@ikonai/sdk-react-ui 1.6.0 → 1.8.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/auth/auth-service.d.ts +9 -0
- package/index.js +771 -750
- package/package.json +1 -1
- package/theme/ikon-app.css +259 -250
- package/theme/ikon-auth.css +290 -271
- package/theme/ikon-surface.css +107 -94
- package/theme/ikon-tokens.css +97 -95
package/auth/auth-service.d.ts
CHANGED
|
@@ -52,6 +52,15 @@ export declare function verifyLoginCode({ email, code, authUrl }: VerifyLoginCod
|
|
|
52
52
|
/**
|
|
53
53
|
* Parse OAuth callback parameters from the current URL.
|
|
54
54
|
* Returns the token and provider if present, or null if not an OAuth callback.
|
|
55
|
+
*
|
|
56
|
+
* FALLBACK, REMOVE WHEN NOTHING ASKS FOR IT. Adopting a bearer token out of the URL is what leaves
|
|
57
|
+
* session swapping open: a link carrying an attacker's token signs the visitor in as them, and this
|
|
58
|
+
* function cannot tell that link from a real callback. This build never produces one — it always
|
|
59
|
+
* sends a `code_challenge` — so the only callers left are the backend's own token fallback and app
|
|
60
|
+
* bundles frozen on an SDK older than 1.6.0.
|
|
61
|
+
*
|
|
62
|
+
* Delete together with the two fallbacks in the backend's `auth.controller.ts`, once its
|
|
63
|
+
* `delivered by` line shows no `token` sign-ins for a full retention window.
|
|
55
64
|
*/
|
|
56
65
|
export declare function parseOAuthCallback(): OAuthCallbackResult | null;
|
|
57
66
|
/** The single-use code an opted-in callback carries, waiting to be exchanged for a session. */
|