@getstrata/core 1.0.8 → 1.1.0

package/dist/entries/security/recoveryCodes.js

@@ -4,7 +4,7 @@ import { randomBytes } from "crypto";
 import { hashApiToken } from "@getstrata/core/auth/tokenHash";
 import { timingSafeCompareString } from "@getstrata/core/security/timingSafeCompare";
 var DEFAULT_RECOVERY_CODE_COUNT = 8;
-var RECOVERY_CODE_BYTES = 4;
+var RECOVERY_CODE_BYTES = 16;
 function normalizeRecoveryCode(code) {
   return code.replace(/[^a-z0-9]/giu, "").toLowerCase();
 }
@@ -12,7 +12,7 @@ function formatRecoveryCode(normalized) {
   if (normalized.length !== RECOVERY_CODE_BYTES * 2) {
     return normalized;
   }
-  return `${normalized.slice(0, 4)}-${normalized.slice(4)}`;
+  return normalized.match(/.{1,4}/gu)?.join("-") ?? normalized;
 }
 function generateRecoveryCodes(count = DEFAULT_RECOVERY_CODE_COUNT) {
   const size = Number.isInteger(count) && count > 0 ? count : DEFAULT_RECOVERY_CODE_COUNT;

package/dist/entries/security/safeFetch.js

@@ -1,4 +1,8 @@
 // @bun
+// ../../src/core/security/safeUrl.ts
+import { lookup as dnsLookupImpl } from "dns/promises";
+import { BadRequestError } from "@getstrata/core/errors/http";
+
 // ../../src/core/runtime/appEnv.ts
 var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
 function normalizeEnvValue(value) {
@@ -19,72 +23,7 @@ function envFlagEnabled(value) {
   return value === "true";
 }
 
