@becklyn/deployment-protection 0.2.0 → 0.3.0

package/dist/es/handler.js

@@ -1,7 +1,8 @@
 import { isValidBypass, readBypassCookie, readBypassToken, shouldSetBypassCookie } from "./bypass";
-import { hasPasswordAuth, hasVercelAuth, isProtectionActive, resolveConfig } from "./config";
+import { hasPasswordAuth, hasVercelAuth, hasVercelDirectAuth, hasVercelProxyAuth, isProtectionActive, resolveConfig, } from "./config";
 import { BYPASS_COOKIE_NAME, BYPASS_HEADER, OAUTH_NONCE_COOKIE, OAUTH_RETURN_COOKIE, OAUTH_VERIFIER_COOKIE, SESSION_COOKIE_NAME, VERCEL_AUTHORIZE_PATH, VERCEL_CALLBACK_PATH, } from "./constants";
 import { timingSafeEqualString } from "./crypto";
+import { buildProxyStartUrl, verifyHandoffToken } from "./handoff";
 import { renderLoginPage } from "./login-page";
 import { validatePasswordCredentials } from "./password";
 import { safeReturnTo } from "./safe-return-to";
@@ -114,6 +115,19 @@ async function handleVercelAuthorize(request, config) {
         return new Response("Sign in with Vercel is not configured", { status: 500 });
     }
     const returnTo = safeReturnTo(new URL(request.url).searchParams.get("return_to"));
+    // Prefer central auth-proxy so apps never register per-host OAuth callbacks.
+    if (hasVercelProxyAuth(config) && config.authProxyUrl && config.handoffSecret) {
+        const startUrl = await buildProxyStartUrl({
+            authProxyUrl: config.authProxyUrl,
+            secret: config.handoffSecret,
+            returnOrigin: new URL(request.url).origin,
+            returnPath: returnTo,
+        });
+        return redirect(request, startUrl);
+    }
+    if (!hasVercelDirectAuth(config)) {
+        return new Response("Sign in with Vercel is not configured", { status: 500 });
+    }
     return buildVercelAuthorizeRedirect(request, config, returnTo);
 }
 async function handleVercelCallback(request, config) {
@@ -124,9 +138,32 @@ async function handleVercelCallback(request, config) {
         return new Response("Sign in with Vercel is not configured", { status: 500 });
     }
     const url = new URL(request.url);
+    const handoff = url.searchParams.get("handoff");
+    const secure = isSecureRequest(request);
+    // Auth-proxy handoff: short-lived signed token, no Vercel client secret on the app.
+    if (handoff) {
+        if (!config.handoffSecret) {
+            return new Response("Sign in with Vercel is not configured", { status: 500 });
+        }
+        const returnTo = safeReturnTo(url.searchParams.get("return_to"));
+        const payload = await verifyHandoffToken(config.handoffSecret, handoff, url.origin);
+        if (!payload) {
+            return htmlResponse(renderLoginPage(config, {
+                error: "Vercel sign-in failed (invalid handoff).",
+                returnTo,
+                showPassword: hasPasswordAuth(config),
+                showVercel: true,
+            }));
+        }
+        const response = redirect(request, returnTo);
+        return attachSession(response, config, "vercel", payload.subject, secure);
+    }
+    // Legacy direct OAuth callback on the protected app.
+    if (!hasVercelDirectAuth(config)) {
+        return new Response("Sign in with Vercel is not configured", { status: 500 });
+    }
     const code = url.searchParams.get("code");
     const state = url.searchParams.get("state");
-    const secure = isSecureRequest(request);
     const returnTo = safeReturnTo(readCookie(request, OAUTH_RETURN_COOKIE));
     if (!code || !(await assertOAuthState(request, state))) {
         const response = htmlResponse(renderLoginPage(config, {

package/dist/es/handoff.d.ts

@@ -0,0 +1,46 @@
+export declare const HANDOFF_TTL_SECONDS = 60;
+export declare const PROXY_START_TTL_SECONDS: number;
+export interface ProxyStartParams {
+    returnOrigin: string;
+    returnPath: string;
+    exp: number;
+    nonce: string;
+}
+export interface HandoffPayload {
+    exp: number;
+    aud: string;
+    subject: string;
+    method: "vercel";
+}
+/**
+ * Canonical payload for HMAC over the proxy start request.
+ * Field order is fixed so app and proxy produce the same signature.
+ */
+export declare function canonicalProxyStartPayload(params: ProxyStartParams): string;
+export declare function signProxyStart(secret: string, params: ProxyStartParams): Promise<string>;
+export declare function verifyProxyStartSignature(secret: string, params: ProxyStartParams, signature: string | null | undefined): Promise<boolean>;
+export declare function buildProxyStartUrl(options: {
+    authProxyUrl: string;
+    secret: string;
+    returnOrigin: string;
+    returnPath: string;
+    ttlSeconds?: number;
+}): Promise<string>;
+export declare function createHandoffToken(secret: string, audienceOrigin: string, subject: string, ttlSeconds?: number): Promise<string>;
+export declare function verifyHandoffToken(secret: string, token: string | null | undefined, expectedAudienceOrigin: string): Promise<HandoffPayload | null>;
+/**
+ * Validate a post-login return origin for the auth proxy.
+ * Only https (and http://localhost / 127.0.0.1) are accepted.
+ */
+export declare function normalizeReturnOrigin(value: string | null | undefined): string | null;
+/**
+ * Optional allowlist. Entries may be:
+ * - full origins (`https://app.example.com`)
+ * - hostname suffixes (`.vercel.app`, `example.com`)
+ * - `localhost` (any localhost / 127.0.0.1 http(s) origin)
+ *
+ * Empty allowlist → any origin that passes {@link normalizeReturnOrigin}.
+ */
+export declare function isReturnOriginAllowed(origin: string, allowlist: string[]): boolean;
+export declare function parseAllowlist(value: string | null | undefined): string[];
+//# sourceMappingURL=handoff.d.ts.map

package/dist/es/handoff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handoff.d.ts","sourceRoot":"","sources":["../../src/handoff.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,mBAAmB,KAAK,CAAC;AACtC,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,MAAM,WAAW,gBAAgB;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,QAAQ,CAAC;CACpB;AAeD;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAE3E;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAE9F;AAED,wBAAsB,yBAAyB,CAC3C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,gBAAgB,EACxB,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACrC,OAAO,CAAC,OAAO,CAAC,CAWlB;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAC9C,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBlB;AAWD,wBAAsB,kBAAkB,CACpC,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,MAAM,EACf,UAAU,SAAsB,GACjC,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED,wBAAsB,kBAAkB,CACpC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,sBAAsB,EAAE,MAAM,GAC/B,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAwChC;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CA4BrF;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAgDlF;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CASzE"}

package/dist/es/handoff.js

@@ -0,0 +1,187 @@
+import { base64UrlToBytes, bytesToBase64Url, hmacSign, randomToken, timingSafeEqualString, } from "./crypto";
+import { safeReturnTo } from "./safe-return-to";
+export const HANDOFF_TTL_SECONDS = 60;
+export const PROXY_START_TTL_SECONDS = 5 * 60;
+function encodeJson(value) {
+    return bytesToBase64Url(new TextEncoder().encode(JSON.stringify(value)));
+}
+function decodeJson(encoded) {
+    try {
+        const json = new TextDecoder().decode(base64UrlToBytes(encoded));
+        return JSON.parse(json);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Canonical payload for HMAC over the proxy start request.
+ * Field order is fixed so app and proxy produce the same signature.
+ */
+export function canonicalProxyStartPayload(params) {
+    return `v1\n${params.returnOrigin}\n${params.returnPath}\n${params.exp}\n${params.nonce}`;
+}
+export async function signProxyStart(secret, params) {
+    return hmacSign(secret, canonicalProxyStartPayload(params));
+}
+export async function verifyProxyStartSignature(secret, params, signature) {
+    if (!signature) {
+        return false;
+    }
+    if (params.exp < Math.floor(Date.now() / 1000)) {
+        return false;
+    }
+    const expected = await signProxyStart(secret, params);
+    return timingSafeEqualString(signature, expected);
+}
+export async function buildProxyStartUrl(options) {
+    const returnPath = safeReturnTo(options.returnPath);
+    const params = {
+        returnOrigin: options.returnOrigin.replace(/\/$/, ""),
+        returnPath,
+        exp: Math.floor(Date.now() / 1000) + (options.ttlSeconds ?? PROXY_START_TTL_SECONDS),
+        nonce: randomToken(16),
+    };
+    const sig = await signProxyStart(options.secret, params);
+    const url = new URL("/start", ensureTrailingSlashBase(options.authProxyUrl));
+    url.searchParams.set("return_origin", params.returnOrigin);
+    url.searchParams.set("return_path", params.returnPath);
+    url.searchParams.set("exp", String(params.exp));
+    url.searchParams.set("nonce", params.nonce);
+    url.searchParams.set("sig", sig);
+    return url.toString();
+}
+function ensureTrailingSlashBase(value) {
+    try {
+        const url = new URL(value);
+        return url.toString().endsWith("/") ? url.toString() : `${url.toString()}/`;
+    }
+    catch {
+        return value.endsWith("/") ? value : `${value}/`;
+    }
+}
+export async function createHandoffToken(secret, audienceOrigin, subject, ttlSeconds = HANDOFF_TTL_SECONDS) {
+    const payload = {
+        exp: Math.floor(Date.now() / 1000) + ttlSeconds,
+        aud: audienceOrigin.replace(/\/$/, ""),
+        subject,
+        method: "vercel",
+    };
+    const body = encodeJson(payload);
+    const signature = await hmacSign(secret, body);
+    return `${body}.${signature}`;
+}
+export async function verifyHandoffToken(secret, token, expectedAudienceOrigin) {
+    if (!token) {
+        return null;
+    }
+    const [body, signature] = token.split(".");
+    if (!body || !signature) {
+        return null;
+    }
+    const expected = await hmacSign(secret, body);
+    if (!(await timingSafeEqualString(signature, expected))) {
+        return null;
+    }
+    const payload = decodeJson(body);
+    if (!payload ||
+        typeof payload.exp !== "number" ||
+        typeof payload.aud !== "string" ||
+        typeof payload.subject !== "string" ||
+        payload.method !== "vercel") {
+        return null;
+    }
+    if (payload.exp < Math.floor(Date.now() / 1000)) {
+        return null;
+    }
+    const expectedAud = expectedAudienceOrigin.replace(/\/$/, "");
+    if (!(await timingSafeEqualString(payload.aud, expectedAud))) {
+        return null;
+    }
+    return payload;
+}
+/**
+ * Validate a post-login return origin for the auth proxy.
+ * Only https (and http://localhost / 127.0.0.1) are accepted.
+ */
+export function normalizeReturnOrigin(value) {
+    if (typeof value !== "string" || value.length === 0 || value.length > 512) {
+        return null;
+    }
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return null;
+    }
+    if (url.username || url.password) {
+        return null;
+    }
+    const host = url.hostname.toLowerCase();
+    const isLocalHttp = url.protocol === "http:" &&
+        (host === "localhost" || host === "127.0.0.1" || host === "[::1]");
+    if (url.protocol !== "https:" && !isLocalHttp) {
+        return null;
+    }
+    // Origin only — reject unexpected path/query/hash noise by normalizing.
+    return url.origin;
+}
+/**
+ * Optional allowlist. Entries may be:
+ * - full origins (`https://app.example.com`)
+ * - hostname suffixes (`.vercel.app`, `example.com`)
+ * - `localhost` (any localhost / 127.0.0.1 http(s) origin)
+ *
+ * Empty allowlist → any origin that passes {@link normalizeReturnOrigin}.
+ */
+export function isReturnOriginAllowed(origin, allowlist) {
+    if (allowlist.length === 0) {
+        return true;
+    }
+    let url;
+    try {
+        url = new URL(origin);
+    }
+    catch {
+        return false;
+    }
+    const host = url.hostname.toLowerCase();
+    for (const raw of allowlist) {
+        const entry = raw.trim().toLowerCase();
+        if (!entry) {
+            continue;
+        }
+        if (entry === "localhost") {
+            if (host === "localhost" || host === "127.0.0.1" || host === "[::1]") {
+                return true;
+            }
+            continue;
+        }
+        if (entry.startsWith("http://") || entry.startsWith("https://")) {
+            try {
+                if (new URL(entry).origin.toLowerCase() === origin.toLowerCase()) {
+                    return true;
+                }
+            }
+            catch {
+                // ignore invalid allowlist entries
+            }
+            continue;
+        }
+        const suffix = entry.startsWith(".") ? entry : `.${entry}`;
+        if (host === entry || host === entry.replace(/^\./, "") || host.endsWith(suffix)) {
+            return true;
+        }
+    }
+    return false;
+}
+export function parseAllowlist(value) {
+    if (!value) {
+        return [];
+    }
+    return value
+        .split(",")
+        .map(part => part.trim())
+        .filter(Boolean);
+}

