@getstrata/core 0.5.78 → 0.5.80
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +8 -0
- package/dist/core/auth/sessionCookie.d.ts +8 -2
- package/dist/core/contracts/authUserDirectory.d.ts +1 -0
- package/dist/core/runtime/appKeyPrefix.d.ts +3 -1
- package/dist/entries/audit/exportAuditLogs.js +6 -0
- package/dist/entries/audit/siemFormatter.js +6 -0
- package/dist/entries/auth/oauth/providers.js +6 -0
- package/dist/entries/auth/oauth/samlProvider.js +6 -0
- package/dist/entries/auth/passwordConfirmCookie.js +58 -2
- package/dist/entries/auth/sessionCookie.js +75 -4
- package/dist/entries/auth/sessionGuard.js +79 -7
- package/dist/entries/auth/tokenHash.js +58 -2
- package/dist/entries/cache/createCacheStore.js +6 -0
- package/dist/entries/facades.js +6 -0
- package/dist/entries/http/csrfMiddleware.js +56 -2
- package/dist/entries/http/csrfToken.js +56 -2
- package/dist/entries/http/flashMiddleware.js +58 -2
- package/dist/entries/http/flashSession.js +58 -2
- package/dist/entries/http/loginThrottleMiddleware.js +6 -0
- package/dist/entries/http/memoryThrottleMiddleware.js +6 -0
- package/dist/entries/http/scimThrottleMiddleware.js +6 -0
- package/dist/entries/http/securityHeadersMiddleware.js +6 -0
- package/dist/entries/http/signedUrl.js +57 -1
- package/dist/entries/http/throttleMiddleware.js +6 -0
- package/dist/entries/jobs/exportAuditLogsJob.js +6 -0
- package/dist/entries/mail/mailer.js +6 -0
- package/dist/entries/openapi/generator.js +6 -0
- package/dist/entries/queue/createAppQueue.js +6 -0
- package/dist/entries/queue/publicQueue.js +6 -0
- package/dist/entries/queue/queueMetrics.js +6 -0
- package/dist/entries/queue/redisQueue.js +6 -0
- package/dist/entries/runtime/appKeyPrefix.js +8 -0
- package/dist/entries/security/oauthState.js +57 -1
- package/dist/entries/security/safeFetch.js +6 -0
- package/dist/entries/tracing/tracingMiddleware.js +6 -0
- package/dist/entries/view.js +58 -4
- package/dist/index.js +11 -7
- package/package.json +1 -1
package/dist/index.js
CHANGED
|
@@ -979,6 +979,12 @@ var {RedisClient } = globalThis.Bun;
|
|
|
979
979
|
function appKeyPrefix() {
|
|
980
980
|
return process.env.APP_KEY_PREFIX?.trim() || "workhub";
|
|
981
981
|
}
|
|
982
|
+
function appCookieName(kind) {
|
|
983
|
+
return `${appKeyPrefix()}_${kind}`;
|
|
984
|
+
}
|
|
985
|
+
function appDevSecret(kind) {
|
|
986
|
+
return `${appKeyPrefix()}-dev-${kind}`;
|
|
987
|
+
}
|
|
982
988
|
function namespacedRedisKey(kind) {
|
|
983
989
|
return `${appKeyPrefix()}:${kind}`;
|
|
984
990
|
}
|
|
@@ -4560,13 +4566,12 @@ function currentRequestMeta() {
|
|
|
4560
4566
|
}
|
|
4561
4567
|
|
|
4562
4568
|
// ../../src/core/http/csrfToken.ts
|
|
4563
|
-
var CSRF_COOKIE = "workhub_csrf";
|
|
4564
4569
|
var CSRF_TTL_MS = 60 * 60 * 1000;
|
|
4565
4570
|
function csrfCookieName() {
|
|
4566
|
-
return process.env.CSRF_COOKIE_NAME?.trim() ||
|
|
4571
|
+
return process.env.CSRF_COOKIE_NAME?.trim() || appCookieName("csrf");
|
|
4567
4572
|
}
|
|
4568
4573
|
function resolveCsrfSecret() {
|
|
4569
|
-
return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "
|
|
4574
|
+
return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || appDevSecret("csrf-secret");
|
|
4570
4575
|
}
|
|
4571
4576
|
function csrfVerifyOptions() {
|
|
4572
4577
|
return { secret: resolveCsrfSecret(), maxAge: CSRF_TTL_MS };
|
|
@@ -4692,13 +4697,12 @@ function createCsrfProtection(secret, options = {}) {
|
|
|
4692
4697
|
}
|
|
4693
4698
|
// ../../src/core/http/flashSession.ts
|
|
4694
4699
|
import { createHmac, timingSafeEqual as timingSafeEqual3 } from "crypto";
|
|
4695
|
-
var FLASH_COOKIE = "workhub_flash";
|
|
4696
4700
|
var FLASH_TTL_MS = 60 * 1000;
|
|
4697
4701
|
function flashCookieName() {
|
|
4698
|
-
return process.env.FLASH_COOKIE_NAME?.trim() ||
|
|
4702
|
+
return process.env.FLASH_COOKIE_NAME?.trim() || appCookieName("flash");
|
|
4699
4703
|
}
|
|
4700
4704
|
function resolveFlashSecret() {
|
|
4701
|
-
return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "
|
|
4705
|
+
return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || appDevSecret("flash-secret");
|
|
4702
4706
|
}
|
|
4703
4707
|
function signFlashPayload(payload, issuedAt) {
|
|
4704
4708
|
const signature = createHmac("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
|
|
@@ -5709,7 +5713,7 @@ function createSecurityHeadersMiddleware(options = {}) {
|
|
|
5709
5713
|
// ../../src/core/http/signedUrl.ts
|
|
5710
5714
|
import { createHmac as createHmac2 } from "crypto";
|
|
5711
5715
|
function resolveSignedUrlSecret() {
|
|
5712
|
-
return process.env.SIGNED_URL_SECRET?.trim() || process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "
|
|
5716
|
+
return process.env.SIGNED_URL_SECRET?.trim() || process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || appDevSecret("signed-url-secret");
|
|
5713
5717
|
}
|
|
5714
5718
|
function resolveSignedUrlOrigin() {
|
|
5715
5719
|
return (process.env.APP_URL ?? "http://localhost:3000").replace(/\/$/, "");
|