poe-code 4.0.24 → 4.0.25
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json
CHANGED
|
@@ -111,18 +111,30 @@ function loginField(field) {
|
|
|
111
111
|
type: field === "password" || field === "apiKey" ? "password" : field === "email" ? "email" : "text"
|
|
112
112
|
};
|
|
113
113
|
}
|
|
114
|
-
function renderLogin(providerName, fields, transaction, csrfToken, error) {
|
|
114
|
+
function renderLogin(providerName, fields, transaction, csrfToken, error, submittedValues = {}) {
|
|
115
|
+
const scriptNonce = randomBytes(18).toString("base64");
|
|
115
116
|
const controls = fields
|
|
116
117
|
.map((field) => {
|
|
117
118
|
const name = escapeHtml(field.name);
|
|
118
|
-
|
|
119
|
+
const type = field.type ?? "text";
|
|
120
|
+
const autocomplete = type === "email" ? "username" : field.name === "password" ? "current-password" : "off";
|
|
121
|
+
const value = type === "email" ? submittedValues[field.name] ?? "" : "";
|
|
122
|
+
return `<label>${escapeHtml(field.label ?? field.name)}<input name="${name}" type="${type}" required autocomplete="${autocomplete}"${value.length === 0 ? "" : ` value="${escapeHtml(value)}"`}></label>`;
|
|
119
123
|
})
|
|
120
124
|
.join("");
|
|
121
|
-
|
|
125
|
+
const idleLabel = `Connect ${providerName}`;
|
|
126
|
+
const html = `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Connect ${escapeHtml(providerName)}</title><style>body{font:16px system-ui;max-width:28rem;margin:10vh auto;padding:1rem;color:#171717}form{display:grid;gap:1rem}label{display:grid;gap:.35rem}input,button{font:inherit;padding:.7rem}button{cursor:pointer}button:disabled{cursor:wait;opacity:.7}.status{margin:0;color:#525252}.error{color:#b42318}</style></head><body><h1>Connect ${escapeHtml(providerName)}</h1>${error === undefined ? "" : `<p class="error" role="alert">${escapeHtml(error)}</p>`}<form id="oauth-connect-form" method="post" action="/oauth/connect"><input type="hidden" name="transaction" value="${escapeHtml(transaction.id)}"><input type="hidden" name="csrf" value="${escapeHtml(csrfToken)}">${controls}<button id="oauth-connect-button" type="submit" data-idle-label="${escapeHtml(idleLabel)}">${escapeHtml(idleLabel)}</button><p id="oauth-connect-status" class="status" role="status" aria-live="polite" hidden>Signing in… This may take a moment.</p></form><script nonce="${scriptNonce}">(()=>{const form=document.getElementById("oauth-connect-form");const button=document.getElementById("oauth-connect-button");const status=document.getElementById("oauth-connect-status");if(!(form instanceof HTMLFormElement)||!(button instanceof HTMLButtonElement)||!(status instanceof HTMLElement))return;const reset=()=>{form.removeAttribute("aria-busy");button.disabled=false;button.textContent=button.dataset.idleLabel||"Connect";status.hidden=true};form.addEventListener("submit",()=>{form.setAttribute("aria-busy","true");button.disabled=true;button.textContent="Connecting…";status.hidden=false});addEventListener("pageshow",reset)})();</script></body></html>`;
|
|
127
|
+
return {
|
|
128
|
+
contentSecurityPolicy: loginContentSecurityPolicy(transaction, scriptNonce),
|
|
129
|
+
html
|
|
130
|
+
};
|
|
122
131
|
}
|
|
123
|
-
function loginContentSecurityPolicy(transaction) {
|
|
132
|
+
function loginContentSecurityPolicy(transaction, scriptNonce) {
|
|
124
133
|
const callbackOrigin = new URL(transaction.redirectUri).origin;
