diff --git a/.changeset/bearer-redirects.md b/.changeset/bearer-redirects.md deleted file mode 100644 index 769d68a..0000000 --- a/.changeset/bearer-redirects.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -'@seamless-auth/client': minor -'@seamless-auth/react': patch -'@seamless-auth/react-native': patch ---- - -In bearer transport, a request that carries a token no longer follows a redirect to an origin outside `apiHost` and `trustedOrigins`. The client asks `fetch` for `redirect: 'manual'`, follows a redirect to a trusted origin itself (up to five hops, turning a `303`, or a `301` or `302` after a POST, into a GET as `fetch` does), and rejects any other with the new `UntrustedRedirectError` without sending the token on. Where the platform follows redirects regardless, as React Native's `fetch` does, a response that ended on another origin is rejected instead. A caller that sets `redirect` itself keeps that choice, and the final-origin check still applies. Requests without a token, and cookie transport, are unchanged. diff --git a/.changeset/same-origin-authorized-fetch.md b/.changeset/same-origin-authorized-fetch.md deleted file mode 100644 index 8280ea3..0000000 --- a/.changeset/same-origin-authorized-fetch.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@seamless-auth/client': patch ---- - -`authorizedFetch` works again for an app that serves `/auth` on its own origin (`apiHost: ""`, as ``). Since 0.5.0 it refused every path in that setup with `UntrustedOriginError`, because a path stayed relative and the origin check could not read an origin from it. A path now resolves on the page's own origin, which is trusted. Without a page (server rendering, React Native) an empty `apiHost` still sends nothing. diff --git a/packages/angular/CHANGELOG.md b/packages/angular/CHANGELOG.md index a119519..1bb057e 100644 --- a/packages/angular/CHANGELOG.md +++ b/packages/angular/CHANGELOG.md @@ -1,5 +1,13 @@ # @seamless-auth/angular +## 0.3.1 + +### Patch Changes + +- Updated dependencies [782583c] +- Updated dependencies [e3cf1f9] + - @seamless-auth/client@0.7.0 + ## 0.3.0 ### Minor Changes diff --git a/packages/angular/package.json b/packages/angular/package.json index a78cb80..543825a 100644 --- a/packages/angular/package.json +++ b/packages/angular/package.json @@ -1,6 +1,6 @@ { "name": "@seamless-auth/angular", - "version": "0.3.0", + "version": "0.3.1", "description": "Angular bindings for Seamless Auth: a signal-based auth service, route guards, and optional sign-in screens.", "type": "module", "engines": { @@ -43,7 +43,7 @@ "rxjs": "^7.4.0" }, "dependencies": { - "@seamless-auth/client": "^0.6.0", + "@seamless-auth/client": "^0.7.0", "tslib": "^2.7.0" }, "sideEffects": [ diff --git a/packages/client/CHANGELOG.md b/packages/client/CHANGELOG.md index 3061704..b6bfde1 100644 --- a/packages/client/CHANGELOG.md +++ b/packages/client/CHANGELOG.md @@ -1,5 +1,15 @@ # @seamless-auth/client +## 0.7.0 + +### Minor Changes + +- 782583c: In bearer transport, a request that carries a token no longer follows a redirect to an origin outside `apiHost` and `trustedOrigins`. The client asks `fetch` for `redirect: 'manual'`, follows a redirect to a trusted origin itself (up to five hops, turning a `303`, or a `301` or `302` after a POST, into a GET as `fetch` does), and rejects any other with the new `UntrustedRedirectError` without sending the token on. Where the platform follows redirects regardless, as React Native's `fetch` does, a response that ended on another origin is rejected instead. A caller that sets `redirect` itself keeps that choice, and the final-origin check still applies. Requests without a token, and cookie transport, are unchanged. + +### Patch Changes + +- e3cf1f9: `authorizedFetch` works again for an app that serves `/auth` on its own origin (`apiHost: ""`, as ``). Since 0.5.0 it refused every path in that setup with `UntrustedOriginError`, because a path stayed relative and the origin check could not read an origin from it. A path now resolves on the page's own origin, which is trusted. Without a page (server rendering, React Native) an empty `apiHost` still sends nothing. + ## 0.6.0 ### Minor Changes diff --git a/packages/client/package.json b/packages/client/package.json index 8bd8f12..8b7ff18 100644 --- a/packages/client/package.json +++ b/packages/client/package.json @@ -1,6 +1,6 @@ { "name": "@seamless-auth/client", - "version": "0.6.0", + "version": "0.7.0", "description": "Framework-agnostic client core for Seamless Auth: the HTTP client, session store, and result types the framework bindings share.", "type": "module", "exports": { diff --git a/packages/react-native/CHANGELOG.md b/packages/react-native/CHANGELOG.md index e29994d..84077f3 100644 --- a/packages/react-native/CHANGELOG.md +++ b/packages/react-native/CHANGELOG.md @@ -1,5 +1,14 @@ # @seamless-auth/react-native +## 0.3.2 + +### Patch Changes + +- 782583c: In bearer transport, a request that carries a token no longer follows a redirect to an origin outside `apiHost` and `trustedOrigins`. The client asks `fetch` for `redirect: 'manual'`, follows a redirect to a trusted origin itself (up to five hops, turning a `303`, or a `301` or `302` after a POST, into a GET as `fetch` does), and rejects any other with the new `UntrustedRedirectError` without sending the token on. Where the platform follows redirects regardless, as React Native's `fetch` does, a response that ended on another origin is rejected instead. A caller that sets `redirect` itself keeps that choice, and the final-origin check still applies. Requests without a token, and cookie transport, are unchanged. +- Updated dependencies [782583c] +- Updated dependencies [e3cf1f9] + - @seamless-auth/client@0.7.0 + ## 0.3.1 ### Patch Changes diff --git a/packages/react-native/package.json b/packages/react-native/package.json index e88ba30..1d051a2 100644 --- a/packages/react-native/package.json +++ b/packages/react-native/package.json @@ -1,6 +1,6 @@ { "name": "@seamless-auth/react-native", - "version": "0.3.1", + "version": "0.3.2", "description": "Headless React Native binding for Seamless Auth: provider, hooks, and the native ports for passkeys, secure token storage, and in-app browser OAuth.", "type": "module", "exports": { @@ -45,7 +45,7 @@ "react": "^18.0.0 || ^19.0.0" }, "dependencies": { - "@seamless-auth/client": "^0.6.0", + "@seamless-auth/client": "^0.7.0", "@seamless-auth/types": "^0.28.0" }, "sideEffects": false diff --git a/packages/react/CHANGELOG.md b/packages/react/CHANGELOG.md index 117777f..683d3b0 100644 --- a/packages/react/CHANGELOG.md +++ b/packages/react/CHANGELOG.md @@ -1,5 +1,14 @@ # @seamless-auth/react +## 0.17.1 + +### Patch Changes + +- 782583c: In bearer transport, a request that carries a token no longer follows a redirect to an origin outside `apiHost` and `trustedOrigins`. The client asks `fetch` for `redirect: 'manual'`, follows a redirect to a trusted origin itself (up to five hops, turning a `303`, or a `301` or `302` after a POST, into a GET as `fetch` does), and rejects any other with the new `UntrustedRedirectError` without sending the token on. Where the platform follows redirects regardless, as React Native's `fetch` does, a response that ended on another origin is rejected instead. A caller that sets `redirect` itself keeps that choice, and the final-origin check still applies. Requests without a token, and cookie transport, are unchanged. +- Updated dependencies [782583c] +- Updated dependencies [e3cf1f9] + - @seamless-auth/client@0.7.0 + ## 0.17.0 ### Minor Changes diff --git a/packages/react/package.json b/packages/react/package.json index 84fe37e..6d4d396 100644 --- a/packages/react/package.json +++ b/packages/react/package.json @@ -1,6 +1,6 @@ { "name": "@seamless-auth/react", - "version": "0.17.0", + "version": "0.17.1", "description": "A drop-in authentication solution for modern React applications.", "type": "module", "exports": { @@ -56,7 +56,7 @@ } }, "dependencies": { - "@seamless-auth/client": "^0.6.0", + "@seamless-auth/client": "^0.7.0", "@seamless-auth/types": "^0.28.0", "@simplewebauthn/browser": "^13.1.0", "libphonenumber-js": "^1.12.7" diff --git a/packages/svelte/CHANGELOG.md b/packages/svelte/CHANGELOG.md index 1194422..8d7cb8d 100644 --- a/packages/svelte/CHANGELOG.md +++ b/packages/svelte/CHANGELOG.md @@ -1,5 +1,13 @@ # @seamless-auth/svelte +## 0.2.1 + +### Patch Changes + +- Updated dependencies [782583c] +- Updated dependencies [e3cf1f9] + - @seamless-auth/client@0.7.0 + ## 0.2.0 ### Minor Changes diff --git a/packages/svelte/package.json b/packages/svelte/package.json index 0cf79f5..e4c1129 100644 --- a/packages/svelte/package.json +++ b/packages/svelte/package.json @@ -1,6 +1,6 @@ { "name": "@seamless-auth/svelte", - "version": "0.2.0", + "version": "0.2.1", "description": "Svelte bindings for Seamless Auth: a rune-based session, SvelteKit guards, and optional sign-in screens.", "type": "module", "svelte": "./dist/index.js", @@ -70,7 +70,7 @@ } }, "dependencies": { - "@seamless-auth/client": "^0.6.0" + "@seamless-auth/client": "^0.7.0" }, "sideEffects": [ "*.css" diff --git a/packages/vue/CHANGELOG.md b/packages/vue/CHANGELOG.md index 92d9eb5..26c56f7 100644 --- a/packages/vue/CHANGELOG.md +++ b/packages/vue/CHANGELOG.md @@ -1,5 +1,13 @@ # @seamless-auth/vue +## 0.2.1 + +### Patch Changes + +- Updated dependencies [782583c] +- Updated dependencies [e3cf1f9] + - @seamless-auth/client@0.7.0 + ## 0.2.0 ### Minor Changes diff --git a/packages/vue/package.json b/packages/vue/package.json index b8820ef..a4ea6dd 100644 --- a/packages/vue/package.json +++ b/packages/vue/package.json @@ -1,6 +1,6 @@ { "name": "@seamless-auth/vue", - "version": "0.2.0", + "version": "0.2.1", "description": "Vue bindings for Seamless Auth: a plugin and composable for session state, route guards, and optional sign-in screens.", "type": "module", "exports": { @@ -63,7 +63,7 @@ } }, "dependencies": { - "@seamless-auth/client": "^0.6.0" + "@seamless-auth/client": "^0.7.0" }, "sideEffects": [ "*.css"