@spfn/auth 0.3.0-beta.2 → 0.3.0-beta.20

package/dist/{session-DTHahDQ9.d.ts → session-Dfwu5g2W.d.ts}

@@ -1,5 +1,32 @@
 import { K as KeyAlgorithmType } from './types-DYyhze28.js';
 
+/**
+ * @spfn/auth - Return-path validation
+ *
+ * One rule for every flow that hands a caller-supplied destination back to the
+ * browser: the verified-email signup link, the password reset link, and the
+ * OAuth start/callback seams. Apps that build their own destination before
+ * calling an auth route import the same function rather than writing a second
+ * rule that drifts from this one.
+ *
+ * The module imports nothing on purpose — it is part of the client bundle
+ * (`@spfn/auth/nextjs/client`), which must not pull server code in behind it.
+ */
+/**
+ * Whether a return path can be handed back to the browser.
+ *
+ * Only a path within the app is allowed. The rejected shapes are the ones that
+ * turn a return path into an open redirect: an absolute URL, a protocol-relative
+ * `//host` that a browser reads as another origin, a backslash that some
+ * browsers normalize into a slash, any `..` traversal, and any character a URL
+ * parser strips before parsing (see above).
+ *
+ * The value is judged exactly as written: nothing is percent-decoded here. A
+ * `/a%0d%0a` is therefore a path containing those six literal characters and is
+ * accepted — no decoder downstream turns it back into header bytes.
+ */
+declare function isSafeReturnPath(returnPath: string): boolean;
+
 /**
  * @spfn/auth - Client Session Management
  *
@@ -50,4 +77,4 @@ declare function getSessionInfo(jwt: string): Promise<{
  */
 declare function shouldRefreshSession(jwt: string, thresholdHours?: number): Promise<boolean>;
 
-export { type SessionData as S, shouldRefreshSession as a, getSessionInfo as g, sealSession as s, unsealSession as u };
+export { type SessionData as S, shouldRefreshSession as a, getSessionInfo as g, isSafeReturnPath as i, sealSession as s, unsealSession as u };

package/migrations/20260810112144_colorful_tomorrow_man/migration.sql

@@ -0,0 +1,18 @@
+CREATE TABLE "spfn_auth"."signup_link_tokens" (
+	"id" bigserial PRIMARY KEY,
+	"email" text NOT NULL,
+	"token_hash" text NOT NULL,
+	"return_path" text,
+	"expires_at" timestamp with time zone NOT NULL,
+	"consumed_at" timestamp with time zone,
+	"superseded_at" timestamp with time zone,
+	"setup_secret_hash" text,
+	"setup_expires_at" timestamp with time zone,
+	"completed_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX "signup_link_token_hash_idx" ON "spfn_auth"."signup_link_tokens" ("token_hash");--> statement-breakpoint
+CREATE UNIQUE INDEX "signup_link_setup_secret_hash_idx" ON "spfn_auth"."signup_link_tokens" ("setup_secret_hash");--> statement-breakpoint
+CREATE INDEX "signup_link_email_idx" ON "spfn_auth"."signup_link_tokens" ("email","expires_at");