@cedarjs/auth-dbauth-api 7.0.0-canary.3072 → 7.0.0-canary.3074

package/dist/DbAuthHandler.d.ts

@@ -231,6 +231,17 @@ export interface DbAuthHandlerOptions<TUser = UserType, TUserAttributes = Record
      * CORS settings, same as in createGraphqlHandler
      */
     cors?: CorsConfig;
+    /**
+     * Extra origins that are trusted for state-changing (non-GET) requests,
+     * on top of the request's own host and any origins already listed in
+     * `cors.origin`.
+     *
+     * Needed when the web side and API are on different origins and
+     * `cors.origin` isn't set to those origins, or when `cors.origin` is set
+     * to `true` -- reflecting any request origin is never treated as trust,
+     * so that combination requires listing trusted origins here explicitly.
+     */
+    trustedOrigins?: string | string[];
 }
 export interface SignupHandlerOptions<TUserAttributes> {
     username: string;
@@ -312,6 +323,8 @@ export declare class DbAuthHandler<TUser extends UserType, TUserAttributes = Rec
         body?: string | undefined;
         statusCode: number;
     }>;
+    _requestHost(): string | null;
+    _requestProtocol(): string | null;
     forgotPassword(): Promise<AuthMethodOutput>;
     getToken(): Promise<AuthMethodOutput>;
     login(): Promise<AuthMethodOutput>;
@@ -334,7 +347,6 @@ export declare class DbAuthHandler<TUser extends UserType, TUserAttributes = Rec
     }): (string | null)[];
     _createAuthProviderCookieString(): string;
     _createSessionCookieString<TIdType = any>(data: DbAuthSession<TIdType>, csrfToken: string): string;
-    _validateCsrf(): Promise<boolean>;
     _findUserByToken(token: string): Promise<any>;
     _clearResetToken(user: Record<string, unknown>): Promise<void>;
     _verifyUser(username: string | undefined, password: string | undefined): Promise<any>;
@@ -364,6 +376,11 @@ export declare class DbAuthHandler<TUser extends UserType, TUserAttributes = Rec
         body: string;
         headers: Headers;
     };
+    _forbidden(message: string): {
+        statusCode: number;
+        body: string;
+        headers: Headers;
+    };
     _getUserMatchCriteriaOptions(username: string, usernameMatchFlowOption: string | undefined): {
         [x: string]: string;
     } | {

