@caffeinebounce/identity 0.12.1 → 0.12.2

package/dist/index.d.mts

@@ -241,6 +241,10 @@ interface ConsentItem {
     errorMessage?: string;
 }
 interface SignupFormProps extends AuthFormConfig {
+    /** Optional heading override for the sign-up form */
+    title?: string;
+    /** Optional initial value for the email field */
+    initialEmail?: string;
     /** Navigation links configuration */
     links?: AuthLinks;
     /** Image component to use (e.g., Next.js Image) */
@@ -283,7 +287,7 @@ interface SignupFormProps extends AuthFormConfig {
 /**
  * SignupForm - Configurable sign-up form with email/password and OAuth support
  */
-declare function SignupForm({ createClient, logo, appName, termsUrl, privacyUrl, links, ImageComponent, LinkComponent, oauthProviders, googleComingSoon, azureComingSoon, oauthIconMonochromeOnHover, className, onAuthEvent, consentItems, consentPosition, consentSize, showHomeLink, showLogo, }: SignupFormProps): react_jsx_runtime.JSX.Element;
+declare function SignupForm({ createClient, logo, appName, title, initialEmail, termsUrl, privacyUrl, links, ImageComponent, LinkComponent, oauthProviders, googleComingSoon, azureComingSoon, oauthIconMonochromeOnHover, className, onAuthEvent, consentItems, consentPosition, consentSize, showHomeLink, showLogo, }: SignupFormProps): react_jsx_runtime.JSX.Element;
 
 /**
  * MFA event logging callbacks

package/dist/index.d.ts

@@ -241,6 +241,10 @@ interface ConsentItem {
     errorMessage?: string;
 }
 interface SignupFormProps extends AuthFormConfig {
+    /** Optional heading override for the sign-up form */
+    title?: string;
+    /** Optional initial value for the email field */
+    initialEmail?: string;
     /** Navigation links configuration */
     links?: AuthLinks;
     /** Image component to use (e.g., Next.js Image) */
@@ -283,7 +287,7 @@ interface SignupFormProps extends AuthFormConfig {
 /**
  * SignupForm - Configurable sign-up form with email/password and OAuth support
  */
-declare function SignupForm({ createClient, logo, appName, termsUrl, privacyUrl, links, ImageComponent, LinkComponent, oauthProviders, googleComingSoon, azureComingSoon, oauthIconMonochromeOnHover, className, onAuthEvent, consentItems, consentPosition, consentSize, showHomeLink, showLogo, }: SignupFormProps): react_jsx_runtime.JSX.Element;
+declare function SignupForm({ createClient, logo, appName, title, initialEmail, termsUrl, privacyUrl, links, ImageComponent, LinkComponent, oauthProviders, googleComingSoon, azureComingSoon, oauthIconMonochromeOnHover, className, onAuthEvent, consentItems, consentPosition, consentSize, showHomeLink, showLogo, }: SignupFormProps): react_jsx_runtime.JSX.Element;
 
 /**
  * MFA event logging callbacks

package/dist/index.js

@@ -19,6 +19,17 @@ function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 var isEmail__default = /*#__PURE__*/_interopDefault(isEmail);
 
