@seamless-auth/types 0.19.0 → 0.20.0

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # @seamless-auth/types
 
+## 0.20.0
+
+### Minor Changes
+
+- 9541d01: Carry `returnTo` back out of the OAuth callback, and hold it to a scheme that can be a
+  link destination.
+  
+  `StartOAuthLoginRequestSchema` has taken a `returnTo` since OAuth landed, and nothing ever
+  gave it back. `seamless-auth-api` validated it against the configured origins and signed it
+  into the state, and `seamless-auth-react` sent it, but no schema carried it to the end of the
+  flow, so a client that asked to be returned somewhere had no way to learn where. It was a
+  field that looked supported and did nothing.
+  
+  `OAuthLoginSuccessResponseSchema` now carries an optional `returnTo`. The API reads it back
+  out of the signed state rather than from the callback request, so it is the value validated
+  at `/start` and not one introduced at the end of the round trip. Absent when the caller asked
+  for nothing, so a client falls through to its own default rather than treating absence as an
+  error.
+  
+  Both `returnTo` fields move from `z.url()` to `RedirectTargetSchema`. `z.url()` accepts
+  `javascript:alert(1)` and `data:text/html,...`, and a client navigates to whatever comes back
+  out of this flow, so it is the same sink a magic link destination is. That is what
+  `RedirectTargetSchema` was added for in 0.18.0, and the OAuth fields should have used it
+  then.
+  
+  Additive for a consumer that ignores the new field. A caller that was somehow sending a
+  `javascript:` or `data:` `returnTo` is now refused at the schema rather than later, which is
+  the intended change.
+
 ## 0.19.0
 
 ### Minor Changes

package/dist/schemas/oauth/schema.d.ts

@@ -49,6 +49,7 @@ export declare const OAuthLoginSuccessResponseSchema: z.ZodObject<{
     refreshToken: z.ZodOptional<z.ZodString>;
     organizationId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     refreshTtl: z.ZodOptional<z.ZodNumber>;
+    returnTo: z.ZodOptional<z.ZodURL>;
 }, z.core.$strip>;
 export type OAuthLoginSuccessResponse = z.infer<typeof OAuthLoginSuccessResponseSchema>;
 export declare const OAUTH_ERROR_CODES: readonly ["oauth_missing_email", "oauth_email_not_verified", "oauth_missing_subject"];

package/dist/schemas/oauth/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/oauth/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,wBAAwB;;iBAEnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,wFAAwF;AACxF,eAAO,MAAM,yBAAyB;;;;iBAIpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,4BAA4B;;;;;;iBAEvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,6BAA6B;;;;;;;;iBAIxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,6BAA6B;;;iBAGxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,+BAA+B;;;;;;;;;;;iBAE1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,eAAO,MAAM,iBAAiB,uFAIpB,CAAC;AAEX,eAAO,MAAM,oBAAoB;;;;EAA4B,CAAC;AAE9D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,6BAA6B;;;;;;;;iBAIxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/oauth/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,wBAAwB;;iBAEnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,wFAAwF;AACxF,eAAO,MAAM,yBAAyB;;;;iBAIpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,4BAA4B;;;;;;iBAEvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,6BAA6B;;;;;;;;iBAIxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,6BAA6B;;;iBAGxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;iBAa1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,eAAO,MAAM,iBAAiB,uFAIpB,CAAC;AAEX,eAAO,MAAM,oBAAoB;;;;EAA4B,CAAC;AAE9D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,6BAA6B;;;;;;;;iBAIxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC"}

package/dist/schemas/oauth/schema.js

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { RefreshSuccessResponseSchema } from '../auth/auth.schema.js';
-import { OAuthProviderIdSchema } from '../systemConfig/schema.js';
+import { OAuthProviderIdSchema, RedirectTargetSchema } from '../systemConfig/schema.js';
 export const OAuthProviderParamSchema = z.object({
     providerId: OAuthProviderIdSchema,
 });
@@ -15,7 +15,7 @@ export const OAuthProvidersResponseSchema = z.object({
 });
 export const StartOAuthLoginRequestSchema = z.object({
     redirectUri: z.url().optional(),
-    returnTo: z.url().optional(),
+    returnTo: RedirectTargetSchema.optional(),
 });
 export const StartOAuthLoginResponseSchema = z.object({
     provider: PublicOAuthProviderSchema,
@@ -28,6 +28,17 @@ export const FinishOAuthLoginRequestSchema = z.object({
 });
 export const OAuthLoginSuccessResponseSchema = RefreshSuccessResponseSchema.omit({
     sessionId: true,
+}).extend({
+    /**
+     * Where the caller asked to be sent once the flow completes.
+     *
+     * Read back out of the signed state rather than from the callback request, so it is
+     * the value the authorization server accepted at `/start` and not one introduced at
+     * the end of the round trip. Present only when the caller supplied one and it passed
+     * validation there, so a client treats absence as "use my own default" rather than
+     * as an error.
+     */
+    returnTo: RedirectTargetSchema.optional(),
 });
 export const OAUTH_ERROR_CODES = [
     'oauth_missing_email',

