@getstrata/core 1.0.9 → 1.1.0

package/dist/entries/http/memoryThrottleMiddleware.js

@@ -156,6 +156,69 @@ function readSpaPrefix() {
 // ../../src/core/view/webErrorView.ts
 import { currentRequestMeta as currentRequestMeta2 } from "@getstrata/core/http/requestMetaContext";
 
+// ../../src/core/http/safeInternalPath.ts
+var NESTED_REDIRECT_KEYS = new Set(["redirect", "next", "return", "returnTo", "return_to"]);
+function looksLikeExternalTarget(value) {
+  const trimmed = value.trim();
+  if (!trimmed.startsWith("/") || trimmed.startsWith("//") || trimmed.includes("\\")) {
+    return true;
+  }
+  if (trimmed.includes("://") || trimmed.includes(":/") || trimmed.includes(":\\")) {
+    return true;
+  }
+  try {
+    const decoded = decodeURIComponent(trimmed);
+    if (decoded.startsWith("//") || decoded.includes("\\") || /https?:/i.test(decoded)) {
+      return true;
+    }
+  } catch {
+    return true;
+  }
+  return false;
+}
+function sanitizeNestedQuery(search) {
+  if (!search) {
+    return "";
+  }
+  const params = new URLSearchParams(search.startsWith("?") ? search.slice(1) : search);
+  const next = new URLSearchParams;
+  for (const [key, value] of params.entries()) {
+    if (NESTED_REDIRECT_KEYS.has(key)) {
+      const sanitized = sanitizeInternalPath(value, "/");
+      next.set(key, sanitized);
+      continue;
+    }
+    if (looksLikeExternalTarget(value) && value.includes("://")) {
+      continue;
+    }
+    next.set(key, value);
+  }
+  const serialized = next.toString();
+  return serialized ? `?${serialized}` : "";
+}
+function sanitizeInternalPath(raw, fallback = "/") {
+  const trimmed = raw.trim();
+  if (looksLikeExternalTarget(trimmed)) {
+    return fallback;
+  }
+  const queryIndex = trimmed.indexOf("?");
+  const hashIndex = trimmed.indexOf("#");
+  const end = [queryIndex, hashIndex].filter((index) => index >= 0).sort((a, b) => a - b)[0];
+  const pathname = end === undefined ? trimmed : trimmed.slice(0, end);
+  if (looksLikeExternalTarget(pathname)) {
+    return fallback;
+  }
+  const search = queryIndex >= 0 ? trimmed.slice(queryIndex, hashIndex >= 0 ? hashIndex : undefined) : "";
+  return `${pathname}${sanitizeNestedQuery(search)}`;
+}
+function safeInternalRedirectPath(request, fallback = "/") {
+  const url = new URL(request.url);
+  return sanitizeInternalPath(`${url.pathname}${url.search}`, fallback);
+}
+function loginRedirectLocation(request) {
+  return `/login?redirect=${encodeURIComponent(safeInternalRedirectPath(request))}`;
+}
+
 // ../../src/core/view/htmlResponse.ts
 function htmlResponse(html, init = {}) {
   return new Response(html, {

package/dist/entries/http/pagination.js

@@ -16,7 +16,7 @@ function buildPaginationMeta(input) {
 // ../../src/core/http/validation.ts
 import { currentAuthUser } from "@getstrata/core/auth/authContext";
 import { BadRequestError } from "@getstrata/core/errors/http";
-import { currentTenantId } from "@getstrata/core/tenant/tenantContext";
+import { currentTenant } from "@getstrata/core/tenant/tenantContext";
 function buildRequestCacheKey(fallbackPath, request) {
   if (!request) {
     return fallbackPath;
@@ -24,7 +24,7 @@ function buildRequestCacheKey(fallbackPath, request) {
   const url = new URL(request.url);
   const user = currentAuthUser();
   const authScope = user ? `u:${user.id}` : "guest";
-  const tenantScope = `t:${currentTenantId()}`;
+  const tenantScope = `t:${currentTenant()?.id ?? "none"}`;
   return `${authScope}|${tenantScope}|${url.pathname}${url.search}`;
 }
 function getQueryParams(request) {