 // src/components/auth/EmailVerificationPending.tsx
+
+// src/types.ts
+var defaultAuthLinks = {
+  signIn: "/signin",
+  signUp: "/signup",
+  forgotPassword: "/forgot-password",
+  resetPassword: "/reset-password",
+  callback: "/callback",
+  home: "/",
+  defaultRedirect: "/dashboard"
+};
 function AuthFormLayout({
   children,
   footer,
@@ -55,6 +66,122 @@ function AuthFormLayout({
     ] }) })
   ] });
 }
+
+// src/utils/redirect.ts
+var INTERNAL_REDIRECT_BASE = new URL("https://identity.invalid");
+var ENCODED_PATH_SEPARATOR = /%(?:2f|5c)/i;
+function hasControlCharacter(value) {
+  return Array.from(value).some((character) => {
+    const code = character.charCodeAt(0);
+    return code <= 31 || code === 127;
+  });
+}
+function isStrictInternalRedirect(candidate) {
+  if (!candidate?.startsWith("/") || hasControlCharacter(candidate)) {
+    return false;
+  }
+  const pathEnd = candidate.search(/[?#]/);
+  const pathname = pathEnd === -1 ? candidate : candidate.slice(0, pathEnd);
+  if (pathname.includes("\\") || ENCODED_PATH_SEPARATOR.test(pathname)) {
+    return false;
+  }
+  try {
+    const target = new URL(candidate, INTERNAL_REDIRECT_BASE);
+    return target.origin === INTERNAL_REDIRECT_BASE.origin;
+  } catch {
+    return false;
+  }
+}
+function getSafeInternalRedirect(candidate, fallback) {
+  if (isStrictInternalRedirect(candidate)) {
+    return candidate;
+  }
+  if (fallback === null) {
+    return null;
+  }
+  return isStrictInternalRedirect(fallback) ? fallback : "/";
+}
+
+// src/components/auth/utils.ts
+var warnedSupabaseRedirectOrigins = /* @__PURE__ */ new Set();
+function hardRedirect(redirectTo) {
+  window.location.href = redirectTo;
+}
+function sanitizeAuthError(message) {
+  const lowerMessage = message.toLowerCase();
+  if (lowerMessage.includes("user already registered") || lowerMessage.includes("already registered") || lowerMessage.includes("already exists") || lowerMessage.includes("email already") || lowerMessage.includes("duplicate")) {
+    return "An account with this email already exists. Please sign in instead.";
+  }
+  if (lowerMessage.includes("invalid login credentials") || lowerMessage.includes("invalid credentials") || lowerMessage.includes("wrong password") || lowerMessage.includes("incorrect password")) {
+    return "Invalid email or password. Please try again.";
+  }
+  if (lowerMessage.includes("invalid email") || lowerMessage.includes("password")) {
+    return message;
+  }
+  if (message === "The string did not match the expected pattern.") {
+    return "Please check your email address format and try again.";
+  }
+  if (lowerMessage.includes("rate limit") || lowerMessage.includes("too many requests") || lowerMessage.includes("try again later")) {
+    return "Too many attempts. Please wait a moment and try again.";
+  }
+  if (lowerMessage.includes("hook") || lowerMessage.includes("authorization") || lowerMessage.includes("token") || lowerMessage.includes("internal") || lowerMessage.includes("server") || lowerMessage.includes("database") || lowerMessage.includes("connection")) {
+    return "An error occurred. Please try again.";
+  }
+  return "An error occurred. Please try again.";
+}
+function sanitizeSignupError(message) {
+  const sanitized = sanitizeAuthError(message);
+  if (sanitized === "An error occurred. Please try again.") {
+    return "An error occurred during sign up. Please try again.";
+  }
+  return sanitized;
+}
+function buildOAuthRedirectTo(origin, nextPath) {
+  const siteUrl = origin.replace(/\/$/, "");
+  return `${siteUrl}/callback?next=${encodeURIComponent(nextPath)}`;
+}
+function buildOAuthSignInOptions(provider, redirectTo, options = {}) {
+  return {
+    redirectTo,
+    ...provider === "azure" ? { scopes: "email" } : {},
+    ...options
+  };
+}
+function warnAboutSupabaseRedirectAllowlist(origin) {
+  const normalizedOrigin = origin.replace(/\/$/, "");
+  let hostname = "";
+  try {
+    hostname = new URL(normalizedOrigin).host;
+  } catch {
+    return;
+  }
+  if (!sharedUtils.isPreviewEnvironment(hostname)) {
+    return;
+  }
+  if (warnedSupabaseRedirectOrigins.has(normalizedOrigin)) {
+    return;
+  }
+  warnedSupabaseRedirectOrigins.add(normalizedOrigin);
+  console.warn(
+    `[identity] Supabase redirect allowlist reminder: add "${normalizedOrigin}/**" to Supabase Auth > URL Configuration > Additional Redirect URLs. The auth components already use the active origin for callbacks, but Supabase must allow that origin too or OAuth/email flows can bounce to another host.`
+  );
+}
+function clearStalePKCEState() {
+  if (typeof window === "undefined") return;
+  try {
+    const keysToRemove = [];
+    for (let i = 0; i < localStorage.length; i++) {
+      const key = localStorage.key(i);
+      if (key?.includes("-code-verifier")) {
+        keysToRemove.push(key);
+      }
+    }
+    for (const key of keysToRemove) {
+      localStorage.removeItem(key);
+    }
+  } catch {
+  }
+}
 var POLL_INTERVAL_MS = 6e4;
 var MAX_POLL_COUNT = 60;
 function EmailVerificationPending({
@@ -125,9 +252,19 @@ function EmailVerificationPending({
     setResendStatus("sending");
     try {
       const supabase = createClient();
+      const safeRedirectTo = getSafeInternalRedirect(
+        redirectTo,
+        defaultAuthLinks.defaultRedirect
+      );
       const { error } = await supabase.auth.resend({
         type: "signup",
-        email
+        email,
+        options: {
+          emailRedirectTo: buildOAuthRedirectTo(
+            window.location.origin,
+            safeRedirectTo
+          )
+        }
       });
       if (error) {
         setResendStatus("error");
@@ -247,17 +384,6 @@ function EmailVerificationPending({
     }
   );
 }
-
-// src/types.ts
-var defaultAuthLinks = {
-  signIn: "/signin",
-  signUp: "/signup",
-  forgotPassword: "/forgot-password",
-  resetPassword: "/reset-password",
-  callback: "/callback",
-  home: "/",
-  defaultRedirect: "/dashboard"
-};
 function AuthHeader({
   logo,
   title,
@@ -279,82 +405,6 @@ function AuthHeader({
     /* @__PURE__ */ jsxRuntime.jsx("h1", { className: "text-2xl font-semibold tracking-tight text-foreground", children: title })
   ] });
 }
-var warnedSupabaseRedirectOrigins = /* @__PURE__ */ new Set();
-function sanitizeAuthError(message) {
-  const lowerMessage = message.toLowerCase();
-  if (lowerMessage.includes("user already registered") || lowerMessage.includes("already registered") || lowerMessage.includes("already exists") || lowerMessage.includes("email already") || lowerMessage.includes("duplicate")) {
-    return "An account with this email already exists. Please sign in instead.";
-  }
-  if (lowerMessage.includes("invalid login credentials") || lowerMessage.includes("invalid credentials") || lowerMessage.includes("wrong password") || lowerMessage.includes("incorrect password")) {
-    return "Invalid email or password. Please try again.";
-  }
-  if (lowerMessage.includes("invalid email") || lowerMessage.includes("password")) {
-    return message;
-  }
-  if (message === "The string did not match the expected pattern.") {
-    return "Please check your email address format and try again.";
-  }
-  if (lowerMessage.includes("rate limit") || lowerMessage.includes("too many requests") || lowerMessage.includes("try again later")) {
-    return "Too many attempts. Please wait a moment and try again.";
-  }
-  if (lowerMessage.includes("hook") || lowerMessage.includes("authorization") || lowerMessage.includes("token") || lowerMessage.includes("internal") || lowerMessage.includes("server") || lowerMessage.includes("database") || lowerMessage.includes("connection")) {
-    return "An error occurred. Please try again.";
-  }
-  return "An error occurred. Please try again.";
-}
-function sanitizeSignupError(message) {
-  const sanitized = sanitizeAuthError(message);
-  if (sanitized === "An error occurred. Please try again.") {
-    return "An error occurred during sign up. Please try again.";
-  }
-  return sanitized;
-}
-function buildOAuthRedirectTo(origin, nextPath) {
-  const siteUrl = origin.replace(/\/$/, "");
-  return `${siteUrl}/callback?next=${encodeURIComponent(nextPath)}`;
-}
-function buildOAuthSignInOptions(provider, redirectTo, options = {}) {
-  return {
-    redirectTo,
-    ...provider === "azure" ? { scopes: "email" } : {},
-    ...options
-  };
-}
-function warnAboutSupabaseRedirectAllowlist(origin) {
