@orangecheck/auth-client 2.22.1 → 2.24.0

package/dist/index.d.mts

@@ -134,6 +134,8 @@ interface OcSignInProps {
     add?: boolean;
     className?: string;
 }
+declare function safeReturnTo(input: string | undefined): string;
+declare function familyReturnTarget(input: string | undefined | null): string | undefined;
 declare function OcSignIn({ audience, returnTo, onSuccess, resolveReturnTo, linkPrompt, add: addProp, authOrigin, initialPath, providersFirst, paths, className, }: OcSignInProps): React.ReactElement;
 
 interface OcLinkedIdentity {
@@ -253,4 +255,4 @@ declare function handleSudoRequired(body: {
     returnTo?: string;
 }): boolean;
 
-export { DEFAULT_CONFIG, DISPLAY_IDENTITY_KINDS, type DisplayIdentity, type DisplayIdentityKind, type OcAccount, OcAccountChip, type OcAccountChipProps, OcAccountPill, type OcAccountPillProps, type OcAccountSummary, OcAddressInput, type OcAddressInputProps, type OcAuthConfig, OcLinkedIdentities, type OcLinkedIdentitiesProps, type OcLinkedIdentity, OcSessionProvider, type OcSessionState, type OcSessionStatus, OcSignIn, OcSignInButton, type OcSignInButtonProps, type OcSignInProps, type OcSignOutScope, type OcTabSession, type RedirectToSudoArgs, TAB_ACCOUNT_HINT_KEY, TAB_ADOPT_HASH, TAB_SESSION_HEADER, TAB_SESSION_STORAGE_KEY, type UseOcAddressSuggestionOptions, type UseOcAddressSuggestionReturn, type UseStepUpAuthReturn, type UseWebAuthnListReturn, type UseWebAuthnRegisterReturn, type WebAuthnAssertionStatus, type WebAuthnCredentialPublic, type WebAuthnListStatus, type WebAuthnRegisterResult, type WebAuthnRegisterStatus, type WebAuthnRemoveResult, type WebAuthnRenameResult, type WebAuthnStepUpResult, buildAddAccountUrl, buildSignInUrl, clearTabSession, consumeTabAccountHint, consumeTabAdoptMarker, fetchOcLinkedIdentities, handleSudoRequired, installTabFetchInterceptor, installTabLinkDecorator, readTabSession, redirectToSudo, tabSessionHeader, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister, writeTabSession };
+export { DEFAULT_CONFIG, DISPLAY_IDENTITY_KINDS, type DisplayIdentity, type DisplayIdentityKind, type OcAccount, OcAccountChip, type OcAccountChipProps, OcAccountPill, type OcAccountPillProps, type OcAccountSummary, OcAddressInput, type OcAddressInputProps, type OcAuthConfig, OcLinkedIdentities, type OcLinkedIdentitiesProps, type OcLinkedIdentity, OcSessionProvider, type OcSessionState, type OcSessionStatus, OcSignIn, OcSignInButton, type OcSignInButtonProps, type OcSignInProps, type OcSignOutScope, type OcTabSession, type RedirectToSudoArgs, TAB_ACCOUNT_HINT_KEY, TAB_ADOPT_HASH, TAB_SESSION_HEADER, TAB_SESSION_STORAGE_KEY, type UseOcAddressSuggestionOptions, type UseOcAddressSuggestionReturn, type UseStepUpAuthReturn, type UseWebAuthnListReturn, type UseWebAuthnRegisterReturn, type WebAuthnAssertionStatus, type WebAuthnCredentialPublic, type WebAuthnListStatus, type WebAuthnRegisterResult, type WebAuthnRegisterStatus, type WebAuthnRemoveResult, type WebAuthnRenameResult, type WebAuthnStepUpResult, buildAddAccountUrl, buildSignInUrl, clearTabSession, consumeTabAccountHint, consumeTabAdoptMarker, familyReturnTarget, fetchOcLinkedIdentities, handleSudoRequired, installTabFetchInterceptor, installTabLinkDecorator, readTabSession, redirectToSudo, safeReturnTo, tabSessionHeader, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister, writeTabSession };

package/dist/index.d.ts

@@ -134,6 +134,8 @@ interface OcSignInProps {
     add?: boolean;
     className?: string;
 }
+declare function safeReturnTo(input: string | undefined): string;
+declare function familyReturnTarget(input: string | undefined | null): string | undefined;
 declare function OcSignIn({ audience, returnTo, onSuccess, resolveReturnTo, linkPrompt, add: addProp, authOrigin, initialPath, providersFirst, paths, className, }: OcSignInProps): React.ReactElement;
 
 interface OcLinkedIdentity {
@@ -253,4 +255,4 @@ declare function handleSudoRequired(body: {
     returnTo?: string;
 }): boolean;
 
-export { DEFAULT_CONFIG, DISPLAY_IDENTITY_KINDS, type DisplayIdentity, type DisplayIdentityKind, type OcAccount, OcAccountChip, type OcAccountChipProps, OcAccountPill, type OcAccountPillProps, type OcAccountSummary, OcAddressInput, type OcAddressInputProps, type OcAuthConfig, OcLinkedIdentities, type OcLinkedIdentitiesProps, type OcLinkedIdentity, OcSessionProvider, type OcSessionState, type OcSessionStatus, OcSignIn, OcSignInButton, type OcSignInButtonProps, type OcSignInProps, type OcSignOutScope, type OcTabSession, type RedirectToSudoArgs, TAB_ACCOUNT_HINT_KEY, TAB_ADOPT_HASH, TAB_SESSION_HEADER, TAB_SESSION_STORAGE_KEY, type UseOcAddressSuggestionOptions, type UseOcAddressSuggestionReturn, type UseStepUpAuthReturn, type UseWebAuthnListReturn, type UseWebAuthnRegisterReturn, type WebAuthnAssertionStatus, type WebAuthnCredentialPublic, type WebAuthnListStatus, type WebAuthnRegisterResult, type WebAuthnRegisterStatus, type WebAuthnRemoveResult, type WebAuthnRenameResult, type WebAuthnStepUpResult, buildAddAccountUrl, buildSignInUrl, clearTabSession, consumeTabAccountHint, consumeTabAdoptMarker, fetchOcLinkedIdentities, handleSudoRequired, installTabFetchInterceptor, installTabLinkDecorator, readTabSession, redirectToSudo, tabSessionHeader, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister, writeTabSession };
+export { DEFAULT_CONFIG, DISPLAY_IDENTITY_KINDS, type DisplayIdentity, type DisplayIdentityKind, type OcAccount, OcAccountChip, type OcAccountChipProps, OcAccountPill, type OcAccountPillProps, type OcAccountSummary, OcAddressInput, type OcAddressInputProps, type OcAuthConfig, OcLinkedIdentities, type OcLinkedIdentitiesProps, type OcLinkedIdentity, OcSessionProvider, type OcSessionState, type OcSessionStatus, OcSignIn, OcSignInButton, type OcSignInButtonProps, type OcSignInProps, type OcSignOutScope, type OcTabSession, type RedirectToSudoArgs, TAB_ACCOUNT_HINT_KEY, TAB_ADOPT_HASH, TAB_SESSION_HEADER, TAB_SESSION_STORAGE_KEY, type UseOcAddressSuggestionOptions, type UseOcAddressSuggestionReturn, type UseStepUpAuthReturn, type UseWebAuthnListReturn, type UseWebAuthnRegisterReturn, type WebAuthnAssertionStatus, type WebAuthnCredentialPublic, type WebAuthnListStatus, type WebAuthnRegisterResult, type WebAuthnRegisterStatus, type WebAuthnRemoveResult, type WebAuthnRenameResult, type WebAuthnStepUpResult, buildAddAccountUrl, buildSignInUrl, clearTabSession, consumeTabAccountHint, consumeTabAdoptMarker, familyReturnTarget, fetchOcLinkedIdentities, handleSudoRequired, installTabFetchInterceptor, installTabLinkDecorator, readTabSession, redirectToSudo, safeReturnTo, tabSessionHeader, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister, writeTabSession };

