@_mustachio/openauth 0.13.2 → 0.14.0

package/dist/esm/client.js

@@ -37,59 +37,59 @@ function createClient(input) {
     jwksCache.set(issuer, result);
     return result;
   }
+  function applyClientAuth(headers, body) {
+    const secret = input.clientSecret;
+    if (secret === undefined)
+      return;
+    if ((input.tokenEndpointAuthMethod ?? "client_secret_basic") === "client_secret_post") {
+      body.set("client_secret", secret);
+      return;
+    }
+    const cred = `${encodeURIComponent(input.clientID)}:${encodeURIComponent(secret)}`;
+    headers["authorization"] = `Basic ${btoa(cred)}`;
+  }
   const result = {
-    async authorize(redirectURI, response, opts) {
-      const result = new URL(issuer + "/authorize");
+    async authorize(redirectURI, opts) {
+      const wk = await getIssuer();
+      const url = new URL(wk.authorization_endpoint);
+      const pkce = await generatePKCE();
       const challenge = {
-        state: crypto.randomUUID()
+        state: crypto.randomUUID(),
+        verifier: pkce.verifier
       };
-      result.searchParams.set("client_id", input.clientID);
-      result.searchParams.set("redirect_uri", redirectURI);
-      result.searchParams.set("response_type", response);
-      result.searchParams.set("state", challenge.state);
+      url.searchParams.set("client_id", input.clientID);
+      url.searchParams.set("redirect_uri", redirectURI);
+      url.searchParams.set("response_type", "code");
+      url.searchParams.set("state", challenge.state);
+      url.searchParams.set("code_challenge_method", "S256");
+      url.searchParams.set("code_challenge", pkce.challenge);
       if (opts?.provider)
-        result.searchParams.set("provider", opts.provider);
+        url.searchParams.set("provider", opts.provider);
       if (opts?.scope !== undefined) {
         const scope = Array.isArray(opts.scope) ? opts.scope.join(" ") : opts.scope;
         if (scope)
-          result.searchParams.set("scope", scope);
-      }
-      if (opts?.pkce && response === "code") {
-        const pkce = await generatePKCE();
-        result.searchParams.set("code_challenge_method", "S256");
-        result.searchParams.set("code_challenge", pkce.challenge);
-        challenge.verifier = pkce.verifier;
+          url.searchParams.set("scope", scope);
       }
-      return {
-        challenge,
-        url: result.toString()
-      };
-    },
-    async pkce(redirectURI, opts) {
-      const result = new URL(issuer + "/authorize");
-      if (opts?.provider)
-        result.searchParams.set("provider", opts.provider);
-      result.searchParams.set("client_id", input.clientID);
-      result.searchParams.set("redirect_uri", redirectURI);
-      result.searchParams.set("response_type", "code");
-      const pkce = await generatePKCE();
-      result.searchParams.set("code_challenge_method", "S256");
-      result.searchParams.set("code_challenge", pkce.challenge);
-      return [pkce.verifier, result.toString()];
+      return { challenge, url: url.toString() };
     },
     async exchange(code, redirectURI, verifier) {
-      const tokens = await f(issuer + "/token", {
+      const wk = await getIssuer();
+      const body = new URLSearchParams({
+        code,
+        redirect_uri: redirectURI,
+        grant_type: "authorization_code",
+        client_id: input.clientID
+      });
+      if (verifier)
+        body.set("code_verifier", verifier);
+      const headers = {
+        "Content-Type": "application/x-www-form-urlencoded"
+      };
+      applyClientAuth(headers, body);
+      const tokens = await f(wk.token_endpoint, {
         method: "POST",
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded"
-        },
-        body: new URLSearchParams({
-          code,
-          redirect_uri: redirectURI,
-          grant_type: "authorization_code",
-          client_id: input.clientID,
-          code_verifier: verifier || ""
-        }).toString()
+        headers,
+        body: body.toString()
       });
       const json = await tokens.json();
       if (!tokens.ok) {
@@ -121,15 +121,20 @@ function createClient(input) {
           };
         }
       }
-      const tokens = await f(issuer + "/token", {
+      const wk = await getIssuer();
+      const body = new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: refresh,
+        client_id: input.clientID
+      });
+      const headers = {
+        "Content-Type": "application/x-www-form-urlencoded"
+      };
+      applyClientAuth(headers, body);
+      const tokens = await f(wk.token_endpoint, {
         method: "POST",
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded"
-        },
-        body: new URLSearchParams({
-          grant_type: "refresh_token",
-          refresh_token: refresh
-        }).toString()
+        headers,
+        body: body.toString()
       });
       const json = await tokens.json();
       if (!tokens.ok) {
@@ -151,30 +156,24 @@ function createClient(input) {
       const jwks = await getJWKS();
       try {
         const result = await jwtVerify(token, jwks, {
-          issuer
+          issuer,
+          audience: options?.audience ?? input.clientID
         });
         const claim = result.payload.claim;
-        let subjectType;
-        let subjectProperties;
-        if (claim && typeof claim.type === "string") {
-          subjectType = claim.type;
-          subjectProperties = claim.properties;
-        } else if (result.payload.mode === "access" && typeof result.payload.type === "string") {
-          subjectType = result.payload.type;
-          subjectProperties = result.payload.properties;
-        }
-        if (subjectType === undefined) {
+        if (!claim || typeof claim.type !== "string") {
           return { err: new InvalidSubjectError };
         }
+        const subjectType = claim.type;
         const schema = subjects[subjectType];
         if (!schema) {
           return { err: new InvalidSubjectError };
         }
-        const validated = await schema["~standard"].validate(subjectProperties);
+        const validated = await schema["~standard"].validate(claim.properties);
         if (validated.issues) {
           return { err: new InvalidSubjectError };
         }
         return {
+          err: false,
           aud: result.payload.aud,
           subject: {
             type: subjectType,

