@caffeinebounce/identity 0.12.1 → 0.12.3

package/dist/index.d.mts

@@ -241,6 +241,10 @@ interface ConsentItem {
     errorMessage?: string;
 }
 interface SignupFormProps extends AuthFormConfig {
+    /** Optional heading override for the sign-up form */
+    title?: string;
+    /** Optional initial value for the email field */
+    initialEmail?: string;
     /** Navigation links configuration */
     links?: AuthLinks;
     /** Image component to use (e.g., Next.js Image) */
@@ -283,7 +287,7 @@ interface SignupFormProps extends AuthFormConfig {
 /**
  * SignupForm - Configurable sign-up form with email/password and OAuth support
  */
-declare function SignupForm({ createClient, logo, appName, termsUrl, privacyUrl, links, ImageComponent, LinkComponent, oauthProviders, googleComingSoon, azureComingSoon, oauthIconMonochromeOnHover, className, onAuthEvent, consentItems, consentPosition, consentSize, showHomeLink, showLogo, }: SignupFormProps): react_jsx_runtime.JSX.Element;
+declare function SignupForm({ createClient, logo, appName, title, initialEmail, termsUrl, privacyUrl, links, ImageComponent, LinkComponent, oauthProviders, googleComingSoon, azureComingSoon, oauthIconMonochromeOnHover, className, onAuthEvent, consentItems, consentPosition, consentSize, showHomeLink, showLogo, }: SignupFormProps): react_jsx_runtime.JSX.Element;
 
 /**
  * MFA event logging callbacks
@@ -480,6 +484,8 @@ interface DeleteAccountSectionProps {
 declare function DeleteAccountSection({ createClient, email, retentionDays, }: DeleteAccountSectionProps): react_jsx_runtime.JSX.Element;
 
 interface EmailSectionProps {
+    /** Render the change action as a compact pencil icon instead of a text label */
+    changeButtonPresentation?: "label" | "icon";
     /** Function to create a Supabase client */
     createClient: CreateClientFn;
     /** User ID (reserved for future use) */
@@ -491,7 +497,7 @@ interface EmailSectionProps {
     /** Callback when email is changed */
     onEmailChanged: (newEmail: string) => void;
 }
-declare function EmailSection({ createClient, userId: _userId, email, isVerified, onEmailChanged, }: EmailSectionProps): react_jsx_runtime.JSX.Element;
+declare function EmailSection({ changeButtonPresentation, createClient, userId: _userId, email, isVerified, onEmailChanged, }: EmailSectionProps): react_jsx_runtime.JSX.Element;
 
 interface LinkedAccountsSectionProps {
     /** Function to create a Supabase client */

package/dist/index.d.ts

@@ -241,6 +241,10 @@ interface ConsentItem {
     errorMessage?: string;
 }
 interface SignupFormProps extends AuthFormConfig {
+    /** Optional heading override for the sign-up form */
+    title?: string;
+    /** Optional initial value for the email field */
+    initialEmail?: string;
     /** Navigation links configuration */
     links?: AuthLinks;
     /** Image component to use (e.g., Next.js Image) */
@@ -283,7 +287,7 @@ interface SignupFormProps extends AuthFormConfig {
 /**
  * SignupForm - Configurable sign-up form with email/password and OAuth support
  */
-declare function SignupForm({ createClient, logo, appName, termsUrl, privacyUrl, links, ImageComponent, LinkComponent, oauthProviders, googleComingSoon, azureComingSoon, oauthIconMonochromeOnHover, className, onAuthEvent, consentItems, consentPosition, consentSize, showHomeLink, showLogo, }: SignupFormProps): react_jsx_runtime.JSX.Element;
+declare function SignupForm({ createClient, logo, appName, title, initialEmail, termsUrl, privacyUrl, links, ImageComponent, LinkComponent, oauthProviders, googleComingSoon, azureComingSoon, oauthIconMonochromeOnHover, className, onAuthEvent, consentItems, consentPosition, consentSize, showHomeLink, showLogo, }: SignupFormProps): react_jsx_runtime.JSX.Element;
 
