@farm.js/auth0 0.1.0-beta.10 → 0.1.0-beta.101

package/dist/index.d.ts

@@ -17,6 +17,12 @@ export interface Auth0IntegrationInput {
     logoutPath?: string;
     profilePath?: string;
     protectedRoutes?: string | string[];
+    /**
+     * Additional origins allowed to drive the sign-out route, using the same
+     * pattern syntax as `serverActions.allowedOrigins`. The app's own origin is
+     * always trusted.
+     */
+    allowedOrigins?: string[];
     audience?: string;
     scopes?: string[];
     tokenEndpointAuthMethod?: "auto" | "client_secret_basic" | "client_secret_post" | "none";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAuC,KAAK,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAkBhG,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,QAAQ,GAAG,IAAI,CAAC;IACzE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,uBAAuB,CAAC,EAAE,MAAM,GAAG,qBAAqB,GAAG,oBAAoB,GAAG,MAAM,CAAC;IACzF,GAAG,CAAC,EAAE,qBAAqB,CAAC;CAC7B;AAED,UAAU,gBAAgB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AA2PD,wBAAgB,KAAK,CAAC,KAAK,GAAE,qBAA0B;;;;;;;yBAU5B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBA6QH,OAAO;;GAmBrC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAuC,KAAK,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAgChG,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,QAAQ,GAAG,IAAI,CAAC;IACzE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACpC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,uBAAuB,CAAC,EAAE,MAAM,GAAG,qBAAqB,GAAG,oBAAoB,GAAG,MAAM,CAAC;IACzF,GAAG,CAAC,EAAE,qBAAqB,CAAC;CAC7B;AAED,UAAU,gBAAgB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AA6PD,wBAAgB,KAAK,CAAC,KAAK,GAAE,qBAA0B;;;;;;;yBAU5B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAsSH,OAAO;;GAmBrC"}

package/dist/index.js

@@ -1,8 +1,17 @@
 import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import { defineIntegration, integrationRoute } from "@farm.js/core";
+import { describeIntegrationOriginRejection, resolveIntegrationAllowedOrigins, validateIntegrationRequestOrigin, } from "@farm.js/core/integrations";
 import { clearRequestCookie, createPathInferredClientApi, createDocumentNavigationMatchers, createRequestCookie, getOrigin, getReturnTo, integrationConfig, normalizeMatchers, parseCookieHeaderMap, resolveCallbackSettings, } from "@farm.js/integration-utils";
 import { auth0Client } from "./client.js";
 const DEV_SECRET = "farmjs-auth0-development-secret-2026";
+// The built server re-evaluates farm.config.ts at runtime to instantiate
+// integrations, and Farm does not force NODE_ENV=production into that process.
+// Treating an absent NODE_ENV as "development" would silently sign production
+// sessions with the public DEV_SECRET, so only an explicit dev/test value may
+// use it. `farm dev` runs through Vite, which sets NODE_ENV="development".
+function isExplicitDevelopmentEnv() {
+    return process.env.NODE_ENV === "development" || process.env.NODE_ENV === "test";
+}
 function createAuth0Api(input) {
     return createPathInferredClientApi({
         path: input.loginPath,
@@ -25,15 +34,15 @@ function resolveEnv(input) {
     const domain = normalizeDomain(input.domain ?? process.env.AUTH0_DOMAIN ?? "");
     const clientId = input.clientId ?? process.env.AUTH0_CLIENT_ID ?? "";
     const clientSecret = input.clientSecret ?? process.env.AUTH0_CLIENT_SECRET ?? "";
-    const secret = input.secret ??
-        process.env.AUTH0_SECRET ??
-        (process.env.NODE_ENV === "production" ? "" : DEV_SECRET);
+    const secret = input.secret ?? process.env.AUTH0_SECRET ?? (isExplicitDevelopmentEnv() ? DEV_SECRET : "");
     const appBaseUrl = input.appBaseUrl ?? process.env.APP_BASE_URL ?? undefined;
     if (!domain || !clientId) {
         throw new Error("Auth0 integration requires AUTH0_DOMAIN and AUTH0_CLIENT_ID.");
     }
     if (!secret) {
-        throw new Error("Auth0 integration requires AUTH0_SECRET in production.");
+        throw new Error("Auth0 integration requires AUTH0_SECRET. A development-only fallback secret is used " +
+            'only when NODE_ENV is "development" or "test"; set AUTH0_SECRET to a random 32-byte ' +
+            "value in every other environment.");
     }
     return {
         domain,
@@ -187,6 +196,7 @@ export function auth0(input = {}) {
     const logoutPath = input.logoutPath ?? "/auth/logout";
     const profilePath = input.profilePath ?? "/auth/profile";
     const scopes = input.scopes?.length ? input.scopes : ["openid", "profile", "email"];
+    const allowedOrigins = resolveIntegrationAllowedOrigins(input.allowedOrigins, "auth0.allowedOrigins");
     const stateCookieName = "farm_auth0_state";
     const sessionCookieName = "farm_auth0_session";
     const callbackSettings = resolveCallbackSettings({
@@ -335,6 +345,23 @@ export function auth0(input = {}) {
             integrationRoute.get(logoutPath, {
                 responseFormat: "json",
                 handler(request) {
+                    // Sign-out is a GET, so it is also reachable as a plain link or a
+                    // bookmark with no origin metadata at all. Only a request the browser
+                    // labelled cross-site is refused.
+                    const originResult = validateIntegrationRequestOrigin(request, {
+                        allowedOrigins,
+                        requireOriginMetadata: false,
+                    });
+                    if (!originResult.ok) {
+                        const message = describeIntegrationOriginRejection(originResult.reason);
+                        if (request.headers.get("x-farm-integration-client") === "1") {
+                            return Response.json({ error: message }, { status: 403 });
+                        }
+                        return new Response(message, {
+                            status: 403,
+                            headers: { "content-type": "text/plain; charset=utf-8" },
+                        });
+                    }
                     const origin = getOrigin(request, appBaseUrl);
                     const redirectTo = new URL("/v2/logout", `https://${domain}`);
                     redirectTo.searchParams.set("client_id", clientId);
@@ -384,7 +411,7 @@ export function auth0(input = {}) {
                         const requestUrl = new URL(request.url);
                         const redirectUrl = new URL(loginPath, getOrigin(request, appBaseUrl));
                         redirectUrl.searchParams.set("returnTo", `${requestUrl.pathname}${requestUrl.search}`);
-                        return Response.redirect(redirectUrl, 307);
+                        return Response.redirect(redirectUrl, 303); // 303 (See Other) mandates a GET on the GET-only login route regardless of the original method (RFC 7231 §6.4.4)
                     },
                 },
             ]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@farm.js/auth0",
-  "version": "0.1.0-beta.10",
+  "version": "0.1.0-beta.101",
   "description": "Auth0 integration for Farm.js",
   "license": "MIT",
   "repository": {
@@ -29,8 +29,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@farm.js/core": "0.1.0-beta.10",
-    "@farm.js/integration-utils": "0.1.0-beta.10"
+    "@farm.js/core": "0.1.0-beta.101",
+    "@farm.js/integration-utils": "0.1.0-beta.101"
   },
   "scripts": {
     "build": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc",