@dashai/cli 0.10.0 → 0.11.0

package/dist/bin.js

@@ -929,6 +929,15 @@ export default withAuth({
   // redirect-loop trying to re-authenticate.
   publicPaths: ['/', '/about', '/sign-in-error'],
   loginPath: '/api/auth/sign-in',
+  // Silent sign-in: when a signed-in DashWise user opens the module through
+  // the platform (in-app embed or the module subdomain), the SSO handshake
+  // completes with zero clicks \u2014 they land straight in the app, landing page
+  // included. It never touches:
+  //   - anonymous visitors on public installs (no platform-session hint),
+  //   - local \`dashwise dev\` (no platform proxy \u2192 no hint header) \u2014 the
+  //     landing's "Sign in with DashWise" button stays your dev flow,
+  //   - anything within 60s of a failed silent attempt (no redirect loops).
+  autoSignIn: true,
 });
 
 export const config = {
@@ -970,11 +979,13 @@ export default function RootLayout({ children }: { children: React.ReactNode })
 function appPageCustomTsx(opts) {
   return `// Public landing page \u2014 listed in middleware.ts publicPaths.
 //
-// First-run experience for unauthenticated visitors: hero with the
-// module name + tagline, a "Sign in with DashWise" button that kicks
-// off the SSO flow (via /api/auth/sign-in), and a feature card
-// describing what the module does. After signing in, the user lands
-// on /dashboard (Server Component, session-validated).
+// NOTE: signed-in DashWise users usually never see this page \u2014 the
+// middleware's \`autoSignIn\` signs them in silently and they land on the
+// page they asked for. This landing serves anonymous visitors (public
+// installs), local \`dashwise dev\`, and the rare failed silent attempt \u2014
+// its "Sign in with DashWise" button is the manual fallback that kicks
+// off the same SSO flow (via /api/auth/sign-in). After signing in, the
+// user lands on /dashboard (Server Component, session-validated).
 //
 // Styling: shadcn/ui primitives (\`<Button>\`, \`<Card>\`) on Tailwind 4
 // theme tokens. Add more blocks via \`npx shadcn add @shadcn-studio/...\`
@@ -1190,6 +1201,11 @@ import { getPublicOrigin } from '@/lib/request-origin';
 export async function GET(request: Request) {
   const url = new URL(request.url);
   const returnTo = url.searchParams.get('return_to') ?? '/';
+  // \`auto=1\` marks a SILENT attempt (the middleware's autoSignIn redirect,
+  // no user click). Its failures degrade to the public landing page \u2014 where
+  // the manual "Sign in with DashWise" button lives \u2014 instead of the error
+  // page: the user never asked for anything, so don't show them an error.
+  const isAuto = url.searchParams.get('auto') === '1';
   const apiBaseUrl = process.env.DASHWISE_API_URL;
   const apiKey = process.env.DASHWISE_API_KEY;
 
@@ -1216,6 +1232,16 @@ export async function GET(request: Request) {
   const callback = new URL('/api/auth/callback', moduleOrigin);
   callback.searchParams.set('return_to', returnTo);
 
+  // Where a failed start lands: the error page for user-initiated sign-ins,
+  // the landing page for silent (auto) attempts.
+  const failTarget = (code: string, description?: string): URL => {
+    if (isAuto) return new URL('/', moduleOrigin);
+    const target = new URL('/sign-in-error', moduleOrigin);
+    target.searchParams.set('code', code);
+    if (description) target.searchParams.set('description', description);
+    return target;
+  };
+
   let res: Response;
   try {
     res = await fetch(\`\${apiBaseUrl}/api/module-api/sso/start-url\`, {
@@ -1228,10 +1254,9 @@ export async function GET(request: Request) {
       body: JSON.stringify({ callback_url: callback.toString() }),
     });
   } catch (err) {
-    const target = new URL('/sign-in-error', moduleOrigin);
-    target.searchParams.set('code', 'server_error');
-    target.searchParams.set('description', (err as Error).message);
-    return NextResponse.redirect(target);
+    return NextResponse.redirect(
+      failTarget('server_error', (err as Error).message),
+    );
   }
 
   if (!res.ok) {
@@ -1241,23 +1266,18 @@ export async function GET(request: Request) {
     const body = (await res.json().catch(() => null)) as
       | { code?: string; message?: string }
       | null;
-    const target = new URL('/sign-in-error', moduleOrigin);
-    target.searchParams.set('code', body?.code ?? 'invalid_request');
-    if (body?.message) target.searchParams.set('description', body.message);
-    return NextResponse.redirect(target);
+    return NextResponse.redirect(
+      failTarget(body?.code ?? 'invalid_request', body?.message),
+    );
   }
 
   const body = (await res.json().catch(() => null)) as
     | { redirect_url?: string }
     | null;
   if (!body?.redirect_url) {
-    const target = new URL('/sign-in-error', moduleOrigin);
-    target.searchParams.set('code', 'server_error');
-    target.searchParams.set(
-      'description',
-      'start-url response missing redirect_url',
+    return NextResponse.redirect(
+      failTarget('server_error', 'start-url response missing redirect_url'),
     );
-    return NextResponse.redirect(target);
   }
   return NextResponse.redirect(body.redirect_url);
 }
@@ -1293,7 +1313,13 @@ export async function GET(request: Request) {
     return NextResponse.redirect(target);
   }
   const code = url.searchParams.get('code');
-  const returnTo = url.searchParams.get('return_to') ?? '/';
+  // Only ever redirect to a ROOT-RELATIVE, same-module path. \`return_to\`
+  // rides through the SSO round-trip unvalidated (the backend checks only the
+  // callback ORIGIN, not this sub-param), so an absolute (\`https://evil\`),
+  // protocol-relative (\`//evil\`), or control-char-smuggled value would be a
+  // post-auth open redirect off the module host. Reject anything that isn't a
+  // clean root-relative path.
+  const returnTo = safeReturnTo(url.searchParams.get('return_to'));
   if (!code) {
     const target = new URL('/sign-in-error', publicOrigin);
     target.searchParams.set('code', 'missing_code');
@@ -1309,6 +1335,20 @@ export async function GET(request: Request) {
   }
   return NextResponse.redirect(new URL(returnTo, publicOrigin));
 }
+
+/** Root-relative in-module paths only \u2014 defends against open-redirect via
+ *  a crafted \`return_to\`. Rejects absolute/protocol-relative/backslash and
+ *  any ASCII control char (which WHATWG URL parsing strips, defeating a naive
+ *  prefix check). Falls back to '/'. */
+function safeReturnTo(raw: string | null): string {
+  if (!raw || raw[0] !== '/') return '/';
+  if (raw.startsWith('//') || raw.startsWith('/\\\\')) return '/';
+  for (let i = 0; i < raw.length; i++) {
+    const c = raw.charCodeAt(i);
+    if (c < 0x20 || c === 0x7f) return '/';
+  }
+  return raw;
+}
 `;
 }
 function appApiAuthSignOutTs() {
@@ -9231,7 +9271,7 @@ fieldCmd.command("set-type <table-slug> <field-slug> <new-type>").description(
   }
 })();
 function getVersion() {
-  return "0.10.0";
+  return "0.11.0";
 }
 function parseIntOption(value) {
   const n = Number.parseInt(value, 10);