 /**
  * MFA event logging callbacks
@@ -480,6 +484,8 @@ interface DeleteAccountSectionProps {
 declare function DeleteAccountSection({ createClient, email, retentionDays, }: DeleteAccountSectionProps): react_jsx_runtime.JSX.Element;
 
 interface EmailSectionProps {
+    /** Render the change action as a compact pencil icon instead of a text label */
+    changeButtonPresentation?: "label" | "icon";
     /** Function to create a Supabase client */
     createClient: CreateClientFn;
     /** User ID (reserved for future use) */
@@ -491,7 +497,7 @@ interface EmailSectionProps {
     /** Callback when email is changed */
     onEmailChanged: (newEmail: string) => void;
 }
-declare function EmailSection({ createClient, userId: _userId, email, isVerified, onEmailChanged, }: EmailSectionProps): react_jsx_runtime.JSX.Element;
+declare function EmailSection({ changeButtonPresentation, createClient, userId: _userId, email, isVerified, onEmailChanged, }: EmailSectionProps): react_jsx_runtime.JSX.Element;
 
 interface LinkedAccountsSectionProps {
     /** Function to create a Supabase client */

package/dist/index.js

@@ -19,6 +19,17 @@ function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 var isEmail__default = /*#__PURE__*/_interopDefault(isEmail);
 
