@getstrata/core 1.0.8 → 1.1.0

package/dist/entries/crypto/mfaSecret.js

@@ -1,4 +1,24 @@
 // @bun
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
 // ../../src/core/crypto/fieldEncryption.ts
 import { createCipheriv, createDecipheriv, createHmac, randomBytes } from "crypto";
 var ENCRYPTION_PREFIX = "enc:v1:";
@@ -26,7 +46,7 @@ function isFieldEncryptionEnabled() {
   if (featureFlag === "true") {
     return true;
   }
-  return (process.env.APP_ENV ?? "local") === "production";
+  return Boolean(resolveEncryptionKey());
 }
 function encryptField(plaintext, key) {
   const iv = randomBytes(IV_LENGTH);
@@ -84,8 +104,8 @@ function emailLookupForQuery(email) {
 // ../../src/core/crypto/mfaSecret.ts
 function protectMfaSecret(secret) {
   const key = resolveEncryptionKey();
-  if (!isFieldEncryptionEnabled() || !key) {
-    return secret;
+  if (!key) {
+    throw new Error("MFA secrets require KMS_ENCRYPTION_KEY.");
   }
   return encryptField(secret, key);
 }
@@ -93,10 +113,16 @@ function revealMfaSecret(stored) {
   if (!stored) {
     return null;
   }
-  const key = resolveEncryptionKey();
-  if (!isFieldEncryptionEnabled() || !key || !stored.startsWith("enc:v1:")) {
+  if (!stored.startsWith("enc:v1:")) {
+    if (isProductionEnv() || resolveEncryptionKey()) {
+      throw new Error("MFA secrets must be encrypted.");
+    }
     return stored;
   }
+  const key = resolveEncryptionKey();
+  if (!key) {
+    throw new Error("MFA secrets require KMS_ENCRYPTION_KEY.");
+  }
   return decryptField(stored, key);
 }
 export {

package/dist/entries/database/errors.js

@@ -75,21 +75,25 @@ function mapDatabaseError(error) {
   const sqlState = getPostgresSqlState(error);
   switch (sqlState) {
     case "23505":
-      return new ConflictError(error.detail ?? "A record with these values already exists.", {
-        constraint: error.constraint
-      });
+      if (error.detail) {
+        console.error("[database] unique violation", error.detail);
+      }
+      return new ConflictError("A record with these values already exists.");
     case "23503":
-      return new UnprocessableEntityError(error.detail ?? "Referenced record does not exist.", {
-        constraint: error.constraint
-      });
+      if (error.detail) {
+        console.error("[database] foreign-key violation", error.detail);
+      }
+      return new UnprocessableEntityError("Referenced record does not exist.");
     case "23502":
-      return new BadRequestError(error.detail ?? "Required field is missing.", {
-        constraint: error.constraint
-      });
+      if (error.detail) {
+        console.error("[database] not-null violation", error.detail);
+      }
+      return new BadRequestError("Required field is missing.");
     case "23514":
-      return new BadRequestError(error.detail ?? "Value violates a database constraint.", {
-        constraint: error.constraint
-      });
+      if (error.detail) {
+        console.error("[database] check violation", error.detail);
+      }
+      return new BadRequestError("Value violates a database constraint.");
     default:
       return new InternalServerError("Database operation failed.");
   }
@@ -101,8 +105,21 @@ async function withDatabaseErrorHandling(operation) {
     throw mapDatabaseError(error);
   }
 }
+function isUniqueConstraintError(error) {
+  if (!isPostgresError(error)) {
+    return false;
+  }
+  if (error.code === "SQLITE_CONSTRAINT_UNIQUE" || error.code === "SQLITE_CONSTRAINT_PRIMARYKEY") {
+    return true;
+  }
+  if (error.errno === 1062) {
+    return true;
+  }
+  return getPostgresSqlState(error) === "23505";
+}
 export {
   isPostgresError,
+  isUniqueConstraintError,
   mapDatabaseError,
   withDatabaseErrorHandling
 };

