@tutti-os/auth-bridge 0.0.2 → 0.0.49

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -5,7 +5,7 @@ High-level Tutti auth helpers for browser apps and Node/Electron clients.
 ## Browser
 
 ```ts
-import { createTuttiBrowserAuthClient } from '@tutti-os/auth-bridge/browser';
+import { createTuttiBrowserAuthClient } from "@tutti-os/auth-bridge/browser";
 
 const auth = createTuttiBrowserAuthClient();
 
@@ -17,12 +17,30 @@ await auth.logout();
 ## Node
 
 ```ts
-import { createTuttiNodeAuthClient } from '@tutti-os/auth-bridge/node';
+import { createTuttiNodeAuthClient } from "@tutti-os/auth-bridge/node";
 
 const auth = createTuttiNodeAuthClient({
   authJsonPath,
-  appCallbackUrl,
+  appCallbackUrl
 });
 
 const { session, user } = await auth.login();
 ```
+
+## Local Desktop Callback
+
+The Node bridge starts a loopback HTTP server for desktop sign-in. New desktop OAuth completions use:
+
+- `GET /oauth/callback?state=<base64url>&transfer_code=<code>`
+- `GET /oauth/callback?state=<base64url>&error=<providerError>`
+
+The callback validates the signed login state, redeems the desktop transfer code through the account service, writes `auth.json`, fetches user info, and redirects the browser back to the web result page:
+
+```text
+/auth/login/callback?desktopBridgeStatus=success&openAppUrl=<safe-deeplink>
+/auth/login/callback?desktopBridgeStatus=error&desktopBridgeError=<safeCode>&openAppUrl=<safe-deeplink>
+```
+
+`openAppUrl` is only used to focus or reopen Tutti. It is sanitized to the allowed app schemes and must not carry `transfer_code`, sessions, or tokens.
+
+`/oauth/health` and `POST /oauth/complete` remain available for compatibility with older web clients, but the current web flow redirects the browser to `/oauth/callback` instead of fetching the local bridge.

package/dist/browser.d.ts

@@ -1,4 +1,4 @@
-import { T as TuttiUserInfo } from './shared-Bm-pnst6.js';
+import { a as TuttiUserInfo } from './shared-CPA5wTKA.js';
 
 interface TuttiBrowserAuthClientOptions {
     openUrl?: (url: string) => void;

package/dist/browser.js

@@ -5,7 +5,7 @@ import {
   buildAccountUrl,
   mapUserInfo,
   readEnvelopeError
-} from "./chunk-B7N5AC4Q.js";
+} from "./chunk-M2P3SN64.js";
 
 // src/browser.ts
 function defaultOpenUrl(url) {
@@ -25,22 +25,28 @@ function createTuttiBrowserAuthClient(options = {}) {
   return {
     login(loginOptions = {}) {
       const url = new URL(authLoginUrl);
-      url.searchParams.set("redirect_uri", loginOptions.redirectUri ?? resolveCurrentRedirectUri());
+      url.searchParams.set(
+        "redirect_uri",
+        loginOptions.redirectUri ?? resolveCurrentRedirectUri()
+      );
       if (loginOptions.locale) {
         url.searchParams.set("locale", loginOptions.locale);
       }
       openUrl(url.toString());
     },
     async getUserInfo() {
-      const response = await fetch(buildAccountUrl(accountBaseUrl, "/user/v1/user_info"), {
-        method: "POST",
-        credentials: "include",
-        headers: {
-          Accept: "application/json",
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify({})
-      });
+      const response = await fetch(
+        buildAccountUrl(accountBaseUrl, "/user/v1/user_info"),
+        {
+          method: "POST",
+          credentials: "include",
+          headers: {
+            Accept: "application/json",
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify({})
+        }
+      );
       const payload = await readJsonEnvelope(response);
       if (response.status === 401 || payload?.code === 401) {
         return null;
@@ -51,15 +57,18 @@ function createTuttiBrowserAuthClient(options = {}) {
       return mapUserInfo(payload.data);
     },
     async logout() {
-      const response = await fetch(buildAccountUrl(accountBaseUrl, "/auth/v1/logout-web-session"), {
-        method: "POST",
-        credentials: "include",
-        headers: {
-          Accept: "application/json",
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify({ appId })
-      });
+      const response = await fetch(
