@orangecheck/auth-client 2.22.0 → 2.23.0

package/dist/index.mjs

@@ -1998,15 +1998,27 @@ var primaryChipStyle = {
   color: V.primary,
   border: `1px solid ${V.primary}`
 };
+function isSameOriginPath(candidate, origin) {
+  try {
+    return new URL(candidate, origin).origin === origin;
+  } catch {
+    return false;
+  }
+}
+function resolutionOrigin() {
+  return typeof window === "undefined" ? "https://ochk.io" : window.location.origin;
+}
 function safeReturnTo(input) {
   const candidate = input ?? "/";
   if (typeof candidate !== "string") return "/";
-  if (!candidate.startsWith("/") || candidate.startsWith("//")) return "/";
-  return candidate;
+  if (!candidate.startsWith("/")) return "/";
+  return isSameOriginPath(candidate, resolutionOrigin()) ? candidate : "/";
 }
 function familyReturnTarget(input) {
   if (typeof input !== "string" || input.length === 0) return void 0;
-  if (input.startsWith("/") && !input.startsWith("//")) return input;
+  if (input.startsWith("/") && isSameOriginPath(input, resolutionOrigin())) {
+    return input;
+  }
   try {
     const u = new URL(input);
     if (u.protocol !== "https:") return void 0;
@@ -2375,6 +2387,8 @@ function ProviderSignIn({
   if (providers.length === 0) return null;
   const providerReturnTo = returnTo.startsWith("/") ? origin ? `${origin}${returnTo}` : returnTo : returnTo;
   const line = { flex: 1, height: 1, background: "var(--border, #27272a)" };
+  const BLOCK_GAP = 16;
+  const BUTTON_GAP = 8;
   const divider = /* @__PURE__ */ jsxs(
     "div",
     {
@@ -2382,7 +2396,10 @@ function ProviderSignIn({
         display: "flex",
         alignItems: "center",
         gap: 10,
-        margin: first ? "14px 0 4px" : "4px 0 12px",
+        // Symmetric in both orderings: in `first` mode the divider
+        // owns the gap on both sides; at the bottom the container's
+        // marginTop owns the gap above, so the divider only pads below.
+        margin: first ? `${BLOCK_GAP}px 0` : `0 0 ${BLOCK_GAP}px`,
         color: "var(--muted-foreground, #a1a1aa)",
         fontFamily: "ui-monospace, SFMono-Regular, monospace",
         fontSize: 10,
@@ -2410,7 +2427,7 @@ function ProviderSignIn({
         gap: 10,
         boxSizing: "border-box",
         width: "100%",
-        marginTop: i === 0 ? 0 : 8,
+        marginTop: i === 0 ? 0 : BUTTON_GAP,
         padding: "0.6rem 0.875rem",
         border: "1px solid var(--border, #27272a)",
         borderRadius: 6,
@@ -2427,13 +2444,20 @@ function ProviderSignIn({
     },
     p.id
   ));
-  return /* @__PURE__ */ jsx("div", { "data-oc-signin-providers": "", style: first ? { marginBottom: 4 } : { marginTop: 20 }, children: first ? /* @__PURE__ */ jsxs(Fragment, { children: [
-    buttons,
-    divider
-  ] }) : /* @__PURE__ */ jsxs(Fragment, { children: [
-    divider,
-    buttons
-  ] }) });
+  return /* @__PURE__ */ jsx(
+    "div",
+    {
+      "data-oc-signin-providers": "",
+      style: first ? { marginBottom: 0 } : { marginTop: BLOCK_GAP },
+      children: first ? /* @__PURE__ */ jsxs(Fragment, { children: [
+        buttons,
+        divider
+      ] }) : /* @__PURE__ */ jsxs(Fragment, { children: [
+        divider,
+        buttons
+      ] })
+    }
+  );
 }
 function WalletFlow({ authOrigin, audience, add, onSuccess }) {
   const [address, setAddress] = React3.useState("");
@@ -3088,6 +3112,6 @@ function handleSudoRequired(body, args = {}) {
   return false;
 }
 
-export { DEFAULT_CONFIG, DISPLAY_IDENTITY_KINDS, OcAccountChip, OcAccountPill, OcAddressInput, OcLinkedIdentities, OcSessionProvider, OcSignIn, OcSignInButton, TAB_ACCOUNT_HINT_KEY, TAB_ADOPT_HASH, TAB_SESSION_HEADER, TAB_SESSION_STORAGE_KEY, buildAddAccountUrl, buildSignInUrl, clearTabSession, consumeTabAccountHint, consumeTabAdoptMarker, fetchOcLinkedIdentities, handleSudoRequired, installTabFetchInterceptor, installTabLinkDecorator, readTabSession, redirectToSudo, tabSessionHeader, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister, writeTabSession };
+export { DEFAULT_CONFIG, DISPLAY_IDENTITY_KINDS, OcAccountChip, OcAccountPill, OcAddressInput, OcLinkedIdentities, OcSessionProvider, OcSignIn, OcSignInButton, TAB_ACCOUNT_HINT_KEY, TAB_ADOPT_HASH, TAB_SESSION_HEADER, TAB_SESSION_STORAGE_KEY, buildAddAccountUrl, buildSignInUrl, clearTabSession, consumeTabAccountHint, consumeTabAdoptMarker, familyReturnTarget, fetchOcLinkedIdentities, handleSudoRequired, installTabFetchInterceptor, installTabLinkDecorator, readTabSession, redirectToSudo, safeReturnTo, tabSessionHeader, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister, writeTabSession };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map