
+  "X-Content-Type-Options": "nosniff",
+  "X-Frame-Options": "DENY",
+  "Referrer-Policy": "strict-origin-when-cross-origin"
 };
-var expiredCookieAttributes = {
-  ...defaultCookieOptions,
-  expires: /* @__PURE__ */ new Date(0),
-  maxAge: 0
+var secureApiHeaders = {
+  ...cacheControl,
+  ...contentSecurityPolicy,
+  ...secureHeaders
 };
 
-// src/schemas.ts
-var import_zod = require("zod");
-var OAuthProviderConfigSchema = (0, import_zod.object)({
-  authorizeURL: (0, import_zod.string)().url(),
-  accessToken: (0, import_zod.string)().url(),
-  scope: (0, import_zod.string)().optional(),
-  userInfo: (0, import_zod.string)().url(),
-  responseType: (0, import_zod.enum)(["code", "token", "id_token"]),
-  clientId: (0, import_zod.string)(),
-  clientSecret: (0, import_zod.string)()
-});
-var OAuthAuthorization = OAuthProviderConfigSchema.extend({
-  redirectURI: (0, import_zod.string)(),
-  state: (0, import_zod.string)(),
-  codeChallenge: (0, import_zod.string)(),
-  codeChallengeMethod: (0, import_zod.enum)(["plain", "S256"])
-});
-var OAuthAuthorizationResponse = (0, import_zod.object)({
-  state: (0, import_zod.string)({ message: "Missing state parameter in the OAuth authorization response." }),
-  code: (0, import_zod.string)({ message: "Missing code parameter in the OAuth authorization response." })
-});
-var OAuthAuthorizationErrorResponse = (0, import_zod.object)({
-  error: (0, import_zod.enum)([
-    "invalid_request",
-    "unauthorized_client",
-    "access_denied",
-    "unsupported_response_type",
-    "invalid_scope",
-    "server_error",
-    "temporarily_unavailable"
-  ]),
-  error_description: (0, import_zod.string)().optional(),
-  error_uri: (0, import_zod.string)().optional(),
-  state: (0, import_zod.string)()
-});
-var OAuthAccessToken = OAuthProviderConfigSchema.extend({
-  redirectURI: (0, import_zod.string)(),
-  code: (0, import_zod.string)(),
-  codeVerifier: (0, import_zod.string)().min(43).max(128)
-});
-var OAuthAccessTokenResponse = (0, import_zod.object)({
-  access_token: (0, import_zod.string)(),
-  token_type: (0, import_zod.string)().optional(),
-  expires_in: (0, import_zod.number)().optional(),
-  refresh_token: (0, import_zod.string)().optional(),
-  scope: (0, import_zod.string)().optional().or((0, import_zod.null)())
-});
-var OAuthAccessTokenErrorResponse = (0, import_zod.object)({
-  error: (0, import_zod.enum)([
-    "invalid_request",
-    "invalid_client",
-    "invalid_grant",
-    "unauthorized_client",
-    "unsupported_grant_type",
-    "invalid_scope"
-  ]),
-  error_description: (0, import_zod.string)().optional(),
-  error_uri: (0, import_zod.string)().optional()
-});
-var OAuthErrorResponse = (0, import_zod.object)({
-  error: (0, import_zod.string)(),
-  error_description: (0, import_zod.string)().optional()
-});
-var OAuthEnvSchema = (0, import_zod.object)({
-  clientId: import_zod.z.string().min(1, "OAuth Client ID is required in the environment variables."),
-  clientSecret: import_zod.z.string().min(1, "OAuth Client Secret is required in the environment variables.")
-});
+// src/api/signOut.ts
+var import_router2 = require("@aura-stack/router");
+var signOut = async ({
+  ctx,
+  headers: headersInit,
+  redirectTo = "/",
+  skipCSRFCheck = false
+}) => {
+  const headers = new Headers(headersInit);
+  const header = headers.get("X-CSRF-Token");
+  let session = null;
+  let csrfToken = null;
+  try {
+    session = getCookie(headers, ctx.cookies.sessionToken.name);
+  } catch {
+    throw new AuthSecurityError("SESSION_TOKEN_MISSING", "The sessionToken is missing.");
+  }
+  try {
+    csrfToken = getCookie(headers, ctx.cookies.csrfToken.name);
+  } catch {
+    throw new AuthSecurityError("CSRF_TOKEN_MISSING", "The CSRF token is missing.");
+  }
+  ctx?.logger?.log("SIGN_OUT_ATTEMPT", {
+    structuredData: {
+      has_session: Boolean(session),
+      has_csrf_token: Boolean(csrfToken),
+      has_csrf_header: Boolean(header),
+      skip_csrf_check: skipCSRFCheck
+    }
+  });
+  if (!session) {
+    ctx?.logger?.log("SESSION_TOKEN_MISSING");
+    throw new AuthSecurityError("SESSION_TOKEN_MISSING", "The sessionToken is missing.");
+  }
+  if (!skipCSRFCheck) {
+    if (!csrfToken) {
+      ctx?.logger?.log("CSRF_TOKEN_MISSING");
+      throw new AuthSecurityError("CSRF_TOKEN_MISSING", "The CSRF token is missing.");
+    }
+    if (!header) {
+      ctx?.logger?.log("CSRF_HEADER_MISSING");
+      throw new AuthSecurityError("CSRF_HEADER_MISSING", "The CSRF header is missing.");
+    }
+    try {
+      await verifyCSRF(ctx.jose, csrfToken, header);
+    } catch (error) {
+      ctx?.logger?.log("CSRF_TOKEN_INVALID", { structuredData: { error_type: getErrorName(error) } });
+      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "CSRF token verification failed");
+    }
+    ctx?.logger?.log("SIGN_OUT_CSRF_VERIFIED");
+  } else {
+    try {
+      await ctx.jose.verifyJWS(csrfToken);
+    } catch (error) {
