@frontegg/redux-store 6.78.0 → 6.79.0-alpha.0

package/auth/LoginState/index.d.ts

@@ -202,3 +202,4 @@ declare type DispatchedActions = {
 };
 export declare type LoginActions = DispatchedActions;
 export { loginState, reducers as loginReducers, actions as loginActions };
+export { getRedirectUrl } from './utils';

package/auth/LoginState/index.js

@@ -126,4 +126,5 @@ const actions = {
  *  contains the same functions in reducers and actions
  */
 const Matcher = {};
-export { loginState, reducers as loginReducers, actions as loginActions };
+export { loginState, reducers as loginReducers, actions as loginActions };
+export { getRedirectUrl } from './utils';

package/auth/LoginState/saga.d.ts

@@ -6,6 +6,8 @@ import { MFAState } from '../MfaState/interfaces';
 export declare function afterAuthNavigation(): Generator<Promise<unknown> | import("redux-saga/effects").SelectEffect, void, {
     routes: any;
     includeQueryParam: any;
+    enforceRedirectToSameSite?: false | undefined;
+    allowedRedirectOrigins?: never[] | undefined;
 }>;
 export declare function refreshMetadata(): Generator<import("redux-saga/effects").PutEffect<{
     payload: Partial<AuthState>;

package/auth/LoginState/saga.js

@@ -34,6 +34,7 @@ import { ResetPhoneNumberStep } from '../ResetPhoneNumberState/interfaces';
 import { base64urlDecode, delay, publicKeyCredentialToJSON } from '../utils';
 import { loadPublicAuthStrategiesPolicy } from '../SecurityPolicyState/saga';
 import { useIsPasskeysEnabled } from '../PasskeysState/helpers';
+import { getRedirectUrl } from './utils';
 const authStrategyLoginStepMap = {
   [AuthStrategyEnum.Code]: LoginStep.loginWithOtc,
   [AuthStrategyEnum.EmailAndPassword]: LoginStep.loginWithPassword,
@@ -41,11 +42,12 @@ const authStrategyLoginStepMap = {
   [AuthStrategyEnum.SmsCode]: LoginStep.loginWithSmsOtc
 };
 export function* afterAuthNavigation() {
-  var _window;
   const onRedirectTo = ContextHolder.onRedirectTo;
   const {
     routes,
-    includeQueryParam
+    includeQueryParam,
+    enforceRedirectToSameSite = false,
+    allowedRedirectOrigins = []
   } = yield select(state => state.auth);
   const {
     loginUrl,
@@ -63,14 +65,12 @@ export function* afterAuthNavigation() {
   window.localStorage.removeItem(FRONTEGG_AFTER_AUTH_REDIRECT_URL);
   yield delay(200);
   put(actions.resetLoginState());
-  const url = new URL((_window = window) == null ? void 0 : _window.location.href);
-  let redirectUrl = authenticatedUrl;
-  if (url.searchParams.get('redirectUrl')) {
-    var _url$searchParams$get;
-    redirectUrl = (_url$searchParams$get = url.searchParams.get('redirectUrl')) != null ? _url$searchParams$get : authenticatedUrl;
-  } else if (includeQueryParam) {
-    redirectUrl += window.location.search;
-  }
+  const redirectUrl = getRedirectUrl({
+    authenticatedUrl,
+    includeQueryParam,
+    enforceRedirectToSameSite,
+    allowedRedirectOrigins
+  });
   onRedirectTo(redirectUrl, {
     refresh: redirectUrl.startsWith('http')
   });
@@ -410,8 +410,8 @@ function* refreshTokenEmbeddedSocialLogins() {
   }
 }
 function* handleRedirectRefreshToken(shouldNavigateToRegisterQuickLogin) {
-  var _window2;
-  const url = new URL((_window2 = window) == null ? void 0 : _window2.location.href);
+  var _window;
+  const url = new URL((_window = window) == null ? void 0 : _window.location.href);
   const onRedirectTo = ContextHolder.onRedirectTo;
   const {
     routes,
@@ -509,11 +509,11 @@ function* requestAuthorizeSSR({
 }
 const getUri = urlStrategy => {
   if (urlStrategy === 'path') {
-    var _window3;
-    return ((_window3 = window) != null ? _window3 : document).location.pathname;
+    var _window2;
+    return ((_window2 = window) != null ? _window2 : document).location.pathname;
   } else {
-    var _window4;
-    const uri = (((_window4 = window) != null ? _window4 : document).location.hash || '#').substring(1);
+    var _window3;
+    const uri = (((_window3 = window) != null ? _window3 : document).location.hash || '#').substring(1);
     if (uri.indexOf('?') !== -1) {
       return uri.substring(0, uri.indexOf('?'));
     } else {
@@ -1449,9 +1449,12 @@ function* handleVerifyMFAResponse({
   if (user.id) {
     localStorage.setItem('userId', user.id);
   }
+  const {
+    step: mfaStep
+  } = yield select(state => state.auth.mfaState);
   if (loginState.flow === LoginFlow.Login) {
     const shouldShowPrompt = yield call(shouldShowPromptPasskeys);
-    if (shouldShowPrompt) {
+    if (mfaStep === MFAStep.smsVerifyCode && shouldShowPrompt) {
       yield put(actions.setLoginState({
         step: LoginStep.promptPasskeys,
         loading: false

