@dyrected/core 2.5.42 → 2.5.43

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { F as Field, B as Block, D as DyrectedConfig, C as CollectionConfig, A as AdminAuthConfig, P as PublicAdminAuthConfig, W as WorkflowConfig, a as AuthenticatedUser, b as WorkflowTransition, L as LifecycleEventName, c as LifecycleEvent, d as BaseDocument, H as HookRequestContext, G as GlobalConfig } from './app-config-BLMX-9MN.cjs';
-export { e as AccessFunction, f as AdminAuthAccessResolution, g as AdminAuthClaimMapping, h as AdminAuthProvider, i as AdminAuthProvisioningMode, j as AdminAuthResolveAccessArgs, k as AdminAuthResolvedIdentity, l as AdminConfig, m as AdminDashboardComponentSlots, n as AdminIconName, o as ArrayField, p as BaseAdminAuthProvider, q as BlocksField, r as BooleanField, s as CharacterLimitFieldConfig, t as CollectionAfterChangeHook, u as CollectionAfterDeleteHook, v as CollectionAfterReadHook, w as CollectionAfterTransitionHook, x as CollectionBeforeChangeHook, y as CollectionBeforeDeleteHook, z as CollectionBeforeReadHook, E as CollectionBeforeTransitionHook, I as CollectionListComponentSlots, J as CustomAdminAuthProvider, K as DatabaseAdapter, M as DateField, N as DateTimeField, O as DynamicOptionItem, Q as DynamicOptionsConfig, R as DynamicOptionsResolver, S as DynamicOptionsResolverArgs, T as EmailField, U as FieldAdminOnChangeHook, V as FieldAdminOnChangeHookArgs, X as FieldAdminOptionsHook, Y as FieldAdminOptionsHookArgs, Z as FieldAdminOptionsHookResult, _ as FieldAfterReadHook, $ as FieldAfterReadHookArgs, a0 as FieldBeforeChangeHook, a1 as FieldBeforeChangeHookArgs, a2 as FieldHook, a3 as FieldType, a4 as FileData, a5 as GlobalAfterChangeHook, a6 as GlobalAfterReadHook, a7 as GlobalBeforeChangeHook, a8 as GlobalBeforeReadHook, a9 as HookFunction, aa as IconField, ab as ImageField, ac as ImageService, ad as JoinField, ae as JsonField, af as LIFECYCLE_EVENT_NAMES, ag as LifecycleEventHandler, ah as MultiSelectField, ai as NumberField, aj as OIDCAdminAuthProvider, ak as ObjectField, al as PaginatedResult, am as PublicAdminAuthProvider, an as RadioField, ao as ReadonlyDatabaseAdapter, ap as RelationshipField, aq as RichTextField, ar as RowField, as as SelectField, at as StorageAdapter, au as TextField, av as TextareaField, aw as TimeField, ax as UploadConfig, ay as UrlField, az as WordLimitFieldConfig, aA as WorkflowMetadata, aB as WorkflowRole, aC as WorkflowState, aD as WorkflowTransitionContext } from './app-config-BLMX-9MN.cjs';
+import { F as Field, B as Block, D as DyrectedConfig, C as CollectionConfig, A as AdminAuthConfig, P as PublicAdminAuthConfig, W as WorkflowConfig, a as AuthenticatedUser, b as WorkflowTransition, L as LifecycleEventName, c as LifecycleEvent, d as BaseDocument, H as HookRequestContext, G as GlobalConfig } from './app-config-2vF6W56z.cjs';
+export { e as AccessFunction, f as AdminAuthAccessResolution, g as AdminAuthClaimMapping, h as AdminAuthProvider, i as AdminAuthProvisioningMode, j as AdminAuthResolveAccessArgs, k as AdminAuthResolvedIdentity, l as AdminConfig, m as AdminDashboardComponentSlots, n as AdminIconName, o as ArrayField, p as BaseAdminAuthProvider, q as BlocksField, r as BooleanField, s as CharacterLimitFieldConfig, t as CollectionAfterChangeHook, u as CollectionAfterDeleteHook, v as CollectionAfterReadHook, w as CollectionAfterTransitionHook, x as CollectionBeforeChangeHook, y as CollectionBeforeDeleteHook, z as CollectionBeforeReadHook, E as CollectionBeforeTransitionHook, I as CollectionListComponentSlots, J as CustomAdminAuthProvider, K as DatabaseAdapter, M as DateField, N as DateTimeField, O as DynamicOptionItem, Q as DynamicOptionsConfig, R as DynamicOptionsResolver, S as DynamicOptionsResolverArgs, T as EmailField, U as FieldAdminOnChangeHook, V as FieldAdminOnChangeHookArgs, X as FieldAdminOptionsHook, Y as FieldAdminOptionsHookArgs, Z as FieldAdminOptionsHookResult, _ as FieldAfterReadHook, $ as FieldAfterReadHookArgs, a0 as FieldBeforeChangeHook, a1 as FieldBeforeChangeHookArgs, a2 as FieldHook, a3 as FieldType, a4 as FileData, a5 as GlobalAfterChangeHook, a6 as GlobalAfterReadHook, a7 as GlobalBeforeChangeHook, a8 as GlobalBeforeReadHook, a9 as HookFunction, aa as IconField, ab as ImageField, ac as ImageService, ad as JoinField, ae as JsonField, af as LIFECYCLE_EVENT_NAMES, ag as LifecycleEventHandler, ah as MultiSelectField, ai as NumberField, aj as OIDCAdminAuthProvider, ak as ObjectField, al as PaginatedResult, am as PublicAdminAuthProvider, an as RadioField, ao as ReadonlyDatabaseAdapter, ap as RelationshipField, aq as RichTextField, ar as RowField, as as SelectField, at as StorageAdapter, au as TextField, av as TextareaField, aw as TimeField, ax as UploadConfig, ay as UrlField, az as WordLimitFieldConfig, aA as WorkflowMetadata, aB as WorkflowRole, aC as WorkflowState, aD as WorkflowTransitionContext } from './app-config-2vF6W56z.cjs';
 import 'lucide-react';
 
