@caffeinebounce/identity 0.12.1 → 0.12.3

package/dist/index.mjs

@@ -1,8 +1,8 @@
 "use client";
-import { cn, FieldLabel, Input, Button, PasswordInput, defaultPasswordRules, FieldError, PasswordRequirements, Checkbox, Select, SelectTrigger, SelectValue, SelectContent, SelectItem, Badge, Tooltip, TooltipTrigger, TooltipContent, Dialog, DialogContent, DialogHeader, DialogTitle, DialogDescription, Label, DialogFooter, Spinner, extendedPasswordRules, VerificationCodeInput, Tabs, TabsList, TabsTrigger, TabsContent, InputOTP, InputOTPGroup, InputOTPSlot, InputOTPSeparator } from '@caffeinebounce/ui/primitives';
+import { cn, FieldLabel, Input, Button, PasswordInput, defaultPasswordRules, FieldError, PasswordRequirements, Checkbox, Select, SelectTrigger, SelectValue, SelectContent, SelectItem, Badge, Tooltip, TooltipTrigger, TooltipContent, Dialog, DialogContent, DialogHeader, DialogTitle, DialogDescription, Label, DialogFooter, TooltipProvider, Spinner, extendedPasswordRules, VerificationCodeInput, Tabs, TabsList, TabsTrigger, TabsContent, InputOTP, InputOTPGroup, InputOTPSlot, InputOTPSeparator } from '@caffeinebounce/ui/primitives';
 import { useSearchParams, useRouter } from 'next/navigation';
 import { createContext, useState, useEffect, useCallback, useRef, useMemo, useContext } from 'react';
-import { ArrowLeft, AlertCircle, Loader2, Shield, AlertTriangle, Smartphone, Check, Mail, KeyRound, Info, Trash2, CheckCircle2, Link2, Unlink, Phone, Copy, Download, Lightbulb, X } from 'lucide-react';
+import { ArrowLeft, AlertCircle, Loader2, Shield, AlertTriangle, Smartphone, Check, Mail, KeyRound, Info, Trash2, CheckCircle2, Link2, Unlink, Phone, Copy, Download, Lightbulb, X, PencilLine } from 'lucide-react';
 import { jsxs, Fragment, jsx } from 'react/jsx-runtime';
 import { getClientOrigin, generateDeviceFingerprint, formatPhoneInput, isPreviewEnvironment, formatDate } from '@caffeinebounce/shared-utils';
 export { generateDeviceFingerprint, generateSecureToken, getClientIP, getGeolocationFromIP, hashString } from '@caffeinebounce/shared-utils';
@@ -14,6 +14,17 @@ import { REGEXP_ONLY_DIGITS } from 'input-otp';
 import { NextResponse } from 'next/server';
 
 // src/components/auth/EmailVerificationPending.tsx
+
+// src/types.ts
+var defaultAuthLinks = {
+  signIn: "/signin",
+  signUp: "/signup",
+  forgotPassword: "/forgot-password",
+  resetPassword: "/reset-password",
+  callback: "/callback",
+  home: "/",
+  defaultRedirect: "/dashboard"
+};
 function AuthFormLayout({
   children,
   footer,
@@ -50,6 +61,122 @@ function AuthFormLayout({
     ] }) })
   ] });
 }
+
+// src/utils/redirect.ts
+var INTERNAL_REDIRECT_BASE = new URL("https://identity.invalid");
+var ENCODED_PATH_SEPARATOR = /%(?:2f|5c)/i;
+function hasControlCharacter(value) {
+  return Array.from(value).some((character) => {
+    const code = character.charCodeAt(0);
+    return code <= 31 || code === 127;
+  });
+}
+function isStrictInternalRedirect(candidate) {
+  if (!candidate?.startsWith("/") || hasControlCharacter(candidate)) {
+    return false;
+  }
+  const pathEnd = candidate.search(/[?#]/);
+  const pathname = pathEnd === -1 ? candidate : candidate.slice(0, pathEnd);
+  if (pathname.includes("\\") || ENCODED_PATH_SEPARATOR.test(pathname)) {
+    return false;
+  }
+  try {
+    const target = new URL(candidate, INTERNAL_REDIRECT_BASE);
+    return target.origin === INTERNAL_REDIRECT_BASE.origin;
+  } catch {
+    return false;
+  }
+}
+function getSafeInternalRedirect(candidate, fallback) {
+  if (isStrictInternalRedirect(candidate)) {
+    return candidate;
+  }
+  if (fallback === null) {
+    return null;
+  }
+  return isStrictInternalRedirect(fallback) ? fallback : "/";
+}
+
+// src/components/auth/utils.ts
