From 944f83d3f48efa3503b8d0d6613ff6d21651385b Mon Sep 17 00:00:00 2001 From: Ajay Ghanwat Date: Mon, 20 Jul 2026 15:04:20 +0530 Subject: [PATCH] fix: use public origins for SSO redirects --- .publish/ai/package.json | 2 +- .publish/authz/package.json | 2 +- .publish/cli/package.json | 22 ++++++++++---------- .publish/compiler/package.json | 2 +- .publish/core/package.json | 2 +- .publish/csr/package.json | 4 ++-- .publish/db/package.json | 2 +- .publish/dev-server/package.json | 26 ++++++++++++------------ .publish/encryption/package.json | 2 +- .publish/helpers/package.json | 4 ++-- .publish/i18n/package.json | 4 ++-- .publish/jwt/package.json | 2 +- .publish/mobile/package.json | 4 ++-- .publish/native/package.json | 2 +- .publish/oauth/package.json | 2 +- .publish/pubsub/package.json | 2 +- .publish/queue/package.json | 2 +- .publish/reactive/package.json | 2 +- .publish/router/package.json | 6 +++--- .publish/ssr/package.json | 4 ++-- .publish/styles/package.json | 4 ++-- .publish/test/package.json | 2 +- .publish/tracking/package.json | 2 +- .publish/ui/package.json | 4 ++-- .publish/uploader/package.json | 4 ++-- .publish/validation/package.json | 2 +- packages/ai/package.json | 2 +- packages/authz/package.json | 2 +- packages/cli/package.json | 2 +- packages/cli/src/update.ts | 9 ++++++++ packages/compiler/package.json | 2 +- packages/core/package.json | 2 +- packages/csr/package.json | 2 +- packages/db/package.json | 2 +- packages/dev-server/package.json | 2 +- packages/dev-server/src/gateway.ts | 12 +++++++---- packages/dev-server/test/gateway.test.ts | 12 +++++++++++ packages/encryption/package.json | 2 +- packages/helpers/package.json | 2 +- packages/helpers/src/index.ts | 3 ++- packages/helpers/test/helpers.test.ts | 23 +++++++++++++++++++++ packages/i18n/package.json | 2 +- packages/jwt/package.json | 2 +- packages/mobile/package.json | 2 +- packages/native/package.json | 2 +- packages/oauth/package.json | 2 +- packages/pubsub/package.json | 2 +- packages/queue/package.json | 2 +- packages/reactive/package.json | 2 +- packages/router/package.json | 2 +- packages/ssr/package.json | 2 +- packages/styles/package.json | 2 +- packages/test/package.json | 2 +- packages/tracking/package.json | 2 +- packages/ui/package.json | 2 +- packages/uploader/package.json | 2 +- packages/validation/package.json | 2 +- 57 files changed, 138 insertions(+), 89 deletions(-) diff --git a/.publish/ai/package.json b/.publish/ai/package.json index 46e983c9..26bafe2a 100644 --- a/.publish/ai/package.json +++ b/.publish/ai/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/ai", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "description": "Zero-dependency Claude (Anthropic) client for WrNexus apps.", "license": "MIT", diff --git a/.publish/authz/package.json b/.publish/authz/package.json index 0bd70482..5bd7cfb3 100644 --- a/.publish/authz/package.json +++ b/.publish/authz/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/authz", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "description": "@wrnexus/authz — part of the WrNexus framework.", "license": "MIT", diff --git a/.publish/cli/package.json b/.publish/cli/package.json index 718d0962..c7bc9b8e 100644 --- a/.publish/cli/package.json +++ b/.publish/cli/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/cli", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "description": "@wrnexus/cli — part of the WrNexus framework.", "license": "MIT", @@ -28,16 +28,16 @@ "wrnexus": "./dist/index.js" }, "dependencies": { - "@wrnexus/core": "^0.2.70", - "@wrnexus/router": "^0.2.70", - "@wrnexus/csr": "^0.2.70", - "@wrnexus/compiler": "^0.2.70", - "@wrnexus/styles": "^0.2.70", - "@wrnexus/dev-server": "^0.2.70", - "@wrnexus/ui": "^0.2.70", - "@wrnexus/validation": "^0.2.70", - "@wrnexus/i18n": "^0.2.70", - "@wrnexus/db": "^0.2.70" + "@wrnexus/core": "^0.2.71", + "@wrnexus/router": "^0.2.71", + "@wrnexus/csr": "^0.2.71", + "@wrnexus/compiler": "^0.2.71", + "@wrnexus/styles": "^0.2.71", + "@wrnexus/dev-server": "^0.2.71", + "@wrnexus/ui": "^0.2.71", + "@wrnexus/validation": "^0.2.71", + "@wrnexus/i18n": "^0.2.71", + "@wrnexus/db": "^0.2.71" }, "files": [ "dist" diff --git a/.publish/compiler/package.json b/.publish/compiler/package.json index 20315826..8413068b 100644 --- a/.publish/compiler/package.json +++ b/.publish/compiler/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/compiler", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "description": "@wrnexus/compiler — part of the WrNexus framework.", "license": "MIT", diff --git a/.publish/core/package.json