@farm.js/auth0 0.1.0-beta.98 → 0.1.0

package/README.md

@@ -2,10 +2,10 @@
 
 Auth0 integration for Farm.js
 
-Farm.js is currently in beta.
+See [Stability and Support](https://farmjs.dev/docs/stability) for what this package guarantees.
 
 ```bash
-npm install @farm.js/auth0@beta
+npm install @farm.js/auth0
 ```
 
 See the [Farm.js repository](https://github.com/farming-labs/farm.js) for documentation, examples, and support.

package/dist/index.d.ts

@@ -17,6 +17,12 @@ export interface Auth0IntegrationInput {
     logoutPath?: string;
     profilePath?: string;
     protectedRoutes?: string | string[];
+    /**
+     * Additional origins allowed to drive the sign-out route, using the same
+     * pattern syntax as `serverActions.allowedOrigins`. The app's own origin is
+     * always trusted.
+     */
+    allowedOrigins?: string[];
     audience?: string;
     scopes?: string[];
     tokenEndpointAuthMethod?: "auto" | "client_secret_basic" | "client_secret_post" | "none";
@@ -46,7 +52,7 @@ export declare function auth0(input?: Auth0IntegrationInput): import("@farm.js/c
         clientId: string;
         protectedRoutes: string[];
     };
-    config: import("@farm.js/core").FarmIntegrationConfigDefinition<ResolvedAuth0Env, import("@farm.js/core").FarmIntegrationSchema | undefined>;
+    config: import("@farm.js/core").FarmIntegrationConfigDefinition<ResolvedAuth0Env, import("@farm.js/core").FarmSchema | undefined>;
     api: {
         [x: string]: {
             get: {
@@ -79,7 +85,7 @@ export declare function auth0(input?: Auth0IntegrationInput): import("@farm.js/c
     documentNavigations: {
         matcher: string[];
     }[];
-    routes: import("@farm.js/core").FarmTypedIntegrationRoute<string, never, any, unknown, false, "GET", import("@farm.js/core").FarmIntegrationSchema | undefined>[];
+    routes: import("@farm.js/core").FarmTypedIntegrationRoute<string, never, any, unknown, false, "GET", import("@farm.js/core").FarmSchema | undefined>[];
     middleware: {
         matcher: string[];
         handler(request: Request): Response | undefined;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAuC,KAAK,qBAAqB,EAAE,MAAM,eAAe,CAAC;AA2BhG,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,QAAQ,GAAG,IAAI,CAAC;IACzE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,uBAAuB,CAAC,EAAE,MAAM,GAAG,qBAAqB,GAAG,oBAAoB,GAAG,MAAM,CAAC;IACzF,GAAG,CAAC,EAAE,qBAAqB,CAAC;CAC7B;AAED,UAAU,gBAAgB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AA6PD,wBAAgB,KAAK,CAAC,KAAK,GAAE,qBAA0B;;;;;;;yBAU5B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBA6QH,OAAO;;GAmBrC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAuC,KAAK,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAgChG,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,QAAQ,GAAG,IAAI,CAAC;IACzE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACpC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,uBAAuB,CAAC,EAAE,MAAM,GAAG,qBAAqB,GAAG,oBAAoB,GAAG,MAAM,CAAC;IACzF,GAAG,CAAC,EAAE,qBAAqB,CAAC;CAC7B;AAED,UAAU,gBAAgB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AA6PD,wBAAgB,KAAK,CAAC,KAAK,GAAE,qBAA0B;;;;;;;yBAU5B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAsSH,OAAO;;GAmBrC"}

package/dist/index.js

@@ -1,5 +1,6 @@
 import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import { defineIntegration, integrationRoute } from "@farm.js/core";
+import { describeIntegrationOriginRejection, resolveIntegrationAllowedOrigins, validateIntegrationRequestOrigin, } from "@farm.js/core/integrations";
 import { clearRequestCookie, createPathInferredClientApi, createDocumentNavigationMatchers, createRequestCookie, getOrigin, getReturnTo, integrationConfig, normalizeMatchers, parseCookieHeaderMap, resolveCallbackSettings, } from "@farm.js/integration-utils";
 import { auth0Client } from "./client.js";
 const DEV_SECRET = "farmjs-auth0-development-secret-2026";
@@ -195,6 +196,7 @@ export function auth0(input = {}) {
     const logoutPath = input.logoutPath ?? "/auth/logout";
     const profilePath = input.profilePath ?? "/auth/profile";
     const scopes = input.scopes?.length ? input.scopes : ["openid", "profile", "email"];
+    const allowedOrigins = resolveIntegrationAllowedOrigins(input.allowedOrigins, "auth0.allowedOrigins");
     const stateCookieName = "farm_auth0_state";
     const sessionCookieName = "farm_auth0_session";
     const callbackSettings = resolveCallbackSettings({
@@ -343,6 +345,23 @@ export function auth0(input = {}) {
             integrationRoute.get(logoutPath, {
                 responseFormat: "json",
                 handler(request) {
+                    // Sign-out is a GET, so it is also reachable as a plain link or a
+                    // bookmark with no origin metadata at all. Only a request the browser
+                    // labelled cross-site is refused.
+                    const originResult = validateIntegrationRequestOrigin(request, {
+                        allowedOrigins,
+                        requireOriginMetadata: false,
+                    });
+                    if (!originResult.ok) {
+                        const message = describeIntegrationOriginRejection(originResult.reason);
+                        if (request.headers.get("x-farm-integration-client") === "1") {
+                            return Response.json({ error: message }, { status: 403 });
+                        }
+                        return new Response(message, {
+                            status: 403,
+                            headers: { "content-type": "text/plain; charset=utf-8" },
+                        });
+                    }
                     const origin = getOrigin(request, appBaseUrl);
                     const redirectTo = new URL("/v2/logout", `https://${domain}`);
                     redirectTo.searchParams.set("client_id", clientId);
@@ -392,7 +411,7 @@ export function auth0(input = {}) {
                         const requestUrl = new URL(request.url);
                         const redirectUrl = new URL(loginPath, getOrigin(request, appBaseUrl));
                         redirectUrl.searchParams.set("returnTo", `${requestUrl.pathname}${requestUrl.search}`);
-                        return Response.redirect(redirectUrl, 307);
+                        return Response.redirect(redirectUrl, 303); // 303 (See Other) mandates a GET on the GET-only login route regardless of the original method (RFC 7231 §6.4.4)
                     },
                 },
             ]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@farm.js/auth0",
-  "version": "0.1.0-beta.98",
+  "version": "0.1.0",
   "description": "Auth0 integration for Farm.js",
   "license": "MIT",
   "repository": {
@@ -29,8 +29,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@farm.js/core": "0.1.0-beta.98",
-    "@farm.js/integration-utils": "0.1.0-beta.98"
+    "@farm.js/core": "0.1.0",
+    "@farm.js/integration-utils": "0.1.0"
   },
   "scripts": {
     "build": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc",