@schemavaults/auth-common 0.12.9 → 0.12.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/dist/auth-error-message-catalog.d.ts +1 -1
  2. package/dist/auth-error-message-catalog.js +2 -0
  3. package/dist/auth-error-message-catalog.js.map +1 -1
  4. package/dist/auth_acquire_tokens_grant_types.d.ts +6 -0
  5. package/dist/auth_acquire_tokens_grant_types.js +8 -0
  6. package/dist/auth_acquire_tokens_grant_types.js.map +1 -1
  7. package/package.json +3 -3
package/dist/auth-error-message-catalog.d.ts CHANGED
@@ -1,4 +1,4 @@
1
- declare const ERROR_IDS: readonly ["unknown", "bad_request", "app_id_not_found", "api_server_id_not_found", "unauthenticated", "forbidden", "account_disabled", "load_user_data_failure", "internal_server_error", "load_server_config_failure", "server_misconfiguration", "account_not_in_organization", "pkce_challenge_expired"];
1
+ declare const ERROR_IDS: readonly ["unknown", "bad_request", "app_id_not_found", "api_server_id_not_found", "unauthenticated", "forbidden", "account_disabled", "load_user_data_failure", "internal_server_error", "load_server_config_failure", "server_misconfiguration", "account_not_in_organization", "pkce_challenge_expired", "invalid_redirect_uri"];
2
2
  export type SchemaVaultsAuthErrorId = (typeof ERROR_IDS)[number];
3
3
  export declare const ERROR_MESSAGE_CATALOG: Record<SchemaVaultsAuthErrorId, string>;
4
4
  export declare function isValidErrorId(id: string): id is SchemaVaultsAuthErrorId;
package/dist/auth-error-message-catalog.js CHANGED
@@ -12,6 +12,7 @@ const ERROR_IDS = [
12
12
  "server_misconfiguration",
13
13
  "account_not_in_organization",
14
14
  "pkce_challenge_expired",
15
+ "invalid_redirect_uri",
15
16
  ];
16
17
  export const ERROR_MESSAGE_CATALOG = {
17
18
  unknown: "An unknown error occurred",
@@ -27,6 +28,7 @@ export const ERROR_MESSAGE_CATALOG = {
27
28
  server_misconfiguration: "The server does not appear to be configured properly. If you are the site admin, please see the logs for more details.",
28
29
  account_not_in_organization: "Your account is not a member of the organization required for the attempted action.",
29
30
  pkce_challenge_expired: "Your authorization session has expired. Please return to the requesting application and try again.",
31
+ invalid_redirect_uri: "The redirect URI presented by the requesting application is not registered for it. For your safety, login has been blocked.",
30
32
  };
31
33
  export function isValidErrorId(id) {
32
34
  return ERROR_IDS.includes(id);
package/dist/auth-error-message-catalog.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"auth-error-message-catalog.js","sourceRoot":"","sources":["../src/auth-error-message-catalog.ts"],"names":[],"mappings":"AAAA,MAAM,SAAS,GAAG;IAChB,SAAS;IACT,aAAa;IACb,kBAAkB;IAClB,yBAAyB;IACzB,iBAAiB;IACjB,WAAW;IACX,kBAAkB;IAClB,wBAAwB;IACxB,uBAAuB;IACvB,4BAA4B;IAC5B,yBAAyB;IACzB,6BAA6B;IAC7B,wBAAwB;CACY,CAAC;AAIvC,MAAM,CAAC,MAAM,qBAAqB,GAA4C;IAC5E,OAAO,EAAE,2BAA2B;IACpC,WAAW,EAAE,wCAAwC;IACrD,gBAAgB,EAAE,kCAAkC;IACpD,uBAAuB,EAAE,wCAAwC;IACjE,eAAe,EACb,iGAAiG;IACnG,SAAS,EACP,gHAAgH;IAClH,gBAAgB,EAAE,iCAAiC;IACnD,sBAAsB,EACpB,4EAA4E;IAC9E,qBAAqB,EACnB,qFAAqF;IACvF,0BAA0B,EACxB,4DAA4D;IAC9D,uBAAuB,EACrB,wHAAwH;IAC1H,2BAA2B,EACzB,qFAAqF;IACvF,sBAAsB,EACpB,oGAAoG;CACvG,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,EAAU;IACvC,OAAO,SAAS,CAAC,QAAQ,CAAC,EAA8C,CAAC,CAAC;AAC5E,CAAC"}
1
+ {"version":3,"file":"auth-error-message-catalog.js","sourceRoot":"","sources":["../src/auth-error-message-catalog.ts"],"names":[],"mappings":"AAAA,MAAM,SAAS,GAAG;IAChB,SAAS;IACT,aAAa;IACb,kBAAkB;IAClB,yBAAyB;IACzB,iBAAiB;IACjB,WAAW;IACX,kBAAkB;IAClB,wBAAwB;IACxB,uBAAuB;IACvB,4BAA4B;IAC5B,yBAAyB;IACzB,6BAA6B;IAC7B,wBAAwB;IACxB,sBAAsB;CACc,CAAC;AAIvC,MAAM,CAAC,MAAM,qBAAqB,GAA4C;IAC5E,OAAO,EAAE,2BAA2B;IACpC,WAAW,EAAE,wCAAwC;IACrD,gBAAgB,EAAE,kCAAkC;IACpD,uBAAuB,EAAE,wCAAwC;IACjE,eAAe,EACb,iGAAiG;IACnG,SAAS,EACP,gHAAgH;IAClH,gBAAgB,EAAE,iCAAiC;IACnD,sBAAsB,EACpB,4EAA4E;IAC9E,qBAAqB,EACnB,qFAAqF;IACvF,0BAA0B,EACxB,4DAA4D;IAC9D,uBAAuB,EACrB,wHAAwH;IAC1H,2BAA2B,EACzB,qFAAqF;IACvF,sBAAsB,EACpB,oGAAoG;IACtG,oBAAoB,EAClB,6HAA6H;CAChI,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,EAAU;IACvC,OAAO,SAAS,CAAC,QAAQ,CAAC,EAA8C,CAAC,CAAC;AAC5E,CAAC"}
