@wtfalch/auth 0.1.1 → 0.2.1

package/dist/auth.d.ts

@@ -37,9 +37,9 @@ export type Gate = {
     cookies: SetCookie[];
 };
 export type Intent = 'login' | 'register';
-export type SignInError = 'invalid_credentials' | 'request' | 'unavailable';
+export type SignInError = 'invalid_credentials' | 'too_many' | 'request' | 'unavailable';
 export type ResetError = 'invalid_code' | 'invalid_password' | 'unavailable';
-export type SignUpError = 'email_taken' | 'invalid' | 'request' | 'unavailable';
+export type SignUpError = 'registration_closed' | 'email_taken' | 'username_taken' | 'username_invalid' | 'invalid' | 'request' | 'unavailable';
 export type SignInResult = {
     ok: true;
     redirectTo: string;

package/dist/auth.js

@@ -265,6 +265,16 @@ export function createAuth(input) {
             if (error instanceof BrokerError && error.error === 'email_taken') {
                 return { ok: false, error: 'email_taken', message: error.detail ?? error.error };
             }
+            if (error instanceof BrokerError && error.error === 'registration_closed') {
+                return { ok: false, error: 'registration_closed', message: error.detail ?? error.error };
+            }
+            // Both carry a sentence about the name, for the form to show as it is.
+            if (error instanceof BrokerError && error.error === 'username_taken') {
+                return { ok: false, error: 'username_taken', message: error.detail ?? error.error };
+            }
+            if (error instanceof BrokerError && error.error === 'username_invalid') {
+                return { ok: false, error: 'username_invalid', message: error.detail ?? error.error };
+            }
             if (error instanceof BrokerError && error.error === 'request') {
                 return { ok: false, error: 'request', message: error.detail ?? error.error };
             }
@@ -390,6 +400,9 @@ function signInError(error) {
     // A key the service will not take is the app's problem, not the visitor's.
     if (error instanceof BrokerError && error.error === 'unauthorized')
         return 'unavailable';
+    // The sign-in service's brute-force backstop tripped; ask them to wait.
+    if (error instanceof BrokerError && error.error === 'too_many')
+        return 'too_many';
     if (error instanceof BrokerError && error.status < 500)
         return 'invalid_credentials';
     return 'unavailable';

package/dist/broker.d.ts

@@ -9,6 +9,12 @@ export interface NewUser {
     password: string;
     givenName: string;
     familyName: string;
+    /**
+     * A login name they chose, where the app asks for one. Three to thirty of
+     * letters, digits, `.`, `_` and `-`; the service refuses reserved names
+     * and words it will not have. Without it the email is the login name.
+     */
+    username?: string;
 }
 export declare class BrokerError extends Error {
     readonly status: number;

package/dist/redirect.js

@@ -12,5 +12,12 @@ export function safeNextPath(next, fallback) {
     }
     if (url.origin !== 'https://app.invalid')
         return fallback;
-    return `${url.pathname}${url.search}`;
+    const path = `${url.pathname}${url.search}`;
+    // The URL parser can normalise an input like "/..//evil" into a
+    // protocol-relative "//evil", which a caller resolving it against an origin
+    // would send to another host. Guard the OUTPUT, not just the input.
+    if (!path.startsWith('/') || path.startsWith('//') || path.startsWith('/\\')) {
+        return fallback;
+    }
+    return path;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/auth",
-  "version": "0.1.1",
+  "version": "0.2.1",
   "description": "Sign in against auth.wtfalch.dev from a Next.js app.",
   "repository": {
     "type": "git",
@@ -8,7 +8,9 @@
     "directory": "packages/auth"
   },
   "type": "module",
-  "files": ["dist"],
+  "files": [
+    "dist"
+  ],
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -23,12 +25,6 @@
   "engines": {
     "node": ">=22.0.0"
   },
-  "scripts": {
-    "build": "rm -rf dist && tsc -p tsconfig.build.json",
-    "prepack": "pnpm build",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest run"
-  },
   "dependencies": {
     "jose": "^6.2.10",
     "openid-client": "6.8.7"
@@ -44,11 +40,16 @@
   "devDependencies": {
     "@types/node": "^22",
     "@types/react": "^19",
-    "@wtfalch/auth-broker": "workspace:*",
     "next": "^16",
     "playwright-core": "^1.62.1",
     "react": "^19",
     "typescript": "^5.9.0",
-    "vitest": "^4.1.6"
+    "vitest": "^4.1.6",
+    "@wtfalch/auth-broker": "0.1.0"
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
   }
-}
+}