@eminuckan/spine 0.3.9 → 0.3.10

package/dist/{server-Cw86FdT-.mjs → server-BJTz5-BE.mjs}

@@ -1,5 +1,5 @@
 import { logger } from "./logging/index.mjs";
-import { C as OAUTH_STATE_TTL_MS, S as updateAuthSession, a as createOAuthState, d as destroyAuthSessionsBySid, f as destroyAuthSessionsForUser, g as getOAuthState, i as createAuthSession, l as destroyAuthSessionsByIdentitySession, o as deleteOAuthState, p as getAuthSession, s as destroyAuthSession, t as AUTH_ERROR_COOKIE_PREFIX, v as listAuthSessionDataForUser, w as OAUTH_STATE_TTL_SECONDS } from "./redis-session-storage.server-CI_IYIn8.mjs";
+import { D as OAUTH_RECOVERY_TTL_SECONDS, E as OAUTH_RECOVERY_TTL_MS, O as OAUTH_STATE_TTL_MS, T as updateAuthSession, a as createAuthSession, c as deleteOAuthRecoveryRecord, f as destroyAuthSessionsByIdentitySession, g as getAuthSession, h as destroyAuthSessionsForUser, i as consumeOAuthRecoveryRecord, k as OAUTH_STATE_TTL_SECONDS, l as deleteOAuthState, m as destroyAuthSessionsBySid, o as createOAuthRecoveryRecord, s as createOAuthState, t as AUTH_ERROR_COOKIE_PREFIX, u as destroyAuthSession, x as listAuthSessionDataForUser, y as getOAuthState } from "./redis-session-storage.server-DLJ0B7-C.mjs";
 import * as oidc from "openid-client";
 import { createRemoteJWKSet, errors, jwtVerify } from "jose";
 //#region src/http/response.ts
@@ -150,7 +150,7 @@ function isOAuthCallbackFailureCode(value) {
 function isHeadersLike(value) {
 	return value !== null && typeof value === "object" && typeof value.get === "function" && typeof value.append === "function";
 }
-function getSetCookieValues(headers) {
+function getSetCookieValues$1(headers) {
 	const getSetCookie = headers.getSetCookie;
 	if (getSetCookie) return getSetCookie.call(headers);
 	return Array.from(headers).reduce((cookies, [name, value]) => {
@@ -175,7 +175,7 @@ var OAuthCallbackError = class extends Error {
 		this.name = "OAuthCallbackError";
 		this.code = code;
 		this.cleanupHeaders = new Headers(cleanupHeaders);
-		this.cleanupSetCookies = getSetCookieValues(this.cleanupHeaders);
+		this.cleanupSetCookies = getSetCookieValues$1(this.cleanupHeaders);
 		Object.defineProperty(this, OAUTH_CALLBACK_ERROR_BRAND, {
 			configurable: false,
 			enumerable: false,
@@ -201,6 +201,199 @@ function isRecoverableOAuthCallbackError(error) {
 	return isOAuthCallbackError(error) && error.code === "stale_transaction";
 }
 //#endregion
+//#region src/auth/oauth-recovery.server.ts
+/**
+* Server-only recovery intent for stale OAuth callbacks.
+*
+* A recovery intent is an opaque, HttpOnly cookie backed by a separate Redis
+* record. Consumers must atomically consume it with the typed stale callback
+* error; the client never supplies a boolean budget or a return URL.
+*/
+const OAUTH_RECOVERY_COOKIE_NAME = `${AUTH_ERROR_COOKIE_PREFIX}_oauth_recovery`;
+function escapeRegExp$1(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function getCookieValue(request) {
+	const cookies = request.headers.get("Cookie");
+	if (!cookies) return null;
+	const cookieRegex = new RegExp(`(?:^|;\\s*)${escapeRegExp$1(OAUTH_RECOVERY_COOKIE_NAME)}=([^;]*)`);
+	const rawValue = cookies.match(cookieRegex)?.[1];
+	if (!rawValue) return null;
+	try {
+		const value = decodeURIComponent(rawValue);
+		return value.length > 0 ? value : null;
+	} catch {
+		return null;
+	}
+}
+function hasCookie(request) {
+	const cookies = request.headers.get("Cookie");
+	if (!cookies) return false;
+	return cookies.split(";").some((part) => {
+		const separator = part.indexOf("=");
+		return separator > 0 && part.slice(0, separator).trim() === OAUTH_RECOVERY_COOKIE_NAME;
+	});
+}
+const SAFE_FALLBACK_COOKIE_PATH = "/";
+function normalizeCookiePath(pathname) {
+	const candidate = pathname.trim();
+	const hasUnsafeCharacter = Array.from(candidate).some((character) => {
+		const code = character.charCodeAt(0);
+		return code <= 31 || code === 127 || character === ";";
+	});
+	if (candidate.length === 0 || !candidate.startsWith("/") || candidate.startsWith("//") || hasUnsafeCharacter) return SAFE_FALLBACK_COOKIE_PATH;
+	return candidate;
+}
+/**
+* Resolve the callback cookie path from a configured redirect URI or the
+* actual callback request. Unsafe path values fall back to `/` rather than
+* being interpolated into a Set-Cookie header.
