@orangecheck/auth-client 2.22.1 → 2.24.0

package/dist/index.mjs

@@ -1998,15 +1998,27 @@ var primaryChipStyle = {
   color: V.primary,
   border: `1px solid ${V.primary}`
 };
+function isSameOriginPath(candidate, origin) {
+  try {
+    return new URL(candidate, origin).origin === origin;
+  } catch {
+    return false;
+  }
+}
+function resolutionOrigin() {
+  return typeof window === "undefined" ? "https://ochk.io" : window.location.origin;
+}
 function safeReturnTo(input) {
   const candidate = input ?? "/";
   if (typeof candidate !== "string") return "/";
-  if (!candidate.startsWith("/") || candidate.startsWith("//")) return "/";
-  return candidate;
+  if (!candidate.startsWith("/")) return "/";
+  return isSameOriginPath(candidate, resolutionOrigin()) ? candidate : "/";
 }
 function familyReturnTarget(input) {
   if (typeof input !== "string" || input.length === 0) return void 0;
-  if (input.startsWith("/") && !input.startsWith("//")) return input;
+  if (input.startsWith("/") && isSameOriginPath(input, resolutionOrigin())) {
+    return input;
+  }
   try {
     const u = new URL(input);
     if (u.protocol !== "https:") return void 0;
@@ -2625,7 +2637,7 @@ function EmailFlow({ authOrigin, add, onSuccess }) {
   }
   if (stage === "enter") {
     return /* @__PURE__ */ jsxs("form", { onSubmit: start, "data-oc-signin-email": "", children: [
-      /* @__PURE__ */ jsx(FlowHeader, { label: "\xA7 email + otp", children: "We email you a 6-digit code. No password. The federation provisions a custodial wallet for you in your browser. Best path if you don't have a Bitcoin wallet yet \u2014 graduate to self-custody anytime by adding your BTC address from your account dashboard." }),
+      /* @__PURE__ */ jsx(FlowHeader, { label: "\xA7 email + otp", children: "We email you a 6-digit code. No password, and no wallet needed to start. Link a Bitcoin address any time \u2014 that is the identity you hold yourself." }),
       /* @__PURE__ */ jsx(Label, { children: "email" }),
       /* @__PURE__ */ jsx(
         "input",
@@ -2645,7 +2657,7 @@ function EmailFlow({ authOrigin, add, onSuccess }) {
       ),
       emailError && /* @__PURE__ */ jsx(ErrorLine2, { children: emailError }),
       /* @__PURE__ */ jsx("button", { type: "submit", disabled: submitting, style: submitStyle(submitting), children: submitting ? "sending\u2026" : "send one-time code \u2192" }),
-      /* @__PURE__ */ jsx(Hint, { children: "OTP delivered by the auth host. Codes expire in 10 minutes and are single-use. Rate-limited 5 starts/hour/IP." })
+      /* @__PURE__ */ jsx(Hint, { children: "Codes come from the auth host, expire in 10 minutes, and work once." })
     ] });
   }
   return /* @__PURE__ */ jsxs("form", { onSubmit: verify, "data-oc-signin-email-verify": "", children: [
@@ -3100,6 +3112,6 @@ function handleSudoRequired(body, args = {}) {
   return false;
 }
 
-export { DEFAULT_CONFIG, DISPLAY_IDENTITY_KINDS, OcAccountChip, OcAccountPill, OcAddressInput, OcLinkedIdentities, OcSessionProvider, OcSignIn, OcSignInButton, TAB_ACCOUNT_HINT_KEY, TAB_ADOPT_HASH, TAB_SESSION_HEADER, TAB_SESSION_STORAGE_KEY, buildAddAccountUrl, buildSignInUrl, clearTabSession, consumeTabAccountHint, consumeTabAdoptMarker, fetchOcLinkedIdentities, handleSudoRequired, installTabFetchInterceptor, installTabLinkDecorator, readTabSession, redirectToSudo, tabSessionHeader, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister, writeTabSession };
+export { DEFAULT_CONFIG, DISPLAY_IDENTITY_KINDS, OcAccountChip, OcAccountPill, OcAddressInput, OcLinkedIdentities, OcSessionProvider, OcSignIn, OcSignInButton, TAB_ACCOUNT_HINT_KEY, TAB_ADOPT_HASH, TAB_SESSION_HEADER, TAB_SESSION_STORAGE_KEY, buildAddAccountUrl, buildSignInUrl, clearTabSession, consumeTabAccountHint, consumeTabAdoptMarker, familyReturnTarget, fetchOcLinkedIdentities, handleSudoRequired, installTabFetchInterceptor, installTabLinkDecorator, readTabSession, redirectToSudo, safeReturnTo, tabSessionHeader, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister, writeTabSession };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map