package/dist/auth_acquire_tokens_grant_types.d.ts CHANGED
@@ -7,6 +7,7 @@ export declare const authorizationCodePOSTbody: z.ZodObject<{
7
7
  audience: z.ZodUnion<[z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, z.ZodArray<z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, "many">]>;
8
8
  client_app_id: z.ZodUnion<readonly [z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail" | "schemavaults-web" | "schemavaults-cli", string>]>;
9
9
  grant_type: z.ZodLiteral<"authorization_code">;
10
+ redirect_uri: z.ZodOptional<z.ZodNullable<z.ZodString>>;
10
11
  }, "strict", z.ZodTypeAny, {
11
12
  code: string;
12
13
  challenge_time: number;
@@ -14,6 +15,7 @@ export declare const authorizationCodePOSTbody: z.ZodObject<{
14
15
  audience: string | string[];
15
16
  client_app_id: string;
16
17
  grant_type: "authorization_code";
18
+ redirect_uri?: string | null | undefined;
17
19
  }, {
18
20
  code: string;
19
21
  challenge_time: number;
@@ -21,6 +23,7 @@ export declare const authorizationCodePOSTbody: z.ZodObject<{
21
23
  audience: string | string[];
22
24
  client_app_id: string;
23
25
  grant_type: "authorization_code";
26
+ redirect_uri?: string | null | undefined;
24
27
  }>;
25
28
  export declare const refreshTokenPOSTbody: z.ZodObject<{
26
29
  audience: z.ZodUnion<[z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, z.ZodArray<z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, "many">]>;
@@ -46,6 +49,7 @@ export declare const grantTypePOSTbodySchemaMap: {
46
49
  audience: z.ZodUnion<[z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, z.ZodArray<z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, "many">]>;
47
50
  client_app_id: z.ZodUnion<readonly [z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail" | "schemavaults-web" | "schemavaults-cli", string>]>;
48
51
  grant_type: z.ZodLiteral<"authorization_code">;
52
+ redirect_uri: z.ZodOptional<z.ZodNullable<z.ZodString>>;
49
53
  }, "strict", z.ZodTypeAny, {
50
54
  code: string;
51
55
  challenge_time: number;
@@ -53,6 +57,7 @@ export declare const grantTypePOSTbodySchemaMap: {
53
57
  audience: string | string[];
54
58
  client_app_id: string;
55
59
  grant_type: "authorization_code";
60
+ redirect_uri?: string | null | undefined;
56
61
  }, {
57
62
  code: string;
58
63
  challenge_time: number;
@@ -60,6 +65,7 @@ export declare const grantTypePOSTbodySchemaMap: {
60
65
  audience: string | string[];
61
66
  client_app_id: string;
62
67
  grant_type: "authorization_code";
68
+ redirect_uri?: string | null | undefined;
63
69
  }>;
64
70
  readonly refresh_token: z.ZodObject<{
65
71
  audience: z.ZodUnion<[z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, z.ZodArray<z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>, "many">]>;
package/dist/auth_acquire_tokens_grant_types.js CHANGED
@@ -20,6 +20,14 @@ export const authorizationCodePOSTbody = _createTokenEndpointBaseSchema
20
20
  .refine((value) => /^[A-Za-z0-9_-]+$/.test(value)),
21
21
  code_verifier: PKCE_ProofKeyManager.codeChallengeSchema,
22
22
  challenge_time: z.number().nonnegative(),
23
+ // OAuth2 `redirect_uri` (RFC 6749 §4.1.3) bound to the issued
24
+ // authorization code. The token endpoint verifies this matches the
25
+ // value persisted on the authorization_codes row by exact string
26
+ // equality, so a code minted for URI A cannot be redeemed by
27
+ // presenting URI B even when both share an allowlisted origin.
28
+ // Null/absent is reserved for the auth server's own account flow,
29
+ // which has no third-party callback.
30
+ redirect_uri: z.string().url().nullable().optional(),
23
31
  })
24
32
  .required({
25
33
  grant_type: true,
package/dist/auth_acquire_tokens_grant_types.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"auth_acquire_tokens_grant_types.js","sourceRoot":"","sources":["../src/auth_acquire_tokens_grant_types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAkB,CAAC,EAAE,MAAM,KAAK,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,oBAAoB;IACpB,eAAe;CACqB,CAAC;AAEvC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,QAAQ,EAAE,cAAc;IACxB,aAAa,EAAE,WAAW;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B;KACpE,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;IAC3C,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,EAAE,CAAC;SACP,GAAG,CAAC,IAAI,CAAC;SACT,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpD,aAAa,EAAE,oBAAoB,CAAC,mBAAmB;IACvD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;CACzC,CAAC;KACD,QAAQ,CAAC;IACR,UAAU,EAAE,IAAI;IAChB,QAAQ,EAAE,IAAI;IACd,aAAa,EAAE,IAAI;IACnB,IAAI,EAAE,IAAI;IACV,aAAa,EAAE,IAAI;IACnB,cAAc,EAAE,IAAI;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,oBAAoB,GAAG,8BAA8B;KAC/D,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IACtC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,QAAQ,CAAC;IACR,UAAU,EAAE,IAAI;IAChB,QAAQ,EAAE,IAAI;IACd,aAAa,EAAE,IAAI;CACpB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,kBAAkB,EAAE,yBAAyB;IAC7C,aAAa,EAAE,oBAAoB;CAC+B,CAAC"}
1
+ {"version":3,"file":"auth_acquire_tokens_grant_types.js","sourceRoot":"","sources":["../src/auth_acquire_tokens_grant_types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAkB,CAAC,EAAE,MAAM,KAAK,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,oBAAoB;IACpB,eAAe;CACqB,CAAC;AAEvC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,QAAQ,EAAE,cAAc;IACxB,aAAa,EAAE,WAAW;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B;KACpE,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;IAC3C,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,EAAE,CAAC;SACP,GAAG,CAAC,IAAI,CAAC;SACT,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpD,aAAa,EAAE,oBAAoB,CAAC,mBAAmB;IACvD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;IACxC,8DAA8D;IAC9D,mEAAmE;IACnE,iEAAiE;IACjE,6DAA6D;IAC7D,+DAA+D;IAC/D,kEAAkE;IAClE,qCAAqC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,QAAQ,CAAC;IACR,UAAU,EAAE,IAAI;IAChB,QAAQ,EAAE,IAAI;IACd,aAAa,EAAE,IAAI;IACnB,IAAI,EAAE,IAAI;IACV,aAAa,EAAE,IAAI;IACnB,cAAc,EAAE,IAAI;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,oBAAoB,GAAG,8BAA8B;KAC/D,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IACtC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,QAAQ,CAAC;IACR,UAAU,EAAE,IAAI;IAChB,QAAQ,EAAE,IAAI;IACd,aAAa,EAAE,IAAI;CACpB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,kBAAkB,EAAE,yBAAyB;IAC7C,aAAa,EAAE,oBAAoB;CAC+B,CAAC"}
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "@schemavaults/auth-common",
3
3
  "description": "Types and utility functions for authentication and authorization",
4
- "version": "0.12.9",
4
+ "version": "0.12.10",
5
5
  "license": "UNLICENSED",
6
6
  "private": false,
7
7
  "repository": {
@@ -30,7 +30,7 @@
30
30
  "typescript": "5.8.3",
31
31
  "tsc-alias": "1.8.16",
32
32
  "@types/crypto-js": "4.2.0",
33
- "bun-types": "1.3.11",
33
+ "bun-types": "1.3.14",
34
34
  "eslint": "9.39.1",
35
35
  "@eslint/js": "9.39.1",
36
36
  "globals": "16.5.0",
@@ -40,7 +40,7 @@
40
40
  "publishConfig": {
41
41
  "access": "public"
42
42
  },
43
- "packageManager": "bun@1.3.11",
43
+ "packageManager": "bun@1.3.14",
44
44
  "exports": {
45
45
  ".": {
46
46
  "types": "./dist/index.d.ts",