-// ../../src/core/runtime/appKeyPrefix.ts
-function appKeyPrefix() {
-  return process.env.APP_KEY_PREFIX?.trim() || "strata";
-}
-function appCookieName(kind) {
-  return `${appKeyPrefix()}_${kind}`;
-}
-function appDevSecret(kind) {
-  return `${appKeyPrefix()}-dev-${kind}`;
-}
-function requireConfiguredSecret(names, devKind, env = process.env) {
-  for (const name of names) {
-    const value = env[name]?.trim();
-    if (value) {
-      return value;
-    }
-  }
-  if (isProductionEnv(env)) {
-    throw new Error(`${names[0]} must be set outside development. Do not derive secrets from the app name.`);
-  }
-  return appDevSecret(devKind);
-}
-function namespacedRedisKey(kind) {
-  return `${appKeyPrefix()}:${kind}`;
-}
-function smtpEhloHost() {
-  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
-  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
-  return safe || "strata.local";
-}
-function siemEventType() {
-  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
-}
-function appUserAgent() {
-  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
-}
-function otelServiceName() {
-  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
-}
-function appDisplayName() {
-  return process.env.APP_NAME?.trim() || "Strata";
-}
-function appEnv() {
-  return process.env.APP_ENV?.trim() || "local";
-}
-function appUrl() {
-  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
-}
-function apiPrefix() {
-  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
-  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
-  const trimmed = withSlash.replace(/\/+$/, "");
-  return trimmed || "/api/v1";
-}
-function sdkClientClassName() {
-  const override = process.env.APP_SDK_CLASS?.trim();
-  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
-    return override;
-  }
-  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
-  return fromName ? `${fromName}Client` : "AppClient";
-}
-
 // ../../src/core/security/safeUrl.ts
-import { lookup as dnsLookupImpl } from "dns/promises";
-import { BadRequestError } from "@getstrata/core/errors/http";
 var dnsLookup = dnsLookupImpl;
 var BLOCKED_HOSTNAMES = new Set([
   "localhost",
@@ -93,34 +32,144 @@ var BLOCKED_HOSTNAMES = new Set([
   "::1",
   "metadata.google.internal"
 ]);
-function isPrivateIpv4(hostname) {
-  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
-  if (!match) {
-    return false;
+function parseCanonicalDottedDecimal(hostname) {
+  const parts = hostname.split(".");
+  if (parts.length !== 4) {
+    return null;
   }
-  const octets = match.slice(1, 5).map((part) => Number.parseInt(part, 10));
-  if (octets.some((octet) => octet < 0 || octet > 255)) {
-    return true;
+  const octets = [];
+  for (const part of parts) {
+    if (!/^(0|[1-9]\d{0,2})$/u.test(part)) {
+      return null;
+    }
+    const value = Number.parseInt(part, 10);
+    if (!Number.isInteger(value) || value < 0 || value > 255) {
+      return null;
+    }
+    octets.push(value);
   }
+  return octets;
+}
+function parseDottedIpv4(hostname) {
+  return parseCanonicalDottedDecimal(hostname);
+}
+function isBlockedIpv4Octets(octets) {
   const [a = 0, b = 0] = octets;
-  if (a === 10) {
+  if (a === 10 || a === 127 || a === 0) {
     return true;
   }
-  if (a === 127) {
+  if (a === 169 && b === 254) {
     return true;
   }
-  if (a === 0) {
+  if (a === 172 && b >= 16 && b <= 31) {
     return true;
   }
-  if (a === 169 && b === 254) {
+  if (a === 192 && b === 168) {
     return true;
   }
-  if (a === 172 && b >= 16 && b <= 31) {
+  if (a === 100 && b >= 64 && b <= 127) {
     return true;
   }
-  if (a === 192 && b === 168) {
+  if (a === 198 && (b === 18 || b === 19)) {
+    return true;
+  }
+  return false;
+}
+function expandIpv6(hostname) {
+  const trimmed = hostname.trim().toLowerCase();
+  const unbracketed = trimmed.startsWith("[") && trimmed.endsWith("]") ? trimmed.slice(1, -1) : trimmed;
+  if (unbracketed.includes("%")) {
+    return null;
+  }
+  const mapped = unbracketed.match(/^::ffff:([0-9a-fx.]+)$/iu);
+  if (mapped?.[1]) {
+    const octets = parseDottedIpv4(mapped[1]);
+    if (!octets) {
+      return null;
+    }
+    return [
+      0,
+      0,
+      0,
+      0,
+      0,
+      65535,
+      octets[0] << 8 | octets[1],
+      octets[2] << 8 | octets[3]
+    ];
+  }
+  const halves = unbracketed.split("::");
+  if (halves.length > 2) {
+    return null;
+  }
+  const parseGroup = (part) => {
+    if (!/^[0-9a-f]{1,4}$/u.test(part)) {
+      return null;
+    }
+    return Number.parseInt(part, 16);
+  };
+  if (halves.length === 1) {
+    const groups = unbracketed.split(":");
+    if (groups.length !== 8) {
+      return null;
+    }
+    const values = groups.map(parseGroup);
+    return values.every((value) => value !== null) ? values : null;
+  }
+  const head = halves[0] ? halves[0].split(":").filter(Boolean) : [];
+  const tail = halves[1] ? halves[1].split(":").filter(Boolean) : [];
+  if (head.length + tail.length > 8) {
+    return null;
+  }
+  const values = [];
+  for (const part of head) {
+    const value = parseGroup(part);
+    if (value === null) {
+      return null;
+    }
+    values.push(value);
+  }
+  while (values.length < 8 - tail.length) {
+    values.push(0);
+  }
+  for (const part of tail) {
+    const value = parseGroup(part);
+    if (value === null) {
+      return null;
+    }
+    values.push(value);
+  }
+  return values.length === 8 ? values : null;
+}
+function isBlockedIpv6(hostname) {
+  const groups = expandIpv6(hostname);
+  if (!groups) {
+    return hostname.includes(":");
+  }
+  const first = groups[0] ?? 0;
+  const second = groups[1] ?? 0;
+  if (groups.every((group) => group === 0)) {
+    return true;
+  }
+  if (groups.slice(0, 7).every((group) => group === 0) && groups[7] === 1) {
+    return true;
+  }
+  if ((first & 65472) === 65152) {
+    return true;
+  }
+  if ((first & 65024) === 64512) {
     return true;
   }
+  if ((first & 65280) === 65280) {
+    return true;
+  }
+  if (first === 0 && second === 0 && groups[2] === 0 && groups[3] === 0 && groups[4] === 0 && groups[5] === 65535) {
+    const a = (groups[6] ?? 0) >> 8;
+    const b = (groups[6] ?? 0) & 255;
+    const c = (groups[7] ?? 0) >> 8;
+    const d = (groups[7] ?? 0) & 255;
+    return isBlockedIpv4Octets([a, b, c, d]);
+  }
   return false;
 }
 function isBlockedHostname(hostname) {
@@ -135,24 +184,43 @@ function isBlockedHostname(hostname) {
     return true;
   }
   if (normalized.includes(":")) {
+    return isBlockedIpv6(normalized);
+  }
+  if (/^\d+$/u.test(normalized)) {
     return true;
   }
-  return isPrivateIpv4(normalized);
+  if (normalized.includes(".")) {
+    const canonical = parseCanonicalDottedDecimal(normalized);
+    if (canonical) {
+      return isBlockedIpv4Octets(canonical);
+    }
+    if (/^[0-9a-fx.]+$/iu.test(normalized)) {
+      return true;
+    }
+  }
+  return false;
+}
+function productionSafeOutboundOptions(options) {
+  if (!isProductionEnv()) {
+    return options;
+  }
+  return { ...options, allowPrivate: false, resolveDns: true };
 }
 function assertSafeOutboundUrl(rawUrl, options = {}) {
+  const resolved = productionSafeOutboundOptions(options);
   let parsed;
   try {
     parsed = new URL(rawUrl);
   } catch {
     throw new BadRequestError("Webhook URL is invalid.");
   }
-  if (parsed.protocol !== "https:" && !(options.allowHttp && parsed.protocol === "http:")) {
+  if (parsed.protocol !== "https:" && !(resolved.allowHttp && parsed.protocol === "http:")) {
     throw new BadRequestError("Webhook URL must use HTTPS.");
   }
   if (parsed.username || parsed.password) {
     throw new BadRequestError("Webhook URL must not include credentials.");
   }
-  if (isBlockedHostname(parsed.hostname)) {
+  if (!resolved.allowPrivate && isBlockedHostname(parsed.hostname)) {
     throw new BadRequestError("Webhook URL targets a blocked host.");
   }
   return parsed;
@@ -160,17 +228,35 @@ function assertSafeOutboundUrl(rawUrl, options = {}) {
 function isBlockedIpAddress(address) {
   return isBlockedHostname(address.trim().toLowerCase());
 }
-async function assertSafeOutboundUrlResolved(rawUrl, options = {}) {
-  const parsed = assertSafeOutboundUrl(rawUrl, options);
-  if (options.resolveDns === false) {
-    return parsed;
+function isLiteralIpHostname(hostname) {
+  return parseCanonicalDottedDecimal(hostname) !== null || expandIpv6(hostname) !== null;
+}
+function pinUrlToAddress(url, address) {
+  const pinned = new URL(url.toString());
+  const ipv6 = expandIpv6(address.replace(/^\[|\]$/gu, ""));
+  pinned.hostname = ipv6 ? `[${address.replace(/^\[|\]$/gu, "")}]` : address;
+  return pinned;
+}
+async function resolveSafeOutboundTarget(rawUrl, options = {}) {
+  const resolvedOptions = productionSafeOutboundOptions(options);
+  const parsed = assertSafeOutboundUrl(rawUrl, resolvedOptions);
+  if (resolvedOptions.resolveDns === false || resolvedOptions.allowPrivate) {
+    return { url: parsed, addresses: [] };
   }
   const hostname = parsed.hostname.trim().toLowerCase();
-  const results = await dnsLookup(hostname, { all: true, verbatim: true });
-  if (results.some((result) => isBlockedIpAddress(result.address))) {
+  if (isLiteralIpHostname(hostname)) {
+    return { url: parsed, addresses: [hostname] };
+  }
+  let results;
+  try {
+    results = await dnsLookup(hostname, { all: true, verbatim: true });
+  } catch {
     throw new BadRequestError("Webhook URL targets a blocked host.");
   }
-  return parsed;
+  if (results.length === 0 || results.some((result) => isBlockedIpAddress(result.address))) {
+    throw new BadRequestError("Webhook URL targets a blocked host.");
+  }
+  return { url: parsed, addresses: results.map((result) => result.address) };
 }
 
 // ../../src/core/security/safeFetch.ts
@@ -178,25 +264,40 @@ var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
 async function safeFetch(input, init = {}, options = {}) {
   const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
   const maxRedirects = options.maxRedirects ?? 0;
-  const resolveDns = options.resolveDns ?? appEnv() === "production";
-  const urlOptions = { allowHttp: options.allowHttp, resolveDns };
+  const resolveDns = options.resolveDns ?? true;
+  const urlOptions = {
+    allowHttp: options.allowHttp,
+    resolveDns,
+    allowPrivate: options.allowPrivate
+  };
   const controller = new AbortController;
   const timeout = setTimeout(() => controller.abort(), timeoutMs);
   try {
-    let currentUrl = (await assertSafeOutboundUrlResolved(input, urlOptions)).toString();
+    let current = await resolveSafeOutboundTarget(input, urlOptions);
     let redirectCount = 0;
     while (true) {
-      const response = await fetch(currentUrl, {
+      const address = current.addresses[0];
+      const fetchUrl = address ? pinUrlToAddress(current.url, address).toString() : current.url.toString();
+      const headers = new Headers(init.headers);
+      if (address && !headers.has("host")) {
+        headers.set("Host", current.url.host);
+      }
+      const fetchInit = {
         ...init,
+        headers,
         signal: controller.signal,
         redirect: "manual"
-      });
+      };
+      if (address) {
+        fetchInit.tls = { serverName: current.url.hostname };
+      }
+      const response = await fetch(fetchUrl, fetchInit);
       if (response.status >= 300 && response.status < 400) {
         const location = response.headers.get("location");
         if (!location || redirectCount >= maxRedirects) {
           return response;
         }
-        currentUrl = (await assertSafeOutboundUrlResolved(new URL(location, currentUrl).toString(), urlOptions)).toString();
+        current = await resolveSafeOutboundTarget(new URL(location, current.url).toString(), urlOptions);
         redirectCount += 1;
         continue;
       }