package/dist/DbAuthHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DbAuthHandler.d.ts","sourceRoot":"","sources":["../src/DbAuthHandler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAG1B,wBAAwB,EAKzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,KAAK,EAAE,oBAAoB,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,YAAY,CAAA;AAIhF,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAuB3E,UAAU,iBAAiB,CAAC,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACnE;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;;;OAOG;IACH,OAAO,EAAE,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,eAAe,CAAC,KAAK,GAAG,CAAA;IAE7E;;;OAGG;IACH,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAA;IAElD;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,aAAa,CAAC,EAAE,MAAM,CAAA;QACtB,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;IAED;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,UAAU,yBAAyB,CAAC,KAAK,GAAG,QAAQ;IAClD;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,KAAK,GAAG,CAAA;IAC5C,MAAM,CAAC,EAAE;QACP,gBAAgB,CAAC,EAAE,MAAM,CAAA;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAA;QACzB,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;IACD,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,UAAU,gBAAgB,CAAC,KAAK,GAAG,QAAQ;IACzC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,GAAG,CAAA;IAC7B;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,yBAAyB,CAAC,EAAE,MAAM,CAAA;QAClC,gBAAgB,CAAC,EAAE,MAAM,CAAA;QACzB,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;IACD;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IAEf;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,UAAU,wBAAwB,CAAC,KAAK,GAAG,QAAQ;IACjD;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACpD,mBAAmB,EAAE,OAAO,CAAA;IAC5B,MAAM,CAAC,EAAE;QACP,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAA;QAC3B,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;CACF;AAED,UAAU,mBAAmB;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,KAAK,GAAG,UAAU,GAAG,gBAAgB,CAAA;IAC3C,gBAAgB,EAAE;QAChB,EAAE,EAAE,MAAM,CAAA;QACV,MAAM,EAAE,MAAM,CAAA;QACd,SAAS,EAAE,MAAM,CAAA;QACjB,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;CACF;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,GAAG,CAAC,CAAA;AAEnD,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC;IACnC,OAAO,EAAE;QACP,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;KAC/B,CAAA;IACD,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;CACnB,CAAC,CAAA;AAEF,KAAK,gBAAgB,GAAG;IACtB,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,GAAG,SAAS;IAClD,OAAO,CAAC;IACR;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CACxB,CAAA;AAED,MAAM,WAAW,oBAAoB,CACnC,KAAK,GAAG,QAAQ,EAChB,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACzC,GAAG,SAAS,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE5C;;;;;;;OAOG;IACH,EAAE,EAAE,GAAG,CAAA;IACP;;;OAGG;IACH,iBAAiB,EAAE,MAAM,GAAG,CAAA;IAC5B;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,GAAG,CAAA;IACnC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B;;;;OAIG;IACH,UAAU,EAAE;QACV,EAAE,EAAE,MAAM,CAAA;QACV,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;QACtB,IAAI,EAAE,MAAM,CAAA;QACZ,UAAU,EAAE,MAAM,CAAA;QAClB,mBAAmB,EAAE,MAAM,CAAA;QAC3B,SAAS,CAAC,EAAE,MAAM,CAAA;KACnB,CAAA;IACD;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,yDAAyD;QACzD,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,yDAAyD;QACzD,QAAQ,CAAC,EAAE,OAAO,CAAA;QAClB,yDAAyD;QACzD,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,yDAAyD;QACzD,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,yDAAyD;QACzD,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,UAAU,CAAC,EAAE;YACX,IAAI,CAAC,EAAE,MAAM,CAAA;YACb,QAAQ,CAAC,EAAE,OAAO,CAAA;YAClB,MAAM,CAAC,EAAE,OAAO,CAAA;YAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;YACjB,MAAM,CAAC,EAAE,MAAM,CAAA;SAChB,CAAA;QACD;;;;;;WAMG;QACH,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;IACD;;OAEG;IACH,cAAc,EAAE,yBAAyB,CAAC,KAAK,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IACrE;;OAEG;IACH,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IACnD;;OAEG;IACH,aAAa,EAAE,wBAAwB,CAAC,KAAK,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IACnE;;OAEG;IACH,MAAM,EAAE,iBAAiB,CAAC,eAAe,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IAE/D;;OAEG;IACH,QAAQ,CAAC,EAAE,mBAAmB,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IAEnD;;OAEG;IACH,IAAI,CAAC,EAAE,UAAU,CAAA;CAClB;AAED,MAAM,WAAW,oBAAoB,CAAC,eAAe;IACnD,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,CAAC,EAAE,eAAe,CAAA;CACjC;AAED,MAAM,MAAM,eAAe,GACvB,gBAAgB,GAChB,UAAU,GACV,OAAO,GACP,QAAQ,GACR,eAAe,GACf,QAAQ,GACR,sBAAsB,GACtB,qBAAqB,GACrB,oBAAoB,GACpB,kBAAkB,GAClB,oBAAoB,CAAA;AAExB,KAAK,MAAM,GAAG,0BAA0B,GACtC,wBAAwB,GAAG;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,eAAe,CAAA;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CACnB,GAAG;IACF,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,CAAA;AAEH,KAAK,aAAa,CAAC,CAAC,GAAG,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;AACnD,KAAK,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AAIzC,qBAAa,aAAa,CACxB,KAAK,SAAS,QAAQ,EACtB,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACzC,GAAG,SAAS,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE5C,KAAK,EAAE,OAAO,GAAG,oBAAoB,CAAA;IACrC,kBAAkB,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IACtD,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC,CAAA;IAC1D,MAAM,EAAE,MAAM,CAAA;IACd,EAAE,EAAE,GAAG,CAAA;IACP,UAAU,EAAE,GAAG,CAAA;IACf,oBAAoB,EAAE,GAAG,CAAA;IACzB,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,iBAAiB,EAAE,OAAO,CAAA;IAC1B,OAAO,EAAE,aAAa,GAAG,SAAS,CAAA;IAClC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAA;IACpC,WAAW,EAAE,WAAW,GAAG,SAAS,CAAA;IACpC,kBAAkB,EAAE,MAAM,CAAA;IAC1B,mBAAmB,EAAE,MAAM,CAAA;IAC3B