package/dist/entries/http/requirePasswordConfirmMiddleware.js

@@ -31,6 +31,7 @@ function requestPrefersJson(request) {
 }
 
 // ../../src/core/http/safeInternalPath.ts
+var NESTED_REDIRECT_KEYS = new Set(["redirect", "next", "return", "returnTo", "return_to"]);
 function looksLikeExternalTarget(value) {
   const trimmed = value.trim();
   if (!trimmed.startsWith("/") || trimmed.startsWith("//") || trimmed.includes("\\")) {
@@ -49,11 +50,40 @@ function looksLikeExternalTarget(value) {
   }
   return false;
 }
+function sanitizeNestedQuery(search) {
+  if (!search) {
+    return "";
+  }
+  const params = new URLSearchParams(search.startsWith("?") ? search.slice(1) : search);
+  const next = new URLSearchParams;
+  for (const [key, value] of params.entries()) {
+    if (NESTED_REDIRECT_KEYS.has(key)) {
+      const sanitized = sanitizeInternalPath(value, "/");
+      next.set(key, sanitized);
+      continue;
+    }
+    if (looksLikeExternalTarget(value) && value.includes("://")) {
+      continue;
+    }
+    next.set(key, value);
+  }
+  const serialized = next.toString();
+  return serialized ? `?${serialized}` : "";
+}
 function sanitizeInternalPath(raw, fallback = "/") {
-  if (looksLikeExternalTarget(raw)) {
+  const trimmed = raw.trim();
+  if (looksLikeExternalTarget(trimmed)) {
+    return fallback;
+  }
+  const queryIndex = trimmed.indexOf("?");
+  const hashIndex = trimmed.indexOf("#");
+  const end = [queryIndex, hashIndex].filter((index) => index >= 0).sort((a, b) => a - b)[0];
+  const pathname = end === undefined ? trimmed : trimmed.slice(0, end);
+  if (looksLikeExternalTarget(pathname)) {
     return fallback;
   }
-  return raw;
+  const search = queryIndex >= 0 ? trimmed.slice(queryIndex, hashIndex >= 0 ? hashIndex : undefined) : "";
+  return `${pathname}${sanitizeNestedQuery(search)}`;
 }
 function safeInternalRedirectPath(request, fallback = "/") {
   const url = new URL(request.url);
@@ -70,7 +100,10 @@ function createRequirePasswordConfirmMiddleware() {
   return async (request, next) => {
     const user = currentAuthUser();
     if (!user) {
-      return await next();
+      if (requestPrefersJson(request)) {
+        return Response.json({ error: "Authentication required." }, { status: 401 });
+      }
+      return Response.redirect("/login", 302);
     }
     const userId = resolveUserId(user);
     if (hasFreshPasswordConfirmation(request, userId)) {

