@better-auth/infra 0.2.8 → 0.2.10

package/dist/index.mjs

@@ -1210,7 +1210,7 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 				return "";
 			}
 		},
-		async checkImpossibleTravel(userId, currentLocation, visitorId) {
+		async checkImpossibleTravel(userId, currentLocation, visitorId, ip = null) {
 			if (!options.impossibleTravel?.enabled || !currentLocation) return null;
 			try {
 				const data = await $api("/security/impossible-travel", {
@@ -1219,6 +1219,7 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 						userId,
 						visitorId,
 						location: currentLocation,
+						ip,
 						config: options
 					}
 				});
@@ -1249,14 +1250,15 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 		/**
 		* Store user's last known location for impossible travel detection
 		*/
-		async storeLastLocation(userId, location) {
-			if (!location) return;
+		async storeLastLocation(userId, location, ip = null) {
+			if (!options.impossibleTravel?.enabled || !location) return;
 			try {
 				await $api("/security/store-last-login", {
 					method: "POST",
 					body: {
 						userId,
-						location
+						location,
+						ip
 					}
 				});
 			} catch (error) {
@@ -1497,7 +1499,9 @@ const all = new Set([
 	"/send-verification-email",
 	"/change-email",
 	"/organization/invite-member",
-	"/dash/organization/invite-member"
+	"/dash/organization/invite-member",
+	"/dash/create-user",
+	"/dash/update-user"
 ]);
 /**
 * Path is one of `[
@@ -1516,7 +1520,9 @@ const all = new Set([
 *   '/send-verification-email',
 *   '/change-email',
 *   '/organization/invite-member',
-*   '/dash/organization/invite-member'
+*   '/dash/organization/invite-member',
+*   '/dash/create-user',
+*   '/dash/update-user'
 * ]`.
 * @param context Request context
 * @param context.path Request path
@@ -2088,33 +2094,42 @@ const sentinel = (options) => {
 				emailValidation: opts.security?.emailValidation,
 				emailNormalization: opts.security?.emailNormalization,
 				databaseHooks: {
-					user: { create: {
-						async before(user, ctx) {
-							if (!ctx) return;
-							const visitorId = ctx.context.visitorId;
-							if (visitorId && opts.security?.freeTrialAbuse?.enabled) {
-								recordCheck(ctx, "free_trial_abuse");
-								const abuseCheck = await securityService.checkFreeTrialAbuse(visitorId);
-								if (abuseCheck.isAbuse && abuseCheck.action === "block") {
-									setOutcome(ctx, "blocked", "free_trial_abuse", {
-										accountCount: abuseCheck.accountCount,
-										maxAccounts: abuseCheck.maxAccounts
-									});
-									emitEvaluation(ctx, trackEvent);
-									throw new APIError("FORBIDDEN", { message: "Account creation is not allowed from this device." });
+					user: {
+						create: {
+							async before(user, ctx) {
+								if (!ctx) return;
+								const visitorId = ctx.context.visitorId;
+								if (visitorId && opts.security?.freeTrialAbuse?.enabled) {
+									recordCheck(ctx, "free_trial_abuse");
+									const abuseCheck = await securityService.checkFreeTrialAbuse(visitorId);
+									if (abuseCheck.isAbuse && abuseCheck.action === "block") {
+										setOutcome(ctx, "blocked", "free_trial_abuse", {
+											accountCount: abuseCheck.accountCount,
+											maxAccounts: abuseCheck.maxAccounts
+										});
+										emitEvaluation(ctx, trackEvent);
+										throw new APIError("FORBIDDEN", { message: "Account creation is not allowed from this device." });
+									}
 								}
+								if (user.email && typeof user.email === "string" && isEmailNormalizationEnabled(opts.security)) return { data: {
+									...user,
+									email: normalizeEmail(user.email, ctx.context)
+								} };
+							},
+							async after(user, ctx) {