package/dist/entries/database/model.js

@@ -858,7 +858,7 @@ class BelongsToManyRelationQuery {
   }
   async get() {
     const parentId = this.parent.get(this.relation.parentKey);
-    const pivotRows = await this.connection().unsafe(`SELECT * FROM ${this.relation.pivotTable} WHERE ${String(this.relation.foreignPivotKey)} = $1`, [parentId]);
+    const pivotRows = await this.connection().unsafe(`SELECT * FROM ${quoteIdentifier(this.relation.pivotTable)} WHERE ${quoteIdentifier(String(this.relation.foreignPivotKey))} = $1`, [parentId]);
     if (pivotRows.length === 0) {
       return [];
     }
@@ -881,7 +881,7 @@ class BelongsToManyRelationQuery {
   }
   async count() {
     const parentId = this.parent.get(this.relation.parentKey);
-    const rows = await this.connection().unsafe(`SELECT COUNT(*) AS count FROM ${this.relation.pivotTable} WHERE ${String(this.relation.foreignPivotKey)} = $1`, [parentId]);
+    const rows = await this.connection().unsafe(`SELECT COUNT(*) AS count FROM ${quoteIdentifier(this.relation.pivotTable)} WHERE ${quoteIdentifier(String(this.relation.foreignPivotKey))} = $1`, [parentId]);
     return Number(rows[0]?.count ?? 0);
   }
   async pluck(column, keyBy) {
@@ -893,7 +893,7 @@ class BelongsToManyRelationQuery {
   }
   async relatedQuery() {
     const parentId = this.parent.get(this.relation.parentKey);
-    const pivotRows = await this.connection().unsafe(`SELECT * FROM ${this.relation.pivotTable} WHERE ${String(this.relation.foreignPivotKey)} = $1`, [parentId]);
+    const pivotRows = await this.connection().unsafe(`SELECT * FROM ${quoteIdentifier(this.relation.pivotTable)} WHERE ${quoteIdentifier(String(this.relation.foreignPivotKey))} = $1`, [parentId]);
     if (pivotRows.length === 0) {
       return null;
     }
@@ -916,18 +916,18 @@ class BelongsToManyRelationQuery {
     const list = Array.isArray(ids) ? ids : [ids];
     const parentId = this.parent.get(this.relation.parentKey);
     const extraKeys = Object.keys(this.pivotValues);
-    const extraColumns = extraKeys.length > 0 ? `, ${extraKeys.join(", ")}` : "";
+    const extraColumns = extraKeys.length > 0 ? `, ${extraKeys.map((key) => quoteIdentifier(key)).join(", ")}` : "";
     const extraPlaceholders = extraKeys.map((_, index) => `$${index + 3}`).join(", ");
     const extraValues = extraKeys.map((key) => this.pivotValues[key]);
     for (const id of list) {
-      await this.connection().unsafe(extraKeys.length > 0 ? `INSERT INTO ${this.relation.pivotTable} (${String(this.relation.foreignPivotKey)}, ${String(this.relation.relatedPivotKey)}${extraColumns}) VALUES ($1, $2, ${extraPlaceholders})` : `INSERT INTO ${this.relation.pivotTable} (${String(this.relation.foreignPivotKey)}, ${String(this.relation.relatedPivotKey)}) VALUES ($1, $2)`, [parentId, id, ...extraValues]);
+      await this.connection().unsafe(extraKeys.length > 0 ? `INSERT INTO ${quoteIdentifier(this.relation.pivotTable)} (${quoteIdentifier(String(this.relation.foreignPivotKey))}, ${quoteIdentifier(String(this.relation.relatedPivotKey))}${extraColumns}) VALUES ($1, $2, ${extraPlaceholders})` : `INSERT INTO ${quoteIdentifier(this.relation.pivotTable)} (${quoteIdentifier(String(this.relation.foreignPivotKey))}, ${quoteIdentifier(String(this.relation.relatedPivotKey))}) VALUES ($1, $2)`, [parentId, id, ...extraValues]);
     }
   }
   async toggle(ids) {
     const list = Array.isArray(ids) ? ids : [ids];
     const parentId = this.parent.get(this.relation.parentKey);
     for (const id of list) {
-      const existing = await this.connection().unsafe(`SELECT 1 FROM ${this.relation.pivotTable} WHERE ${String(this.relation.foreignPivotKey)} = $1 AND ${String(this.relation.relatedPivotKey)} = $2 LIMIT 1`, [parentId, id]);
+      const existing = await this.connection().unsafe(`SELECT 1 FROM ${quoteIdentifier(this.relation.pivotTable)} WHERE ${quoteIdentifier(String(this.relation.foreignPivotKey))} = $1 AND ${quoteIdentifier(String(this.relation.relatedPivotKey))} = $2 LIMIT 1`, [parentId, id]);
       if (existing.length > 0) {
         await this.detach(id);
       } else {
@@ -938,12 +938,12 @@ class BelongsToManyRelationQuery {
   async detach(ids) {
     const parentId = this.parent.get(this.relation.parentKey);
     if (ids === undefined) {
-      await this.connection().unsafe(`DELETE FROM ${this.relation.pivotTable} WHERE ${String(this.relation.foreignPivotKey)} = $1`, [parentId]);
+      await this.connection().unsafe(`DELETE FROM ${quoteIdentifier(this.relation.pivotTable)} WHERE ${quoteIdentifier(String(this.relation.foreignPivotKey))} = $1`, [parentId]);
       return;
     }
     const list = Array.isArray(ids) ? ids : [ids];
     const placeholders = list.map((_, index) => `$${index + 2}`).join(", ");
-    await this.connection().unsafe(`DELETE FROM ${this.relation.pivotTable} WHERE ${String(this.relation.foreignPivotKey)} = $1 AND ${String(this.relation.relatedPivotKey)} IN (${placeholders})`, [parentId, ...list]);
+    await this.connection().unsafe(`DELETE FROM ${quoteIdentifier(this.relation.pivotTable)} WHERE ${quoteIdentifier(String(this.relation.foreignPivotKey))} = $1 AND ${quoteIdentifier(String(this.relation.relatedPivotKey))} IN (${placeholders})`, [parentId, ...list]);
   }
   async sync(ids) {
     await this.detach();
@@ -1610,7 +1610,7 @@ function hashCastValue(value) {
   if (isAlreadyHashed(plain)) {
     return plain;
   }
-  return Bun.password.hashSync(plain, { algorithm: "bcrypt", cost: 10 });
+  return Bun.password.hashSync(plain, { algorithm: "bcrypt", cost: 12 });
 }
 function hydrateValue(value, cast) {
   if (value === null || value === undefined) {

