@farm.js/auth0 0.1.0-beta.98 → 0.1.0-beta.99
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.d.ts +6 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +19 -0
- package/package.json +3 -3
package/dist/index.d.ts
CHANGED
|
@@ -17,6 +17,12 @@ export interface Auth0IntegrationInput {
|
|
|
17
17
|
logoutPath?: string;
|
|
18
18
|
profilePath?: string;
|
|
19
19
|
protectedRoutes?: string | string[];
|
|
20
|
+
/**
|
|
21
|
+
* Additional origins allowed to drive the sign-out route, using the same
|
|
22
|
+
* pattern syntax as `serverActions.allowedOrigins`. The app's own origin is
|
|
23
|
+
* always trusted.
|
|
24
|
+
*/
|
|
25
|
+
allowedOrigins?: string[];
|
|
20
26
|
audience?: string;
|
|
21
27
|
scopes?: string[];
|
|
22
28
|
tokenEndpointAuthMethod?: "auto" | "client_secret_basic" | "client_secret_post" | "none";
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAuC,KAAK,qBAAqB,EAAE,MAAM,eAAe,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAuC,KAAK,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAgChG,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,QAAQ,GAAG,IAAI,CAAC;IACzE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACpC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,uBAAuB,CAAC,EAAE,MAAM,GAAG,qBAAqB,GAAG,oBAAoB,GAAG,MAAM,CAAC;IACzF,GAAG,CAAC,EAAE,qBAAqB,CAAC;CAC7B;AAED,UAAU,gBAAgB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AA6PD,wBAAgB,KAAK,CAAC,KAAK,GAAE,qBAA0B;;;;;;;yBAU5B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAsSH,OAAO;;GAmBrC"}
|
package/dist/index.js
CHANGED
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
|
|
2
2
|
import { defineIntegration, integrationRoute } from "@farm.js/core";
|
|
3
|
+
import { describeIntegrationOriginRejection, resolveIntegrationAllowedOrigins, validateIntegrationRequestOrigin, } from "@farm.js/core/integrations";
|
|
3
4
|
import { clearRequestCookie, createPathInferredClientApi, createDocumentNavigationMatchers, createRequestCookie, getOrigin, getReturnTo, integrationConfig, normalizeMatchers, parseCookieHeaderMap, resolveCallbackSettings, } from "@farm.js/integration-utils";
|
|
4
5
|
import { auth0Client } from "./client.js";
|
|
5
6
|
const DEV_SECRET = "farmjs-auth0-development-secret-2026";
|
|
@@ -195,6 +196,7 @@ export function auth0(input = {}) {
|
|
|
195
196
|
const logoutPath = input.logoutPath ?? "/auth/logout";
|
|
196
197
|
const profilePath = input.profilePath ?? "/auth/profile";
|
|
197
198
|
const scopes = input.scopes?.length ? input.scopes : ["openid", "profile", "email"];
|
|
199
|
+
const allowedOrigins = resolveIntegrationAllowedOrigins(input.allowedOrigins, "auth0.allowedOrigins");
|
|
198
200
|
const stateCookieName = "farm_auth0_state";
|
|
199
201
|
const sessionCookieName = "farm_auth0_session";
|
|
200
202
|
const callbackSettings = resolveCallbackSettings({
|
|
@@ -343,6 +345,23 @@ export function auth0(input = {}) {
|
|
|
343
345
|
integrationRoute.get(logoutPath, {
|
|
344
346
|
responseFormat: "json",
|
|
345
347
|
handler(request) {
|
|
348
|
+
// Sign-out is a GET, so it is also reachable as a plain link or a
|
|
349
|
+
// bookmark with no origin metadata at all. Only a request the browser
|
|
350
|
+
// labelled cross-site is refused.
|
|
351
|
+
const originResult = validateIntegrationRequestOrigin(request, {
|
|
352
|
+
allowedOrigins,
|
|
353
|
+
requireOriginMetadata: false,
|
|
354
|
+
});
|
|
355
|
+
if (!originResult.ok) {
|
|
356
|
+
const message = describeIntegrationOriginRejection(originResult.reason);
|
|
357
|
+
if (request.headers.get("x-farm-integration-client") === "1") {
|
|
358
|
+
return Response.json({ error: message }, { status: 403 });
|
|
359
|
+
}
|
|
360
|
+
return new Response(message, {
|
|
361
|
+
status: 403,
|
|
362
|
+
headers: { "content-type": "text/plain; charset=utf-8" },
|
|
363
|
+
});
|
|
364
|
+
}
|
|
346
365
|
const origin = getOrigin(request, appBaseUrl);
|
|
347
366
|
const redirectTo = new URL("/v2/logout", `https://${domain}`);
|
|
348
367
|
redirectTo.searchParams.set("client_id", clientId);
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@farm.js/auth0",
|
|
3
|
-
"version": "0.1.0-beta.
|
|
3
|
+
"version": "0.1.0-beta.99",
|
|
4
4
|
"description": "Auth0 integration for Farm.js",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"repository": {
|
|
@@ -29,8 +29,8 @@
|
|
|
29
29
|
"access": "public"
|
|
30
30
|
},
|
|
31
31
|
"dependencies": {
|
|
32
|
-
"@farm.js/
|
|
33
|
-
"@farm.js/
|
|
32
|
+
"@farm.js/integration-utils": "0.1.0-beta.99",
|
|
33
|
+
"@farm.js/core": "0.1.0-beta.99"
|
|
34
34
|
},
|
|
35
35
|
"scripts": {
|
|
36
36
|
"build": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc",
|