package/dist/index.js

@@ -2020,15 +2020,27 @@ var primaryChipStyle = {
   color: V.primary,
   border: `1px solid ${V.primary}`
 };
+function isSameOriginPath(candidate, origin) {
+  try {
+    return new URL(candidate, origin).origin === origin;
+  } catch {
+    return false;
+  }
+}
+function resolutionOrigin() {
+  return typeof window === "undefined" ? "https://ochk.io" : window.location.origin;
+}
 function safeReturnTo(input) {
   const candidate = input ?? "/";
   if (typeof candidate !== "string") return "/";
-  if (!candidate.startsWith("/") || candidate.startsWith("//")) return "/";
-  return candidate;
+  if (!candidate.startsWith("/")) return "/";
+  return isSameOriginPath(candidate, resolutionOrigin()) ? candidate : "/";
 }
 function familyReturnTarget(input) {
   if (typeof input !== "string" || input.length === 0) return void 0;
-  if (input.startsWith("/") && !input.startsWith("//")) return input;
+  if (input.startsWith("/") && isSameOriginPath(input, resolutionOrigin())) {
+    return input;
+  }
   try {
     const u = new URL(input);
     if (u.protocol !== "https:") return void 0;
@@ -2647,7 +2659,7 @@ function EmailFlow({ authOrigin, add, onSuccess }) {
   }
   if (stage === "enter") {
     return /* @__PURE__ */ jsxRuntime.jsxs("form", { onSubmit: start, "data-oc-signin-email": "", children: [
-      /* @__PURE__ */ jsxRuntime.jsx(FlowHeader, { label: "\xA7 email + otp", children: "We email you a 6-digit code. No password. The federation provisions a custodial wallet for you in your browser. Best path if you don't have a Bitcoin wallet yet \u2014 graduate to self-custody anytime by adding your BTC address from your account dashboard." }),
+      /* @__PURE__ */ jsxRuntime.jsx(FlowHeader, { label: "\xA7 email + otp", children: "We email you a 6-digit code. No password, and no wallet needed to start. Link a Bitcoin address any time \u2014 that is the identity you hold yourself." }),
       /* @__PURE__ */ jsxRuntime.jsx(Label, { children: "email" }),
       /* @__PURE__ */ jsxRuntime.jsx(
         "input",
@@ -2667,7 +2679,7 @@ function EmailFlow({ authOrigin, add, onSuccess }) {
       ),
       emailError && /* @__PURE__ */ jsxRuntime.jsx(ErrorLine2, { children: emailError }),
       /* @__PURE__ */ jsxRuntime.jsx("button", { type: "submit", disabled: submitting, style: submitStyle(submitting), children: submitting ? "sending\u2026" : "send one-time code \u2192" }),
-      /* @__PURE__ */ jsxRuntime.jsx(Hint, { children: "OTP delivered by the auth host. Codes expire in 10 minutes and are single-use. Rate-limited 5 starts/hour/IP." })
+      /* @__PURE__ */ jsxRuntime.jsx(Hint, { children: "Codes come from the auth host, expire in 10 minutes, and work once." })
     ] });
   }
   return /* @__PURE__ */ jsxRuntime.jsxs("form", { onSubmit: verify, "data-oc-signin-email-verify": "", children: [
@@ -3140,12 +3152,14 @@ exports.buildSignInUrl = buildSignInUrl;
 exports.clearTabSession = clearTabSession;
 exports.consumeTabAccountHint = consumeTabAccountHint;
 exports.consumeTabAdoptMarker = consumeTabAdoptMarker;
+exports.familyReturnTarget = familyReturnTarget;
 exports.fetchOcLinkedIdentities = fetchOcLinkedIdentities;
 exports.handleSudoRequired = handleSudoRequired;
 exports.installTabFetchInterceptor = installTabFetchInterceptor;
 exports.installTabLinkDecorator = installTabLinkDecorator;
 exports.readTabSession = readTabSession;
 exports.redirectToSudo = redirectToSudo;
+exports.safeReturnTo = safeReturnTo;
 exports.tabSessionHeader = tabSessionHeader;
 exports.useOcAddressSuggestion = useOcAddressSuggestion;
 exports.useOcSession = useOcSession;