@microcosmmoney/auth-react 1.1.1 → 1.2.1

package/dist/callback.js

@@ -5,6 +5,17 @@ const jsx_runtime_1 = require("react/jsx-runtime");
 // AI-generated · AI-managed · AI-maintained
 const react_1 = require("react");
 const provider_1 = require("./provider");
+function isSameOrigin(url) {
+    if (url.startsWith('/') && !url.startsWith('//'))
+        return true;
+    try {
+        const parsed = new URL(url, window.location.origin);
+        return parsed.origin === window.location.origin;
+    }
+    catch {
+        return false;
+    }
+}
 function AuthCallback({ redirectTo = '/dashboard', onSuccess, onError, loadingComponent, errorComponent, }) {
     const { client } = (0, provider_1.useAuth)();
     const [error, setError] = (0, react_1.useState)(null);
@@ -16,7 +27,8 @@ function AuthCallback({ redirectTo = '/dashboard', onSuccess, onError, loadingCo
                 if (cancelled)
                     return;
                 onSuccess?.(user);
-                window.location.href = redirectTo;
+                const safeRedirect = isSameOrigin(redirectTo) ? redirectTo : '/dashboard';
+                window.location.href = safeRedirect;
             }
             catch (err) {
                 if (cancelled)

package/dist/server/token-exchange.js

@@ -45,10 +45,7 @@ function createTokenExchangeHandler(config) {
             if (!tokenResponse.ok) {
                 const errorData = await safeJson(tokenResponse);
                 console.error('[MicrocosmAuth] Token exchange failed:', errorData);
-                return jsonResponse({
-                    error: errorData.error || 'token_error',
-                    error_description: errorData.error_description || 'Token exchange failed',
-                }, tokenResponse.status);
+                return jsonResponse({ error: 'token_error', error_description: 'Token exchange failed' }, tokenResponse.status);
             }
             const tokenData = await tokenResponse.json();
             return jsonResponse({
@@ -60,10 +57,7 @@ function createTokenExchangeHandler(config) {
         }
         catch (error) {
             console.error('[MicrocosmAuth] Exchange error:', error);
-            return jsonResponse({
-                error: 'server_error',
-                error_description: error instanceof Error ? error.message : 'Internal server error',
-            }, 500);
+            return jsonResponse({ error: 'server_error', error_description: 'Internal server error' }, 500);
         }
     };
 }
@@ -94,7 +88,7 @@ function createProfileHandler(config) {
         }
         catch (error) {
             console.error('[MicrocosmAuth] Profile error:', error);
-            return jsonResponse({ error: 'server_error', message: error instanceof Error ? error.message : 'Internal error' }, 500);
+            return jsonResponse({ error: 'server_error', message: 'Internal server error' }, 500);
         }
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@microcosmmoney/auth-react",
-  "version": "1.1.1",
+  "version": "1.2.1",
   "description": "Microcosm OAuth 2.0 React/Next.js adapter",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -24,7 +24,7 @@
     "react-dom": ">=18.0.0"
   },
   "dependencies": {
-    "@microcosmmoney/auth-core": "^1.1.1"
+    "@microcosmmoney/auth-core": "^1.2.1"
   },
   "devDependencies": {
     "@types/react": "^18.0.0",