package/dist/entries/facades.js

@@ -117,6 +117,28 @@ function resolveSmtpConfig() {
     ...process.env.MAIL_PASSWORD?.trim() ? { password: process.env.MAIL_PASSWORD.trim() } : {}
   };
 }
+var EMAIL_SHAPE = /^[^\s@\r\n]+@[^\s@\r\n]+\.[^\s@\r\n]+$/u;
+function assertSafeSmtpField(value, field) {
+  if (/[\r\n]/u.test(value)) {
+    throw new Error(`Mail ${field} must not contain CR or LF.`);
+  }
+  return value;
+}
+function smtpEnvelopeAddress(value, field) {
+  const trimmed = assertSafeSmtpField(value, field).trim();
+  const address = trimmed.includes("<") ? trimmed.match(/<([^>]+)>/u)?.[1] ?? trimmed : trimmed;
+  if (!EMAIL_SHAPE.test(address)) {
+    throw new Error(`Mail ${field} must be a valid email address.`);
+  }
+  return address;
+}
+function assertSafeSmtpAddress(value, field) {
+  smtpEnvelopeAddress(value, field);
+  return assertSafeSmtpField(value, field).trim();
+}
+function redactMailBody(body) {
+  return body.replace(/https?:\/\/[^\s]+/giu, "[redacted-url]").replace(/[?&](token|signature|expires|code)=[^&\s]+/giu, "[redacted-query]");
+}
 function encodeBase64(value) {
   return Buffer.from(value, "utf8").toString("base64");
 }
@@ -181,6 +203,12 @@ async function openSmtpConnection(config) {
   return { socket, readResponse };
 }
 async function defaultSmtpTransport(config, message) {
+  if (config.username) {
+    assertSafeSmtpField(config.username, "username");
+  }
+  if (config.password) {
+    assertSafeSmtpField(config.password, "password");
+  }
   const { socket, readResponse } = await openSmtpConnection(config);
   try {
     await waitForSmtpResponse(readResponse, ["220"]);
@@ -198,16 +226,24 @@ async function defaultSmtpTransport(config, message) {
 `);
       await waitForSmtpResponse(readResponse, ["235"]);
     }
-    await socket.write(`MAIL FROM:<${config.from}>\r
+    const fromHeader = assertSafeSmtpAddress(config.from, "from");
+    const toHeader = assertSafeSmtpAddress(message.to, "to");
+    const from = smtpEnvelopeAddress(config.from, "from");
+    const to = smtpEnvelopeAddress(message.to, "to");
+    await socket.write(`MAIL FROM:<${from}>\r
 `);
     await waitForSmtpResponse(readResponse, ["250"]);
-    await socket.write(`RCPT TO:<${message.to}>\r
+    await socket.write(`RCPT TO:<${to}>\r
 `);
     await waitForSmtpResponse(readResponse, ["250", "251"]);
     await socket.write(`DATA\r
 `);
     await waitForSmtpResponse(readResponse, ["354"]);
-    const payload = buildSmtpPayload(config.from, message);
+    const payload = buildSmtpPayload(fromHeader, {
+      ...message,
+      to: toHeader,
+      subject: assertSafeSmtpField(message.subject, "subject")
+    });
     await socket.write(payload);
     await waitForSmtpResponse(readResponse, ["250"]);
     await socket.write(`QUIT\r
@@ -218,10 +254,13 @@ async function defaultSmtpTransport(config, message) {
   }
 }
 function buildSmtpPayload(from, message) {
+  const safeFrom = assertSafeSmtpAddress(from, "from");
+  const safeTo = assertSafeSmtpAddress(message.to, "to");
+  const safeSubject = assertSafeSmtpField(message.subject, "subject");
   const headers = [
-    `From: ${from}`,
-    `To: ${message.to}`,
-    `Subject: ${message.subject}`,
+    `From: ${safeFrom}`,
+    `To: ${safeTo}`,
+    `Subject: ${safeSubject}`,
     "MIME-Version: 1.0"
   ];
   if (message.html) {
@@ -254,7 +293,7 @@ class LogMailDriver {
       channel: "mail",
       to: message.to,
       subject: message.subject,
-      body: message.body,
+      body: redactMailBody(message.body),
       ...message.html ? { htmlBytes: Buffer.byteLength(message.html, "utf8") } : {}
     }));
   }
@@ -278,6 +317,8 @@ class Mailer {
     this.driver = driver;
   }
   send(message) {
+    assertSafeSmtpAddress(message.to, "to");
+    assertSafeSmtpField(message.subject, "subject");
     return this.driver.send(message);
   }
 }
@@ -295,9 +336,31 @@ function mailer() {
 
 // ../../src/core/storage/storage.ts
 import { mkdir, readFile, unlink, writeFile } from "fs/promises";
-import { dirname, join } from "path";
+import { dirname } from "path";
 var {S3Client } = globalThis.Bun;
 
+// ../../src/core/security/safePath.ts
+import { isAbsolute, resolve, sep } from "path";
+function assertPathUnderRoot(rootDirectory, userPath) {
+  const trimmed = userPath.trim();
+  if (trimmed.length === 0) {
+    throw new Error("Path must not be empty.");
+  }
+  if (trimmed.includes("\x00")) {
+    throw new Error("Path must not contain a null byte.");
+  }
+  const root = resolve(rootDirectory);
+  const candidate = isAbsolute(trimmed) ? resolve(trimmed) : resolve(root, trimmed.replace(/^\/+/u, ""));
+  if (candidate === root || candidate.startsWith(`${root}${sep}`)) {
+    return candidate;
+  }
+  throw new Error("Path escapes the storage root.");
+}
+function assertUrlPathUnderRoot(rootDirectory, urlPathname) {
+  return assertPathUnderRoot(rootDirectory, urlPathname.replace(/^\/+/u, ""));
+}
+
+// ../../src/core/storage/storage.ts
 class LocalStorageDriver {
   rootDirectory;
   constructor(rootDirectory) {
@@ -307,7 +370,7 @@ class LocalStorageDriver {
     return this.rootDirectory ?? process.env.STORAGE_PATH ?? "storage";
   }
   resolvePath(path) {
-    return join(this.resolveRootDirectory(), path.replace(/^\/+/, ""));
+    return assertPathUnderRoot(this.resolveRootDirectory(), path);
   }
   async put(path, contents) {
     const absolutePath = this.resolvePath(path);

package/dist/entries/http/authMiddleware.js

@@ -1,21 +1,14 @@
 // @bun
 // ../../src/core/http/authMiddleware.ts
-import { authContext, runWithAuthUser } from "@getstrata/core/auth/authContext";
+import {
+  authContext,
+  runWithAuthContext
+} from "@getstrata/core/auth/authContext";
 function createAuthMiddleware(auth) {
   return async (request, next) => {
-    const user = await auth.resolve(request);
-    return await runWithAuthUser(user, async () => {
-      const response = await next();
-      if (user) {
-        const headers = new Headers(response.headers);
-        headers.set("x-authenticated-user-id", String(user.id));
-        return new Response(response.body, {
-          status: response.status,
-          statusText: response.statusText,
-          headers
-        });
-      }
-      return response;
+    const resolved = typeof auth.resolveWithSource === "function" ? await auth.resolveWithSource(request) : { user: await auth.resolve(request), credentialSource: null };
+    return await runWithAuthContext(resolved.user, resolved.credentialSource, async () => {
+      return await next();
     });
   };
 }

package/dist/entries/http/corsMiddleware.js

@@ -19,9 +19,72 @@ function envFlagEnabled(value) {
   return value === "true";
 }
 
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "strata";
+}
+function appCookieName(kind) {
+  return `${appKeyPrefix()}_${kind}`;
+}
+function appDevSecret(kind) {
+  return `${appKeyPrefix()}-dev-${kind}`;
+}
+function requireConfiguredSecret(names, devKind, env = process.env) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  if (isProductionEnv(env)) {
+    throw new Error(`${names[0]} must be set outside development. Do not derive secrets from the app name.`);
+  }
+  return appDevSecret(devKind);
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "Strata";
+}
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
+
 // ../../src/core/http/corsMiddleware.ts
 function defaultAllowedOrigins() {
-  return isProductionEnv() ? "" : "*";
+  return appUrl();
 }
 function resolveCorsConfig() {
   return {
@@ -35,7 +98,8 @@ function resolveCorsConfig() {
       "X-Authenticated-User-Id",
       "X-Authenticated-User-Role",
       "If-Match",
-      "If-None-Match"
+      "If-None-Match",
+      "X-CSRF-Token"
     ],
     maxAgeSeconds: 86400
   };
@@ -74,6 +138,9 @@ function buildCorsHeaders(request) {
   headers.set("Access-Control-Allow-Methods", corsConfig.allowedMethods.join(", "));
   headers.set("Access-Control-Allow-Headers", corsConfig.allowedHeaders.join(", "));
   headers.set("Access-Control-Max-Age", String(corsConfig.maxAgeSeconds));
+  if (allowOrigin !== "*") {
+    headers.set("Access-Control-Allow-Credentials", "true");
+  }
   return headers;
 }
 export {

package/dist/entries/http/csrfMiddleware.js

@@ -1,5 +1,6 @@
 // @bun
 // ../../src/core/http/csrfMiddleware.ts
+import { currentCredentialSource } from "@getstrata/core/auth/authContext";
 import { ForbiddenError } from "@getstrata/core/errors/http";
 
