@getstrata/core 1.0.9 → 1.1.0

package/dist/entries/http/validation.js

@@ -2,7 +2,7 @@
 // ../../src/core/http/validation.ts
 import { currentAuthUser } from "@getstrata/core/auth/authContext";
 import { BadRequestError } from "@getstrata/core/errors/http";
-import { currentTenantId } from "@getstrata/core/tenant/tenantContext";
+import { currentTenant } from "@getstrata/core/tenant/tenantContext";
 function buildRequestCacheKey(fallbackPath, request) {
   if (!request) {
     return fallbackPath;
@@ -10,7 +10,7 @@ function buildRequestCacheKey(fallbackPath, request) {
   const url = new URL(request.url);
   const user = currentAuthUser();
   const authScope = user ? `u:${user.id}` : "guest";
-  const tenantScope = `t:${currentTenantId()}`;
+  const tenantScope = `t:${currentTenant()?.id ?? "none"}`;
   return `${authScope}|${tenantScope}|${url.pathname}${url.search}`;
 }
 function getQueryParams(request) {

package/dist/entries/http/webFormRequest.js

@@ -50,7 +50,7 @@ function formDataToRecord(formData) {
 // ../../src/core/http/validation.ts
 import { currentAuthUser } from "@getstrata/core/auth/authContext";
 import { BadRequestError as BadRequestError2 } from "@getstrata/core/errors/http";
-import { currentTenantId } from "@getstrata/core/tenant/tenantContext";
+import { currentTenant } from "@getstrata/core/tenant/tenantContext";
 function buildRequestCacheKey(fallbackPath, request) {
   if (!request) {
     return fallbackPath;
@@ -58,7 +58,7 @@ function buildRequestCacheKey(fallbackPath, request) {
   const url = new URL(request.url);
   const user = currentAuthUser();
   const authScope = user ? `u:${user.id}` : "guest";
-  const tenantScope = `t:${currentTenantId()}`;
+  const tenantScope = `t:${currentTenant()?.id ?? "none"}`;
   return `${authScope}|${tenantScope}|${url.pathname}${url.search}`;
 }
 function getQueryParams(request) {