+var warnedSupabaseRedirectOrigins = /* @__PURE__ */ new Set();
+function hardRedirect(redirectTo) {
+  window.location.href = redirectTo;
+}
+function sanitizeAuthError(message) {
+  const lowerMessage = message.toLowerCase();
+  if (lowerMessage.includes("user already registered") || lowerMessage.includes("already registered") || lowerMessage.includes("already exists") || lowerMessage.includes("email already") || lowerMessage.includes("duplicate")) {
+    return "An account with this email already exists. Please sign in instead.";
+  }
+  if (lowerMessage.includes("invalid login credentials") || lowerMessage.includes("invalid credentials") || lowerMessage.includes("wrong password") || lowerMessage.includes("incorrect password")) {
+    return "Invalid email or password. Please try again.";
+  }
+  if (lowerMessage.includes("invalid email") || lowerMessage.includes("password")) {
+    return message;
+  }
+  if (message === "The string did not match the expected pattern.") {
+    return "Please check your email address format and try again.";
+  }
+  if (lowerMessage.includes("rate limit") || lowerMessage.includes("too many requests") || lowerMessage.includes("try again later")) {
+    return "Too many attempts. Please wait a moment and try again.";
+  }
+  if (lowerMessage.includes("hook") || lowerMessage.includes("authorization") || lowerMessage.includes("token") || lowerMessage.includes("internal") || lowerMessage.includes("server") || lowerMessage.includes("database") || lowerMessage.includes("connection")) {
+    return "An error occurred. Please try again.";
+  }
+  return "An error occurred. Please try again.";
+}
+function sanitizeSignupError(message) {
+  const sanitized = sanitizeAuthError(message);
+  if (sanitized === "An error occurred. Please try again.") {
+    return "An error occurred during sign up. Please try again.";
+  }
+  return sanitized;
+}
+function buildOAuthRedirectTo(origin, nextPath) {
+  const siteUrl = origin.replace(/\/$/, "");
+  return `${siteUrl}/callback?next=${encodeURIComponent(nextPath)}`;
+}
+function buildOAuthSignInOptions(provider, redirectTo, options = {}) {
+  return {
+    redirectTo,
+    ...provider === "azure" ? { scopes: "email" } : {},
+    ...options
+  };
+}
+function warnAboutSupabaseRedirectAllowlist(origin) {
+  const normalizedOrigin = origin.replace(/\/$/, "");
+  let hostname = "";
+  try {
+    hostname = new URL(normalizedOrigin).host;
+  } catch {
+    return;
+  }
+  if (!isPreviewEnvironment(hostname)) {
+    return;
+  }
+  if (warnedSupabaseRedirectOrigins.has(normalizedOrigin)) {
+    return;
+  }
+  warnedSupabaseRedirectOrigins.add(normalizedOrigin);
+  console.warn(
+    `[identity] Supabase redirect allowlist reminder: add "${normalizedOrigin}/**" to Supabase Auth > URL Configuration > Additional Redirect URLs. The auth components already use the active origin for callbacks, but Supabase must allow that origin too or OAuth/email flows can bounce to another host.`
+  );
+}
+function clearStalePKCEState() {
+  if (typeof window === "undefined") return;
+  try {
+    const keysToRemove = [];
+    for (let i = 0; i < localStorage.length; i++) {
+      const key = localStorage.key(i);
+      if (key?.includes("-code-verifier")) {
+        keysToRemove.push(key);
+      }
+    }
+    for (const key of keysToRemove) {
+      localStorage.removeItem(key);
+    }
+  } catch {
+  }
+}
 var POLL_INTERVAL_MS = 6e4;
 var MAX_POLL_COUNT = 60;
 function EmailVerificationPending({
@@ -120,9 +247,19 @@ function EmailVerificationPending({
     setResendStatus("sending");
     try {
       const supabase = createClient();
+      const safeRedirectTo = getSafeInternalRedirect(
+        redirectTo,
+        defaultAuthLinks.defaultRedirect