 // ../../src/core/http/csrfToken.ts
@@ -149,7 +150,7 @@ function csrfCookieName() {
   return process.env.CSRF_COOKIE_NAME?.trim() || appCookieName("csrf");
 }
 function resolveCsrfSecret() {
-  return requireConfiguredSecret(["SESSION_SECRET", "OAUTH_STATE_SECRET", "ADMIN_API_TOKEN"], "csrf-secret");
+  return requireConfiguredSecret(["SESSION_SECRET", "CSRF_SECRET"], "csrf-secret");
 }
 function csrfVerifyOptions() {
   return { secret: resolveCsrfSecret(), maxAge: CSRF_TTL_MS };
@@ -167,7 +168,7 @@ function createCsrfTokenCookie() {
   const secure = isProductionEnv() ? "; Secure" : "";
   return {
     token,
-    cookie: `${csrfCookieName()}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}${secure}`
+    cookie: `${csrfCookieName()}=${encodeURIComponent(token)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}${secure}`
   };
 }
 function resolveCsrfToken(request) {
@@ -224,50 +225,22 @@ function resolveCsrfTokenForRequest(request) {
   return resolveCsrfToken(request).token;
 }
 
-// ../../src/core/http/statelessAuth.ts
-function authorizationScheme(request) {
-  const header = request.headers.get("authorization")?.trim() ?? "";
-  const scheme = header.split(/\s+/, 1)[0];
-  return scheme ? scheme.toLowerCase() : "";
-}
-function requestUsesHeaderCredentials(request) {
-  const scheme = authorizationScheme(request);
-  return scheme === "bearer" || scheme === "basic";
-}
-function readBearerToken(request) {
-  const header = request.headers.get("authorization")?.trim() ?? "";
-  if (!header.toLowerCase().startsWith("bearer ")) {
-    return null;
-  }
-  const token = header.slice("Bearer ".length).trim();
-  return token.length > 0 ? token : null;
-}
-function readBasicCredentials(request) {
-  const header = request.headers.get("authorization")?.trim() ?? "";
-  if (!header.toLowerCase().startsWith("basic ")) {
-    return null;
-  }
-  const encoded = header.slice("Basic ".length).trim();
-  if (!encoded) {
-    return null;
+// ../../src/core/http/csrfMiddleware.ts
+var MUTATING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+function samlAcsPathname() {
+  const configured = process.env.SAML_ACS_URL?.trim();
+  if (!configured) {
+    return "/auth/saml/acs";
   }
   try {
-    const decoded = Buffer.from(encoded, "base64").toString("utf8");
-    const separator = decoded.indexOf(":");
-    if (separator < 0) {
-      return null;
-    }
-    return {
-      username: decoded.slice(0, separator),
-      password: decoded.slice(separator + 1)
-    };
+    return new URL(configured, "http://strata.invalid").pathname;
   } catch {
-    return null;
+    return "/auth/saml/acs";
   }
 }
-
-// ../../src/core/http/csrfMiddleware.ts
-var MUTATING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+function skipsCsrfPath(pathname) {
+  return pathname === samlAcsPathname() || pathname.startsWith("/scim/");
+}
 function appendSetCookie(response, cookie) {
   const headers = new Headers(response.headers);
   headers.append("set-cookie", cookie);
@@ -279,13 +252,18 @@ function appendSetCookie(response, cookie) {
 }
 function createCsrfMiddleware() {
   return async (request, next) => {
-    if (requestUsesHeaderCredentials(request)) {
+    const credentialSource = currentCredentialSource();
+    if (credentialSource === "bearer" || credentialSource === "basic") {
+      return await next();
+    }
+    const pathname = new URL(request.url).pathname;
+    if (skipsCsrfPath(pathname)) {
       return await next();
     }
     const method = request.method.toUpperCase();
     if (!MUTATING_METHODS.has(method)) {
-      const csrf = resolveCsrfToken(request);
       const meta = currentRequestMeta();
+      const csrf = meta.csrfToken ? { token: meta.csrfToken } : resolveCsrfToken(request);
       meta.csrfToken = csrf.token;
       const response = await next();
       if (!csrf.cookie) {
@@ -297,6 +275,18 @@ function createCsrfMiddleware() {
     if (!verifyCsrfToken(request, submitted)) {
       throw new ForbiddenError("Invalid or missing CSRF token.");
     }
+    const originHeader = request.headers.get("origin");
+    let headerOrigin = null;
+    if (originHeader) {
+      try {
+        headerOrigin = new URL(originHeader).origin;
+      } catch {
+        headerOrigin = null;
+      }
+    }
+    if (!headerOrigin || headerOrigin !== new URL(request.url).origin) {
+      throw new ForbiddenError("Cross-site cookie requests are not allowed.");
+    }
     return await next();
   };
 }

