Edit: /tmp/tsx-0/17887-91f493ef0d0694578377eee6127a20efeadd0ae6 (12098B)
{"code":"__filename=\"/opt/canhelp/node_modules/better-auth/dist/api/middlewares/origin-check.mjs\";(()=>{\nvar __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __hasOwnProp=Object.prototype.hasOwnProperty;var __name=(target,value)=>__defProp(target,\"name\",{value,configurable:true});var __export=(target,all)=>{for(var name in all)__defProp(target,name,{get:all[name],enumerable:true})};var __copyProps=(to,from,except,desc)=>{if(from&&typeof from===\"object\"||typeof from===\"function\"){for(let key of __getOwnPropNames(from))if(!__hasOwnProp.call(to,key)&&key!==except)__defProp(to,key,{get:()=>from[key],enumerable:!(desc=__getOwnPropDesc(from,key))||desc.enumerable})}return to};var __toCommonJS=mod=>__copyProps(__defProp({},\"__esModule\",{value:true}),mod);var origin_check_exports={};__export(origin_check_exports,{formCsrfMiddleware:()=>formCsrfMiddleware,originCheck:()=>originCheck,originCheckMiddleware:()=>originCheckMiddleware});module.exports=__toCommonJS(origin_check_exports);var import_trusted_origins=require(\"../../auth/trusted-origins.mjs\");var import_error=require(\"@better-auth/core/error\");var import_url=require(\"@better-auth/core/utils/url\");var import_api=require(\"@better-auth/core/api\");var import_deprecate=require(\"@better-auth/core/utils/deprecate\");function shouldSkipCSRFForBackwardCompat(ctx){return ctx.context.skipOriginCheck===true&&ctx.context.options.advanced?.disableCSRFCheck===void 0}__name(shouldSkipCSRFForBackwardCompat,\"shouldSkipCSRFForBackwardCompat\");function shouldSkipOriginCheck(ctx){const skipOriginCheck=ctx.context.skipOriginCheck;if(skipOriginCheck===true)return true;if(Array.isArray(skipOriginCheck)&&ctx.request)try{const basePath=new URL(ctx.context.baseURL).pathname;const currentPath=(0,import_url.normalizePathname)(ctx.request.url,basePath);return skipOriginCheck.some(skipPath=>currentPath.startsWith(skipPath))}catch{}return false}__name(shouldSkipOriginCheck,\"shouldSkipOriginCheck\");const logBackwardCompatWarning=(0,import_deprecate.deprecate)(__name(function logBackwardCompatWarning2(){},\"logBackwardCompatWarning\"),\"disableOriginCheck: true currently also disables CSRF checks. In a future version, disableOriginCheck will ONLY disable URL validation. To keep CSRF disabled, add disableCSRFCheck: true to your config.\");const originCheckMiddleware=(0,import_api.createAuthMiddleware)(async ctx=>{if(ctx.request?.method===\"GET\"||ctx.request?.method===\"OPTIONS\"||ctx.request?.method===\"HEAD\"||!ctx.request)return;await validateOrigin(ctx);if(shouldSkipOriginCheck(ctx))return;const{body,query}=ctx;const callbackURL=body?.callbackURL||query?.callbackURL;const redirectURL=body?.redirectTo;const errorCallbackURL=body?.errorCallbackURL;const newUserCallbackURL=body?.newUserCallbackURL;const validateURL=__name((url,label)=>{if(!url)return;if(!ctx.context.isTrustedOrigin(url,{allowRelativePaths:label!==\"origin\"})){ctx.context.logger.error(`Invalid ${label}: ${url}`);ctx.context.logger.info(`If it's a valid URL, please add ${url} to trustedOrigins in your auth config\n`,`Current list of trustedOrigins: ${ctx.context.trustedOrigins}`);if(label===\"origin\")throw import_error.APIError.from(\"FORBIDDEN\",import_error.BASE_ERROR_CODES.INVALID_ORIGIN);if(label===\"callbackURL\")throw import_error.APIError.from(\"FORBIDDEN\",import_error.BASE_ERROR_CODES.INVALID_CALLBACK_URL);if(label===\"redirectURL\")throw import_error.APIError.from(\"FORBIDDEN\",import_error.BASE_ERROR_CODES.INVALID_REDIRECT_URL);if(label===\"errorCallbackURL\")throw import_error.APIError.from(\"FORBIDDEN\",import_error.BASE_ERROR_CODES.INVALID_ERROR_CALLBACK_URL);if(label===\"newUserCallbackURL\")throw import_error.APIError.from(\"FORBIDDEN\",import_error.BASE_ERROR_CODES.INVALID_NEW_USER_CALLBACK_URL);throw import_error.APIError.fromStatus(\"FORBIDDEN\",{message:`Invalid ${label}`})}},\"validateURL\");callbackURL&&validateURL(callbackURL,\"callbackURL\");redirectURL&&validateURL(redirectURL,\"redirectURL\");errorCallbackURL&&validateURL(errorCallbackURL,\"errorCallbackURL\");newUserCallbackURL&&validateURL(newUserCallbackURL,\"newUserCallbackURL\")});const originCheck=__name(getValue=>(0,import_api.createAuthMiddleware)(async ctx=>{if(!ctx.request)return;if(shouldSkipOriginCheck(ctx))return;const callbackURL=getValue(ctx);const validateURL=__name((url,label)=>{if(!url)return;if(!ctx.context.isTrustedOrigin(url,{allowRelativePaths:label!