+								if (!ctx) return;
+								const visitorId = ctx.context.visitorId;
+								if (visitorId && opts.security?.freeTrialAbuse?.enabled) await ctx.context.runInBackgroundOrAwait(securityService.trackFreeTrialSignup(visitorId, user.id));
 							}
+						},
+						update: { async before(user, ctx) {
+							if (!ctx) return;
 							if (user.email && typeof user.email === "string" && isEmailNormalizationEnabled(opts.security)) return { data: {
 								...user,
 								email: normalizeEmail(user.email, ctx.context)
 							} };
-						},
-						async after(user, ctx) {
-							if (!ctx) return;
-							const visitorId = ctx.context.visitorId;
-							if (visitorId && opts.security?.freeTrialAbuse?.enabled) await ctx.context.runInBackgroundOrAwait(securityService.trackFreeTrialSignup(visitorId, user.id));
-						}
-					} },
+						} }
+					},
 					session: { create: {
 						async before(session, ctx) {
 							if (!ctx) return;
@@ -2122,7 +2137,7 @@ const sentinel = (options) => {
 							const identification = ctx.context.identification;
 							if (session.userId && identification?.location && visitorId) {
 								recordCheck(ctx, "impossible_travel");
-								const travelCheck = await securityService.checkImpossibleTravel(session.userId, identification.location, visitorId);
+								const travelCheck = await securityService.checkImpossibleTravel(session.userId, identification.location, visitorId, identification.ip);
 								if (travelCheck?.isImpossible) {
 									if (travelCheck.action === "block") {
 										setOutcome(ctx, "blocked", "impossible_travel", {
@@ -2201,7 +2216,7 @@ const sentinel = (options) => {
 									}
 								}
 							}
-							if (identification?.location) await ctx.context.runInBackgroundOrAwait(securityService.storeLastLocation(session.userId, identification.location));
+							if (opts.security?.impossibleTravel?.enabled && identification?.location) await ctx.context.runInBackgroundOrAwait(securityService.storeLastLocation(session.userId, identification.location, identification.ip));
 						}
 					} }
 				}
@@ -2779,7 +2794,7 @@ const jwtValidateMiddleware = (options) => {
 };
 //#endregion
 //#region src/version.ts
-const PLUGIN_VERSION = "0.2.8";
+const PLUGIN_VERSION = "0.2.10";
 //#endregion
 //#region src/routes/auth/config.ts
 const PLUGIN_OPTIONS_EXCLUDE_KEYS = { stripe: new Set(["stripeClient"]) };
@@ -3794,13 +3809,13 @@ const completeInvitation = (options) => {
 * Used by the platform to verify before sending invitation
 * This is different from /dash/organization/check-user-by-email which also checks membership
 */
-const checkUserExists = (_options) => {
+const checkUserExists = (options) => {
 	return createAuthEndpoint("/dash/check-user-exists", {
 		method: "POST",
+		use: [jwtMiddleware(options)],
 		body: z$1.object({ email: z$1.email() })
 	}, async (ctx) => {
 		const { email } = ctx.body;
-		if (!ctx.request?.headers.get("Authorization")) throw new APIError("UNAUTHORIZED", { message: "Authorization required" });
 		const normalizedEmail = normalizeEmail(email, ctx.context);
 		const existingUser = await ctx.context.internalAdapter.findUserByEmail(normalizedEmail).then((user) => user?.user);
 		return {
@@ -3810,6 +3825,23 @@ const checkUserExists = (_options) => {
 	});
 };
 //#endregion
+//#region src/routes/organizations/roles.ts
+const DEFAULT_ORG_MEMBER_ROLES = [
+	"member",
+	"admin",
+	"owner"
+];
+function getOrganizationRoleKeys(orgOptions) {
+	const roles = orgOptions?.roles;
+	if (roles && typeof roles === "object" && Object.keys(roles).length > 0) return Object.keys(roles);
+	return [...DEFAULT_ORG_MEMBER_ROLES];
+}