-  const normalizedOrigin = origin.replace(/\/$/, "");
-  let hostname = "";
-  try {
-    hostname = new URL(normalizedOrigin).host;
-  } catch {
-    return;
-  }
-  if (!sharedUtils.isPreviewEnvironment(hostname)) {
-    return;
-  }
-  if (warnedSupabaseRedirectOrigins.has(normalizedOrigin)) {
-    return;
-  }
-  warnedSupabaseRedirectOrigins.add(normalizedOrigin);
-  console.warn(
-    `[identity] Supabase redirect allowlist reminder: add "${normalizedOrigin}/**" to Supabase Auth > URL Configuration > Additional Redirect URLs. The auth components already use the active origin for callbacks, but Supabase must allow that origin too or OAuth/email flows can bounce to another host.`
-  );
-}
-function clearStalePKCEState() {
-  if (typeof window === "undefined") return;
-  try {
-    const keysToRemove = [];
-    for (let i = 0; i < localStorage.length; i++) {
-      const key = localStorage.key(i);
-      if (key?.includes("-code-verifier")) {
-        keysToRemove.push(key);
-      }
-    }
-    for (const key of keysToRemove) {
-      localStorage.removeItem(key);
-    }
-  } catch {
-  }
-}
 function ForgotPasswordForm({
   createClient,
   logo,
@@ -1095,7 +1145,14 @@ function SigninForm({
   const oauthTimeoutRef = react.useRef(null);
   const router = navigation.useRouter();
   const searchParams = navigation.useSearchParams();
-  const redirectTo = searchParams.get("redirect") || mergedLinks.defaultRedirect;
+  const defaultRedirect = getSafeInternalRedirect(
+    mergedLinks.defaultRedirect,
+    defaultAuthLinks.defaultRedirect
+  );
+  const redirectTo = getSafeInternalRedirect(
+    searchParams.get("redirect"),
+    defaultRedirect
+  );
   const message = searchParams.get("message");
   const mfaRequired = searchParams.get("mfa") === "required";
   const [showMFA, setShowMFA] = react.useState(mfaRequired);
@@ -1267,7 +1324,7 @@ function SigninForm({
       } else {
         onAuthEvent?.onSignInSuccess?.(userId, email.trim(), false);
         recordSignIn("email", email.trim());
-        window.location.href = redirectTo;
+        hardRedirect(redirectTo);
       }
     } catch (err) {
       logError(err, {
@@ -1427,10 +1484,13 @@ function SigninForm({
     }
   );
 }
+var EMPTY_CONSENT_ITEMS = [];
 function SignupForm({
   createClient,
   logo,
   appName = "your account",
+  title,
+  initialEmail = "",
   termsUrl = "/terms",
   privacyUrl = "/privacy",
   links = {},
@@ -1442,7 +1502,7 @@ function SignupForm({
   oauthIconMonochromeOnHover = false,
   className,
   onAuthEvent,
-  consentItems = [],
+  consentItems = EMPTY_CONSENT_ITEMS,
   consentPosition = "above",
   consentSize = "default",
   showHomeLink = true,
@@ -1452,7 +1512,11 @@ function SignupForm({
   const Link = LinkComponent;
   const Image = ImageComponent;
   const router = navigation.useRouter();
-  const [email, setEmail] = react.useState("");
+  const redirectTo = getSafeInternalRedirect(
+    mergedLinks.defaultRedirect,
+    defaultAuthLinks.defaultRedirect
+  );
+  const [email, setEmail] = react.useState(initialEmail);
   const [emailTouched, setEmailTouched] = react.useState(false);
   const [password, setPassword] = react.useState("");
   const [confirmPassword, setConfirmPassword] = react.useState("");
@@ -1517,7 +1581,7 @@ function SignupForm({
       provider,
       options: buildOAuthSignInOptions(
         provider,
-        buildOAuthRedirectTo(siteUrl, mergedLinks.defaultRedirect)
+        buildOAuthRedirectTo(siteUrl, redirectTo)
       )
     });
     if (error) {
@@ -1552,7 +1616,7 @@ function SignupForm({
       email: email.trim(),
       password,
       options: {
-        emailRedirectTo: `${siteUrl}/callback`,
+        emailRedirectTo: buildOAuthRedirectTo(siteUrl, redirectTo),
         // Pass all consent values as user metadata
         data: consentState
       }
@@ -1570,7 +1634,7 @@ function SignupForm({
     } else if (data.user) {
       const userId = data.user.id;
       onAuthEvent?.onSignUpSuccess?.(userId, email.trim());
-      router.push(mergedLinks.defaultRedirect);
+      router.push(redirectTo);
       router.refresh();
     } else {
       onAuthEvent?.onSignUpFailure?.(email.trim(), "no_user_data_in_response");
@@ -1586,7 +1650,7 @@ function SignupForm({
         logo,
         ImageComponent: Image,
         createClient,
-        redirectTo: mergedLinks.home,
+        redirectTo,
         className
       }
     );
@@ -1608,7 +1672,7 @@ function SignupForm({
             AuthHeader,
             {
               logo: showLogo !== false ? logo : void 0,
-              title: `Sign up for ${appName}`,
+              title: title ?? `Sign up for ${appName}`,
               ImageComponent: Image
             }
           ),
@@ -5535,12 +5599,6 @@ var EMAIL_OTP_TYPES = [
   "email_change",
   "email"
 ];
-function getSafeRedirectPath(candidate, fallback) {
-  if (candidate?.startsWith("/") && !candidate.startsWith("//")) {
-    return candidate;
-  }
-  return fallback;
-}
 function getEmailOtpType(value) {
   if (!value) {
     return null;
@@ -5631,8 +5689,9 @@ function createRedirectResponse(target, origin) {
   if (target instanceof URL) {
     return server.NextResponse.redirect(target.toString());
   }
-  if (target.startsWith("/") && !target.startsWith("//")) {
-    return server.NextResponse.redirect(`${origin}${target}`);
+  const safeTarget = getSafeInternalRedirect(target, null);
+  if (safeTarget) {
+    return server.NextResponse.redirect(`${origin}${safeTarget}`);
   }
   return null;
 }
@@ -5694,15 +5753,20 @@ function createAuthCallbackHandler({
   isLinkingFlow = isDefaultLinkingFlow,
   resolveLinkingErrorMessage
 }) {
+  const safeDefaultRedirect = getSafeInternalRedirect(
+    defaultRedirect,
+    "/dashboard"
+  );
+  const safeSignInPath = getSafeInternalRedirect(signInPath, "/signin");
   return async function GET(request) {
     const requestUrl = new URL(request.url);
     const code = requestUrl.searchParams.get("code");
     const tokenHash = requestUrl.searchParams.get("token_hash");
     const rawOtpType = requestUrl.searchParams.get("type");
     const otpType = getEmailOtpType(rawOtpType);
-    const next = getSafeRedirectPath(
+    const next = getSafeInternalRedirect(
       requestUrl.searchParams.get("next") ?? requestUrl.searchParams.get("redirect_to"),
-      defaultRedirect
+      safeDefaultRedirect
     );
     const origin = requestUrl.origin;
     const error = requestUrl.searchParams.get("error");
@@ -5724,7 +5788,7 @@ function createAuthCallbackHandler({
         return linkingErrorRedirect;
       }
       return server.NextResponse.redirect(
-        `${origin}${signInPath}?error=${encodeURIComponent(message)}`
+        `${origin}${safeSignInPath}?error=${encodeURIComponent(message)}`
       );
     }
     if (code) {
@@ -5739,7 +5803,7 @@ function createAuthCallbackHandler({
           flow: "oauth",
           postAuthHook,
           postAuthHookErrorMode,
-          signInPath,
+          signInPath: safeSignInPath,
           resolveSuccessRedirect
         });
       }
@@ -5759,13 +5823,13 @@ function createAuthCallbackHandler({
         return linkingErrorRedirect;
       }
       return server.NextResponse.redirect(
-        `${origin}${signInPath}?error=${encodeURIComponent(errorMessage)}`
+        `${origin}${safeSignInPath}?error=${encodeURIComponent(errorMessage)}`
       );
     }
     if (tokenHash || rawOtpType) {
       if (!tokenHash || !otpType) {
         return server.NextResponse.redirect(
-          `${origin}${signInPath}?error=${encodeURIComponent("Invalid verification link")}`
+          `${origin}${safeSignInPath}?error=${encodeURIComponent("Invalid verification link")}`
         );
       }
       const supabase = await createClient();
@@ -5783,16 +5847,16 @@ function createAuthCallbackHandler({
           otpType,
           postAuthHook,
           postAuthHookErrorMode,
-          signInPath,
+          signInPath: safeSignInPath,
           resolveSuccessRedirect
         });
       }
       return server.NextResponse.redirect(
-        `${origin}${signInPath}?error=${encodeURIComponent(verifyError.message)}`
+        `${origin}${safeSignInPath}?error=${encodeURIComponent(verifyError.message)}`
       );
     }
     return server.NextResponse.redirect(
-      `${origin}${signInPath}?error=No authorization code received`
+      `${origin}${safeSignInPath}?error=No authorization code received`
     );
   };
 }

