@getstrata/core 1.1.5 → 1.1.7

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @getstrata/core changelog
 
+## 1.1.7
+
+- Fix generated webhook SQL, billing hook, and hybrid SPA smoke
+
+## 1.1.6
+
+- Add optional OIDC cookie login and loopback discovery
+
+## Unreleased
+
+- `sealOidcPkceCookie()` / `readOidcPkceCookie()` on `@getstrata/core/security/oauthState` store the OIDC PKCE handshake in the `oidc_pkce` cookie, bound to the signed OAuth state.
+- OIDC discovery, token, and JWKS fetches allow loopback issuers outside production. `OIDC_ALLOW_PRIVATE=true` allows other private hosts and is ignored in production.
+- `OidcProvider.getAuthorizationUrl()` still throws. Call `createAuthorization()`.
+
 ## 1.1.5
 
 - Close dogfood gaps: webhook docs, starter extras, signing helper

package/dist/core/auth/oauth/oidcIdToken.d.ts

@@ -5,6 +5,12 @@ interface OidcDiscovery {
     token_endpoint?: string;
     jwks_uri?: string;
 }
+declare function oidcSafeFetchOptions(url: string): {
+    allowHttp: boolean;
+    allowPrivate: boolean;
+    timeoutMs: number;
+    maxRedirects: number;
+};
 declare function loadOidcDiscovery(issuer: string): Promise<OidcDiscovery>;
 declare function oidcAccessTokenHash(accessToken: string): string;
 declare function verifyOidcIdToken(token: string, options: {
@@ -16,4 +22,4 @@ declare function verifyOidcIdToken(token: string, options: {
 }): Promise<JwtPayload>;
 declare function resetOidcDiscoveryCacheForTests(): void;
 export type { OidcDiscovery };
-export { loadOidcDiscovery, oidcAccessTokenHash, resetOidcDiscoveryCacheForTests, verifyOidcIdToken, };
+export { loadOidcDiscovery, oidcAccessTokenHash, oidcSafeFetchOptions, resetOidcDiscoveryCacheForTests, verifyOidcIdToken, };

package/dist/core/security/oauthState.d.ts

@@ -1,4 +1,10 @@
 declare const OAUTH_STATE_COOKIE = "oauth_state";
+declare const OIDC_PKCE_COOKIE = "oidc_pkce";
+interface OidcPkceSeal {
+    state: string;
+    nonce: string;
+    codeVerifier: string;
+}
 declare function verifySignedOAuthStateValue(value: string): boolean;
 declare function createOAuthState(): {
     state: string;
@@ -9,4 +15,11 @@ declare function createOAuthStateCookie(): {
 };
 declare function verifyOAuthState(_request: Request, returnedState: string | null): boolean;
 declare function clearOAuthStateCookie(): string;
-export { clearOAuthStateCookie, createOAuthState, createOAuthStateCookie, OAUTH_STATE_COOKIE, verifyOAuthState, verifySignedOAuthStateValue, };
+declare function sealOidcPkceCookie(payload: OidcPkceSeal): string;
+declare function clearOidcPkceCookie(): string;
+declare function readOidcPkceCookie(request: Request, returnedState: string | null): {
+    nonce: string;
+    codeVerifier: string;
+} | null;
+export type { OidcPkceSeal };
+export { clearOAuthStateCookie, clearOidcPkceCookie, createOAuthState, createOAuthStateCookie, OAUTH_STATE_COOKIE, OIDC_PKCE_COOKIE, readOidcPkceCookie, sealOidcPkceCookie, verifyOAuthState, verifySignedOAuthStateValue, };

package/dist/entries/auth/oauth/oidcProvider.js

@@ -2,6 +2,10 @@
 // ../../src/core/auth/oauth/oidcProvider.ts
 import { createHash as createHash2, randomBytes } from "crypto";
 
+// ../../src/core/security/safeUrl.ts
+import { lookup as dnsLookupImpl } from "dns/promises";
+import { BadRequestError } from "@getstrata/core/errors/http";
+
 // ../../src/core/runtime/appEnv.ts
 var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
 function normalizeEnvValue(value) {
@@ -23,8 +27,6 @@ function envFlagEnabled(value) {
 }
 