package/dist/es/index.d.ts

@@ -1,6 +1,7 @@
 export { INTERNAL_PATH_PREFIX, VERCEL_AUTHORIZE_PATH, VERCEL_CALLBACK_PATH } from "./constants";
+export { AUTH_PROXY_CALLBACK_PATH, AUTH_PROXY_START_PATH, handleAuthProxyCallback, handleAuthProxyStart, } from "./auth-proxy";
 export { handleDeploymentProtection } from "./handler";
 export { withDeploymentProtection } from "./middleware";
-export { resolveConfig, hasPasswordAuth, hasVercelAuth, isProtectionActive } from "./config";
+export { resolveConfig, hasPasswordAuth, hasVercelAuth, hasVercelDirectAuth, hasVercelProxyAuth, isProtectionActive, } from "./config";
 export type { AuthMethod, DeploymentProtectionConfig, DeploymentProtectionOptions, FormOptions, SessionPayload, } from "./types";
 //# sourceMappingURL=index.d.ts.map

package/dist/es/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAChG,OAAO,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC7F,YAAY,EACR,UAAU,EACV,0BAA0B,EAC1B,2BAA2B,EAC3B,WAAW,EACX,cAAc,GACjB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAChG,OAAO,EACH,wBAAwB,EACxB,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EACH,aAAa,EACb,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,GACrB,MAAM,UAAU,CAAC;AAClB,YAAY,EACR,UAAU,EACV,0BAA0B,EAC1B,2BAA2B,EAC3B,WAAW,EACX,cAAc,GACjB,MAAM,SAAS,CAAC"}

package/dist/es/index.js

@@ -1,4 +1,5 @@
 export { INTERNAL_PATH_PREFIX, VERCEL_AUTHORIZE_PATH, VERCEL_CALLBACK_PATH } from "./constants";
+export { AUTH_PROXY_CALLBACK_PATH, AUTH_PROXY_START_PATH, handleAuthProxyCallback, handleAuthProxyStart, } from "./auth-proxy";
 export { handleDeploymentProtection } from "./handler";
 export { withDeploymentProtection } from "./middleware";
-export { resolveConfig, hasPasswordAuth, hasVercelAuth, isProtectionActive } from "./config";
+export { resolveConfig, hasPasswordAuth, hasVercelAuth, hasVercelDirectAuth, hasVercelProxyAuth, isProtectionActive, } from "./config";