+        buildAccountUrl(accountBaseUrl, "/auth/v1/logout-web-session"),
+        {
+          method: "POST",
+          credentials: "include",
+          headers: {
+            Accept: "application/json",
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify({ appId })
+        }
+      );
       const payload = await readJsonEnvelope(response);
       if (!response.ok || (payload?.code ?? 0) !== 0) {
         throw readEnvelopeError(response, payload);

package/dist/{chunk-B7N5AC4Q.js → chunk-M2P3SN64.js}

@@ -20,7 +20,9 @@ function buildAccountUrl(accountBaseUrl, path) {
   return `${normalizeBaseUrl(accountBaseUrl)}/${path.replace(/^\/+/u, "")}`;
 }
 function readEnvelopeError(response, payload) {
-  return new Error(payload?.errmsg ?? payload?.message ?? `Request failed with status ${response.status}`);
+  return new Error(
+    payload?.errmsg ?? payload?.message ?? `Request failed with status ${response.status}`
+  );
 }
 function mapUserInfo(data) {
   if (!data) {

package/dist/node.d.ts

@@ -1,4 +1,4 @@
-import { a as TuttiAuthSession, T as TuttiUserInfo } from './shared-Bm-pnst6.js';
+import { T as TuttiAuthSession, a as TuttiUserInfo } from './shared-CPA5wTKA.js';
 
 interface TuttiNodeAuthClientOptions {
     authJsonPath: string;

package/dist/node.js

@@ -12,13 +12,15 @@ import {
   mapUserInfo,
   readEnvelopeError,
   trimString
-} from "./chunk-B7N5AC4Q.js";
+} from "./chunk-M2P3SN64.js";
 
 // src/node.ts
 import { spawn } from "child_process";
 import { randomUUID } from "crypto";
 import { mkdir, readFile, rename, rm, writeFile } from "fs/promises";
-import { createServer } from "http";
+import {
+  createServer
+} from "http";
 import { createServer as createNetServer } from "net";
 import { hostname } from "os";
 import { dirname } from "path";
@@ -36,8 +38,14 @@ function createTuttiNodeAuthClient(options) {
   const accountBaseUrl = options.accountBaseUrl?.trim() || DEFAULT_ACCOUNT_BASE_URL;
   const authLoginUrl = options.authLoginUrl?.trim() || DEFAULT_AUTH_LOGIN_URL;
   const openUrl = options.openUrl ?? openUrlWithDefaultBrowser;
-  const idleTimeoutMs = positiveMs(options.loginIdleTimeoutMs, DEFAULT_LOGIN_IDLE_TIMEOUT_MS);
-  const maxTimeoutMs = Math.max(idleTimeoutMs, positiveMs(options.loginMaxTimeoutMs, DEFAULT_LOGIN_MAX_TIMEOUT_MS));
+  const idleTimeoutMs = positiveMs(
+    options.loginIdleTimeoutMs,
+    DEFAULT_LOGIN_IDLE_TIMEOUT_MS
+  );
+  const maxTimeoutMs = Math.max(
+    idleTimeoutMs,
+    positiveMs(options.loginMaxTimeoutMs, DEFAULT_LOGIN_MAX_TIMEOUT_MS)
+  );
   async function readSession() {
     return await readAuthJson(authJsonPath);
   }
@@ -81,6 +89,7 @@ function createTuttiNodeAuthClient(options) {
         accountBaseUrl,
         appId,
         appCallbackUrl,
+        authJsonPath,
         attemptId,
         authOrigin: new URL(authLoginUrl).origin,
         bridgeToken,
@@ -99,14 +108,10 @@ function createTuttiNodeAuthClient(options) {
       try {
         await openUrl(loginUrl);
         const transferCode = await completion;
-        const sessionId = await redeemDesktopTransferCode(pending, transferCode);
-        const user = await fetchUserInfo(accountBaseUrl, buildSessionCookie(sessionId));
-        if (!user) {
-          throw new Error("Failed to load user info after login");
+        if (pending.completedResult) {
+          return pending.completedResult;
         }
-        const session = sessionFromUser(sessionId, user);
-        await writeAuthJson(authJsonPath, session);
-        return { session, user };
+        return await completePendingLogin(pending, transferCode);
       } finally {
         await closeServer(bridge.server);
       }
@@ -156,7 +161,10 @@ async function writeAuthJson(authJsonPath, session) {
   };
   const tempPath = `${authJsonPath}.tmp-${process.pid}-${Date.now()}-${randomUUID()}`;
   try {
-    await writeFile(tempPath, JSON.stringify(payload, null, 2), { encoding: "utf8", mode: 384 });
+    await writeFile(tempPath, JSON.stringify(payload, null, 2), {
+      encoding: "utf8",
+      mode: 384