+      ctx?.logger?.log("CSRF_TOKEN_INVALID", { structuredData: { error_type: getErrorName(error) } });
+      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "CSRF token verification failed");
+    }
+  }
+  try {
+    await ctx.jose.decodeJWT(session);
+    ctx?.logger?.log("SIGN_OUT_SUCCESS");
+  } catch (error) {
+    ctx?.logger?.log("INVALID_JWT_TOKEN", { structuredData: { error_type: getErrorName(error) } });
+  }
+  const headersList = new import_router2.HeadersBuilder(secureApiHeaders).setHeader("Location", redirectTo).setCookie(ctx.cookies.csrfToken.name, "", expiredCookieAttributes).setCookie(ctx.cookies.sessionToken.name, "", expiredCookieAttributes).toHeaders();
+  return Response.json(
+    { redirect: Boolean(redirectTo), url: redirectTo },
+    {
+      status: 202,
+      headers: headersList
+    }
+  );
+};
 
 // src/actions/signIn/authorization.ts
-var getOriginURL = (request, trustedProxyHeaders) => {
-  const headers = request.headers;
-  if (trustedProxyHeaders) {
-    const protocol = headers.get("X-Forwarded-Proto") ?? headers.get("Forwarded")?.match(/proto=([^;]+)/i)?.[1] ?? "http";
-    const host = headers.get("X-Forwarded-Host") ?? headers.get("Host") ?? headers.get("Forwarded")?.match(/host=([^;]+)/i)?.[1] ?? null;
-    return new URL(`${protocol}://${host}${getNormalizedOriginPath(new URL(request.url).pathname)}`);
-  } else {
-    return new URL(getNormalizedOriginPath(request.url));
+var getTrustedOrigins = async (request, trustedOrigins) => {
+  if (!trustedOrigins) return [];
+  const raw = typeof trustedOrigins === "function" ? await trustedOrigins(request) : trustedOrigins;
+  return Array.isArray(raw) ? raw : typeof raw === "string" ? [raw] : [];
+};
+var getBaseURL2 = async ({
+  ctx,
+  request,
+  headers: headersInit
+}) => {
+  const origin = getEnv("BASE_URL") || ctx?.baseURL;
+  if (origin && origin !== "/") return origin;
+  if (ctx?.trustedProxyHeaders) {
+    const headers = headersInit && new Headers(headersInit) || request?.headers;
+    const protocol = headers?.get("Forwarded")?.match(/proto=([^;]+)/i)?.[1] ?? headers?.get("X-Forwarded-Proto") ?? "http";
+    const host = headers?.get("Host") ?? headers?.get("Forwarded")?.match(/host=([^;]+)/i)?.[1] ?? headers?.get("X-Forwarded-Host") ?? null;
+    if (host) return `${protocol}://${host}`;
+    throw new AuthInternalError(
+      "INVALID_OAUTH_CONFIGURATION",
+      "The URL cannot be constructed. Please set the BASE_URL environment variable or provide trusted proxy host headers."
+    );
+  }
+  try {
+    return new URL(request?.url ?? "not-found").origin;
+  } catch (error) {
+    throw new AuthInternalError(
+      "INVALID_OAUTH_CONFIGURATION",
+      "The URL cannot be constructed. Please set the BASE_URL environment variable or enable trustedProxyHeaders.",
+      { cause: error }
+    );
   }
 };
-var createRedirectTo = (request, redirectTo, trustedProxyHeaders) => {
+var getOriginURL = async (request, context) => {
+  const trustedOrigins = await getTrustedOrigins(request, context?.trustedOrigins);
+  trustedOrigins.push(new URL(request.url).origin);
+  const origin = await getBaseURL2({ request, ctx: context });
+  if (!isTrustedOrigin(origin, trustedOrigins)) {
+    context?.logger?.log("UNTRUSTED_ORIGIN", { structuredData: { origin } });
+    throw new AuthInternalError("UNTRUSTED_ORIGIN", "The constructed origin URL is not trusted.");
+  }
+  return origin;
+};
+var createRedirectTo = async (request, redirectTo, context) => {
   try {
     const headers = request.headers;
-    const origin = headers.get("Origin");
-    const referer = headers.get("Referer");
-    let hostedURL = getOriginURL(request, trustedProxyHeaders);
-    if (redirectTo) {
-      if (redirectTo.startsWith("/")) {
-        return sanitizeURL(redirectTo);
+    const requestOrigin = await getOriginURL(request, context);
+    const origins = await getTrustedOrigins(request, context?.trustedOrigins);
+    const validateURL = (url) => {
+      if (!isRelativeURL(url) && !isValidURL(url)) return "/";
+      if (isRelativeURL(url)) return url;
+      if (origins.length > 0) {
+        if (isTrustedOrigin(url, origins)) {
+          const urlOrigin = new URL(url).origin;
+          for (const pattern of origins) {
+            const regex = patternToRegex(pattern);
+            if (regex?.test(urlOrigin)) {
+              return isSameOrigin(url, request.url) ? extractPath(url) : url;
+            }
+            if (isValidURL(pattern) && equals(new URL(pattern).origin, urlOrigin)) return url;
+          }
+        }
+        context?.logger?.log("OPEN_REDIRECT_ATTACK");
+        return "/";
       }
-      const redirectToURL = new URL(sanitizeURL(getNormalizedOriginPath(redirectTo)));
-      if (!isValidURL(redirectTo) || !equals(redirectToURL.origin, hostedURL.origin)) {
-        throw new AuthSecurityError(
-          "POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED",
-          "The redirectTo parameter does not match the hosted origin."
