@stackframe/stack-shared 2.6.27 → 2.6.28

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @stackframe/stack-shared
 
+## 2.6.28
+
+### Patch Changes
+
+- Bugfixes
+  - @stackframe/stack-sc@2.6.28
+
 ## 2.6.27
 
 ### Patch Changes

package/dist/known-errors.d.ts

@@ -395,5 +395,8 @@ export declare const KnownErrors: {
     OAuthProviderAccessDenied: KnownErrorConstructor<KnownError & KnownErrorBrand<"OAUTH_PROVIDER_ACCESS_DENIED">, []> & {
         errorCode: "OAUTH_PROVIDER_ACCESS_DENIED";
     };
+    ContactChannelAlreadyUsedForAuthBySomeoneElse: KnownErrorConstructor<KnownError & KnownErrorBrand<"CONTACT_CHANNEL_ALREADY_USED_FOR_AUTH_BY_SOMEONE_ELSE">, [type: "email"]> & {
+        errorCode: "CONTACT_CHANNEL_ALREADY_USED_FOR_AUTH_BY_SOMEONE_ELSE";
+    };
 };
 export {};

package/dist/known-errors.js

@@ -558,6 +558,11 @@ const OAuthProviderAccessDenied = createKnownErrorConstructor(KnownError, "OAUTH
     400,
     "The OAuth provider denied access to the user.",
 ], () => []);
+const ContactChannelAlreadyUsedForAuthBySomeoneElse = createKnownErrorConstructor(KnownError, "CONTACT_CHANNEL_ALREADY_USED_FOR_AUTH_BY_SOMEONE_ELSE", (type) => [
+    400,
+    `This ${type} is already used for authentication by another account.`,
+    { type },
+], (json) => [json.type]);
 export const KnownErrors = {
     UnsupportedError,
     BodyParsingError,
@@ -650,6 +655,7 @@ export const KnownErrors = {
     InvalidAuthorizationCode,
     TeamPermissionNotFound,
     OAuthProviderAccessDenied,
+    ContactChannelAlreadyUsedForAuthBySomeoneElse,
 };
 // ensure that all known error codes are unique
 const knownErrorCodes = new Set();

package/dist/schema-fields.js

@@ -296,7 +296,7 @@ export const userPasswordHashMutationSchema = yupString()
     .meta({ openapiField: { description: 'If `password` is not given, sets the user\'s password hash to the given string in Modular Crypt Format (ex.: `$2a$10$VIhIOofSMqGdGlL4wzE//e.77dAQGqNtF/1dT7bqCrVtQuInWy2qi`). Doing so revokes all current sessions.' } }); // we don't set an exampleValue here because it's exclusive with the password field and having both would break the generated example
 export const userTotpSecretMutationSchema = base64Schema.nullable().meta({ openapiField: { description: 'Enables 2FA and sets a TOTP secret for the user. Set to null to disable 2FA.', exampleValue: 'dG90cC1zZWNyZXQ=' } });
 // Auth
-export const signInEmailSchema = emailSchema.meta({ openapiField: { description: 'The email to sign in with.', exampleValue: 'johndoe@example.com' } });
+export const signInEmailSchema = strictEmailSchema(undefined).meta({ openapiField: { description: 'The email to sign in with.', exampleValue: 'johndoe@example.com' } });
 export const emailOtpSignInCallbackUrlSchema = urlSchema.meta({ openapiField: { description: 'The base callback URL to construct the magic link from. A query parameter `code` with the verification code will be appended to it. The page should then make a request to the `/auth/otp/sign-in` endpoint.', exampleValue: 'https://example.com/handler/magic-link-callback' } });
 export const emailVerificationCallbackUrlSchema = urlSchema.meta({ openapiField: { description: 'The base callback URL to construct a verification link for the verification e-mail. A query parameter `code` with the verification code will be appended to it. The page should then make a request to the `/contact-channels/verify` endpoint.', exampleValue: 'https://example.com/handler/email-verification' } });
 export const accessTokenResponseSchema = yupString().meta({ openapiField: { description: 'Short-lived access token that can be used to authenticate the user', exampleValue: 'eyJhmMiJB2TO...diI4QT' } });

package/dist/utils/promises.js

@@ -105,7 +105,7 @@ export function runAsynchronouslyWithAlert(...args) {
     return runAsynchronously(args[0], {
         ...args[1],
         onError: error => {
-            alert(`An unhandled error occurred. Please ${process.env.NODE_ENV === "development" ? `check the browser console for the full error. ${error}` : "report this to the developer."}\n\n${error}`);
+            alert(`An unhandled error occurred. Please ${process.env.NODE_ENV === "development" ? `check the browser console for the full error.` : "report this to the developer."}\n\n${error}`);
             args[1]?.onError?.(error);
         },
     }, ...args.slice(2));
@@ -116,9 +116,9 @@ export function runAsynchronously(promiseOrFunc, options = {}) {
     }
     const duringError = new Error();
     promiseOrFunc?.catch(error => {
+        options.onError?.(error);
         const newError = new StackAssertionError("Uncaught error in asynchronous function: " + error.toString(), { cause: error });
         concatStacktraces(newError, duringError);
-        options.onError?.(newError);
         if (!options.noErrorLogging) {
             captureError("runAsynchronously", newError);
         }

package/dist/utils/urls.d.ts

@@ -1,3 +1,4 @@
+export declare function createUrlIfValid(...args: ConstructorParameters<typeof URL>): URL | null;
 export declare function isLocalhost(urlOrString: string | URL): boolean;
 export declare function isRelative(url: string): boolean;
 export declare function getRelativePart(url: URL): string;

package/dist/utils/urls.js

@@ -1,6 +1,16 @@
 import { generateSecureRandomString } from "./crypto";
+export function createUrlIfValid(...args) {
+    try {
+        return new URL(...args);
+    }
+    catch (e) {
+        return null;
+    }
+}
 export function isLocalhost(urlOrString) {
-    const url = new URL(urlOrString);
+    const url = createUrlIfValid(urlOrString);
+    if (!url)
+        return false;
     if (url.hostname === "localhost" || url.hostname.endsWith(".localhost"))
         return true;
     if (url.hostname.match(/^127\.\d+\.\d+\.\d+$/))
@@ -9,7 +19,9 @@ export function isLocalhost(urlOrString) {
 }
 export function isRelative(url) {
     const randomDomain = `${generateSecureRandomString()}.stack-auth.example.com`;
-    const u = new URL(url, `https://${randomDomain}`);
+    const u = createUrlIfValid(url, `https://${randomDomain}`);
+    if (!u)
+        return false;
     if (u.host !== randomDomain)
         return false;
     if (u.protocol !== "https:")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stackframe/stack-shared",
-  "version": "2.6.27",
+  "version": "2.6.28",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [
@@ -50,7 +50,7 @@
     "oauth4webapi": "^2.10.3",
     "semver": "^7.6.3",
     "uuid": "^9.0.1",
-    "@stackframe/stack-sc": "2.6.27"
+    "@stackframe/stack-sc": "2.6.28"
   },
   "devDependencies": {
     "@simplewebauthn/types": "^11.0.0",