+*/
+function getOAuthRecoveryCookiePath(source) {
+	try {
+		return normalizeCookiePath((source instanceof Request ? new URL(source.url) : source instanceof URL ? source : new URL(source, source.startsWith("/") ? "http://spine.local" : void 0)).pathname);
+	} catch {
+		return SAFE_FALLBACK_COOKIE_PATH;
+	}
+}
+function serializeRecoveryCookie(ticket, maxAge, callbackPath) {
+	const segments = [
+		`${OAUTH_RECOVERY_COOKIE_NAME}=${encodeURIComponent(ticket)}`,
+		`Path=${callbackPath}`,
+		"HttpOnly",
+		"SameSite=Lax",
+		`Max-Age=${maxAge}`
+	];
+	if (process.env.NODE_ENV === "production") segments.push("Secure");
+	return segments.join("; ");
+}
+function appendRecoveryCookieClear(headers, callbackPath) {
+	headers.append("Set-Cookie", serializeRecoveryCookie("", 0, callbackPath));
+}
+function getSetCookieValues(headers) {
+	const getSetCookie = headers.getSetCookie;
+	if (getSetCookie) return getSetCookie.call(headers);
+	return Array.from(headers).filter(([name]) => name.toLowerCase() === "set-cookie").map(([, value]) => value);
+}
+/**
+* Build a lossless ticket-clear header using a callback request, URL, or
+* configured redirect URI as the cookie-path source.
+*/
+function clearOAuthRecoveryIntentHeaders(source) {
+	const headers = new Headers();
+	appendRecoveryCookieClear(headers, getOAuthRecoveryCookiePath(source));
+	return headers;
+}
+function hasNonEmptyParam(url, name) {
+	return url.searchParams.get(name)?.trim().length ? true : false;
+}
+/**
+* This check is intentionally stricter than the callback error code.  It
+* prevents recovery for provider errors, malformed callbacks, and account
+* actions even if an adapter accidentally calls the consume helper there.
+*/
+function isOAuthRecoveryEligibleCallback(request) {
+	const url = new URL(request.url);
+	return hasNonEmptyParam(url, "code") && hasNonEmptyParam(url, "state") && !url.searchParams.has("error") && !url.searchParams.has("kc_action") && !url.searchParams.has("kc_action_status");
+}
+function isRecoveryRecord(value) {
+	if (value === null || typeof value !== "object") return false;
+	const record = value;
+	return typeof record.state === "string" && record.state.length > 0 && typeof record.returnUrl === "string" && typeof record.createdAt === "number" && Number.isFinite(record.createdAt);
+}
+function getCallbackState(request) {
+	const value = new URL(request.url).searchParams.get("state");
+	return value && value.trim().length > 0 ? value : null;
+}
+/**
+* Create the opaque ticket cookie for an ordinary login transaction.
+* Application-action transactions deliberately do not receive a recovery
+* ticket and therefore cannot enter the automatic recovery path.
+*/
+async function createOAuthRecoveryForLogin(request, state, redirectUri) {
+	const returnUrl = sanitizeOAuthReturnUrl(state.returnUrl, request) ?? "/";
+	const callbackPath = getOAuthRecoveryCookiePath(redirectUri);
+	const ticket = await createOAuthRecoveryRecord({
+		state: state.state,
+		returnUrl,
+		createdAt: Date.now()
+	});
+	return {
+		ticket,
+		cookie: serializeRecoveryCookie(ticket, OAUTH_RECOVERY_TTL_SECONDS, callbackPath)
+	};
+}
+/**
+* Delete an unconsumed ticket during terminal/successful callback cleanup.
+* The caller owns error classification and should still clear the browser
+* cookie if deletion fails.