+const organizationMemberRoleInputSchema = z$1.string().trim().min(1, "Role is required").max(64, "Role is too long").regex(/^[a-zA-Z][a-zA-Z0-9_-]*$/, "Role must start with a letter and contain only letters, numbers, hyphens, and underscores");
+function validateOrganizationMemberRole(ctx, role, orgOptions) {
+	const allowedRoles = getOrganizationRoleKeys(orgOptions);
+	if (!allowedRoles.includes(role)) throw ctx.error("BAD_REQUEST", { message: `Invalid role. Allowed roles: ${allowedRoles.join(", ")}` });
+}
+//#endregion
 //#region src/routes/organizations/invitations.ts
 const listOrganizationInvitations = (options) => {
 	return createAuthEndpoint("/dash/organization/:id/invitations", {
@@ -3858,7 +3890,7 @@ const inviteMember = (options) => {
 		method: "POST",
 		body: z$1.object({
 			email: z$1.string(),
-			role: z$1.string(),
+			role: organizationMemberRoleInputSchema,
 			invitedBy: z$1.string()
 		}),
 		use: [jwtMiddleware(options, z$1.object({
@@ -3868,6 +3900,7 @@ const inviteMember = (options) => {
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
 		const organizationPlugin = requireOrganizationPlugin(ctx);
+		validateOrganizationMemberRole(ctx, ctx.body.role, organizationPlugin.options);
 		if (!organizationPlugin.options?.sendInvitationEmail) throw ctx.error("BAD_REQUEST", { message: "Invitation email is not enabled" });
 		const invitedBy = await ctx.context.adapter.findOne({
 			model: "user",
@@ -4117,11 +4150,12 @@ const addMember = (options) => {
 		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
 		body: z$1.object({
 			userId: z$1.string(),
-			role: z$1.string()
+			role: organizationMemberRoleInputSchema
 		})
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
 		const orgOptions = requireOrganizationPlugin(ctx).options || {};
+		validateOrganizationMemberRole(ctx, ctx.body.role, orgOptions);
 		const organization = await ctx.context.adapter.findOne({
 			model: "organization",
 			where: [{
@@ -4250,11 +4284,12 @@ const updateMemberRole = (options) => {
 		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
 		body: z$1.object({
 			memberId: z$1.string(),
-			role: z$1.string()
+			role: organizationMemberRoleInputSchema
 		})
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
 		const orgOptions = requireOrganizationPlugin(ctx).options || {};
+		validateOrganizationMemberRole(ctx, ctx.body.role, orgOptions);
 		const existingMember = await ctx.context.adapter.findOne({
 			model: "member",
 			where: [{
@@ -4411,6 +4446,121 @@ async function withConcurrency(items, fn, options) {
 	return results;
 }
 //#endregion
+//#region src/routes/organizations/schemas.ts
+const DENIED_ORG_WRITE_KEYS = new Set([
+	"id",
+	"createdAt",
+	"updatedAt"
+]);
+const CREATE_NON_PERSISTED_KEYS = new Set(["defaultTeamName"]);
+const CREATE_REQUEST_ONLY_KEYS = new Set(["userId", "skipDefaultTeam"]);
+const CORE_CREATE_KEYS = [
+	"name",
+	"slug",
+	"logo"
+];
+const CORE_UPDATE_KEYS = [
+	"name",
+	"slug",
+	"logo",
+	"metadata"
+];
+function getOrganizationAdditionalFields(orgOptions) {
+	return orgOptions?.schema?.organization?.additionalFields ?? {};
+}
+function getWritableOrganizationAdditionalFieldNames(orgOptions) {
+	const additional = getOrganizationAdditionalFields(orgOptions);
+	return Object.entries(additional).filter(([, field]) => {
+		return field.input !== false;
+	}).map(([name]) => name);
+}
+function getWritableOrganizationFieldNames(orgOptions, mode) {
+	const keys = new Set(mode === "create" ? CORE_CREATE_KEYS : CORE_UPDATE_KEYS);
+	for (const name of getWritableOrganizationAdditionalFieldNames(orgOptions)) keys.add(name);
+	return keys;
+}
+/**
+* Returns only organization fields that may be persisted on create/update.
+* Strips unknown keys, denied keys, and create-only request fields.
