@getstrata/core 0.5.5 → 0.5.7

package/dist/entries/http/csrfToken.js

@@ -1,6 +1,34 @@
 // @bun
 // ../../src/core/http/csrfToken.ts
-import { createHmac, randomBytes, timingSafeEqual } from "crypto";
+import { timingSafeEqual } from "crypto";
+
+// ../../src/core/http/cookies.ts
+function readRequestCookie(request, name) {
+  const cookies = request.cookies;
+  if (cookies && typeof cookies.get === "function") {
+    const value = cookies.get(name);
+    if (value) {
+      return value;
+    }
+  }
+  const header = request.headers.get("cookie");
+  if (!header) {
+    return null;
+  }
+  for (const part of header.split(";")) {
+    const idx = part.indexOf("=");
+    if (idx === -1)
+      continue;
+    const cookieName = part.slice(0, idx).trim();
+    if (cookieName !== name)
+      continue;
+    return decodeURIComponent(part.slice(idx + 1).trim());
+  }
+  return null;
+}
+function readBunRequestCookie(request, name) {
+  return request.cookies.get(name) ?? readRequestCookie(request, name);
+}
 
 // ../../src/core/http/requestMetaContext.ts
 import { AsyncLocalStorage } from "async_hooks";
@@ -21,70 +49,28 @@ var CSRF_TTL_MS = 60 * 60 * 1000;
 function resolveCsrfSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-csrf-secret";
 }
-function signCsrfToken(token, issuedAt) {
-  const payload = `${token}.${issuedAt}`;
-  const signature = createHmac("sha256", resolveCsrfSecret()).update(payload).digest("hex");
-  return `${payload}.${signature}`;
+function csrfVerifyOptions() {
+  return { secret: resolveCsrfSecret(), maxAge: CSRF_TTL_MS };
 }
-function readCsrfCookie(request) {
-  const cookieHeader = request.headers.get("cookie");
-  if (!cookieHeader) {
-    return null;
-  }
-  for (const part of cookieHeader.split(";")) {
-    const [name, ...rest] = part.trim().split("=");
-    if (name === CSRF_COOKIE) {
-      return decodeURIComponent(rest.join("="));
-    }
-  }
-  return null;
-}
-function parseSignedCsrfValue(cookieValue) {
-  const parts = cookieValue.split(".");
-  if (parts.length !== 3) {
-    return null;
-  }
-  const [token, issuedAtRaw, cookieSignature] = parts;
-  if (!token || !issuedAtRaw || !cookieSignature) {
-    return null;
-  }
-  const issuedAt = Number.parseInt(issuedAtRaw, 10);
-  if (!Number.isFinite(issuedAt)) {
-    return null;
-  }
-  if (Date.now() - issuedAt > CSRF_TTL_MS) {
-    return null;
-  }
-  const expectedSignature = signCsrfToken(token, issuedAt).split(".").pop();
-  if (!expectedSignature) {
-    return null;
-  }
-  const expectedBuffer = Buffer.from(expectedSignature);
-  const actualBuffer = Buffer.from(cookieSignature);
-  if (expectedBuffer.length !== actualBuffer.length) {
-    return null;
-  }
-  if (!timingSafeEqual(expectedBuffer, actualBuffer)) {
-    return null;
+function tokensMatch(left, right) {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  if (leftBuffer.length !== rightBuffer.length) {
+    return false;
   }
-  return { token, issuedAt };
+  return timingSafeEqual(leftBuffer, rightBuffer);
 }
 function createCsrfTokenCookie() {
-  const token = randomBytes(24).toString("hex");
-  const issuedAt = Date.now();
-  const value = signCsrfToken(token, issuedAt);
+  const token = Bun.CSRF.generate(resolveCsrfSecret(), { expiresIn: CSRF_TTL_MS });
   return {
     token,
-    cookie: `${CSRF_COOKIE}=${encodeURIComponent(value)}; Path=/; SameSite=Lax; Max-Age=3600`
+    cookie: `${CSRF_COOKIE}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}`
   };
 }
 function resolveCsrfToken(request) {
-  const cookieValue = readCsrfCookie(request);
-  if (cookieValue) {
-    const parsed = parseSignedCsrfValue(cookieValue);
-    if (parsed) {
-      return { token: parsed.token };
-    }
+  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
+  if (cookieValue && Bun.CSRF.verify(cookieValue, csrfVerifyOptions())) {
+    return { token: cookieValue };
   }
   return createCsrfTokenCookie();
 }
@@ -107,6 +93,10 @@ async function readSubmittedCsrfTokenFromBody(request) {
     if (typeof field === "string" && field.trim().length > 0) {
       return field.trim();
     }
+    const legacyField = formData.get("_csrf");
+    if (typeof legacyField === "string" && legacyField.trim().length > 0) {
+      return legacyField.trim();
+    }
   }
   return null;
 }
@@ -114,20 +104,14 @@ function verifyCsrfToken(request, submittedToken) {
   if (!submittedToken) {
     return false;
   }
-  const cookieValue = readCsrfCookie(request);
+  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
   if (!cookieValue) {
     return false;
   }
-  const parsed = parseSignedCsrfValue(cookieValue);
-  if (!parsed) {
-    return false;
-  }
-  const submittedBuffer = Buffer.from(submittedToken);
-  const expectedBuffer = Buffer.from(parsed.token);
-  if (submittedBuffer.length !== expectedBuffer.length) {
+  if (!tokensMatch(submittedToken, cookieValue)) {
     return false;
   }
-  return timingSafeEqual(submittedBuffer, expectedBuffer);
+  return Bun.CSRF.verify(submittedToken, csrfVerifyOptions());
 }
 function resolveCsrfTokenForRequest(request) {
   const metaToken = currentRequestMeta().csrfToken;

