@farm.js/integration-utils 0.1.0-beta.106 → 0.1.0-beta.107

package/dist/cookies.d.ts

@@ -11,8 +11,10 @@ export interface RequestCookieOptions {
     domain?: string;
     expires?: Date;
 }
+/** Collapse duplicate names using the first value in request-header order. */
 export declare function parseCookieHeaderMap(header: string | null): Record<string, string>;
 export declare function parseCookieHeaderList(header: string | null): ParsedCookie[];
+/** Read the first matching value, consistent with core `cookies().get(name)`. */
 export declare function getCookieValue(headers: Headers, name: string): string | null;
 export declare function createRequestCookie(name: string, value: string, request: Request, options?: RequestCookieOptions): string;
 export declare function clearRequestCookie(name: string, request: Request, options?: Omit<RequestCookieOptions, "maxAge">): string;

package/dist/cookies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../src/cookies.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,IAAI,CAAC;CAChB;AAiBD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAelF;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,YAAY,EAAE,CAK3E;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE5E;AAED,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,oBAAyB,GACjC,MAAM,CA4BR;AAED,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAM,GACjD,MAAM,CAKR"}
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../src/cookies.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,IAAI,CAAC;CAChB;AAED,8EAA8E;AAC9E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASlF;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,YAAY,EAAE,CAE3E;AAED,iFAAiF;AACjF,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK5E;AAED,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,oBAAyB,GACjC,MAAM,CA4BR;AAED,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAM,GACjD,MAAM,CAKR"}

package/dist/cookies.js

@@ -1,39 +1,21 @@
-/**
- * Decode a cookie value, tolerating malformed percent-encoding. A request can
- * carry a cookie whose value is not valid UTF-8 percent-encoding (a latin-1
- * value from an old link, a crawler, or an attacker-planted sibling-domain
- * cookie); `decodeURIComponent` throws `URIError` on those. Falling back to the
- * raw value keeps a single bad cookie from turning every auth route into a 500.
- */
-function decodeCookieValue(value) {
-    try {
-        return decodeURIComponent(value);
-    }
-    catch {
-        return value;
-    }
-}
+import { parseRequestCookieHeader } from "@farm.js/core/internal/request-cookies";
+/** Collapse duplicate names using the first value in request-header order. */
 export function parseCookieHeaderMap(header) {
-    if (!header) {
-        return {};
+    const cookies = Object.create(null);
+    for (const cookie of parseCookieHeaderList(header)) {
+        if (Object.prototype.hasOwnProperty.call(cookies, cookie.name))
+            continue;
+        cookies[cookie.name] = cookie.value;
     }
-    return Object.fromEntries(header
-        .split(";")
-        .map((part) => part.trim())
-        .filter(Boolean)
-        .map((part) => {
-        const [key, ...rest] = part.split("=");
-        return [key, decodeCookieValue(rest.join("="))];
-    }));
+    return cookies;
 }
 export function parseCookieHeaderList(header) {
-    return Object.entries(parseCookieHeaderMap(header)).map(([name, value]) => ({
-        name,
-        value,
-    }));
+    return parseRequestCookieHeader(header);
 }
+/** Read the first matching value, consistent with core `cookies().get(name)`. */
 export function getCookieValue(headers, name) {
-    return parseCookieHeaderMap(headers.get("cookie"))[name] ?? null;
+    return (parseCookieHeaderList(headers.get("cookie")).find((cookie) => cookie.name === name)?.value ??
+        null);
 }
 export function createRequestCookie(name, value, request, options = {}) {
     const requestUrl = new URL(request.url);

package/dist/url.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"url.d.ts","sourceRoot":"","sources":["../src/url.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,4BAA4B;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,QAAQ,SAAM,GAAG,MAAM,CAgBvF;AAED,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,iBAAiB,CAAC,EAAE,MAAM,GACzB,GAAG,CAML;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,GAAG,CAUjG;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAU1F;AAQD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,4BAA4B,EACnC,iBAAiB,CAAC,EAAE,MAAM,GACzB;IACD,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,KAAK,MAAM,CAAC;CAClG,CAkCA"}
+{"version":3,"file":"url.d.ts","sourceRoot":"","sources":["../src/url.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,4BAA4B;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,QAAQ,SAAM,GAAG,MAAM,CAWvF;AAED,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,iBAAiB,CAAC,EAAE,MAAM,GACzB,GAAG,CAML;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,GAAG,CAUjG;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAU1F;AAiBD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,4BAA4B,EACnC,iBAAiB,CAAC,EAAE,MAAM,GACzB;IACD,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,KAAK,MAAM,CAAC;CAClG,CAkCA"}

package/dist/url.js

@@ -7,11 +7,7 @@ export function getReturnTo(rawValue, fallback = "/") {
     // and the URL parser treat "\" as "/") both begin with "/" yet resolve to a
     // foreign origin when passed to `new URL(returnTo, origin)`, giving an open
     // redirect after a legitimate login.
-    if (!rawValue || !rawValue.startsWith("/")) {
-        return fallback;
-    }
-    const second = rawValue[1];
-    if (second === "/" || second === "\\") {
+    if (!rawValue || !isSameOriginRootRelativePath(rawValue)) {
         return fallback;
     }
     return rawValue;
@@ -45,8 +41,18 @@ export function resolveAppPath(path, label) {
 function isSameOriginRootRelativePath(value) {
     if (!value.startsWith("/"))
         return false;
-    const second = value[1];
-    return second !== "/" && second !== "\\";
+    // The URL parser removes ASCII tab, carriage return, and line feed before
+    // parsing. Reject them before resolution so `/\n/evil.example` cannot turn
+    // into the protocol-relative URL `//evil.example`.
+    if (/[\t\n\r]/.test(value))
+        return false;
+    const trustedOrigin = "https://farm.invalid";
+    try {
+        return new URL(value, trustedOrigin).origin === trustedOrigin;
+    }
+    catch {
+        return false;
+    }
 }
 export function resolveCallbackSettings(input, configuredBaseUrl) {
     if (input.callbackUrl) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@farm.js/integration-utils",
-  "version": "0.1.0-beta.106",
+  "version": "0.1.0-beta.107",
   "description": "Shared integration utilities for Farm.js",
   "license": "MIT",
   "repository": {
@@ -53,7 +53,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@farm.js/core": "0.1.0-beta.106"
+    "@farm.js/core": "0.1.0-beta.107"
   },
   "scripts": {
     "build": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc",