@spfn/auth 0.3.0-beta.16 → 0.3.0-beta.17

package/README.md

@@ -949,6 +949,16 @@ Both convenience URL APIs seal `metadata` into the encrypted OAuth state. On a n
 signup, the callback passes it to `beforeRegister` and `authRegisterEvent`; existing-account
 logins do not run the registration hook.
 
+`returnUrl` must be a path inside your app — absolute URLs, `//host`, `..`, a backslash, and a
+tab/CR/LF (which a URL parser strips, turning `/<tab>/host` into `//host`) are refused, so a
+real login cannot become an open redirect. The start seams answer an unsafe value with a 400
+`ValidationError`; the seams that already hold a logged-in user replace the destination instead
+of failing the login — `OAuthCallback` navigates to `/` and `createOAuthCallbackHandler`
+redirects to its `defaultRedirectUrl` (`/` unless you pass one). The rule is exported as
+`isSafeReturnPath` from `@spfn/auth/server`, `@spfn/auth/nextjs/server`, and
+`@spfn/auth/nextjs/client` for apps that validate a destination before calling
+`getGoogleOAuthUrl`.
+
 Built-in OAuth routes: `POST /_auth/oauth/google/url`, `GET /_auth/oauth/google` (redirect),
 `GET /_auth/oauth/google/callback`, `POST /_auth/oauth/finalize`, `GET /_auth/oauth/providers`,
 plus the provider-generic `POST /_auth/oauth/start`. `getGoogleAccessToken(userId)` returns a

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import * as _spfn_core_nextjs from '@spfn/core/nextjs';
-import { P as PermissionConfig, R as RoleConfig, m as mainAuthRouter, S as SendVerificationCodeResult, a as RegisterResult, b as RequestSignupLinkResult, C as ConfirmSignupLinkResult, c as RequestPasswordResetResult, d as ConfirmPasswordResetResult, L as LoginResult, e as StartDeviceAuthResult, D as DeviceAuthInfoResult, F as FinishPasskeyEnrollmentResult, f as PasskeySummary, g as RotateKeyResult, K as KeySummary, h as RevokeAllKeysResult, I as IssueOneTimeTokenResult, O as OAuthStartResult, i as OAuthNativeResult, U as UserProfile, j as ProfileInfo } from './machine-principals-Dn-7BqYZ.js';
-export { A as AuthInitOptions, k as AuthSession, l as PERMISSION_CATEGORIES, n as PermissionCategory, V as VERIFICATION_PURPOSES, o as VERIFICATION_TARGET_TYPES, p as VerificationPurpose, q as VerificationTargetType } from './machine-principals-Dn-7BqYZ.js';
+import { P as PermissionConfig, R as RoleConfig, m as mainAuthRouter, S as SendVerificationCodeResult, a as RegisterResult, b as RequestSignupLinkResult, C as ConfirmSignupLinkResult, c as RequestPasswordResetResult, d as ConfirmPasswordResetResult, L as LoginResult, e as StartDeviceAuthResult, D as DeviceAuthInfoResult, F as FinishPasskeyEnrollmentResult, f as PasskeySummary, g as RotateKeyResult, K as KeySummary, h as RevokeAllKeysResult, I as IssueOneTimeTokenResult, O as OAuthStartResult, i as OAuthNativeResult, U as UserProfile, j as ProfileInfo } from './machine-principals-nrpFSvvB.js';
+export { A as AuthInitOptions, k as AuthSession, l as PERMISSION_CATEGORIES, n as PermissionCategory, V as VERIFICATION_PURPOSES, o as VERIFICATION_TARGET_TYPES, p as VerificationPurpose, q as VerificationTargetType } from './machine-principals-nrpFSvvB.js';
 import * as _simplewebauthn_server from '@simplewebauthn/server';
 import * as _spfn_core_route from '@spfn/core/route';
 import { HttpMethod } from '@spfn/core/route';

package/dist/{machine-principals-Dn-7BqYZ.d.ts → machine-principals-nrpFSvvB.d.ts}

@@ -300,15 +300,6 @@ declare function verifyCodeService(params: VerifyCodeParams): Promise<{
  * is a second entry point to the same account creation, not a replacement.
  */
 
-/**
- * Whether a return path can be handed back to the browser.
- *
- * Only a path within the app is allowed. The rejected shapes are the ones that
- * turn a return path into an open redirect: an absolute URL, a protocol-relative
- * `//host` that a browser reads as another origin, a backslash that some
- * browsers normalize into a slash, and any `..` traversal.
- */
-declare function isSafeReturnPath(returnPath: string): boolean;
 interface RequestSignupLinkParams {
     email: string;
     returnPath?: string;
@@ -2575,4 +2566,4 @@ declare const machineAuth: _spfn_core_route.NamedMiddleware<"machineAuth">;
  */
 declare const requireMachineScope: _spfn_core_route.NamedMiddlewareFactory<"machineScope", string[]>;
 
-export { KeyIdSchema as $, type AuthInitOptions as A, type ConfirmPasswordResetParams as B, type ConfirmSignupLinkResult as C, type DeviceAuthInfoResult as D, type ConfirmSignupLinkParams as E, type FinishPasskeyEnrollmentResult as F, type DenyDeviceAuthParams as G, type DeviceAuthApprovedResult as H, type IssueOneTimeTokenResult as I, type DeviceAuthInfoParams as J, type KeySummary as K, type LoginResult as L, type DeviceAuthPendingResult as M, type NewPasskey as N, type OAuthStartResult as O, type PermissionConfig as P, DeviceAuthPollResponseSchema as Q, type RoleConfig as R, type SendVerificationCodeResult as S, DeviceNameSchema as T, type UserProfile as U, VERIFICATION_PURPOSES as V, EmailSchema as W, FingerprintSchema as X, type FinishPasskeyEnrollmentParams as Y, type FinishPasskeyLoginParams as Z, KEY_FINGERPRINT_PREFIX_LENGTH as _, type RegisterResult as a, isSafeReturnPath as a$, type LoginParams as a0, type LogoutParams as a1, type MachinePrincipal as a2, type MachineVerifierRegistration as a3, type NativeVerifyOptions as a4, type NormalizedIdentity as a5, type OAuthCallbackParams as a6, type OAuthCallbackResult as a7, type OAuthCodeExchangeOptions as a8, type OAuthNativeParams as a9, UnlinkNotifyRejection as aA, type UnlinkNotifyRequest as aB, type UnlinkNotifyResult as aC, UserCodeSchema as aD, VerificationPurposeSchema as aE, type VerifyCodeParams as aF, type VerifyCodeResult as aG, approveDeviceAuthService as aH, assertNotLastRecoveryCredential as aI, assertRecentAuthentication as aJ, authenticate as aK, buildOAuthErrorUrl as aL, changePasswordService as aM, completePasswordResetService as aN, completeSignupService as aO, confirmPasswordResetService as aP, confirmSignupLinkService as aQ, denyDeviceAuthService as aR, finishPasskeyEnrollmentService as aS, finishPasskeyLoginService as aT, getDeviceAuthInfoService as aU, getEnabledOAuthProviders as aV, getGoogleAccessToken as aW, getMachinePrincipal as aX, getOAuthProvider as aY, getRegisteredProviders as aZ, isOAuthProviderEnabled as a_, type OAuthStartParams as aa, type OAuthTokens as ab, PASSKEY_DEVICE_TYPES as ac, PASSKEY_LABEL_MAX_LENGTH as ad, type PasskeyDeviceType as ae, PasswordSchema as af, PhoneSchema as ag, PlatformSchema as ah, type PollDeviceAuthParams as ai, type PollDeviceAuthResult as aj, PublicKeySchema as ak, type RecentAuthenticationParams as al, type RegisterParams as am, type RegisterPublicKeyParams as an, type RenamePasskeyParams as ao, type RequestPasswordResetParams as ap, type RequestSignupLinkParams as aq, type RevokeAllKeysParams as ar, type RevokeKeyParams as as, type RevokePasskeyParams as at, type RotateKeyParams as au, type SendVerificationCodeParams as av, type StartDeviceAuthParams as aw, type StartPasskeyEnrollmentParams as ax, TargetTypeSchema as ay, type UnlinkNotification as az, type RequestSignupLinkResult as b, issueOneTimeTokenService as b0, listKeysService as b1, listPasskeysService as b2, loginService as b3, logoutService as b4, machineAuth as b5, oauthCallbackService as b6, oauthNativeService as b7, oauthStartService as b8, oauthUnlinkNotifyService as b9, optionalAuth as ba, passkeys as bb, pollDeviceAuthService as bc, registerAuthProfile as bd, registerMachineVerifier as be, registerOAuthProvider as bf, registerPublicKeyService as bg, registerService as bh, renamePasskeyService as bi, requestPasswordResetService as bj, requestSignupLinkService as bk, requireEnabledProvider as bl, requireMachineScope as bm, resolveAuthenticatedUser as bn, revokeAllKeysService as bo, revokeKeyService as bp, revokePasskeyService as bq, rotateKeyService as br, runAuthProfile as bs, selectAuthProfile as bt, sendVerificationCodeService as bu, startDeviceAuthService as bv, startPasskeyEnrollmentService as bw, startPasskeyLoginService as bx, verifyCodeService as by, verifyOneTimeTokenService as bz, type RequestPasswordResetResult as c, type ConfirmPasswordResetResult as d, type StartDeviceAuthResult as e, type PasskeySummary as f, type RotateKeyResult as g, type RevokeAllKeysResult as h, type OAuthNativeResult as i, type ProfileInfo as j, type AuthSession as k, PERMISSION_CATEGORIES as l, mainAuthRouter as m, type PermissionCategory as n, VERIFICATION_TARGET_TYPES as o, type VerificationPurpose as p, type VerificationTargetType as q, type OAuthProvider as r, type Passkey as s, type AuthContext as t, type ApproveDeviceAuthParams as u, type AuthProfileOutcome as v, type AuthProfileVerifier as w, type ChangePasswordParams as x, type CompletePasswordResetParams as y, type CompleteSignupParams as z };
+export { KeyIdSchema as $, type AuthInitOptions as A, type ConfirmPasswordResetParams as B, type ConfirmSignupLinkResult as C, type DeviceAuthInfoResult as D, type ConfirmSignupLinkParams as E, type FinishPasskeyEnrollmentResult as F, type DenyDeviceAuthParams as G, type DeviceAuthApprovedResult as H, type IssueOneTimeTokenResult as I, type DeviceAuthInfoParams as J, type KeySummary as K, type LoginResult as L, type DeviceAuthPendingResult as M, type NewPasskey as N, type OAuthStartResult as O, type PermissionConfig as P, DeviceAuthPollResponseSchema as Q, type RoleConfig as R, type SendVerificationCodeResult as S, DeviceNameSchema as T, type UserProfile as U, VERIFICATION_PURPOSES as V, EmailSchema as W, FingerprintSchema as X, type FinishPasskeyEnrollmentParams as Y, type FinishPasskeyLoginParams as Z, KEY_FINGERPRINT_PREFIX_LENGTH as _, type RegisterResult as a, issueOneTimeTokenService as a$, type LoginParams as a0, type LogoutParams as a1, type MachinePrincipal as a2, type MachineVerifierRegistration as a3, type NativeVerifyOptions as a4, type NormalizedIdentity as a5, type OAuthCallbackParams as a6, type OAuthCallbackResult as a7, type OAuthCodeExchangeOptions as a8, type OAuthNativeParams as a9, UnlinkNotifyRejection as aA, type UnlinkNotifyRequest as aB, type UnlinkNotifyResult as aC, UserCodeSchema as aD, VerificationPurposeSchema as aE, type VerifyCodeParams as aF, type VerifyCodeResult as aG, approveDeviceAuthService as aH, assertNotLastRecoveryCredential as aI, assertRecentAuthentication as aJ, authenticate as aK, buildOAuthErrorUrl as aL, changePasswordService as aM, completePasswordResetService as aN, completeSignupService as aO, confirmPasswordResetService as aP, confirmSignupLinkService as aQ, denyDeviceAuthService as aR, finishPasskeyEnrollmentService as aS, finishPasskeyLoginService as aT, getDeviceAuthInfoService as aU, getEnabledOAuthProviders as aV, getGoogleAccessToken as aW, getMachinePrincipal as aX, getOAuthProvider as aY, getRegisteredProviders as aZ, isOAuthProviderEnabled as a_, type OAuthStartParams as aa, type OAuthTokens as ab, PASSKEY_DEVICE_TYPES as ac, PASSKEY_LABEL_MAX_LENGTH as ad, type PasskeyDeviceType as ae, PasswordSchema as af, PhoneSchema as ag, PlatformSchema as ah, type PollDeviceAuthParams as ai, type PollDeviceAuthResult as aj, PublicKeySchema as ak, type RecentAuthenticationParams as al, type RegisterParams as am, type RegisterPublicKeyParams as an, type RenamePasskeyParams as ao, type RequestPasswordResetParams as ap, type RequestSignupLinkParams as aq, type RevokeAllKeysParams as ar, type RevokeKeyParams as as, type RevokePasskeyParams as at, type RotateKeyParams as au, type SendVerificationCodeParams as av, type StartDeviceAuthParams as aw, type StartPasskeyEnrollmentParams as ax, TargetTypeSchema as ay, type UnlinkNotification as az, type RequestSignupLinkResult as b, listKeysService as b0, listPasskeysService as b1, loginService as b2, logoutService as b3, machineAuth as b4, oauthCallbackService as b5, oauthNativeService as b6, oauthStartService as b7, oauthUnlinkNotifyService as b8, optionalAuth as b9, passkeys as ba, pollDeviceAuthService as bb, registerAuthProfile as bc, registerMachineVerifier as bd, registerOAuthProvider as be, registerPublicKeyService as bf, registerService as bg, renamePasskeyService as bh, requestPasswordResetService as bi, requestSignupLinkService as bj, requireEnabledProvider as bk, requireMachineScope as bl, resolveAuthenticatedUser as bm, revokeAllKeysService as bn, revokeKeyService as bo, revokePasskeyService as bp, rotateKeyService as bq, runAuthProfile as br, selectAuthProfile as bs, sendVerificationCodeService as bt, startDeviceAuthService as bu, startPasskeyEnrollmentService as bv, startPasskeyLoginService as bw, verifyCodeService as bx, verifyOneTimeTokenService as by, type RequestPasswordResetResult as c, type ConfirmPasswordResetResult as d, type StartDeviceAuthResult as e, type PasskeySummary as f, type RotateKeyResult as g, type RevokeAllKeysResult as h, type OAuthNativeResult as i, type ProfileInfo as j, type AuthSession as k, PERMISSION_CATEGORIES as l, mainAuthRouter as m, type PermissionCategory as n, VERIFICATION_TARGET_TYPES as o, type VerificationPurpose as p, type VerificationTargetType as q, type OAuthProvider as r, type Passkey as s, type AuthContext as t, type ApproveDeviceAuthParams as u, type AuthProfileOutcome as v, type AuthProfileVerifier as w, type ChangePasswordParams as x, type CompletePasswordResetParams as y, type CompleteSignupParams as z };