package/dist/schemas/oauth/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/oauth/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,UAAU,EAAE,qBAAqB;CAClC,CAAC,CAAC;AAIH,wFAAwF;AACxF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC5B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;CAC9C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,QAAQ,EAAE,yBAAyB;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;CAC1B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,+BAA+B,GAAG,4BAA4B,CAAC,IAAI,CAAC;IAC/E,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,qBAAqB;IACrB,0BAA0B;IAC1B,uBAAuB;CACf,CAAC;AAEX,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;AAI9D,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/oauth/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAExF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,UAAU,EAAE,qBAAqB;CAClC,CAAC,CAAC;AAIH,wFAAwF;AACxF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC5B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;CAC9C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,QAAQ,EAAE,yBAAyB;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;CAC1B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,+BAA+B,GAAG,4BAA4B,CAAC,IAAI,CAAC;IAC/E,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC,MAAM,CAAC;IACR;;;;;;;;OAQG;IACH,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,qBAAqB;IACrB,0BAA0B;IAC1B,uBAAuB;CACf,CAAC;AAEX,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;AAI9D,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC"}

package/dist/schemas/webauthn/schema.d.ts

@@ -9,8 +9,8 @@ export declare const WebAuthnPrfRequestSchema: z.ZodObject<{
 }, z.core.$strip>;
 export type WebAuthnPrfRequest = z.infer<typeof WebAuthnPrfRequestSchema>;
 export declare const WebAuthnRegisterStartQuerySchema: z.ZodObject<{
-    requestPrf: z.ZodPreprocess<z.ZodOptional<z.ZodBoolean>>;
-    requirePrf: z.ZodPreprocess<z.ZodOptional<z.ZodBoolean>>;
+    requestPrf: z.ZodPreprocess<z.ZodOptional<z.ZodBoolean>, unknown>;
+    requirePrf: z.ZodPreprocess<z.ZodOptional<z.ZodBoolean>, unknown>;
 }, z.core.$strip>;
 export type WebAuthnRegisterStartQuery = z.infer<typeof WebAuthnRegisterStartQuerySchema>;
 export declare const WebAuthnAssertionStartSchema: z.ZodDefault<z.ZodObject<{

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seamless-auth/types",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "description": "Shared TypeScript types and Zod schemas for SeamlessAuth.",
   "author": "Fells Code, LLC",
   "license": "AGPL-3.0-only",
@@ -78,7 +78,7 @@
     "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@changesets/cli": "^2.31.1",
+    "@changesets/cli": "^3.0.2",
     "@commitlint/cli": "^21.2.1",
     "@commitlint/config-conventional": "^21.2.0",
     "@typescript-eslint/eslint-plugin": "^8.57.2",

package/src/schemas/oauth/schema.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { RefreshSuccessResponseSchema } from '../auth/auth.schema.js';
-import { OAuthProviderIdSchema } from '../systemConfig/schema.js';
+import { OAuthProviderIdSchema, RedirectTargetSchema } from '../systemConfig/schema.js';
 
 export const OAuthProviderParamSchema = z.object({
   providerId: OAuthProviderIdSchema,
@@ -25,7 +25,7 @@ export type OAuthProvidersResponse = z.infer<typeof OAuthProvidersResponseSchema
 
 export const StartOAuthLoginRequestSchema = z.object({
   redirectUri: z.url().optional(),
-  returnTo: z.url().optional(),
+  returnTo: RedirectTargetSchema.optional(),
 });
 
 export type StartOAuthLoginRequest = z.infer<typeof StartOAuthLoginRequestSchema>;
@@ -47,6 +47,17 @@ export type FinishOAuthLoginRequest = z.infer<typeof FinishOAuthLoginRequestSche
 
 export const OAuthLoginSuccessResponseSchema = RefreshSuccessResponseSchema.omit({
   sessionId: true,
+}).extend({
+  /**
+   * Where the caller asked to be sent once the flow completes.
+   *
+   * Read back out of the signed state rather than from the callback request, so it is
+   * the value the authorization server accepted at `/start` and not one introduced at
+   * the end of the round trip. Present only when the caller supplied one and it passed
+   * validation there, so a client treats absence as "use my own default" rather than
+   * as an error.
+   */
+  returnTo: RedirectTargetSchema.optional(),
 });
 
 export type OAuthLoginSuccessResponse = z.infer<typeof OAuthLoginSuccessResponseSchema>;