package/dist/entries/jobs/exportAuditLogsJob.js

@@ -96,36 +96,146 @@ var BLOCKED_HOSTNAMES = new Set([
   "::1",
   "metadata.google.internal"
 ]);
-function isPrivateIpv4(hostname) {
-  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
-  if (!match) {
-    return false;
+function parseCanonicalDottedDecimal(hostname) {
+  const parts = hostname.split(".");
+  if (parts.length !== 4) {
+    return null;
   }
-  const octets = match.slice(1, 5).map((part) => Number.parseInt(part, 10));
-  if (octets.some((octet) => octet < 0 || octet > 255)) {
-    return true;
+  const octets = [];
+  for (const part of parts) {
+    if (!/^(0|[1-9]\d{0,2})$/u.test(part)) {
+      return null;
+    }
+    const value = Number.parseInt(part, 10);
+    if (!Number.isInteger(value) || value < 0 || value > 255) {
+      return null;
+    }
+    octets.push(value);
   }
+  return octets;
+}
+function parseDottedIpv4(hostname) {
+  return parseCanonicalDottedDecimal(hostname);
+}
+function isBlockedIpv4Octets(octets) {
   const [a = 0, b = 0] = octets;
-  if (a === 10) {
+  if (a === 10 || a === 127 || a === 0) {
     return true;
   }
-  if (a === 127) {
+  if (a === 169 && b === 254) {
     return true;
   }
-  if (a === 0) {
+  if (a === 172 && b >= 16 && b <= 31) {
     return true;
   }
-  if (a === 169 && b === 254) {
+  if (a === 192 && b === 168) {
     return true;
   }
-  if (a === 172 && b >= 16 && b <= 31) {
+  if (a === 100 && b >= 64 && b <= 127) {
     return true;
   }
-  if (a === 192 && b === 168) {
+  if (a === 198 && (b === 18 || b === 19)) {
     return true;
   }
   return false;
 }
+function expandIpv6(hostname) {
+  const trimmed = hostname.trim().toLowerCase();
+  const unbracketed = trimmed.startsWith("[") && trimmed.endsWith("]") ? trimmed.slice(1, -1) : trimmed;
+  if (unbracketed.includes("%")) {
+    return null;
+  }
+  const mapped = unbracketed.match(/^::ffff:([0-9a-fx.]+)$/iu);
+  if (mapped?.[1]) {
+    const octets = parseDottedIpv4(mapped[1]);
+    if (!octets) {
+      return null;
+    }
+    return [
+      0,
+      0,
+      0,
+      0,
+      0,
+      65535,
+      octets[0] << 8 | octets[1],
+      octets[2] << 8 | octets[3]
+    ];
+  }
+  const halves = unbracketed.split("::");
+  if (halves.length > 2) {
+    return null;
+  }
+  const parseGroup = (part) => {
+    if (!/^[0-9a-f]{1,4}$/u.test(part)) {
+      return null;
+    }
+    return Number.parseInt(part, 16);
+  };
+  if (halves.length === 1) {
+    const groups = unbracketed.split(":");
+    if (groups.length !== 8) {
+      return null;
+    }
+    const values = groups.map(parseGroup);
+    return values.every((value) => value !== null) ? values : null;
+  }
+  const head = halves[0] ? halves[0].split(":").filter(Boolean) : [];
+  const tail = halves[1] ? halves[1].split(":").filter(Boolean) : [];
+  if (head.length + tail.length > 8) {
+    return null;
+  }
+  const values = [];
+  for (const part of head) {
+    const value = parseGroup(part);
+    if (value === null) {
+      return null;
+    }
+    values.push(value);
+  }
+  while (values.length < 8 - tail.length) {
+    values.push(0);
+  }
+  for (const part of tail) {
+    const value = parseGroup(part);
+    if (value === null) {
+      return null;
+    }
+    values.push(value);
+  }
+  return values.length === 8 ? values : null;
+}
+function isBlockedIpv6(hostname) {
+  const groups = expandIpv6(hostname);
+  if (!groups) {
+    return hostname.includes(":");
+  }
+  const first = groups[0] ?? 0;
+  const second = groups[1] ?? 0;
+  if (groups.every((group) => group === 0)) {
+    return true;
+  }
+  if (groups.slice(0, 7).every((group) => group === 0) && groups[7] === 1) {
+    return true;
+  }
+  if ((first & 65472) === 65152) {
+    return true;
+  }
+  if ((first & 65024) === 64512) {
+    return true;
+  }
+  if ((first & 65280) === 65280) {
