@getstrata/core 1.0.8 → 1.1.0

package/dist/entries/auth/intendedUrlCookie.js

@@ -1,5 +1,6 @@
 // @bun
 // ../../src/core/http/safeInternalPath.ts
+var NESTED_REDIRECT_KEYS = new Set(["redirect", "next", "return", "returnTo", "return_to"]);
 function looksLikeExternalTarget(value) {
   const trimmed = value.trim();
   if (!trimmed.startsWith("/") || trimmed.startsWith("//") || trimmed.includes("\\")) {
@@ -18,11 +19,40 @@ function looksLikeExternalTarget(value) {
   }
   return false;
 }
+function sanitizeNestedQuery(search) {
+  if (!search) {
+    return "";
+  }
+  const params = new URLSearchParams(search.startsWith("?") ? search.slice(1) : search);
+  const next = new URLSearchParams;
+  for (const [key, value] of params.entries()) {
+    if (NESTED_REDIRECT_KEYS.has(key)) {
+      const sanitized = sanitizeInternalPath(value, "/");
+      next.set(key, sanitized);
+      continue;
+    }
+    if (looksLikeExternalTarget(value) && value.includes("://")) {
+      continue;
+    }
+    next.set(key, value);
+  }
+  const serialized = next.toString();
+  return serialized ? `?${serialized}` : "";
+}
 function sanitizeInternalPath(raw, fallback = "/") {
-  if (looksLikeExternalTarget(raw)) {
+  const trimmed = raw.trim();
+  if (looksLikeExternalTarget(trimmed)) {
+    return fallback;
+  }
+  const queryIndex = trimmed.indexOf("?");
+  const hashIndex = trimmed.indexOf("#");
+  const end = [queryIndex, hashIndex].filter((index) => index >= 0).sort((a, b) => a - b)[0];
+  const pathname = end === undefined ? trimmed : trimmed.slice(0, end);
+  if (looksLikeExternalTarget(pathname)) {
     return fallback;
   }
-  return raw;
+  const search = queryIndex >= 0 ? trimmed.slice(queryIndex, hashIndex >= 0 ? hashIndex : undefined) : "";
+  return `${pathname}${sanitizeNestedQuery(search)}`;
 }
 function safeInternalRedirectPath(request, fallback = "/") {
   const url = new URL(request.url);

package/dist/entries/auth/jwt.js

@@ -154,7 +154,7 @@ function verifyJwt(token, secret) {
   if (!payload || payload.sub === undefined || payload.sub === null) {
     return null;
   }
-  if (typeof payload.exp === "number" && payload.exp * 1000 <= Date.now()) {
+  if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp) || payload.exp * 1000 <= Date.now()) {
     return null;
   }
   return payload;

package/dist/entries/auth/jwtGuard.js

@@ -1,4 +1,49 @@
 // @bun
+// ../../src/core/contracts/serviceTokens.ts
+var CORE_CONFIG_TOKEN = "core.config";
+var CORE_CACHE_TOKEN = "core.cache";
+var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_EVENT_BUS_TOKEN = "core.eventBus";
+var CORE_POLICY_GATE_TOKEN = "core.policyGate";
+var CORE_AUTH_TOKEN = "core.auth";
+var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
+var CORE_ABILITY_CHECKER_TOKEN = "core.abilityChecker";
+var CORE_AUTH_USER_DIRECTORY_TOKEN = "core.authUserDirectory";
+function isAbilityChecker(value) {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  const candidate = value;
+  return typeof candidate.tokenCan === "function" && typeof candidate.requireAbility === "function";
+}
+function isAuthUserDirectory(value) {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  return typeof value.findByIdOrThrow === "function";
+}
+function resolveAbilityChecker(container) {
+  if (container.has(CORE_ABILITY_CHECKER_TOKEN)) {
+    return container.resolve(CORE_ABILITY_CHECKER_TOKEN);
+  }
+  return container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+}
+function resolveAuthUserDirectory(container) {
+  if (container.has(CORE_AUTH_USER_DIRECTORY_TOKEN)) {
+    const directory = container.resolve(CORE_AUTH_USER_DIRECTORY_TOKEN);
+    if (isAuthUserDirectory(directory)) {
+      return directory;
+    }
+  }
+  if (container.has(CORE_TOKEN_SERVICE_TOKEN)) {
+    const tokenService = container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    if (isAuthUserDirectory(tokenService)) {
+      return tokenService;
+    }
+  }
+  return null;
+}
+
 // ../../src/core/http/statelessAuth.ts
 function authorizationScheme(request) {
   const header = request.headers.get("authorization")?.trim() ?? "";
@@ -196,13 +241,130 @@ function verifyJwt(token, secret) {
   if (!payload || payload.sub === undefined || payload.sub === null) {
     return null;
   }
-  if (typeof payload.exp === "number" && payload.exp * 1000 <= Date.now()) {
+  if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp) || payload.exp * 1000 <= Date.now()) {
     return null;
   }
   return payload;
 }
 