package/auth/LoginState/utils.d.ts

@@ -0,0 +1,6 @@
+export declare const getRedirectUrl: ({ authenticatedUrl, enforceRedirectToSameSite, allowedRedirectOrigins, includeQueryParam, }: {
+    authenticatedUrl: string;
+    enforceRedirectToSameSite: boolean;
+    allowedRedirectOrigins: string[];
+    includeQueryParam: boolean;
+}) => string;

package/auth/LoginState/utils.js

@@ -0,0 +1,39 @@
+const isAbsoluteUrl = path => {
+  try {
+    new URL(path);
+    return true;
+  } catch (e) {
+    return false;
+  }
+};
+const isValidRedirectUrl = (redirectUrl, allowedRedirectOrigins) => {
+  const currentUrl = new URL(window.location.href);
+  const redirectURL = new URL(redirectUrl);
+  const isSameSite = redirectURL.origin === currentUrl.origin;
+  const isOriginInWhiteList = allowedRedirectOrigins.includes(redirectURL.origin);
+  return isOriginInWhiteList || isSameSite;
+};
+export const getRedirectUrl = ({
+  authenticatedUrl,
+  enforceRedirectToSameSite,
+  allowedRedirectOrigins,
+  includeQueryParam
+}) => {
+  const currentUrl = new URL(window.location.href);
+  let redirectUrl = authenticatedUrl;
+  const redirectUrlQueryParam = currentUrl.searchParams.get('redirectUrl');
+  if (redirectUrlQueryParam) {
+    if (!enforceRedirectToSameSite || !isAbsoluteUrl(redirectUrlQueryParam)) {
+      redirectUrl = redirectUrlQueryParam;
+    } else {
+      if (isValidRedirectUrl(redirectUrlQueryParam, allowedRedirectOrigins)) {
+        redirectUrl = redirectUrlQueryParam;
+      } else {
+        console.warn('The redirect url param is not valid, the origin is a different site');
+      }
+    }
+  } else if (includeQueryParam) {
+    redirectUrl += window.location.search;
+  }
+  return redirectUrl;
+};

package/index.js

@@ -1,4 +1,4 @@
-/** @license Frontegg v6.78.0
+/** @license Frontegg v6.79.0-alpha.0
  *
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.

package/node/auth/LoginState/index.js

@@ -3,11 +3,18 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
+Object.defineProperty(exports, "getRedirectUrl", {
+  enumerable: true,
+  get: function () {
+    return _utils2.getRedirectUrl;
+  }
+});
 exports.loginState = exports.loginReducers = exports.loginActions = void 0;
 var _toolkit = require("@reduxjs/toolkit");
 var _interfaces = require("./interfaces");
 var _utils = require("../utils");
 var _constants = require("../../constants");
+var _utils2 = require("./utils");
 const loginState = {
   flow: _interfaces.LoginFlow.Login,
   step: _interfaces.LoginStep.preLogin,

