@auth-link/web 0.0.1 → 0.0.3

package/dist/index.js

@@ -1694,6 +1694,9 @@ function qrImage(ticket) {
   qr.make();
   return `data:image/svg+xml;charset=utf-8,${encodeURIComponent(qr.createSvgTag({ cellSize: 4, margin: 16, scalable: true }))}`;
 }
+function backendProtocol(url) {
+  return url.protocol === "https:" || url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+}
 async function limitedJson(response) {
   const reader = response.body?.getReader();
   if (!reader) fail("INVALID_RESPONSE");
@@ -1728,30 +1731,66 @@ async function limitedJson(response) {
 function createAuthLinkClient(options) {
   if ("apiKey" in options || "secret" in options) fail("SERVER_SECRET_FORBIDDEN");
   const base = options.baseUrl ?? "/api/authlink";
+  const allowedOrigins = new Set(options.allowedBackendOrigins ?? []);
+  for (const origin of allowedOrigins) {
+    let url;
+    try {
+      url = new URL(origin);
+    } catch {
+      return fail("INVALID_BACKEND_ORIGIN");
+    }
+    if (url.origin !== origin || url.hostname.includes("*") || !backendProtocol(url)) fail("INVALID_BACKEND_ORIGIN");
+  }
+  const credentials = options.credentials ?? (options.accessToken ? "omit" : "same-origin");
+  if (!["omit", "same-origin", "include"].includes(credentials)) fail("INVALID_CREDENTIALS");
+  const csrfHeaderName = options.csrfHeaderName ?? "X-CSRF-Token";
+  const reserved = /* @__PURE__ */ new Set(["accept", "content-type", "authorization", "idempotency-key"]);
+  try {
+    new Headers([[csrfHeaderName, "test"]]);
+  } catch {
+    return fail("INVALID_CSRF_HEADER");
+  }
+  if (reserved.has(csrfHeaderName.toLowerCase())) fail("INVALID_CSRF_HEADER");
+  reserved.add(csrfHeaderName.toLowerCase());
   const call = async (path, body, signal, key) => {
     if (typeof window === "undefined") fail("BROWSER_REQUIRED");
-    const url = new URL(base.replace(/\/$/, "") + path, window.location.href);
-    if (url.origin !== window.location.origin || url.username || url.password || url.search || url.hash || url.protocol !== "https:" && !["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)) fail("CMS_ORIGIN_REQUIRED");
-    const csrf = await options.csrfToken();
-    if (typeof csrf !== "string" || !csrf || csrf.length > 1024 || /[\r\n]/.test(csrf)) fail("CSRF_REQUIRED");
+    let url;
+    try {
+      url = new URL(base.replace(/\/+$/, "") + path, window.location.href);
+    } catch {
+      return fail("INVALID_BASE_URL");
+    }
+    if (url.username || url.password || url.search || url.hash || !backendProtocol(url)) fail("INVALID_BASE_URL");
+    if (url.origin !== window.location.origin && !allowedOrigins.has(url.origin)) fail("BACKEND_ORIGIN_NOT_ALLOWED");
     signal?.throwIfAborted();
     const controller = new AbortController();
     const cancel = () => controller.abort(signal?.reason);
     signal?.addEventListener("abort", cancel, { once: true });
     const timeout = setTimeout(() => controller.abort(), 1e4);
     try {
+      const headers = new Headers(typeof options.headers === "function" ? await abortable(Promise.resolve().then(options.headers), controller.signal) : options.headers);
+      for (const name of reserved) if (headers.has(name)) fail("RESERVED_HEADER");
+      headers.set("Accept", "application/json");
+      headers.set("Content-Type", "application/json");
+      if (key) headers.set("Idempotency-Key", key);
+      if (options.csrfToken) {
+        const csrf = await abortable(Promise.resolve().then(options.csrfToken), controller.signal);
+        if (typeof csrf !== "string" || !csrf.trim() || csrf.length > 1024 || /[\r\n]/.test(csrf)) fail("CSRF_REQUIRED");
+        headers.set(csrfHeaderName, csrf);
+      } else if (!options.accessToken || credentials !== "omit") fail("CSRF_REQUIRED");
+      if (options.accessToken) {
+        const accessToken = await abortable(Promise.resolve().then(options.accessToken), controller.signal);
+        if (typeof accessToken !== "string" || !accessToken || /\s/.test(accessToken)) fail("ACCESS_TOKEN_REQUIRED");
+        headers.set("Authorization", `Bearer ${accessToken}`);
+      }
+      controller.signal.throwIfAborted();
       const response = await (options.fetch ?? globalThis.fetch)(url, {
         method: "POST",
-        credentials: "same-origin",
+        credentials,
         redirect: "error",
         cache: "no-store",
         signal: controller.signal,
-        headers: {
-          Accept: "application/json",
-          "Content-Type": "application/json",
-          "X-CSRF-Token": csrf,
-          ...key ? { "Idempotency-Key": key } : {}
-        },
+        headers,
         body: JSON.stringify(body)
       });
       if (!response.ok) fail(response.status === 401 || response.status === 403 ? "CMS_UNAUTHORIZED" : "CMS_REQUEST_FAILED");