package/dist/entries/http/requireWebAuthMiddleware.js

@@ -31,6 +31,7 @@ function requestPrefersJson(request) {
 }
 
 // ../../src/core/http/safeInternalPath.ts
+var NESTED_REDIRECT_KEYS = new Set(["redirect", "next", "return", "returnTo", "return_to"]);
 function looksLikeExternalTarget(value) {
   const trimmed = value.trim();
   if (!trimmed.startsWith("/") || trimmed.startsWith("//") || trimmed.includes("\\")) {
@@ -49,11 +50,40 @@ function looksLikeExternalTarget(value) {
   }
   return false;
 }
+function sanitizeNestedQuery(search) {
+  if (!search) {
+    return "";
+  }
+  const params = new URLSearchParams(search.startsWith("?") ? search.slice(1) : search);
+  const next = new URLSearchParams;
+  for (const [key, value] of params.entries()) {
+    if (NESTED_REDIRECT_KEYS.has(key)) {
+      const sanitized = sanitizeInternalPath(value, "/");
+      next.set(key, sanitized);
+      continue;
+    }
+    if (looksLikeExternalTarget(value) && value.includes("://")) {
+      continue;
+    }
+    next.set(key, value);
+  }
+  const serialized = next.toString();
+  return serialized ? `?${serialized}` : "";
+}
 function sanitizeInternalPath(raw, fallback = "/") {
-  if (looksLikeExternalTarget(raw)) {
+  const trimmed = raw.trim();
+  if (looksLikeExternalTarget(trimmed)) {
+    return fallback;
+  }
+  const queryIndex = trimmed.indexOf("?");
+  const hashIndex = trimmed.indexOf("#");
+  const end = [queryIndex, hashIndex].filter((index) => index >= 0).sort((a, b) => a - b)[0];
+  const pathname = end === undefined ? trimmed : trimmed.slice(0, end);
+  if (looksLikeExternalTarget(pathname)) {
     return fallback;
   }
-  return raw;
+  const search = queryIndex >= 0 ? trimmed.slice(queryIndex, hashIndex >= 0 ? hashIndex : undefined) : "";
+  return `${pathname}${sanitizeNestedQuery(search)}`;
 }
 function safeInternalRedirectPath(request, fallback = "/") {
   const url = new URL(request.url);

package/dist/entries/http/response.js

@@ -78,21 +78,25 @@ function mapDatabaseError(error) {
   const sqlState = getPostgresSqlState(error);
   switch (sqlState) {
     case "23505":
-      return new ConflictError(error.detail ?? "A record with these values already exists.", {
-        constraint: error.constraint
-      });
+      if (error.detail) {
+        console.error("[database] unique violation", error.detail);
+      }
+      return new ConflictError("A record with these values already exists.");
     case "23503":
-      return new UnprocessableEntityError(error.detail ?? "Referenced record does not exist.", {
-        constraint: error.constraint
-      });
+      if (error.detail) {
+        console.error("[database] foreign-key violation", error.detail);
+      }
+      return new UnprocessableEntityError("Referenced record does not exist.");
     case "23502":
-      return new BadRequestError(error.detail ?? "Required field is missing.", {
-        constraint: error.constraint
-      });
+      if (error.detail) {
+        console.error("[database] not-null violation", error.detail);
+      }
+      return new BadRequestError("Required field is missing.");
     case "23514":
-      return new BadRequestError(error.detail ?? "Value violates a database constraint.", {
-        constraint: error.constraint
-      });
+      if (error.detail) {
+        console.error("[database] check violation", error.detail);
+      }
+      return new BadRequestError("Value violates a database constraint.");
     default:
       return new InternalServerError("Database operation failed.");
   }
@@ -104,6 +108,18 @@ async function withDatabaseErrorHandling(operation) {
     throw mapDatabaseError(error);
   }
 }
+function isUniqueConstraintError(error) {
+  if (!isPostgresError(error)) {
+    return false;
+  }
+  if (error.code === "SQLITE_CONSTRAINT_UNIQUE" || error.code === "SQLITE_CONSTRAINT_PRIMARYKEY") {
+    return true;
+  }
+  if (error.errno === 1062) {
+    return true;
+  }
+  return getPostgresSqlState(error) === "23505";
+}
 
 // ../../src/core/http/webErrorResponse.ts
 import { toHttpError as toHttpError2, ValidationError } from "@getstrata/core/errors/http";
@@ -171,6 +187,69 @@ function readSpaPrefix() {
 // ../../src/core/view/webErrorView.ts
 import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
 