package/dist/es/types.d.ts

@@ -4,7 +4,22 @@ export interface DeploymentProtectionConfig {
     username: string | null;
     password: string | null;
     secret: string | null;
+    /**
+     * Shared secret used to sign proxy start requests and verify handoff tokens.
+     * Falls back to {@link secret} when unset.
+     */
+    handoffSecret: string | null;
     bypassSecret: string | null;
+    /**
+     * Base URL of the central auth-proxy app (e.g. https://dp-auth.example.com).
+     * When set, protected apps no longer need per-host Vercel OAuth callback URLs.
+     */
+    authProxyUrl: string | null;
+    /**
+     * Optional allowlist for auth-proxy return origins (proxy side).
+     * See README for entry formats.
+     */
+    allowedReturnOrigins: string[];
     vercelClientId: string | null;
     vercelClientSecret: string | null;
     sessionTtlSeconds: number;

package/dist/es/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE1D,MAAM,WAAW,0BAA0B;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,2BAA2B;IACxC;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,8CAA8C;IAC9C,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,qDAAqD;IACrD,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE1D,MAAM,WAAW,0BAA0B;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;OAGG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;OAGG;IACH,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;OAGG;IACH,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,2BAA2B;IACxC;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,8CAA8C;IAC9C,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,qDAAqD;IACrD,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC"}

package/dist/es/vercel-oauth.d.ts

@@ -13,8 +13,15 @@ export interface VercelUserInfo {
     email?: string;
     preferred_username?: string;
 }
-export declare function buildVercelAuthorizeRedirect(request: Request, config: DeploymentProtectionConfig, returnTo: string): Promise<Response>;
-export declare function exchangeVercelCode(request: Request, config: DeploymentProtectionConfig, code: string, codeVerifier: string): Promise<VercelTokenResponse>;
+export interface VercelOAuthPathOptions {
+    /**
+     * Absolute path used as the OAuth redirect_uri path on the current origin.
+     * Defaults to the protected-app callback path. Auth-proxy uses `/callback`.
+     */
+    callbackPath?: string;
+}
+export declare function buildVercelAuthorizeRedirect(request: Request, config: DeploymentProtectionConfig, returnTo: string, options?: VercelOAuthPathOptions): Promise<Response>;
+export declare function exchangeVercelCode(request: Request, config: DeploymentProtectionConfig, code: string, codeVerifier: string, options?: VercelOAuthPathOptions): Promise<VercelTokenResponse>;
 export declare function fetchVercelUserInfo(accessToken: string): Promise<VercelUserInfo>;
 export declare function readCookie(request: Request, name: string): string | null;
 export declare function assertOAuthState(request: Request, state: string | null): Promise<boolean>;

package/dist/es/vercel-oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vercel-oauth.d.ts","sourceRoot":"","sources":["../../src/vercel-oauth.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,SAAS,CAAC;AAE1D,MAAM,WAAW,mBAAmB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAYD,wBAAsB,4BAA4B,CAC9C,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,0BAA0B,EAClC,QAAQ,EAAE,MAAM,GACjB,OAAO,CAAC,QAAQ,CAAC,CAsCnB;AAED,wBAAsB,kBAAkB,CACpC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,0BAA0B,EAClC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GACrB,OAAO,CAAC,mBAAmB,CAAC,CA6B9B;AAED,wBAAsB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAYtF;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgBxE;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAO/F;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAqB7E;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI,CAiB3E;AAED,wBAAgB,eAAe,CAC3B,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE;IACL,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,GACF,IAAI,CAwBN"}
+{"version":3,"file":"vercel-oauth.d.ts","sourceRoot":"","sources":["../../src/vercel-oauth.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,SAAS,CAAC;AAE1D,MAAM,WAAW,mBAAmB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,sBAAsB;IACnC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAgBD,wBAAsB,4BAA4B,CAC9C,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,0BAA0B,EAClC,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,sBAAsB,GACjC,OAAO,CAAC,QAAQ,CAAC,CAsCnB;AAED,wBAAsB,kBAAkB,CACpC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,0BAA0B,EAClC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,sBAAsB,GACjC,OAAO,CAAC,mBAAmB,CAAC,CA6B9B;AAED,wBAAsB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAYtF;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgBxE;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAO/F;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAqB7E;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI,CAkB3E;AAED,wBAAgB,eAAe,CAC3B,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE;IACL,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,GACF,IAAI,CAwBN"}