|
|
125
|
-
return `default-src 'none'; style-src 'unsafe-inline'; form-action 'self' ${callbackOrigin}; base-uri 'none'; frame-ancestors 'none'`;
|
|
134
|
+
return `default-src 'none'; style-src 'unsafe-inline'; script-src 'nonce-${scriptNonce}'; form-action 'self' ${callbackOrigin}; base-uri 'none'; frame-ancestors 'none'`;
|
|
135
|
+
}
|
|
136
|
+
function renderExpiredConnection() {
|
|
137
|
+
return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Connection expired</title><style>body{font:16px system-ui;max-width:28rem;margin:10vh auto;padding:1rem;color:#171717}p{line-height:1.5}</style></head><body><h1>Connection expired</h1><p>This sign-in link has expired or was already used.</p><p>Close this tab, return to the app that started the connection, and click Connect again.</p></body></html>`;
|
|
126
138
|
}
|
|
127
139
|
function interactionCookieName(transactionId) {
|
|
128
140
|
const suffix = createHash("sha256").update(transactionId).digest("base64url").slice(0, 22);
|
|
@@ -186,11 +198,12 @@ export async function prepareHostedOAuthRuntime(config) {
|
|
|
186
198
|
const security = createAuthorizationInteractionSecurity({
|
|
187
199
|
cookieName: interactionCookieName(transaction.id)
|
|
188
200
|
});
|
|
189
|
-
|
|
201
|
+
const login = renderLogin(displayName, fields, transaction, security.csrfToken);
|
|
202
|
+
return new Response(login.html, {
|
|
190
203
|
status: 200,
|
|
191
204
|
headers: {
|
|
192
205
|
"content-type": "text/html; charset=utf-8",
|
|
193
|
-
"content-security-policy":
|
|
206
|
+
"content-security-policy": login.contentSecurityPolicy,
|
|
194
207
|
"cache-control": "no-store",
|
|
195
208
|
"referrer-policy": "no-referrer",
|
|
196
209
|
"x-content-type-options": "nosniff",
|
|
@@ -273,10 +286,13 @@ export async function prepareHostedOAuthRuntime(config) {
|
|
|
273
286
|
}) ||
|
|
274
287
|
transaction.expiresAt <= Date.now()) {
|
|
275
288
|
response.writeHead(400, {
|
|
276
|
-
"content-type": "text/
|
|
277
|
-
"
|
|
289
|
+
"content-type": "text/html; charset=utf-8",
|
|
290
|
+
"content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; frame-ancestors 'none'",
|
|
291
|
+
"cache-control": "no-store",
|
|
292
|
+
"referrer-policy": "no-referrer",
|
|
293
|
+
"x-content-type-options": "nosniff"
|
|
278
294
|
});
|
|
279
|
-
response.end(
|
|
295
|
+
response.end(renderExpiredConnection());
|
|
280
296
|
return true;
|
|
281
297
|
}
|
|
282
298
|
const controller = new AbortController();
|
|
@@ -312,13 +328,15 @@ export async function prepareHostedOAuthRuntime(config) {
|
|
|
312
328
|
const safeError = error instanceof HostedOAuthLoginError
|
|
313
329
|
? error.message
|
|
314
330
|
: "Sign-in failed. Please try again.";
|
|
331
|
+
const login = renderLogin(displayName, fields, transaction, csrf, safeError, values);
|
|
315
332
|
response.writeHead(400, {
|
|
316
333
|
"content-type": "text/html; charset=utf-8",
|
|
317
|
-
"content-security-policy":
|
|
334
|
+
"content-security-policy": login.contentSecurityPolicy,
|
|
318
335
|
"cache-control": "no-store",
|
|
319
|
-
"referrer-policy": "no-referrer"
|
|
336
|
+
"referrer-policy": "no-referrer",
|
|
337
|
+
"x-content-type-options": "nosniff"
|
|
320
338
|
});
|
|
321
|
-
response.end(
|
|
339
|
+
response.end(login.html);
|
|
322
340
|
}
|
|
323
341
|
return true;
|
|
324
342
|
}
|