package/dist/esm/domain/authorize.js

@@ -4,6 +4,7 @@ import { err, isErr, ok } from "../types/result";
 import { safeAudit } from "./audit";
 import { randomId, randomToken } from "./crypto";
 import { dispatchMethod } from "./method-dispatch";
+import { callbackTarget } from "./mount";
 import { mintStateEnvelope } from "./state-envelope";
 import { saveEncryptedCode } from "./token";
 var DEFAULT_FLOW_TTL_MS = 10 * 60 * 1000;
@@ -54,9 +55,15 @@ async function startAuthorize(input, deps) {
   const nonce = (deps.newNonce ?? randomToken)();
   const flowTtl = deps.flowTtlMs ?? DEFAULT_FLOW_TTL_MS;
   const now = deps.clock();
-  const callbackHost = deps.callbackHostFor?.(tenant.id) ?? new URL(deps.issuerUrl).host;
-  const callbackPath = `/cb/${methodId}`;
-  const callbackUrl = `${new URL(deps.issuerUrl).protocol}//${callbackHost}${callbackPath}`;
+  const {
+    host: callbackHost,
+    path: callbackPath,
+    url: callbackUrl
+  } = callbackTarget({
+    issuerUrl: deps.issuerUrl,
+    methodId,
+    callbackHost: deps.callbackHostFor?.(tenant.id)
+  });
   const record = {
     flowId,
     tenantId: tenant.id,
@@ -103,6 +110,7 @@ async function startAuthorize(input, deps) {
     flow: record,
     cookies: input.cookies,
     sessionStore: deps.sessionStore,
+    issuerUrl: deps.issuerUrl,
     dispatch: {
       state: stateEnvelope,
       callbackUrl,
@@ -203,6 +211,16 @@ async function issueCodeFromInlineSuccess(result, record, deps) {
   }, AUTH_CODE_TTL_MS, { keyStore: deps.keyStore, tokenStore: deps.tokenStore });
   if (isErr(saved))
     return err(saved.error);
+  await safeAudit(deps, {
+    kind: "authorize_succeeded",
+    tenantId: flow.tenantId,
+    clientId: flow.clientId,
+    methodId: flow.methodId,
+    methodKind: flow.methodKind,
+    flowId: flow.flowId,
+    providerSubject: result.providerSubject,
+    timestamp: now
+  });
   return ok({
     kind: "issue-code",
     code,

