authhero 0.229.0 → 0.231.0

package/dist/authhero.mjs

@@ -22661,11 +22661,7 @@ function wf(t, e = [], n = {}) {
     const r = new URL(t);
     return e.some((i) => {
       try {
-        return a5(
-          r,
-          new URL(i),
-          n.allowPathWildcards
-        );
+        return a5(r, new URL(i), n);
       } catch {
         return !1;
       }
@@ -22674,18 +22670,18 @@ function wf(t, e = [], n = {}) {
     return !1;
   }
 }
-function a5(t, e, n) {
+function a5(t, e, n = {}) {
   if (t.protocol !== e.protocol)
     return !1;
-  if (n && e.pathname.includes("*")) {
+  if (n.allowPathWildcards && e.pathname.includes("*")) {
     const r = e.pathname.replace(/\*/g, ".*").replace(/\//g, "\\/");
     if (!new RegExp(`^${r}$`).test(t.pathname))
       return !1;
   } else if (t.pathname !== e.pathname)
     return !1;
-  if (e.hostname.startsWith("*.") && e.hostname.split(".").length > 2 && ["http:", "https:"].includes(e.protocol)) {
+  if (n.allowSubDomainWildcards && e.hostname.startsWith("*.") && e.hostname.split(".").length > 2 && ["http:", "https:"].includes(e.protocol)) {
     const r = e.hostname.split(".").slice(1).join(".");
-    return t.hostname.endsWith(r);
+    return t.hostname === r || t.hostname.endsWith("." + r);
   }
   return t.hostname === e.hostname;
 }
@@ -22724,7 +22720,7 @@ const c5 = new be().openapi(
         ...r.allowed_logout_urls || [],
         ...(i == null ? void 0 : i.allowed_logout_urls) || []
       ],
-      { allowPathWildcards: !0 }
+      { allowPathWildcards: !0, allowSubDomainWildcards: !0 }
     ))
       throw new E(400, {
         message: "Invalid redirect uri"
@@ -26370,7 +26366,8 @@ const BE = ["email", "sms", "Username-Password-Authentication"], LE = new be().o
     if (K.redirect_uri) {
       const F = M.callbacks || [];
       if (t.var.host && (F.push(`${pl(t.env)}/*`), F.push(`${ft(t.env)}/*`)), !wf(K.redirect_uri, F, {
-        allowPathWildcards: !0
+        allowPathWildcards: !0,
+        allowSubDomainWildcards: !0
       }))
         throw new E(400, {
           message: `Invalid redirect URI - ${K.redirect_uri}`
@@ -26484,7 +26481,8 @@ const BE = ["email", "sms", "Username-Password-Authentication"], LE = new be().o
     if (l.redirect_uri) {
       const A = a.callbacks || [];
       if (t.var.host && (A.push(`${pl(t.env)}/*`), A.push(`${ft(t.env)}/*`)), !wf(l.redirect_uri, A, {
-        allowPathWildcards: !0
+        allowPathWildcards: !0,
+        allowSubDomainWildcards: !0
       }))
         throw new E(400, {
           message: `Invalid redirect URI - ${l.redirect_uri}`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "authhero",
-  "version": "0.229.0",
+  "version": "0.231.0",
   "files": [
     "dist"
   ],