package/dist/entries/http/etag.js

@@ -1,6 +1,8 @@
 // @bun
-// ../../src/core/http/etag.ts
-import { createHash } from "crypto";
+// ../../src/core/crypto/nonCryptographicHash.ts
+function nonCryptographicDigest(input) {
+  return Bun.hash(input).toString(16);
+}
 
 // ../../src/core/errors/http.ts
 class HttpError extends Error {
@@ -76,13 +78,13 @@ function formatWeakEtag(digest) {
   return `W/"${digest}"`;
 }
 function computeEtagFromJson(data) {
-  const digest = createHash("sha256").update(JSON.stringify(data)).digest("hex").slice(0, 32);
+  const digest = nonCryptographicDigest(JSON.stringify(data)).slice(0, 32);
   return formatWeakEtag(digest);
 }
 function etagFromResource(resource) {
   const version = resource.updated_at ?? resource.created_at ?? "";
   const versionText = version instanceof Date ? version.toISOString() : version ? String(version) : "0";
-  const digest = createHash("sha256").update(`${String(resource.id ?? "0")}:${versionText}`).digest("hex").slice(0, 32);
+  const digest = nonCryptographicDigest(`${String(resource.id ?? "0")}:${versionText}`).slice(0, 32);
   return formatWeakEtag(digest);
 }
 function normalizeEtag(value) {