+    });
     await rename(tempPath, authJsonPath);
   } catch (error) {
     await rm(tempPath, { force: true }).catch(() => void 0);
@@ -168,7 +176,9 @@ function encodeBridgeState(state) {
 }
 function decodeBridgeState(rawState) {
   try {
-    const parsed = JSON.parse(Buffer.from(rawState, "base64url").toString("utf8"));
+    const parsed = JSON.parse(
+      Buffer.from(rawState, "base64url").toString("utf8")
+    );
     if (parsed.v !== 1 || parsed.flow !== "desktop_bridge" || !trimString(parsed.attemptId) || !trimString(parsed.localServerOrigin) || !trimString(parsed.bridgeToken)) {
       return null;
     }
@@ -218,16 +228,82 @@ async function createLoginBridgeServer(input, port) {
     if (req.method === "GET" && url.pathname === "/oauth/health") {
       const matched = !input.completed && Date.now() <= input.expiresAt && Date.now() <= input.maxExpiresAt && url.searchParams.get("attempt_id") === input.attemptId && url.searchParams.get("token") === input.bridgeToken;
       if (!matched) {
-        sendJson(res, 401, { ok: false, error: { code: "INVALID_BRIDGE_ATTEMPT", message: "Desktop login attempt is unavailable." } });
+        sendJson(res, 401, {
+          ok: false,
+          error: {
+            code: "INVALID_BRIDGE_ATTEMPT",
+            message: "Desktop login attempt is unavailable."
+          }
+        });
         return;
       }
-      input.expiresAt = Math.min(input.maxExpiresAt, Date.now() + input.idleTimeoutMs);
-      sendJson(res, 200, { ok: true, data: { attemptId: input.attemptId, status: "ready", expiresAt: input.expiresAt } });
+      input.expiresAt = Math.min(
+        input.maxExpiresAt,
+        Date.now() + input.idleTimeoutMs
+      );
+      sendJson(res, 200, {
+        ok: true,
+        data: {
+          attemptId: input.attemptId,
+          status: "ready",
+          expiresAt: input.expiresAt
+        }
+      });
+      return;
+    }
+    if (req.method === "GET" && url.pathname === "/oauth/callback") {
+      if (!isAllowedLoopbackHost(req, port)) {
+        res.writeHead(403);
+        res.end();
+        return;
+      }
+      const callbackError = trimString(url.searchParams.get("error"));
+      const callbackState = trimString(url.searchParams.get("state"));
+      const transferCode = trimString(url.searchParams.get("transfer_code"));
+      if (!stateMatches(input, callbackState)) {
+        const error = new Error("Invalid state");
+        complete(() => rejectCompletion(error));
+        sendRedirect(res, buildBridgeResultUrl(input, "error", "invalidState"));
+        return;
+      }
+      if (callbackError) {
+        const error = new Error(callbackError);
+        complete(() => rejectCompletion(error));
+        sendRedirect(
+          res,
+          buildBridgeResultUrl(input, "error", "providerError")
+        );
+        return;
+      }
+      if (!transferCode) {
+        const error = new Error("Missing transfer_code");
+        complete(() => rejectCompletion(error));
+        sendRedirect(
+          res,
+          buildBridgeResultUrl(input, "error", "missingTransferCode")
+        );
+        return;
+      }
+      try {
+        input.completedResult = await completePendingLogin(input, transferCode);
+        input.completed = true;
+        complete(() => resolveCompletion(transferCode));
+        sendRedirect(res, buildBridgeResultUrl(input, "success"));
+      } catch (error) {
+        complete(() => rejectCompletion(error));
+        sendRedirect(res, buildBridgeResultUrl(input, "error", "redeemFailed"));
+      }
       return;
     }
     if (req.method === "POST" && url.pathname === "/oauth/complete") {
       if (!isAllowedBridgeOrigin(req, input) || !isAllowedLoopbackHost(req, port)) {
-        sendJson(res, 403, { ok: false, error: { code: "FORBIDDEN_BRIDGE_ORIGIN", message: "Bridge origin is not allowed." } });
+        sendJson(res, 403, {
+          ok: false,
+          error: {
+            code: "FORBIDDEN_BRIDGE_ORIGIN",
+            message: "Bridge origin is not allowed."