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAO;IACtC,cAAc,EAAE,CACd,QAAQ,EAAE;QACR,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,CAAC,EAAE,OAAO,CAAA;KAClB,EACD,WAAW,EAAE,WAAW,KACrB;QACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAA;QAC1C,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACzB,UAAU,EAAE,MAAM,CAAA;KACnB,CAAA;IAED,IAAW,iBAAiB,2BAS3B;IAGD,MAAM,KAAK,OAAO,IAAI,eAAe,EAAE,CActC;IAGD,MAAM,KAAK,KAAK;;;;;;;;;;;;MAcf;IAGD,MAAM,KAAK,iBAAiB,WAE3B;IAGD,MAAM,KAAK,UAAU,WAEpB;IAED,MAAM,KAAK,6BAA6B,aAEvC;IAED;;;;;;;;OAQG;IACH,IAAI,oBAAoB,IAAI,OAAO,CAmBlC;gBAGC,KAAK,EAAE,oBAAoB,GAAG,OAAO,EACrC,QAAQ,EAAE,aAAa,EAAE,SAAS;IAClC,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC;IA6DtD,IAAI;IAUJ,MAAM;iBAxKD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;eACnC,MAAM,GAAG,SAAS;oBACb,MAAM;;IAwNd,cAAc,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA2E3C,QAAQ,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAqBrC,KAAK,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAuBxC,MAAM,IAAI,gBAAgB;IAIpB,aAAa,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA0E1C,MAAM,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA6BnC,kBAAkB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAgB/C,oBAAoB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA+FjD,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAkEhD,kBAAkB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAiD/C,gBAAgB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA2EnD,gBAAgB;IAkEV,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAYlE,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IAY3C,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAa3C,YAAY;IAMZ,iBAAiB,CAAC,EAChB,OAAe,EACf,OAAY,GACb,EAAE;QACD,OAAO,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;QACxB,OAAO,CAAC,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAA;KACzC;IAmCD,+BAA+B,IAAI,MAAM;IASzC,0BAA0B,CAAC,OAAO,GAAG,GAAG,EACtC,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,EAC5B,SAAS,EAAE,MAAM,GAChB,MAAM;IAaH,aAAa;IASb,gBAAgB,CAAC,KAAK,EAAE,MAAM;IAoC9B,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAiB9C,WAAW,CACf,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,GAAG,SAAS;IA6CxB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM;IA6C/D,eAAe;IAqCf,WAAW;IAqCX,cAAc;IAqBpB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,IAAI,MAAM;IAYxE,cAAc,CACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,UAAU,SAAM,GACf,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,EAAE,OAAO,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAkBpD,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,gBAAgB;IAIrE,GAAG,CACD,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5D,OAAO,UAAgB,EACvB,OAAO;;KAAsB;;;;;IAW/B,SAAS;;;IAMT,WAAW,CAAC,OAAO,EAAE,MAAM;;;;;IAQ3B,4BAA4B,CAC1B,QAAQ,EAAE,MAAM,EAChB,uBAAuB,EAAE,MAAM,GAAG,SAAS;;;;;;;;CAgB9C"}
+{"version":3,"file":"DbAuthHandler.d.ts","sourceRoot":"","sources":["../src/DbAuthHandler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAG1B,wBAAwB,EAKzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,KAAK,EAAE,oBAAoB,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,YAAY,CAAA;AAIhF,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AA8B3E,UAAU,iBAAiB,CAAC,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACnE;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;;;OAOG;IACH,OAAO,EAAE,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,eAAe,CAAC,KAAK,GAAG,CAAA;IAE7E;;;OAGG;IACH,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAA;IAElD;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,aAAa,CAAC,EAAE,MAAM,CAAA;QACtB,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;IAED;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,UAAU,yBAAyB,CAAC,KAAK,GAAG,QAAQ;IAClD;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,KAAK,GAAG,CAAA;IAC5C,MAAM,CAAC,EAAE;QACP,gBAAgB,CAAC,EAAE,MAAM,CAAA;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAA;QACzB,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;IACD,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,UAAU,gBAAgB,CAAC,KAAK,GAAG,QAAQ;IACzC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,GAAG,CAAA;IAC7B;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,yBAAyB,CAAC,EAAE,MAAM,CAAA;QAClC,gBAAgB,CAAC,EAAE,MAAM,CAAA;QACzB,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;IACD;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IAEf;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,UAAU,wBAAwB,CAAC,KAAK,GAAG,QAAQ;IACjD;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACpD,mBAAmB,EAAE,OAAO,CAAA;IAC5B,MAAM,CAAC,EAAE;QACP,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAA;QAC3B,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;CACF;AAED,UAAU,mBAAmB;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,KAAK,GAAG,UAAU,GAAG,gBAAgB,CAAA;IAC3C,gBAAgB,EAAE;QAChB,EAAE,EAAE,MAAM,CAAA;QACV,MAAM,EAAE,MAAM,CAAA;QACd,SAAS,EAAE,MAAM,CAAA;QACjB,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;CACF;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,GAAG,CAAC,CAAA;AAEnD,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC;IACnC,OAAO,EAAE;QACP,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;KAC/B,CAAA;IACD,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;CACnB,CAAC,CAAA;AAEF,KAAK,gBAAgB,GAAG;IACtB,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,GAAG,SAAS;IAClD,OAAO,CAAC;IACR;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CACxB,CAAA;AAED,MAAM,WAAW,oBAAoB,CACnC,KAAK,GAAG,QAAQ,EAChB,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACzC,GAAG,SAAS,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE5C;;;;;;;OAOG;IACH,EAAE,EAAE,GAAG,CAAA;IACP;;;OAGG;IACH,iBAAiB,EAAE,MAAM,GAAG,CAAA;IAC5B;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,GAAG,CAAA;IACnC