package/dist/index.mjs

@@ -14,6 +14,17 @@ import { REGEXP_ONLY_DIGITS } from 'input-otp';
 import { NextResponse } from 'next/server';
 
 // src/components/auth/EmailVerificationPending.tsx
+
+// src/types.ts
+var defaultAuthLinks = {
+  signIn: "/signin",
+  signUp: "/signup",
+  forgotPassword: "/forgot-password",
+  resetPassword: "/reset-password",
+  callback: "/callback",
+  home: "/",
+  defaultRedirect: "/dashboard"
+};
 function AuthFormLayout({
   children,
   footer,
@@ -50,6 +61,122 @@ function AuthFormLayout({
     ] }) })
   ] });
 }
+
+// src/utils/redirect.ts
+var INTERNAL_REDIRECT_BASE = new URL("https://identity.invalid");
+var ENCODED_PATH_SEPARATOR = /%(?:2f|5c)/i;
+function hasControlCharacter(value) {
+  return Array.from(value).some((character) => {
+    const code = character.charCodeAt(0);
+    return code <= 31 || code === 127;
+  });
+}
+function isStrictInternalRedirect(candidate) {
+  if (!candidate?.startsWith("/") || hasControlCharacter(candidate)) {
+    return false;
+  }
+  const pathEnd = candidate.search(/[?#]/);
+  const pathname = pathEnd === -1 ? candidate : candidate.slice(0, pathEnd);
+  if (pathname.includes("\\") || ENCODED_PATH_SEPARATOR.test(pathname)) {
+    return false;
+  }
+  try {
+    const target = new URL(candidate, INTERNAL_REDIRECT_BASE);
+    return target.origin === INTERNAL_REDIRECT_BASE.origin;
+  } catch {
+    return false;
+  }
+}
+function getSafeInternalRedirect(candidate, fallback) {
+  if (isStrictInternalRedirect(candidate)) {
+    return candidate;
+  }
+  if (fallback === null) {
+    return null;
+  }
+  return isStrictInternalRedirect(fallback) ? fallback : "/";
+}
+
+// src/components/auth/utils.ts
+var warnedSupabaseRedirectOrigins = /* @__PURE__ */ new Set();
+function hardRedirect(redirectTo) {
+  window.location.href = redirectTo;
+}
+function sanitizeAuthError(message) {
+  const lowerMessage = message.toLowerCase();
+  if (lowerMessage.includes("user already registered") || lowerMessage.includes("already registered") || lowerMessage.includes("already exists") || lowerMessage.includes("email already") || lowerMessage.includes("duplicate")) {
+    return "An account with this email already exists. Please sign in instead.";
+  }
+  if (lowerMessage.includes("invalid login credentials") || lowerMessage.includes("invalid credentials") || lowerMessage.includes("wrong password") || lowerMessage.includes("incorrect password")) {
+    return "Invalid email or password. Please try again.";
+  }
+  if (lowerMessage.includes("invalid email") || lowerMessage.includes("password")) {
+    return message;
+  }
+  if (message === "The string did not match the expected pattern.") {
+    return "Please check your email address format and try again.";
+  }
+  if (lowerMessage.includes("rate limit") || lowerMessage.includes("too many requests") || lowerMessage.includes("try again later")) {
+    return "Too many attempts. Please wait a moment and try again.";
+  }
+  if (lowerMessage.includes("hook") || lowerMessage.includes("authorization") || lowerMessage.includes("token") || lowerMessage.includes("internal") || lowerMessage.includes("server") || lowerMessage.includes("database") || lowerMessage.includes("connection")) {
+    return "An error occurred. Please try again.";
+  }
+  return "An error occurred. Please try again.";
+}
+function sanitizeSignupError(message) {
+  const sanitized = sanitizeAuthError(message);
+  if (sanitized === "An error occurred. Please try again.") {
+    return "An error occurred during sign up. Please try again.";
+  }
+  return sanitized;
+}
+function buildOAuthRedirectTo(origin, nextPath) {
+  const siteUrl = origin.replace(/\/$/, "");
+  return `${siteUrl}/callback?next=${encodeURIComponent(nextPath)}`;
+}
+function buildOAuthSignInOptions(provider, redirectTo, options = {}) {
+  return {
+    redirectTo,
+    ...provider === "azure" ? { scopes: "email" } : {},
+    ...options
+  };
+}
+function warnAboutSupabaseRedirectAllowlist(origin) {
+  const normalizedOrigin = origin.replace(/\/$/, "");
+  let hostname = "";
+  try {
+    hostname = new URL(normalizedOrigin).host;
+  } catch {
+    return;
+  }
+  if (!isPreviewEnvironment(hostname)) {
+    return;
+  }
+  if (warnedSupabaseRedirectOrigins.has(normalizedOrigin)) {
+    return;
+  }
+  warnedSupabaseRedirectOrigins.add(normalizedOrigin);
+  console.warn(
+    `[identity] Supabase redirect allowlist reminder: add "${normalizedOrigin}/**" to Supabase Auth > URL Configuration > Additional Redirect URLs. The auth components already use the active origin for callbacks, but Supabase must allow that origin too or OAuth/email flows can bounce to another host.`
+  );
+}
+function clearStalePKCEState() {
+  if (typeof window === "undefined") return;
+  try {
+    const keysToRemove = [];
+    for (let i = 0; i < localStorage.length; i++) {
+      const key = localStorage.key(i);
+      if (key?.includes("-code-verifier")) {
+        keysToRemove.push(key);
+      }
+    }
+    for (const key of keysToRemove) {
+      localStorage.removeItem(key);
+    }
+  } catch {
+  }
+}
 var POLL_INTERVAL_MS = 6e4;
 var MAX_POLL_COUNT = 60;
 function EmailVerificationPending({
@@ -120,9 +247,19 @@ function EmailVerificationPending({
     setResendStatus("sending");
     try {
       const supabase = createClient();
+      const safeRedirectTo = getSafeInternalRedirect(
+        redirectTo,
+        defaultAuthLinks.defaultRedirect
+      );
       const { error } = await supabase.auth.resend({
         type: "signup",
-        email
+        email,
+        options: {
+          emailRedirectTo: buildOAuthRedirectTo(
