@udibo/oauth2 0.12.1 → 0.12.2

package/esm/utils/url.d.ts

@@ -13,7 +13,9 @@ import "../_dnt.polyfills.js";
  * that some browsers resolve as a host, and any value containing a C0 control
  * character or `DEL` — browsers strip TAB/CR/LF before parsing a URL, so
  * `/<TAB>/evil.com` would otherwise navigate to `evil.com`. Anything else
- * collapses to `fallback` (default `/`).
+ * collapses to `fallback` (default `/`), which is returned verbatim. The
+ * fallback is trusted caller configuration; do not pass user-controlled input
+ * there.
  *
  * Percent-encoded control characters (`/%09/x`) are safe and pass through: a
  * browser does not decode them before parsing, so they stay on the origin.
@@ -34,17 +36,17 @@ import "../_dnt.polyfills.js";
  * ```
  */
 export declare function safeReturnTo(value: string | null | undefined, fallback?: string): string;
-/** Options for {@link loginContinuation}. */
+/** Trusted application configuration for {@link loginContinuation}. */
 export interface LoginContinuationOptions {
     /**
-     * The authorization endpoint (absolute URL or path). When `returnTo` points at
-     * it, the flow is **resumed** (the in-flight authorize request already carries
+     * Trusted authorization endpoint (absolute URL or path). When `returnTo` points
+     * at it, the flow is **resumed** (the in-flight authorize request already carries
      * its `state`). Omit it and every `returnTo` starts a fresh login.
      */
     authorizeEndpoint?: string;
-    /** The login path to start a fresh login. Defaults to `"/auth/login"`. */
+    /** Trusted login path for a fresh login. Defaults to `"/auth/login"`. */
     loginPath?: string;
-    /** Fallback when `returnTo` is missing/unsafe. Defaults to `"/"`. */
+    /** Trusted fallback for missing/unsafe `returnTo`. Defaults to `"/"`. */
     defaultReturnTo?: string;
 }
 /**
@@ -61,6 +63,7 @@ export interface LoginContinuationOptions {
  *
  * Pure and client-safe — the same logic behind `HonoBff.loginContinuation`
  * (server) and `BffClient.loginContinuation` (browser). `returnTo` is
- * open-redirect-guarded via {@link safeReturnTo}.
+ * open-redirect-guarded via {@link safeReturnTo}. The fallback, authorization
+ * endpoint and login path are trusted application configuration.
  */
 export declare function loginContinuation(returnTo: string | null | undefined, options?: LoginContinuationOptions): string;

package/esm/utils/url.js

@@ -22,7 +22,9 @@ function hasControlCharacter(value) {
  * that some browsers resolve as a host, and any value containing a C0 control
  * character or `DEL` — browsers strip TAB/CR/LF before parsing a URL, so
  * `/<TAB>/evil.com` would otherwise navigate to `evil.com`. Anything else
- * collapses to `fallback` (default `/`).
+ * collapses to `fallback` (default `/`), which is returned verbatim. The
+ * fallback is trusted caller configuration; do not pass user-controlled input
+ * there.
  *
  * Percent-encoded control characters (`/%09/x`) are safe and pass through: a
  * browser does not decode them before parsing, so they stay on the origin.
@@ -74,7 +76,8 @@ export function safeReturnTo(value, fallback = "/") {
  *
  * Pure and client-safe — the same logic behind `HonoBff.loginContinuation`
  * (server) and `BffClient.loginContinuation` (browser). `returnTo` is
- * open-redirect-guarded via {@link safeReturnTo}.
+ * open-redirect-guarded via {@link safeReturnTo}. The fallback, authorization
+ * endpoint and login path are trusted application configuration.
  */
 export function loginContinuation(returnTo, options = {}) {
     const safe = safeReturnTo(returnTo, options.defaultReturnTo ?? "/");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@udibo/oauth2",
-  "version": "0.12.1",
+  "version": "0.12.2",
   "description": "A flexible OAuth2 toolkit: framework-agnostic authorization & resource servers, a typed client, Hono adapters (including a backend-for-frontend), and React bindings.",
   "repository": {
     "type": "git",