package/dist/esm/domain/callback.js

@@ -4,27 +4,10 @@ import { err, isErr, ok } from "../types/result";
 import { safeAudit } from "./audit";
 import { randomToken } from "./crypto";
 import { dispatchMethod } from "./method-dispatch";
+import { callbackTarget } from "./mount";
 import { saveEncryptedCode } from "./token";
-import { verifyStateEnvelope } from "./state-envelope";
+import { extractCallbackState, verifyStateEnvelope } from "./state-envelope";
 import { AUTH_CODE_TTL_MS } from "./authorize";
-async function extractCallbackState(req) {
-  const fromQuery = new URL(req.url).searchParams.get("state");
-  if (fromQuery)
-    return fromQuery;
-  if (req.method !== "POST")
-    return null;
-  const ct = req.headers.get("content-type") ?? "";
-  if (!ct.includes("application/x-www-form-urlencoded"))
-    return null;
-  try {
-    const body = await req.clone().text();
-    const form = new URLSearchParams(body);
-    const v = form.get("state") ?? form.get("RelayState");
-    return v && v.length > 0 ? v : null;
-  } catch {
-    return null;
-  }
-}
 async function handleCallback(input, deps) {
   const url = new URL(input.rawRequest.url);
   const state = await extractCallbackState(input.rawRequest);
@@ -114,6 +97,7 @@ async function handleCallback(input, deps) {
     flow,
     cookies: input.cookies,
     sessionStore: deps.sessionStore,
+    issuerUrl: input.issuerUrl,
     dispatch: null
   });
   if (isErr(dispatched))
@@ -145,6 +129,16 @@ async function translate(result, flow, deps) {
       }, AUTH_CODE_TTL_MS, { keyStore: deps.keyStore, tokenStore: deps.tokenStore });
       if (isErr(saved))
         return err(saved.error);
+      await safeAudit(deps, {
+        kind: "authorize_succeeded",
+        tenantId: flow.tenantId,
+        clientId: flow.clientId,
+        methodId: flow.methodId,
+        methodKind: flow.methodKind,
+        flowId: flow.flowId,
+        providerSubject: result.providerSubject,
+        timestamp: now
+      });
       return ok({
         kind: "issue-code",
         code,
@@ -192,7 +186,7 @@ async function translate(result, flow, deps) {
 async function tryIdpInitiated(input, deps, url) {
   if (input.rawRequest.method !== "POST")
     return null;
-  if (!input.tenant || !input.issuerUrl)
+  if (!input.tenant)
     return null;
   const segments = url.pathname.split("/").filter(Boolean);
   if (segments.length < 2 || segments[0] !== "cb")
@@ -204,7 +198,11 @@ async function tryIdpInitiated(input, deps, url) {
   const method = methodRes.value;
   if (method.unsolicitedCallback !== true)
     return null;
-  const callbackUrl = `${url.protocol}//${url.host}/cb/${methodId}`;
+  const { url: callbackUrl } = callbackTarget({
+    issuerUrl: input.issuerUrl,
+    methodId,
+    callbackHost: url.host
+  });
   const dispatched = await dispatchMethod({
     method,
     route: "GET /callback",
@@ -214,6 +212,7 @@ async function tryIdpInitiated(input, deps, url) {
     flow: null,
     cookies: input.cookies,
     sessionStore: deps.sessionStore,
+    issuerUrl: input.issuerUrl,
     dispatch: { state: "", callbackUrl, issuerUrl: input.issuerUrl }
   });
   if (isErr(dispatched))
@@ -275,6 +274,16 @@ async function tryIdpInitiated(input, deps, url) {
   }, AUTH_CODE_TTL_MS, { keyStore: deps.keyStore, tokenStore: deps.tokenStore });
   if (isErr(saved))
     return err(saved.error);
+  await safeAudit(deps, {
+    kind: "authorize_succeeded",
+    tenantId: input.tenant.id,
+    clientId: binding.clientId,
+    methodId,
+    methodKind: method.kind,
+    flowId: "",
+    providerSubject: result.providerSubject,
+    timestamp: now
+  });
   return ok({
     kind: "issue-code",
     code,

package/dist/esm/domain/client-credentials.js

@@ -4,6 +4,8 @@ import { err, isErr, ok } from "../types/result";
 import { verifyClientCredentials } from "./client-auth";
 import { randomId } from "./crypto";
 import { mintTokens } from "./token";
+import { safeAudit } from "./audit";
+import { validateSubjectClaim } from "./subject";
 async function clientCredentialsGrant(req, deps, tenantId) {
   const tenantCfg = await deps.configStore.getTenantConfig(tenantId);
   if (isErr(tenantCfg))
@@ -67,6 +69,20 @@ async function clientCredentialsGrant(req, deps, tenantId) {
   } catch (e) {
     return err(authError.serverError("success callback threw", e));
   }
+  const checked = await validateSubjectClaim(deps.subjects, claim);
+  if (isErr(checked)) {
+    await safeAudit(deps, {
+      kind: "invalid_subject_claim",
+      tenantId: tenant.id,
+      clientId: client.id,
+      subjectType: checked.error.rejection.subjectType,
+      reason: checked.error.rejection.reason,
+      detail: checked.error.rejection.detail,
+      timestamp: deps.clock()
+    });
+    return err(checked.error);
+  }
+  claim = checked.value;
   const minted = await mintTokens({
     tenant,
     claim,