+*/
+async function discardOAuthRecoveryForRequest(request) {
+	const ticket = getCookieValue(request);
+	const headers = new Headers();
+	if (!hasCookie(request)) return headers;
+	if (ticket) await deleteOAuthRecoveryRecord(ticket);
+	appendRecoveryCookieClear(headers, getOAuthRecoveryCookiePath(request));
+	return headers;
+}
+/**
+* Atomically consume a stale-flow recovery intent.
+*
+* The typed error and the callback shape are both checked server-side.  Redis
+* compares the callback state and deletes only on an exact match, so a
+* mismatch cannot burn a valid ticket while a replay or concurrent loser
+* cannot retry.
+*/
+async function consumeOAuthRecoveryIntent(request, callbackError) {
+	const cleanupHeaders = clearOAuthRecoveryIntentHeaders(request);
+	const cleanupSetCookies = getSetCookieValues(cleanupHeaders);
+	if (!isRecoverableOAuthCallbackError(callbackError) || !isOAuthRecoveryEligibleCallback(request)) return {
+		intent: null,
+		cleanupHeaders,
+		cleanupSetCookies
+	};
+	const ticket = getCookieValue(request);
+	const callbackState = getCallbackState(request);
+	if (!ticket || !callbackState) return {
+		intent: null,
+		cleanupHeaders,
+		cleanupSetCookies
+	};
+	let record;
+	try {
+		record = await consumeOAuthRecoveryRecord(ticket, callbackState);
+	} catch (error) {
+		logger.warn("OAuth recovery record could not be consumed", { errorType: error instanceof Error ? error.name : "UnknownError" });
+		return {
+			intent: null,
+			cleanupHeaders,
+			cleanupSetCookies
+		};
+	}
+	if (!isRecoveryRecord(record)) return {
+		intent: null,
+		cleanupHeaders,
+		cleanupSetCookies
+	};
+	const age = Date.now() - record.createdAt;
+	if (age < 0 || age > OAUTH_RECOVERY_TTL_MS) return {
+		intent: null,
+		cleanupHeaders,
+		cleanupSetCookies
+	};
+	const returnUrl = sanitizeOAuthReturnUrl(record.returnUrl, request);
+	if (!returnUrl) return {
+		intent: null,
+		cleanupHeaders,
+		cleanupSetCookies
+	};
+	return {
+		intent: { returnUrl },
+		cleanupHeaders,
+		cleanupSetCookies
+	};
+}
+//#endregion
 //#region src/auth/auth.server.ts
 /**
 * OpenID Connect Authentication Server Module
@@ -781,6 +974,7 @@ function getCallbackFailureCode(error, stage) {
 async function createOAuthCallbackFailure(request, stateId, failureCode) {
 	const cleanupHeaders = new Headers();
 	let cleanupError;
+	const preserveRecoveryTicket = failureCode === OAuthCallbackFailureCodes.StaleTransaction && isOAuthRecoveryEligibleCallback(request);
 	if (stateId) try {
 		await deleteOAuthState(stateId);
 	} catch (error) {
@@ -791,6 +985,12 @@ async function createOAuthCallbackFailure(request, stateId, failureCode) {
 	} catch (error) {
 		cleanupError ??= error;
 	}
+	if (!preserveRecoveryTicket || cleanupError) try {
+		appendHeadersPreservingSetCookie(cleanupHeaders, await discardOAuthRecoveryForRequest(request));
+	} catch (error) {
+		cleanupError ??= error;
+		appendHeadersPreservingSetCookie(cleanupHeaders, clearOAuthRecoveryIntentHeaders(request));
+	}
 	appendOAuthStateCookieClear(cleanupHeaders);
 	const effectiveFailureCode = cleanupError ? OAuthCallbackFailureCodes.StorageError : failureCode;
 	if (cleanupError) logger.warn("OAuth callback cleanup failed", {
@@ -806,6 +1006,9 @@ async function createOAuthCallbackFailure(request, stateId, failureCode) {
 * @param returnUrlOrOptions - Either a return URL string or LoginOptions object
 */
 async function login(request, returnUrlOrOptions) {
+	let oauthStateId = null;
+	let recoveryTicket = null;
+	let recoveryCookie = null;
 	try {
 		const config = getAuthConfig();
 		const options = typeof returnUrlOrOptions === "string" ? { returnUrl: returnUrlOrOptions } : returnUrlOrOptions || {};
@@ -837,7 +1040,15 @@ async function login(request, returnUrlOrOptions) {
 			hasKcAction: Boolean(options.kcAction),
 			extraAuthParamKeys: Object.keys(extraAuthParams)
 		});
-		const stateId = await createOAuthState(oauthState);