 type Prettify<T> = {

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { F as Field, B as Block, D as DyrectedConfig, C as CollectionConfig, A as AdminAuthConfig, P as PublicAdminAuthConfig, W as WorkflowConfig, a as AuthenticatedUser, b as WorkflowTransition, L as LifecycleEventName, c as LifecycleEvent, d as BaseDocument, H as HookRequestContext, G as GlobalConfig } from './app-config-BLMX-9MN.js';
-export { e as AccessFunction, f as AdminAuthAccessResolution, g as AdminAuthClaimMapping, h as AdminAuthProvider, i as AdminAuthProvisioningMode, j as AdminAuthResolveAccessArgs, k as AdminAuthResolvedIdentity, l as AdminConfig, m as AdminDashboardComponentSlots, n as AdminIconName, o as ArrayField, p as BaseAdminAuthProvider, q as BlocksField, r as BooleanField, s as CharacterLimitFieldConfig, t as CollectionAfterChangeHook, u as CollectionAfterDeleteHook, v as CollectionAfterReadHook, w as CollectionAfterTransitionHook, x as CollectionBeforeChangeHook, y as CollectionBeforeDeleteHook, z as CollectionBeforeReadHook, E as CollectionBeforeTransitionHook, I as CollectionListComponentSlots, J as CustomAdminAuthProvider, K as DatabaseAdapter, M as DateField, N as DateTimeField, O as DynamicOptionItem, Q as DynamicOptionsConfig, R as DynamicOptionsResolver, S as DynamicOptionsResolverArgs, T as EmailField, U as FieldAdminOnChangeHook, V as FieldAdminOnChangeHookArgs, X as FieldAdminOptionsHook, Y as FieldAdminOptionsHookArgs, Z as FieldAdminOptionsHookResult, _ as FieldAfterReadHook, $ as FieldAfterReadHookArgs, a0 as FieldBeforeChangeHook, a1 as FieldBeforeChangeHookArgs, a2 as FieldHook, a3 as FieldType, a4 as FileData, a5 as GlobalAfterChangeHook, a6 as GlobalAfterReadHook, a7 as GlobalBeforeChangeHook, a8 as GlobalBeforeReadHook, a9 as HookFunction, aa as IconField, ab as ImageField, ac as ImageService, ad as JoinField, ae as JsonField, af as LIFECYCLE_EVENT_NAMES, ag as LifecycleEventHandler, ah as MultiSelectField, ai as NumberField, aj as OIDCAdminAuthProvider, ak as ObjectField, al as PaginatedResult, am as PublicAdminAuthProvider, an as RadioField, ao as ReadonlyDatabaseAdapter, ap as RelationshipField, aq as RichTextField, ar as RowField, as as SelectField, at as StorageAdapter, au as TextField, av as TextareaField, aw as TimeField, ax as UploadConfig, ay as UrlField, az as WordLimitFieldConfig, aA as WorkflowMetadata, aB as WorkflowRole, aC as WorkflowState, aD as WorkflowTransitionContext } from './app-config-BLMX-9MN.js';
+import { F as Field, B as Block, D as DyrectedConfig, C as CollectionConfig, A as AdminAuthConfig, P as PublicAdminAuthConfig, W as WorkflowConfig, a as AuthenticatedUser, b as WorkflowTransition, L as LifecycleEventName, c as LifecycleEvent, d as BaseDocument, H as HookRequestContext, G as GlobalConfig } from './app-config-2vF6W56z.js';
+export { e as AccessFunction, f as AdminAuthAccessResolution, g as AdminAuthClaimMapping, h as AdminAuthProvider, i as AdminAuthProvisioningMode, j as AdminAuthResolveAccessArgs, k as AdminAuthResolvedIdentity, l as AdminConfig, m as AdminDashboardComponentSlots, n as AdminIconName, o as ArrayField, p as BaseAdminAuthProvider, q as BlocksField, r as BooleanField, s as CharacterLimitFieldConfig, t as CollectionAfterChangeHook, u as CollectionAfterDeleteHook, v as CollectionAfterReadHook, w as CollectionAfterTransitionHook, x as CollectionBeforeChangeHook, y as CollectionBeforeDeleteHook, z as CollectionBeforeReadHook, E as CollectionBeforeTransitionHook, I as CollectionListComponentSlots, J as CustomAdminAuthProvider, K as DatabaseAdapter, M as DateField, N as DateTimeField, O as DynamicOptionItem, Q as DynamicOptionsConfig, R as DynamicOptionsResolver, S as DynamicOptionsResolverArgs, T as EmailField, U as FieldAdminOnChangeHook, V as FieldAdminOnChangeHookArgs, X as FieldAdminOptionsHook, Y as FieldAdminOptionsHookArgs, Z as FieldAdminOptionsHookResult, _ as FieldAfterReadHook, $ as FieldAfterReadHookArgs, a0 as FieldBeforeChangeHook, a1 as FieldBeforeChangeHookArgs, a2 as FieldHook, a3 as FieldType, a4 as FileData, a5 as GlobalAfterChangeHook, a6 as GlobalAfterReadHook, a7 as GlobalBeforeChangeHook, a8 as GlobalBeforeReadHook, a9 as HookFunction, aa as IconField, ab as ImageField, ac as ImageService, ad as JoinField, ae as JsonField, af as LIFECYCLE_EVENT_NAMES, ag as LifecycleEventHandler, ah as MultiSelectField, ai as NumberField, aj as OIDCAdminAuthProvider, ak as ObjectField, al as PaginatedResult, am as PublicAdminAuthProvider, an as RadioField, ao as ReadonlyDatabaseAdapter, ap as RelationshipField, aq as RichTextField, ar as RowField, as as SelectField, at as StorageAdapter, au as TextField, av as TextareaField, aw as TimeField, ax as UploadConfig, ay as UrlField, az as WordLimitFieldConfig, aA as WorkflowMetadata, aB as WorkflowRole, aC as WorkflowState, aD as WorkflowTransitionContext } from './app-config-2vF6W56z.js';
 import 'lucide-react';
 