+    return true;
+  }
+  if (first === 0 && second === 0 && groups[2] === 0 && groups[3] === 0 && groups[4] === 0 && groups[5] === 65535) {
+    const a = (groups[6] ?? 0) >> 8;
+    const b = (groups[6] ?? 0) & 255;
+    const c = (groups[7] ?? 0) >> 8;
+    const d = (groups[7] ?? 0) & 255;
+    return isBlockedIpv4Octets([a, b, c, d]);
+  }
+  return false;
+}
 function isBlockedHostname(hostname) {
   const normalized = hostname.trim().toLowerCase();
   if (normalized.length === 0) {
@@ -138,24 +248,43 @@ function isBlockedHostname(hostname) {
     return true;
   }
   if (normalized.includes(":")) {
+    return isBlockedIpv6(normalized);
+  }
+  if (/^\d+$/u.test(normalized)) {
     return true;
   }
-  return isPrivateIpv4(normalized);
+  if (normalized.includes(".")) {
+    const canonical = parseCanonicalDottedDecimal(normalized);
+    if (canonical) {
+      return isBlockedIpv4Octets(canonical);
+    }
+    if (/^[0-9a-fx.]+$/iu.test(normalized)) {
+      return true;
+    }
+  }
+  return false;
+}
+function productionSafeOutboundOptions(options) {
+  if (!isProductionEnv()) {
+    return options;
+  }
+  return { ...options, allowPrivate: false, resolveDns: true };
 }
 function assertSafeOutboundUrl(rawUrl, options = {}) {
+  const resolved = productionSafeOutboundOptions(options);
   let parsed;
   try {
     parsed = new URL(rawUrl);
   } catch {
     throw new BadRequestError("Webhook URL is invalid.");
   }
-  if (parsed.protocol !== "https:" && !(options.allowHttp && parsed.protocol === "http:")) {
+  if (parsed.protocol !== "https:" && !(resolved.allowHttp && parsed.protocol === "http:")) {
     throw new BadRequestError("Webhook URL must use HTTPS.");
   }
   if (parsed.username || parsed.password) {
     throw new BadRequestError("Webhook URL must not include credentials.");
   }
-  if (isBlockedHostname(parsed.hostname)) {
+  if (!resolved.allowPrivate && isBlockedHostname(parsed.hostname)) {
     throw new BadRequestError("Webhook URL targets a blocked host.");
   }
   return parsed;
@@ -163,17 +292,35 @@ function assertSafeOutboundUrl(rawUrl, options = {}) {
 function isBlockedIpAddress(address) {
   return isBlockedHostname(address.trim().toLowerCase());
 }
-async function assertSafeOutboundUrlResolved(rawUrl, options = {}) {
-  const parsed = assertSafeOutboundUrl(rawUrl, options);
-  if (options.resolveDns === false) {
-    return parsed;
+function isLiteralIpHostname(hostname) {
+  return parseCanonicalDottedDecimal(hostname) !== null || expandIpv6(hostname) !== null;
+}
+function pinUrlToAddress(url, address) {
+  const pinned = new URL(url.toString());
+  const ipv6 = expandIpv6(address.replace(/^\[|\]$/gu, ""));
+  pinned.hostname = ipv6 ? `[${address.replace(/^\[|\]$/gu, "")}]` : address;
+  return pinned;
+}
+async function resolveSafeOutboundTarget(rawUrl, options = {}) {
+  const resolvedOptions = productionSafeOutboundOptions(options);
+  const parsed = assertSafeOutboundUrl(rawUrl, resolvedOptions);
+  if (resolvedOptions.resolveDns === false || resolvedOptions.allowPrivate) {
+    return { url: parsed, addresses: [] };
   }
   const hostname = parsed.hostname.trim().toLowerCase();
-  const results = await dnsLookup(hostname, { all: true, verbatim: true });
-  if (results.some((result) => isBlockedIpAddress(result.address))) {
+  if (isLiteralIpHostname(hostname)) {
+    return { url: parsed, addresses: [hostname] };
+  }
+  let results;
+  try {
+    results = await dnsLookup(hostname, { all: true, verbatim: true });
+  } catch {
     throw new BadRequestError("Webhook URL targets a blocked host.");
   }
-  return parsed;
+  if (results.length === 0 || results.some((result) => isBlockedIpAddress(result.address))) {
+    throw new BadRequestError("Webhook URL targets a blocked host.");
+  }
+  return { url: parsed, addresses: results.map((result) => result.address) };
 }
 
 // ../../src/core/security/safeFetch.ts
@@ -181,25 +328,40 @@ var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
 async function safeFetch(input, init = {}, options = {}) {
   const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
   const maxRedirects = options.maxRedirects ?? 0;
-  const resolveDns = options.resolveDns ?? appEnv() === "production";
-  const urlOptions = { allowHttp: options.allowHttp, resolveDns };
+  const resolveDns = options.resolveDns ?? true;
+  const urlOptions = {
+    allowHttp: options.allowHttp,
+    resolveDns,
+    allowPrivate: options.allowPrivate
+  };
   const controller = new AbortController;
   const timeout = setTimeout(() => controller.abort(), timeoutMs);
   try {
-    let currentUrl = (await assertSafeOutboundUrlResolved(input, urlOptions)).toString();
+    let current = await resolveSafeOutboundTarget(input, urlOptions);
     let redirectCount = 0;
     while (true) {
-      const response = await fetch(currentUrl, {
+      const address = current.addresses[0];
+      const fetchUrl = address ? pinUrlToAddress(current.url, address).toString() : current.url.toString();
+      const headers = new Headers(init.headers);
+      if (address && !headers.has("host")) {
+        headers.set("Host", current.url.host);
+      }
+      const fetchInit = {
         ...init,
+        headers,
         signal: controller.signal,
         redirect: "manual"
-      });
+      };
+      if (address) {
+        fetchInit.tls = { serverName: current.url.hostname };
+      }
+      const response = await fetch(fetchUrl, fetchInit);
       if (response.status >= 300 && response.status < 400) {
         const location = response.headers.get("location");
         if (!location || redirectCount >= maxRedirects) {
           return response;
         }
-        currentUrl = (await assertSafeOutboundUrlResolved(new URL(location, currentUrl).toString(), urlOptions)).toString();
+        current = await resolveSafeOutboundTarget(new URL(location, current.url).toString(), urlOptions);
         redirectCount += 1;
         continue;
       }
@@ -264,28 +426,49 @@ async function applyBypassToTransaction(transaction, bypass) {
     bypass ? "true" : "false"
   ]);
 }
-async function runWithMigrationBypass(callback) {
-  if (!isRlsTenancy()) {
-    return await callback();
+function stringifyBypassIdentifier(identifier) {
+  if (typeof identifier === "number") {
+    return String(identifier);
   }
-  if (hasActiveDatabaseConnection()) {
-    const activeConnection = getActiveDatabaseConnection(getDefaultDatabasePool());
-    await applyBypassToTransaction(activeConnection, true);
-    try {
-      return await callback();
-    } finally {
-      await applyBypassToTransaction(activeConnection, false);
+  return identifier.trim();
+}
+async function applyIdentifierToTransaction(transaction, identifier) {
+  await transaction.unsafe(`SELECT set_config('app.bypass_identifier', $1, true)`, [
+    stringifyBypassIdentifier(identifier)
+  ]);
+}
+function assertBypassIdentifier(identifier) {
+  if (typeof identifier === "number") {
+    if (!Number.isInteger(identifier) || identifier <= 0) {
+      throw new Error("RLS bypass requires a caller-supplied identifier that pins the row.");
     }
+    return;
+  }
+  if (typeof identifier === "string" && identifier.trim() !== "") {
+    return;
+  }
+  throw new Error("RLS bypass requires a caller-supplied identifier that pins the row.");
+}
+async function runWithScopedTenantTransaction(apply, callback) {
+  if (!isRlsTenancy()) {
+    return await callback();
   }
   const pool = getDefaultDatabasePool();
   if (typeof pool.begin !== "function") {
     throw new Error("RLS migration bypass requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
   }
   return await pool.begin(async (transaction) => {
-    await applyBypassToTransaction(transaction, true);
+    await apply(transaction);
     return await runWithDatabaseConnection(transaction, callback);
   });
 }
+async function runWithMigrationBypass(callback) {
+  return await runWithScopedTenantTransaction((transaction) => applyBypassToTransaction(transaction, true), callback);
+}
+async function runWithMigrationBypassForIdentifier(identifier, callback) {
+  assertBypassIdentifier(identifier);
+  return await runWithScopedTenantTransaction((transaction) => applyIdentifierToTransaction(transaction, identifier), callback);
+}
 
 // ../../src/core/audit/siemFormatter.ts
 function formatSiemAuditEvent(input) {

package/dist/entries/mail/mailer.js

@@ -105,6 +105,28 @@ function resolveSmtpConfig() {
     ...process.env.MAIL_PASSWORD?.trim() ? { password: process.env.MAIL_PASSWORD.trim() } : {}
   };
 }
+var EMAIL_SHAPE = /^[^\s@\r\n]+@[^\s@\r\n]+\.[^\s@\r\n]+$/u;
+function assertSafeSmtpField(value, field) {
+  if (/[\r\n]/u.test(value)) {
+    throw new Error(`Mail ${field} must not contain CR or LF.`);
+  }
+  return value;
+}
+function smtpEnvelopeAddress(value, field) {
+  const trimmed = assertSafeSmtpField(value, field).trim();
+  const address = trimmed.includes("<") ? trimmed.match(/<([^>]+)>/u)?.[1] ?? trimmed : trimmed;
+  if (!EMAIL_SHAPE.test(address)) {
+    throw new Error(`Mail ${field} must be a valid email address.`);
+  }
+  return address;
+}
+function assertSafeSmtpAddress(value, field) {
+  smtpEnvelopeAddress(value, field);
+  return assertSafeSmtpField(value, field).trim();
+}
+function redactMailBody(body) {
+  return body.replace(/https?:\/\/[^\s]+/giu, "[redacted-url]").replace(/[?&](token|signature|expires|code)=[^&\s]+/giu, "[redacted-query]");
+}
 function encodeBase64(value) {
   return Buffer.from(value, "utf8").toString("base64");
 }
@@ -169,6 +191,12 @@ async function openSmtpConnection(config) {
   return { socket, readResponse };
 }
 async function defaultSmtpTransport(config, message) {
+  if (config.username) {
+    assertSafeSmtpField(config.username, "username");
+  }
+  if (config.password) {
+    assertSafeSmtpField(config.password, "password");
+  }
   const { socket, readResponse } = await openSmtpConnection(config);
   try {
     await waitForSmtpResponse(readResponse, ["220"]);
@@ -186,16 +214,24 @@ async function defaultSmtpTransport(config, message) {
 `);
       await waitForSmtpResponse(readResponse, ["235"]);
     }
-    await socket.write(`MAIL FROM:<${config.from}>\r
+    const fromHeader = assertSafeSmtpAddress(config.from, "from");
+    const toHeader = assertSafeSmtpAddress(message.to, "to");
+    const from = smtpEnvelopeAddress(config.from, "from");
+    const to = smtpEnvelopeAddress(message.to, "to");
+    await socket.write(`MAIL FROM:<${from}>\r
 `);
     await waitForSmtpResponse(readResponse, ["250"]);
-    await socket.write(`RCPT TO:<${message.to}>\r
+    await socket.write(`RCPT TO:<${to}>\r
 `);
     await waitForSmtpResponse(readResponse, ["250", "251"]);
     await socket.write(`DATA\r
 `);
     await waitForSmtpResponse(readResponse, ["354"]);
-    const payload = buildSmtpPayload(config.from, message);
+    const payload = buildSmtpPayload(fromHeader, {
+      ...message,
+      to: toHeader,
+      subject: assertSafeSmtpField(message.subject, "subject")
+    });
     await socket.write(payload);
     await waitForSmtpResponse(readResponse, ["250"]);
     await socket.write(`QUIT\r
@@ -206,10 +242,13 @@ async function defaultSmtpTransport(config, message) {
   }
 }
 function buildSmtpPayload(from, message) {
+  const safeFrom = assertSafeSmtpAddress(from, "from");
+  const safeTo = assertSafeSmtpAddress(message.to, "to");
+  const safeSubject = assertSafeSmtpField(message.subject, "subject");
   const headers = [
-    `From: ${from}`,
-    `To: ${message.to}`,
-    `Subject: ${message.subject}`,
+    `From: ${safeFrom}`,
+    `To: ${safeTo}`,
+    `Subject: ${safeSubject}`,
     "MIME-Version: 1.0"
   ];
   if (message.html) {
@@ -242,7 +281,7 @@ class LogMailDriver {
       channel: "mail",
       to: message.to,
       subject: message.subject,
-      body: message.body,
+      body: redactMailBody(message.body),
       ...message.html ? { htmlBytes: Buffer.byteLength(message.html, "utf8") } : {}
     }));
   }
@@ -266,6 +305,8 @@ class Mailer {
     this.driver = driver;
   }
   send(message) {
+    assertSafeSmtpAddress(message.to, "to");
+    assertSafeSmtpField(message.subject, "subject");
     return this.driver.send(message);
   }
 }
@@ -284,8 +325,13 @@ export {
   LogMailDriver,
   Mailer,
   SmtpMailDriver,
+  assertSafeSmtpAddress,
+  assertSafeSmtpField,
   buildSmtpPayload,
   createMailDriver,
+  defaultSmtpTransport,
   mailer,
-  resolveSmtpConfig
+  redactMailBody,
+  resolveSmtpConfig,
+  smtpEnvelopeAddress
 };