+		oauthStateId = await createOAuthState(oauthState);
+		if (!options.kcAction) {
+			const recovery = await createOAuthRecoveryForLogin(request, {
+				state,
+				returnUrl
+			}, config.redirectUri);
+			recoveryTicket = recovery.ticket;
+			recoveryCookie = recovery.cookie;
+		}
 		const authorizationParameters = {
 			redirect_uri: config.redirectUri,
 			scope: config.scope,
@@ -851,7 +1062,8 @@ async function login(request, returnUrlOrOptions) {
 		if (options.kcAction) authorizationParameters.kc_action = options.kcAction;
 		const authorizationUrl = oidc.buildAuthorizationUrl(oidcConfig, authorizationParameters);
 		const headers = new Headers();
-		headers.append("Set-Cookie", serializeTemporaryAuthCookie(OAUTH_STATE_COOKIE, stateId, { maxAge: OAUTH_STATE_TTL_SECONDS }));
+		headers.append("Set-Cookie", serializeTemporaryAuthCookie(OAUTH_STATE_COOKIE, oauthStateId, { maxAge: OAUTH_STATE_TTL_SECONDS }));
+		if (recoveryCookie) headers.append("Set-Cookie", recoveryCookie);
 		logger.info("OIDC authorization flow initiated", {
 			clientId: config.clientId,
 			redirectUri: config.redirectUri,
@@ -863,6 +1075,16 @@ async function login(request, returnUrlOrOptions) {
 		});
 		return createRedirectResponse(authorizationUrl.toString(), { headers });
 	} catch (error) {
+		if (oauthStateId) try {
+			await deleteOAuthState(oauthStateId);
+		} catch (cleanupError) {
+			logger.warn("OAuth login state cleanup failed", { errorType: cleanupError instanceof Error ? cleanupError.name : "UnknownError" });
+		}
+		if (recoveryTicket) try {
+			await deleteOAuthRecoveryRecord(recoveryTicket);
+		} catch (cleanupError) {
+			logger.warn("OAuth recovery intent cleanup failed", { errorType: cleanupError instanceof Error ? cleanupError.name : "UnknownError" });
+		}
 		logger.error("Failed to initiate OAuth login", void 0, { errorType: error instanceof Error ? error.name : "UnknownError" });
 		throw new Error("Login failed");
 	}
@@ -916,9 +1138,11 @@ async function handleCallback(request) {
 					if (oauthState && isUsableOAuthState(oauthState, requiresNonce) && oauthState.state === state && stateAge <= OAUTH_STATE_TTL_MS) {
 						callbackStage = "storage";
 						await deleteOAuthState(stateId);
+						const recoveryHeaders = await discardOAuthRecoveryForRequest(request);
 						callbackStage = "application_action";
 						const headers = new Headers();
 						appendOAuthStateCookieClear(headers);
+						appendHeadersPreservingSetCookie(headers, recoveryHeaders);
 						const redirectUrl = appendApplicationInitiatedActionResult(sanitizeOAuthReturnUrl(oauthState.returnUrl, request) ?? "/", kcAction || oauthState.kcAction, kcActionStatus);
 						logger.info("Application initiated action returned with OAuth error", {
 							hasError: Boolean(error),
@@ -943,6 +1167,7 @@ async function handleCallback(request) {
 				if (stateId) await deleteOAuthState(stateId);
 				const headers = await destroyAuthSession(request);
 				appendOAuthStateCookieClear(headers);
+				appendHeadersPreservingSetCookie(headers, await discardOAuthRecoveryForRequest(request));
 				headers.append("Set-Cookie", serializeTemporaryAuthCookie(AUTH_ERROR_COOKIE, "access_denied", { maxAge: 300 }));
 				headers.append("Set-Cookie", serializeTemporaryAuthCookie(AUTH_ERROR_DESC_COOKIE, "You do not have access to this application.", { maxAge: 300 }));
 				const baseUrl = new URL(config.redirectUri).origin;
@@ -959,6 +1184,7 @@ async function handleCallback(request) {
 				if (stateId) await deleteOAuthState(stateId);
 				const headers = await destroyAuthSession(request);
 				appendOAuthStateCookieClear(headers);
+				appendHeadersPreservingSetCookie(headers, await discardOAuthRecoveryForRequest(request));
 				const baseUrl = new URL(config.redirectUri).origin;
 				return createRedirectResponse(baseUrl, { headers });
 			}
@@ -966,6 +1192,7 @@ async function handleCallback(request) {
 			if (stateId) await deleteOAuthState(stateId);