+      );
       const { error } = await supabase.auth.resend({
         type: "signup",
-        email
+        email,
+        options: {
+          emailRedirectTo: buildOAuthRedirectTo(
+            window.location.origin,
+            safeRedirectTo
+          )
+        }
       });
       if (error) {
         setResendStatus("error");
@@ -242,17 +379,6 @@ function EmailVerificationPending({
     }
   );
 }
-
-// src/types.ts
-var defaultAuthLinks = {
-  signIn: "/signin",
-  signUp: "/signup",
-  forgotPassword: "/forgot-password",
-  resetPassword: "/reset-password",
-  callback: "/callback",
-  home: "/",
-  defaultRedirect: "/dashboard"
-};
 function AuthHeader({
   logo,
   title,
@@ -274,82 +400,6 @@ function AuthHeader({
     /* @__PURE__ */ jsx("h1", { className: "text-2xl font-semibold tracking-tight text-foreground", children: title })
   ] });
 }
-var warnedSupabaseRedirectOrigins = /* @__PURE__ */ new Set();
-function sanitizeAuthError(message) {
-  const lowerMessage = message.toLowerCase();
-  if (lowerMessage.includes("user already registered") || lowerMessage.includes("already registered") || lowerMessage.includes("already exists") || lowerMessage.includes("email already") || lowerMessage.includes("duplicate")) {
-    return "An account with this email already exists. Please sign in instead.";
-  }
-  if (lowerMessage.includes("invalid login credentials") || lowerMessage.includes("invalid credentials") || lowerMessage.includes("wrong password") || lowerMessage.includes("incorrect password")) {
-    return "Invalid email or password. Please try again.";
-  }
-  if (lowerMessage.includes("invalid email") || lowerMessage.includes("password")) {
-    return message;
-  }
-  if (message === "The string did not match the expected pattern.") {
-    return "Please check your email address format and try again.";
-  }
-  if (lowerMessage.includes("rate limit") || lowerMessage.includes("too many requests") || lowerMessage.includes("try again later")) {
-    return "Too many attempts. Please wait a moment and try again.";
-  }
-  if (lowerMessage.includes("hook") || lowerMessage.includes("authorization") || lowerMessage.includes("token") || lowerMessage.includes("internal") || lowerMessage.includes("server") || lowerMessage.includes("database") || lowerMessage.includes("connection")) {
-    return "An error occurred. Please try again.";
-  }
-  return "An error occurred. Please try again.";
-}
-function sanitizeSignupError(message) {
-  const sanitized = sanitizeAuthError(message);
-  if (sanitized === "An error occurred. Please try again.") {
-    return "An error occurred during sign up. Please try again.";
-  }
-  return sanitized;
-}
-function buildOAuthRedirectTo(origin, nextPath) {
-  const siteUrl = origin.replace(/\/$/, "");
-  return `${siteUrl}/callback?next=${encodeURIComponent(nextPath)}`;
-}
-function buildOAuthSignInOptions(provider, redirectTo, options = {}) {
-  return {
-    redirectTo,
-    ...provider === "azure" ? { scopes: "email" } : {},
-    ...options
-  };
-}
-function warnAboutSupabaseRedirectAllowlist(origin) {
-  const normalizedOrigin = origin.replace(/\/$/, "");
-  let hostname = "";
-  try {
-    hostname = new URL(normalizedOrigin).host;
-  } catch {
-    return;
-  }
-  if (!isPreviewEnvironment(hostname)) {
-    return;
-  }
-  if (warnedSupabaseRedirectOrigins.has(normalizedOrigin)) {
-    return;
-  }
-  warnedSupabaseRedirectOrigins.add(normalizedOrigin);
-  console.warn(
-    `[identity] Supabase redirect allowlist reminder: add "${normalizedOrigin}/**" to Supabase Auth > URL Configuration > Additional Redirect URLs. The auth components already use the active origin for callbacks, but Supabase must allow that origin too or OAuth/email flows can bounce to another host.`