b/.publish/core/package.json index 28ec1847..fbd2cfba 100644 --- a/.publish/core/package.json +++ b/.publish/core/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/core", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "description": "@wrnexus/core — part of the WrNexus framework.", "license": "MIT", diff --git a/.publish/csr/package.json b/.publish/csr/package.json index dc0737b8..90a5a873 100644 --- a/.publish/csr/package.json +++ b/.publish/csr/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/csr", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "description": "@wrnexus/csr — part of the WrNexus framework.", "license": "MIT", @@ -21,7 +21,7 @@ } }, "dependencies": { - "@wrnexus/core": "^0.2.70" + "@wrnexus/core": "^0.2.71" }, "files": [ "dist" diff --git a/.publish/db/package.json b/.publish/db/package.json index bfc63c7f..93cfb3a5 100644 --- a/.publish/db/package.json +++ b/.publish/db/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/db", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "description": "@wrnexus/db — part of the WrNexus framework.", "license": "MIT", diff --git a/.publish/dev-server/package.json b/.publish/dev-server/package.json index c2489bc6..75dcd16b 100644 --- a/.publish/dev-server/package.json +++ b/.publish/dev-server/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/dev-server", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "description": "@wrnexus/dev-server — part of the WrNexus framework.", "license": "MIT", @@ -25,18 +25,18 @@ } }, "dependencies": { - "@wrnexus/core": "^0.2.70", - "@wrnexus/router": "^0.2.70", - "@wrnexus/ssr": "^0.2.70", - "@wrnexus/csr": "^0.2.70", - "@wrnexus/compiler": "^0.2.70", - "@wrnexus/styles": "^0.2.70", - "@wrnexus/ui": "^0.2.70", - "@wrnexus/validation": "^0.2.70", - "@wrnexus/i18n": "^0.2.70", - "@wrnexus/db": "^0.2.70", - "@wrnexus/pubsub": "^0.2.70", - "@wrnexus/uploader": "^0.2.70" + "@wrnexus/core": "^0.2.71", + "@wrnexus/router": "^0.2.71", + "@wrnexus/ssr": "^0.2.71", + "@wrnexus/csr": "^0.2.71", + "@wrnexus/compiler": "^0.2.71", + "@wrnexus/styles": "^0.2.71", + "@wrnexus/ui": "^0.2.71", + "@wrnexus/validation": "^0.2.71", + "@wrnexus/i18n": "^0.2.71", + "@wrnexus/db": "^0.2.71", + "@wrnexus/pubsub": "^0.2.71", + "@wrnexus/uploader": "^0.2.71" }, "files": [ "dist" diff --git a/.publish/encryption/package.json b/.publish/encryption/package.json index f3459533..7feb110f 100644 --- a/.publish/encryption/package.json +++ b/.publish/encryption/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/encryption", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "description": "@wrnexus/encryption — part of the WrNexus framework.", "license": "MIT", diff --git a/.publish/helpers/package.json b/.publish/helpers/package.json index 5fb38ee2..a7a0955c 100644 --- a/.publish/helpers/package.json +++ b/.publish/helpers/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/helpers", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "description": "Safe convenience helpers for WrNexus request contexts and common application flows.", "license": "MIT", @@ -21,7 +21,7 @@ } }, "dependencies": { - "@wrnexus/core": "^0.2.70" + "@wrnexus/core": "^0.2.71" }, "files": [ "dist" diff --git a/.publish/i18n/package.json b/.publish/i18n/package.json index 7cdc0c39..2569e116 100644 --- a/.publish/i18n/package.json +++ b/.publish/i18n/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/i18n", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "description": "@wrnexus/i18n — part of the WrNexus framework.", "license": "MIT", @@ -21,7 +21,7 @@ } }, "dependencies": { - "@wrnexus/core": "^0.2.70" + "@wrnexus/core": "^0.2.71" }, "files": [ "dist" diff --git a/.publish/jwt/package.json b/.publish/jwt/package.json index 2c1d5746..a74da84c 100644 --- a/.publish/jwt/package.json +++ b/.publish/jwt/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/jwt", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "description": "@wrnexus/jwt — part of the WrNexus framework.", "license": "MIT", diff --git a/.publish/mobile/package.json b/.publish/mobile/package.json index 7a35b1f8..ee2f9b4f 100644 --- a/.publish/mobile/package.json +++ b/.publish/mobile/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/mobile", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "description": "@wrnexus/mobile — part of the WrNexus framework.", "license": "MIT", @@ -21,7 +21,7 @@ } }, "dependencies": { - "@wrnexus/native": "^0.2.70" + "@wrnexus/native": "^0.2.71" }, "files": [ "dist" diff --git a/.publish/native/package.json b/.publish/native/package.json index 2caa4b44..7f61cb55 100644 --- a/.publish/native/package.json +++ b/.publish/native/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/native", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "description": "@wrnexus/native — part of the WrNexus framework.", "license": "MIT", diff --git a/.publish/oauth/package.json b/.publish/oauth/package.json index 1eec53cd..13f542bb 100644 --- a/.publish/oauth/package.json +++ b/.publish/oauth/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/oauth", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "description": "@wrnexus/oauth — part of the WrNexus framework.", "license": "MIT", diff --git a/.publish/pubsub/package.json b/.publish/pubsub/package.json index 5b77fb4f..6c7804fc 100644 --- a/.publish/pubsub/package.json +++ b/.publish/pubsub/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/pubsub", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "description": "@wrnexus/pubsub — part of the WrNexus framework.", "license": "MIT", diff --git a/.publish/queue/package.json b/.publish/queue/package.json index 7018f412..f37e98e1 100644 --- a/.publish/queue/package.json +++ b/.publish/queue/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/queue", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "description": "@wrnexus/queue — part of the WrNexus framework.", "license": "MIT", diff --git a/.publish/reactive/package.json b/.publish/reactive/package.json index ae93d276..2d61a123 100644 --- a/.publish/reactive/package.json +++ b/.publish/reactive/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/reactive", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "description": "@wrnexus/reactive — part of the WrNexus framework.", "license": "MIT", diff --git a/.publish/router/package.json b/.publish/router/package.json index febe15ca..12402949 100644 --- a/.publish/router/package.json +++ b/.publish/router/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/router", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "description": "@wrnexus/router — part of the WrNexus framework.", "license": "MIT", @@ -21,8 +21,8 @@ } }, "dependencies": { - "@wrnexus/compiler": "^0.2.70", - "@wrnexus/core": "^0.2.70" + "@wrnexus/compiler": "^0.2.71", + "@wrnexus/core": "^0.2.71" }, "files": [ "dist" diff --git a/.publish/ssr/package.json b/.publish/ssr/package.json index 5830f209..c31cb764 100644 --- a/.publish/ssr/package.json +++ b/.publish/ssr/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/ssr", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "description": "@wrnexus/ssr — part of the WrNexus framework.", "license": "MIT", @@ -21,7 +21,7 @@ } }, "dependencies": { - "@wrnexus/core": "^0.2.70" + "@wrnexus/core": "^0.2.71" }, "files": [ "dist" diff --git a/.publish/styles/package.json b/.publish/styles/package.json index 081487b2..1019b6e7 100644 --- a/.publish/styles/package.json +++ b/.publish/styles/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/styles", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "description": "@wrnexus/styles — part of the WrNexus framework.", "license": "MIT", @@ -21,7 +21,7 @@ } }, "dependencies": { - "@wrnexus/uploader": "^0.2.70" + "@wrnexus/uploader": "^0.2.71" }, "files": [ "dist" diff --git a/.publish/test/package.json b/.publish/test/package.json index 85a2e578..096b21d7 100644 --- a/.publish/test/package.json +++ b/.publish/test/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/test", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "description": "@wrnexus/test — part of the WrNexus framework.", "license": "MIT", diff --git a/.publish/tracking/package.json b/.publish/tracking/package.json index 8a60d4f5..a6ddbaa6 100644 --- a/.publish/tracking/package.json +++ b/.publish/tracking/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/tracking", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "description": "@wrnexus/tracking — part of the WrNexus framework.", "license": "MIT", diff --git a/.publish/ui/package.json b/.publish/ui/package.json index 1cfe0f7d..1635dd3d 100644 --- a/.publish/ui/package.json +++ b/.publish/ui/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/ui", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "description": "@wrnexus/ui — part of the WrNexus framework.", "license": "MIT", @@ -25,7 +25,7 @@ "./ui.css": "./ui.css" }, "dependencies": { - "@wrnexus/core": "^0.2.70" + "@wrnexus/core": "^0.2.71" }, "files": [ "dist", diff --git a/.publish/uploader/package.json b/.publish/uploader/package.json index 0ffc4045..1adedcdf 100644 --- a/.publish/uploader/package.json +++ b/.publish/uploader/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/uploader", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "description": "@wrnexus/uploader — part of the WrNexus framework.", "license": "MIT", @@ -21,7 +21,7 @@ } }, "dependencies": { - "@wrnexus/core": "^0.2.70" + "@wrnexus/core": "^0.2.71" }, "files": [ "dist" diff --git a/.publish/validation/package.json b/.publish/validation/package.json index b2498a73..f186e880 100644 --- a/.publish/validation/package.json +++ b/.publish/validation/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/validation", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "description": "@wrnexus/validation — part of the WrNexus framework.", "license": "MIT", diff --git a/packages/ai/package.json b/packages/ai/package.json index 4713efef..82913d45 100644 --- a/packages/ai/package.json +++ b/packages/ai/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/ai", - "version": "0.2.70", + "version": "0.2.71", "private": true, "type": "module", "description": "Zero-dependency Claude (Anthropic) client for WrNexus apps.", diff --git a/packages/authz/package.json b/packages/authz/package.json index 3d2ef1e8..8e989493 100644 --- a/packages/authz/package.json +++ b/packages/authz/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/authz", - "version": "0.2.70", + "version": "0.2.71", "private": true, "type": "module", "main": "src/index.ts", diff --git a/packages/cli/package.json b/packages/cli/package.json index 124a750e..bdb27cb5 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/cli", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "main": "src/index.ts", "exports": { diff --git a/packages/cli/src/update.ts b/packages/cli/src/update.ts index 94a2e6cf..d4017ac7 100644 --- a/packages/cli/src/update.ts +++ b/packages/cli/src/update.ts @@ -707,6 +707,15 @@ const MIGRATIONS: Migration[] = [ if (!ctx.dryRun) writeFileSync(file, JSON.stringify(pkg, null, 2) + "\n", "utf8"); }, }, + { + version: "0.2.71", + id: "public-forward-auth-redirect-origins", + description: + "Builds SSO redirects and returnTo URLs from configured public app origins instead of internal gateway listeners.", + apply() { + // Public URL handling improves automatically after updating and rebuilding. + }, + }, ]; /** Release tooling uses this to require an explicit migration entry per version. */ diff --git a/packages/compiler/package.json b/packages/compiler/package.json index fe945e7c..5e13cb5b 100644 --- a/packages/compiler/package.json +++ b/packages/compiler/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/compiler", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "main": "src/index.ts", "exports": { diff --git a/packages/core/package.json b/packages/core/package.json index 95037614..8a8f2d93 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/core", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "main": "src/index.ts", "exports": { diff --git a/packages/csr/package.json b/packages/csr/package.json index 6b2e59c9..7d34818d 100644 --- a/packages/csr/package.json +++ b/packages/csr/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/csr", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "main": "src/index.ts", "exports": { diff --git a/packages/db/package.json b/packages/db/package.json index 20e9d4c4..caef8c04 100644 --- a/packages/db/package.json +++ b/packages/db/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/db", - "version": "0.2.70", + "version": "0.2.71", "private": true, "type": "module", "main": "src/index.ts", diff --git a/packages/dev-server/package.json b/packages/dev-server/package.json index 055558cd..6bfc56b5 100644 --- a/packages/dev-server/package.json +++ b/packages/dev-server/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/dev-server", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "main": "src/index.ts", "exports": { diff --git a/packages/dev-server/src/gateway.ts b/packages/dev-server/src/gateway.ts index b59246e6..0d26864a 100644 --- a/packages/dev-server/src/gateway.ts +++ b/packages/dev-server/src/gateway.ts @@ -166,10 +166,13 @@ export function forwardAuthFailure(res: Response, verifierUrl: string): Response } /** Describe the original gateway request to a forward-auth verifier. */ -export function forwardAuthHeaders(req: Request): Headers { +export function forwardAuthHeaders(req: Request, publicOrigin?: string): Headers { const original = new URL(req.url); const host = req.headers.get("host") ?? original.host; - const protocol = original.protocol.replace(":", ""); + const protocol = (publicOrigin ? new URL(publicOrigin).protocol : original.protocol).replace( + ":", + "", + ); return