+// ../../src/core/auth/sessionCookie.ts
+import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+var SESSION_COOKIE = appCookieName("session");
+var SESSION_TTL_SECONDS = 60 * 60 * 24 * 7;
+var SESSION_REMEMBER_TTL_SECONDS = 60 * 60 * 24 * 30;
+function sessionCookieName() {
+  return process.env.SESSION_COOKIE_NAME?.trim() || appCookieName("session");
+}
+function parsePositiveSeconds(raw, fallback) {
+  const parsed = Number.parseInt(raw ?? "", 10);
+  return Number.isInteger(parsed) && parsed > 0 ? parsed : fallback;
+}
+function sessionTtlSeconds() {
+  return parsePositiveSeconds(process.env.SESSION_TTL_SECONDS, SESSION_TTL_SECONDS);
+}
+function sessionRememberTtlSeconds() {
+  return parsePositiveSeconds(process.env.SESSION_REMEMBER_TTL_SECONDS, SESSION_REMEMBER_TTL_SECONDS);
+}
+function resolveSessionSecret() {
+  return requireConfiguredSecret(["SESSION_SECRET"], "session-secret");
+}
+function signSession(userId, issuedAt, ttlSeconds) {
+  const payload = ttlSeconds === undefined ? `${userId}.${issuedAt}` : `${userId}.${issuedAt}.${ttlSeconds}`;
+  const signature = createHmac2("sha256", resolveSessionSecret()).update(payload).digest("hex");
+  return `${payload}.${signature}`;
+}
+function readCookieValue(request, cookieName) {
+  const cookieHeader = request.headers.get("cookie");
+  if (!cookieHeader) {
+    return null;
+  }
+  for (const part of cookieHeader.split(";")) {
+    const [name, ...rest] = part.trim().split("=");
+    if (name === cookieName) {
+      return decodeURIComponent(rest.join("="));
+    }
+  }
+  return null;
+}
+function readSignedSession(userIdRaw, issuedAtRaw, cookieSignature, ttlSeconds, remember) {
+  const userId = Number.parseInt(userIdRaw, 10);
+  const issuedAt = Number.parseInt(issuedAtRaw, 10);
+  if (!Number.isInteger(userId) || userId <= 0 || !Number.isFinite(issuedAt)) {
+    return null;
+  }
+  if (!Number.isInteger(ttlSeconds) || ttlSeconds <= 0) {
+    return null;
+  }
+  if (Date.now() - issuedAt > ttlSeconds * 1000) {
+    return null;
+  }
+  const expectedSignature = (remember ? signSession(userId, issuedAt, ttlSeconds) : signSession(userId, issuedAt)).split(".").pop();
+  if (!expectedSignature || !cookieSignature) {
+    return null;
+  }
+  const expectedBuffer = Buffer.from(expectedSignature);
+  const actualBuffer = Buffer.from(cookieSignature);
+  if (expectedBuffer.length !== actualBuffer.length) {
+    return null;
+  }
+  if (!timingSafeEqual2(expectedBuffer, actualBuffer)) {
+    return null;
+  }
+  return { userId, issuedAt };
+}
+function readSession(request) {
+  const cookieValue = readCookieValue(request, sessionCookieName());
+  if (!cookieValue) {
+    return null;
+  }
+  const parts = cookieValue.split(".");
+  if (parts.length === 4) {
+    const [userIdRaw, issuedAtRaw, ttlRaw, cookieSignature] = parts;
+    return readSignedSession(String(userIdRaw), String(issuedAtRaw), cookieSignature, Number.parseInt(String(ttlRaw), 10), true);
+  }
+  if (parts.length !== 3) {
+    return null;
+  }
+  const [userIdRaw, issuedAtRaw, cookieSignature] = parts;
+  return readSignedSession(String(userIdRaw), String(issuedAtRaw), cookieSignature, sessionTtlSeconds(), false);
+}
+function readSessionUserId(request) {
+  return readSession(request)?.userId ?? null;
+}
+function isSessionInvalidated(issuedAt, validAfter) {
+  if (!validAfter) {
+    return false;
+  }
+  const timestamp = validAfter instanceof Date ? validAfter.getTime() : Date.parse(String(validAfter));
+  if (!Number.isFinite(timestamp)) {
+    return false;
+  }
+  return issuedAt < timestamp;
+}
+function createSessionCookieDetails(userId, options = {}) {
+  const issuedAt = Date.now();
+  const ttlSeconds = options.remember ? sessionRememberTtlSeconds() : sessionTtlSeconds();
+  const value = options.remember ? signSession(userId, issuedAt, ttlSeconds) : signSession(userId, issuedAt);
+  const secure = isProductionEnv() ? "; Secure" : "";
+  return {
+    header: `${sessionCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${ttlSeconds}${secure}`,
+    userId,
+    issuedAt,
+    ttlSeconds
+  };
+}
+function createSessionCookie(userId, options = {}) {
+  return createSessionCookieDetails(userId, options).header;
+}
+function clearSessionCookie() {
+  const secure = isProductionEnv() ? "; Secure" : "";
+  return `${sessionCookieName()}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0${secure}`;
+}
+
 // ../../src/core/auth/jwtGuard.ts
+function isServiceContainer(value) {
+  return "has" in value && "resolve" in value && typeof value.has === "function";
+}
 function authUserFromJwt(payload) {
   return {
     id: payload.sub,
@@ -211,13 +373,20 @@ function authUserFromJwt(payload) {
     ...payload.emailVerifiedAt !== undefined ? { emailVerifiedAt: payload.emailVerifiedAt } : {}
   };
 }
+function jwtSubjectId(payload) {
+  const userId = typeof payload.sub === "number" ? payload.sub : Number.parseInt(String(payload.sub), 10);
+  if (!Number.isInteger(userId) || userId <= 0) {
+    return null;
+  }
+  return userId;
+}
 