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B;;;;OAIG;IACH,UAAU,EAAE;QACV,EAAE,EAAE,MAAM,CAAA;QACV,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;QACtB,IAAI,EAAE,MAAM,CAAA;QACZ,UAAU,EAAE,MAAM,CAAA;QAClB,mBAAmB,EAAE,MAAM,CAAA;QAC3B,SAAS,CAAC,EAAE,MAAM,CAAA;KACnB,CAAA;IACD;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,yDAAyD;QACzD,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,yDAAyD;QACzD,QAAQ,CAAC,EAAE,OAAO,CAAA;QAClB,yDAAyD;QACzD,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,yDAAyD;QACzD,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,yDAAyD;QACzD,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,UAAU,CAAC,EAAE;YACX,IAAI,CAAC,EAAE,MAAM,CAAA;YACb,QAAQ,CAAC,EAAE,OAAO,CAAA;YAClB,MAAM,CAAC,EAAE,OAAO,CAAA;YAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;YACjB,MAAM,CAAC,EAAE,MAAM,CAAA;SAChB,CAAA;QACD;;;;;;WAMG;QACH,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;IACD;;OAEG;IACH,cAAc,EAAE,yBAAyB,CAAC,KAAK,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IACrE;;OAEG;IACH,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IACnD;;OAEG;IACH,aAAa,EAAE,wBAAwB,CAAC,KAAK,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IACnE;;OAEG;IACH,MAAM,EAAE,iBAAiB,CAAC,eAAe,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IAE/D;;OAEG;IACH,QAAQ,CAAC,EAAE,mBAAmB,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IAEnD;;OAEG;IACH,IAAI,CAAC,EAAE,UAAU,CAAA;IAEjB;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CACnC;AAED,MAAM,WAAW,oBAAoB,CAAC,eAAe;IACnD,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,CAAC,EAAE,eAAe,CAAA;CACjC;AAED,MAAM,MAAM,eAAe,GACvB,gBAAgB,GAChB,UAAU,GACV,OAAO,GACP,QAAQ,GACR,eAAe,GACf,QAAQ,GACR,sBAAsB,GACtB,qBAAqB,GACrB,oBAAoB,GACpB,kBAAkB,GAClB,oBAAoB,CAAA;AAExB,KAAK,MAAM,GAAG,0BAA0B,GACtC,wBAAwB,GAAG;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,eAAe,CAAA;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CACnB,GAAG;IACF,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,CAAA;AAEH,KAAK,aAAa,CAAC,CAAC,GAAG,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;AACnD,KAAK,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AAIzC,qBAAa,aAAa,CACxB,KAAK,SAAS,QAAQ,EACtB,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACzC,GAAG,SAAS,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE5C,KAAK,EAAE,OAAO,GAAG,oBAAoB,CAAA;IACrC,kBAAkB,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IACtD,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC,CAAA;IAC1D,MAAM,EAAE,MAAM,CAAA;IACd,EAAE,EAAE,GAAG,CAAA;IACP,UAAU,EAAE,GAAG,CAAA;IACf,oBAAoB,EAAE,GAAG,CAAA;IACzB,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,iBAAiB,EAAE,OAAO,CAAA;IAC1B,OAAO,EAAE,aAAa,GAAG,SAAS,CAAA;IAClC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAA;IACpC,WAAW,EAAE,WAAW,GAAG,SAAS,CAAA;IACpC,kBAAkB,EAAE,MAAM,CAAA;IAC1B,mBAAmB,EAAE,MAAM,CAAA;IAC3B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAO;IACtC,cAAc,EAAE,CACd,QAAQ,EAAE;QACR,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,CAAC,EAAE,OAAO,CAAA;KAClB,EACD,WAAW,EAAE,WAAW,KACrB;QACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAA;QAC1C,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACzB,UAAU,EAAE,MAAM,CAAA;KACnB,CAAA;IAED,IAAW,iBAAiB,2BAS3B;IAGD,MAAM,KAAK,OAAO,IAAI,eAAe,EAAE,CActC;IAGD,MAAM,KAAK,KAAK;;;;;;;;;;;;MAcf;IAGD,MAAM,KAAK,iBAAiB,WAE3B;IAGD,MAAM,KAAK,UAAU,WAEpB;IAED,MAAM,KAAK,6BAA6B,aAEvC;IAED;;;;;;;;OAQG;IACH,IAAI,oBAAoB,IAAI,OAAO,CAmBlC;gBAGC,KAAK,EAAE,oBAAoB,GAAG,OAAO,EACrC,QAAQ,EAAE,aAAa,EAAE,SAAS;IAClC,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC;IA6DtD,IAAI;IAUJ,MAAM;iBAxKD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;eACnC,MAAM,GAAG,SAAS;oBACb,MAAM;;IAqPpB,YAAY,IAAI,MAAM,GAAG,IAAI;IAU7B,gBAAgB,IAAI,MAAM,GAAG,IAAI;IAO3B,cAAc,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA2E3C,QAAQ,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAqBrC,KAAK,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAuBxC,MAAM,IAAI,gBAAgB;IAIpB,aAAa,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA0E1C,MAAM,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA6BnC,kBAAkB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAgB/C,oBAAoB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA+FjD,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAkEhD,kBAAkB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAiD/C,gBAAgB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA2EnD,gBAAgB;IAkEV,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAYlE,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IAY3C,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAa3C,YAAY;IAMZ,iBAAiB,CAAC,EAChB,OAAe,EACf,OAAY,GACb,EAAE;QACD,OAAO,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;QACxB,OAAO,CAAC,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAA;KACzC;IAmCD,+BAA+B,IAAI,MAAM;IASzC,0BAA0B,CAAC,OAAO,GAAG,GAAG,EACtC,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,EAC5B,SAAS,EAAE,MAAM,GAChB,MAAM;IAWH,gBAAgB,CAAC,KAAK,EAAE,MAAM;IAoC9B,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAiB9C,WAAW,CACf,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,GAAG,SAAS;IA6CxB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM;IA6C/D,eAAe;IAqCf,WAAW;IAqCX,cAAc;IAqBpB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,IAAI,MAAM;IAYxE,cAAc,CACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,UAAU,SAAM,GACf,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,EAAE,OAAO,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAkBpD,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,gBAAgB;IAIrE,GAAG,CACD,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5D,OAAO,UAAgB,EACvB,OAAO;;KAAsB;;;;;IAW/B,SAAS;;;IAMT,WAAW,CAAC,OAAO,EAAE,MAAM;;;;;IAQ3B,UAAU,CAAC,OAAO,EAAE,MAAM;;;;;IAQ1B,4BAA4B,CAC1B,QAAQ,EAAE,MAAM,EAChB,uBAAuB,EAAE,MAAM,GAAG,SAAS;;;;;;;;CAgB9C"}

package/dist/DbAuthHandler.js

@@ -6,6 +6,13 @@ import {
   normalizeRequest
 } from "@cedarjs/api";
 import * as DbAuthError from "./errors.js";
+import {
+  isProxiedRequest,
+  isRequestOriginTrusted,
+  requiresOriginValidation,
+  resolveRequestHost,
+  resolveRequestProtocol
+} from "./originValidation.js";
 import {
   decryptSession,
   encryptSession,
@@ -188,11 +195,28 @@ class DbAuthHandler {
       if (this.httpMethod !== DbAuthHandler.VERBS[method]) {
         return this.createResponse(this._notFound(), corsHeaders);
       }
+      if (requiresOriginValidation(this.httpMethod) && !isRequestOriginTrusted(
+        {
+          method: this.httpMethod,
+          headers: this.normalizedRequest.headers,
+          host: this._requestHost(),
+          protocol: this._requestProtocol(),
+          proxied: isProxiedRequest(this.normalizedRequest.headers)
+        },
+        {
+          trustedOrigins: this.options.trustedOrigins,
+          corsOrigin: this.options.cors?.origin
+        }
+      )) {
+        throw new DbAuthError.UntrustedOriginError();
+      }
       const [body, headers, options = { statusCode: 200 }] = await this[method]();
       return this.createResponse(this._ok(body, headers, options), corsHeaders);
     } catch (e) {
       if (e instanceof DbAuthError.WrongVerbError) {
         return this.createResponse(this._notFound(), corsHeaders);
+      } else if (e instanceof DbAuthError.UntrustedOriginError) {
+        return this.createResponse(this._forbidden(e.message), corsHeaders);
       } else {
         return this.createResponse(
           this._badRequest(e.message || e),
@@ -201,6 +225,25 @@ class DbAuthHandler {
       }
     }
   }
+  // best-effort host the request was sent to, used by origin validation to
+  // allow same-origin requests through with no extra configuration. Prefers
+  // `X-Forwarded-Host` over the connection-level host/URL -- see
+  // `resolveRequestHost` for why that's safe behind a proxy
+  _requestHost() {
+    return resolveRequestHost(
+      this.normalizedRequest.headers,
+      isFetchApiRequest(this.event) ? this.event.url : void 0
+    );
+  }
+  // best-effort scheme the request arrived over, used alongside
+  // `_requestHost` for origin validation. See `resolveRequestProtocol` for
+  // when it can and can't be determined reliably
+  _requestProtocol() {
+    return resolveRequestProtocol(
+      this.normalizedRequest.headers,
+      isFetchApiRequest(this.event) ? this.event.url : void 0
+    );
+  }
   async forgotPassword() {
     const { enabled = true } = this.options.forgotPassword;
     if (!enabled) {
@@ -681,14 +724,6 @@ class DbAuthHandler {
     ].join(";");
     return sessionCookieString;
   }
-  // checks the CSRF token in the header against the CSRF token in the session
-  // and throw an error if they are not the same (not used yet)
-  async _validateCsrf() {
-    if (this.sessionCsrfToken !== this.normalizedRequest.headers.get("csrf-token")) {
-      throw new DbAuthError.CsrfTokenMismatchError();
-    }
-    return true;
-  }
   async _findUserByToken(token) {
     const tokenExpires = /* @__PURE__ */ new Date();
     tokenExpires.setSeconds(
@@ -904,6 +939,13 @@ class DbAuthHandler {
       headers: new Headers({ "content-type": "application/json" })
     };
   }
+  _forbidden(message) {
+    return {
+      statusCode: 403,
+      body: JSON.stringify({ error: message }),
+      headers: new Headers({ "content-type": "application/json" })
+    };
+  }
   _getUserMatchCriteriaOptions(username, usernameMatchFlowOption) {
     const findUniqueUserMatchCriteriaOptions = !usernameMatchFlowOption ? { [this.options.authFields.username]: username } : {
       [this.options.authFields.username]: {

package/dist/errors.d.ts

@@ -49,8 +49,8 @@ export declare class DuplicateUsernameError extends Error {
 export declare class IncorrectPasswordError extends Error {
     constructor(username: string, message?: string | undefined);
 }
-export declare class CsrfTokenMismatchError extends Error {
-    constructor();
+export declare class UntrustedOriginError extends Error {
+    constructor(message?: string);
 }
 export declare class SessionDecryptionError extends Error {
     constructor();