package/dist/entries/http/csrfToken.js

@@ -146,7 +146,7 @@ function csrfCookieName() {
   return process.env.CSRF_COOKIE_NAME?.trim() || appCookieName("csrf");
 }
 function resolveCsrfSecret() {
-  return requireConfiguredSecret(["SESSION_SECRET", "OAUTH_STATE_SECRET", "ADMIN_API_TOKEN"], "csrf-secret");
+  return requireConfiguredSecret(["SESSION_SECRET", "CSRF_SECRET"], "csrf-secret");
 }
 function csrfVerifyOptions() {
   return { secret: resolveCsrfSecret(), maxAge: CSRF_TTL_MS };
@@ -164,7 +164,7 @@ function createCsrfTokenCookie() {
   const secure = isProductionEnv() ? "; Secure" : "";
   return {
     token,
-    cookie: `${csrfCookieName()}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}${secure}`
+    cookie: `${csrfCookieName()}=${encodeURIComponent(token)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}${secure}`
   };
 }
 function resolveCsrfToken(request) {

package/dist/entries/http/flashMiddleware.js

@@ -155,10 +155,12 @@ function createFlashCookie(message) {
   const payload = Buffer.from(JSON.stringify(message), "utf8").toString("base64url");
   const issuedAt = Date.now();
   const value = signFlashPayload(payload, issuedAt);
-  return `${flashCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=60`;
+  const secure = isProductionEnv() ? "; Secure" : "";
+  return `${flashCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=60${secure}`;
 }
 function clearFlashCookie() {
-  return `${flashCookieName()}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
+  const secure = isProductionEnv() ? "; Secure" : "";
+  return `${flashCookieName()}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0${secure}`;
 }
 function pullFlash(request) {
   const cookieValue = readFlashCookie(request);

package/dist/entries/http/flashSession.js

@@ -155,10 +155,12 @@ function createFlashCookie(message) {
   const payload = Buffer.from(JSON.stringify(message), "utf8").toString("base64url");
   const issuedAt = Date.now();
   const value = signFlashPayload(payload, issuedAt);
-  return `${flashCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=60`;
+  const secure = isProductionEnv() ? "; Secure" : "";
+  return `${flashCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=60${secure}`;
 }
 function clearFlashCookie() {
-  return `${flashCookieName()}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
+  const secure = isProductionEnv() ? "; Secure" : "";
+  return `${flashCookieName()}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0${secure}`;
 }
 function pullFlash(request) {
   const cookieValue = readFlashCookie(request);

package/dist/entries/http/formRequest.js

@@ -5,7 +5,7 @@ import { ForbiddenError } from "@getstrata/core/errors/http";
 // ../../src/core/http/validation.ts
 import { currentAuthUser } from "@getstrata/core/auth/authContext";
 import { BadRequestError } from "@getstrata/core/errors/http";
-import { currentTenantId } from "@getstrata/core/tenant/tenantContext";
+import { currentTenant } from "@getstrata/core/tenant/tenantContext";
 function buildRequestCacheKey(fallbackPath, request) {
   if (!request) {
     return fallbackPath;
@@ -13,7 +13,7 @@ function buildRequestCacheKey(fallbackPath, request) {
   const url = new URL(request.url);
   const user = currentAuthUser();
   const authScope = user ? `u:${user.id}` : "guest";
-  const tenantScope = `t:${currentTenantId()}`;
+  const tenantScope = `t:${currentTenant()?.id ?? "none"}`;
   return `${authScope}|${tenantScope}|${url.pathname}${url.search}`;
 }
 function getQueryParams(request) {