+            window.location.origin,
+            safeRedirectTo
+          )
+        }
       });
       if (error) {
         setResendStatus("error");
@@ -242,17 +379,6 @@ function EmailVerificationPending({
     }
   );
 }
-
-// src/types.ts
-var defaultAuthLinks = {
-  signIn: "/signin",
-  signUp: "/signup",
-  forgotPassword: "/forgot-password",
-  resetPassword: "/reset-password",
-  callback: "/callback",
-  home: "/",
-  defaultRedirect: "/dashboard"
-};
 function AuthHeader({
   logo,
   title,
@@ -274,82 +400,6 @@ function AuthHeader({
     /* @__PURE__ */ jsx("h1", { className: "text-2xl font-semibold tracking-tight text-foreground", children: title })
   ] });
 }
-var warnedSupabaseRedirectOrigins = /* @__PURE__ */ new Set();
-function sanitizeAuthError(message) {
-  const lowerMessage = message.toLowerCase();
-  if (lowerMessage.includes("user already registered") || lowerMessage.includes("already registered") || lowerMessage.includes("already exists") || lowerMessage.includes("email already") || lowerMessage.includes("duplicate")) {
-    return "An account with this email already exists. Please sign in instead.";
-  }
-  if (lowerMessage.includes("invalid login credentials") || lowerMessage.includes("invalid credentials") || lowerMessage.includes("wrong password") || lowerMessage.includes("incorrect password")) {
-    return "Invalid email or password. Please try again.";
-  }
-  if (lowerMessage.includes("invalid email") || lowerMessage.includes("password")) {
-    return message;
-  }
-  if (message === "The string did not match the expected pattern.") {
-    return "Please check your email address format and try again.";
-  }
-  if (lowerMessage.includes("rate limit") || lowerMessage.includes("too many requests") || lowerMessage.includes("try again later")) {
-    return "Too many attempts. Please wait a moment and try again.";
-  }
-  if (lowerMessage.includes("hook") || lowerMessage.includes("authorization") || lowerMessage.includes("token") || lowerMessage.includes("internal") || lowerMessage.includes("server") || lowerMessage.includes("database") || lowerMessage.includes("connection")) {
-    return "An error occurred. Please try again.";
-  }
-  return "An error occurred. Please try again.";
-}
-function sanitizeSignupError(message) {
-  const sanitized = sanitizeAuthError(message);
-  if (sanitized === "An error occurred. Please try again.") {
-    return "An error occurred during sign up. Please try again.";
-  }
-  return sanitized;
-}
-function buildOAuthRedirectTo(origin, nextPath) {
-  const siteUrl = origin.replace(/\/$/, "");
-  return `${siteUrl}/callback?next=${encodeURIComponent(nextPath)}`;
-}
-function buildOAuthSignInOptions(provider, redirectTo, options = {}) {
-  return {
-    redirectTo,
-    ...provider === "azure" ? { scopes: "email" } : {},
-    ...options
-  };
-}
-function warnAboutSupabaseRedirectAllowlist(origin) {
-  const normalizedOrigin = origin.replace(/\/$/, "");
-  let hostname = "";
-  try {
-    hostname = new URL(normalizedOrigin).host;
-  } catch {
-    return;
-  }
-  if (!isPreviewEnvironment(hostname)) {
-    return;
-  }
-  if (warnedSupabaseRedirectOrigins.has(normalizedOrigin)) {
-    return;
-  }
-  warnedSupabaseRedirectOrigins.add(normalizedOrigin);
-  console.warn(
-    `[identity] Supabase redirect allowlist reminder: add "${normalizedOrigin}/**" to Supabase Auth > URL Configuration > Additional Redirect URLs. The auth components already use the active origin for callbacks, but Supabase must allow that origin too or OAuth/email flows can bounce to another host.`
-  );
-}
-function clearStalePKCEState() {
-  if (typeof window === "undefined") return;
-  try {
-    const keysToRemove = [];
-    for (let i = 0; i < localStorage.length; i++) {
-      const key = localStorage.key(i);
-      if (key?.includes("-code-verifier")) {
-        keysToRemove.push(key);
-      }
-    }
-    for (const key of keysToRemove) {
-      localStorage.removeItem(key);
-    }
-  } catch {
-  }
-}
 function ForgotPasswordForm({
   createClient,
   logo,
@@ -1090,7 +1140,14 @@ function SigninForm({
   const oauthTimeoutRef = useRef(null);
   const router = useRouter();
   const searchParams = useSearchParams();
-  const redirectTo = searchParams.get("redirect") || mergedLinks.defaultRedirect;
+  const defaultRedirect = getSafeInternalRedirect(
+    mergedLinks.defaultRedirect,
+    defaultAuthLinks.defaultRedirect
+  );
+  const redirectTo = getSafeInternalRedirect(
+    searchParams.get("redirect"),
+    defaultRedirect
+  );
   const message = searchParams.get("message");
   const mfaRequired = searchParams.get("mfa") === "required";
   const [showMFA, setShowMFA] = useState(mfaRequired);
@@ -1262,7 +1319,7 @@ function SigninForm({
       } else {
         onAuthEvent?.onSignInSuccess?.(userId, email.trim(), false);
         recordSignIn("email", email.trim());
-        window.location.href = redirectTo;
+        hardRedirect(redirectTo);
       }
     } catch (err) {
       logError(err, {
@@ -1422,10 +1479,13 @@ function SigninForm({
     }
   );
 }
+var EMPTY_CONSENT_ITEMS = [];
 function SignupForm({
   createClient,
   logo,
   appName = "your account",
+  title,
+  initialEmail = "",
   termsUrl = "/terms",
   privacyUrl = "/privacy",
   links = {},
@@ -1437,7 +1497,7 @@ function SignupForm({
   oauthIconMonochromeOnHover = false,
   className,
   onAuthEvent,
-  consentItems = [],
+  consentItems = EMPTY_CONSENT_ITEMS,
   consentPosition = "above",
   consentSize = "default",
   showHomeLink = true,
@@ -1447,7 +1507,11 @@ function SignupForm({
   const Link = LinkComponent;