+          }
+        });
         return;
       }
       const payload = await readJsonBody(req).catch(() => ({}));
@@ -236,19 +312,28 @@ async function createLoginBridgeServer(input, port) {
       const transferCode = trimString(payload.transfer_code) || trimString(payload.transferCode);
       if (!stateMatches(input, callbackState)) {
         const error = new Error("Invalid state");
-        sendJson(res, 400, { ok: false, error: { code: "INVALID_STATE", message: error.message } });
+        sendJson(res, 400, {
+          ok: false,
+          error: { code: "INVALID_STATE", message: error.message }
+        });
         complete(() => rejectCompletion(error));
         return;
       }
       if (callbackError) {
         const error = new Error(callbackError);
-        sendJson(res, 400, { ok: false, error: { code: "PROVIDER_CALLBACK_ERROR", message: error.message } });
+        sendJson(res, 400, {
+          ok: false,
+          error: { code: "PROVIDER_CALLBACK_ERROR", message: error.message }
+        });
         complete(() => rejectCompletion(error));
         return;
       }
       if (!transferCode) {
         const error = new Error("Missing transfer_code");
-        sendJson(res, 400, { ok: false, error: { code: "MISSING_TRANSFER_CODE", message: error.message } });
+        sendJson(res, 400, {
+          ok: false,
+          error: { code: "MISSING_TRANSFER_CODE", message: error.message }
+        });
         complete(() => rejectCompletion(error));
         return;
       }
@@ -257,7 +342,10 @@ async function createLoginBridgeServer(input, port) {
       complete(() => resolveCompletion(transferCode));
       return;
     }
-    sendJson(res, 404, { ok: false, error: { code: "NOT_FOUND", message: "Not found" } });
+    sendJson(res, 404, {
+      ok: false,
+      error: { code: "NOT_FOUND", message: "Not found" }
+    });
   });
   await new Promise((resolve, reject) => {
     server.once("error", reject);
@@ -265,6 +353,19 @@ async function createLoginBridgeServer(input, port) {
   });
   return { server, waitForCompletion: waitForCompletion2 };
 }
+async function completePendingLogin(input, transferCode) {
+  const sessionId = await redeemDesktopTransferCode(input, transferCode);
+  const user = await fetchUserInfo(
+    input.accountBaseUrl,
+    buildSessionCookie(sessionId)
+  );
+  if (!user) {
+    throw new Error("Failed to load user info after login");
+  }
+  const session = sessionFromUser(sessionId, user);
+  await writeAuthJson(input.authJsonPath, session);
+  return { session, user };
+}
 async function waitForCompletion(input, completion) {
   while (true) {
     const remainingMs = Math.min(input.expiresAt, input.maxExpiresAt) - Date.now();
@@ -281,15 +382,18 @@ async function waitForCompletion(input, completion) {
   }
 }
 async function fetchUserInfo(accountBaseUrl, cookie) {
-  const response = await fetch(buildAccountUrl(accountBaseUrl, "/user/v1/user_info"), {
-    method: "POST",
-    headers: {
-      Accept: "application/json",
-      "Content-Type": "application/json",
-      Cookie: cookie
-    },
-    body: JSON.stringify({})
-  });
+  const response = await fetch(
+    buildAccountUrl(accountBaseUrl, "/user/v1/user_info"),
+    {
+      method: "POST",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/json",
+        Cookie: cookie
+      },
+      body: JSON.stringify({})
+    }
+  );
   const payload = await response.json().catch(() => null);
   if (response.status === 401 || payload?.code === 401) {
     return null;
@@ -300,20 +404,26 @@ async function fetchUserInfo(accountBaseUrl, cookie) {
   return mapUserInfo(payload.data);
 }
 async function redeemDesktopTransferCode(input, transferCode) {
-  const response = await fetch(buildAccountUrl(input.accountBaseUrl, "/auth/v1/redeem_desktop_transfer_code"), {
-    method: "POST",
-    headers: {
-      Accept: "application/json",
-      "Content-Type": "application/json"
-    },
-    body: JSON.stringify({
-      transfer_code: transferCode,
-      attempt_id: input.attemptId,
-      bridge_token: input.bridgeToken,
-      app_id: input.appId,
-      device_id: input.deviceId
-    })
-  });
+  const response = await fetch(
+    buildAccountUrl(
+      input.accountBaseUrl,
+      "/auth/v1/redeem_desktop_transfer_code"
+    ),
+    {
+      method: "POST",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        transfer_code: transferCode,
