@supabase/auth-js 2.106.1-beta.1 → 2.106.1-beta.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supabase/auth-js",
-  "version": "2.106.1-beta.1",
+  "version": "2.106.1-beta.2",
   "private": false,
   "description": "Official SDK for Supabase Auth",
   "keywords": [

package/src/GoTrueAdminApi.ts

@@ -65,6 +65,14 @@ export default class GoTrueAdminApi {
   protected headers: {
     [key: string]: string
   }
+
+  private _encodePathSegment(segment: string): string {
+    if (segment === '.' || segment === '..') {
+      throw new AuthError('Invalid path segment')
+    }
+
+    return encodeURIComponent(segment)
+  }
   protected fetch: Fetch
   protected experimental: ExperimentalFeatureFlags
 
@@ -982,12 +990,18 @@ export default class GoTrueAdminApi {
    */
   private async _getOAuthClient(clientId: string): Promise<OAuthClientResponse> {
     try {
-      return await _request(this.fetch, 'GET', `${this.url}/admin/oauth/clients/${clientId}`, {
-        headers: this.headers,
-        xform: (client: any) => {
-          return { data: client, error: null }
-        },
-      })
+      const encodedClientId = this._encodePathSegment(clientId)
+      return await _request(
+        this.fetch,
+        'GET',
+        `${this.url}/admin/oauth/clients/${encodedClientId}`,
+        {
+          headers: this.headers,
+          xform: (client: any) => {
+            return { data: client, error: null }
+          },
+        }
+      )
     } catch (error) {
       if (isAuthError(error)) {
         return { data: null, error }
@@ -1008,13 +1022,19 @@ export default class GoTrueAdminApi {
     params: UpdateOAuthClientParams
   ): Promise<OAuthClientResponse> {
     try {
-      return await _request(this.fetch, 'PUT', `${this.url}/admin/oauth/clients/${clientId}`, {
-        body: params,
-        headers: this.headers,
-        xform: (client: any) => {
-          return { data: client, error: null }
-        },
-      })
+      const encodedClientId = this._encodePathSegment(clientId)
+      return await _request(
+        this.fetch,
+        'PUT',
+        `${this.url}/admin/oauth/clients/${encodedClientId}`,
+        {
+          body: params,
+          headers: this.headers,
+          xform: (client: any) => {
+            return { data: client, error: null }
+          },
+        }
+      )
     } catch (error) {
       if (isAuthError(error)) {
         return { data: null, error }
@@ -1034,7 +1054,8 @@ export default class GoTrueAdminApi {
     clientId: string
   ): Promise<{ data: null; error: AuthError | null }> {
     try {
-      await _request(this.fetch, 'DELETE', `${this.url}/admin/oauth/clients/${clientId}`, {
+      const encodedClientId = this._encodePathSegment(clientId)
+      await _request(this.fetch, 'DELETE', `${this.url}/admin/oauth/clients/${encodedClientId}`, {
         headers: this.headers,
         noResolveJson: true,
       })
@@ -1056,10 +1077,11 @@ export default class GoTrueAdminApi {
    */
   private async _regenerateOAuthClientSecret(clientId: string): Promise<OAuthClientResponse> {
     try {
+      const encodedClientId = this._encodePathSegment(clientId)
       return await _request(
         this.fetch,
         'POST',
-        `${this.url}/admin/oauth/clients/${clientId}/regenerate_secret`,
+        `${this.url}/admin/oauth/clients/${encodedClientId}/regenerate_secret`,
         {
           headers: this.headers,
           xform: (client: any) => {
@@ -1141,12 +1163,18 @@ export default class GoTrueAdminApi {
    */
   private async _getCustomProvider(identifier: string): Promise<CustomProviderResponse> {
     try {
-      return await _request(this.fetch, 'GET', `${this.url}/admin/custom-providers/${identifier}`, {
-        headers: this.headers,
-        xform: (provider: any) => {
-          return { data: provider, error: null }
-        },
-      })
+      const encodedIdentifier = this._encodePathSegment(identifier)
+      return await _request(
+        this.fetch,
+        'GET',
+        `${this.url}/admin/custom-providers/${encodedIdentifier}`,
+        {
+          headers: this.headers,
+          xform: (provider: any) => {
+            return { data: provider, error: null }
+          },
+        }
+      )
     } catch (error) {
       if (isAuthError(error)) {
         return { data: null, error }
@@ -1170,13 +1198,19 @@ export default class GoTrueAdminApi {
     params: UpdateCustomProviderParams
   ): Promise<CustomProviderResponse> {
     try {
-      return await _request(this.fetch, 'PUT', `${this.url}/admin/custom-providers/${identifier}`, {
-        body: params,
-        headers: this.headers,
-        xform: (provider: any) => {
-          return { data: provider, error: null }
-        },
-      })
+      const encodedIdentifier = this._encodePathSegment(identifier)
+      return await _request(
+        this.fetch,
+        'PUT',
+        `${this.url}/admin/custom-providers/${encodedIdentifier}`,
+        {
+          body: params,
+          headers: this.headers,
+          xform: (provider: any) => {
+            return { data: provider, error: null }
+          },
+        }
+      )
     } catch (error) {
       if (isAuthError(error)) {
         return { data: null, error }
@@ -1194,10 +1228,16 @@ export default class GoTrueAdminApi {
     identifier: string
   ): Promise<{ data: null; error: AuthError | null }> {
     try {
-      await _request(this.fetch, 'DELETE', `${this.url}/admin/custom-providers/${identifier}`, {
-        headers: this.headers,
-        noResolveJson: true,
-      })
+      const encodedIdentifier = this._encodePathSegment(identifier)
+      await _request(
+        this.fetch,
+        'DELETE',
+        `${this.url}/admin/custom-providers/${encodedIdentifier}`,
+        {
+          headers: this.headers,
+          noResolveJson: true,
+        }
+      )
       return { data: null, error: null }
     } catch (error) {
       if (isAuthError(error)) {

package/src/lib/version.ts

@@ -4,4 +4,4 @@
 // - Debugging and support (identifying which version is running)
 // - Telemetry and logging (version reporting in errors/analytics)
 // - Ensuring build artifacts match the published package version
-export const version = '2.106.1-beta.1'
+export const version = '2.106.1-beta.2'