   const Image = ImageComponent;
   const router = useRouter();
-  const [email, setEmail] = useState("");
+  const redirectTo = getSafeInternalRedirect(
+    mergedLinks.defaultRedirect,
+    defaultAuthLinks.defaultRedirect
+  );
+  const [email, setEmail] = useState(initialEmail);
   const [emailTouched, setEmailTouched] = useState(false);
   const [password, setPassword] = useState("");
   const [confirmPassword, setConfirmPassword] = useState("");
@@ -1512,7 +1576,7 @@ function SignupForm({
       provider,
       options: buildOAuthSignInOptions(
         provider,
-        buildOAuthRedirectTo(siteUrl, mergedLinks.defaultRedirect)
+        buildOAuthRedirectTo(siteUrl, redirectTo)
       )
     });
     if (error) {
@@ -1547,7 +1611,7 @@ function SignupForm({
       email: email.trim(),
       password,
       options: {
-        emailRedirectTo: `${siteUrl}/callback`,
+        emailRedirectTo: buildOAuthRedirectTo(siteUrl, redirectTo),
         // Pass all consent values as user metadata
         data: consentState
       }
@@ -1565,7 +1629,7 @@ function SignupForm({
     } else if (data.user) {
       const userId = data.user.id;
       onAuthEvent?.onSignUpSuccess?.(userId, email.trim());
-      router.push(mergedLinks.defaultRedirect);
+      router.push(redirectTo);
       router.refresh();
     } else {
       onAuthEvent?.onSignUpFailure?.(email.trim(), "no_user_data_in_response");
@@ -1581,7 +1645,7 @@ function SignupForm({
         logo,
         ImageComponent: Image,
         createClient,
-        redirectTo: mergedLinks.home,
+        redirectTo,
         className
       }
     );
@@ -1603,7 +1667,7 @@ function SignupForm({
             AuthHeader,
             {
               logo: showLogo !== false ? logo : void 0,
-              title: `Sign up for ${appName}`,
+              title: title ?? `Sign up for ${appName}`,
               ImageComponent: Image
             }
           ),
@@ -5530,12 +5594,6 @@ var EMAIL_OTP_TYPES = [
   "email_change",
   "email"
 ];
-function getSafeRedirectPath(candidate, fallback) {
-  if (candidate?.startsWith("/") && !candidate.startsWith("//")) {
-    return candidate;
-  }
-  return fallback;
-}
 function getEmailOtpType(value) {
   if (!value) {
     return null;
@@ -5626,8 +5684,9 @@ function createRedirectResponse(target, origin) {
   if (target instanceof URL) {
     return NextResponse.redirect(target.toString());
   }
-  if (target.startsWith("/") && !target.startsWith("//")) {
-    return NextResponse.redirect(`${origin}${target}`);
+  const safeTarget = getSafeInternalRedirect(target, null);
+  if (safeTarget) {
+    return NextResponse.redirect(`${origin}${safeTarget}`);
   }
   return null;
 }
@@ -5689,15 +5748,20 @@ function createAuthCallbackHandler({
   isLinkingFlow = isDefaultLinkingFlow,
   resolveLinkingErrorMessage
 }) {
+  const safeDefaultRedirect = getSafeInternalRedirect(
+    defaultRedirect,
+    "/dashboard"
+  );
+  const safeSignInPath = getSafeInternalRedirect(signInPath, "/signin");
   return async function GET(request) {
     const requestUrl = new URL(request.url);
     const code = requestUrl.searchParams.get("code");
     const tokenHash = requestUrl.searchParams.get("token_hash");
     const rawOtpType = requestUrl.searchParams.get("type");
     const otpType = getEmailOtpType(rawOtpType);
-    const next = getSafeRedirectPath(
+    const next = getSafeInternalRedirect(
       requestUrl.searchParams.get("next") ?? requestUrl.searchParams.get("redirect_to"),
-      defaultRedirect
+      safeDefaultRedirect
     );
     const origin = requestUrl.origin;
     const error = requestUrl.searchParams.get("error");
@@ -5719,7 +5783,7 @@ function createAuthCallbackHandler({
         return linkingErrorRedirect;
       }
       return NextResponse.redirect(
-        `${origin}${signInPath}?error=${encodeURIComponent(message)}`
+        `${origin}${safeSignInPath}?error=${encodeURIComponent(message)}`
       );
     }
     if (code) {
@@ -5734,7 +5798,7 @@ function createAuthCallbackHandler({
           flow: "oauth",
           postAuthHook,
           postAuthHookErrorMode,
-          signInPath,
+          signInPath: safeSignInPath,
           resolveSuccessRedirect
         });
       }
@@ -5754,13 +5818,13 @@ function createAuthCallbackHandler({
         return linkingErrorRedirect;
       }
       return NextResponse.redirect(
-        `${origin}${signInPath}?error=${encodeURIComponent(errorMessage)}`
+        `${origin}${safeSignInPath}?error=${encodeURIComponent(errorMessage)}`
       );
     }
     if (tokenHash || rawOtpType) {
       if (!tokenHash || !otpType) {
         return NextResponse.redirect(
-          `${origin}${signInPath}?error=${encodeURIComponent("Invalid verification link")}`
+          `${origin}${safeSignInPath}?error=${encodeURIComponent("Invalid verification link")}`
         );
       }
       const supabase = await createClient();
@@ -5778,16 +5842,16 @@ function createAuthCallbackHandler({
           otpType,
           postAuthHook,
           postAuthHookErrorMode,
-          signInPath,
+          signInPath: safeSignInPath,
           resolveSuccessRedirect
         });
       }
       return NextResponse.redirect(
-        `${origin}${signInPath}?error=${encodeURIComponent(verifyError.message)}`
+        `${origin}${safeSignInPath}?error=${encodeURIComponent(verifyError.message)}`
       );
     }
     return NextResponse.redirect(
-      `${origin}${signInPath}?error=No authorization code received`
+      `${origin}${safeSignInPath}?error=No authorization code received`
     );
   };
 }