==\"origin\"})){ctx.context.logger.error(`Invalid ${label}: ${url}`);ctx.context.logger.info(`If it's a valid URL, please add ${url} to trustedOrigins in your auth config\n`,`Current list of trustedOrigins: ${ctx.context.trustedOrigins}`);if(label===\"origin\")throw import_error.APIError.from(\"FORBIDDEN\",import_error.BASE_ERROR_CODES.INVALID_ORIGIN);if(label===\"callbackURL\")throw import_error.APIError.from(\"FORBIDDEN\",import_error.BASE_ERROR_CODES.INVALID_CALLBACK_URL);if(label===\"redirectURL\")throw import_error.APIError.from(\"FORBIDDEN\",import_error.BASE_ERROR_CODES.INVALID_REDIRECT_URL);if(label===\"errorCallbackURL\")throw import_error.APIError.from(\"FORBIDDEN\",import_error.BASE_ERROR_CODES.INVALID_ERROR_CALLBACK_URL);if(label===\"newUserCallbackURL\")throw import_error.APIError.from(\"FORBIDDEN\",import_error.BASE_ERROR_CODES.INVALID_NEW_USER_CALLBACK_URL);throw import_error.APIError.fromStatus(\"FORBIDDEN\",{message:`Invalid ${label}`})}},\"validateURL\");const callbacks=Array.isArray(callbackURL)?callbackURL:[callbackURL];for(const url of callbacks)validateURL(url,\"callbackURL\")}),\"originCheck\");async function validateOrigin(ctx,forceValidate=false){const headers=ctx.request?.headers;if(!headers||!ctx.request)return;const originHeader=headers.get(\"origin\")||headers.get(\"referer\")||\"\";const useCookies=headers.has(\"cookie\");if(ctx.context.skipCSRFCheck)return;if(shouldSkipCSRFForBackwardCompat(ctx)){ctx.context.options.advanced?.disableOriginCheck===true&&logBackwardCompatWarning();return}if(shouldSkipOriginCheck(ctx))return;if(!(forceValidate||useCookies))return;if(!originHeader||originHeader===\"null\")throw import_error.APIError.from(\"FORBIDDEN\",import_error.BASE_ERROR_CODES.MISSING_OR_NULL_ORIGIN);const trustedOrigins=Array.isArray(ctx.context.options.trustedOrigins)?ctx.context.trustedOrigins:[...ctx.context.trustedOrigins,...(await ctx.context.options.trustedOrigins?.(ctx.request))?.filter(v=>Boolean(v))||[]];if(!trustedOrigins.some(origin=>(0,import_trusted_origins.matchesOriginPattern)(originHeader,origin))){ctx.context.logger.error(`Invalid origin: ${originHeader}`);ctx.context.logger.info(`If it's a valid URL, please add ${originHeader} to trustedOrigins in your auth config\n`,`Current list of trustedOrigins: ${trustedOrigins}`);throw import_error.APIError.from(\"FORBIDDEN\",import_error.BASE_ERROR_CODES.INVALID_ORIGIN)}}__name(validateOrigin,\"validateOrigin\");const formCsrfMiddleware=(0,import_api.createAuthMiddleware)(async ctx=>{if(!ctx.request)return;await validateFormCsrf(ctx)});async function validateFormCsrf(ctx){const req=ctx.request;if(!req)return;if(ctx.context.skipCSRFCheck)return;if(shouldSkipCSRFForBackwardCompat(ctx))return;const