WorkRoot/WRNexusJS
2
0
Fork 0
Code Issues Pull Requests Actions 27 Packages Projects Releases Wiki Activity

fix: use public origins for SSO redirects

Browse Source
This commit is contained in:
Clintchiz
2026-07-20 15:04:20 +05:30
parent a75779fa4d
commit 944f83d3f4
57 changed files with 138 additions and 89 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/ai/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/ai",
"version": "0.2.70",
"version": "0.2.71",
"private": true,
"type": "module",
"description": "Zero-dependency Claude (Anthropic) client for WrNexus apps.",
packages/authz/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/authz",
"version": "0.2.70",
"version": "0.2.71",
"private": true,
"type": "module",
"main": "src/index.ts",
packages/cli/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/cli",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"main": "src/index.ts",
"exports": {
packages/cli/src/update.ts
+9
View File
@@ -707,6 +707,15 @@ const MIGRATIONS: Migration[] = [
if (!ctx.dryRun) writeFileSync(file, JSON.stringify(pkg, null, 2) + "\n", "utf8");
},
},
{
version: "0.2.71",
id: "public-forward-auth-redirect-origins",
description:
"Builds SSO redirects and returnTo URLs from configured public app origins instead of internal gateway listeners.",
apply() {
// Public URL handling improves automatically after updating and rebuilding.
},
},
];
/** Release tooling uses this to require an explicit migration entry per version. */
packages/compiler/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/compiler",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"main": "src/index.ts",
"exports": {
packages/core/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/core",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"main": "src/index.ts",
"exports": {
packages/csr/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/csr",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"main": "src/index.ts",
"exports": {
packages/db/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/db",
"version": "0.2.70",
"version": "0.2.71",
"private": true,
"type": "module",
"main": "src/index.ts",
packages/dev-server/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/dev-server",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"main": "src/index.ts",
"exports": {
packages/dev-server/src/gateway.ts
+8 -4
View File
@@ -166,10 +166,13 @@ export function forwardAuthFailure(res: Response, verifierUrl: string): Response
}
/** Describe the original gateway request to a forward-auth verifier. */
export function forwardAuthHeaders(req: Request): Headers {
export function forwardAuthHeaders(req: Request, publicOrigin?: string): Headers {
const original = new URL(req.url);
const host = req.headers.get("host") ?? original.host;
const protocol = original.protocol.replace(":", "");
const protocol = (publicOrigin ? new URL(publicOrigin).protocol : original.protocol).replace(
":",
"",
);
return new Headers({
cookie: req.headers.get("cookie") ?? "",
authorization: req.headers.get("authorization") ?? "",
@@ -194,6 +197,7 @@ async function checkAuth(
req: Request,
ip: string,
internalOrigins: Readonly<Record<string, string>>,
publicOrigin?: string,
): Promise<Response | null> {
if (!auth) return null;
@@ -225,7 +229,7 @@ async function checkAuth(
try {
const res = await fetch(verifyUrl, {
headers: forwardAuthHeaders(req),
headers: forwardAuthHeaders(req, publicOrigin),
redirect: "manual",
});
if (!res.ok) {
@@ -492,7 +496,7 @@ export async function startGateway(opts: GatewayOptions): Promise<RunningGateway
}
// Per-app access control (basic auth / IP allowlist / forward-auth).