 class JwtGuard {
   options;
   constructor(options = {}) {
-    this.options = options;
+    this.options = isServiceContainer(options) ? { container: options } : options;
   }
-  resolve(request) {
+  async resolve(request) {
     const token = readBearerToken(request);
     if (token?.split(".").length !== 3) {
       return null;
@@ -226,6 +395,26 @@ class JwtGuard {
     if (!payload) {
       return null;
     }
+    if (typeof payload.iat !== "number" || !Number.isFinite(payload.iat)) {
+      return null;
+    }
+    const directory = this.options.directory ?? (this.options.container ? resolveAuthUserDirectory(this.options.container) : null);
+    if (!directory) {
+      return null;
+    }
+    const userId = jwtSubjectId(payload);
+    if (userId === null) {
+      return null;
+    }
+    let record;
+    try {
+      record = await directory.findByIdOrThrow(userId);
+    } catch {
+      return null;
+    }
+    if (isSessionInvalidated(payload.iat * 1000, record.session_valid_after)) {
+      return null;
+    }
     return authUserFromJwt(payload);
   }
 }

package/dist/entries/auth/membershipMiddleware.js

@@ -18,6 +18,7 @@ import { ForbiddenError } from "@getstrata/core/errors/http";
 
 // ../../src/core/auth/authContext.ts
 var authContext = createAsyncContextStore("@getstrata/authContext");
+var credentialSourceContext = createAsyncContextStore("@getstrata/credentialSource");
 function currentAuthUser() {
   return authContext.getStore() ?? null;
 }

package/dist/entries/auth/membershipScope.js

@@ -22,6 +22,7 @@ function createAsyncContextStore(key) {
 
 // ../../src/core/auth/authContext.ts
 var authContext = createAsyncContextStore("@getstrata/authContext");
+var credentialSourceContext = createAsyncContextStore("@getstrata/credentialSource");
 function currentAuthUser() {
   return authContext.getStore() ?? null;
 }

package/dist/entries/auth/membershipService.js

@@ -21,6 +21,7 @@ function createAsyncContextStore(key) {
 
 // ../../src/core/auth/authContext.ts
 var authContext = createAsyncContextStore("@getstrata/authContext");
+var credentialSourceContext = createAsyncContextStore("@getstrata/credentialSource");
 function currentAuthUser() {
   return authContext.getStore() ?? null;
 }