+// ../../src/core/http/safeInternalPath.ts
+var NESTED_REDIRECT_KEYS = new Set(["redirect", "next", "return", "returnTo", "return_to"]);
+function looksLikeExternalTarget(value) {
+  const trimmed = value.trim();
+  if (!trimmed.startsWith("/") || trimmed.startsWith("//") || trimmed.includes("\\")) {
+    return true;
+  }
+  if (trimmed.includes("://") || trimmed.includes(":/") || trimmed.includes(":\\")) {
+    return true;
+  }
+  try {
+    const decoded = decodeURIComponent(trimmed);
+    if (decoded.startsWith("//") || decoded.includes("\\") || /https?:/i.test(decoded)) {
+      return true;
+    }
+  } catch {
+    return true;
+  }
+  return false;
+}
+function sanitizeNestedQuery(search) {
+  if (!search) {
+    return "";
+  }
+  const params = new URLSearchParams(search.startsWith("?") ? search.slice(1) : search);
+  const next = new URLSearchParams;
+  for (const [key, value] of params.entries()) {
+    if (NESTED_REDIRECT_KEYS.has(key)) {
+      const sanitized = sanitizeInternalPath(value, "/");
+      next.set(key, sanitized);
+      continue;
+    }
+    if (looksLikeExternalTarget(value) && value.includes("://")) {
+      continue;
+    }
+    next.set(key, value);
+  }
+  const serialized = next.toString();
+  return serialized ? `?${serialized}` : "";
+}
+function sanitizeInternalPath(raw, fallback = "/") {
+  const trimmed = raw.trim();
+  if (looksLikeExternalTarget(trimmed)) {
+    return fallback;
+  }
+  const queryIndex = trimmed.indexOf("?");
+  const hashIndex = trimmed.indexOf("#");
+  const end = [queryIndex, hashIndex].filter((index) => index >= 0).sort((a, b) => a - b)[0];
+  const pathname = end === undefined ? trimmed : trimmed.slice(0, end);
+  if (looksLikeExternalTarget(pathname)) {
+    return fallback;
+  }
+  const search = queryIndex >= 0 ? trimmed.slice(queryIndex, hashIndex >= 0 ? hashIndex : undefined) : "";
+  return `${pathname}${sanitizeNestedQuery(search)}`;
+}
+function safeInternalRedirectPath(request, fallback = "/") {
+  const url = new URL(request.url);
+  return sanitizeInternalPath(`${url.pathname}${url.search}`, fallback);
+}
+function loginRedirectLocation(request) {
+  return `/login?redirect=${encodeURIComponent(safeInternalRedirectPath(request))}`;
+}
+
 // ../../src/core/view/htmlResponse.ts
 function htmlResponse(html, init = {}) {
   return new Response(html, {
@@ -261,39 +340,6 @@ function requestPrefersJson(request) {
   return false;
 }
 
-// ../../src/core/http/safeInternalPath.ts
-function looksLikeExternalTarget(value) {
-  const trimmed = value.trim();
-  if (!trimmed.startsWith("/") || trimmed.startsWith("//") || trimmed.includes("\\")) {
-    return true;
-  }
-  if (trimmed.includes("://") || trimmed.includes(":/") || trimmed.includes(":\\")) {
-    return true;
-  }
-  try {
-    const decoded = decodeURIComponent(trimmed);
-    if (decoded.startsWith("//") || decoded.includes("\\") || /https?:/i.test(decoded)) {
-      return true;
-    }
-  } catch {
-    return true;
-  }
-  return false;
-}
-function sanitizeInternalPath(raw, fallback = "/") {
-  if (looksLikeExternalTarget(raw)) {
-    return fallback;
-  }
-  return raw;
-}
-function safeInternalRedirectPath(request, fallback = "/") {
-  const url = new URL(request.url);
-  return sanitizeInternalPath(`${url.pathname}${url.search}`, fallback);
-}
-function loginRedirectLocation(request) {
-  return `/login?redirect=${encodeURIComponent(safeInternalRedirectPath(request))}`;
-}
-
 // ../../src/core/http/webErrorResponse.ts
 function normalizeFieldErrors(details) {
   if (!details || typeof details !== "object" || Array.isArray(details)) {
@@ -402,7 +448,17 @@ function withJsonErrorHandling(handler) {
     }
   };
 }
+function createJsonErrorMiddleware() {
+  return async (_request, next) => {
+    try {
+      return await next();
+    } catch (error) {
+      return errorResponse(error);
+    }
+  };
+}
 export {
+  createJsonErrorMiddleware,
   createdResponse,
   errorResponse,
   jsonResponse,

package/dist/entries/http/routeModelBinding.js

@@ -2,7 +2,7 @@
 // ../../src/core/http/validation.ts
 import { currentAuthUser } from "@getstrata/core/auth/authContext";
 import { BadRequestError } from "@getstrata/core/errors/http";
-import { currentTenantId } from "@getstrata/core/tenant/tenantContext";
+import { currentTenant } from "@getstrata/core/tenant/tenantContext";
 function buildRequestCacheKey(fallbackPath, request) {
   if (!request) {
     return fallbackPath;
@@ -10,7 +10,7 @@ function buildRequestCacheKey(fallbackPath, request) {
   const url = new URL(request.url);
   const user = currentAuthUser();
   const authScope = user ? `u:${user.id}` : "guest";
-  const tenantScope = `t:${currentTenantId()}`;
+  const tenantScope = `t:${currentTenant()?.id ?? "none"}`;
   return `${authScope}|${tenantScope}|${url.pathname}${url.search}`;
 }
 function getQueryParams(request) {

package/dist/entries/http/safeInternalPath.js

@@ -1,5 +1,6 @@
 // @bun
 // ../../src/core/http/safeInternalPath.ts
+var NESTED_REDIRECT_KEYS = new Set(["redirect", "next", "return", "returnTo", "return_to"]);
 function looksLikeExternalTarget(value) {
   const trimmed = value.trim();
   if (!trimmed.startsWith("/") || trimmed.startsWith("//") || trimmed.includes("\\")) {
@@ -18,11 +19,40 @@ function looksLikeExternalTarget(value) {
   }
   return false;
 }
+function sanitizeNestedQuery(search) {
+  if (!search) {
+    return "";
+  }
+  const params = new URLSearchParams(search.startsWith("?") ? search.slice(1) : search);
+  const next = new URLSearchParams;
+  for (const [key, value] of params.entries()) {
+    if (NESTED_REDIRECT_KEYS.has(key)) {
+      const sanitized = sanitizeInternalPath(value, "/");
+      next.set(key, sanitized);
+      continue;
+    }
+    if (looksLikeExternalTarget(value) && value.includes("://")) {
+      continue;
+    }
+    next.set(key, value);
+  }
+  const serialized = next.toString();
+  return serialized ? `?${serialized}` : "";
+}
 function sanitizeInternalPath(raw, fallback = "/") {
-  if (looksLikeExternalTarget(raw)) {
+  const trimmed = raw.trim();
+  if (looksLikeExternalTarget(trimmed)) {
+    return fallback;
+  }
+  const queryIndex = trimmed.indexOf("?");
+  const hashIndex = trimmed.indexOf("#");
+  const end = [queryIndex, hashIndex].filter((index) => index >= 0).sort((a, b) => a - b)[0];
+  const pathname = end === undefined ? trimmed : trimmed.slice(0, end);
+  if (looksLikeExternalTarget(pathname)) {
     return fallback;
   }
-  return raw;
+  const search = queryIndex >= 0 ? trimmed.slice(queryIndex, hashIndex >= 0 ? hashIndex : undefined) : "";
+  return `${pathname}${sanitizeNestedQuery(search)}`;
 }
 function safeInternalRedirectPath(request, fallback = "/") {
   const url = new URL(request.url);

package/dist/entries/http/scimThrottleMiddleware.js

@@ -1,5 +1,6 @@
 // @bun
 // ../../src/core/http/scimThrottleMiddleware.ts
+import { createHash } from "crypto";
 var {RedisClient } = globalThis.Bun;
 