+*/
+function pickWritableOrganizationFields(body, orgOptions, mode) {
+	const allowed = getWritableOrganizationFieldNames(orgOptions, mode);
+	const skip = new Set([
+		...DENIED_ORG_WRITE_KEYS,
+		...mode === "create" ? CREATE_NON_PERSISTED_KEYS : [],
+		...mode === "create" ? CREATE_REQUEST_ONLY_KEYS : []
+	]);
+	const result = {};
+	for (const [key, value] of Object.entries(body)) {
+		if (skip.has(key) || !allowed.has(key) || value === void 0) continue;
+		result[key] = value;
+	}
+	return result;
+}
+const BaseCreateOrgCoreBodySchema = z$1.object({
+	name: z$1.string(),
+	slug: z$1.string(),
+	logo: z$1.string().optional(),
+	defaultTeamName: z$1.string().optional()
+});
+const BaseUpdateOrgCoreBodySchema = z$1.object({
+	logo: z$1.union([z$1.url(), z$1.literal("")]).optional(),
+	name: z$1.string().optional(),
+	slug: z$1.string().optional(),
+	metadata: z$1.string().optional()
+});
+const CreateOrganizationBodySchema = BaseCreateOrgCoreBodySchema.catchall(z$1.unknown());
+const UpdateOrganizationBodySchema = BaseUpdateOrgCoreBodySchema.catchall(z$1.unknown());
+function createSchemaForDBField(field) {
+	switch (field.type) {
+		case "number": return field.required ? z$1.coerce.number() : z$1.coerce.number().optional();
+		case "boolean": return field.required ? z$1.coerce.boolean() : z$1.coerce.boolean().optional();
+		case "date": return field.required ? z$1.union([z$1.string().min(1), z$1.coerce.date()]) : z$1.union([z$1.string(), z$1.coerce.date()]).optional();
+		default: return field.required ? z$1.string().min(1) : z$1.string().optional();
+	}
+}
+/**
+* Validates required core + configured additional fields on create.
+* Call after pickWritableOrgFields if you need required additional field checks.
+*/
+function validateWritableCreateOrganizationFields(data, options) {
+	const shape = {
+		name: z$1.string().min(1),
+		slug: z$1.string().min(1),
+		logo: z$1.string().optional()
+	};
+	const additional = getOrganizationAdditionalFields(options);
+	for (const [name, field] of Object.entries(additional)) {
+		if (field.input === false) continue;
+		shape[name] = createSchemaForDBField(field);
+	}
+	const result = z$1.object(shape).strict().safeParse(data);
+	if (!result.success) throw result.error;
+}
+/**
+* Ensures at least one field is present on update and validates additional field types.
+*/
+function validateWritableOrganizationUpdateFields(data, orgOptions) {
+	if (Object.keys(data).length === 0) throw new z$1.ZodError([{
+		code: "custom",
+		message: "No valid fields to update",
+		path: []
+	}]);
+	const shape = {
+		name: z$1.string().min(1).optional(),
+		slug: z$1.string().min(1).optional(),
+		logo: z$1.union([z$1.url(), z$1.literal("")]).optional(),
+		metadata: z$1.string().optional()
+	};
+	const additional = getOrganizationAdditionalFields(orgOptions);
+	for (const [name, field] of Object.entries(additional)) {
+		if (field.input === false) continue;
+		shape[name] = createSchemaForDBField(field);
+	}
+	const result = z$1.object(shape).partial().strict().safeParse(data);
+	if (!result.success) throw result.error;
+}
+//#endregion
 //#region src/routes/organizations/organization.ts
 const listOrganizations = (options) => {
 	return createAuthEndpoint("/dash/list-organizations", {
@@ -4729,15 +4879,11 @@ const createOrganization = (options) => {
 			userId: z$1.string(),
 			skipDefaultTeam: z$1.boolean().optional().default(false)
 		}))],
-		body: z$1.looseObject({
-			name: z$1.string(),
-			slug: z$1.string(),
-			logo: z$1.string().optional(),
-			defaultTeamName: z$1.string().optional()
-		})
+		body: CreateOrganizationBodySchema
 	}, async (ctx) => {
 		const orgOptions = requireOrganizationPlugin(ctx).options || {};
 		const { userId } = ctx.context.payload;
+		const defaultTeamName = ctx.body.defaultTeamName;
 		const user = await ctx.context.adapter.findOne({
 			model: "user",
 			where: [{
@@ -4753,10 +4899,13 @@ const createOrganization = (options) => {
 				value: ctx.body.slug
 			}]
 		}) > 0) throw ctx.error("BAD_REQUEST", { message: "Organization already exists" });
-		let orgData = {
-			...ctx.body,
-			defaultTeamName: void 0
-		};