package/dist/esm/domain/method-dispatch.js

@@ -8,6 +8,7 @@ async function dispatchMethod(input) {
   }
   const ctx = {
     request: input.request,
+    issuerUrl: input.issuerUrl,
     subPath: input.subPath,
     tenant: input.tenant,
     flow: input.flow,

package/dist/esm/domain/method-route.js

@@ -38,6 +38,7 @@ async function handleMethodRoute(input, deps) {
     flow,
     cookies: input.cookies,
     sessionStore: deps.sessionStore,
+    issuerUrl: input.issuerUrl,
     dispatch: null
   });
   if (isErr(dispatched))
@@ -73,6 +74,16 @@ async function translate(result, flow, deps) {
       }, AUTH_CODE_TTL_MS, { keyStore: deps.keyStore, tokenStore: deps.tokenStore });
       if (isErr(saved))
         return err(saved.error);
+      await safeAudit(deps, {
+        kind: "authorize_succeeded",
+        tenantId: final.tenantId,
+        clientId: final.clientId,
+        methodId: final.methodId,
+        methodKind: final.methodKind,
+        flowId: final.flowId,
+        providerSubject: result.providerSubject,
+        timestamp: now
+      });
       return ok({
         kind: "issue-code",
         code,
@@ -120,6 +131,7 @@ async function handlePublicMethodRoute(input, deps) {
     flow: null,
     cookies: new Map,
     sessionStore: deps.sessionStore,
+    issuerUrl: input.dispatch.issuerUrl,
     dispatch: input.dispatch
   });
   if (isErr(dispatched))

package/dist/esm/domain/mount.js

@@ -0,0 +1,29 @@
+// src/domain/mount.ts
+function mountPath(issuerUrl) {
+  let pathname;
+  try {
+    pathname = new URL(issuerUrl).pathname;
+  } catch {
+    return "";
+  }
+  const segments = pathname.split("/").filter(Boolean);
+  return segments.length === 0 ? "" : `/${segments.join("/")}`;
+}
+function mountedPath(issuerUrl, path) {
+  return `${mountPath(issuerUrl)}${path}`;
+}
+function callbackTarget(input) {
+  const issuer = new URL(input.issuerUrl);
+  const host = input.callbackHost ?? issuer.host;
+  const path = `/cb/${input.methodId}`;
+  return {
+    host,
+    path,
+    url: `${issuer.protocol}//${host}${mountPath(input.issuerUrl)}${path}`
+  };
+}
+export {
+  callbackTarget,
+  mountPath,
+  mountedPath
+};

package/dist/esm/domain/refresh.js

@@ -4,6 +4,16 @@ import { err, isErr } from "../types/result";
 import { safeAudit } from "./audit";
 import { verifyClientCredentials } from "./client-auth";
 import { mintTokens } from "./token";
+function validateRequestedScopes(requested, granted) {
+  if (!requested)
+    return null;
+  for (const s of requested.split(" ").filter(Boolean)) {
+    if (!granted.includes(s)) {
+      return authError.invalidScope(`requested scope "${s}" not granted by original refresh token`);
+    }
+  }
+  return null;
+}
 async function refreshTokens(req, deps) {
   const peek = await deps.tokenStore.peekRefresh(req.refreshToken);
   if (isErr(peek))
@@ -39,6 +49,9 @@ async function refreshTokens(req, deps) {
       return err(authError.invalidDpopProof("refresh token DPoP jkt does not match the original binding"));
     }
   }
+  const scopeErr = validateRequestedScopes(req.scope, peekedPayload.scopes);
+  if (scopeErr)
+    return err(scopeErr);
   const consumed = await deps.tokenStore.consumeRefresh(req.refreshToken, {
     reuseWindowMs: deps.reuseWindowMs
   });
@@ -56,12 +69,10 @@ async function refreshTokens(req, deps) {
     return err(consumed.error);
   }
   const payload = consumed.value;
+  const authoritativeScopeErr = validateRequestedScopes(req.scope, payload.scopes);
+  if (authoritativeScopeErr)
+    return err(authoritativeScopeErr);
   const requestedScopes = req.scope ? req.scope.split(" ").filter(Boolean) : payload.scopes;
-  for (const s of requestedScopes) {
-    if (!payload.scopes.includes(s)) {
-      return err(authError.invalidScope(`requested scope "${s}" not granted by original refresh token`));
-    }
-  }
   const tenant = {
     id: payload.tenantId,
     config: tenantCfg.value,