package/dist/entries/http/webErrorResponse.js

@@ -1577,26 +1577,26 @@ class Model {
     throw new Error(`${this.constructor.name}.primaryKey() is not implemented.`);
   }
   static primaryKeyField() {
-    return resolveModelRepository(this).getTable().primaryKey;
+    return resolveModelRepository(Model).getTable().primaryKey;
   }
   static hydrateAttributes(attributes) {
-    const casts = modelStatics(this).$casts ?? {};
+    const casts = modelStatics(Model).$casts ?? {};
     return applyCasts(attributes, casts, "hydrate");
   }
   static dehydrateAttributes(attributes) {
-    const casts = modelStatics(this).$casts ?? {};
+    const casts = modelStatics(Model).$casts ?? {};
     return applyCasts(attributes, casts, "dehydrate");
   }
   static fromRecord(record, repository, exists = true) {
-    const statics = modelStatics(this);
+    const statics = modelStatics(Model);
     const hydrated = statics.hydrateAttributes(record);
     return new statics(hydrated, repository, exists);
   }
   static boot() {}
   static addGlobalScope(_name, scope) {
-    ensureBooted(this);
-    const existing = modelGlobalScopes.get(this) ?? [];
-    modelGlobalScopes.set(this, [
+    ensureBooted(Model);
+    const existing = modelGlobalScopes.get(Model) ?? [];
+    modelGlobalScopes.set(Model, [
       ...existing,
       scope
     ]);
@@ -1606,17 +1606,17 @@ class Model {
   }
   static query() {
     ensureBooted(this);
-    const repository = resolveModelRepository(this);
+    const repository = resolveModelRepository(Model);
     let query = repository.query();
-    for (const scope of getGlobalScopes(this)) {
+    for (const scope of getGlobalScopes(Model)) {
       query = scope(query);
     }
     return query;
   }
   static async create(attributes) {
     const statics = modelStatics(this);
-    ensureBooted(this);
-    const repository = resolveModelRepository(this);
+    ensureBooted(Model);
+    const repository = resolveModelRepository(Model);
     const table = repository.getTable();
     const timestamps = statics.$timestamps ?? true;
     const assignable = filterMassAssignable(statics.$fillable, statics.$guarded, attributes);
@@ -1626,23 +1626,23 @@ class Model {
     return statics.fromRecord(record, repository, true);
   }
   static async find(id) {
-    const statics = modelStatics(this);
-    const repository = resolveModelRepository(this);
+    const statics = modelStatics(Model);
+    const repository = resolveModelRepository(Model);
     const primaryKey = repository.getTable().primaryKey;
-    const record = await Model.query.call(this).where({ [primaryKey]: id }).first();
+    const record = await Model.query.call(Model).where({ [primaryKey]: id }).first();
     return record ? statics.fromRecord(record, repository, true) : null;
   }
   static async findOrFail(id, errorFactory) {
-    const model = await Model.find.call(this, id);
+    const model = await Model.find.call(Model, id);
     if (model) {
       return model;
     }
-    throw errorFactory?.(id) ?? new NotFoundError(`${this.name} ${String(id)} not found.`);
+    throw errorFactory?.(id) ?? new NotFoundError(`${Model.name} ${String(id)} not found.`);
   }
   static async all(options = {}) {
     const statics = modelStatics(this);
-    const repository = resolveModelRepository(this);
-    let query = Model.query.call(this);
+    const repository = resolveModelRepository(Model);
+    let query = Model.query.call(Model);
     if (options.orderBy) {
       query = query.orderBy(options.orderBy);
     }
@@ -1654,8 +1654,8 @@ class Model {
   }
   static async firstWhere(where, options = {}) {
     const statics = modelStatics(this);
-    const repository = resolveModelRepository(this);
-    let query = Model.query.call(this).where(where);
+    const repository = resolveModelRepository(Model);
+    let query = Model.query.call(Model).where(where);
     if (options.orderBy) {
       query = query.orderBy(options.orderBy);
     }
@@ -2817,76 +2817,64 @@ function hashApiToken(token) {
 var tokenServiceToken = CORE_TOKEN_SERVICE_TOKEN;
 