+		let orgData = pickWritableOrganizationFields(ctx.body, orgOptions, "create");
+		try {
+			validateWritableCreateOrganizationFields(orgData, orgOptions);
+		} catch (error) {
+			if (error instanceof z$1.ZodError) throw ctx.error("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid organization data" });
+			throw error;
+		}
 		if (orgOptions.organizationCreation?.beforeCreate) {
 			const response = await orgOptions.organizationCreation.beforeCreate({
 				organization: {
@@ -4765,20 +4914,20 @@ const createOrganization = (options) => {
 				},
 				user
 			}, ctx.request);
-			if (response && typeof response === "object" && "data" in response) orgData = {
+			if (response && typeof response === "object" && "data" in response) orgData = pickWritableOrganizationFields({
 				...orgData,
 				...response.data
-			};
+			}, orgOptions, "create");
 		}
 		if (orgOptions?.organizationHooks?.beforeCreateOrganization) {
 			const response = await orgOptions?.organizationHooks.beforeCreateOrganization({
 				organization: orgData,
 				user
 			});
-			if (response && typeof response === "object" && "data" in response) orgData = {
+			if (response && typeof response === "object" && "data" in response) orgData = pickWritableOrganizationFields({
 				...orgData,
 				...response.data
-			};
+			}, orgOptions, "create");
 		}
 		const organization = await ctx.context.adapter.create({
 			model: "organization",
@@ -4827,7 +4976,7 @@ const createOrganization = (options) => {
 		if (orgOptions?.teams?.enabled && orgOptions.teams.defaultTeam?.enabled !== false && !ctx.context.payload.skipDefaultTeam) {
 			let teamData = {
 				organizationId: organization.id,
-				name: ctx.body.defaultTeamName || `${organization.name}`,
+				name: defaultTeamName || `${organization.name}`,
 				createdAt: /* @__PURE__ */ new Date()
 			};
 			if (orgOptions?.organizationHooks?.beforeCreateTeam) {
@@ -4891,12 +5040,7 @@ const updateOrganization = (options) => {
 	return createAuthEndpoint("/dash/organization/update", {
 		method: "POST",
 		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.looseObject({
-			logo: z$1.url().optional(),
-			name: z$1.string().optional(),
-			slug: z$1.string().optional(),
-			metadata: z$1.string().optional()
-		})
+		body: UpdateOrganizationBodySchema
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
 		const orgOptions = requireOrganizationPlugin(ctx).options || {};
@@ -4931,7 +5075,13 @@ const updateOrganization = (options) => {
 		const owner = owners[0];
 		const updatedByUser = Array.isArray(owner.user) ? owner.user[0] : owner.user;
 		if (!updatedByUser) throw ctx.error("NOT_FOUND", { message: "Owner user not found" });
-		let updateData = { ...ctx.body };
+		let updateData = pickWritableOrganizationFields(ctx.body, orgOptions, "update");
+		try {
+			validateWritableOrganizationUpdateFields(updateData, orgOptions);
+		} catch (error) {
+			if (error instanceof z$1.ZodError) throw ctx.error("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid organization data" });
+			throw error;
+		}
 		if (typeof updateData.metadata === "string") try {
 			updateData.metadata = updateData.metadata === "" ? void 0 : JSON.parse(updateData.metadata);
 		} catch (parseError) {
@@ -4944,10 +5094,10 @@ const updateOrganization = (options) => {
 				user: updatedByUser,
 				member: owner
 			});
-			if (response && typeof response === "object" && "data" in response) updateData = {
+			if (response && typeof response === "object" && "data" in response) updateData = pickWritableOrganizationFields({
 				...updateData,
 				...response.data
-			};
+			}, orgOptions, "update");
 		}
 		const organization = await ctx.context.adapter.update({
 			model: "organization",
@@ -5528,13 +5678,13 @@ const revokeManySessions = (options) => createAuthEndpoint("/dash/sessions/revok
 	});
 });
 //#endregion
-//#region src/validation/ssrf.ts
+//#region ../utils/dist/ip.mjs
 /**
 * SSRF (Server-Side Request Forgery) Protection
 *
-* Validates URLs before server-side fetches to block requests to private/reserved
-* networks. Covers IPv4 private ranges, IPv6 private ranges, and IPv4-mapped IPv6
-* bypass vectors.