package/dist/nextjs/api.js

@@ -846,6 +846,21 @@ async function createOAuthState(params) {
   return encodeURIComponent(jwe);
 }
 
+// src/lib/return-path.ts
+var URL_STRIPPED_CHARACTER = /[\t\n\r]/;
+function isSafeReturnPath(returnPath) {
+  if (!returnPath.startsWith("/")) {
+    return false;
+  }
+  if (returnPath.startsWith("//") || returnPath.includes("\\")) {
+    return false;
+  }
+  if (returnPath.includes("..") || URL_STRIPPED_CHARACTER.test(returnPath)) {
+    return false;
+  }
+  return !/^\/[^/?#]*:/.test(returnPath);
+}
+
 // src/nextjs/session-helpers.ts
 import * as jose3 from "jose";
 import { cookies } from "next/headers.js";
@@ -872,6 +887,20 @@ async function unsealPendingSession(jwt2) {
 }
 
 // src/nextjs/interceptors/oauth.ts
+var UNSAFE_RETURN_URL_MESSAGE = "returnUrl must be a relative path within the app";
+function refuseUnsafeReturnUrl() {
+  return {
+    status: 400,
+    body: {
+      __type: "ValidationError",
+      message: UNSAFE_RETURN_URL_MESSAGE,
+      error: {
+        code: "ValidationError",
+        message: UNSAFE_RETURN_URL_MESSAGE
+      }
+    }
+  };
+}
 var oauthUrlInterceptor = {
   pathPattern: /^\/_auth\/oauth\/\w+\/url$/,
   method: "POST",
@@ -879,6 +908,13 @@ var oauthUrlInterceptor = {
     const provider = ctx.path.split("/")[3];
     const returnUrl = ctx.body?.returnUrl || "/";
     const metadata = ctx.body?.metadata;
+    if (typeof returnUrl !== "string" || !isSafeReturnPath(returnUrl)) {
+      authLogger.interceptor.oauth?.warn?.("OAuth start refused: returnUrl is not a path within the app", {
+        provider
+      });
+      ctx.abort = refuseUnsafeReturnUrl();
+      return;
+    }
     const keyPair = generateKeyPair("ES256");
     const csrfNonce = generateOAuthNonce();
     const state = await createOAuthState({