cauthy-auth 0.28.0 → 0.28.1

package/README.md

@@ -12,7 +12,7 @@ npm install cauthy-auth
 ```
 
 ```ts
-// auth.ts — reads CAUTHY_ISSUER, CAUTHY_CLIENT_ID, CAUTHY_SECRET (and CAUTHY_SYSTEM)
+// auth.ts — reads CAUTHY_ISSUER, CAUTHY_CLIENT_ID, CAUTHY_SECRET (and CAUTHY_SYSTEM, CAUTHY_BASE_URL)
 import { createCauthy } from 'cauthy-auth'
 export const auth = createCauthy()
 ```

package/dist/{cauthy-DGAy45G2.d.ts → cauthy-BAwAJChs.d.ts}

@@ -1,4 +1,4 @@
-import { J as JsonValue, S as Session, l as SessionStatus, k as SessionOrganization, c as CauthySystem, i as PublicSession, b as CauthyOptions } from './system-DTIeDXDP.js';
+import { J as JsonValue, S as Session, l as SessionStatus, k as SessionOrganization, c as CauthySystem, i as PublicSession, b as CauthyOptions } from './system-Bn8uckvQ.js';
 import { JWTVerifyGetKey } from 'jose';
 
 /** Something that happened in Cauthy, as a subscriber is told. Moments are UTC. */

package/dist/{cauthy-XkIbG5gE.d.mts → cauthy-CTVg4kvo.d.mts}

@@ -1,4 +1,4 @@
-import { J as JsonValue, S as Session, l as SessionStatus, k as SessionOrganization, c as CauthySystem, i as PublicSession, b as CauthyOptions } from './system-BxMsSIu1.mjs';
+import { J as JsonValue, S as Session, l as SessionStatus, k as SessionOrganization, c as CauthySystem, i as PublicSession, b as CauthyOptions } from './system-CVBW_AV8.mjs';
 import { JWTVerifyGetKey } from 'jose';
 
 /** Something that happened in Cauthy, as a subscriber is told. Moments are UTC. */

package/dist/client.d.mts

@@ -1,5 +1,5 @@
 import { CauthyTheme } from './theme.mjs';
-import { i as PublicSession } from './system-BxMsSIu1.mjs';
+import { i as PublicSession } from './system-CVBW_AV8.mjs';
 import { A as AuthField, b as PasswordPolicy } from './validate-sEXG82po.mjs';
 export { D as DEFAULT_PASSWORD_POLICY, F as FieldProblem, M as MIN_PASSWORD, P as PasswordClass, a as PasswordLocale, c as PasswordReason, d as checkCode, e as checkEmail, f as checkName, g as checkNewPassword, h as checkPassword, i as describePasswordPolicy, j as explainPasswordProblems, p as passwordPolicyOf, k as passwordProblems } from './validate-sEXG82po.mjs';
 import 'jose';

package/dist/client.d.ts

@@ -1,5 +1,5 @@
 import { CauthyTheme } from './theme.js';
-import { i as PublicSession } from './system-DTIeDXDP.js';
+import { i as PublicSession } from './system-Bn8uckvQ.js';
 import { A as AuthField, b as PasswordPolicy } from './validate-sEXG82po.js';
 export { D as DEFAULT_PASSWORD_POLICY, F as FieldProblem, M as MIN_PASSWORD, P as PasswordClass, a as PasswordLocale, c as PasswordReason, d as checkCode, e as checkEmail, f as checkName, g as checkNewPassword, h as checkPassword, i as describePasswordPolicy, j as explainPasswordProblems, p as passwordPolicyOf, k as passwordProblems } from './validate-sEXG82po.js';
 import 'jose';

package/dist/express.d.mts

@@ -1,6 +1,6 @@
 import { IncomingMessage, ServerResponse } from 'node:http';
-import { C as Cauthy } from './cauthy-XkIbG5gE.mjs';
-import { S as Session } from './system-BxMsSIu1.mjs';
+import { C as Cauthy } from './cauthy-CTVg4kvo.mjs';
+import { S as Session } from './system-CVBW_AV8.mjs';
 import 'jose';
 import './theme.mjs';
 

package/dist/express.d.ts

@@ -1,6 +1,6 @@
 import { IncomingMessage, ServerResponse } from 'node:http';
-import { C as Cauthy } from './cauthy-DGAy45G2.js';
-import { S as Session } from './system-DTIeDXDP.js';
+import { C as Cauthy } from './cauthy-BAwAJChs.js';
+import { S as Session } from './system-Bn8uckvQ.js';
 import 'jose';
 import './theme.js';
 

package/dist/fastify.d.mts

@@ -1,6 +1,6 @@
 import { FastifyReply, FastifyPluginAsync } from 'fastify';
-import { C as Cauthy } from './cauthy-XkIbG5gE.mjs';
-import { S as Session } from './system-BxMsSIu1.mjs';
+import { C as Cauthy } from './cauthy-CTVg4kvo.mjs';
+import { S as Session } from './system-CVBW_AV8.mjs';
 import 'jose';
 import './theme.mjs';
 

package/dist/fastify.d.ts

@@ -1,6 +1,6 @@
 import { FastifyReply, FastifyPluginAsync } from 'fastify';
-import { C as Cauthy } from './cauthy-DGAy45G2.js';
-import { S as Session } from './system-DTIeDXDP.js';
+import { C as Cauthy } from './cauthy-BAwAJChs.js';
+import { S as Session } from './system-Bn8uckvQ.js';
 import 'jose';
 import './theme.js';
 

package/dist/hono.d.mts

@@ -1,6 +1,6 @@
 import { MiddlewareHandler } from 'hono';
-import { C as Cauthy } from './cauthy-XkIbG5gE.mjs';
-import { S as Session } from './system-BxMsSIu1.mjs';
+import { C as Cauthy } from './cauthy-CTVg4kvo.mjs';
+import { S as Session } from './system-CVBW_AV8.mjs';
 import 'jose';
 import './theme.mjs';
 

package/dist/hono.d.ts

@@ -1,6 +1,6 @@
 import { MiddlewareHandler } from 'hono';
-import { C as Cauthy } from './cauthy-DGAy45G2.js';
-import { S as Session } from './system-DTIeDXDP.js';
+import { C as Cauthy } from './cauthy-BAwAJChs.js';
+import { S as Session } from './system-Bn8uckvQ.js';
 import 'jose';
 import './theme.js';
 

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-export { C as Cauthy, a as CauthyEvent, b as CauthyWebhookError, R as Resolved, V as VerifyWebhookOptions, c as createCauthy, v as verifyWebhook } from './cauthy-XkIbG5gE.mjs';
-export { C as CauthyApiError, a as CauthyConfigError, b as CauthyOptions, c as CauthySystem, J as JsonValue, N as NewMember, O as Organization, d as OrganizationMember, P as PermissionOf, e as Permitted, f as Policy, g as PolicyPermission, h as PolicyRole, i as PublicSession, j as PushPolicyOptions, R as RoleOf, S as Session, k as SessionOrganization, l as SessionStatus, m as SessionUser, n as SystemKey, o as SystemOptions, p as can, q as createSystem, r as definePolicy, s as policySource, t as pullPolicy, u as pushPolicy } from './system-BxMsSIu1.mjs';
+export { C as Cauthy, a as CauthyEvent, b as CauthyWebhookError, R as Resolved, V as VerifyWebhookOptions, c as createCauthy, v as verifyWebhook } from './cauthy-CTVg4kvo.mjs';
+export { C as CauthyApiError, a as CauthyConfigError, b as CauthyOptions, c as CauthySystem, J as JsonValue, N as NewMember, O as Organization, d as OrganizationMember, P as PermissionOf, e as Permitted, f as Policy, g as PolicyPermission, h as PolicyRole, i as PublicSession, j as PushPolicyOptions, R as RoleOf, S as Session, k as SessionOrganization, l as SessionStatus, m as SessionUser, n as SystemKey, o as SystemOptions, p as can, q as createSystem, r as definePolicy, s as policySource, t as pullPolicy, u as pushPolicy } from './system-CVBW_AV8.mjs';
 export { CauthyTheme, ImportedTheme, PushThemeOptions, StackmythThemeOptions, StackmythTokens, ThemeFont, ThemeTexts, pushTheme, themeFromStackmyth, tokensFromStackmyth } from './theme.mjs';
 export { A as AuthField, D as DEFAULT_PASSWORD_POLICY, F as FieldProblem, M as MIN_PASSWORD, P as PasswordClass, a as PasswordLocale, b as PasswordPolicy, c as PasswordReason, d as checkCode, e as checkEmail, f as checkName, g as checkNewPassword, h as checkPassword, i as describePasswordPolicy, j as explainPasswordProblems, p as passwordPolicyOf, k as passwordProblems } from './validate-sEXG82po.mjs';
 import { JWTVerifyGetKey } from 'jose';

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-export { C as Cauthy, a as CauthyEvent, b as CauthyWebhookError, R as Resolved, V as VerifyWebhookOptions, c as createCauthy, v as verifyWebhook } from './cauthy-DGAy45G2.js';
-export { C as CauthyApiError, a as CauthyConfigError, b as CauthyOptions, c as CauthySystem, J as JsonValue, N as NewMember, O as Organization, d as OrganizationMember, P as PermissionOf, e as Permitted, f as Policy, g as PolicyPermission, h as PolicyRole, i as PublicSession, j as PushPolicyOptions, R as RoleOf, S as Session, k as SessionOrganization, l as SessionStatus, m as SessionUser, n as SystemKey, o as SystemOptions, p as can, q as createSystem, r as definePolicy, s as policySource, t as pullPolicy, u as pushPolicy } from './system-DTIeDXDP.js';
+export { C as Cauthy, a as CauthyEvent, b as CauthyWebhookError, R as Resolved, V as VerifyWebhookOptions, c as createCauthy, v as verifyWebhook } from './cauthy-BAwAJChs.js';
+export { C as CauthyApiError, a as CauthyConfigError, b as CauthyOptions, c as CauthySystem, J as JsonValue, N as NewMember, O as Organization, d as OrganizationMember, P as PermissionOf, e as Permitted, f as Policy, g as PolicyPermission, h as PolicyRole, i as PublicSession, j as PushPolicyOptions, R as RoleOf, S as Session, k as SessionOrganization, l as SessionStatus, m as SessionUser, n as SystemKey, o as SystemOptions, p as can, q as createSystem, r as definePolicy, s as policySource, t as pullPolicy, u as pushPolicy } from './system-Bn8uckvQ.js';
 export { CauthyTheme, ImportedTheme, PushThemeOptions, StackmythThemeOptions, StackmythTokens, ThemeFont, ThemeTexts, pushTheme, themeFromStackmyth, tokensFromStackmyth } from './theme.js';
 export { A as AuthField, D as DEFAULT_PASSWORD_POLICY, F as FieldProblem, M as MIN_PASSWORD, P as PasswordClass, a as PasswordLocale, b as PasswordPolicy, c as PasswordReason, d as checkCode, e as checkEmail, f as checkName, g as checkNewPassword, h as checkPassword, i as describePasswordPolicy, j as explainPasswordProblems, p as passwordPolicyOf, k as passwordProblems } from './validate-sEXG82po.js';
 import { JWTVerifyGetKey } from 'jose';

package/dist/index.js

@@ -899,6 +899,13 @@ function providerIn(segment) {
 function env2(name) {
   return typeof process !== "undefined" ? process.env?.[name] : void 0;
 }
+function hostOf(origin) {
+  try {
+    return new URL(origin).hostname;
+  } catch {
+    return void 0;
+  }
+}
 function b64url(bytes) {
   let s = "";
   for (const b of bytes) s += String.fromCharCode(b);
@@ -932,6 +939,10 @@ function createCauthy(given = {}) {
   if (!/^https?:\/\//.test(issuer)) throw new CauthyConfigError("issuer (CAUTHY_ISSUER) must be Cauthy's address, e.g. https://id.example.com");
   if (clientId === "") throw new CauthyConfigError("clientId (CAUTHY_CLIENT_ID) is required");
   if (secret.length < 32) throw new CauthyConfigError("secret (CAUTHY_SECRET) must be at least 32 characters: it encrypts the session cookie");
+  const baseURL = given.baseURL ?? env2("CAUTHY_BASE_URL");
+  if (baseURL !== void 0 && baseURL !== "" && !/^https?:\/\/[^/]+\/*$/.test(baseURL)) {
+    throw new CauthyConfigError("baseURL (CAUTHY_BASE_URL) must be the application's public origin, e.g. https://app.example.com");
+  }
   const basePath = "/" + (given.basePath ?? "/api/auth").replace(/^\/+|\/+$/g, "");
   const afterSignIn = localPath(given.afterSignIn, "/");
   const afterSignOut = localPath(given.afterSignOut, "/");
@@ -947,7 +958,12 @@ function createCauthy(given = {}) {
     verifyEmail: given.pages?.verifyEmail ? localPath(given.pages.verifyEmail, "/") : void 0
   };
   const ownSystem = createSystem({ issuer, clientId, clientSecret, key: given.systemKey, fetch: given.fetch });
-  const originOf = (request) => withoutTrailingSlashes(given.baseURL ?? new URL(request.url).origin);
+  const originOf = (request) => {
+    if (baseURL) return withoutTrailingSlashes(baseURL);
+    const url = new URL(request.url);
+    const proto = request.headers.get("x-forwarded-proto")?.split(",")[0]?.trim().toLowerCase();
+    return proto === "https" || proto === "http" ? `${proto}://${url.host}` : url.origin;
+  };
   const attrs = (request, maxAge) => ({ secure: originOf(request).startsWith("https://"), maxAge });
   async function token(form) {
     const body2 = new URLSearchParams({ client_id: clientId, ...form });
@@ -1245,9 +1261,18 @@ function createCauthy(given = {}) {
   });
   const problem = (status2, code, message, field, headers, reasons) => json({ error: { code, message, ...field ? { field } : {}, ...reasons && reasons.length > 0 ? { reasons } : {} } }, status2, headers);
   const invalid = (p) => problem(400, p.code, p.message, p.field);
+  let explained = false;
   function ownRequest(request) {
     const origin = request.headers.get("origin");
-    if (origin !== null) return origin === originOf(request) || origin === new URL(request.url).origin;
+    if (origin !== null) {
+      const own = originOf(request);
+      if (origin === own || origin === new URL(request.url).origin) return true;
+      if (!explained && hostOf(origin) === new URL(own).hostname) {
+        explained = true;
+        console.warn(`cauthy-auth: refused a request from ${origin} as cross_site: this application sees itself as ${own}. Behind a proxy? Set CAUTHY_BASE_URL (or baseURL) to the public origin.`);
+      }
+      return false;
+    }
     return (request.headers.get("sec-fetch-site") ?? "same-origin") === "same-origin";
   }
   async function body(request) {