package/dist/entries/media/imageTransform.js

@@ -1,6 +1,8 @@
 // @bun
 // ../../src/core/media/imageTransform.ts
 var IMAGE_MIME_TYPES = new Set(["image/jpeg", "image/png", "image/gif", "image/webp"]);
+var MAX_IMAGE_BYTES = 8 * 1024 * 1024;
+var MAX_IMAGE_PIXELS = 4096 * 4096;
 function normalizeMimeType(mimeType) {
   return mimeType.split(";")[0]?.trim().toLowerCase() ?? "";
 }
@@ -21,8 +23,17 @@ function parseThumbnailWidth(raw, options = {}) {
   return Math.min(maxWidth, Math.max(minWidth, parsed));
 }
 async function resizeImageContents(contents, width, mimeType) {
+  if (contents.byteLength > MAX_IMAGE_BYTES) {
+    throw new Error("Image exceeds the maximum allowed size.");
+  }
   const normalized = normalizeMimeType(mimeType);
-  const pipeline = new Bun.Image(contents).resize(width);
+  const source = new Bun.Image(contents);
+  const metadata = await source.metadata();
+  const pixels = Number(metadata.width) * Number(metadata.height);
+  if (pixels > MAX_IMAGE_PIXELS) {
+    throw new Error("Image exceeds the maximum allowed dimensions.");
+  }
+  const pipeline = source.resize(width);
   if (normalized === "image/png") {
     return { body: await pipeline.png().bytes(), contentType: "image/png" };
   }

package/dist/entries/openapi/generator.js

@@ -119,14 +119,10 @@ var PUBLIC_ROUTE_DESCRIPTIONS = {
   "POST /tasks": "Create task",
   "GET /search": "Full-text search tasks and comments",
   "GET /audit-logs": "List audit log entries",
-  "GET /webhooks": "List webhooks",
-  "POST /webhooks": "Create webhook",
   "GET /reports/summary": "Cross-module summary report",
   "GET /admin/stats": "Platform statistics",
   "GET /admin/tenants": "List tenants",
   "GET /admin/features": "Runtime feature flags",
-  "GET /billing/subscription": "Current tenant subscription",
-  "POST /billing/webhooks/stripe": "Stripe webhook receiver (stub)",
   "GET /scim/v2/Users": "SCIM list users",
   "POST /scim/v2/Users": "SCIM create user",
   "GET /health": "Liveness probe",
@@ -165,10 +161,7 @@ var PUBLIC_ROUTE_DESCRIPTIONS = {
   "POST /api/applications": "Submit an application",
   "GET /api/positions": "List hiring positions",
   "GET /api/departments": "List departments",
-  "GET /api/webhooks": "List hiring webhooks",
-  "POST /api/webhooks": "Create a hiring webhook",
   "GET /api/audit-logs": "List hiring audit log entries",
-  "GET /api/billing/subscription": "Current tenant subscription",
   "GET /scim/v2/Groups": "SCIM list groups (departments)"
 };
 function toOpenApiPath(path) {

