@oxyhq/core 12.10.4 → 12.10.6

package/dist/esm/i18n/locales/en-US.json

@@ -1552,6 +1552,7 @@
             "fileEmpty": "File \"{{name}}\" is empty",
             "fileTooLarge": "\"{{name}}\" is too large. Maximum file size is {{maxSize}}",
             "noValidFiles": "No valid files to upload",
+            "imagesOnlyRequired": "Only image files can be selected",
             "waitForSelection": "Please wait for the current file selection to complete",
             "noFilesSelected": "No files were selected",
             "loadSomeFailed": "Failed to load some files:\n{{errors}}",

package/dist/esm/i18n/locales/es-ES.json

@@ -1552,6 +1552,7 @@
             "fileEmpty": "El archivo \"{{name}}\" está vacío",
             "fileTooLarge": "\"{{name}}\" es demasiado grande. El tamaño máximo es {{maxSize}}",
             "noValidFiles": "No hay archivos válidos para subir",
+            "imagesOnlyRequired": "Solo se pueden seleccionar archivos de imagen",
             "waitForSelection": "Espera a que se complete la selección actual",
             "noFilesSelected": "No se seleccionaron archivos",
             "loadSomeFailed": "Error al cargar algunos archivos:\n{{errors}}",

package/dist/esm/i18n/locales/locales/en-US.json

@@ -1552,6 +1552,7 @@
       "fileEmpty": "File \"{{name}}\" is empty",
       "fileTooLarge": "\"{{name}}\" is too large. Maximum file size is {{maxSize}}",
       "noValidFiles": "No valid files to upload",
+      "imagesOnlyRequired": "Only image files can be selected",
       "waitForSelection": "Please wait for the current file selection to complete",
       "noFilesSelected": "No files were selected",
       "loadSomeFailed": "Failed to load some files:\n{{errors}}",

package/dist/esm/i18n/locales/locales/es-ES.json

@@ -1552,6 +1552,7 @@
       "fileEmpty": "El archivo \"{{name}}\" está vacío",
       "fileTooLarge": "\"{{name}}\" es demasiado grande. El tamaño máximo es {{maxSize}}",
       "noValidFiles": "No hay archivos válidos para subir",
+      "imagesOnlyRequired": "Solo se pueden seleccionar archivos de imagen",
       "waitForSelection": "Espera a que se complete la selección actual",
       "noFilesSelected": "No se seleccionaron archivos",
       "loadSomeFailed": "Error al cargar algunos archivos:\n{{errors}}",

package/dist/esm/index.js

@@ -145,7 +145,7 @@ export { runColdBoot } from './utils/coldBoot.js';
 // OAuth 2.0 Authorization Code + PKCE helpers ("Sign in with Oxy" third party).
 // Standard OAuth against auth.oxy.so/authorize — no FedCM/cookies/SSO bounce.
 // ---------------------------------------------------------------------------
-export { buildOAuthAuthorizeUrl, computeCodeChallenge, generateOAuthState, generatePkcePair, DEFAULT_OAUTH_SCOPE, OXY_AUTHORIZE_URL, OXY_OAUTH_STATE_STORAGE_KEY, OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY, OXY_SILENT_OAUTH_ATTEMPTED_KEY, OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY, normalizeOAuthRedirectUri, persistOAuthHandshake, readOAuthHandshake, clearOAuthHandshake, } from './utils/oauthPkce.js';
+export { buildOAuthAuthorizeUrl, computeCodeChallenge, generateOAuthState, generatePkcePair, DEFAULT_OAUTH_SCOPE, OXY_AUTHORIZE_URL, OXY_OAUTH_STATE_STORAGE_KEY, OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY, OXY_SILENT_OAUTH_ATTEMPTED_KEY, OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY, OXY_OAUTH_RETURN_PATH_STORAGE_KEY, normalizeOAuthRedirectUri, persistOAuthHandshake, readOAuthHandshake, clearOAuthHandshake, persistOAuthReturnPath, consumeOAuthReturnPath, } from './utils/oauthPkce.js';
 export { buildIdpHubOrigin, buildHubSyncUrl, isIdpHubOrigin, isLoopbackOrigin, isOfficialWebOrigin, isAllowedDeviceJoinOrigin, normalizeOfficialReturnOrigin, parseHubSyncReturnUrl, } from './utils/officialOrigins.js';
 export { syncHubAfterSignIn, redeemHubTicketOnHub, } from './session/hubSync.js';
 // ---------------------------------------------------------------------------