 // ../../src/core/security/safeUrl.ts
-import { lookup as dnsLookupImpl } from "dns/promises";
-import { BadRequestError } from "@getstrata/core/errors/http";
 var dnsLookup = dnsLookupImpl;
 var BLOCKED_HOSTNAMES = new Set([
   "localhost",
@@ -330,8 +332,33 @@ var jwksCache = new Map;
 function issuerOrigin(issuer) {
   return issuer.replace(/\/$/, "");
 }
+function oidcLoopbackHost(hostname) {
+  const host = hostname.trim().toLowerCase().replace(/^\[|\]$/gu, "");
+  return host === "localhost" || host === "127.0.0.1" || host === "::1";
+}
+function oidcOutboundAllowsPrivate(url) {
+  if (isProductionEnv()) {
+    return false;
+  }
+  if (process.env.OIDC_ALLOW_PRIVATE === "true") {
+    return true;
+  }
+  try {
+    return oidcLoopbackHost(new URL(url).hostname);
+  } catch {
+    return false;
+  }
+}
+function oidcSafeFetchOptions(url) {
+  return {
+    allowHttp: !isProductionEnv(),
+    allowPrivate: oidcOutboundAllowsPrivate(url),
+    timeoutMs: 1e4,
+    maxRedirects: 0
+  };
+}
 async function fetchJson(url) {
-  const response = await safeFetch(url, { headers: { accept: "application/json" } }, { allowHttp: !isProductionEnv(), timeoutMs: 1e4, maxRedirects: 0 });
+  const response = await safeFetch(url, { headers: { accept: "application/json" } }, oidcSafeFetchOptions(url));
   return await response.json();
 }
 async function loadOidcDiscovery(issuer) {
@@ -532,11 +559,12 @@ class OidcProvider {
       client_secret: this.options.clientSecret,
       code_verifier: handshake.codeVerifier
     });
-    const tokenResponse = await safeFetch(requireOidcEndpoint(discovery.token_endpoint, "token_endpoint"), {
+    const tokenEndpoint = requireOidcEndpoint(discovery.token_endpoint, "token_endpoint");
+    const tokenResponse = await safeFetch(tokenEndpoint, {
       method: "POST",
       headers: { "content-type": "application/x-www-form-urlencoded" },
       body
-    }, { allowHttp: !isProductionEnv(), timeoutMs: 1e4, maxRedirects: 0 });
+    }, oidcSafeFetchOptions(tokenEndpoint));
     const tokenBody = await tokenResponse.json();
     if (!tokenBody.access_token) {
       throw new Error("OIDC token exchange failed.");