 // ../../src/core/runtime/appEnv.ts
@@ -120,7 +121,12 @@ function readClientIp(request, env = process.env) {
 // ../../src/core/http/scimThrottleMiddleware.ts
 var memoryBuckets = new Map;
 function resolveScimIdentity(request) {
-  return request.headers.get("authorization")?.slice("Bearer ".length, "Bearer ".length + 16) ?? readClientIp(request) ?? "unknown";
+  const authorization = request.headers.get("authorization") ?? "";
+  const presented = authorization.startsWith("Bearer ") ? authorization.slice("Bearer ".length).trim() : "";
+  if (presented.length > 0) {
+    return createHash("sha256").update(presented).digest("hex");
+  }
+  return readClientIp(request) ?? "unknown";
 }
 function throttleFromMemory(key, maxAttempts, decaySeconds) {
   const now = Date.now();

package/dist/entries/http/securedRouteModelBinding.js

@@ -108,7 +108,7 @@ function applyConditionalGet(request, response, etag) {
 // ../../src/core/http/validation.ts
 import { currentAuthUser } from "@getstrata/core/auth/authContext";
 import { BadRequestError } from "@getstrata/core/errors/http";
-import { currentTenantId } from "@getstrata/core/tenant/tenantContext";
+import { currentTenant } from "@getstrata/core/tenant/tenantContext";
 function buildRequestCacheKey(fallbackPath, request) {
   if (!request) {
     return fallbackPath;
@@ -116,7 +116,7 @@ function buildRequestCacheKey(fallbackPath, request) {
   const url = new URL(request.url);
   const user = currentAuthUser();
   const authScope = user ? `u:${user.id}` : "guest";
-  const tenantScope = `t:${currentTenantId()}`;
+  const tenantScope = `t:${currentTenant()?.id ?? "none"}`;
   return `${authScope}|${tenantScope}|${url.pathname}${url.search}`;
 }
 function getQueryParams(request) {

package/dist/entries/http/securityHeadersMiddleware.js

@@ -27,69 +27,6 @@ function envFlagEnabled(value) {
   return value === "true";
 }
 
-// ../../src/core/runtime/appKeyPrefix.ts
-function appKeyPrefix() {
-  return process.env.APP_KEY_PREFIX?.trim() || "strata";
-}
-function appCookieName(kind) {
-  return `${appKeyPrefix()}_${kind}`;
-}
-function appDevSecret(kind) {
-  return `${appKeyPrefix()}-dev-${kind}`;
-}
-function requireConfiguredSecret(names, devKind, env = process.env) {
-  for (const name of names) {
-    const value = env[name]?.trim();
-    if (value) {
-      return value;
-    }
-  }
-  if (isProductionEnv(env)) {
-    throw new Error(`${names[0]} must be set outside development. Do not derive secrets from the app name.`);
-  }
-  return appDevSecret(devKind);
-}
-function namespacedRedisKey(kind) {
-  return `${appKeyPrefix()}:${kind}`;
-}
-function smtpEhloHost() {
-  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
-  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
-  return safe || "strata.local";
-}
-function siemEventType() {
-  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
-}
-function appUserAgent() {
-  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
-}
-function otelServiceName() {
-  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
-}
-function appDisplayName() {
-  return process.env.APP_NAME?.trim() || "Strata";
-}
-function appEnv() {
-  return process.env.APP_ENV?.trim() || "local";
-}
-function appUrl() {
-  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
-}
-function apiPrefix() {
-  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
-  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
-  const trimmed = withSlash.replace(/\/+$/, "");
-  return trimmed || "/api/v1";
-}
-function sdkClientClassName() {
-  const override = process.env.APP_SDK_CLASS?.trim();
-  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
-    return override;
-  }
-  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
-  return fromName ? `${fromName}Client` : "AppClient";
-}
-
 // ../../src/core/http/securityHeadersMiddleware.ts
 function createSecurityHeadersMiddleware(options = {}) {
   return async (request, next) => {
@@ -106,8 +43,10 @@ function createSecurityHeadersMiddleware(options = {}) {
       headers.set("X-Frame-Options", "DENY");
       headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
       headers.set("X-XSS-Protection", "0");
+      headers.set("Cross-Origin-Opener-Policy", "same-origin");
+      headers.set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), payment=(), usb=()");
       headers.set("Content-Security-Policy", resolveContentSecurityPolicy(response, { ...options, nonce }));
-      if (appEnv() === "production") {
+      if (isProductionEnv()) {
         headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
       }
       return new Response(response.body, {