package/dist/esm/session/hubSync.js

@@ -29,7 +29,7 @@ export async function syncHubAfterSignIn(oxy, opts) {
     }
     const hubOrigin = buildIdpHubOrigin();
     const issued = await oxy.issueHubTicket(hubOrigin);
-    const returnUrl = `${location.origin}${location.pathname}${location.search}`;
+    const returnUrl = `${location.origin}${location.pathname}${location.search}${location.hash}`;
     const syncUrl = buildHubSyncUrl(issued.ticket, returnUrl);
     window.location.assign(syncUrl);
     return true;

package/dist/esm/utils/oauthPkce.js

@@ -144,9 +144,19 @@ export const OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = 'oxy_oauth_code_verifier';
 export const OXY_SILENT_OAUTH_ATTEMPTED_KEY = 'oxy.silent_oauth_attempted';
 /** `sessionStorage` key — blocks further cross-origin auto-restore in this tab. */
 export const OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY = 'oxy.cross_origin_restore_attempted';
+/**
+ * `sessionStorage` key for the in-app path to return to after an authorize
+ * round trip. See {@link persistOAuthReturnPath}.
+ */
+export const OXY_OAUTH_RETURN_PATH_STORAGE_KEY = 'oxy.oauth_return_path';
 /**
  * Normalize a redirect URI to its origin. Official Oxy apps register apex
  * origins (`https://inbox.oxy.so`) — never path-qualified URLs.
+ *
+ * This is why the path cannot ride along in `redirect_uri`, and why
+ * {@link persistOAuthReturnPath} exists: the authorize round trip always lands
+ * back on the bare origin, so the page the user was on has to be carried
+ * out-of-band and restored on return.
  */
 export function normalizeOAuthRedirectUri(input) {
     try {
@@ -156,6 +166,70 @@ export function normalizeOAuthRedirectUri(input) {
         return input;
     }
 }
+/**
+ * Is this a safe same-origin path to restore into the address bar?
+ *
+ * Only site-relative paths are accepted. `//evil.com` and `/\evil.com` are
+ * rejected because browsers resolve both as protocol-relative *absolute* URLs —
+ * without this check, anything able to write one key of `sessionStorage` could
+ * turn the post-authorize restore into an open redirect.
+ */
+function isSafeReturnPath(value) {
+    if (!value.startsWith('/'))
+        return false;
+    if (value.startsWith('//') || value.startsWith('/\\'))
+        return false;
+    if (value.length > 2048)
+        return false;
+    return true;
+}
+/**
+ * Remember the page the user was on before a full-page authorize redirect.
+ *
+ * Silent cross-origin restore navigates the whole tab to the IdP and back, and
+ * `redirect_uri` must be a registered apex origin, so the browser returns to
+ * `/` no matter which page the visit started on. Without this, every deep link
+ * — a shared URL, a search result, an ad landing page — silently became the
+ * home page for signed-out visitors on their first navigation in a tab.
+ *
+ * Stored next to the PKCE handshake it belongs to, and cleared by
+ * {@link clearOAuthHandshake} so a stale entry can never be applied to an
+ * unrelated later navigation.
+ */
+export function persistOAuthReturnPath(path) {
+    const store = globalThis.sessionStorage;
+    if (!store || !isSafeReturnPath(path))
+        return;
+    try {
+        store.setItem(OXY_OAUTH_RETURN_PATH_STORAGE_KEY, path);
+    }
+    catch (error) {
+        // Non-fatal: the round trip still completes, it just lands on the origin.
+        logger.warn('Could not persist OAuth return path to sessionStorage', { component: 'oauthPkce' }, error);
+    }
+}
+/**
+ * Read and remove the persisted return path, or `null` when there is none or
+ * it failed validation.
+ *
+ * Single-use by design: it is consumed on the first return so a leftover value
+ * cannot redirect a later navigation in the same tab.
+ */
+export function consumeOAuthReturnPath() {
+    const store = globalThis.sessionStorage;
+    if (!store)
+        return null;
+    try {
+        const value = store.getItem(OXY_OAUTH_RETURN_PATH_STORAGE_KEY);
+        store.removeItem(OXY_OAUTH_RETURN_PATH_STORAGE_KEY);
+        if (!value || !isSafeReturnPath(value))
+            return null;
+        return value;
+    }
+    catch {
+        return null;
+    }
+}
 /** Persist the OAuth handshake for a full-page redirect return (web only). */
 export function persistOAuthHandshake(state, codeVerifier) {
     const store = globalThis.sessionStorage;
@@ -188,6 +262,9 @@ export function clearOAuthHandshake() {
     try {
         store?.removeItem(OXY_OAUTH_STATE_STORAGE_KEY);
         store?.removeItem(OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY);
+        // The return path belongs to this handshake. Leaving it behind would let a
+        // later, unrelated navigation in the same tab be redirected by it.
+        store?.removeItem(OXY_OAUTH_RETURN_PATH_STORAGE_KEY);
     }
     catch {
         // Best-effort cleanup only.