@mintlify/validation 0.1.848 → 0.1.850

package/dist/types/postLoginRedirects.js

@@ -2,21 +2,28 @@ export const DASHBOARD_ALLOWED_NEXT_PATHS = [
     '/api/slack/connect',
     '/api/end-user-auth/deployment',
     '/api/cli/oauth/authorize',
+    '/api/desktop/oauth/authorize',
     '/api/admin-mcp/oauth/authorize',
     '/api/bitbucket-oauth/callback',
     '/slack/connect',
 ];
+const DASHBOARD_ALLOWED_NEXT_PATH_PREFIXES = ['/api/slack/connect'];
+const SAFE_PATH_SEGMENT = /^[A-Za-z0-9_-]+$/;
 const EDITOR_NEXT_PATH_PATTERN = /^\/[^/?#]+\/[^/?#]+(?:\/~\/[^?#]+|\/editor\/[^/?#]+(?:\/~\/[^?#]+)?)?$/;
 export const validateDashboardRedirect = (next) => {
-    if (DASHBOARD_ALLOWED_NEXT_PATHS.some((val) => next.startsWith(val)))
-        return true;
     try {
         const baseUrl = 'https://example.com';
         const url = new URL(next, baseUrl);
         const normalizedNext = `${url.pathname}${url.search}${url.hash}`;
-        return (url.origin === baseUrl &&
-            normalizedNext === next &&
-            EDITOR_NEXT_PATH_PATTERN.test(url.pathname));
+        if (url.origin !== baseUrl || normalizedNext !== next)
+            return false;
+        if (DASHBOARD_ALLOWED_NEXT_PATHS.includes(url.pathname))
+            return true;
+        const hasAllowedChild = DASHBOARD_ALLOWED_NEXT_PATH_PREFIXES.some((prefix) => url.pathname.startsWith(`${prefix}/`) &&
+            SAFE_PATH_SEGMENT.test(url.pathname.slice(prefix.length + 1)));
+        if (hasAllowedChild)
+            return true;
+        return EDITOR_NEXT_PATH_PATTERN.test(url.pathname);
     }
     catch (_a) {
         return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mintlify/validation",
-  "version": "0.1.848",
+  "version": "0.1.850",
   "description": "Validates mint.json files",
   "author": "Mintlify, Inc.",
   "bugs": {
@@ -67,5 +67,5 @@
     "typescript": "5.5.3",
     "vitest": "2.1.9"
   },
-  "gitHead": "1860a3818bea322e6f6500313f1d2695be7432ee"
+  "gitHead": "457fe2e146dcc76222d433e6be6fafcaf93c24ff"
 }