cauthy-auth 0.23.0 → 0.24.1

package/dist/react.mjs

@@ -79,6 +79,13 @@ function ceremonyError(e) {
   return { code: "passkey_failed", message: "The passkey could not be used. Try again, or sign in another way." };
 }
 
+// src/url.ts
+function withoutTrailingSlashes(s) {
+  let end = s.length;
+  while (end > 0 && s.charCodeAt(end - 1) === 47) end--;
+  return s.slice(0, end);
+}
+
 // src/theme.ts
 function themeVariables(theme) {
   const vars = {};
@@ -197,7 +204,7 @@ function loadGoogleIdentity() {
 var PASSKEY_SECONDS = 300;
 var UNAVAILABLE = { code: "unavailable", message: "Sign-in is unavailable right now. Try again in a moment." };
 function createAuthClient(options = {}) {
-  const base = (options.basePath ?? "/api/auth").replace(/\/+$/, "");
+  const base = withoutTrailingSlashes(options.basePath ?? "/api/auth");
   const doFetch = (...args) => (options.fetch ?? fetch)(...args);
   const locale = () => {
     const said = typeof options.locale === "function" ? options.locale() : options.locale;
@@ -941,6 +948,16 @@ function useMethods(auth) {
 function sitePath(to) {
   return to && to.startsWith("/") && !to.startsWith("//") && !to.includes("\\") ? to : void 0;
 }
+function sameOrigin(to) {
+  const path = sitePath(to);
+  if (path || !to) return path;
+  try {
+    const url = new URL(to);
+    return url.origin === window.location.origin ? url.pathname + url.search + url.hash : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function useForm(props) {
   const t = { ...TEXTS[props.locale ?? "en"], ...props.texts, errors: { ...TEXTS[props.locale ?? "en"].errors, ...props.texts?.errors } };
   const cx = (slot) => props.classNames?.[slot] ?? `cauthy-${slot}`;
@@ -951,7 +968,7 @@ function useForm(props) {
   const say = (e) => t.errors[e.code] ?? e.message;
   const done = (to) => {
     if (props.onSuccess) props.onSuccess();
-    else window.location.assign(sitePath(to) ?? props.returnTo ?? "/");
+    else window.location.assign(sitePath(to) ?? sameOrigin(props.returnTo) ?? "/");
   };
   const root = useRoot(props);
   return { t, cx, Button, Input, error, setError, busy, setBusy, say, done, root };
@@ -1213,7 +1230,10 @@ function GoogleOneTap(props) {
     void auth.signIn.googleOneTap({ signal: ctl.signal, context: props.context }).then((r) => {
       if (!r.ok || ctl.signal.aborted) return;
       if (props.onSuccess) props.onSuccess();
-      else if (props.returnTo) window.location.assign(props.returnTo);
+      else {
+        const to = sameOrigin(props.returnTo);
+        if (to) window.location.assign(to);
+      }
     });
     return () => ctl.abort();
   }, [unauthenticated]);
@@ -1862,7 +1882,7 @@ import { jsx as jsx2 } from "react/jsx-runtime";
 var Ctx = createContext(null);
 var AHEAD_MS = 6e4;
 function CauthyProvider({ children, basePath = "/api/auth", initialSession }) {
-  const base = basePath.replace(/\/+$/, "");
+  const base = withoutTrailingSlashes(basePath);
   const [session, setSession] = useState2(initialSession ?? null);
   const [status, setStatus] = useState2(
     initialSession === void 0 ? "loading" : initialSession === null ? "unauthenticated" : "authenticated"