new Headers({ cookie: req.headers.get("cookie") ?? "", authorization: req.headers.get("authorization") ?? "", @@ -194,6 +197,7 @@ async function checkAuth( req: Request, ip: string, internalOrigins: Readonly>, + publicOrigin?: string, ): Promise { if (!auth) return null; @@ -225,7 +229,7 @@ async function checkAuth( try { const res = await fetch(verifyUrl, { - headers: forwardAuthHeaders(req), + headers: forwardAuthHeaders(req, publicOrigin), redirect: "manual", }); if (!res.ok) { @@ -492,7 +496,7 @@ export async function startGateway(opts: GatewayOptions): Promise { expect(headers.get("authorization")).toBe("Bearer token"); }); +test("forward auth uses the protected app public protocol", () => { + const headers = forwardAuthHeaders( + new Request("http://127.0.0.1:10050/settings", { + headers: { host: "admin.wrnx.in" }, + }), + "https://admin.wrnx.in", + ); + + expect(headers.get("x-original-host")).toBe("admin.wrnx.in"); + expect(headers.get("x-original-proto")).toBe("https"); +}); + test("nested SSO proxy keeps the protected app's original request headers", () => { const authHeaders = forwardAuthHeaders( new Request("http://admin.localhost:3000/settings", { diff --git a/packages/encryption/package.json b/packages/encryption/package.json index ca6d8268..5b582ef8 100644 --- a/packages/encryption/package.json +++ b/packages/encryption/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/encryption", - "version": "0.2.70", + "version": "0.2.71", "private": true, "type": "module", "main": "src/index.ts", diff --git a/packages/helpers/package.json b/packages/helpers/package.json index e2f51a70..51f7372b 100644 --- a/packages/helpers/package.json +++ b/packages/helpers/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/helpers", - "version": "0.2.70", + "version": "0.2.71", "private": true, "type": "module", "description": "Safe convenience helpers for WrNexus request contexts and common application flows.", diff --git a/packages/helpers/src/index.ts b/packages/helpers/src/index.ts index 91b80f33..dc87bcd5 100644 --- a/packages/helpers/src/index.ts +++ b/packages/helpers/src/index.ts @@ -6,6 +6,7 @@ */ import type { Context } from "@wrnexus/core"; +import { currentAppOrigin } from "./workspace.ts"; export type RequestContext = Pick; @@ -127,7 +128,7 @@ export function redirectToLogin( loginUrl: string | URL, options: LoginRedirectOptions = {}, ): Response { - const target = new URL(loginUrl, ctx.url.origin); + const target = new URL(loginUrl, `${currentAppOrigin() ?? ctx.url.origin}/`); if (target.protocol !== "http:" && target.protocol !== "https:") { throw new TypeError("Login URL must use http or https"); } diff --git a/packages/helpers/test/helpers.test.ts b/packages/helpers/test/helpers.test.ts index ab115844..b130f6e6 100644 --- a/packages/helpers/test/helpers.test.ts +++ b/packages/helpers/test/helpers.test.ts @@ -93,6 +93,29 @@ test("creates a safe login redirect with an encoded returnTo URL", () => { ); }); +test("relative login redirects use the configured public app origin", () => { + const previous = process.env.WRNEXUS_APP_ORIGIN; + process.env.WRNEXUS_APP_ORIGIN = "https://sso.example.test"; + try { + const ctx = context("http://127.0.0.1:3002/api/verify", { + "x-original-host": "admin.example.test", + "x-original-proto": "https", + "x-original-uri": "/settings", + }); + const response = redirectToLogin(ctx, "/sign-in", { + allowedHosts: ["admin.example.test"], + }); + const location = new URL(response.headers.get("location")!); + + expect(location.origin).toBe("https://sso.example.test"); + expect(location.pathname).toBe("/sign-in"); + expect(location.searchParams.get("returnTo")).toBe("https://admin.example.test/settings"); + } finally { + if (previous === undefined) delete process.env.WRNEXUS_APP_ORIGIN; + else process.env.WRNEXUS_APP_ORIGIN = previous; + } +}); + test("supports an allowed-host callback and custom response options", () => { const ctx = context("https://login.example.test/api/verify", { "x-forwarded-host": "reports.example.test", diff --git a/packages/i18n/package.json b/packages/i18n/package.json index c0329f83..8b7c9d21 100644 --- a/packages/i18n/package.json +++ b/packages/i18n/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/i18n", - "version": "0.2.70", + "version": "0.2.71", "private": true, "type": "module", "main": "src/index.ts", diff --git a/packages/jwt/package.json b/packages/jwt/package.json index e3e1eb5e..79893753 100644 --- a/packages/jwt/package.json +++ b/packages/jwt/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/jwt", - "version": "0.2.70", + "version": "0.2.71", "private": true, "type": "module", "main": "src/index.ts", diff --git a/packages/mobile/package.json b/packages/mobile/package.json index 881911a8..984d3381 100644 --- a/packages/mobile/package.json +++ b/packages/mobile/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/mobile", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "main": "src/index.ts", "exports": { diff --git a/packages/native/package.json b/packages/native/package.json index eb81359f..17d8f639 100644 --- a/packages/native/package.json +++ b/packages/native/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/native", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "main": "src/index.ts", "exports": { diff --git a/packages/oauth/package.json b/packages/oauth/package.json index 1fcf93a4..7884251c 100644 --- a/packages/oauth/package.json +++ b/packages/oauth/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/oauth", - "version": "0.2.70", + "version": "0.2.71", "private": true, "type": "module", "main": "src/index.ts", diff --git a/packages/pubsub/package.json b/packages/pubsub/package.json index dbbddd5c..b7dc348f 100644 --- a/packages/pubsub/package.json +++ b/packages/pubsub/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/pubsub", - "version": "0.2.70", + "version": "0.2.71", "private": true, "type": "module", "main": "src/index.ts", diff --git a/packages/queue/package.json b/packages/queue/package.json index a7293326..e54612c6 100644 --- a/packages/queue/package.json +++ b/packages/queue/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/queue", - "version": "0.2.70", + "version": "0.2.71", "private": true, "type": "module", "main": "src/index.ts", diff --git a/packages/reactive/package.json b/packages/reactive/package.json index faef312c..948ce704 100644 --- a/packages/reactive/package.json +++ b/packages/reactive/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/reactive", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "main": "src/index.ts", "exports": { diff --git a/packages/router/package.json b/packages/router/package.json index a3615dea..4531153f 100644 --- a/packages/router/package.json +++ b/packages/router/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/router", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "main": "src/index.ts", "exports": { diff --git a/packages/ssr/package.json b/packages/ssr/package.json index cadda612..b095766e 100644 --- a/packages/ssr/package.json +++ b/packages/ssr/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/ssr", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "main": "src/index.ts", "exports": { diff --git a/packages/styles/package.json b/packages/styles/package.json index 34c4a9ce..44c4be7e 100644 --- a/packages/styles/package.json +++ b/packages/styles/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/styles", - "version": "0.2.70", + "version": "0.2.71", "type": "module", "main": "src/index.ts", "exports": { diff --git a/packages/test/package.json b/packages/test/package.json index f2eb943f..62486a59 100644 --- a/packages/test/package.json +++ b/packages/test/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/test", - "version": "0.2.70", + "version": "0.2.71", "private": true, "type": "module", "main": "src/index.ts", diff --git a/packages/tracking/package.json b/packages/tracking/package.json index 87701896..a76b52f7 100644 --- a/packages/tracking/package.json +++ b/packages/tracking/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/tracking", - "version": "0.2.70", + "version": "0.2.71", "private": true, "type": "module", "main": "src/index.ts", diff --git a/packages/ui/package.json b/packages/ui/package.json index 1fd4725a..40bdc12e 100644 --- a/packages/ui/package.json +++ b/packages/ui/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/ui", - "version": "0.2.70", + "version": "0.2.71", "private": true, "type": "module", "main": "src/index.ts", diff --git a/packages/uploader/package.json b/packages/uploader/package.json index dbab33db..3c513a95 100644 --- a/packages/uploader/package.json +++ b/packages/uploader/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/uploader", - "version": "0.2.70", + "version": "0.2.71", "private": true, "type": "module", "main": "src/index.ts", diff --git a/packages/validation/package.json b/packages/validation/package.json index 9c7300c8..5045738e 100644 --- a/packages/validation/package.json +++ b/packages/validation/package.json @@ -1,6 +1,6 @@ { "name": "@wrnexus/validation", - "version": "0.2.70", + "version": "0.2.71", "private": true, "type": "module", "main": "src/index.ts",