 // src/components/auth/EmailVerificationPending.tsx
+
+// src/types.ts
+var defaultAuthLinks = {
+  signIn: "/signin",
+  signUp: "/signup",
+  forgotPassword: "/forgot-password",
+  resetPassword: "/reset-password",
+  callback: "/callback",
+  home: "/",
+  defaultRedirect: "/dashboard"
+};
 function AuthFormLayout({
   children,
   footer,
@@ -55,6 +66,122 @@ function AuthFormLayout({
     ] }) })
   ] });
 }
+
+// src/utils/redirect.ts
+var INTERNAL_REDIRECT_BASE = new URL("https://identity.invalid");
+var ENCODED_PATH_SEPARATOR = /%(?:2f|5c)/i;
+function hasControlCharacter(value) {
+  return Array.from(value).some((character) => {
+    const code = character.charCodeAt(0);
+    return code <= 31 || code === 127;
+  });
+}
+function isStrictInternalRedirect(candidate) {
+  if (!candidate?.startsWith("/") || hasControlCharacter(candidate)) {
+    return false;
+  }
+  const pathEnd = candidate.search(/[?#]/);
+  const pathname = pathEnd === -1 ? candidate : candidate.slice(0, pathEnd);
+  if (pathname.includes("\\") || ENCODED_PATH_SEPARATOR.test(pathname)) {
+    return false;
+  }
+  try {
+    const target = new URL(candidate, INTERNAL_REDIRECT_BASE);
+    return target.origin === INTERNAL_REDIRECT_BASE.origin;
+  } catch {
+    return false;
+  }
+}
+function getSafeInternalRedirect(candidate, fallback) {
+  if (isStrictInternalRedirect(candidate)) {
+    return candidate;
+  }
+  if (fallback === null) {
+    return null;
+  }
+  return isStrictInternalRedirect(fallback) ? fallback : "/";
+}
+
+// src/components/auth/utils.ts
+var warnedSupabaseRedirectOrigins = /* @__PURE__ */ new Set();
+function hardRedirect(redirectTo) {
+  window.location.href = redirectTo;
+}
+function sanitizeAuthError(message) {
+  const lowerMessage = message.toLowerCase();
+  if (lowerMessage.includes("user already registered") || lowerMessage.includes("already registered") || lowerMessage.includes("already exists") || lowerMessage.includes("email already") || lowerMessage.includes("duplicate")) {
+    return "An account with this email already exists. Please sign in instead.";
+  }
+  if (lowerMessage.includes("invalid login credentials") || lowerMessage.includes("invalid credentials") || lowerMessage.includes("wrong password") || lowerMessage.includes("incorrect password")) {
+    return "Invalid email or password. Please try again.";
+  }
+  if (lowerMessage.includes("invalid email") || lowerMessage.includes("password")) {
+    return message;
+  }
+  if (message === "The string did not match the expected pattern.") {
+    return "Please check your email address format and try again.";
+  }
+  if (lowerMessage.includes("rate limit") || lowerMessage.includes("too many requests") || lowerMessage.includes("try again later")) {
+    return "Too many attempts. Please wait a moment and try again.";
+  }
+  if (lowerMessage.includes("hook") || lowerMessage.includes("authorization") || lowerMessage.includes("token") || lowerMessage.includes("internal") || lowerMessage.includes("server") || lowerMessage.includes("database") || lowerMessage.includes("connection")) {
+    return "An error occurred. Please try again.";
+  }
+  return "An error occurred. Please try again.";
+}
+function sanitizeSignupError(message) {
+  const sanitized = sanitizeAuthError(message);
+  if (sanitized === "An error occurred. Please try again.") {
+    return "An error occurred during sign up. Please try again.";
+  }
+  return sanitized;
+}
+function buildOAuthRedirectTo(origin, nextPath) {
+  const siteUrl = origin.replace(/\/$/, "");
+  return `${siteUrl}/callback?next=${encodeURIComponent(nextPath)}`;
+}
+function buildOAuthSignInOptions(provider, redirectTo, options = {}) {
+  return {
+    redirectTo,
+    ...provider === "azure" ? { scopes: "email" } : {},
+    ...options
+  };
+}
+function warnAboutSupabaseRedirectAllowlist(origin) {
+  const normalizedOrigin = origin.replace(/\/$/, "");
+  let hostname = "";
+  try {
+    hostname = new URL(normalizedOrigin).host;
+  } catch {
+    return;
+  }
+  if (!sharedUtils.isPreviewEnvironment(hostname)) {
+    return;
+  }
+  if (warnedSupabaseRedirectOrigins.has(normalizedOrigin)) {
+    return;
+  }
+  warnedSupabaseRedirectOrigins.add(normalizedOrigin);
+  console.warn(
+    `[identity] Supabase redirect allowlist reminder: add "${normalizedOrigin}/**" to Supabase Auth > URL Configuration > Additional Redirect URLs. The auth components already use the active origin for callbacks, but Supabase must allow that origin too or OAuth/email flows can bounce to another host.`
+  );
+}
+function clearStalePKCEState() {
+  if (typeof window === "undefined") return;
+  try {
+    const keysToRemove = [];
+    for (let i = 0; i < localStorage.length; i++) {
+      const key = localStorage.key(i);