package/dist/entries/http/signedUrl.js

@@ -159,11 +159,12 @@ function hasValidSignature(input) {
     return false;
   }
   const expires = url.searchParams.get("expires");
-  if (expires) {
-    const expiresAt = Number.parseInt(expires, 10);
-    if (!Number.isInteger(expiresAt) || expiresAt <= Math.floor(Date.now() / 1000)) {
-      return false;
-    }
+  if (!expires) {
+    return false;
+  }
+  const expiresAt = Number.parseInt(expires, 10);
+  if (!Number.isInteger(expiresAt) || expiresAt <= Math.floor(Date.now() / 1000)) {
+    return false;
   }
   const expected = signCanonicalPayload(url.pathname, sortedQueryString(url.searchParams));
   return timingSafeCompareString(signature, expected);

package/dist/entries/http/throttleMiddleware.js

@@ -161,6 +161,69 @@ function readSpaPrefix() {
 // ../../src/core/view/webErrorView.ts
 import { currentRequestMeta as currentRequestMeta2 } from "@getstrata/core/http/requestMetaContext";
 
+// ../../src/core/http/safeInternalPath.ts
+var NESTED_REDIRECT_KEYS = new Set(["redirect", "next", "return", "returnTo", "return_to"]);
+function looksLikeExternalTarget(value) {
+  const trimmed = value.trim();
+  if (!trimmed.startsWith("/") || trimmed.startsWith("//") || trimmed.includes("\\")) {
+    return true;
+  }
+  if (trimmed.includes("://") || trimmed.includes(":/") || trimmed.includes(":\\")) {
+    return true;
+  }
+  try {
+    const decoded = decodeURIComponent(trimmed);
+    if (decoded.startsWith("//") || decoded.includes("\\") || /https?:/i.test(decoded)) {
+      return true;
+    }
+  } catch {
+    return true;
+  }
+  return false;
+}
+function sanitizeNestedQuery(search) {
+  if (!search) {
+    return "";
+  }
+  const params = new URLSearchParams(search.startsWith("?") ? search.slice(1) : search);
+  const next = new URLSearchParams;
+  for (const [key, value] of params.entries()) {
+    if (NESTED_REDIRECT_KEYS.has(key)) {
+      const sanitized = sanitizeInternalPath(value, "/");
+      next.set(key, sanitized);
+      continue;
+    }
+    if (looksLikeExternalTarget(value) && value.includes("://")) {
+      continue;
+    }
+    next.set(key, value);
+  }
+  const serialized = next.toString();
+  return serialized ? `?${serialized}` : "";
+}
+function sanitizeInternalPath(raw, fallback = "/") {
+  const trimmed = raw.trim();
+  if (looksLikeExternalTarget(trimmed)) {
+    return fallback;
+  }
+  const queryIndex = trimmed.indexOf("?");
+  const hashIndex = trimmed.indexOf("#");
+  const end = [queryIndex, hashIndex].filter((index) => index >= 0).sort((a, b) => a - b)[0];
+  const pathname = end === undefined ? trimmed : trimmed.slice(0, end);
+  if (looksLikeExternalTarget(pathname)) {
+    return fallback;
+  }
+  const search = queryIndex >= 0 ? trimmed.slice(queryIndex, hashIndex >= 0 ? hashIndex : undefined) : "";
+  return `${pathname}${sanitizeNestedQuery(search)}`;
+}
+function safeInternalRedirectPath(request, fallback = "/") {
+  const url = new URL(request.url);
+  return sanitizeInternalPath(`${url.pathname}${url.search}`, fallback);
+}
+function loginRedirectLocation(request) {
+  return `/login?redirect=${encodeURIComponent(safeInternalRedirectPath(request))}`;
+}
+
 // ../../src/core/view/htmlResponse.ts
 function htmlResponse(html, init = {}) {
   return new Response(html, {