+* IP and URL utilities to validate hostnames and URLs before server-side fetches.
+* Blocks requests to private/reserved networks. Covers IPv4 private ranges,
+* IPv6 private ranges, and IPv4-mapped IPv6 bypass vectors.
 */
 function isPrivateIPv4(a, b) {
 	if (a === 10) return true;
@@ -5543,6 +5693,24 @@ function isPrivateIPv4(a, b) {
 	if (a === 127) return true;
 	if (a === 169 && b === 254) return true;
 	if (a === 0) return true;
+	if (a === 100 && b >= 64 && b <= 127) return true;
+	return false;
+}
+/**
+* Loopback, RFC1918, link-local, CGNAT, ULA, documentation, NAT64 well-known,
+* IPv4-mapped private, unspecified, and multicast (RFC 4291 section 2.7).
+*/
+function ipv6GroupsAreNonPublic(groups) {
+	if (groups.slice(0, 7).every((g) => g === 0) && groups[7] === 1) return true;
+	if (groups.every((g) => g === 0)) return true;
+	if ((groups[0] & 65472) === 65152) return true;
+	if ((groups[0] & 65024) === 64512) return true;
+	if ((groups[0] & 65280) === 65280) return true;
+	if (groups[0] === 0 && groups[1] === 0 && groups[2] === 0 && groups[3] === 0 && groups[4] === 0 && groups[5] === 65535) return isPrivateIPv4(groups[6] >> 8 & 255, groups[6] & 255);
+	if (groups[0] === 0 && groups[1] === 0 && groups[2] === 0 && groups[3] === 0 && groups[4] === 65535 && groups[5] === 0) return isPrivateIPv4(groups[6] >> 8 & 255, groups[6] & 255);
+	if (groups[0] === 100 && groups[1] === 65435 && groups.slice(2, 6).every((g) => g === 0)) return isPrivateIPv4(groups[6] >> 8 & 255, groups[6] & 255);
+	if (groups[0] === 8193 && groups[1] === 3512) return true;
+	if (groups[0] === 256 && groups.slice(1, 4).every((g) => g === 0)) return true;
 	return false;
 }
 function parseIPv6(addr) {
@@ -5564,36 +5732,174 @@ function parseIPv6(addr) {
 	if (left.length !== 8) return null;
 	return left;
 }
+/** Returns true if the hostname resolves to a private/reserved IP or is a local hostname. */
 function isPrivateHost(hostname) {
 	if (hostname === "localhost" || hostname.endsWith(".local") || hostname.endsWith(".internal")) return true;
 	const bare = hostname.replace(/^\[|\]$/g, "");
 	const v4parts = bare.split(".").map(Number);
 	if (v4parts.length === 4 && v4parts.every((p) => !isNaN(p) && p >= 0 && p <= 255)) return isPrivateIPv4(v4parts[0], v4parts[1]);
 	const groups = parseIPv6(bare);
-	if (groups && groups.length === 8) {
-		if (groups.slice(0, 7).every((g) => g === 0) && groups[7] === 1) return true;
-		if (groups.every((g) => g === 0)) return true;
-		if ((groups[0] & 65472) === 65152) return true;
-		if ((groups[0] & 65024) === 64512) return true;
-		if (groups[0] === 0 && groups[1] === 0 && groups[2] === 0 && groups[3] === 0 && groups[4] === 0 && groups[5] === 65535) return isPrivateIPv4(groups[6] >> 8 & 255, groups[6] & 255);
-		if (groups[0] === 0 && groups[1] === 0 && groups[2] === 0 && groups[3] === 0 && groups[4] === 65535 && groups[5] === 0) return isPrivateIPv4(groups[6] >> 8 & 255, groups[6] & 255);
-		if (groups[0] === 100 && groups[1] === 65435 && groups.slice(2, 6).every((g) => g === 0)) return isPrivateIPv4(groups[6] >> 8 & 255, groups[6] & 255);
-		if (groups[0] === 8193 && groups[1] === 3512) return true;
-		if (groups[0] === 256 && groups.slice(1, 4).every((g) => g === 0)) return true;
-	}
+	if (groups && groups.length === 8) return ipv6GroupsAreNonPublic(groups);
 	return false;
 }
-function parseAndValidateUrl(url) {
+//#endregion
+//#region ../utils/dist/url.mjs
+/**
+* URL helpers: normalization, SSRF-safe parsing/validation, and path/query segments.
