authhero 0.229.0 → 0.230.0

package/dist/authhero.mjs

@@ -22664,7 +22664,7 @@ function wf(t, e = [], n = {}) {
         return a5(
           r,
           new URL(i),
-          n.allowPathWildcards
+          n
         );
       } catch {
         return !1;
@@ -22674,16 +22674,16 @@ function wf(t, e = [], n = {}) {
     return !1;
   }
 }
-function a5(t, e, n) {
+function a5(t, e, n = {}) {
   if (t.protocol !== e.protocol)
     return !1;
-  if (n && e.pathname.includes("*")) {
+  if (n.allowPathWildcards && e.pathname.includes("*")) {
     const r = e.pathname.replace(/\*/g, ".*").replace(/\//g, "\\/");
     if (!new RegExp(`^${r}$`).test(t.pathname))
       return !1;
   } else if (t.pathname !== e.pathname)
     return !1;
-  if (e.hostname.startsWith("*.") && e.hostname.split(".").length > 2 && ["http:", "https:"].includes(e.protocol)) {
+  if (n.enableSubDomainWildcards && e.hostname.startsWith("*.") && e.hostname.split(".").length > 2 && ["http:", "https:"].includes(e.protocol)) {
     const r = e.hostname.split(".").slice(1).join(".");
     return t.hostname.endsWith(r);
   }
@@ -22724,7 +22724,7 @@ const c5 = new be().openapi(
         ...r.allowed_logout_urls || [],
         ...(i == null ? void 0 : i.allowed_logout_urls) || []
       ],
-      { allowPathWildcards: !0 }
+      { allowPathWildcards: !0, enableSubDomainWildcards: !0 }
     ))
       throw new E(400, {
         message: "Invalid redirect uri"
@@ -26370,7 +26370,8 @@ const BE = ["email", "sms", "Username-Password-Authentication"], LE = new be().o
     if (K.redirect_uri) {
       const F = M.callbacks || [];
       if (t.var.host && (F.push(`${pl(t.env)}/*`), F.push(`${ft(t.env)}/*`)), !wf(K.redirect_uri, F, {
-        allowPathWildcards: !0
+        allowPathWildcards: !0,
+        enableSubDomainWildcards: !0
       }))
         throw new E(400, {
           message: `Invalid redirect URI - ${K.redirect_uri}`
@@ -26484,7 +26485,8 @@ const BE = ["email", "sms", "Username-Password-Authentication"], LE = new be().o
     if (l.redirect_uri) {
       const A = a.callbacks || [];
       if (t.var.host && (A.push(`${pl(t.env)}/*`), A.push(`${ft(t.env)}/*`)), !wf(l.redirect_uri, A, {
-        allowPathWildcards: !0
+        allowPathWildcards: !0,
+        enableSubDomainWildcards: !0
       }))
         throw new E(400, {
           message: `Invalid redirect URI - ${l.redirect_uri}`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "authhero",
-  "version": "0.229.0",
+  "version": "0.230.0",
   "files": [
     "dist"
   ],