package/dist/esm/domain/register.js

@@ -50,12 +50,18 @@ async function registerNewClient(request, tenant, deps) {
   };
   const hookResult = await deps.registerClient({
     tenant,
-    request
+    request,
+    client: clientConfig,
+    ...secret !== undefined ? { secret } : {}
   });
   if (isErr(hookResult))
     return err(hookResult.error);
   const persisted = hookResult.value.client;
-  const persistedSecret = hookResult.value.secret;
+  const keptOurSecret = persisted.type === "confidential" && clientConfig.type === "confidential" && persisted.secretHash === clientConfig.secretHash;
+  const persistedSecret = hookResult.value.secret ?? (keptOurSecret ? secret : undefined);
+  if (persisted.type === "confidential" && persistedSecret === undefined) {
+    return err(authError.serverError("registerClient persisted a confidential client with a substituted " + "secretHash but returned no matching plaintext secret"));
+  }
   const issuedAt = Math.floor(deps.clock() / 1000);
   return ok({
     client_id: persisted.id,

package/dist/esm/domain/state-envelope.js

@@ -74,7 +74,26 @@ function isEnvelopeShape(value) {
   const v = value;
   return typeof v.tenantId === "string" && typeof v.flowId === "string" && typeof v.nonce === "string" && typeof v.kid === "string";
 }
+async function extractCallbackState(req) {
+  const fromQuery = new URL(req.url).searchParams.get("state");
+  if (fromQuery)
+    return fromQuery;
+  if (req.method !== "POST")
+    return null;
+  const ct = req.headers.get("content-type") ?? "";
+  if (!ct.toLowerCase().includes("application/x-www-form-urlencoded")) {
+    return null;
+  }
+  try {
+    const form = new URLSearchParams(await req.clone().text());
+    const v = form.get("state") ?? form.get("RelayState");
+    return v && v.length > 0 ? v : null;
+  } catch {
+    return null;
+  }
+}
 export {
+  extractCallbackState,
   mintStateEnvelope,
   verifyStateEnvelope
 };

package/dist/esm/domain/subject.js

@@ -0,0 +1,35 @@
+// src/domain/subject.ts
+import { authError } from "../types/error";
+import { err, ok } from "../types/result";
+async function validateSubjectClaim(subjects, claim) {
+  const declared = Object.keys(subjects);
+  const subjectType = typeof claim?.type === "string" ? claim.type : "";
+  const schema = subjectType ? subjects[subjectType] : undefined;
+  if (!schema) {
+    return err(Object.assign(authError.serverError(`success() returned subject type "${subjectType}", which is not declared in \`subjects\``), {
+      rejection: {
+        reason: "unknown-type",
+        subjectType,
+        detail: `declared: ${declared.join(", ") || "(none)"}`
+      }
+    }));
+  }
+  const validated = await schema["~standard"].validate(claim.properties);
+  if (validated.issues) {
+    const detail = validated.issues.map((i) => (i.path ?? []).map(String).join(".") || "(root)").join(", ") || "(root)";
+    return err(Object.assign(authError.serverError(`success() returned properties that violate the "${subjectType}" schema`), {
+      rejection: {
+        reason: "invalid-properties",
+        subjectType,
+        detail
+      }
+    }));
+  }
+  return ok({
+    type: subjectType,
+    properties: validated.value
+  });
+}
+export {
+  validateSubjectClaim
+};

package/dist/esm/domain/token.js

@@ -15,6 +15,7 @@ import {
 import { buildIdTokenClaims, shouldIssueIdToken } from "./id-token";
 import { signAccessToken, signIdToken } from "./jwt";
 import { validatePkce } from "./pkce";
+import { validateSubjectClaim } from "./subject";
 async function saveEncryptedCode(code, payload, ttl, deps) {
   const keyResult = await deps.keyStore.currentEncryptionKey();
   if (isErr(keyResult))
@@ -91,6 +92,20 @@ async function exchangeCode(req, deps) {
   } catch (e) {
     return err(authError.serverError("success callback threw", e));
   }
+  const checked = await validateSubjectClaim(deps.subjects, claim);
+  if (isErr(checked)) {
+    await safeAudit(deps, {
+      kind: "invalid_subject_claim",
+      tenantId: payload.tenantId,
+      clientId: payload.clientId,
+      subjectType: checked.error.rejection.subjectType,
+      reason: checked.error.rejection.reason,
+      detail: checked.error.rejection.detail,
+      timestamp: deps.clock()
+    });
+    return err(checked.error);
+  }
+  claim = checked.value;
   if (deps.persistUpstreamTokens) {
     try {
       await deps.persistUpstreamTokens({

package/dist/esm/http/handlers/method-route.js

@@ -3,6 +3,7 @@ import {
   handleMethodRoute,
   handlePublicMethodRoute
 } from "../../domain/method-route";
+import { callbackTarget } from "../../domain/mount";
 import { authError } from "../../types/error";
 import { isErr } from "../../types/result";
 import { applyResponsePolicy, cacheControlHeader } from "../cookies";
@@ -24,8 +25,11 @@ function makeMethodRouteHandler(deps) {
         const resolved = await deps.methodCache.resolve(tenant.config, methodId);
         if (!isErr(resolved) && resolved.value.publicRoutes?.includes(routeKey)) {
           const issuerUrl = c.get("issuerUrl");
-          const callbackHost = deps.callbackHostFor?.(tenant.id) ?? new URL(issuerUrl).host;
-          const callbackUrl = `${new URL(issuerUrl).protocol}//${callbackHost}/cb/${methodId}`;
+          const { url: callbackUrl } = callbackTarget({
+            issuerUrl,
+            methodId,
+            callbackHost: deps.callbackHostFor?.(tenant.id)
+          });
           const pub = await handlePublicMethodRoute({
             rawRequest: c.req.raw,
             tenant,
@@ -75,7 +79,8 @@ function makeMethodRouteHandler(deps) {
       subPath,
       httpMethod,
       flowId,
-      cookies
+      cookies,
+      issuerUrl: c.get("issuerUrl")
     }, {
       sessionStore: deps.sessionStore,
       tokenStore: deps.tokenStore,

package/dist/esm/http/handlers/token.js

@@ -67,6 +67,7 @@ function makeTokenHandler(deps) {
         keyStore: deps.keyStore,
         ...deps.auditLog ? { auditLog: deps.auditLog } : {},
         success: deps.success,
+        subjects: deps.subjects,
         ...deps.persistUpstreamTokens ? { persistUpstreamTokens: deps.persistUpstreamTokens } : {},
         issuerUrl: c.get("issuerUrl"),
         clock: deps.clock,
@@ -99,6 +100,7 @@ function makeTokenHandler(deps) {
         ...deps.auditLog ? { auditLog: deps.auditLog } : {},
         methodCache: deps.methodCache,
         success: deps.success,
+        subjects: deps.subjects,
         ...deps.persistUpstreamTokens ? { persistUpstreamTokens: deps.persistUpstreamTokens } : {},
         issuerUrl: c.get("issuerUrl"),
         clock: deps.clock,

package/dist/esm/http/middleware/tenant.js

@@ -1,5 +1,8 @@
 // src/http/middleware/tenant.ts
-import { verifyStateEnvelope } from "../../domain/state-envelope";
+import {
+  extractCallbackState,
+  verifyStateEnvelope
+} from "../../domain/state-envelope";
 import { isErr } from "../../types/result";
 import { parseCookieHeader } from "../cookies";
 import {
@@ -90,7 +93,7 @@ function buildTenantContext(req, id, config, custom) {
   };
 }
 async function runCallbackRecovery(req, deps) {
-  const state = await extractStateParam(req);
+  const state = await extractCallbackState(req);
   if (state) {
     const env = await verifyStateEnvelope(state, deps.stateKeys);
     if (env.ok) {
@@ -103,24 +106,6 @@ async function runCallbackRecovery(req, deps) {
   }
   return { kind: "fresh-request" };
 }
-async function extractStateParam(req) {
-  const url = new URL(req.url);
-  const fromQuery = url.searchParams.get("state");
-  if (fromQuery)
-    return fromQuery;
-  if (req.method !== "POST")
-    return null;
-  const ct = req.headers.get("content-type") ?? "";
-  if (!ct.toLowerCase().startsWith("application/x-www-form-urlencoded")) {
-    return null;
-  }
-  try {
-    const text = await req.clone().text();
-    return new URLSearchParams(text).get("state");
-  } catch {
-    return null;
-  }
-}
 export {
   bootstrapMiddleware,
   tenantMiddleware