+*/
+const HTTP_PROTOCOLS = ["http:", "https:"];
+function isAllowedProtocol(protocol, allowedProtocols) {
+	return (allowedProtocols?.length ? allowedProtocols : HTTP_PROTOCOLS).includes(protocol);
+}
+function toAllowedOriginSet(allowedOrigins) {
+	const set = /* @__PURE__ */ new Set();
+	for (const raw of allowedOrigins) try {
+		const parsed = new URL(raw.trim());
+		if (isAllowedProtocol(parsed.protocol, HTTP_PROTOCOLS)) set.add(parsed.origin);
+	} catch {}
+	return set;
+}
+function isAllowedOrigin(origin, allowedOrigins) {
+	if (!allowedOrigins.length) return false;
+	return toAllowedOriginSet(allowedOrigins).has(origin);
+}
+async function resolveHostnameAddresses(hostname) {
+	try {
+		const dns = await import("node:dns").catch((e) => {
+			console.warn("Failed to load node:dns for DNS resolution", e);
+			return null;
+		});
+		if (!dns?.promises?.resolve) return null;
+		return await dns.promises.resolve(hostname);
+	} catch {
+		return null;
+	}
+}
+function validateUrlSync(rawUrl, options = {}) {
+	const trimmed = rawUrl.trim();
+	let parsed;
+	try {
+		parsed = new URL(trimmed);
+	} catch {
+		return {
+			ok: false,
+			reason: "invalid_url",
+			url: trimmed
+		};
+	}
+	if (!isAllowedProtocol(parsed.protocol, options.allowedProtocols)) return {
+		ok: false,
+		reason: "disallowed_protocol",
+		url: trimmed,
+		protocol: parsed.protocol
+	};
+	if (parsed.username !== "" || parsed.password !== "") return {
+		ok: false,
+		reason: "embedded_credentials",
+		url: trimmed
+	};
+	if (isPrivateHost(parsed.hostname)) return {
+		ok: false,
+		reason: "private_host",
+		url: trimmed
+	};
+	if (options.allowedOrigins?.length) {
+		if (!isAllowedOrigin(parsed.origin, options.allowedOrigins)) return {
+			ok: false,
+			reason: "disallowed_origin",
+			url: trimmed,
+			hostname: parsed.hostname,
+			origin: parsed.origin
+		};
+	}
+	return {
+		ok: true,
+		url: parsed
+	};
+}
+/** SSRF checks with DNS resolution when available. */
+async function validateUrl(rawUrl, options = {}) {
+	const sync = validateUrlSync(rawUrl, options);
+	if (!sync.ok) return sync;
+	if (options.dns === false) return sync;
+	const addresses = await resolveHostnameAddresses(sync.url.hostname);
+	if (addresses) {
+		for (const addr of addresses) if (isPrivateHost(addr)) return {
+			ok: false,
+			reason: "private_dns",
+			url: sync.url.href,
+			hostname: sync.url.hostname,
+			address: addr
+		};
+	}
+	return sync;
+}
+function safeResolveUrl(raw, baseURL) {
+	const trim = raw.trim();
+	if (!trim) return null;
+	if (trim.startsWith("//") || trim.includes("\\")) return null;
+	if (/[\u0000-\u001F\u007F]/.test(trim)) return null;
 	try {
-		const parsed = new URL(url);
-		if (!["http:", "https:"].includes(parsed.protocol)) return null;
-		if (isPrivateHost(parsed.hostname)) return null;
-		return parsed;
+		if (trim.startsWith("/")) return new URL(trim, baseURL);
+		return new URL(trim);
 	} catch {
 		return null;
 	}
 }
 //#endregion
+//#region src/validation/ssrf.ts
+/**
+* SSRF protection for dash plugin outbound fetches.