package/node/auth/LoginState/saga.js

@@ -32,6 +32,7 @@ var _interfaces5 = require("../ResetPhoneNumberState/interfaces");
 var _utils = require("../utils");
 var _saga3 = require("../SecurityPolicyState/saga");
 var _helpers2 = require("../PasskeysState/helpers");
+var _utils2 = require("./utils");
 const _excluded = ["callback"],
   _excluded2 = ["callback"],
   _excluded3 = ["callback"],
@@ -57,11 +58,12 @@ const authStrategyLoginStepMap = {
   [_restApi.AuthStrategyEnum.SmsCode]: _interfaces2.LoginStep.loginWithSmsOtc
 };
 function* afterAuthNavigation() {
-  var _window;
   const onRedirectTo = _restApi.ContextHolder.onRedirectTo;
   const {
     routes,
-    includeQueryParam
+    includeQueryParam,
+    enforceRedirectToSameSite = false,
+    allowedRedirectOrigins = []
   } = yield (0, _effects.select)(state => state.auth);
   const {
     loginUrl,
@@ -79,14 +81,12 @@ function* afterAuthNavigation() {
   window.localStorage.removeItem(_constants.FRONTEGG_AFTER_AUTH_REDIRECT_URL);
   yield (0, _utils.delay)(200);
   (0, _effects.put)(_reducer.actions.resetLoginState());
-  const url = new URL((_window = window) == null ? void 0 : _window.location.href);
-  let redirectUrl = authenticatedUrl;
-  if (url.searchParams.get('redirectUrl')) {
-    var _url$searchParams$get;
-    redirectUrl = (_url$searchParams$get = url.searchParams.get('redirectUrl')) != null ? _url$searchParams$get : authenticatedUrl;
-  } else if (includeQueryParam) {
-    redirectUrl += window.location.search;
-  }
+  const redirectUrl = (0, _utils2.getRedirectUrl)({
+    authenticatedUrl,
+    includeQueryParam,
+    enforceRedirectToSameSite,
+    allowedRedirectOrigins
+  });
   onRedirectTo(redirectUrl, {
     refresh: redirectUrl.startsWith('http')
   });
@@ -427,8 +427,8 @@ function* refreshTokenEmbeddedSocialLogins() {
   }
 }
 function* handleRedirectRefreshToken(shouldNavigateToRegisterQuickLogin) {
-  var _window2;
-  const url = new URL((_window2 = window) == null ? void 0 : _window2.location.href);
+  var _window;
+  const url = new URL((_window = window) == null ? void 0 : _window.location.href);
   const onRedirectTo = _restApi.ContextHolder.onRedirectTo;
   const {
     routes,
@@ -526,11 +526,11 @@ function* requestAuthorizeSSR({
 }
 const getUri = urlStrategy => {
   if (urlStrategy === 'path') {
-    var _window3;
-    return ((_window3 = window) != null ? _window3 : document).location.pathname;
+    var _window2;
+    return ((_window2 = window) != null ? _window2 : document).location.pathname;
   } else {
-    var _window4;
-    const uri = (((_window4 = window) != null ? _window4 : document).location.hash || '#').substring(1);
+    var _window3;
+    const uri = (((_window3 = window) != null ? _window3 : document).location.hash || '#').substring(1);
     if (uri.indexOf('?') !== -1) {
       return uri.substring(0, uri.indexOf('?'));
     } else {
@@ -1466,9 +1466,12 @@ function* handleVerifyMFAResponse({
   if (user.id) {
     localStorage.setItem('userId', user.id);
   }
+  const {
+    step: mfaStep
+  } = yield (0, _effects.select)(state => state.auth.mfaState);
   if (loginState.flow === _interfaces2.LoginFlow.Login) {
     const shouldShowPrompt = yield (0, _effects.call)(shouldShowPromptPasskeys);
-    if (shouldShowPrompt) {
+    if (mfaStep === _interfaces3.MFAStep.smsVerifyCode && shouldShowPrompt) {
       yield (0, _effects.put)(_reducer.actions.setLoginState({
         step: _interfaces2.LoginStep.promptPasskeys,
         loading: false

package/node/auth/LoginState/utils.js

@@ -0,0 +1,46 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.getRedirectUrl = void 0;
+const isAbsoluteUrl = path => {
+  try {
+    new URL(path);
+    return true;
+  } catch (e) {
+    return false;
+  }
+};
+const isValidRedirectUrl = (redirectUrl, allowedRedirectOrigins) => {
+  const currentUrl = new URL(window.location.href);
+  const redirectURL = new URL(redirectUrl);
+  const isSameSite = redirectURL.origin === currentUrl.origin;
+  const isOriginInWhiteList = allowedRedirectOrigins.includes(redirectURL.origin);
+  return isOriginInWhiteList || isSameSite;
+};
+const getRedirectUrl = ({
+  authenticatedUrl,
+  enforceRedirectToSameSite,
+  allowedRedirectOrigins,
+  includeQueryParam
+}) => {
+  const currentUrl = new URL(window.location.href);
+  let redirectUrl = authenticatedUrl;
+  const redirectUrlQueryParam = currentUrl.searchParams.get('redirectUrl');
+  if (redirectUrlQueryParam) {
+    if (!enforceRedirectToSameSite || !isAbsoluteUrl(redirectUrlQueryParam)) {
+      redirectUrl = redirectUrlQueryParam;
+    } else {
+      if (isValidRedirectUrl(redirectUrlQueryParam, allowedRedirectOrigins)) {
+        redirectUrl = redirectUrlQueryParam;
+      } else {
+        console.warn('The redirect url param is not valid, the origin is a different site');
+      }
+    }
+  } else if (includeQueryParam) {
+    redirectUrl += window.location.search;
+  }
+  return redirectUrl;
+};
+exports.getRedirectUrl = getRedirectUrl;

package/node/index.js

@@ -1,4 +1,4 @@
-/** @license Frontegg v6.78.0
+/** @license Frontegg v6.79.0-alpha.0
  *
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontegg/redux-store",
-  "version": "6.78.0",
+  "version": "6.79.0-alpha.0",
   "main": "./node/index.js",
   "license": "MIT",
   "author": "Frontegg LTD",