-  );
-}
-function clearStalePKCEState() {
-  if (typeof window === "undefined") return;
-  try {
-    const keysToRemove = [];
-    for (let i = 0; i < localStorage.length; i++) {
-      const key = localStorage.key(i);
-      if (key?.includes("-code-verifier")) {
-        keysToRemove.push(key);
-      }
-    }
-    for (const key of keysToRemove) {
-      localStorage.removeItem(key);
-    }
-  } catch {
-  }
-}
 function ForgotPasswordForm({
   createClient,
   logo,
@@ -1090,7 +1140,14 @@ function SigninForm({
   const oauthTimeoutRef = useRef(null);
   const router = useRouter();
   const searchParams = useSearchParams();
-  const redirectTo = searchParams.get("redirect") || mergedLinks.defaultRedirect;
+  const defaultRedirect = getSafeInternalRedirect(
+    mergedLinks.defaultRedirect,
+    defaultAuthLinks.defaultRedirect
+  );
+  const redirectTo = getSafeInternalRedirect(
+    searchParams.get("redirect"),
+    defaultRedirect
+  );
   const message = searchParams.get("message");
   const mfaRequired = searchParams.get("mfa") === "required";
   const [showMFA, setShowMFA] = useState(mfaRequired);
@@ -1262,7 +1319,7 @@ function SigninForm({
       } else {
         onAuthEvent?.onSignInSuccess?.(userId, email.trim(), false);
         recordSignIn("email", email.trim());
-        window.location.href = redirectTo;
+        hardRedirect(redirectTo);
       }
     } catch (err) {
       logError(err, {
@@ -1422,10 +1479,13 @@ function SigninForm({
     }
   );
 }
+var EMPTY_CONSENT_ITEMS = [];
 function SignupForm({
   createClient,
   logo,
   appName = "your account",
+  title,
+  initialEmail = "",
   termsUrl = "/terms",
   privacyUrl = "/privacy",
   links = {},
@@ -1437,7 +1497,7 @@ function SignupForm({
   oauthIconMonochromeOnHover = false,
   className,
   onAuthEvent,
-  consentItems = [],
+  consentItems = EMPTY_CONSENT_ITEMS,
   consentPosition = "above",
   consentSize = "default",
   showHomeLink = true,
@@ -1447,7 +1507,11 @@ function SignupForm({
   const Link = LinkComponent;
   const Image = ImageComponent;
   const router = useRouter();
-  const [email, setEmail] = useState("");
+  const redirectTo = getSafeInternalRedirect(
+    mergedLinks.defaultRedirect,
+    defaultAuthLinks.defaultRedirect
+  );
+  const [email, setEmail] = useState(initialEmail);
   const [emailTouched, setEmailTouched] = useState(false);
   const [password, setPassword] = useState("");
   const [confirmPassword, setConfirmPassword] = useState("");
@@ -1512,7 +1576,7 @@ function SignupForm({
       provider,
       options: buildOAuthSignInOptions(
         provider,
-        buildOAuthRedirectTo(siteUrl, mergedLinks.defaultRedirect)
+        buildOAuthRedirectTo(siteUrl, redirectTo)
       )
     });
     if (error) {
@@ -1547,7 +1611,7 @@ function SignupForm({
       email: email.trim(),
       password,
       options: {
-        emailRedirectTo: `${siteUrl}/callback`,
+        emailRedirectTo: buildOAuthRedirectTo(siteUrl, redirectTo),
         // Pass all consent values as user metadata
         data: consentState
       }
@@ -1565,7 +1629,7 @@ function SignupForm({
     } else if (data.user) {
       const userId = data.user.id;
       onAuthEvent?.onSignUpSuccess?.(userId, email.trim());
-      router.push(mergedLinks.defaultRedirect);
+      router.push(redirectTo);
       router.refresh();
     } else {
       onAuthEvent?.onSignUpFailure?.(email.trim(), "no_user_data_in_response");
@@ -1581,7 +1645,7 @@ function SignupForm({
         logo,
         ImageComponent: Image,
         createClient,
-        redirectTo: mergedLinks.home,
+        redirectTo,
         className
       }
     );
@@ -1603,7 +1667,7 @@ function SignupForm({