 type Prettify<T> = {

package/dist/server.cjs

@@ -2156,7 +2156,16 @@ var AdminAuthController = class {
     if (!provider.startUrl) {
       return c.json({ error: true, message: "This provider does not expose a start URL." }, 400);
     }
-    const url = new URL(provider.startUrl);
+    const url = this.buildCustomProviderStartUrl(provider.startUrl, new URL(c.req.url).origin);
+    if (!url) {
+      return c.json(
+        {
+          error: true,
+          message: `Admin auth provider "${provider.id}" has an invalid start URL.`
+        },
+        500
+      );
+    }
     url.searchParams.set("returnTo", returnTo);
     if (siteId) url.searchParams.set("siteId", siteId);
     url.searchParams.set("provider", provider.id);
@@ -2470,6 +2479,17 @@ var AdminAuthController = class {
   defaultCallbackPath(providerId, origin = "") {
     return `${origin}/api/admin/auth/${providerId}/callback`;
   }
+  buildCustomProviderStartUrl(startUrl, origin) {
+    const value = startUrl.trim();
+    if (!value || /^(undefined|null)(\/|$)/i.test(value)) return null;
+    try {
+      const url = new URL(value, origin);
+      if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+      return url;
+    } catch {
+      return null;
+    }
+  }
   async signState(payload) {
     return new import_jose2.SignJWT(payload).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime("15m").sign(this.getStateSecret());
   }

package/dist/server.d.cts

@@ -1,7 +1,7 @@
 import * as hono_types from 'hono/types';
 import * as hono from 'hono';
 import { Hono, Context } from 'hono';
-import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './app-config-BLMX-9MN.cjs';
+import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './app-config-2vF6W56z.cjs';
 import * as hono_utils_http_status from 'hono/utils/http-status';
 import * as hono_utils_types from 'hono/utils/types';
 import 'lucide-react';

package/dist/server.d.ts

@@ -1,7 +1,7 @@
 import * as hono_types from 'hono/types';
 import * as hono from 'hono';
 import { Hono, Context } from 'hono';
-import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './app-config-BLMX-9MN.js';
+import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './app-config-2vF6W56z.js';
 import * as hono_utils_http_status from 'hono/utils/http-status';
 import * as hono_utils_types from 'hono/utils/types';
 import 'lucide-react';

package/dist/server.js

@@ -1655,7 +1655,16 @@ var AdminAuthController = class {
     if (!provider.startUrl) {
       return c.json({ error: true, message: "This provider does not expose a start URL." }, 400);
     }
-    const url = new URL(provider.startUrl);
+    const url = this.buildCustomProviderStartUrl(provider.startUrl, new URL(c.req.url).origin);
+    if (!url) {
+      return c.json(
+        {
+          error: true,
+          message: `Admin auth provider "${provider.id}" has an invalid start URL.`
+        },
+        500
+      );
+    }
     url.searchParams.set("returnTo", returnTo);
     if (siteId) url.searchParams.set("siteId", siteId);
     url.searchParams.set("provider", provider.id);
@@ -1969,6 +1978,17 @@ var AdminAuthController = class {
   defaultCallbackPath(providerId, origin = "") {
     return `${origin}/api/admin/auth/${providerId}/callback`;
   }
+  buildCustomProviderStartUrl(startUrl, origin) {
+    const value = startUrl.trim();
+    if (!value || /^(undefined|null)(\/|$)/i.test(value)) return null;
+    try {
+      const url = new URL(value, origin);
+      if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+      return url;
+    } catch {
+      return null;
+    }
+  }
   async signState(payload) {
     return new SignJWT2(payload).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime("15m").sign(this.getStateSecret());
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dyrected/core",
-  "version": "2.5.42",
+  "version": "2.5.43",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",