+      if (key?.includes("-code-verifier")) {
+        keysToRemove.push(key);
+      }
+    }
+    for (const key of keysToRemove) {
+      localStorage.removeItem(key);
+    }
+  } catch {
+  }
+}
 var POLL_INTERVAL_MS = 6e4;
 var MAX_POLL_COUNT = 60;
 function EmailVerificationPending({
@@ -125,9 +252,19 @@ function EmailVerificationPending({
     setResendStatus("sending");
     try {
       const supabase = createClient();
+      const safeRedirectTo = getSafeInternalRedirect(
+        redirectTo,
+        defaultAuthLinks.defaultRedirect
+      );
       const { error } = await supabase.auth.resend({
         type: "signup",
-        email
+        email,
+        options: {
+          emailRedirectTo: buildOAuthRedirectTo(
+            window.location.origin,
+            safeRedirectTo
+          )
+        }
       });
       if (error) {
         setResendStatus("error");
@@ -247,17 +384,6 @@ function EmailVerificationPending({
     }
   );
 }
-
-// src/types.ts
-var defaultAuthLinks = {
-  signIn: "/signin",
-  signUp: "/signup",
-  forgotPassword: "/forgot-password",
-  resetPassword: "/reset-password",
-  callback: "/callback",
-  home: "/",
-  defaultRedirect: "/dashboard"
-};
 function AuthHeader({
   logo,
   title,
@@ -279,82 +405,6 @@ function AuthHeader({
     /* @__PURE__ */ jsxRuntime.jsx("h1", { className: "text-2xl font-semibold tracking-tight text-foreground", children: title })
   ] });
 }
-var warnedSupabaseRedirectOrigins = /* @__PURE__ */ new Set();
-function sanitizeAuthError(message) {
-  const lowerMessage = message.toLowerCase();
-  if (lowerMessage.includes("user already registered") || lowerMessage.includes("already registered") || lowerMessage.includes("already exists") || lowerMessage.includes("email already") || lowerMessage.includes("duplicate")) {
-    return "An account with this email already exists. Please sign in instead.";
-  }
-  if (lowerMessage.includes("invalid login credentials") || lowerMessage.includes("invalid credentials") || lowerMessage.includes("wrong password") || lowerMessage.includes("incorrect password")) {
-    return "Invalid email or password. Please try again.";
-  }
-  if (lowerMessage.includes("invalid email") || lowerMessage.includes("password")) {
-    return message;
-  }
-  if (message === "The string did not match the expected pattern.") {
-    return "Please check your email address format and try again.";
-  }
-  if (lowerMessage.includes("rate limit") || lowerMessage.includes("too many requests") || lowerMessage.includes("try again later")) {
-    return "Too many attempts. Please wait a moment and try again.";
-  }
-  if (lowerMessage.includes("hook") || lowerMessage.includes("authorization") || lowerMessage.includes("token") || lowerMessage.includes("internal") || lowerMessage.includes("server") || lowerMessage.includes("database") || lowerMessage.includes("connection")) {
-    return "An error occurred. Please try again.";
-  }
-  return "An error occurred. Please try again.";
-}
-function sanitizeSignupError(message) {
-  const sanitized = sanitizeAuthError(message);
-  if (sanitized === "An error occurred. Please try again.") {
-    return "An error occurred during sign up. Please try again.";
-  }
-  return sanitized;
-}
-function buildOAuthRedirectTo(origin, nextPath) {
-  const siteUrl = origin.replace(/\/$/, "");
-  return `${siteUrl}/callback?next=${encodeURIComponent(nextPath)}`;
-}
-function buildOAuthSignInOptions(provider, redirectTo, options = {}) {
-  return {
-    redirectTo,
-    ...provider === "azure" ? { scopes: "email" } : {},
-    ...options
-  };
-}
-function warnAboutSupabaseRedirectAllowlist(origin) {
-  const normalizedOrigin = origin.replace(/\/$/, "");
-  let hostname = "";
-  try {
-    hostname = new URL(normalizedOrigin).host;
-  } catch {
-    return;
-  }
-  if (!sharedUtils.isPreviewEnvironment(hostname)) {
-    return;
-  }
-  if (warnedSupabaseRedirectOrigins.has(normalizedOrigin)) {
-    return;
-  }
-  warnedSupabaseRedirectOrigins.add(normalizedOrigin);
-  console.warn(
-    `[identity] Supabase redirect allowlist reminder: add "${normalizedOrigin}/**" to Supabase Auth > URL Configuration > Additional Redirect URLs. The auth components already use the active origin for callbacks, but Supabase must allow that origin too or OAuth/email flows can bounce to another host.`
-  );
-}
-function clearStalePKCEState() {
-  if (typeof window === "undefined") return;
-  try {
-    const keysToRemove = [];
-    for (let i = 0; i < localStorage.length; i++) {
-      const key = localStorage.key(i);
-      if (key?.includes("-code-verifier")) {
-        keysToRemove.push(key);
-      }
-    }
-    for (const key of keysToRemove) {
-      localStorage.removeItem(key);
-    }
-  } catch {
-  }
-}
 function ForgotPasswordForm({
   createClient,
   logo,
@@ -1095,7 +1145,14 @@ function SigninForm({
   const oauthTimeoutRef = react.useRef(null);
   const router = navigation.useRouter();
   const searchParams = navigation.useSearchParams();
-  const redirectTo = searchParams.get("redirect") || mergedLinks.defaultRedirect;
+  const defaultRedirect = getSafeInternalRedirect(
+    mergedLinks.defaultRedirect,
+    defaultAuthLinks.defaultRedirect
+  );
+  const redirectTo = getSafeInternalRedirect(
+    searchParams.get("redirect"),
+    defaultRedirect
+  );
   const message = searchParams.get("message");
   const mfaRequired = searchParams.get("mfa") === "required";
   const [showMFA, setShowMFA] = react.useState(mfaRequired);
@@ -1267,7 +1324,7 @@ function SigninForm({
       } else {
         onAuthEvent?.onSignInSuccess?.(userId, email.trim(), false);
         recordSignIn("email", email.trim());
-        window.location.href = redirectTo;
+        hardRedirect(redirectTo);
       }
     } catch (err) {
       logError(err, {
@@ -1427,10 +1484,13 @@ function SigninForm({
     }
   );
 }
+var EMPTY_CONSENT_ITEMS = [];
 function SignupForm({
   createClient,
   logo,
   appName = "your account",
+  title,
+  initialEmail = "",
   termsUrl = "/terms",
   privacyUrl = "/privacy",
   links = {},
@@ -1442,7 +1502,7 @@ function SignupForm({
   oauthIconMonochromeOnHover = false,
   className,
   onAuthEvent,
-  consentItems = [],
+  consentItems = EMPTY_CONSENT_ITEMS,
   consentPosition = "above",
   consentSize = "default",
   showHomeLink = true,
@@ -1452,7 +1512,11 @@ function SignupForm({
   const Link = LinkComponent;
   const Image = ImageComponent;
   const router = navigation.useRouter();
-  const [email, setEmail] = react.useState("");
+  const redirectTo = getSafeInternalRedirect(
+    mergedLinks.defaultRedirect,
+    defaultAuthLinks.defaultRedirect
+  );
+  const [email, setEmail] = react.useState(initialEmail);
   const [emailTouched, setEmailTouched] = react.useState(false);
   const [password, setPassword] = react.useState("");
   const [confirmPassword, setConfirmPassword] = react.useState("");
@@ -1517,7 +1581,7 @@ function SignupForm({
       provider,
       options: buildOAuthSignInOptions(
         provider,
-        buildOAuthRedirectTo(siteUrl, mergedLinks.defaultRedirect)
+        buildOAuthRedirectTo(siteUrl, redirectTo)
       )
     });
     if (error) {
@@ -1552,7 +1616,7 @@ function SignupForm({
       email: email.trim(),
       password,
       options: {
-        emailRedirectTo: `${siteUrl}/callback`,
+        emailRedirectTo: buildOAuthRedirectTo(siteUrl, redirectTo),
         // Pass all consent values as user metadata
         data: consentState
       }
@@ -1570,7 +1634,7 @@ function SignupForm({
     } else if (data.user) {
       const userId = data.user.id;
       onAuthEvent?.onSignUpSuccess?.(userId, email.trim());
-      router.push(mergedLinks.defaultRedirect);
+      router.push(redirectTo);
       router.refresh();
     } else {
       onAuthEvent?.onSignUpFailure?.(email.trim(), "no_user_data_in_response");
@@ -1586,7 +1650,7 @@ function SignupForm({
         logo,
         ImageComponent: Image,
         createClient,
-        redirectTo: mergedLinks.home,
+        redirectTo,
         className
       }
     );
@@ -1608,7 +1672,7 @@ function SignupForm({
             AuthHeader,
             {
               logo: showLogo !== false ? logo : void 0,
-              title: `Sign up for ${appName}`,
+              title: title ?? `Sign up for ${appName}`,
               ImageComponent: Image
             }
           ),
@@ -3722,6 +3786,7 @@ function useVerificationFlow({
   };
 }
 function EmailSection({
+  changeButtonPresentation = "label",
   createClient,
   userId: _userId,
   email,
@@ -3749,6 +3814,26 @@ function EmailSection({
   const handleStartChange = () => {
     openEntryStep();
   };
+  const changeButton = changeButtonPresentation === "icon" ? /* @__PURE__ */ jsxRuntime.jsx(
+    primitives.Button,
+    {
+      "aria-label": "Change email",
+      onClick: handleStartChange,
+      size: "icon-sm",
+      type: "button",
+      variant: "outline",
+      children: /* @__PURE__ */ jsxRuntime.jsx(lucideReact.PencilLine, { "aria-hidden": "true", className: "size-4" })
+    }
+  ) : /* @__PURE__ */ jsxRuntime.jsx(
+    primitives.Button,
+    {
+      onClick: handleStartChange,
+      size: "sm",
+      type: "button",
+      variant: "outline",
+      children: "Change"
+    }
+  );
   const handleSendCode = async () => {
     if (!newEmail || !newEmail.includes("@")) {
       setError("Please enter a valid email address");
@@ -3828,16 +3913,10 @@ function EmailSection({
         /* @__PURE__ */ jsxRuntime.jsx("p", { className: "text-sm text-muted-foreground", children: email })
       ] })