             AuthHeader,
             {
               logo: showLogo !== false ? logo : void 0,
-              title: `Sign up for ${appName}`,
+              title: title ?? `Sign up for ${appName}`,
               ImageComponent: Image
             }
           ),
@@ -3717,6 +3781,7 @@ function useVerificationFlow({
   };
 }
 function EmailSection({
+  changeButtonPresentation = "label",
   createClient,
   userId: _userId,
   email,
@@ -3744,6 +3809,26 @@ function EmailSection({
   const handleStartChange = () => {
     openEntryStep();
   };
+  const changeButton = changeButtonPresentation === "icon" ? /* @__PURE__ */ jsx(
+    Button,
+    {
+      "aria-label": "Change email",
+      onClick: handleStartChange,
+      size: "icon-sm",
+      type: "button",
+      variant: "outline",
+      children: /* @__PURE__ */ jsx(PencilLine, { "aria-hidden": "true", className: "size-4" })
+    }
+  ) : /* @__PURE__ */ jsx(
+    Button,
+    {
+      onClick: handleStartChange,
+      size: "sm",
+      type: "button",
+      variant: "outline",
+      children: "Change"
+    }
+  );
   const handleSendCode = async () => {
     if (!newEmail || !newEmail.includes("@")) {
       setError("Please enter a valid email address");
@@ -3823,16 +3908,10 @@ function EmailSection({
         /* @__PURE__ */ jsx("p", { className: "text-sm text-muted-foreground", children: email })
       ] })
     ] }),
-    /* @__PURE__ */ jsx(
-      Button,
-      {
-        type: "button",
-        variant: "outline",
-        size: "sm",
-        onClick: handleStartChange,
-        children: "Change"
-      }
-    ),
+    changeButtonPresentation === "icon" ? /* @__PURE__ */ jsx(TooltipProvider, { delayDuration: 300, children: /* @__PURE__ */ jsxs(Tooltip, { children: [
+      /* @__PURE__ */ jsx(TooltipTrigger, { asChild: true, children: changeButton }),
+      /* @__PURE__ */ jsx(TooltipContent, { side: "top", children: "Change email" })
+    ] }) }) : changeButton,
     /* @__PURE__ */ jsx(Dialog, { open: dialogOpen, onOpenChange: handleOpenChange, children: /* @__PURE__ */ jsxs(DialogContent, { className: "sm:max-w-md", children: [
       step === "enter-email" && /* @__PURE__ */ jsxs(Fragment, { children: [
         /* @__PURE__ */ jsxs(DialogHeader, { children: [
@@ -5530,12 +5609,6 @@ var EMAIL_OTP_TYPES = [
   "email_change",
   "email"
 ];
-function getSafeRedirectPath(candidate, fallback) {
-  if (candidate?.startsWith("/") && !candidate.startsWith("//")) {
-    return candidate;
-  }
-  return fallback;
-}
 function getEmailOtpType(value) {
   if (!value) {
     return null;
@@ -5626,8 +5699,9 @@ function createRedirectResponse(target, origin) {
   if (target instanceof URL) {
     return NextResponse.redirect(target.toString());
   }
-  if (target.startsWith("/") && !target.startsWith("//")) {
-    return NextResponse.redirect(`${origin}${target}`);
+  const safeTarget = getSafeInternalRedirect(target, null);
+  if (safeTarget) {
+    return NextResponse.redirect(`${origin}${safeTarget}`);
   }
   return null;
 }
@@ -5689,15 +5763,20 @@ function createAuthCallbackHandler({
   isLinkingFlow = isDefaultLinkingFlow,
   resolveLinkingErrorMessage
 }) {
+  const safeDefaultRedirect = getSafeInternalRedirect(
+    defaultRedirect,
+    "/dashboard"
+  );
+  const safeSignInPath = getSafeInternalRedirect(signInPath, "/signin");
   return async function GET(request) {
     const requestUrl = new URL(request.url);
     const code = requestUrl.searchParams.get("code");
     const tokenHash = requestUrl.searchParams.get("token_hash");
     const rawOtpType = requestUrl.searchParams.get("type");
     const otpType = getEmailOtpType(rawOtpType);
-    const next = getSafeRedirectPath(
+    const next = getSafeInternalRedirect(
       requestUrl.searchParams.get("next") ?? requestUrl.searchParams.get("redirect_to"),
-      defaultRedirect
+      safeDefaultRedirect
     );
     const origin = requestUrl.origin;
     const error = requestUrl.searchParams.get("error");
@@ -5719,7 +5798,7 @@ function createAuthCallbackHandler({
         return linkingErrorRedirect;
       }
       return NextResponse.redirect(
-        `${origin}${signInPath}?error=${encodeURIComponent(message)}`
+        `${origin}${safeSignInPath}?error=${encodeURIComponent(message)}`
       );
     }
     if (code) {
@@ -5734,7 +5813,7 @@ function createAuthCallbackHandler({
           flow: "oauth",
           postAuthHook,
           postAuthHookErrorMode,
-          signInPath,
+          signInPath: safeSignInPath,
           resolveSuccessRedirect
         });
       }
@@ -5754,13 +5833,13 @@ function createAuthCallbackHandler({
         return linkingErrorRedirect;
       }
       return NextResponse.redirect(
-        `${origin}${signInPath}?error=${encodeURIComponent(errorMessage)}`
+        `${origin}${safeSignInPath}?error=${encodeURIComponent(errorMessage)}`
       );
     }
     if (tokenHash || rawOtpType) {
       if (!tokenHash || !otpType) {
         return NextResponse.redirect(
-          `${origin}${signInPath}?error=${encodeURIComponent("Invalid verification link")}`
+          `${origin}${safeSignInPath}?error=${encodeURIComponent("Invalid verification link")}`
         );
       }
       const supabase = await createClient();
@@ -5778,16 +5857,16 @@ function createAuthCallbackHandler({
           otpType,
           postAuthHook,
           postAuthHookErrorMode,
-          signInPath,
+          signInPath: safeSignInPath,
           resolveSuccessRedirect
         });
       }
       return NextResponse.redirect(
-        `${origin}${signInPath}?error=${encodeURIComponent(verifyError.message)}`
+        `${origin}${safeSignInPath}?error=${encodeURIComponent(verifyError.message)}`
       );
     }
     return NextResponse.redirect(
-      `${origin}${signInPath}?error=No authorization code received`
+      `${origin}${safeSignInPath}?error=No authorization code received`
     );
   };
 }

package/dist/server.js

@@ -3,6 +3,43 @@
 var server = require('next/server');
 var sharedUtils = require('@caffeinebounce/shared-utils');
 
+// src/handlers/callback.ts
+
+// src/utils/redirect.ts
+var INTERNAL_REDIRECT_BASE = new URL("https://identity.invalid");
+var ENCODED_PATH_SEPARATOR = /%(?:2f|5c)/i;
+function hasControlCharacter(value) {
+  return Array.from(value).some((character) => {
+    const code = character.charCodeAt(0);
+    return code <= 31 || code === 127;
+  });
+}
+function isStrictInternalRedirect(candidate) {
+  if (!candidate?.startsWith("/") || hasControlCharacter(candidate)) {
+    return false;
+  }
+  const pathEnd = candidate.search(/[?#]/);
+  const pathname = pathEnd === -1 ? candidate : candidate.slice(0, pathEnd);
+  if (pathname.includes("\\") || ENCODED_PATH_SEPARATOR.test(pathname)) {
+    return false;
+  }
+  try {
+    const target = new URL(candidate, INTERNAL_REDIRECT_BASE);
+    return target.origin === INTERNAL_REDIRECT_BASE.origin;
+  } catch {
+    return false;
+  }
+}
+function getSafeInternalRedirect(candidate, fallback) {
+  if (isStrictInternalRedirect(candidate)) {
+    return candidate;
+  }
+  if (fallback === null) {
+    return null;
+  }
+  return isStrictInternalRedirect(fallback) ? fallback : "/";
+}
+
 // src/handlers/callback.ts
 var POST_AUTH_HOOK_ERROR_MESSAGE = "Authentication completed, but setup failed. Please try again.";
 var DEFAULT_LINKING_ACCOUNT_ERROR_MESSAGE = "This account is already connected to another account. Each external account can only be linked to one account.";
@@ -14,12 +51,6 @@ var EMAIL_OTP_TYPES = [
   "email_change",
   "email"
 ];
-function getSafeRedirectPath(candidate, fallback) {
-  if (candidate?.startsWith("/") && !candidate.startsWith("//")) {
-    return candidate;
-  }
-  return fallback;
-}
 function getEmailOtpType(value) {
   if (!value) {
     return null;
@@ -110,8 +141,9 @@ function createRedirectResponse(target, origin) {
   if (target instanceof URL) {
     return server.NextResponse.redirect(target.toString());
   }
-  if (target.startsWith("/") && !target.startsWith("//")) {
-    return server.NextResponse.redirect(`${origin}${target}`);
+  const safeTarget = getSafeInternalRedirect(target, null);
+  if (safeTarget) {
+    return server.NextResponse.redirect(`${origin}${safeTarget}`);
   }
   return null;
 }
@@ -173,15 +205,20 @@ function createAuthCallbackHandler({
   isLinkingFlow = isDefaultLinkingFlow,
   resolveLinkingErrorMessage
 }) {
+  const safeDefaultRedirect = getSafeInternalRedirect(
+    defaultRedirect,
+    "/dashboard"
+  );
+  const safeSignInPath = getSafeInternalRedirect(signInPath, "/signin");
   return async function GET(request) {
     const requestUrl = new URL(request.url);
     const code = requestUrl.searchParams.get("code");
     const tokenHash = requestUrl.searchParams.get("token_hash");
     const rawOtpType = requestUrl.searchParams.get("type");
     const otpType = getEmailOtpType(rawOtpType);
-    const next = getSafeRedirectPath(
+    const next = getSafeInternalRedirect(
       requestUrl.searchParams.get("next") ?? requestUrl.searchParams.get("redirect_to"),
-      defaultRedirect
+      safeDefaultRedirect
     );
     const origin = requestUrl.origin;
     const error = requestUrl.searchParams.get("error");
@@ -203,7 +240,7 @@ function createAuthCallbackHandler({
         return linkingErrorRedirect;
       }
       return server.NextResponse.redirect(
-        `${origin}${signInPath}?error=${encodeURIComponent(message)}`
+        `${origin}${safeSignInPath}?error=${encodeURIComponent(message)}`
       );
     }
     if (code) {
@@ -218,7 +255,7 @@ function createAuthCallbackHandler({
           flow: "oauth",
           postAuthHook,
           postAuthHookErrorMode,
-          signInPath,
+          signInPath: safeSignInPath,
           resolveSuccessRedirect
         });
       }
@@ -238,13 +275,13 @@ function createAuthCallbackHandler({
         return linkingErrorRedirect;
       }
       return server.NextResponse.redirect(
-        `${origin}${signInPath}?error=${encodeURIComponent(errorMessage)}`
+        `${origin}${safeSignInPath}?error=${encodeURIComponent(errorMessage)}`
       );
     }
     if (tokenHash || rawOtpType) {
       if (!tokenHash || !otpType) {
         return server.NextResponse.redirect(
-          `${origin}${signInPath}?error=${encodeURIComponent("Invalid verification link")}`
+          `${origin}${safeSignInPath}?error=${encodeURIComponent("Invalid verification link")}`
         );
       }
       const supabase = await createClient();
@@ -262,16 +299,16 @@ function createAuthCallbackHandler({
           otpType,
           postAuthHook,
           postAuthHookErrorMode,
-          signInPath,
+          signInPath: safeSignInPath,
           resolveSuccessRedirect
         });
       }
       return server.NextResponse.redirect(
-        `${origin}${signInPath}?error=${encodeURIComponent(verifyError.message)}`
+        `${origin}${safeSignInPath}?error=${encodeURIComponent(verifyError.message)}`
       );
     }
     return server.NextResponse.redirect(
-      `${origin}${signInPath}?error=No authorization code received`
+      `${origin}${safeSignInPath}?error=No authorization code received`
     );
   };
 }