@protobase/server 0.39.2 → 0.40.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -28,6 +28,11 @@ const providerRoutes = ({ auth, context, sessionOf }) => {
|
|
|
28
28
|
if (requested && URL.canParse(requested) && (await context()).isTrustedOrigin(requested)) return requested;
|
|
29
29
|
return own;
|
|
30
30
|
};
|
|
31
|
+
const takesSession = async (redirectTo) => {
|
|
32
|
+
const { protocol, origin } = new URL(redirectTo);
|
|
33
|
+
const named = (await context()).trustedOrigins.filter((trusted) => !/[*?]/.test(trusted));
|
|
34
|
+
return protocol === "https:" && named.includes(origin);
|
|
35
|
+
};
|
|
31
36
|
const implicitFragment = async (userId) => {
|
|
32
37
|
const session = await sessionOf((await (await context()).internalAdapter.createSession(userId)).token);
|
|
33
38
|
return {
|
|
@@ -44,7 +49,7 @@ const providerRoutes = ({ auth, context, sessionOf }) => {
|
|
|
44
49
|
if (!auth.socialProviders.includes(provider)) throw new GoTrueError(400, "validation_failed", `Unsupported provider: ${provider || "none"} is not one of this app's`);
|
|
45
50
|
const challenge = challengeOf(query);
|
|
46
51
|
const redirectTo = await destination(query.redirect_to, c.req.raw);
|
|
47
|
-
if (!challenge &&
|
|
52
|
+
if (!challenge && !await takesSession(redirectTo)) throw new GoTrueError(400, "validation_failed", "A redirect_to that is not https, or that only a pattern of the trusted origins matches, needs a code_challenge");
|
|
48
53
|
const before = await auth.api.getSession({ headers: c.req.raw.headers });
|
|
49
54
|
const secret = await startFlow(c, await context(), {
|
|
50
55
|
redirectTo,
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@protobase/server",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.40.0",
|
|
4
4
|
"description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"repository": {
|
|
@@ -36,9 +36,9 @@
|
|
|
36
36
|
"@better-auth/passkey": "^1.7.12",
|
|
37
37
|
"@better-auth/sso": "^1.7.12",
|
|
38
38
|
"@modelcontextprotocol/server": "^2.3.1",
|
|
39
|
-
"@protobase/layout": "0.
|
|
40
|
-
"@protobase/query": "0.
|
|
41
|
-
"@protobase/schema": "0.
|
|
39
|
+
"@protobase/layout": "0.40.0",
|
|
40
|
+
"@protobase/query": "0.40.0",
|
|
41
|
+
"@protobase/schema": "0.40.0",
|
|
42
42
|
"@react-email/render": "^2.1.0",
|
|
43
43
|
"@scalar/hono-api-reference": "^0.12.10",
|
|
44
44
|
"@sentry/core": "^11.7.0",
|