+        attempt_id: input.attemptId,
+        bridge_token: input.bridgeToken,
+        app_id: input.appId,
+        device_id: input.deviceId
+      })
+    }
+  );
   const payload = await response.json().catch(() => null);
   const sessionId = trimString(payload?.data?.sessionId) || trimString(payload?.data?.session_id);
   if (!response.ok || payload?.code !== 0 || !sessionId) {
@@ -322,15 +432,18 @@ async function redeemDesktopTransferCode(input, transferCode) {
   return sessionId;
 }
 async function logoutSession(accountBaseUrl, appId, cookie) {
-  const response = await fetch(buildAccountUrl(accountBaseUrl, "/auth/v1/logout-web-session"), {
-    method: "POST",
-    headers: {
-      Accept: "application/json",
-      "Content-Type": "application/json",
-      Cookie: cookie
-    },
-    body: JSON.stringify({ appId })
-  });
+  const response = await fetch(
+    buildAccountUrl(accountBaseUrl, "/auth/v1/logout-web-session"),
+    {
+      method: "POST",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/json",
+        Cookie: cookie
+      },
+      body: JSON.stringify({ appId })
+    }
+  );
   const payload = await response.json().catch(() => null);
   if (!response.ok || (payload?.code ?? 0) !== 0) {
     throw readEnvelopeError(response, payload);
@@ -395,17 +508,66 @@ function isAllowedLoopbackHost(req, port) {
 function sendJson(res, status, payload) {
   res.writeHead(status, {
     "Access-Control-Allow-Origin": "*",
+    "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type",
+    "Access-Control-Allow-Private-Network": "true",
     "Content-Type": "application/json; charset=utf-8"
   });
   res.end(JSON.stringify(payload));
 }
+function sendRedirect(res, location) {
+  res.writeHead(302, { Location: location });
+  res.end();
+}
+function buildBridgeResultUrl(input, status, safeErrorCode) {
+  const url = new URL("/auth/login/callback", input.authOrigin);
+  url.searchParams.set("desktopBridgeStatus", status);
+  if (safeErrorCode) {
+    url.searchParams.set("desktopBridgeError", safeErrorCode);
+  }
+  const openAppUrl = buildSafeOpenAppUrl(
+    input.appCallbackUrl,
+    status,
+    safeErrorCode
+  );
+  if (openAppUrl) {
+    url.searchParams.set("openAppUrl", openAppUrl);
+  }
+  return url.toString();
+}
+function buildSafeOpenAppUrl(rawUrl, status, safeErrorCode) {
+  try {
+    const url = new URL(rawUrl.trim());
+    if (!isAllowedAppCallbackProtocol(url.protocol)) {
+      return null;
+    }
+    url.search = "";
+    url.hash = "";
+    url.searchParams.set("desktopBridgeStatus", status);
+    if (safeErrorCode) {
+      url.searchParams.set("desktopBridgeError", safeErrorCode);
+    }
+    return url.toString();
+  } catch {
+    return null;
+  }
+}
+function isAllowedAppCallbackProtocol(protocol) {
+  const legacyProtocol = `${DEFAULT_APP_ID}:`;
+  const legacyDevProtocol = `${DEFAULT_APP_ID}-dev:`;
+  return protocol === "tutti:" || protocol === "tutti-dev:" || protocol === legacyProtocol || protocol === legacyDevProtocol;
+}
 function closeServer(server) {
   return new Promise((resolve) => server.close(() => resolve()));
 }
 function openUrlWithDefaultBrowser(url) {
   const command = process.platform === "darwin" ? { file: "open", args: [url] } : process.platform === "win32" ? { file: "cmd", args: ["/c", "start", "", url] } : { file: "xdg-open", args: [url] };
   return new Promise((resolve, reject) => {
-    const child = spawn(command.file, command.args, { detached: true, stdio: "ignore", windowsHide: true });
+    const child = spawn(command.file, command.args, {
+      detached: true,
+      stdio: "ignore",
+      windowsHide: true
+    });
     child.once("error", reject);
     child.once("spawn", () => {
       child.unref();

package/dist/{shared-Bm-pnst6.d.ts → shared-CPA5wTKA.d.ts}

@@ -14,4 +14,4 @@ interface TuttiAuthSession {
     updatedAt: number;
 }
 
-export type { TuttiUserInfo as T, TuttiAuthSession as a };
+export type { TuttiAuthSession as T, TuttiUserInfo as a };

package/package.json

@@ -1,7 +1,12 @@
 {
   "name": "@tutti-os/auth-bridge",
-  "version": "0.0.2",
+  "version": "0.0.49",
   "private": false,
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/tutti-os/tutti.git",
+    "directory": "packages/auth/bridge"
+  },
   "type": "module",
   "types": "./dist/browser.d.ts",
   "exports": {