package/dist/es/vercel-oauth.js

@@ -1,4 +1,4 @@
-import { OAUTH_NONCE_COOKIE, OAUTH_RETURN_COOKIE, OAUTH_STATE_COOKIE, OAUTH_VERIFIER_COOKIE, VERCEL_CALLBACK_PATH, } from "./constants";
+import { OAUTH_NONCE_COOKIE, OAUTH_RETURN_COOKIE, OAUTH_RETURN_ORIGIN_COOKIE, OAUTH_STATE_COOKIE, OAUTH_VERIFIER_COOKIE, VERCEL_CALLBACK_PATH, } from "./constants";
 import { randomToken, sha256Base64Url, timingSafeEqualString } from "./crypto";
 function cookieOptions(secure) {
     return {
@@ -9,7 +9,10 @@ function cookieOptions(secure) {
         maxAge: 10 * 60,
     };
 }
-export async function buildVercelAuthorizeRedirect(request, config, returnTo) {
+function resolveCallbackPath(options) {
+    return options?.callbackPath ?? VERCEL_CALLBACK_PATH;
+}
+export async function buildVercelAuthorizeRedirect(request, config, returnTo, options) {
     if (!config.vercelClientId) {
         return new Response("Vercel OAuth is not configured", { status: 500 });
     }
@@ -18,7 +21,7 @@ export async function buildVercelAuthorizeRedirect(request, config, returnTo) {
     const codeVerifier = randomToken(48);
     const codeChallenge = await sha256Base64Url(codeVerifier);
     const origin = new URL(request.url).origin;
-    const redirectUri = `${origin}${VERCEL_CALLBACK_PATH}`;
+    const redirectUri = `${origin}${resolveCallbackPath(options)}`;
     const secure = origin.startsWith("https://");
     const params = new URLSearchParams({
         client_id: config.vercelClientId,
@@ -43,7 +46,7 @@ export async function buildVercelAuthorizeRedirect(request, config, returnTo) {
     appendSetCookie(response, OAUTH_RETURN_COOKIE, returnTo || "/", opts);
     return response;
 }
-export async function exchangeVercelCode(request, config, code, codeVerifier) {
+export async function exchangeVercelCode(request, config, code, codeVerifier, options) {
     if (!config.vercelClientId || !config.vercelClientSecret) {
         throw new Error("Vercel OAuth is not configured");
     }
@@ -54,7 +57,7 @@ export async function exchangeVercelCode(request, config, code, codeVerifier) {
         client_secret: config.vercelClientSecret,
         code,
         code_verifier: codeVerifier,
-        redirect_uri: `${origin}${VERCEL_CALLBACK_PATH}`,
+        redirect_uri: `${origin}${resolveCallbackPath(options)}`,
     });
     const response = await fetch("https://api.vercel.com/login/oauth/token", {
         method: "POST",
@@ -133,6 +136,7 @@ export function clearOAuthCookies(response, secure) {
         OAUTH_NONCE_COOKIE,
         OAUTH_VERIFIER_COOKIE,
         OAUTH_RETURN_COOKIE,
+        OAUTH_RETURN_ORIGIN_COOKIE,
     ]) {
         appendSetCookie(response, name, "", expired);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@becklyn/deployment-protection",
-    "version": "0.2.0",
+    "version": "0.3.0",
     "license": "MIT",
     "description": "Simple shared username/password + Sign in with Vercel gate for Next.js deployments",
     "homepage": "https://github.com/Becklyn-Studios/ts-libs/tree/main/packages/deployment-protection",