@wtfalch/auth 0.8.0 → 0.9.1

package/dist/auth.js

@@ -135,7 +135,12 @@ export function createAuth(input) {
         };
     };
     const callback = async (request) => {
-        const { location, cookies } = await complete(request.url, request.headers.get('cookie'));
+        // Behind a proxy the request can arrive as http:// or on an internal host,
+        // and `validCallback` would refuse it. The browser reached this app, so the
+        // path and query are what it asked for, on the app's own origin.
+        const { pathname, search } = new URL(request.url);
+        const callbackUrl = new URL(`${pathname}${search}`, options().appUrl).href;
+        const { location, cookies } = await complete(callbackUrl, request.headers.get('cookie'));
         return redirect(location, cookies);
     };
     const logout = async (request) => {
@@ -503,7 +508,7 @@ export function createAuth(input) {
         const device = await requestDeviceAuthorization(options(), scopeFor(options().organizationId));
         const cookie = await sealQrTransaction(options(), { dc: device.deviceCode, iv: device.interval }, device.expiresIn);
         return {
-            url: device.verificationUriComplete,
+            url: qrVerificationUrl(options(), device.verificationUriComplete),
             userCode: device.userCode,
             expiresIn: device.expiresIn,
             interval: device.interval,
@@ -694,3 +699,29 @@ function reasonOf(error) {
         return 'denied';
     return 'exchange';
 }
+/**
+ * The issuer always builds `verification_uri_complete` on itself
+ * (`<issuer>/device?user_code=...`). A namespace with its own login host
+ * keeps that namespace's users, sessions and passkeys there, so the phone
+ * must land on the login host instead -- but only by rewriting a URL that is
+ * exactly what the issuer was expected to return; anything else is refused
+ * rather than sent somewhere unexpected.
+ */
+function qrVerificationUrl(options, verificationUriComplete) {
+    const loginOrigin = options.namespace?.loginOrigin;
+    const issuerOrigin = new URL(options.issuer).origin;
+    if (!loginOrigin || loginOrigin === issuerOrigin)
+        return verificationUriComplete;
+    let url;
+    try {
+        url = new URL(verificationUriComplete);
+    }
+    catch {
+        throw new AuthError('request', 'the issuer returned an unusable device verification URL');
+    }
+    if (url.origin !== issuerOrigin || url.pathname !== '/device')
+        throw new AuthError('request', 'the issuer returned an unexpected device verification URL');
+    const rewritten = new URL(`${loginOrigin}/device`);
+    rewritten.search = url.search;
+    return rewritten.href;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/auth",
-  "version": "0.8.0",
+  "version": "0.9.1",
   "description": "Sign in against auth.wtfalch.dev: a server session for a Next.js app, and a browser client with silent single sign-on across subdomains.",
   "repository": {
     "type": "git",