const denied = await checkAuth(target.auth, req, ip, internalOrigins);
const denied = await checkAuth(target.auth, req, ip, internalOrigins, target.publicOrigin);
if (denied) {
if (sec.accessLog)
console.log(
packages/dev-server/test/gateway.test.ts
+12
View File
@@ -85,6 +85,18 @@ test("forward auth describes the original gateway request", () => {
expect(headers.get("authorization")).toBe("Bearer token");
});
test("forward auth uses the protected app public protocol", () => {
const headers = forwardAuthHeaders(
new Request("http://127.0.0.1:10050/settings", {
headers: { host: "admin.wrnx.in" },
}),
"https://admin.wrnx.in",
);
expect(headers.get("x-original-host")).toBe("admin.wrnx.in");
expect(headers.get("x-original-proto")).toBe("https");
});
test("nested SSO proxy keeps the protected app's original request headers", () => {
const authHeaders = forwardAuthHeaders(
new Request("http://admin.localhost:3000/settings", {
packages/encryption/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/encryption",
"version": "0.2.70",
"version": "0.2.71",
"private": true,
"type": "module",
"main": "src/index.ts",
packages/helpers/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/helpers",
"version": "0.2.70",
"version": "0.2.71",
"private": true,
"type": "module",
"description": "Safe convenience helpers for WrNexus request contexts and common application flows.",
packages/helpers/src/index.ts
+2 -1
View File
@@ -6,6 +6,7 @@
*/
import type { Context } from "@wrnexus/core";
import { currentAppOrigin } from "./workspace.ts";
export type RequestContext = Pick<Context, "req" | "url">;
@@ -127,7 +128,7 @@ export function redirectToLogin(
loginUrl: string | URL,
options: LoginRedirectOptions = {},
): Response {
const target = new URL(loginUrl, ctx.url.origin);
const target = new URL(loginUrl, `${currentAppOrigin() ?? ctx.url.origin}/`);
if (target.protocol !== "http:" && target.protocol !== "https:") {
throw new TypeError("Login URL must use http or https");
}
packages/helpers/test/helpers.test.ts
+23
View File
@@ -93,6 +93,29 @@ test("creates a safe login redirect with an encoded returnTo URL", () => {
);
});
test("relative login redirects use the configured public app origin", () => {
const previous = process.env.WRNEXUS_APP_ORIGIN;
process.env.WRNEXUS_APP_ORIGIN = "https://sso.example.test";
try {
const ctx = context("http://127.0.0.1:3002/api/verify", {
"x-original-host": "admin.example.test",
"x-original-proto": "https",
"x-original-uri": "/settings",
});
const response = redirectToLogin(ctx, "/sign-in", {
allowedHosts: ["admin.example.test"],
});
const location = new URL(response.headers.get("location")!);
expect(location.origin).toBe("https://sso.example.test");
expect(location.pathname).toBe("/sign-in");
expect(location.searchParams.get("returnTo")).toBe("https://admin.example.test/settings");
} finally {
if (previous === undefined) delete process.env.WRNEXUS_APP_ORIGIN;
else process.env.WRNEXUS_APP_ORIGIN = previous;
}
});
test("supports an allowed-host callback and custom response options", () => {
const ctx = context("https://login.example.test/api/verify", {
"x-forwarded-host": "reports.example.test",
packages/i18n/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/i18n",
"version": "0.2.70",
"version": "0.2.71",
"private": true,
"type": "module",
"main": "src/index.ts",
packages/jwt/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/jwt",
"version": "0.2.70",
"version": "0.2.71",
"private": true,
"type": "module",
"main": "src/index.ts",
packages/mobile/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/mobile",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"main": "src/index.ts",
"exports": {
packages/native/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/native",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"main": "src/index.ts",
"exports": {
packages/oauth/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/oauth",
"version": "0.2.70",
"version": "0.2.71",
"private": true,
"type": "module",
"main": "src/index.ts",
packages/pubsub/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/pubsub",
"version": "0.2.70",
"version": "0.2.71",
"private": true,
"type": "module",
"main": "src/index.ts",
packages/queue/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/queue",
"version": "0.2.70",
"version": "0.2.71",
"private": true,
"type": "module",
"main": "src/index.ts",
packages/reactive/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/reactive",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"main": "src/index.ts",
"exports": {
packages/router/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/router",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"main": "src/index.ts",
"exports": {
packages/ssr/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/ssr",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"main": "src/index.ts",
"exports": {
packages/styles/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/styles",
"version": "0.2.70",
"version": "0.2.71",
"type": "module",
"main": "src/index.ts",
"exports": {
packages/test/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/test",
"version": "0.2.70",
"version": "0.2.71",
"private": true,
"type": "module",
"main": "src/index.ts",
packages/tracking/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/tracking",
"version": "0.2.70",
"version": "0.2.71",
"private": true,
"type": "module",
"main": "src/index.ts",
packages/ui/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/ui",
"version": "0.2.70",
"version": "0.2.71",
"private": true,
"type": "module",
"main": "src/index.ts",
packages/uploader/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/uploader",
"version": "0.2.70",
"version": "0.2.71",
"private": true,
"type": "module",
"main": "src/index.ts",
packages/validation/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "@wrnexus/validation",
"version": "0.2.70",
"version": "0.2.71",
"private": true,
"type": "module",
"main": "src/index.ts",