@getstrata/core 0.5.77 → 0.5.78

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # @getstrata/core changelog
 
+## 0.5.78
+
+- OpenAPI treats `POST /auth/two-factor-challenge` as a public operation (no bearer), including when routes are registered under `API_PREFIX`.
+
 ## 0.5.77
 
 - `@getstrata/core/security/recoveryCodes` (`generateRecoveryCodes`, `hashRecoveryCode`, `recoveryCodeMatches`). Fortify-style one-time MFA backup codes (`abcd-efgh`).

package/README.md

@@ -82,7 +82,7 @@ import type { Migration } from "@getstrata/core/database/migrations/types";
 Package name: **`@getstrata/core`** (npm org [`@getstrata`](https://www.npmjs.com/org/getstrata)).
 
 1. Add `NPM_TOKEN` to GitHub repository secrets.
-2. Tag a release: `git tag v0.5.79 && git push origin v0.5.79`
+2. Tag a release: `git tag v0.5.80 && git push origin v0.5.80`
 3. [Release workflow](../../.github/workflows/release.yml) builds and runs `npm publish --access public`.
 
 Previously published as `@eyk-workhub/framework@0.1.0`, deprecated in favor of this package.

package/dist/entries/jobs/dispatchWebhookJob.js

@@ -2,6 +2,7 @@
 // ../../src/modules/webhook/dispatchWebhookJob.ts
 import { createHmac } from "crypto";
 import { repositoryConnection as db } from "@getstrata/core/database/repositoryConnection";
+import { BadRequestError } from "@getstrata/core/errors/http";
 import { Job } from "@getstrata/core/queue";
 import { webhookSignatureHeader } from "@getstrata/core/runtime/appKeyPrefix";
 import { safeFetch } from "@getstrata/core/security/safeFetch";
@@ -39,10 +40,10 @@ class DispatchWebhookJob extends Job {
     const signature = createHmac("sha256", webhook.secret).update(body).digest("hex");
     const allowHttp = (process.env.APP_ENV ?? "local") !== "production";
     const signatureHeader = webhookSignatureHeader();
-    assertSafeOutboundUrl(webhook.url, { allowHttp });
     let responseStatus = null;
     let errorMessage = null;
     try {
+      assertSafeOutboundUrl(webhook.url, { allowHttp });
       const response = await safeFetch(webhook.url, {
         method: "POST",
         headers: {
@@ -67,6 +68,9 @@ class DispatchWebhookJob extends Job {
           ${errorMessage}
         )
       `;
+      if (error instanceof BadRequestError) {
+        return;
+      }
       return error instanceof Error ? error : new Error(errorMessage);
     }
     await db`

package/dist/entries/openapi/generator.js

@@ -51,6 +51,7 @@ function sdkClientClassName() {
 var PUBLIC_ROUTE_DESCRIPTIONS = {
   "GET /auth/me": "Current authenticated user",
   "POST /auth/login": "Login with email and password",
+  "POST /auth/two-factor-challenge": "Complete two-factor login challenge",
   "POST /auth/register": "Register with name, email, and password",
   "POST /auth/forgot-password": "Request a password reset email",
   "POST /auth/reset-password": "Reset password with email and token",
@@ -99,7 +100,7 @@ function toRelativeApiPath(path) {
 }
 function requiresBearerAuth(path, method) {
   const relative = toRelativeApiPath(path);
-  if (relative.startsWith("/auth/login") || relative.startsWith("/auth/register") || relative.startsWith("/auth/forgot-password") || relative.startsWith("/auth/reset-password") || relative.startsWith("/auth/email/verification-notification") || relative.startsWith("/auth/oauth")) {
+  if (relative.startsWith("/auth/login") || relative.startsWith("/auth/two-factor-challenge") || relative.startsWith("/auth/register") || relative.startsWith("/auth/forgot-password") || relative.startsWith("/auth/reset-password") || relative.startsWith("/auth/email/verification-notification") || relative.startsWith("/auth/oauth")) {
     return false;
   }
   if (relative.startsWith("/scim/") || relative.startsWith("/billing/webhooks/") || path.startsWith("/scim/") || path.startsWith("/billing/webhooks/")) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "0.5.77",
+  "version": "0.5.78",
   "description": "Strata — Laravel-inspired Bun framework public API",
   "type": "module",
   "license": "MIT",