package/dist/entries/security/safePath.js

@@ -0,0 +1,25 @@
+// @bun
+// ../../src/core/security/safePath.ts
+import { isAbsolute, resolve, sep } from "path";
+function assertPathUnderRoot(rootDirectory, userPath) {
+  const trimmed = userPath.trim();
+  if (trimmed.length === 0) {
+    throw new Error("Path must not be empty.");
+  }
+  if (trimmed.includes("\x00")) {
+    throw new Error("Path must not contain a null byte.");
+  }
+  const root = resolve(rootDirectory);
+  const candidate = isAbsolute(trimmed) ? resolve(trimmed) : resolve(root, trimmed.replace(/^\/+/u, ""));
+  if (candidate === root || candidate.startsWith(`${root}${sep}`)) {
+    return candidate;
+  }
+  throw new Error("Path escapes the storage root.");
+}
+function assertUrlPathUnderRoot(rootDirectory, urlPathname) {
+  return assertPathUnderRoot(rootDirectory, urlPathname.replace(/^\/+/u, ""));
+}
+export {
+  assertPathUnderRoot,
+  assertUrlPathUnderRoot
+};

package/dist/entries/security/scimTenantTokens.js

@@ -30,14 +30,21 @@ function parseScimTenantTokens(raw) {
   return tokens;
 }
 function resolveScimTenantFromToken(token) {
+  const presented = token.trim();
+  if (presented.length === 0) {
+    return null;
+  }
   const tenantTokens = parseScimTenantTokens(process.env.SCIM_TENANT_TOKENS);
   for (const [tenantId, expectedToken] of tenantTokens) {
-    if (timingSafeCompareString(token, expectedToken)) {
+    if (timingSafeCompareString(presented, expectedToken)) {
       return tenantId;
     }
   }
-  const fallbackToken = process.env.SCIM_BEARER_TOKEN ?? "";
-  if (timingSafeCompareString(token, fallbackToken)) {
+  const fallbackToken = process.env.SCIM_BEARER_TOKEN?.trim() ?? "";
+  if (fallbackToken.length === 0) {
+    return null;
+  }
+  if (timingSafeCompareString(presented, fallbackToken)) {
     return 1;
   }
   return null;

package/dist/entries/security/totp.js

@@ -85,6 +85,17 @@ function sdkClientClassName() {
   return fromName ? `${fromName}Client` : "AppClient";
 }
 
+// ../../src/core/security/timingSafeCompare.ts
+import { timingSafeEqual } from "crypto";
+function timingSafeCompareString(left, right) {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  if (leftBuffer.length !== rightBuffer.length) {
+    return false;
+  }
+  return timingSafeEqual(leftBuffer, rightBuffer);
+}
+
 // ../../src/core/security/totp.ts
 function decodeBase32(input) {
   const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
@@ -131,7 +142,7 @@ function buildOtpauthUrl(options) {
   });
   return `otpauth://totp/${encodeURIComponent(label)}?${params.toString()}`;
 }
-function generateTotp(secret, counter, digits = 6) {
+function generateTotp(secret, counter = Math.floor(Date.now() / 30000), digits = 6) {
   const key = decodeBase32(secret);
   const buffer = Buffer.alloc(8);
   buffer.writeBigUInt64BE(BigInt(counter));
@@ -151,12 +162,13 @@ function verifyTotp(secret, token, window = 1) {
     return false;
   }
   const timestep = Math.floor(Date.now() / 30000);
+  let matched = false;
   for (let offset = -window;offset <= window; offset += 1) {
-    if (generateTotp(secret, timestep + offset) === normalized) {
-      return true;
+    if (timingSafeCompareString(generateTotp(secret, timestep + offset), normalized)) {
+      matched = true;
     }
   }
-  return false;
+  return matched;
 }
 export {
   buildOtpauthUrl,

package/dist/entries/storage/storage.js

@@ -1,9 +1,31 @@
 // @bun
 // ../../src/core/storage/storage.ts
 import { mkdir, readFile, unlink, writeFile } from "fs/promises";
-import { dirname, join } from "path";
+import { dirname } from "path";
 var {S3Client } = globalThis.Bun;
 