package/dist/entries/security/oauthState.js

@@ -90,6 +90,7 @@ function sdkClientClassName() {
 
 // ../../src/core/security/oauthState.ts
 var OAUTH_STATE_COOKIE = "oauth_state";
+var OIDC_PKCE_COOKIE = "oidc_pkce";
 var OAUTH_STATE_TTL_MS = 10 * 60 * 1000;
 function resolveOAuthStateSecret() {
   return requireConfiguredSecret(["OAUTH_STATE_SECRET", "SESSION_SECRET"], "oauth-state-secret");
@@ -144,11 +145,85 @@ function verifyOAuthState(_request, returnedState) {
 function clearOAuthStateCookie() {
   return `${OAUTH_STATE_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0${isProductionEnv() ? "; Secure" : ""}`;
 }
+function oauthCookieSuffix() {
+  return `Path=/; HttpOnly; SameSite=Lax${isProductionEnv() ? "; Secure" : ""}`;
+}
+function sealOidcPkceCookie(payload) {
+  const body = Buffer.from(JSON.stringify({
+    state: payload.state,
+    nonce: payload.nonce,
+    codeVerifier: payload.codeVerifier,
+    iat: Date.now()
+  })).toString("base64url");
+  const signature = createHmac("sha256", resolveOAuthStateSecret()).update(body).digest("base64url");
+  const value = encodeURIComponent(`${body}.${signature}`);
+  return `${OIDC_PKCE_COOKIE}=${value}; ${oauthCookieSuffix()}; Max-Age=600`;
+}
+function clearOidcPkceCookie() {
+  return `${OIDC_PKCE_COOKIE}=; ${oauthCookieSuffix()}; Max-Age=0`;
+}
+function readOidcPkceCookie(request, returnedState) {
+  const state = returnedState?.trim() ?? "";
+  if (!state) {
+    return null;
+  }
+  const header = request.headers.get("cookie") ?? "";
+  for (const part of header.split(";")) {
+    const [name, ...rest] = part.trim().split("=");
+    if (name !== OIDC_PKCE_COOKIE) {
+      continue;
+    }
+    return unsealOidcPkceValue(rest.join("="), state);
+  }
+  return null;
+}
+function unsealOidcPkceValue(rawValue, returnedState) {
+  let decoded = rawValue;
+  try {
+    decoded = decodeURIComponent(rawValue);
+  } catch {
+    return null;
+  }
+  const splitAt = decoded.lastIndexOf(".");
+  if (splitAt <= 0) {
+    return null;
+  }
+  const body = decoded.slice(0, splitAt);
+  const signature = decoded.slice(splitAt + 1);
+  const expected = createHmac("sha256", resolveOAuthStateSecret()).update(body).digest("base64url");
+  const expectedBuffer = Buffer.from(expected);
+  const actualBuffer = Buffer.from(signature);
+  if (expectedBuffer.length !== actualBuffer.length || !timingSafeEqual(expectedBuffer, actualBuffer)) {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+  } catch {
+    return null;
+  }
+  if (typeof parsed.state !== "string" || typeof parsed.nonce !== "string" || typeof parsed.codeVerifier !== "string" || typeof parsed.iat !== "number" || !parsed.nonce.trim() || !parsed.codeVerifier.trim()) {
+    return null;
+  }
+  if (Date.now() - parsed.iat > OAUTH_STATE_TTL_MS) {
+    return null;
+  }
+  const left = Buffer.from(parsed.state);
+  const right = Buffer.from(returnedState);
+  if (left.length !== right.length || !timingSafeEqual(left, right)) {
+    return null;
+  }
+  return { nonce: parsed.nonce, codeVerifier: parsed.codeVerifier };
+}
 export {
   OAUTH_STATE_COOKIE,
+  OIDC_PKCE_COOKIE,
   clearOAuthStateCookie,
+  clearOidcPkceCookie,
   createOAuthState,
   createOAuthStateCookie,
+  readOidcPkceCookie,
+  sealOidcPkceCookie,
   verifyOAuthState,
   verifySignedOAuthStateValue
 };

package/dist/index.js

@@ -1899,8 +1899,33 @@ var jwksCache = new Map;
 function issuerOrigin(issuer) {
   return issuer.replace(/\/$/, "");
 }
+function oidcLoopbackHost(hostname) {
+  const host = hostname.trim().toLowerCase().replace(/^\[|\]$/gu, "");
+  return host === "localhost" || host === "127.0.0.1" || host === "::1";
+}
+function oidcOutboundAllowsPrivate(url) {
+  if (isProductionEnv()) {
+    return false;
+  }
+  if (process.env.OIDC_ALLOW_PRIVATE === "true") {
+    return true;
+  }
+  try {
+    return oidcLoopbackHost(new URL(url).hostname);
+  } catch {
+    return false;
+  }
+}
+function oidcSafeFetchOptions(url) {
+  return {
+    allowHttp: !isProductionEnv(),
+    allowPrivate: oidcOutboundAllowsPrivate(url),
+    timeoutMs: 1e4,
+    maxRedirects: 0
+  };
+}
 async function fetchJson(url) {
-  const response = await safeFetch(url, { headers: { accept: "application/json" } }, { allowHttp: !isProductionEnv(), timeoutMs: 1e4, maxRedirects: 0 });
+  const response = await safeFetch(url, { headers: { accept: "application/json" } }, oidcSafeFetchOptions(url));
   return await response.json();
 }
 async function loadOidcDiscovery(issuer) {
@@ -2097,11 +2122,12 @@ class OidcProvider {
       client_secret: this.options.clientSecret,
       code_verifier: handshake.codeVerifier
     });
-    const tokenResponse = await safeFetch(requireOidcEndpoint(discovery.token_endpoint, "token_endpoint"), {
+    const tokenEndpoint = requireOidcEndpoint(discovery.token_endpoint, "token_endpoint");
+    const tokenResponse = await safeFetch(tokenEndpoint, {
       method: "POST",
       headers: { "content-type": "application/x-www-form-urlencoded" },
       body
-    }, { allowHttp: !isProductionEnv(), timeoutMs: 1e4, maxRedirects: 0 });
+    }, oidcSafeFetchOptions(tokenEndpoint));
     const tokenBody = await tokenResponse.json();
     if (!tokenBody.access_token) {
       throw new Error("OIDC token exchange failed.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "1.1.5",
+  "version": "1.1.7",
   "description": "Strata Bun framework public API",
   "type": "module",
   "license": "MIT",