@startsimpli/auth 0.4.20 → 0.4.22

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@startsimpli/auth",
-  "version": "0.4.20",
+  "version": "0.4.22",
   "description": "Shared authentication package for StartSimpli Next.js apps",
   "main": "./src/index.ts",
   "types": "./src/index.ts",

package/src/__tests__/central-auth.test.ts

@@ -0,0 +1,25 @@
+import { describe, it, expect } from 'vitest';
+import { resolveAppHomeUrl, buildCentralAuthUrl } from '../utils/central-auth';
+
+describe('resolveAppHomeUrl', () => {
+  it('maps known app slugs to their home URL', () => {
+    expect(resolveAppHomeUrl('present')).toBe('https://present.startsimpli.com');
+    expect(resolveAppHomeUrl('market')).toBe('https://market.startsimpli.com');
+    expect(resolveAppHomeUrl('raise')).toBe('https://app.raisesimpli.com');
+    expect(resolveAppHomeUrl('crochet')).toBe('https://crochets.site');
+  });
+  it('defaults unknown slugs to a startsimpli.com subdomain (never off-platform)', () => {
+    expect(resolveAppHomeUrl('whatever')).toBe('https://whatever.startsimpli.com');
+    expect(resolveAppHomeUrl('EVIL')).toBe('https://evil.startsimpli.com');
+  });
+  it('returns null for empty input', () => {
+    expect(resolveAppHomeUrl(null)).toBeNull();
+    expect(resolveAppHomeUrl(undefined)).toBeNull();
+    expect(resolveAppHomeUrl('  ')).toBeNull();
+  });
+  it('buildCentralAuthUrl still preserves app + return_to', () => {
+    const u = buildCentralAuthUrl('signin', { app: 'present', returnTo: 'https://present.startsimpli.com/x' });
+    expect(u).toContain('app=present');
+    expect(u).toContain('return_to=');
+  });
+});

package/src/utils/central-auth.ts

@@ -39,6 +39,35 @@ export function resolveCentralAuthHost(): string {
   return DEFAULT_CENTRAL_AUTH_HOST;
 }
 
+/**
+ * Known app slug → production home URL. Most apps live at
+ * `<slug>.startsimpli.com`; the exceptions (different registrable domains) are
+ * listed explicitly. Used to bounce a user to the right app after an auth flow
+ * when no explicit `return_to` was supplied (e.g. `/signin?app=present`).
+ */
+const APP_HOME_URLS: Record<string, string> = {
+  market: 'https://market.startsimpli.com',
+  trade: 'https://trade.startsimpli.com',
+  present: 'https://present.startsimpli.com',
+  vault: 'https://vault.startsimpli.com',
+  raise: 'https://app.raisesimpli.com',
+  recipe: 'https://recipesimpli.com',
+  crochet: 'https://crochets.site',
+};
+
+/**
+ * Resolve an app slug to its production home URL. Falls back to
+ * `https://<slug>.startsimpli.com` for any unregistered slug — always a
+ * startsimpli.com subdomain, so a bad `?app=` value can't redirect off-platform.
+ * Returns null for empty input.
+ */
+export function resolveAppHomeUrl(app: string | null | undefined): string | null {
+  if (!app) return null;
+  const slug = app.trim().toLowerCase();
+  if (!slug) return null;
+  return APP_HOME_URLS[slug] ?? `https://${slug}.startsimpli.com`;
+}
+
 export interface BuildCentralAuthUrlOptions {
   /** Slug identifying the calling app (e.g. `vault`, `raise`, `market`). */
   app: string;