package/dist/server.js

@@ -3,6 +3,43 @@
 var server = require('next/server');
 var sharedUtils = require('@caffeinebounce/shared-utils');
 
+// src/handlers/callback.ts
+
+// src/utils/redirect.ts
+var INTERNAL_REDIRECT_BASE = new URL("https://identity.invalid");
+var ENCODED_PATH_SEPARATOR = /%(?:2f|5c)/i;
+function hasControlCharacter(value) {
+  return Array.from(value).some((character) => {
+    const code = character.charCodeAt(0);
+    return code <= 31 || code === 127;
+  });
+}
+function isStrictInternalRedirect(candidate) {
+  if (!candidate?.startsWith("/") || hasControlCharacter(candidate)) {
+    return false;
+  }
+  const pathEnd = candidate.search(/[?#]/);
+  const pathname = pathEnd === -1 ? candidate : candidate.slice(0, pathEnd);
+  if (pathname.includes("\\") || ENCODED_PATH_SEPARATOR.test(pathname)) {
+    return false;
+  }
+  try {
+    const target = new URL(candidate, INTERNAL_REDIRECT_BASE);
+    return target.origin === INTERNAL_REDIRECT_BASE.origin;
+  } catch {
+    return false;
+  }
+}
+function getSafeInternalRedirect(candidate, fallback) {
+  if (isStrictInternalRedirect(candidate)) {
+    return candidate;
+  }
+  if (fallback === null) {
+    return null;
+  }
+  return isStrictInternalRedirect(fallback) ? fallback : "/";
+}
+
 // src/handlers/callback.ts
 var POST_AUTH_HOOK_ERROR_MESSAGE = "Authentication completed, but setup failed. Please try again.";
 var DEFAULT_LINKING_ACCOUNT_ERROR_MESSAGE = "This account is already connected to another account. Each external account can only be linked to one account.";
@@ -14,12 +51,6 @@ var EMAIL_OTP_TYPES = [
   "email_change",
   "email"
 ];
-function getSafeRedirectPath(candidate, fallback) {
-  if (candidate?.startsWith("/") && !candidate.startsWith("//")) {
-    return candidate;
-  }
-  return fallback;
-}
 function getEmailOtpType(value) {
   if (!value) {
     return null;
@@ -110,8 +141,9 @@ function createRedirectResponse(target, origin) {
   if (target instanceof URL) {
     return server.NextResponse.redirect(target.toString());
   }
-  if (target.startsWith("/") && !target.startsWith("//")) {
-    return server.NextResponse.redirect(`${origin}${target}`);
+  const safeTarget = getSafeInternalRedirect(target, null);
+  if (safeTarget) {
+    return server.NextResponse.redirect(`${origin}${safeTarget}`);
   }
   return null;
 }
@@ -173,15 +205,20 @@ function createAuthCallbackHandler({
   isLinkingFlow = isDefaultLinkingFlow,
   resolveLinkingErrorMessage
 }) {
+  const safeDefaultRedirect = getSafeInternalRedirect(
+    defaultRedirect,
+    "/dashboard"
+  );
+  const safeSignInPath = getSafeInternalRedirect(signInPath, "/signin");
   return async function GET(request) {
     const requestUrl = new URL(request.url);
     const code = requestUrl.searchParams.get("code");
     const tokenHash = requestUrl.searchParams.get("token_hash");
     const rawOtpType = requestUrl.searchParams.get("type");
     const otpType = getEmailOtpType(rawOtpType);
-    const next = getSafeRedirectPath(
+    const next = getSafeInternalRedirect(
       requestUrl.searchParams.get("next") ?? requestUrl.searchParams.get("redirect_to"),
-      defaultRedirect
+      safeDefaultRedirect
     );
     const origin = requestUrl.origin;
     const error = requestUrl.searchParams.get("error");
@@ -203,7 +240,7 @@ function createAuthCallbackHandler({
         return linkingErrorRedirect;
       }
       return server.NextResponse.redirect(
-        `${origin}${signInPath}?error=${encodeURIComponent(message)}`
+        `${origin}${safeSignInPath}?error=${encodeURIComponent(message)}`
       );
     }
     if (code) {
@@ -218,7 +255,7 @@ function createAuthCallbackHandler({
           flow: "oauth",
           postAuthHook,
           postAuthHookErrorMode,
-          signInPath,
+          signInPath: safeSignInPath,
           resolveSuccessRedirect
         });
       }
@@ -238,13 +275,13 @@ function createAuthCallbackHandler({
         return linkingErrorRedirect;
       }
       return server.NextResponse.redirect(
-        `${origin}${signInPath}?error=${encodeURIComponent(errorMessage)}`
+        `${origin}${safeSignInPath}?error=${encodeURIComponent(errorMessage)}`
       );
     }
     if (tokenHash || rawOtpType) {
       if (!tokenHash || !otpType) {
         return server.NextResponse.redirect(
-          `${origin}${signInPath}?error=${encodeURIComponent("Invalid verification link")}`
+          `${origin}${safeSignInPath}?error=${encodeURIComponent("Invalid verification link")}`
         );
       }
       const supabase = await createClient();
@@ -262,16 +299,16 @@ function createAuthCallbackHandler({
           otpType,
           postAuthHook,
           postAuthHookErrorMode,
-          signInPath,
+          signInPath: safeSignInPath,
           resolveSuccessRedirect
         });
       }
       return server.NextResponse.redirect(
-        `${origin}${signInPath}?error=${encodeURIComponent(verifyError.message)}`
+        `${origin}${safeSignInPath}?error=${encodeURIComponent(verifyError.message)}`
       );
     }
     return server.NextResponse.redirect(
-      `${origin}${signInPath}?error=No authorization code received`
+      `${origin}${safeSignInPath}?error=No authorization code received`
     );
   };
 }

package/dist/server.mjs

@@ -1,6 +1,43 @@
 import { NextResponse } from 'next/server';
 export { generateSecureToken, getClientIP, getGeolocationFromIP, hashString } from '@caffeinebounce/shared-utils';
 
+// src/handlers/callback.ts
+
+// src/utils/redirect.ts
+var INTERNAL_REDIRECT_BASE = new URL("https://identity.invalid");
+var ENCODED_PATH_SEPARATOR = /%(?:2f|5c)/i;
+function hasControlCharacter(value) {
+  return Array.from(value).some((character) => {
+    const code = character.charCodeAt(0);
+    return code <= 31 || code === 127;
+  });
+}
+function isStrictInternalRedirect(candidate) {
+  if (!candidate?.startsWith("/") || hasControlCharacter(candidate)) {
+    return false;
+  }
+  const pathEnd = candidate.search(/[?#]/);
+  const pathname = pathEnd === -1 ? candidate : candidate.slice(0, pathEnd);
+  if (pathname.includes("\\") || ENCODED_PATH_SEPARATOR.test(pathname)) {
+    return false;
+  }
+  try {
+    const target = new URL(candidate, INTERNAL_REDIRECT_BASE);
+    return target.origin === INTERNAL_REDIRECT_BASE.origin;
+  } catch {
+    return false;
+  }
+}
+function getSafeInternalRedirect(candidate, fallback) {
+  if (isStrictInternalRedirect(candidate)) {
+    return candidate;
+  }
+  if (fallback === null) {
+    return null;
+  }
+  return isStrictInternalRedirect(fallback) ? fallback : "/";
+}
+
 // src/handlers/callback.ts
 var POST_AUTH_HOOK_ERROR_MESSAGE = "Authentication completed, but setup failed. Please try again.";
 var DEFAULT_LINKING_ACCOUNT_ERROR_MESSAGE = "This account is already connected to another account. Each external account can only be linked to one account.";
@@ -12,12 +49,6 @@ var EMAIL_OTP_TYPES = [
   "email_change",
   "email"
 ];
-function getSafeRedirectPath(candidate, fallback) {
-  if (candidate?.startsWith("/") && !candidate.startsWith("//")) {
-    return candidate;
-  }
-  return fallback;
-}
 function getEmailOtpType(value) {
   if (!value) {
     return null;
@@ -108,8 +139,9 @@ function createRedirectResponse(target, origin) {
   if (target instanceof URL) {
     return NextResponse.redirect(target.toString());
   }
-  if (target.startsWith("/") && !target.startsWith("//")) {
-    return NextResponse.redirect(`${origin}${target}`);
+  const safeTarget = getSafeInternalRedirect(target, null);
+  if (safeTarget) {
+    return NextResponse.redirect(`${origin}${safeTarget}`);
   }
   return null;
 }
@@ -171,15 +203,20 @@ function createAuthCallbackHandler({
   isLinkingFlow = isDefaultLinkingFlow,
   resolveLinkingErrorMessage
 }) {
+  const safeDefaultRedirect = getSafeInternalRedirect(
+    defaultRedirect,
+    "/dashboard"
+  );
+  const safeSignInPath = getSafeInternalRedirect(signInPath, "/signin");
   return async function GET(request) {
     const requestUrl = new URL(request.url);
     const code = requestUrl.searchParams.get("code");
     const tokenHash = requestUrl.searchParams.get("token_hash");
     const rawOtpType = requestUrl.searchParams.get("type");
     const otpType = getEmailOtpType(rawOtpType);
-    const next = getSafeRedirectPath(
+    const next = getSafeInternalRedirect(
       requestUrl.searchParams.get("next") ?? requestUrl.searchParams.get("redirect_to"),
-      defaultRedirect
+      safeDefaultRedirect
     );
     const origin = requestUrl.origin;
     const error = requestUrl.searchParams.get("error");
@@ -201,7 +238,7 @@ function createAuthCallbackHandler({
         return linkingErrorRedirect;
       }
       return NextResponse.redirect(
-        `${origin}${signInPath}?error=${encodeURIComponent(message)}`
+        `${origin}${safeSignInPath}?error=${encodeURIComponent(message)}`
       );
     }
     if (code) {
@@ -216,7 +253,7 @@ function createAuthCallbackHandler({
           flow: "oauth",
           postAuthHook,
           postAuthHookErrorMode,
-          signInPath,
+          signInPath: safeSignInPath,
           resolveSuccessRedirect
         });
       }
@@ -236,13 +273,13 @@ function createAuthCallbackHandler({
         return linkingErrorRedirect;
       }
       return NextResponse.redirect(
-        `${origin}${signInPath}?error=${encodeURIComponent(errorMessage)}`
+        `${origin}${safeSignInPath}?error=${encodeURIComponent(errorMessage)}`
       );
     }
     if (tokenHash || rawOtpType) {
       if (!tokenHash || !otpType) {
         return NextResponse.redirect(
-          `${origin}${signInPath}?error=${encodeURIComponent("Invalid verification link")}`
+          `${origin}${safeSignInPath}?error=${encodeURIComponent("Invalid verification link")}`
         );
       }
       const supabase = await createClient();
@@ -260,16 +297,16 @@ function createAuthCallbackHandler({
           otpType,
           postAuthHook,
           postAuthHookErrorMode,
-          signInPath,
+          signInPath: safeSignInPath,
           resolveSuccessRedirect
         });
       }
       return NextResponse.redirect(
-        `${origin}${signInPath}?error=${encodeURIComponent(verifyError.message)}`
+        `${origin}${safeSignInPath}?error=${encodeURIComponent(verifyError.message)}`
       );
     }
     return NextResponse.redirect(
-      `${origin}${signInPath}?error=No authorization code received`
+      `${origin}${safeSignInPath}?error=No authorization code received`
     );
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@caffeinebounce/identity",
-  "version": "0.12.1",
+  "version": "0.12.2",
   "description": "Authentication components and handlers for Caffeine Bounce projects",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -61,7 +61,7 @@
   "dependencies": {
     "@caffeinebounce/logger": "^0.10.0",
     "@caffeinebounce/shared-utils": "^0.7.136",
-    "@caffeinebounce/ui": "^0.62.2",
+    "@caffeinebounce/ui": "^0.62.3",
     "@supabase/ssr": "^0.8.0",
     "@supabase/supabase-js": "^2.49.4",
     "input-otp": "^1.4.2",