package/dist/entries/security/oauthState.js

@@ -89,72 +89,63 @@ function sdkClientClassName() {
 var OAUTH_STATE_COOKIE = "oauth_state";
 var OAUTH_STATE_TTL_MS = 10 * 60 * 1000;
 function resolveOAuthStateSecret() {
-  return requireConfiguredSecret(["OAUTH_STATE_SECRET", "ADMIN_API_TOKEN"], "oauth-state-secret");
+  return requireConfiguredSecret(["OAUTH_STATE_SECRET", "SESSION_SECRET"], "oauth-state-secret");
 }
 function signOAuthState(state, issuedAt) {
   const payload = `${state}.${issuedAt}`;
   const signature = createHmac("sha256", resolveOAuthStateSecret()).update(payload).digest("hex");
   return `${payload}.${signature}`;
 }
-function createOAuthStateCookie() {
-  const state = randomBytes(24).toString("hex");
-  const issuedAt = Date.now();
-  const value = signOAuthState(state, issuedAt);
-  return {
-    state,
-    cookie: `${OAUTH_STATE_COOKIE}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=600`
-  };
-}
-function readOAuthStateCookie(request) {
-  const cookieHeader = request.headers.get("cookie");
-  if (!cookieHeader) {
-    return null;
-  }
-  for (const part of cookieHeader.split(";")) {
-    const [name, ...rest] = part.trim().split("=");
-    if (name === OAUTH_STATE_COOKIE) {
-      return decodeURIComponent(rest.join("="));
-    }
-  }
-  return null;
-}
-function verifyOAuthState(request, returnedState) {
-  if (!returnedState || returnedState.trim().length === 0) {
-    return false;
-  }
-  const cookieValue = readOAuthStateCookie(request);
-  if (!cookieValue) {
-    return false;
-  }
-  const parts = cookieValue.split(".");
+function verifySignedOAuthStateValue(value) {
+  const parts = value.split(".");
   if (parts.length !== 3) {
     return false;
   }
-  const [cookieState, issuedAtRaw, cookieSignature] = parts;
-  if (!cookieState || !issuedAtRaw || !cookieSignature) {
+  const [nonce, issuedAtRaw, signature] = parts;
+  if (!nonce || !issuedAtRaw || !signature) {
     return false;
   }
   const issuedAt = Number.parseInt(issuedAtRaw, 10);
-  if (cookieState !== returnedState || !Number.isFinite(issuedAt)) {
+  if (!Number.isFinite(issuedAt)) {
     return false;
   }
   if (Date.now() - issuedAt > OAUTH_STATE_TTL_MS) {
     return false;
   }
-  const expectedSignature = signOAuthState(cookieState, issuedAt).split(".").pop();
+  const expectedSignature = signOAuthState(nonce, issuedAt).split(".").at(-1) ?? "";
   const expectedBuffer = Buffer.from(expectedSignature);
-  const actualBuffer = Buffer.from(cookieSignature);
+  const actualBuffer = Buffer.from(signature);
   if (expectedBuffer.length !== actualBuffer.length) {
     return false;
   }
   return timingSafeEqual(expectedBuffer, actualBuffer);
 }
+function createOAuthState() {
+  const nonce = randomBytes(24).toString("hex");
+  const issuedAt = Date.now();
+  return { state: signOAuthState(nonce, issuedAt) };
+}
+function createOAuthStateCookie() {
+  const { state } = createOAuthState();
+  return {
+    state,
+    cookie: `${OAUTH_STATE_COOKIE}=${encodeURIComponent(state)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=600${isProductionEnv() ? "; Secure" : ""}`
+  };
+}
+function verifyOAuthState(_request, returnedState) {
+  if (!returnedState || returnedState.trim().length === 0) {
+    return false;
+  }
+  return verifySignedOAuthStateValue(returnedState.trim());
+}
 function clearOAuthStateCookie() {
-  return `${OAUTH_STATE_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
+  return `${OAUTH_STATE_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0${isProductionEnv() ? "; Secure" : ""}`;
 }
 export {
   OAUTH_STATE_COOKIE,
   clearOAuthStateCookie,
+  createOAuthState,
   createOAuthStateCookie,
-  verifyOAuthState
+  verifyOAuthState,
+  verifySignedOAuthStateValue
 };

package/dist/entries/security/publicReads.js

@@ -1,7 +1,7 @@
 // @bun
 // ../../src/core/security/publicReads.ts
 function isPublicReadsEnabled() {
-  return (process.env.FEATURE_PUBLIC_READS ?? "true") !== "false";
+  return (process.env.FEATURE_PUBLIC_READS ?? "false") === "true";
 }
 function guestCanViewResource() {
   return isPublicReadsEnabled();