cabloy 5.1.186 → 5.1.187

package/.cabloy-version

@@ -1 +1 @@
-5.1.186
+5.1.187

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 5.1.187
+
+### Improvements
+
+- Enhance redirection handling for trusted external destinations.
+
 ## 5.1.186
 
 ### Improvements

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cabloy",
-  "version": "5.1.186",
+  "version": "5.1.187",
   "gitHead": "2c5c19284bab738e492856189acb6fad74b8a7b7",
   "description": "A Node.js fullstack framework",
   "keywords": [

package/vona/env/.env

@@ -124,3 +124,8 @@ MAIL_SYSTEM_TRANSPORT_SECURE = false
 MAIL_SYSTEM_TRANSPORT_AUTH_USER =
 MAIL_SYSTEM_TRANSPORT_AUTH_PASS =
 MAIL_SYSTEM_DEFAULTS_FROM = no.reply@cabloy.com
+
+# demonstration
+
+DEMONSTRATION_ENABLED = false
+DEMONSTRATION_USERNAME_WHITELIST =

package/vona/packages-cli/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-cli",
-  "version": "1.1.153",
+  "version": "1.1.154",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona cli",
   "keywords": [

package/vona/packages-cli/cli-set-api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-cli-set-api",
-  "version": "1.1.151",
+  "version": "1.1.152",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona cli-set-api",
   "keywords": [

package/vona/packages-vona/vona/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona",
-  "version": "5.1.97",
+  "version": "5.1.98",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "Vona is an intuitive, elegant and powerful Node.js framework for rapidly developing enterprise applications of any size",
   "keywords": [

package/vona/packages-vona/vona-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-core",
-  "version": "5.1.39",
+  "version": "5.1.40",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona",
   "keywords": [

package/vona/packages-vona/vona-core/src/lib/core/context.ts

@@ -1,5 +1,5 @@
 import type { IInstanceRecord } from '../../types/config/instance.ts';
-import type { ContextBase } from '../../types/context/contextBase.ts';
+import type { ContextBase, IContextRedirectOptions } from '../../types/context/contextBase.ts';
 import type { VonaContext } from '../../types/context/index.ts';
 import type { MetadataKey } from './metadata.ts';
 
@@ -121,15 +121,16 @@ export const contextBase: ContextBase = {
     return false;
   },
 
-  redirect(url: string, status?: 301 | 302): void {
+  redirect(url: string, statusOrOptions?: (301 | 302) | IContextRedirectOptions): void {
     const self = cast<VonaContext>(this);
+    const options =
+      typeof statusOrOptions === 'number' ? { status: statusOrOptions } : (statusOrOptions ?? {});
     // checkOrigin
-    if (!url.startsWith('/')) {
+    if (!url.startsWith('/') && !options.trustedExternal) {
       const origin = cast(self.app.bean).security.checkOrigin(url, self.host);
       if (!origin) self.app.throw(403);
     }
     // throw
-    status = status ?? 302;
-    self.app.throw(status, url);
+    self.app.throw(options.status ?? 302, url);
   },
 };

package/vona/packages-vona/vona-core/src/types/context/contextBase.ts

@@ -3,6 +3,11 @@ import type { VonaConfig } from '../config/config.ts';
 import type { IInstanceRecord } from '../config/instance.ts';
 import type { VonaContext } from './index.ts';
 
+export interface IContextRedirectOptions {
+  status?: 301 | 302;
+  trustedExternal?: boolean;
+}
+
 export interface ContextBase {
   get bean(): BeanContainer;
   get locale(): keyof ILocaleRecord;
@@ -26,4 +31,5 @@ export interface ContextBase {
   set onionsDynamic(value: any | undefined);
   get acceptJSON(): boolean;
   redirect(url: string, status?: 301 | 302): void;
+  redirect(url: string, options?: IContextRedirectOptions): void;
 }

package/vona/packages-vona/vona-core/src/types/context/index.ts

@@ -5,6 +5,7 @@ import type { ContextBase } from './contextBase.ts';
 import type { ContextOthers } from './contextOthers.ts';
 import type { ContextState } from './contextState.ts';
 
+export type { IContextRedirectOptions } from './contextBase.ts';
 export * from './contextState.ts';
 
 // @ts-ignore ignore the throw type check of 'throw'/'meta'

package/vona/packages-vona/vona-mock/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-mock",
-  "version": "6.1.39",
+  "version": "6.1.40",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona mock",
   "keywords": [

package/vona/pnpm-lock.yaml

@@ -1595,7 +1595,7 @@ importers:
         specifier: workspace:^
         version: link:modules/a-auth
       vona-module-auth-oauth:
-        specifier: ^5.0.10
+        specifier: ^5.0.12
         version: link:modules/auth-oauth
       vona-module-auth-simple:
         specifier: workspace:^

package/vona/src/suite/a-demo/modules/demo-demonstration/src/bean/guard.demonstration.ts

@@ -42,6 +42,7 @@ export interface IGuardOptionsDemonstration extends IDecoratorGuardOptionsGlobal
     '/auth/passport/callback',
     '/auth/mock/authorize',
     '/captcha/create',
+    '/captcha/refresh',
     '/image/upload-policy',
     '/file/upload-policy',
   ],

package/vona/src/suite-vendor/a-auth/modules/a-auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-auth",
-  "version": "5.1.22",
+  "version": "5.1.23",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-auth/modules/a-auth/src/bean/bean.auth.ts

@@ -86,7 +86,7 @@ export class BeanAuth extends BeanBase {
       strategy.redirect = (location: string) => {
         // real
         if (!clientOptions.mockUsername) {
-          return this.ctx.redirect(location);
+          return this.ctx.redirect(location, { trustedExternal: true });
         }
         // mock
         this.ctx.request.query.code = clientOptions.mockProfileId

package/vona/src/suite-vendor/a-auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-auth",
-  "version": "5.1.26",
+  "version": "5.1.27",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "author": "",

package/vona/src/suite-vendor/a-vona/modules/a-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-core",
-  "version": "5.1.53",
+  "version": "5.1.54",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-vona",
-  "version": "5.1.88",
+  "version": "5.1.89",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "author": "",