     ] }),
-    /* @__PURE__ */ jsxRuntime.jsx(
-      primitives.Button,
-      {
-        type: "button",
-        variant: "outline",
-        size: "sm",
-        onClick: handleStartChange,
-        children: "Change"
-      }
-    ),
+    changeButtonPresentation === "icon" ? /* @__PURE__ */ jsxRuntime.jsx(primitives.TooltipProvider, { delayDuration: 300, children: /* @__PURE__ */ jsxRuntime.jsxs(primitives.Tooltip, { children: [
+      /* @__PURE__ */ jsxRuntime.jsx(primitives.TooltipTrigger, { asChild: true, children: changeButton }),
+      /* @__PURE__ */ jsxRuntime.jsx(primitives.TooltipContent, { side: "top", children: "Change email" })
+    ] }) }) : changeButton,
     /* @__PURE__ */ jsxRuntime.jsx(primitives.Dialog, { open: dialogOpen, onOpenChange: handleOpenChange, children: /* @__PURE__ */ jsxRuntime.jsxs(primitives.DialogContent, { className: "sm:max-w-md", children: [
       step === "enter-email" && /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
         /* @__PURE__ */ jsxRuntime.jsxs(primitives.DialogHeader, { children: [
@@ -5535,12 +5614,6 @@ var EMAIL_OTP_TYPES = [
   "email_change",
   "email"
 ];
-function getSafeRedirectPath(candidate, fallback) {
-  if (candidate?.startsWith("/") && !candidate.startsWith("//")) {
-    return candidate;
-  }
-  return fallback;
-}
 function getEmailOtpType(value) {
   if (!value) {
     return null;
@@ -5631,8 +5704,9 @@ function createRedirectResponse(target, origin) {
   if (target instanceof URL) {
     return server.NextResponse.redirect(target.toString());
   }
-  if (target.startsWith("/") && !target.startsWith("//")) {
-    return server.NextResponse.redirect(`${origin}${target}`);
+  const safeTarget = getSafeInternalRedirect(target, null);
+  if (safeTarget) {
+    return server.NextResponse.redirect(`${origin}${safeTarget}`);
   }
   return null;
 }
@@ -5694,15 +5768,20 @@ function createAuthCallbackHandler({
   isLinkingFlow = isDefaultLinkingFlow,
   resolveLinkingErrorMessage
 }) {
+  const safeDefaultRedirect = getSafeInternalRedirect(
+    defaultRedirect,
+    "/dashboard"
+  );
+  const safeSignInPath = getSafeInternalRedirect(signInPath, "/signin");
   return async function GET(request) {
     const requestUrl = new URL(request.url);
     const code = requestUrl.searchParams.get("code");
     const tokenHash = requestUrl.searchParams.get("token_hash");
     const rawOtpType = requestUrl.searchParams.get("type");
     const otpType = getEmailOtpType(rawOtpType);
-    const next = getSafeRedirectPath(
+    const next = getSafeInternalRedirect(
       requestUrl.searchParams.get("next") ?? requestUrl.searchParams.get("redirect_to"),
-      defaultRedirect
+      safeDefaultRedirect
     );
     const origin = requestUrl.origin;
     const error = requestUrl.searchParams.get("error");
@@ -5724,7 +5803,7 @@ function createAuthCallbackHandler({
         return linkingErrorRedirect;
       }
       return server.NextResponse.redirect(
-        `${origin}${signInPath}?error=${encodeURIComponent(message)}`
+        `${origin}${safeSignInPath}?error=${encodeURIComponent(message)}`
       );
     }
     if (code) {
@@ -5739,7 +5818,7 @@ function createAuthCallbackHandler({
           flow: "oauth",
           postAuthHook,
           postAuthHookErrorMode,
-          signInPath,
+          signInPath: safeSignInPath,
           resolveSuccessRedirect
         });
       }
@@ -5759,13 +5838,13 @@ function createAuthCallbackHandler({
         return linkingErrorRedirect;
       }
       return server.NextResponse.redirect(
-        `${origin}${signInPath}?error=${encodeURIComponent(errorMessage)}`
+        `${origin}${safeSignInPath}?error=${encodeURIComponent(errorMessage)}`
       );
     }
     if (tokenHash || rawOtpType) {
       if (!tokenHash || !otpType) {
         return server.NextResponse.redirect(
-          `${origin}${signInPath}?error=${encodeURIComponent("Invalid verification link")}`
+          `${origin}${safeSignInPath}?error=${encodeURIComponent("Invalid verification link")}`
         );
       }
       const supabase = await createClient();
@@ -5783,16 +5862,16 @@ function createAuthCallbackHandler({
           otpType,
           postAuthHook,
           postAuthHookErrorMode,
-          signInPath,
+          signInPath: safeSignInPath,
           resolveSuccessRedirect
         });
       }
       return server.NextResponse.redirect(
-        `${origin}${signInPath}?error=${encodeURIComponent(verifyError.message)}`
+        `${origin}${safeSignInPath}?error=${encodeURIComponent(verifyError.message)}`
       );
     }
     return server.NextResponse.redirect(
-      `${origin}${signInPath}?error=No authorization code received`
+      `${origin}${safeSignInPath}?error=No authorization code received`
     );
   };
 }