 // ../../src/core/http/csrfToken.ts
-import { createHmac as createHmac4, randomBytes as randomBytes2, timingSafeEqual } from "crypto";
+import { timingSafeEqual } from "crypto";
+
+// ../../src/core/http/cookies.ts
+function readRequestCookie(request, name) {
+  const cookies = request.cookies;
+  if (cookies && typeof cookies.get === "function") {
+    const value = cookies.get(name);
+    if (value) {
+      return value;
+    }
+  }
+  const header = request.headers.get("cookie");
+  if (!header) {
+    return null;
+  }
+  for (const part of header.split(";")) {
+    const idx = part.indexOf("=");
+    if (idx === -1)
+      continue;
+    const cookieName = part.slice(0, idx).trim();
+    if (cookieName !== name)
+      continue;
+    return decodeURIComponent(part.slice(idx + 1).trim());
+  }
+  return null;
+}
+function readBunRequestCookie(request, name) {
+  return request.cookies.get(name) ?? readRequestCookie(request, name);
+}
+
+// ../../src/core/http/csrfToken.ts
 var CSRF_COOKIE = "workhub_csrf";
 var CSRF_TTL_MS = 60 * 60 * 1000;
 function resolveCsrfSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-csrf-secret";
 }
-function signCsrfToken(token, issuedAt) {
-  const payload = `${token}.${issuedAt}`;
-  const signature = createHmac4("sha256", resolveCsrfSecret()).update(payload).digest("hex");
-  return `${payload}.${signature}`;
+function csrfVerifyOptions() {
+  return { secret: resolveCsrfSecret(), maxAge: CSRF_TTL_MS };
 }
-function readCsrfCookie(request) {
-  const cookieHeader = request.headers.get("cookie");
-  if (!cookieHeader) {
-    return null;
-  }
-  for (const part of cookieHeader.split(";")) {
-    const [name, ...rest] = part.trim().split("=");
-    if (name === CSRF_COOKIE) {
-      return decodeURIComponent(rest.join("="));
-    }
-  }
-  return null;
-}
-function parseSignedCsrfValue(cookieValue) {
-  const parts = cookieValue.split(".");
-  if (parts.length !== 3) {
-    return null;
-  }
-  const [token, issuedAtRaw, cookieSignature] = parts;
-  if (!token || !issuedAtRaw || !cookieSignature) {
-    return null;
-  }
-  const issuedAt = Number.parseInt(issuedAtRaw, 10);
-  if (!Number.isFinite(issuedAt)) {
-    return null;
-  }
-  if (Date.now() - issuedAt > CSRF_TTL_MS) {
-    return null;
-  }
-  const expectedSignature = signCsrfToken(token, issuedAt).split(".").pop();
-  if (!expectedSignature) {
-    return null;
-  }
-  const expectedBuffer = Buffer.from(expectedSignature);
-  const actualBuffer = Buffer.from(cookieSignature);
-  if (expectedBuffer.length !== actualBuffer.length) {
-    return null;
-  }
-  if (!timingSafeEqual(expectedBuffer, actualBuffer)) {
-    return null;
+function tokensMatch(left, right) {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  if (leftBuffer.length !== rightBuffer.length) {
+    return false;
   }
-  return { token, issuedAt };
+  return timingSafeEqual(leftBuffer, rightBuffer);
 }
 function createCsrfTokenCookie() {
-  const token = randomBytes2(24).toString("hex");
-  const issuedAt = Date.now();
-  const value = signCsrfToken(token, issuedAt);
+  const token = Bun.CSRF.generate(resolveCsrfSecret(), { expiresIn: CSRF_TTL_MS });
   return {
     token,
-    cookie: `${CSRF_COOKIE}=${encodeURIComponent(value)}; Path=/; SameSite=Lax; Max-Age=3600`
+    cookie: `${CSRF_COOKIE}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}`
   };
 }
 function resolveCsrfToken(request) {
-  const cookieValue = readCsrfCookie(request);
-  if (cookieValue) {
-    const parsed = parseSignedCsrfValue(cookieValue);
-    if (parsed) {
-      return { token: parsed.token };
-    }
+  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
+  if (cookieValue && Bun.CSRF.verify(cookieValue, csrfVerifyOptions())) {
+    return { token: cookieValue };
   }
   return createCsrfTokenCookie();
 }
@@ -2909,6 +2897,10 @@ async function readSubmittedCsrfTokenFromBody(request) {
     if (typeof field === "string" && field.trim().length > 0) {
       return field.trim();
     }
+    const legacyField = formData.get("_csrf");
+    if (typeof legacyField === "string" && legacyField.trim().length > 0) {
+      return legacyField.trim();
+    }
   }
   return null;
 }
@@ -2916,20 +2908,14 @@ function verifyCsrfToken(request, submittedToken) {
   if (!submittedToken) {
     return false;
   }
-  const cookieValue = readCsrfCookie(request);
+  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
   if (!cookieValue) {
     return false;
   }
-  const parsed = parseSignedCsrfValue(cookieValue);
-  if (!parsed) {
-    return false;
-  }
-  const submittedBuffer = Buffer.from(submittedToken);
-  const expectedBuffer = Buffer.from(parsed.token);
-  if (submittedBuffer.length !== expectedBuffer.length) {
+  if (!tokensMatch(submittedToken, cookieValue)) {
     return false;
   }
-  return timingSafeEqual(submittedBuffer, expectedBuffer);
+  return Bun.CSRF.verify(submittedToken, csrfVerifyOptions());
 }
 function resolveCsrfTokenForRequest(request) {
   const metaToken = currentRequestMeta().csrfToken;
@@ -2940,14 +2926,14 @@ function resolveCsrfTokenForRequest(request) {
 }
 
 // ../../src/core/http/flashSession.ts
-import { createHmac as createHmac5, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createHmac as createHmac4, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var FLASH_COOKIE = "workhub_flash";
 var FLASH_TTL_MS = 60 * 1000;
 function resolveFlashSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
 }
 function signFlashPayload(payload, issuedAt) {
-  const signature = createHmac5("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
+  const signature = createHmac4("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
   return `${payload}.${issuedAt}.${signature}`;
 }
 function readFlashCookie(request) {