@schemavaults/auth-common 0.22.8 → 0.22.11

package/dist/credentials/email_credentials.js

@@ -1,7 +1,8 @@
 import { z } from 'zod';
 import { passwordSchema } from './password_requirements';
+import { normalizedEmailSchema } from './normalize-email';
 export const emailCredentialsSchema = z.object({
-    email: z.string().email(),
+    email: normalizedEmailSchema,
     password: passwordSchema
 }).required({
     email: true,

package/dist/credentials/email_credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"email_credentials.js","sourceRoot":"","sources":["../../src/credentials/email_credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,QAAQ,EAAE,cAAc;CACzB,CAAC,CAAC,QAAQ,CAAC;IACV,KAAK,EAAE,IAAI;IACX,QAAQ,EAAE,IAAI;CACf,CAAC,CAAC,MAAM,EAAE,CAAC"}
+{"version":3,"file":"email_credentials.js","sourceRoot":"","sources":["../../src/credentials/email_credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,EAAE,qBAAqB;IAC5B,QAAQ,EAAE,cAAc;CACzB,CAAC,CAAC,QAAQ,CAAC;IACV,KAAK,EAAE,IAAI;IACX,QAAQ,EAAE,IAAI;CACf,CAAC,CAAC,MAAM,EAAE,CAAC"}

package/dist/credentials/index.d.ts

@@ -1,3 +1,4 @@
 export { passwordSchema } from './password_requirements';
+export { normalizeEmail, normalizedEmailSchema } from './normalize-email';
 export { emailCredentialsSchema, type EmailCredentials } from './email_credentials';
 export { emailRegistrationCredentialsSchema, type EmailRegistrationCredentials } from './register_credentials';

package/dist/credentials/index.js

@@ -1,4 +1,5 @@
 export { passwordSchema } from './password_requirements';
+export { normalizeEmail, normalizedEmailSchema } from './normalize-email';
 export { emailCredentialsSchema } from './email_credentials';
 export { emailRegistrationCredentialsSchema } from './register_credentials';
 //# sourceMappingURL=index.js.map

package/dist/credentials/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/credentials/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAyB,MAAM,qBAAqB,CAAC;AACpF,OAAO,EAAE,kCAAkC,EAAqC,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/credentials/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAyB,MAAM,qBAAqB,CAAC;AACpF,OAAO,EAAE,kCAAkC,EAAqC,MAAM,wBAAwB,CAAC"}

package/dist/credentials/normalize-email.d.ts

@@ -0,0 +1,15 @@
+import { z } from "zod";
+/**
+ * Canonical form of an email address for storage and comparison: trimmed
+ * and lowercased. RFC 5321 technically allows a case-sensitive local part,
+ * but mainstream mail providers treat addresses case-insensitively, and
+ * treating case-variants as distinct accounts would let one mailbox
+ * register multiple times (e.g. `user@example.com` vs `User@example.com`).
+ */
+export declare function normalizeEmail(email: string): string;
+/**
+ * Email schema that normalizes (trims + lowercases) at parse time, so any
+ * payload validated with it carries the canonical form of the address.
+ */
+export declare const normalizedEmailSchema: z.ZodString;
+export default normalizeEmail;

package/dist/credentials/normalize-email.js

@@ -0,0 +1,18 @@
+import { z } from "zod";
+/**
+ * Canonical form of an email address for storage and comparison: trimmed
+ * and lowercased. RFC 5321 technically allows a case-sensitive local part,
+ * but mainstream mail providers treat addresses case-insensitively, and
+ * treating case-variants as distinct accounts would let one mailbox
+ * register multiple times (e.g. `user@example.com` vs `User@example.com`).
+ */
+export function normalizeEmail(email) {
+    return email.trim().toLowerCase();
+}
+/**
+ * Email schema that normalizes (trims + lowercases) at parse time, so any
+ * payload validated with it carries the canonical form of the address.
+ */
+export const normalizedEmailSchema = z.string().trim().toLowerCase().email();
+export default normalizeEmail;
+//# sourceMappingURL=normalize-email.js.map

package/dist/credentials/normalize-email.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize-email.js","sourceRoot":"","sources":["../../src/credentials/normalize-email.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,CAAC;AAE7E,eAAe,cAAc,CAAC"}

package/dist/index.d.ts

@@ -35,6 +35,7 @@ export { authorizeClientApplicationFormType } from "./authorize-client-applicati
 export { paginationOptionsSchema, DEFAULT_PAGINATION_PAGE_INDEX, DEFAULT_PAGINATION_PAGE_SIZE, isValidPaginationOptions, } from "./pagination";
 export type { PaginationOptions } from "./pagination";
 export { timingSafeStringEqual } from "./timing-safe-string-equal";
+export { sanitizeNextHref, MAX_NEXT_HREF_LENGTH, } from "./sanitize-next-href";
 export { isOriginInAllowedList } from "./cors";
 export { oauth2StateSchema, OAUTH2_STATE_VSCHAR_REGEX, parseOAuth2State, OAuth2StateValidationError, } from "./oauth2-state-schema";
 export type { OAuth2State } from "./oauth2-state-schema";

