@canonry/canonry 7.78.0 → 7.78.2

package/dist/{chunk-M3BUP6XD.js → chunk-PRCBHOVR.js}

@@ -157,7 +157,7 @@ import {
   userSessions,
   users,
   writeNegativeReviewMaxStars
-} from "./chunk-6VBLPCCX.js";
+} from "./chunk-PH4AESRE.js";
 import {
   ADS_ACTIVATE_SCOPE,
   ADS_ACTIVATION_ABSOLUTE_MAX_ENTITIES,
@@ -7957,6 +7957,8 @@ h1 { margin: 0; font-size: 24px; line-height: 32px; font-weight: 600; letter-spa
 p { margin: 0; overflow-wrap: anywhere; }
 .intro { color: var(--secondary); margin-top: 8px; }
 strong { color: var(--text); font-weight: 550; }
+a { color: var(--text); text-decoration: underline; text-decoration-color: var(--border-strong); text-underline-offset: 3px; }
+a:hover { text-decoration-color: var(--text); }
 .err { margin-top: 16px; color: var(--negative); }
 .warn { margin-top: 16px; padding: 12px; border: 1px solid var(--caution-border); border-radius: 6px; background: var(--caution-surface); color: var(--caution); font-size: 13px; line-height: 20px; }
 .grant { margin: 24px 0 0; padding: 16px 0 20px; border-top: 1px solid var(--border); border-bottom: 1px solid var(--border); font-size: 13px; line-height: 20px; }
@@ -7979,7 +7981,7 @@ button { min-height: 36px; border: 1px solid transparent; border-radius: 6px; pa
 .secondary { border-color: var(--border); background: var(--surface); color: var(--text); }
 .secondary:hover { background: var(--hover); border-color: var(--border-strong); }
 .secondary:active { background: var(--border); }
-:where(input, button):focus-visible { outline: 2px solid var(--focus); outline-offset: 3px; }
+:where(input, button, a):focus-visible { outline: 2px solid var(--focus); outline-offset: 3px; }
 @media (max-width: 480px) {
   main { padding: 32px 16px; align-items: flex-start; }
   .panel { padding: 24px; }
@@ -8004,11 +8006,11 @@ function fontFace(fontUrl) {
   src: url('${fontUrl}') format('woff2');
 }`;
 }
-function gatePage(title, body, fontUrl) {
+function gatePage(title, body, fontUrl, head = "") {
   return `<!doctype html>
 <html lang="en"><head>
 <meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
-<meta name="color-scheme" content="dark"><meta name="theme-color" content="#0a0a0a">
+<meta name="color-scheme" content="dark"><meta name="theme-color" content="#0a0a0a">${head}
 <title>${title} \xB7 Canonry</title>
 <style>${fontFace(fontUrl)}${styles}</style>
 </head><body><main><div class="gate">
@@ -8043,6 +8045,18 @@ ${o.scope.split(/\s+/).includes(RESEARCH_RUN_SCOPE) ? `<p class="warn">Run resea
 <div class="actions"><button class="primary" type="submit" name="approve" value="yes">Allow</button><button class="secondary" type="submit" name="approve" value="no">Deny</button></div>
 </form>`, o.fontUrl);
 }
+function renderAuthorizationHandoff(o) {
+  const target = escapeHtml(o.target);
+  const title = o.approved ? "Access allowed" : "Access denied";
+  return gatePage(
+    title,
+    `<h1 id="gate-title">${title}</h1>
+<p class="intro">Returning you to <strong>${escapeHtml(o.clientName)}</strong>. If nothing happens, <a href="${target}" rel="noreferrer">continue</a>.</p>`,
+    o.fontUrl,
+    `
+<meta http-equiv="refresh" content="0;url=${target}">`
+  );
+}
 
 // ../api-routes/src/oauth.ts
 var CODE_TTL_MS = 6e4;
@@ -8100,6 +8114,12 @@ function sendGatePage(reply, html) {
     "frame-ancestors 'none'; default-src 'none'; style-src 'unsafe-inline'; font-src 'self'; form-action 'self'"
   ).header("x-frame-options", "DENY").header("referrer-policy", "same-origin").header("cache-control", "no-store").type("text/html").send(html);
 }
+function sendHandoffPage(reply, html) {
+  return reply.header(
+    "content-security-policy",
+    "frame-ancestors 'none'; default-src 'none'; style-src 'unsafe-inline'; font-src 'self'; form-action 'none'; base-uri 'none'"
+  ).header("x-frame-options", "DENY").header("referrer-policy", "no-referrer").header("cache-control", "no-store").type("text/html").send(html);
+}
 var CONSENT_SECRET = crypto10.randomBytes(32);
 function registerOAuthRoutes(app, opts) {
   void app.register(async (scope) => {
@@ -8126,6 +8146,12 @@ function registerOAuthRoutesIn(app, opts) {
   function consentToken(userId, clientId, redirectUri, scope) {
     return crypto10.createHmac("sha256", CONSENT_SECRET).update([userId, clientId, redirectUri, scope].join("\0")).digest("base64url");
   }
+  function selfRegistered(client) {
+    if (client.registration !== "dynamic") return false;
+    const gateway = opts.gatewayClient;
+    const vouched = gateway !== void 0 && client.id === gateway.id && client.redirectUris.length > 0 && client.redirectUris.every((uri) => URL.canParse(uri) && new URL(uri).origin === gateway.origin);
+    return !vouched;
+  }
   function authorizationServerMetadata() {
     return {
       issuer,
@@ -8201,7 +8227,7 @@ function registerOAuthRoutesIn(app, opts) {
     return sendGatePage(reply, renderConsentPage({
       action: request.url,
       clientName: client.name,
-      selfRegistered: client.registration === "dynamic",
+      selfRegistered: selfRegistered(client),
       redirectUri,
       scope: grantedScope,
       userName: user.name,
@@ -8239,7 +8265,12 @@ function registerOAuthRoutesIn(app, opts) {
       const denied = new URL(redirectUri);
       denied.searchParams.set("error", "access_denied");
       if (q.state) denied.searchParams.set("state", q.state);
-      return reply.redirect(denied.toString());
+      return sendHandoffPage(reply, renderAuthorizationHandoff({
+        target: denied.toString(),
+        approved: false,
+        clientName: client.name,
+        fontUrl: opts.fontUrl
+      }));
     }
     const code = newToken();
     const now = /* @__PURE__ */ new Date();
@@ -8258,7 +8289,12 @@ function registerOAuthRoutesIn(app, opts) {
     target.searchParams.set("code", code);
     if (q.state) target.searchParams.set("state", q.state);
     target.searchParams.set("iss", issuer);
-    return reply.redirect(target.toString());
+    return sendHandoffPage(reply, renderAuthorizationHandoff({
+      target: target.toString(),
+      approved: true,
+      clientName: client.name,
+      fontUrl: opts.fontUrl
+    }));
   });
   const registrations = /* @__PURE__ */ new Map();
   let registrationsThisWindow = [];

package/dist/{chunk-QXSOXDUR.js → chunk-R26CF4WT.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-VJWDBFSL.js";
 import {
   createApiClient
-} from "./chunk-C5WSQXP5.js";
+} from "./chunk-7OAXEMOF.js";
 import {
   CliError,
   isMachineFormat