@farm.js/workos 0.1.0-beta.98 → 0.1.0-beta.99

package/dist/index.d.ts

@@ -14,6 +14,12 @@ export interface WorkOSIntegrationInput {
     logoutPath?: string;
     sessionPath?: string;
     protectedRoutes?: string | string[];
+    /**
+     * Additional origins allowed to post the sign-out route, using the same
+     * pattern syntax as `serverActions.allowedOrigins`. The app's own origin is
+     * always trusted.
+     */
+    allowedOrigins?: string[];
     log?: FarmIntegrationLogger;
 }
 export type WorkOSIntegrationInstance = WorkOS;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAuC,KAAK,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAWhG,OAAO,KAAK,EAAuB,oBAAoB,EAAuB,MAAM,aAAa,CAAC;AAQlG,MAAM,WAAW,sBAAsB;IACrC,2FAA2F;IAC3F,QAAQ,CAAC,EAAE,yBAAyB,CAAC;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACpC,GAAG,CAAC,EAAE,qBAAqB,CAAC;CAC7B;AAED,MAAM,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAc/C,UAAU,oBAAoB;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;CACxB;AAqFD,wBAAgB,MAAM,CAAC,KAAK,GAAE,sBAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAqMG,MAAM;;;;yBAoE7B,OAAO;;GAe3C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAuC,KAAK,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAgBhG,OAAO,KAAK,EAAuB,oBAAoB,EAAuB,MAAM,aAAa,CAAC;AAQlG,MAAM,WAAW,sBAAsB;IACrC,2FAA2F;IAC3F,QAAQ,CAAC,EAAE,yBAAyB,CAAC;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACpC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,GAAG,CAAC,EAAE,qBAAqB,CAAC;CAC7B;AAED,MAAM,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAc/C,UAAU,oBAAoB;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;CACxB;AAqFD,wBAAgB,MAAM,CAAC,KAAK,GAAE,sBAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAoOG,MAAM;;;;yBAyE7B,OAAO;;GAe3C"}

package/dist/index.js

@@ -1,6 +1,7 @@
 import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import { WorkOS } from "@workos-inc/node";
 import { defineIntegration, integrationRoute } from "@farm.js/core";
+import { describeIntegrationOriginRejection, resolveIntegrationAllowedOrigins, validateIntegrationRequestOrigin, } from "@farm.js/core/integrations";
 import { clearRequestCookie, createPathInferredClientApi, createDocumentNavigationMatchers, createRequestCookie, getCookieValue, getReturnTo, integrationConfig, normalizeMatchers, } from "@farm.js/integration-utils";
 import { workosClient } from "./client.js";
 const DEV_COOKIE_PASSWORD = "farmjs-workos-cookie-password-development-2026";
@@ -76,6 +77,7 @@ export function workos(input = {}) {
     const callbackPath = input.callbackPath ?? "/callback";
     const logoutPath = input.logoutPath ?? "/logout";
     const sessionPath = input.sessionPath ?? "/auth/session";
+    const allowedOrigins = resolveIntegrationAllowedOrigins(input.allowedOrigins, "workos.allowedOrigins");
     const workos = input.instance ??
         new WorkOS({
             apiKey,
@@ -118,6 +120,27 @@ export function workos(input = {}) {
             return null;
         }
     }
+    /**
+     * Reject a sign-out request that did not come from this app. Returns the
+     * response to send, or null when the request may proceed.
+     */
+    function rejectForeignOrigin(request) {
+        const result = validateIntegrationRequestOrigin(request, {
+            allowedOrigins,
+            requireOriginMetadata: request.method === "POST",
+        });
+        if (result.ok) {
+            return null;
+        }
+        const message = describeIntegrationOriginRejection(result.reason);
+        if (request.headers.get("x-farm-integration-client") === "1") {
+            return Response.json({ error: message }, { status: 403 });
+        }
+        return new Response(message, {
+            status: 403,
+            headers: { "content-type": "text/plain; charset=utf-8" },
+        });
+    }
     async function redirectToAuth(request, screenHint) {
         const requestUrl = new URL(request.url);
         const returnTo = getReturnTo(requestUrl.searchParams.get("returnTo"), "/dashboard");
@@ -243,6 +266,10 @@ export function workos(input = {}) {
             integrationRoute.post(logoutPath, {
                 responseFormat: "json",
                 async handler(request) {
+                    const rejected = rejectForeignOrigin(request);
+                    if (rejected) {
+                        return rejected;
+                    }
                     const requestUrl = new URL(request.url);
                     const sessionState = await getSession(workos, request, cookieName, cookiePassword);
                     const headers = new Headers();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@farm.js/workos",
-  "version": "0.1.0-beta.98",
+  "version": "0.1.0-beta.99",
   "description": "WorkOS integration for Farm.js",
   "license": "MIT",
   "repository": {
@@ -30,8 +30,8 @@
   },
   "dependencies": {
     "@workos-inc/node": "^8.9.0",
-    "@farm.js/core": "0.1.0-beta.98",
-    "@farm.js/integration-utils": "0.1.0-beta.98"
+    "@farm.js/integration-utils": "0.1.0-beta.99",
+    "@farm.js/core": "0.1.0-beta.99"
   },
   "scripts": {
     "build": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc",