loginbase 1.5.0 → 1.6.0

package/dist/plugins/github.js

@@ -37,8 +37,12 @@ function redirectAllowed(redirect, github) {
             target.pathname.startsWith(base.pathname));
     });
 }
+// 回跳地址允许自带 query 与 fragment（redirectAllowed 只比对 protocol/host/pathname），
+// 文本拼接会把参数追加进 fragment、或让已有的同名键遮蔽新值，客户端 searchParams 取不到
 function withParam(url, key, value) {
-    return `${url}${url.includes("?") ? "&" : "?"}${key}=${encodeURIComponent(value)}`;
+    const target = new URL(url);
+    target.searchParams.set(key, value);
+    return target.toString();
 }
 // providerProfile 只透传建档需要的公开档案白名单——GET /user 的认证视图含
 // two_factor_authentication、私有仓库统计等敏感字段，不该流出库边界。
@@ -194,10 +198,11 @@ export function registerGithubOauth(auth, getConfig, basePath) {
         if (!gh)
             return c.json({ error: "not_configured" }, 404);
         const code = c.req.query("code") ?? "";
+        const providerError = c.req.query("error") ?? "";
         const state = c.req.query("state") ?? "";
         const stateKey = `oauth:state:${state}`;
         const rawState = state ? await cfg(c).kv.get(stateKey) : null;
-        if (!code || !rawState) {
+        if (!rawState) {
             // state 无效即回跳地址不可信，只能就地报错。
             // 此分支拿不到 flowId——它就存在读不出来的那条 state 记录里。
             track(c, {
@@ -217,6 +222,12 @@ export function registerGithubOauth(auth, getConfig, basePath) {
             ...(userId ? { userId } : {}),
             meta: { mode: mode ?? "login", ...meta },
         });
+        // GitHub 用 ?error= 回报用户拒绝授权，此时没有 code；state 已验过，回跳地址可信
+        if (!code) {
+            const reason = REASON_PATTERN.test(providerError) ? providerError : "no_code";
+            trackCallback(reason);
+            return c.redirect(withParam(redirect, "error", reason), 302);
+        }
         const identity = await fetchGithubIdentity(gh, code);
         if (!identity) {
             trackCallback("oauth_failed");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loginbase",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "description": "Shared login foundation for Cloudflare Workers: email OTP + social OAuth + session management, as a Hono sub-app factory.",
   "type": "module",
   "license": "MIT",