package/dist/index.js

@@ -24,6 +24,7 @@ export { determineRefreshTokenCookieSameSiteValue } from "./determineRefreshToke
 export { authorizeClientApplicationFormType } from "./authorize-client-application-form-type";
 export { paginationOptionsSchema, DEFAULT_PAGINATION_PAGE_INDEX, DEFAULT_PAGINATION_PAGE_SIZE, isValidPaginationOptions, } from "./pagination";
 export { timingSafeStringEqual } from "./timing-safe-string-equal";
+export { sanitizeNextHref, MAX_NEXT_HREF_LENGTH, } from "./sanitize-next-href";
 export { isOriginInAllowedList } from "./cors";
 export { oauth2StateSchema, OAUTH2_STATE_VSCHAR_REGEX, parseOAuth2State, OAuth2StateValidationError, } from "./oauth2-state-schema";
 export { createAuthorizationCodePOSTBodySchema, createRefreshTokenPOSTBodySchema, } from "./auth_acquire_tokens_grant_types";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,cAAc,GACf,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,mCAAmC,EACnC,qCAAqC,GACtC,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,cAAc,EAAiB,MAAM,aAAa,CAAC;AAE5D,cAAc,eAAe,CAAC;AAG9B,mBAAmB;AACnB,cAAc,cAAc,CAAC;AAM7B,cAAc,cAAc,CAAC;AAG7B,cAAc,QAAQ,CAAC;AAGvB,cAAc,QAAQ,CAAC;AAGvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EACL,wBAAwB,EACxB,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,wCAAwC,EACxC,wBAAwB,EACxB,uBAAuB,GAOxB,MAAM,uBAAuB,CAAC;AAE/B,cAAc,OAAO,CAAC;AACtB,OAAO,EACL,+BAA+B,EAE/B,6CAA6C,GAE9C,MAAM,yBAAyB,CAAC;AAEjC,cAAc,mCAAmC,CAAC;AAGlD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,OAAO,EACL,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,gBAAgB,EAChB,gCAAgC,EAChC,yCAAyC,EACzC,kCAAkC,EAClC,2CAA2C,EAC3C,0BAA0B,EAC1B,8BAA8B,EAC9B,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,iCAAiC,EACjC,kCAAkC,EAClC,4BAA4B,EAC5B,+BAA+B,EAC/B,oCAAoC,EACpC,qCAAqC,EACrC,uCAAuC,EACvC,wCAAwC,GACzC,MAAM,iBAAiB,CAAC;AAezB,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,wCAAwC,EAAE,MAAM,4CAA4C,CAAC;AAEtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAE9F,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAE/C,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,qCAAqC,EACrC,gCAAgC,GACjC,MAAM,mCAAmC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,cAAc,GACf,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,mCAAmC,EACnC,qCAAqC,GACtC,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,cAAc,EAAiB,MAAM,aAAa,CAAC;AAE5D,cAAc,eAAe,CAAC;AAG9B,mBAAmB;AACnB,cAAc,cAAc,CAAC;AAM7B,cAAc,cAAc,CAAC;AAG7B,cAAc,QAAQ,CAAC;AAGvB,cAAc,QAAQ,CAAC;AAGvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EACL,wBAAwB,EACxB,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,wCAAwC,EACxC,wBAAwB,EACxB,uBAAuB,GAOxB,MAAM,uBAAuB,CAAC;AAE/B,cAAc,OAAO,CAAC;AACtB,OAAO,EACL,+BAA+B,EAE/B,6CAA6C,GAE9C,MAAM,yBAAyB,CAAC;AAEjC,cAAc,mCAAmC,CAAC;AAGlD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,OAAO,EACL,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,gBAAgB,EAChB,gCAAgC,EAChC,yCAAyC,EACzC,kCAAkC,EAClC,2CAA2C,EAC3C,0BAA0B,EAC1B,8BAA8B,EAC9B,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,iCAAiC,EACjC,kCAAkC,EAClC,4BAA4B,EAC5B,+BAA+B,EAC/B,oCAAoC,EACpC,qCAAqC,EACrC,uCAAuC,EACvC,wCAAwC,GACzC,MAAM,iBAAiB,CAAC;AAezB,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,wCAAwC,EAAE,MAAM,4CAA4C,CAAC;AAEtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAE9F,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EACL,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAE/C,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,qCAAqC,EACrC,gCAAgC,GACjC,MAAM,mCAAmC,CAAC"}