headers=req.headers;if(headers.has(\"cookie\"))return await validateOrigin(ctx);const site=headers.get(\"Sec-Fetch-Site\");const mode=headers.get(\"Sec-Fetch-Mode\");const dest=headers.get(\"Sec-Fetch-Dest\");if(Boolean(site&&site.trim()||mode&&mode.trim()||dest&&dest.trim())){if(site===\"cross-site\"&&mode===\"navigate\"){ctx.context.logger.error(\"Blocked cross-site navigation login attempt (CSRF protection)\",{secFetchSite:site,secFetchMode:mode,secFetchDest:dest});throw import_error.APIError.from(\"FORBIDDEN\",import_error.BASE_ERROR_CODES.CROSS_SITE_NAVIGATION_LOGIN_BLOCKED)}return await validateOrigin(ctx,true)}}__name(validateFormCsrf,\"validateFormCsrf\");0&&(module.exports={formCsrfMiddleware,originCheck,originCheckMiddleware});\n})()\n","warnings":[],"map":{"version":3,"mappings":";suBAAA,gQAAqC,0CACrC,iBAA2C,mCAC3C,eAAkC,uCAClC,eAAqC,iCACrC,qBAA0B,6CAS1B,SAAS,gCAAgC,IAAK,CAC7C,OAAO,IAAI,QAAQ,kBAAoB,MAAQ,IAAI,QAAQ,QAAQ,UAAU,mBAAqB,MACnG,CAFS,0EAOT,SAAS,sBAAsB,IAAK,CACnC,MAAM,gBAAkB,IAAI,QAAQ,gBACpC,GAAI,kBAAoB,KAAM,MAAO,MACrC,GAAI,MAAM,QAAQ,eAAe,GAAK,IAAI,QAAS,GAAI,CACtD,MAAM,SAAW,IAAI,IAAI,IAAI,QAAQ,OAAO,EAAE,SAC9C,MAAM,eAAc,8BAAkB,IAAI,QAAQ,IAAK,QAAQ,EAC/D,OAAO,gBAAgB,KAAM,UAAa,YAAY,WAAW,QAAQ,CAAC,CAC3E,MAAQ,CAAC,CACT,MAAO,MACR,CATS,sDAcT,MAAM,4BAA2B,4BAAU,gBAASA,2BAA2B,CAAC,EAArC,4BAAwC,2MAA2M,EAK9R,MAAM,yBAAwB,iCAAqB,MAAO,KAAQ,CACjE,GAAI,IAAI,SAAS,SAAW,OAAS,IAAI,SAAS,SAAW,WAAa,IAAI,SAAS,SAAW,QAAU,CAAC,IAAI,QAAS,OAC1H,MAAM,eAAe,GAAG,EACxB,GAAI,sBAAsB,GAAG,EAAG,OAChC,KAAM,CAAE,KAAM,KAAM,EAAI,IACxB,MAAM,YAAc,MAAM,aAAe,OAAO,YAChD,MAAM,YAAc,MAAM,WAC1B,MAAM,iBAAmB,MAAM,iBAC/B,MAAM,mBAAqB,MAAM,mBACjC,MAAM,YAAc,QAAC,IAAK,QAAU,CACnC,GAAI,CAAC,IAAK,OACV,GAAI,CAAC,IAAI,QAAQ,gBAAgB,IAAK,CAAE,mBAAoB,QAAU,QAAS,CAAC,EAAG,CAClF,IAAI,QAAQ,OAAO,MAAM,WAAW,KAAK,KAAK,GAAG,EAAE,EACnD,IAAI,QAAQ,OAAO,KAAK,mCAAmC,GAAG;AAAA,EAA4C,mCAAmC,IAAI,QAAQ,cAAc,EAAE,EACzK,GAAI,QAAU,SAAU,MAAM,sBAAS,KAAK,YAAa,8BAAiB,cAAc,EACxF,GAAI,QAAU,cAAe,MAAM,sBAAS,KAAK,YAAa,8BAAiB,oBAAoB,EACnG,GAAI,QAAU,cAAe,MAAM,sBAAS,KAAK,YAAa,8BAAiB,oBAAoB,EACnG,GAAI,QAAU,mBAAoB,MAAM,sBAAS,KAAK,YAAa,8BAAiB,0BAA0B,EAC9G,GAAI,QAAU,qBAAsB,MAAM,sBAAS,KAAK,YAAa,8BAAiB,6BAA6B,EACnH,MAAM,sBAAS,WAAW,YAAa,CAAE,QAAS,WAAW,KAAK,EAAG,CAAC,CACvE,CACD,EAZoB,eAapB,aAAe,YAAY,YAAa,aAAa,EACrD,aAAe,YAAY,YAAa,aAAa,EACrD,kBAAoB,YAAY,iBAAkB,kBAAkB,EACpE,oBAAsB,YAAY,mBAAoB,oBAAoB,CAC3E,CAAC,EACD,MAAM,YAAc,OAAC,aAAa,iCAAqB,MAAO,KAAQ,CACrE,GAAI,CAAC,IAAI,QAAS,OAClB,GAAI,sBAAsB,GAAG,EAAG,OAChC,MAAM,YAAc,SAAS,GAAG,EAChC,MAAM,YAAc,QAAC,IAAK,QAAU,CACnC,GAAI,CAAC,IAAK,OACV,GAAI,CAAC,IAAI,QAAQ,gBAAgB,IAAK,CAAE,mBAAoB,QAAU,QAAS,CAAC,EAAG,CAClF,IAAI,QAAQ,OAAO,MAAM,WAAW,KAAK,KAAK,GAAG,EAAE,EACnD,IAAI,QAAQ,OAAO,KAAK,mCAAmC,GAAG;AAAA,EAA4C,mCAAmC,IAAI,QAAQ,cAAc,EAAE,EACzK,GAAI,QAAU,SAAU,MAAM,sBAAS,KAAK,YAAa,8BAAiB,cAAc,EACxF,GAAI,QAAU,cAAe,MAAM,sBAAS,KAAK,YAAa,8BAAiB,oBAAoB,EACnG,GAAI,QAAU,cAAe,MAAM,sBAAS,KAAK,YAAa,8BAAiB,oBAAoB,EACnG,GAAI,QAAU,mBAAoB,MAAM,sBAAS,KAAK,YAAa,8BAAiB,0BAA0B,EAC9G,GAAI,QAAU,qBAAsB,MAAM,sBAAS,KAAK,YAAa,8BAAiB,6BAA6B,EACnH,MAAM,sBAAS,WAAW,YAAa,CAAE,QAAS,WAAW,KAAK,EAAG,CAAC,CACvE,CACD,EAZoB,eAapB,MAAM,UAAY,MAAM,QAAQ,WAAW,EAAI,YAAc,CAAC,WAAW,EACzE,UAAW,OAAO,UAAW,YAAY,IAAK,aAAa,CAC5D,CAAC,EAnBmB,eAyBpB,eAAe,eAAe,IAAK,cAAgB,MAAO,CACzD,MAAM,QAAU,IAAI,SAAS,QAC7B,GAAI,CAAC,SAAW,CAAC,IAAI,QAAS,OAC9B,MAAM,aAAe,QAAQ,IAAI,QAAQ,GAAK,QAAQ,IAAI,SAAS,GAAK,GACxE,MAAM,WAAa,QAAQ,IAAI,QAAQ,EACvC,GAAI,IAAI,QAAQ,cAAe,OAC/B,GAAI,gCAAgC,GAAG,EAAG,CACzC,IAAI,QAAQ,QAAQ,UAAU,qBAAuB,MAAQ,yBAAyB,EACtF,MACD,CACA,GAAI,sBAAsB,GAAG,EAAG,OAChC,GAAI,EAAE,eAAiB,YAAa,OACpC,GAAI,CAAC,cAAgB,eAAiB,OAAQ,MAAM,sBAAS,KAAK,YAAa,8BAAiB,sBAAsB,EACtH,MAAM,eAAiB,MAAM,QAAQ,IAAI,QAAQ,QAAQ,cAAc,EAAI,IAAI,QAAQ,eAAiB,CAAC,GAAG,IAAI,QAAQ,eAAgB,IAAI,MAAM,IAAI,QAAQ,QAAQ,iBAAiB,IAAI,OAAO,IAAI,OAAQ,GAAM,QAAQ,CAAC,CAAC,GAAK,CAAC,CAAC,EACrO,GAAI,CAAC,eAAe,KAAM,WAAW,6CAAqB,aAAc,MAAM,CAAC,EAAG,CACjF,IAAI,QAAQ,OAAO,MAAM,mBAAmB,YAAY,EAAE,EAC1D,IAAI,QAAQ,OAAO,KAAK,mCAAmC,YAAY;AAAA,EAA4C,mCAAmC,cAAc,EAAE,EACtK,MAAM,sBAAS,KAAK,YAAa,8BAAiB,cAAc,CACjE,CACD,CAnBe,wCAwBf,MAAM,sBAAqB,iCAAqB,MAAO,KAAQ,CAC9D,GAAI,CAAC,IAAI,QAAS,OAClB,MAAM,iBAAiB,GAAG,CAC3B,CAAC,EAKD,eAAe,iBAAiB,IAAK,CACpC,MAAM,IAAM,IAAI,QAChB,GAAI,CAAC,IAAK,OACV,GAAI,IAAI,QAAQ,cAAe,OAC/B,GAAI,gCAAgC,GAAG,EAAG,OAC1C,MAAM,QAAU,IAAI,QACpB,GAAI,QAAQ,IAAI,QAAQ,EAAG,OAAO,MAAM,eAAe,GAAG,EAC1D,MAAM,KAAO,QAAQ,IAAI,gBAAgB,EACzC,MAAM,KAAO,QAAQ,IAAI,gBAAgB,EACzC,MAAM,KAAO,QAAQ,IAAI,gBAAgB,EACzC,GAAI,QAAQ,MAAQ,KAAK,KAAK,GAAK,MAAQ,KAAK,KAAK,GAAK,MAAQ,KAAK,KAAK,CAAC,EAAG,CAC/E,GAAI,OAAS,cAAgB,OAAS,WAAY,CACjD,IAAI,QAAQ,OAAO,MAAM,gEAAiE,CACzF,aAAc,KACd,aAAc,KACd,aAAc,IACf,CAAC,EACD,MAAM,sBAAS,KAAK,YAAa,8BAAiB,mCAAmC,CACtF,CACA,OAAO,MAAM,eAAe,IAAK,IAAI,CACtC,CACD,CArBe","names":["logBackwardCompatWarning"],"ignoreList":[],"sources":["/opt/canhelp/node_modules/better-auth/dist/api/middlewares/origin-check.mjs"],"sourcesContent":[null]}}