@tempoxyz/auth 0.0.0-pr-43.sha-8021459 → 0.0.0-pr-48.sha-9d0ea2b

package/dist/Auth.d.ts

@@ -49,7 +49,7 @@ export declare namespace RequestError {
         uri?: string | undefined;
     };
     /** Each refusal's stable name. `docs/errors.md` explains each one. */
-    type Reason = 'already_decided' | 'body_too_large' | 'duplicate_limit' | 'empty_limits' | 'empty_scopes' | 'expiry_exceeds_maximum' | 'expiry_passed' | 'foreign_account' | 'invalid_chain' | 'invalid_code' | 'invalid_expiry' | 'invalid_field' | 'invalid_origin' | 'invalid_public_key' | 'limit_exceeds_maximum' | 'missing_code_challenge' | 'missing_key' | 'missing_recipients' | 'periodic_limit' | 'rate_limited' | 'rejected' | 'scope_without_limit' | 'unknown_code' | 'unsupported_call' | 'unsupported_step' | 'unsupported_token';
+    type Reason = 'already_decided' | 'body_too_large' | 'duplicate_limit' | 'empty_limits' | 'empty_scopes' | 'expiry_exceeds_maximum' | 'expiry_passed' | 'foreign_account' | 'invalid_chain' | 'invalid_code' | 'invalid_expiry' | 'invalid_field' | 'invalid_origin' | 'invalid_public_key' | 'limit_exceeds_maximum' | 'missing_code_challenge' | 'missing_key' | 'missing_recipients' | 'periodic_limit' | 'rejected' | 'scope_without_limit' | 'unknown_code' | 'unsupported_call' | 'unsupported_step' | 'unsupported_token';
 }
 /**
  * Creates a Tempo Auth instance.

package/dist/actions/redirect.js

@@ -99,6 +99,14 @@ export async function createUrl(auth, options = {}) {
 export async function handleCallback(auth, options) {
     const { redirectUri, state, verifier, ...material } = options.pending;
     const params = new URL(options.url).searchParams;
+    // State comes first, so a forged link cannot supply the error an app shows.
+    if (params.get('state') !== state)
+        throw new RequestError({
+            code: 'invalid_request',
+            field: 'state',
+            message: 'Invalid `state` in the callback URL. Start sign-in again from this app.',
+            status: 400,
+        });
     const code = params.get('code');
     if (!code)
         throw new RequestError({
@@ -108,13 +116,6 @@ export async function handleCallback(auth, options) {
                 'Missing `code` in the callback URL. Start sign-in again.',
             status: 400,
         });
-    if (params.get('state') !== state)
-        throw new RequestError({
-            code: 'invalid_request',
-            field: 'state',
-            message: 'Invalid `state` in the callback URL. Start sign-in again from this app.',
-            status: 400,
-        });
     const body = await Api.token(auth, {
         code,
         code_verifier: verifier,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tempoxyz/auth",
-  "version": "0.0.0-pr-43.sha-8021459",
+  "version": "0.0.0-pr-48.sha-9d0ea2b",
   "description": "Signs users in to Tempo through Tempo Auth, and returns viem access key accounts on their Tempo Accounts.",
   "type": "module",
   "exports": {