package/dist/sanitize-next-href.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Maximum accepted `next_href` length. Generous enough for deep paths
+ * with query strings while keeping the value log- and cookie-safe.
+ */
+export declare const MAX_NEXT_HREF_LENGTH: 2048;
+/**
+ * @name sanitizeNextHref
+ * @description Validate a post-login redirect target from an untrusted
+ * source (query param, form field). Returns the normalized same-origin
+ * path (`pathname + search + hash`) when the value is a safe internal
+ * absolute-path reference, or `null` when it is absent or unsafe.
+ * Callers should treat `null` as "use the default destination".
+ */
+export declare function sanitizeNextHref(value: unknown): string | null;
+export default sanitizeNextHref;

package/dist/sanitize-next-href.js

@@ -0,0 +1,71 @@
+// The `next_href` parameter carries the URL a user was trying to reach
+// when an auth route guard bounced them to the login page, so that the
+// post-login redirect can return them to it. Because the value round-trips
+// through a user-controlled query string, it is an open-redirect vector
+// unless it is strictly confined to a same-origin path.
+//
+// This sanitizer accepts only an absolute-path reference (RFC 3986
+// §4.2: begins with "/" but not "//") and returns the normalized
+// `pathname + search + hash`. Everything else — absolute URLs,
+// protocol-relative URLs ("//evil.example"), backslash variants
+// ("/\evil.example", which browsers treat as "//"), control characters,
+// or values a URL parser resolves off-origin — is rejected with `null`
+// so callers can fall back to their default destination.
+/**
+ * Maximum accepted `next_href` length. Generous enough for deep paths
+ * with query strings while keeping the value log- and cookie-safe.
+ */
+export const MAX_NEXT_HREF_LENGTH = 2048;
+// Sentinel base origin used to resolve the candidate path. If the
+// parsed result escapes this origin, the value was not a plain path.
+const SANITIZE_BASE_ORIGIN = "https://next-href.invalid";
+// eslint-disable-next-line no-control-regex
+const CONTROL_CHARS_REGEX = /[\u0000-\u001f\u007f]/;
+/**
+ * @name sanitizeNextHref
+ * @description Validate a post-login redirect target from an untrusted
+ * source (query param, form field). Returns the normalized same-origin
+ * path (`pathname + search + hash`) when the value is a safe internal
+ * absolute-path reference, or `null` when it is absent or unsafe.
+ * Callers should treat `null` as "use the default destination".
+ */
+export function sanitizeNextHref(value) {
+    if (typeof value !== "string") {
+        return null;
+    }
+    if (value.length === 0 || value.length > MAX_NEXT_HREF_LENGTH) {
+        return null;
+    }
+    // Must be an absolute-path reference: "/..." but never "//..." (a
+    // protocol-relative URL) nor "/\..." (browser-normalized to "//").
+    if (!value.startsWith("/")) {
+        return null;
+    }
+    if (value.startsWith("//") || value.startsWith("/\\")) {
+        return null;
+    }
+    if (CONTROL_CHARS_REGEX.test(value)) {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = new URL(value, SANITIZE_BASE_ORIGIN);
+    }
+    catch {
+        return null;
+    }
+    // A plain path resolved against the sentinel base must stay on the
+    // sentinel origin; anything else smuggled in a scheme or authority.
+    if (parsed.origin !== SANITIZE_BASE_ORIGIN) {
+        return null;
+    }
+    // Defense-in-depth: reject if normalization still yields a
+    // protocol-relative shape (e.g. via backslash tricks the guards
+    // above didn't anticipate).
+    if (parsed.pathname.startsWith("//")) {
+        return null;
+    }
+    return `${parsed.pathname}${parsed.search}${parsed.hash}`;
+}
+export default sanitizeNextHref;
+//# sourceMappingURL=sanitize-next-href.js.map

package/dist/sanitize-next-href.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize-next-href.js","sourceRoot":"","sources":["../src/sanitize-next-href.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,uEAAuE;AACvE,2EAA2E;AAC3E,wEAAwE;AACxE,wDAAwD;AACxD,EAAE;AACF,mEAAmE;AACnE,iEAAiE;AACjE,+DAA+D;AAC/D,gEAAgE;AAChE,wEAAwE;AACxE,uEAAuE;AACvE,yDAAyD;AAEzD;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAa,CAAC;AAElD,kEAAkE;AAClE,qEAAqE;AACrE,MAAM,oBAAoB,GAAG,2BAAoC,CAAC;AAElE,4CAA4C;AAC5C,MAAM,mBAAmB,GAAW,uBAAuB,CAAC;AAE5D;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,kEAAkE;IAClE,mEAAmE;IACnE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mEAAmE;IACnE,oEAAoE;IACpE,IAAI,MAAM,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,2DAA2D;IAC3D,gEAAgE;IAChE,4BAA4B;IAC5B,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;AAC5D,CAAC;AAED,eAAe,gBAAgB,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@schemavaults/auth-common",
   "description": "Types and utility functions for authentication and authorization",
-  "version": "0.22.8",
+  "version": "0.22.11",
   "license": "UNLICENSED",
   "private": false,
   "repository": {