@trylight/app 0.3.2 → 0.3.4

package/dist/auth/next-path.js

@@ -1,10 +1,16 @@
-// Only a path on this app is a valid place to land after signing in. Anything
-// absolute (or protocol-relative) would make the login flow an open redirect.
+import { SAME_ORIGIN_BASE } from "../platform/contract.js";
+// Only a path on this app is a valid place to land after signing in. Parsed,
+// not pattern-matched: browsers read `//host`, `/\host` and `/\t/host` as
+// another site. The candidate is returned as given, not normalised: its
+// pathname could read `//host`.
 export function safeNext(candidate) {
     if (candidate === null ||
         !candidate.startsWith("/") ||
-        candidate.startsWith("//")) {
+        // The parser drops tabs and line breaks; a Location header refuses them.
+        [...candidate].some((character) => character < " ")) {
         return "/";
     }
-    return candidate;
+    return new URL(candidate, SAME_ORIGIN_BASE).origin === SAME_ORIGIN_BASE
+        ? candidate
+        : "/";
 }

package/dist/platform/contract.d.ts

@@ -5,12 +5,16 @@ export declare const IMAGE_PATH = "/api/light/image";
 export declare const BUILD_PATH = "/api/light/build";
 export declare const INVOKE_BASE_PATH = "/api/mii/invoke";
 export declare const CHAT_BASE_PATH = "/api/mii/chat";
+/** A base to resolve an app-relative path against when checking it stays on the app; never contacted. */
+export declare const SAME_ORIGIN_BASE = "https://app.invalid";
 /** The platform's sign-in API, called with an app's own id. */
 export declare const PLATFORM_AUTH_PATHS: {
     signIn: string;
     requestPasswordReset: string;
     redeemPaneCode: string;
     config: string;
+    /** "Continue with Google / Microsoft": the platform signs the person in and returns with a one-time code. */
+    socialSignIn: string;
 };
 /** The platform's chat API: an app's chat route forwards any path beneath it, so a new widget route needs no SDK release. */
 export declare const PLATFORM_CHAT_PATH = "/api/app-chat/v1/chat";

package/dist/platform/contract.js

@@ -11,12 +11,16 @@ export const IMAGE_PATH = `/api/${NAMESPACE}/image`;
 export const BUILD_PATH = `/api/${NAMESPACE}/build`;
 export const INVOKE_BASE_PATH = `/api/${LEGACY_NAMESPACE}/invoke`;
 export const CHAT_BASE_PATH = `/api/${LEGACY_NAMESPACE}/chat`;
+/** A base to resolve an app-relative path against when checking it stays on the app; never contacted. */
+export const SAME_ORIGIN_BASE = "https://app.invalid";
 /** The platform's sign-in API, called with an app's own id. */
 export const PLATFORM_AUTH_PATHS = {
     signIn: "/api/app-auth/sign-in",
     requestPasswordReset: "/api/app-auth/request-password-reset",
     redeemPaneCode: "/api/app-auth/redeem",
-    config: "/api/app-auth/config"
+    config: "/api/app-auth/config",
+    /** "Continue with Google / Microsoft": the platform signs the person in and returns with a one-time code. */
+    socialSignIn: "/api/app-auth/social"
 };
 /** The platform's chat API: an app's chat route forwards any path beneath it, so a new widget route needs no SDK release. */
 export const PLATFORM_CHAT_PATH = "/api/app-chat/v1/chat";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trylight/app",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "description": "The Light SDK every v2 org app depends on: entities (Drizzle tables with a typed client), sign-in, contracts and in-app chat.",
   "license": "UNLICENSED",
   "type": "module",