-        );
+      if (isSameOrigin(url, requestOrigin)) {
+        return extractPath(url);
       }
-      return sanitizeURL(redirectToURL.pathname);
-    }
-    if (referer) {
-      const refererURL = new URL(sanitizeURL(referer));
-      if (!isValidURL(referer) || !equals(refererURL.origin, hostedURL.origin)) {
-        throw new AuthSecurityError(
-          "POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED",
-          "The referer of the request does not match the hosted origin."
-        );
-      }
-      return sanitizeURL(refererURL.pathname);
-    }
-    if (origin) {
-      const originURL = new URL(sanitizeURL(getNormalizedOriginPath(origin)));
-      if (!isValidURL(origin) || !equals(originURL.origin, hostedURL.origin)) {
-        throw new AuthSecurityError("POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED", "Invalid origin (potential CSRF).");
-      }
-      return sanitizeURL(originURL.pathname);
-    }
-    return "/";
+      context?.logger?.log("OPEN_REDIRECT_ATTACK");
+      return "/";
+    };
+    return validateURL(redirectTo ?? headers.get("Referer") ?? headers.get("Origin") ?? "/");
   } catch (error) {
-    if (isAuthSecurityError(error)) {
-      throw error;
-    }
-    throw new AuthSecurityError("POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED", "Invalid origin (potential CSRF).");
+    context?.logger?.log("POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED");
+    return "/";
   }
 };
 
 // src/actions/signOut/signOut.ts
-var config = (0, import_router2.createEndpointConfig)({
+var config = (0, import_router3.createEndpointConfig)({
   schemas: {
-    searchParams: import_zod2.z.object({
-      token_type_hint: import_zod2.z.literal("session_token"),
-      redirectTo: import_zod2.z.string().optional()
+    searchParams: import_v4.z.object({
+      token_type_hint: import_v4.z.literal("session_token"),
+      redirectTo: import_v4.z.string().optional()
     })
   }
 });
-var signOutAction = (0, import_router2.createEndpoint)(
+var signOutAction = (0, import_router3.createEndpoint)(
   "POST",
   "/signOut",
   async (ctx) => {
     const {
       request,
-      headers,
       searchParams: { redirectTo },
-      context: { jose, cookies }
+      context
     } = ctx;
-    const session = headers.getCookie(cookies.sessionToken.name);
-    const csrfToken = headers.getCookie(cookies.csrfToken.name);
-    const header = headers.getHeader("X-CSRF-Token");
-    if (!session) {
-      throw new AuthSecurityError("SESSION_TOKEN_MISSING", "The sessionToken is missing.");
-    }
-    if (!csrfToken) {
-      throw new AuthSecurityError("CSRF_TOKEN_MISSING", "The CSRF token is missing.");
-    }
-    if (!header) {
-      throw new AuthSecurityError("CSRF_TOKEN_MISSING", "The CSRF header is missing.");
-    }
-    await verifyCSRF(jose, csrfToken, header);
-    await jose.decodeJWT(session);
-    const normalizedOriginPath = getNormalizedOriginPath(request.url);
-    const location = createRedirectTo(
-      new Request(normalizedOriginPath, {
-        headers: headers.toHeaders()
+    const baseURL = getBaseURL(request);
+    const location = await createRedirectTo(
+      new Request(baseURL, {
+        headers: request.headers
       }),
-      redirectTo
+      redirectTo,
+      context
     );
-    const headersList = new import_router2.HeadersBuilder(cacheControl).setHeader("Location", location).setCookie(cookies.csrfToken.name, "", expiredCookieAttributes).setCookie(cookies.sessionToken.name, "", expiredCookieAttributes).toHeaders();
-    return Response.json({ message: "Signed out successfully" }, { status: import_router2.statusCode.ACCEPTED, headers: headersList });
+    return await signOut({
+      ctx: context,
+      headers: request.headers,
+      redirectTo: location
+    });
   },
   config
 );