 			const headers = await destroyAuthSession(request);
 			appendOAuthStateCookieClear(headers);
+			appendHeadersPreservingSetCookie(headers, await discardOAuthRecoveryForRequest(request));
 			headers.append("Set-Cookie", serializeTemporaryAuthCookie(AUTH_ERROR_COOKIE, error, { maxAge: 300 }));
 			const baseUrl = new URL(config.redirectUri).origin;
 			return createRedirectResponse(baseUrl, { headers });
@@ -993,9 +1220,11 @@ async function handleCallback(request) {
 			if (kcActionStatus) {
 				callbackStage = "storage";
 				await deleteOAuthState(stateId);
+				const recoveryHeaders = await discardOAuthRecoveryForRequest(request);
 				callbackStage = "application_action";
 				const headers = new Headers();
 				appendOAuthStateCookieClear(headers);
+				appendHeadersPreservingSetCookie(headers, recoveryHeaders);
 				const redirectUrl = appendApplicationInitiatedActionResult(sanitizeOAuthReturnUrl(oauthState.returnUrl, request) ?? "/", kcAction || oauthState.kcAction, kcActionStatus);
 				logger.info("Application initiated action returned without authorization code", {
 					hasKcAction: Boolean(kcAction || oauthState.kcAction),
@@ -1023,9 +1252,11 @@ async function handleCallback(request) {
 		const sessionHeaders = await createAuthSession(request, newSessionData);
 		callbackStage = "storage";
 		await deleteOAuthState(stateId);
+		const recoveryHeaders = await discardOAuthRecoveryForRequest(request);
 		const headers = new Headers();
 		appendHeadersPreservingSetCookie(headers, sessionHeaders);
 		appendOAuthStateCookieClear(headers);
+		appendHeadersPreservingSetCookie(headers, recoveryHeaders);
 		logger.info("OAuth callback processed successfully");
 		return createRedirectResponse(appendApplicationInitiatedActionResult(sanitizeOAuthReturnUrl(oauthState.returnUrl, request) ?? "/", kcAction || oauthState.kcAction, kcActionStatus), { headers });
 	} catch (error) {
@@ -1608,6 +1839,6 @@ function shouldAttemptTokenRefresh(response, hasAuth) {
 	return hasAuth && isTokenExpiredResponse(response);
 }
 //#endregion
-export { resetAuthClaimMapping as A, handleCallback as C, logout as D, login as E, OAuthCallbackFailureCodes as M, isOAuthCallbackError as N, refreshTokens as O, isRecoverableOAuthCallbackError as P, handleBackChannelLogout as S, hasAuthError as T, createAuthorizationResponseUrl as _, configureRouteProtection as a, getAuthError as b, protectRoute as c, resetRouteProtectionConfig as d, shouldRefreshToken as f, configureAuthClaimMapping as g, clearAuthServerCache as h, authRoute as i, OAuthCallbackError as j, requireAuth as k, protectedRoute as l, clearAuthErrorHeaders as m, isTokenExpiredResponse as n, onboardingRoute as o, subscriptionRoute as p, shouldAttemptTokenRefresh as r, policyRoute as s, attemptTokenRefresh as t, publicRoute as u, extractUserInfo as v, handleFrontChannelLogout as w, getUser as x, getAccessToken as y };
+export { resetAuthClaimMapping as A, handleCallback as C, logout as D, login as E, OAuthCallbackError as F, OAuthCallbackFailureCodes as I, isOAuthCallbackError as L, clearOAuthRecoveryIntentHeaders as M, consumeOAuthRecoveryIntent as N, refreshTokens as O, getOAuthRecoveryCookiePath as P, isRecoverableOAuthCallbackError as R, handleBackChannelLogout as S, hasAuthError as T, createAuthorizationResponseUrl as _, configureRouteProtection as a, getAuthError as b, protectRoute as c, resetRouteProtectionConfig as d, shouldRefreshToken as f, configureAuthClaimMapping as g, clearAuthServerCache as h, authRoute as i, OAUTH_RECOVERY_COOKIE_NAME as j, requireAuth as k, protectedRoute as l, clearAuthErrorHeaders as m, isTokenExpiredResponse as n, onboardingRoute as o, subscriptionRoute as p, shouldAttemptTokenRefresh as r, policyRoute as s, attemptTokenRefresh as t, publicRoute as u, extractUserInfo as v, handleFrontChannelLogout as w, getUser as x, getAccessToken as y };
 
-//# sourceMappingURL=server-Cw86FdT-.mjs.map
+//# sourceMappingURL=server-BJTz5-BE.mjs.map