@logto/core-kit 2.11.0 → 2.13.0

package/lib/email-blocklist.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Validates an email blocklist item.
+ *
+ * An item can be either a full email address (`foo@example.com`) or a domain entry
+ * prefixed with `@` (`@example.com`). `*` can be used inside the local part or
+ * domain while keeping the same email/domain shapes.
+ */
+export declare const isEmailBlocklistItem: (value: string) => boolean;
+/**
+ * Checks whether an email address matches an email blocklist item.
+ *
+ * Matching is case-insensitive. Domain items (`@example.com`) match only the email
+ * domain, while full email items match the complete email address. `gmail.com` and
+ * `googlemail.com` are treated as the same domain, and dots in their local parts are
+ * ignored because Gmail treats those variants as the same mailbox.
+ */
+export declare const matchesEmailBlocklistItem: (item: string, email: string) => boolean;

package/lib/email-blocklist.js

@@ -0,0 +1,85 @@
+import { emailOrEmailDomainRegEx } from './regex.js';
+const wildcard = '*';
+const emailSeparator = '@';
+const domainSeparator = '.';
+const gmailDomains = new Set(['gmail.com', 'googlemail.com']);
+const whitespaceRegEx = /\s/u;
+const wildcardOnlyDomainRegEx = /^[*.]+$/u;
+const hasWildcard = (value) => value.includes(wildcard);
+const escapeRegExp = (value) => value.replaceAll(/[.+?^${}()|[\]\\]/gu, '\\$&');
+const buildWildcardRegExp = (pattern) => new RegExp(`^${escapeRegExp(pattern).replaceAll(wildcard, '.*')}$`, 'u');
+const matchesPattern = (pattern, value) => hasWildcard(pattern) ? buildWildcardRegExp(pattern).test(value) : pattern === value;
+const removeDotsFromLocalPart = (value) => {
+    const separatorIndex = value.indexOf(emailSeparator);
+    if (separatorIndex === -1) {
+        return value;
+    }
+    return `${value.slice(0, separatorIndex).replaceAll(domainSeparator, '')}${value.slice(separatorIndex)}`;
+};
+const buildGmailAddressVariants = (email) => {
+    const emailWithoutLocalPartDots = removeDotsFromLocalPart(email);
+    const separatorIndex = emailWithoutLocalPartDots.indexOf(emailSeparator);
+    const localPart = emailWithoutLocalPartDots.slice(0, separatorIndex);
+    return Array.from(gmailDomains, (domain) => `${localPart}${emailSeparator}${domain}`);
+};
+const isValidWildcardLocalPart = (localPart) => localPart.length > 0 && !localPart.includes(emailSeparator) && !whitespaceRegEx.test(localPart);
+const isValidWildcardDomain = (domain) => domain.length > 0 &&
+    domain.includes(domainSeparator) &&
+    !domain.includes(emailSeparator) &&
+    !domain.includes(`${domainSeparator}${domainSeparator}`) &&
+    !domain.startsWith(domainSeparator) &&
+    !domain.endsWith(domainSeparator) &&
+    !whitespaceRegEx.test(domain) &&
+    !wildcardOnlyDomainRegEx.test(domain);
+/**
+ * Validates an email blocklist item.
+ *
+ * An item can be either a full email address (`foo@example.com`) or a domain entry
+ * prefixed with `@` (`@example.com`). `*` can be used inside the local part or
+ * domain while keeping the same email/domain shapes.
+ */
+export const isEmailBlocklistItem = (value) => {
+    if (!hasWildcard(value)) {
+        return emailOrEmailDomainRegEx.test(value);
+    }
+    if (whitespaceRegEx.test(value)) {
+        return false;
+    }
+    if (value.startsWith(emailSeparator)) {
+        return isValidWildcardDomain(value.slice(1));
+    }
+    const emailParts = value.split(emailSeparator);
+    if (emailParts.length !== 2) {
+        return false;
+    }
+    const [localPart, domain] = emailParts;
+    return (localPart !== undefined &&
+        domain !== undefined &&
+        isValidWildcardLocalPart(localPart) &&
+        isValidWildcardDomain(domain));
+};
+/**
+ * Checks whether an email address matches an email blocklist item.
+ *
+ * Matching is case-insensitive. Domain items (`@example.com`) match only the email
+ * domain, while full email items match the complete email address. `gmail.com` and
+ * `googlemail.com` are treated as the same domain, and dots in their local parts are
+ * ignored because Gmail treats those variants as the same mailbox.
+ */
+export const matchesEmailBlocklistItem = (item, email) => {
+    const normalizedItem = item.toLowerCase();
+    const normalizedEmail = email.toLowerCase();
+    const domain = normalizedEmail.split(emailSeparator)[1];
+    if (normalizedItem.startsWith(emailSeparator)) {
+        if (!domain) {
+            return false;
+        }
+        const comparableDomains = gmailDomains.has(domain) ? gmailDomains : [domain];
+        return Array.from(comparableDomains).some((comparableDomain) => matchesPattern(normalizedItem.slice(1), comparableDomain));
+    }
+    const comparableItem = domain && gmailDomains.has(domain) ? removeDotsFromLocalPart(normalizedItem) : normalizedItem;
+    const comparableEmails = domain && gmailDomains.has(domain)
+        ? buildGmailAddressVariants(normalizedEmail)
+        : [normalizedEmail];
+    return comparableEmails.some((comparableEmail) => matchesPattern(comparableItem, comparableEmail));
+};

package/lib/index.d.ts

@@ -1,5 +1,6 @@
 export * from './utils/index.js';
 export * from './custom-ui-csp.js';
+export * from './email-blocklist.js';
 export * from './regex.js';
 export * from './openid.js';
 export * from './models/index.js';

package/lib/index.js

@@ -1,5 +1,6 @@
 export * from './utils/index.js';
 export * from './custom-ui-csp.js';
+export * from './email-blocklist.js';
 export * from './regex.js';
 export * from './openid.js';
 export * from './models/index.js';

package/lib/openid.d.ts

@@ -102,7 +102,14 @@ export declare enum UserScope {
      * Only used for session management via account API.
      * Not included in user claims, even when the scope is requested, as it's not meant for ID token or userinfo endpoint.
      */
-    Sessions = "urn:logto:scope:sessions"
+    Sessions = "urn:logto:scope:sessions",
+    /**
+     * Scope for user's trusted devices.
+     *
+     * Only used for trusted-device management via account API.
+     * Not included in user claims, even when the scope is requested, as it's not meant for ID token or userinfo endpoint.
+     */
+    TrustedDevices = "urn:logto:scope:trusted_devices"
 }
 /**
  * Mapped claims that ID Token includes.

package/lib/openid.js

@@ -137,6 +137,13 @@ export var UserScope;
      * Not included in user claims, even when the scope is requested, as it's not meant for ID token or userinfo endpoint.
      */
     UserScope["Sessions"] = "urn:logto:scope:sessions";
+    /**
+     * Scope for user's trusted devices.
+     *
+     * Only used for trusted-device management via account API.
+     * Not included in user claims, even when the scope is requested, as it's not meant for ID token or userinfo endpoint.
+     */
+    UserScope["TrustedDevices"] = "urn:logto:scope:trusted_devices";
 })(UserScope || (UserScope = {}));
 /**
  * Mapped claims that ID Token includes.
@@ -178,6 +185,7 @@ export const idTokenClaims = Object.freeze({
     [UserScope.CustomData]: [],
     [UserScope.Identities]: [],
     [UserScope.Sessions]: [],
+    [UserScope.TrustedDevices]: [],
 });
 /**
  * Extended claims for ID token grouped by scope, controlled by tenant configuration.

package/lib/regex.js

@@ -1,13 +1,13 @@
 export const emailRegEx = /^\S+@\S+\.\S+$/;
 /** Validates full email address or email domain. */
-export const emailOrEmailDomainRegEx = /^\S+@\S+\.\S+|^@\S+\.\S+$/;
+export const emailOrEmailDomainRegEx = /^(?:[^\s@]+@[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?)+|@[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?)+)$(?![\s\S])/u;
 export const phoneRegEx = /^\d+$/;
 export const phoneInputRegEx = /^\+?[\d-( )]+$/;
 export const usernameRegEx = /^[A-Z_a-z]\w*$/;
 export const webRedirectUriProtocolRegEx = /^https?:$/;
 export const mobileUriSchemeProtocolRegEx = /^(?!http(s)?:)[a-z][\d+_a-z-]*(\.[\d+_a-z-]+)*:$/;
 export const hexColorRegEx = /^#[\da-f]{3}([\da-f]{3})?$/i;
-export const dateRegEx = /^\d{4}(-\d{2}){2}/;
+export const dateRegEx = /^\d{4}(-\d{2}){2}$/;
 export const noSpaceRegEx = /^\S+$/;
 /** Full domain that consists of at least 3 parts, e.g. foo.bar.com or example-foo.bar.com */
 export const domainRegEx = /^[\dA-Za-z](?:[\dA-Za-z-]*[\dA-Za-z])?(?:\.[\dA-Za-z](?:[\dA-Za-z-]*[\dA-Za-z])?){2,}$/;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logto/core-kit",
-  "version": "2.11.0",
+  "version": "2.13.0",
   "author": "Silverhand Inc. <contact@silverhand.io>",
   "homepage": "https://github.com/logto-io/toolkit#readme",
   "repository": {
@@ -35,8 +35,8 @@
   "dependencies": {
     "@silverhand/essentials": "^2.9.1",
     "color": "^4.2.3",
-    "@logto/language-kit": "^1.3.0",
-    "@logto/shared": "^3.4.1"
+    "@logto/language-kit": "^1.4.0",
+    "@logto/shared": "^3.4.3"
   },
   "optionalDependencies": {
     "zod": "3.24.3"
@@ -52,7 +52,7 @@
     "@vitest/coverage-v8": "^4.1.8",
     "eslint": "^8.56.0",
     "lint-staged": "^15.0.0",
-    "postcss": "^8.4.31",
+    "postcss": "^8.5.18",
     "prettier": "^3.5.3",
     "stylelint": "^15.0.0",
     "typescript": "^5.5.3",