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,oBAAqB,SAAQ,KAAK;;CAO9C;AAED,qBAAa,wBAAyB,SAAQ,KAAK;;CAKlD;AAED,qBAAa,mBAAoB,SAAQ,KAAK;;CAK7C;AAED,qBAAa,oBAAqB,SAAQ,KAAK;;CAK9C;AAED,qBAAa,4BAA6B,SAAQ,KAAK;;CAKtD;AAED,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,qBAAa,qBAAsB,SAAQ,KAAK;;CAO/C;AAED,qBAAa,0BAA2B,SAAQ,KAAK;;CAOpD;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,IAAI,EAAE,MAAM;CAIzB;AAED,qBAAa,cAAe,SAAQ,KAAK;gBAC3B,UAAU,EAAE,MAAM;CAI/B;AAED,qBAAa,gBAAiB,SAAQ,KAAK;;CAK1C;AAED,qBAAa,iBAAkB,SAAQ,KAAK;gBAExC,QAAQ,GAAE,MAAM,GAAG,SAAqB,EACxC,OAAO,GAAE,MAAM,GAAG,SAA4C;CAUjE;AAED,qBAAa,gCAAiC,SAAQ,KAAK;gBAEvD,OAAO,GAAE,MAAM,GAAG,SAAqD;CAK1E;AAED,qBAAa,aAAc,SAAQ,KAAK;;CAOvC;AAED,qBAAa,kBAAmB,SAAQ,KAAK;gBAEzC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAM,GAAG,SAAkC;CAKvD;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBAE7C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,MAAM,GAAG,SAAmD;CAKxE;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBAE7C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,MAAM,GAAG,SAAgD;CAKrE;AAED,qBAAa,sBAAuB,SAAQ,KAAK;;CAKhD;AAED,qBAAa,sBAAuB,SAAQ,KAAK;;CAKhD;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,SAAwB;CAI5C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,SAAyB;CAI7C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,SAAyB;CAI7C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,SAAuB;CAI3C;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,SAA0B;CAI9C;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,SAA0B;CAI9C;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,SAA2B;CAI/C;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,SAA+B;CAInD;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,SAAwB;CAI5C;AAED,qBAAa,YAAa,SAAQ,KAAK;gBACzB,OAAO,SAA2B;CAI/C;AAED,qBAAa,aAAc,SAAQ,KAAK;gBAC1B,OAAO,SAAmB;CAIvC;AAED,qBAAa,sBAAuB,SAAQ,aAAa;gBAErD,OAAO,SAAyD;CAKnE"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,oBAAqB,SAAQ,KAAK;;CAO9C;AAED,qBAAa,wBAAyB,SAAQ,KAAK;;CAKlD;AAED,qBAAa,mBAAoB,SAAQ,KAAK;;CAK7C;AAED,qBAAa,oBAAqB,SAAQ,KAAK;;CAK9C;AAED,qBAAa,4BAA6B,SAAQ,KAAK;;CAKtD;AAED,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,qBAAa,qBAAsB,SAAQ,KAAK;;CAO/C;AAED,qBAAa,0BAA2B,SAAQ,KAAK;;CAOpD;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,IAAI,EAAE,MAAM;CAIzB;AAED,qBAAa,cAAe,SAAQ,KAAK;gBAC3B,UAAU,EAAE,MAAM;CAI/B;AAED,qBAAa,gBAAiB,SAAQ,KAAK;;CAK1C;AAED,qBAAa,iBAAkB,SAAQ,KAAK;gBAExC,QAAQ,GAAE,MAAM,GAAG,SAAqB,EACxC,OAAO,GAAE,MAAM,GAAG,SAA4C;CAUjE;AAED,qBAAa,gCAAiC,SAAQ,KAAK;gBAEvD,OAAO,GAAE,MAAM,GAAG,SAAqD;CAK1E;AAED,qBAAa,aAAc,SAAQ,KAAK;;CAOvC;AAED,qBAAa,kBAAmB,SAAQ,KAAK;gBAEzC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAM,GAAG,SAAkC;CAKvD;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBAE7C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,MAAM,GAAG,SAAmD;CAKxE;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBAE7C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,MAAM,GAAG,SAAgD;CAKrE;AAED,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,SAAkC;CAItD;AAED,qBAAa,sBAAuB,SAAQ,KAAK;;CAKhD;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,SAAwB;CAI5C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,SAAyB;CAI7C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,SAAyB;CAI7C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,SAAuB;CAI3C;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,SAA0B;CAI9C;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,SAA0B;CAI9C;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,SAA2B;CAI/C;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,SAA+B;CAInD;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,SAAwB;CAI5C;AAED,qBAAa,YAAa,SAAQ,KAAK;gBACzB,OAAO,SAA2B;CAI/C;AAED,qBAAa,aAAc,SAAQ,KAAK;gBAC1B,OAAO,SAAmB;CAIvC;AAED,qBAAa,sBAAuB,SAAQ,aAAa;gBAErD,OAAO,SAAyD;CAKnE"}

package/dist/errors.js

@@ -112,10 +112,10 @@ class IncorrectPasswordError extends Error {
     this.name = "IncorrectPasswordError";
   }
 }
-class CsrfTokenMismatchError extends Error {
-  constructor() {
-    super(`CSRF token mismatch`);
-    this.name = "CsrfTokenMismatchError";
+class UntrustedOriginError extends Error {
+  constructor(message = "Request origin is not trusted") {
+    super(message);
+    this.name = "UntrustedOriginError";
   }
 }
 class SessionDecryptionError extends Error {
@@ -197,7 +197,6 @@ class NoWebAuthnSessionError extends WebAuthnError {
   }
 }
 export {
-  CsrfTokenMismatchError,
   DuplicateUsernameError,
   FieldRequiredError,
   FlowNotEnabledError,
@@ -222,6 +221,7 @@ export {
   ReusedPasswordError,
   SessionDecryptionError,
   UnknownAuthMethodError,
+  UntrustedOriginError,
   UserNotFoundError,
   UsernameAndPasswordRequiredError,
   UsernameNotFoundError,

package/dist/index.d.ts

@@ -2,4 +2,5 @@ export * from './DbAuthHandler.js';
 export { PasswordValidationError } from './errors.js';
 export * from './shared.js';
 export { authDecoder, createAuthDecoder } from './decoder.js';
+export * from './originValidation.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAA;AAClC,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AACrD,cAAc,aAAa,CAAA;AAC3B,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAA;AAClC,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AACrD,cAAc,aAAa,CAAA;AAC3B,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAC7D,cAAc,uBAAuB,CAAA"}

package/dist/index.js

@@ -2,6 +2,7 @@ export * from "./DbAuthHandler.js";
 import { PasswordValidationError } from "./errors.js";
 export * from "./shared.js";
 import { authDecoder, createAuthDecoder } from "./decoder.js";
+export * from "./originValidation.js";
 export {
   PasswordValidationError,
   authDecoder,

package/dist/originValidation.d.ts

@@ -0,0 +1,131 @@
+import type { CorsConfig } from '@cedarjs/api';
+/**
+ * Minimal, transport-agnostic shape of an incoming request needed to decide
+ * whether its `Origin` header should be trusted for a state-changing
+ * request. Deliberately decoupled from any specific request/event type (no
+ * `DbAuthHandler` coupling) so this helper can be reused by other handler
+ * packages.
+ */
+export interface OriginValidationRequest {
+    /**
+     * HTTP method of the request, e.g. `GET`, `POST`. Used by
+     * {@link requiresOriginValidation} to decide whether a request needs to be
+     * checked at all.
+     */
+    method: string;
+    /**
+     * Request headers, including `origin` if the browser sent one.
+     */
+    headers: Headers;
+    /**
+     * Host (and port, if non-default) the request was sent to, resolved with
+     * {@link resolveRequestHost}. Used to allow same-origin requests through
+     * with no extra configuration, which covers the standard Cedar setup
+     * where the web side proxies API requests through its own origin. Pass
+     * `null` when the host can't be determined.
+     */
+    host?: string | null;
+    /**
+     * Scheme (`http`/`https`) the request is considered to have arrived
+     * over, resolved with {@link resolveRequestProtocol}, when it can be
+     * determined reliably. Used as an extra check alongside `host` when
+     * deciding whether the `Origin` header matches the request's own
+     * origin. Pass `null`/`undefined` when it can't be determined -- in that
+     * case only the host is compared, unless `proxied` narrows that further
+     * (see {@link isProxiedRequest}).
+     */
+    protocol?: string | null;
+    /**
+     * Whether the request declares itself as arriving through a forwarding
+     * proxy, resolved with {@link isProxiedRequest}. Scopes the
+     * unknown-scheme same-host restriction to requests a proxy actually
+     * touched -- see `isSameOrigin`.
+     */
+    proxied?: boolean;
+}
+export interface OriginValidationConfig {
+    /**
+     * Extra origins that are always trusted for state-changing requests, on
+     * top of the request's own host and any origins already listed in
+     * `cors.origin`.
+     */
+    trustedOrigins?: string | string[];
+    /**
+     * The `origin` value from a handler's `cors` config (same shape as passed
+     * to `createCorsContext`). String and array values are treated as
+     * trusted origins.
+     *
+     * `true` (reflect any request origin back in
+     * `Access-Control-Allow-Origin`) is intentionally NOT treated as trust --
+     * combined with `credentials: true` that is the exact misconfiguration
+     * this check protects against. Apps that need to accept requests from an
+     * arbitrary set of origins must list them explicitly in `trustedOrigins`
+     * instead.
+     */
+    corsOrigin?: CorsConfig['origin'];
+}
+/**
+ * HTTP methods that can change server-side state and therefore need their
+ * `Origin` validated. `GET` and `HEAD` requests are read-only and are never
+ * checked.
+ */
+export declare function requiresOriginValidation(method: string): boolean;
+/**
+ * Resolves the host a request should be considered as having arrived at,
+ * preferring a forwarding proxy's advertised host over the connection-level
+ * one.
+ *
+ * A proxy in front of the api side (this framework's own `cedar serve
+ * --ud`, or an external nginx/CDN) terminates the browser's connection and
+ * opens a new one to the api server, so the request's own URL/`Host` header
+ * reflects that internal hop rather than the origin-facing host the
+ * browser actually targeted. `X-Forwarded-Host` carries the origin-facing
+ * host instead.
+ *
+ * Trusting `X-Forwarded-Host` here is safe for CSRF purposes: a cross-site
+ * HTML form can't set arbitrary request headers, and a cross-origin
+ * `fetch()` that sets a custom header triggers a CORS preflight, so an
+ * attacker can't forge it without already having crossed the browser's
+ * CORS checks.
+ *
+ * @param url - The request's own URL (Fetch API requests only), used as a
+ * fallback when neither `X-Forwarded-Host` nor `Host` is present.
+ */
+export declare function resolveRequestHost(headers: Headers, url?: string | null): string | null;
+/**
+ * Resolves the scheme (`http`/`https`) a request should be considered as
+ * having arrived over, mirroring {@link resolveRequestHost}.
+ *
+ * The request's own URL is only used as a fallback when no
+ * `X-Forwarded-Host` is present -- once a proxy has declared itself by
+ * setting that header, the request's own URL reflects the internal hop to
+ * the proxy, and its scheme can't be assumed to match what the browser
+ * actually used unless the proxy also set `X-Forwarded-Proto`.
+ *
+ * @param url - The request's own URL (Fetch API requests only).
+ */
+export declare function resolveRequestProtocol(headers: Headers, url?: string | null): string | null;
+/**
+ * Whether a request declares itself as arriving through a forwarding
+ * proxy, i.e. carries an `X-Forwarded-Host` header.
+ *
+ * Used to scope the unknown-scheme same-host restriction (see
+ * `isSameOrigin`) to requests a proxy actually touched. A request with no
+ * forwarding headers at all is a direct connection -- the normal case for
+ * dev servers, classic `cedar serve`, and most self-hosts -- not evidence
+ * of a proxy.
+ */
+export declare function isProxiedRequest(headers: Headers): boolean;
+/**
+ * Decides whether a request's `Origin` header should be trusted.
+ *
+ * Requests with no `Origin` header are always trusted: non-browser clients
+ * (server-to-server calls, CLIs, mobile apps) don't send one and don't carry
+ * ambient browser cookies, so they aren't CSRF vectors.
+ *
+ * When an `Origin` header is present, it's trusted when it matches the
+ * request's own host, is listed in `trustedOrigins`, or is listed in
+ * `corsOrigin`. Everything else is untrusted.
+ */
+export declare function isRequestOriginTrusted(request: OriginValidationRequest, config: OriginValidationConfig): boolean;
+//# sourceMappingURL=originValidation.d.ts.map

package/dist/originValidation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"originValidation.d.ts","sourceRoot":"","sources":["../src/originValidation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAE9C;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAClC;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAA;CAClC;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAGhE;AAgBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,GAClB,MAAM,GAAG,IAAI,CAoBf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,GAClB,MAAM,GAAG,IAAI,CAef;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAE1D;AA+CD;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CA6BT"}

package/dist/originValidation.js

@@ -0,0 +1,92 @@
+function requiresOriginValidation(method) {
+  const upperMethod = method.toUpperCase();
+  return upperMethod !== "GET" && upperMethod !== "HEAD";
+}
+function toOriginList(value) {
+  if (!value) {
+    return [];
+  }
+  return Array.isArray(value) ? value : [value];
+}
+function firstForwardedValue(headerValue) {
+  return headerValue.split(",")[0].trim();
+}
+function resolveRequestHost(headers, url) {
+  const forwardedHost = headers.get("x-forwarded-host");
+  if (forwardedHost) {
+    return firstForwardedValue(forwardedHost);
+  }
+  const host = headers.get("host");
+  if (host) {
+    return host;
+  }
+  if (url) {
+    try {
+      return new URL(url).host;
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function resolveRequestProtocol(headers, url) {
+  const forwardedProto = headers.get("x-forwarded-proto");
+  if (forwardedProto) {
+    return firstForwardedValue(forwardedProto).toLowerCase();
+  }
+  if (!headers.get("x-forwarded-host") && url) {
+    try {
+      return new URL(url).protocol.replace(":", "");
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function isProxiedRequest(headers) {
+  return headers.get("x-forwarded-host") !== null;
+}
+function isSameOrigin(origin, host, protocol, proxied) {
+  try {
+    const originUrl = new URL(origin);
+    if (originUrl.host !== host) {
+      return false;
+    }
+    if (protocol) {
+      return originUrl.protocol === `${protocol}:`;
+    }
+    if (proxied) {
+      return originUrl.protocol === "https:";
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isRequestOriginTrusted(request, config) {
+  const origin = request.headers.get("origin");
+  if (!origin) {
+    return true;
+  }
+  if (request.host && isSameOrigin(origin, request.host, request.protocol, request.proxied)) {
+    return true;
+  }
+  const trustedOrigins = toOriginList(config.trustedOrigins);
+  if (trustedOrigins.includes(origin)) {
+    return true;
+  }
+  const corsOrigins = toOriginList(
+    typeof config.corsOrigin === "string" || Array.isArray(config.corsOrigin) ? config.corsOrigin : void 0
+  );
+  if (corsOrigins.includes(origin)) {
+    return true;
+  }
+  return false;
+}
+export {
+  isProxiedRequest,
+  isRequestOriginTrusted,
+  requiresOriginValidation,
+  resolveRequestHost,
+  resolveRequestProtocol
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cedarjs/auth-dbauth-api",
-  "version": "7.0.0-canary.3072",
+  "version": "7.0.0-canary.3074",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/cedarjs/cedar.git",
@@ -57,13 +57,13 @@
     "test:watch": "vitest watch"
   },
   "dependencies": {
-    "@cedarjs/project-config": "7.0.0-canary.3072",
+    "@cedarjs/project-config": "7.0.0-canary.3074",
     "md5": "2.3.0",
     "uuid": "11.1.0"
   },
   "devDependencies": {
-    "@cedarjs/api": "7.0.0-canary.3072",
-    "@cedarjs/framework-tools": "7.0.0-canary.3072",
+    "@cedarjs/api": "7.0.0-canary.3074",
+    "@cedarjs/framework-tools": "7.0.0-canary.3074",
     "@simplewebauthn/server": "13.3.3",
     "@types/aws-lambda": "8.10.162",
     "@types/md5": "2.3.6",