+*
+* Uses @infra/utils at build time; tsdown bundles it into published dist so
+* consumers do not install the private workspace package.
+*/
+const REDIRECT_STATUSES = new Set([
+	301,
+	302,
+	303,
+	307,
+	308
+]);
+const MAX_REDIRECTS = 10;
+var SsrfBlockedError = class extends Error {
+	name = "SsrfBlockedError";
+};
+function isSsrfBlockedError(error) {
+	return error instanceof SsrfBlockedError;
+}
+/** Validates URL hostname literals and resolved DNS addresses. */
+async function parseAndValidateUrl(url) {
+	const result = await validateUrl(url);
+	return result.ok ? result.url : null;
+}
+/**
+* Fetch with SSRF checks on the initial URL and every redirect target.
+*/
+async function $outbound(url, options = {}) {
+	const { timeout, signal: callerSignal, ...fetchInit } = options;
+	let currentUrl = url;
+	for (let hop = 0;; hop++) {
+		const validated = await parseAndValidateUrl(currentUrl);
+		if (!validated) throw new SsrfBlockedError("Invalid or blocked URL");
+		const signals = [];
+		if (callerSignal) signals.push(callerSignal);
+		if (timeout !== void 0 && timeout > 0) signals.push(AbortSignal.timeout(timeout));
+		const response = await fetch(validated.href, {
+			...fetchInit,
+			redirect: "manual",
+			signal: signals.length === 0 ? void 0 : signals.length === 1 ? signals[0] : AbortSignal.any(signals)
+		});
+		if (!REDIRECT_STATUSES.has(response.status)) return response;
+		if (hop >= MAX_REDIRECTS) throw new SsrfBlockedError("Too many redirects");
+		await response.body?.cancel().catch(() => {});
+		const location = response.headers.get("location");
+		const next = location ? safeResolveUrl(location, validated.href) : null;
+		if (!next) throw new SsrfBlockedError("Invalid redirect location");
+		currentUrl = next.href;
+	}
+}
+//#endregion
 //#region src/routes/plugin-session.ts
 /**
 * Builds an in-memory session context for calling plugin endpoints
@@ -5706,13 +6012,19 @@ const oidcConfigSchema = z$1.object({
 async function resolveSAMLConfig(samlConfig, providerId, baseURL, ctx) {
 	let idpMetadataXml = samlConfig.idpMetadata?.metadata;
 	if (!idpMetadataXml && samlConfig.idpMetadata?.metadataUrl) {
-		const validatedMetadataUrl = parseAndValidateUrl(samlConfig.idpMetadata.metadataUrl);
+		const validatedMetadataUrl = await parseAndValidateUrl(samlConfig.idpMetadata.metadataUrl);
 		if (!validatedMetadataUrl) throw ctx.error("BAD_REQUEST", { message: "Invalid or blocked IdP metadata URL" });
 		try {
-			const metadataResponse = await fetch(validatedMetadataUrl.toString());
+			const metadataResponse = await $outbound(validatedMetadataUrl.href, {
+				method: "GET",
+				headers: { Accept: "application/xml, text/xml" },
+				timeout: 15e3
+			});
 			if (!metadataResponse.ok) throw ctx.error("BAD_REQUEST", { message: `Failed to fetch IdP metadata from URL: ${metadataResponse.status} ${metadataResponse.statusText}` });
 			idpMetadataXml = await metadataResponse.text();
 		} catch (e) {
+			if (isSsrfBlockedError(e)) throw ctx.error("BAD_REQUEST", { message: "Invalid or blocked IdP metadata URL" });
+			if (e instanceof APIError$1) throw e;
 			ctx.context.logger.error("[Dash] Failed to fetch IdP metadata from URL:", e);
 			throw ctx.error("BAD_REQUEST", { message: "Failed to fetch IdP metadata from URL" });
 		}