+// ../../src/core/security/safePath.ts
+import { isAbsolute, resolve, sep } from "path";
+function assertPathUnderRoot(rootDirectory, userPath) {
+  const trimmed = userPath.trim();
+  if (trimmed.length === 0) {
+    throw new Error("Path must not be empty.");
+  }
+  if (trimmed.includes("\x00")) {
+    throw new Error("Path must not contain a null byte.");
+  }
+  const root = resolve(rootDirectory);
+  const candidate = isAbsolute(trimmed) ? resolve(trimmed) : resolve(root, trimmed.replace(/^\/+/u, ""));
+  if (candidate === root || candidate.startsWith(`${root}${sep}`)) {
+    return candidate;
+  }
+  throw new Error("Path escapes the storage root.");
+}
+function assertUrlPathUnderRoot(rootDirectory, urlPathname) {
+  return assertPathUnderRoot(rootDirectory, urlPathname.replace(/^\/+/u, ""));
+}
+
+// ../../src/core/storage/storage.ts
 class LocalStorageDriver {
   rootDirectory;
   constructor(rootDirectory) {
@@ -13,7 +35,7 @@ class LocalStorageDriver {
     return this.rootDirectory ?? process.env.STORAGE_PATH ?? "storage";
   }
   resolvePath(path) {
-    return join(this.resolveRootDirectory(), path.replace(/^\/+/, ""));
+    return assertPathUnderRoot(this.resolveRootDirectory(), path);
   }
   async put(path, contents) {
     const absolutePath = this.resolvePath(path);

package/dist/entries/tenant/databaseTenantContext.js

@@ -53,28 +53,50 @@ async function applyBypassToTransaction(transaction, bypass) {
     bypass ? "true" : "false"
   ]);
 }
-async function runWithMigrationBypass(callback) {
-  if (!isRlsTenancy()) {
-    return await callback();
+function stringifyBypassIdentifier(identifier) {
+  if (typeof identifier === "number") {
+    return String(identifier);
   }
-  if (hasActiveDatabaseConnection()) {
-    const activeConnection = getActiveDatabaseConnection(getDefaultDatabasePool());
-    await applyBypassToTransaction(activeConnection, true);
-    try {
-      return await callback();
-    } finally {
-      await applyBypassToTransaction(activeConnection, false);
+  return identifier.trim();
+}
+async function applyIdentifierToTransaction(transaction, identifier) {
+  await transaction.unsafe(`SELECT set_config('app.bypass_identifier', $1, true)`, [
+    stringifyBypassIdentifier(identifier)
+  ]);
+}
+function assertBypassIdentifier(identifier) {
+  if (typeof identifier === "number") {
+    if (!Number.isInteger(identifier) || identifier <= 0) {
+      throw new Error("RLS bypass requires a caller-supplied identifier that pins the row.");
     }
+    return;
+  }
+  if (typeof identifier === "string" && identifier.trim() !== "") {
+    return;
+  }
+  throw new Error("RLS bypass requires a caller-supplied identifier that pins the row.");
+}
+async function runWithScopedTenantTransaction(apply, callback) {
+  if (!isRlsTenancy()) {
+    return await callback();
   }
   const pool = getDefaultDatabasePool();
   if (typeof pool.begin !== "function") {
     throw new Error("RLS migration bypass requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
   }
   return await pool.begin(async (transaction) => {
-    await applyBypassToTransaction(transaction, true);
+    await apply(transaction);
     return await runWithDatabaseConnection(transaction, callback);
   });
 }
+async function runWithMigrationBypass(callback) {
+  return await runWithScopedTenantTransaction((transaction) => applyBypassToTransaction(transaction, true), callback);
+}
+async function runWithMigrationBypassForIdentifier(identifier, callback) {
+  assertBypassIdentifier(identifier);
+  return await runWithScopedTenantTransaction((transaction) => applyIdentifierToTransaction(transaction, identifier), callback);
+}
 export {
-  runWithMigrationBypass
+  runWithMigrationBypass,
+  runWithMigrationBypassForIdentifier
 };