@getstrata/core 2.2.29 → 2.2.30

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # @getstrata/core changelog
 
+## 2.2.30
+
+Basic authentication resolution is reused only within the same Request and unchanged credentials, preventing middleware/controller lookups from consuming MFA recovery proofs twice. Adds real HTTP replay/concurrency and credential/guard invalidation regressions.
+
 ## 2.2.29
 
 MFA recovery-code persistence atomically claims the validated snapshot and rejects stale requests before credential issuance. Basic authentication fails closed and consumes under the verified RLS identifier scope. Adds native SQLite/Postgres/MySQL concurrency and restricted-role regressions.

package/dist/core/auth/guard.d.ts

@@ -26,6 +26,7 @@ declare class CompositeGuard implements AuthGuard {
 }
 declare class AuthManager {
     private readonly guard;
+    private basicResolutions;
     private readonly namedGuards;
     constructor(guard: AuthGuard);
     registerGuard(name: string, next: AuthGuard): this;

package/dist/index.js

@@ -2117,6 +2117,7 @@ var SESSION_GUARD_NAMES = ["web", "session", "default"];
 
 class AuthManager {
   guard;
+  basicResolutions = new WeakMap;
   namedGuards = new Map;
   constructor(guard) {
     this.guard = guard;
@@ -2128,6 +2129,7 @@ class AuthManager {
       throw new Error("Auth guard name must not be empty.");
     }
     this.namedGuards.set(trimmed, next);
+    this.basicResolutions = new WeakMap;
     return this;
   }
   use(name = "default") {
@@ -2148,7 +2150,25 @@ class AuthManager {
     if (!request) {
       return { user: currentAuthUser(), credentialSource: null };
     }
-    return await this.authenticateRequest(request);
+    if (authorizationScheme(request) !== "basic") {
+      this.basicResolutions.delete(request);
+      return await this.authenticateRequest(request);
+    }
+    const authorization = request.headers.get("authorization");
+    const mfaCode = request.headers.get("x-mfa-code");
+    const cached = this.basicResolutions.get(request);
+    if (cached && cached.authorization === authorization && cached.mfaCode === mfaCode) {
+      return await cached.result;
+    }
+    const entry = { authorization, mfaCode, result: this.authenticateRequest(request) };
+    this.basicResolutions.set(request, entry);
+    try {
+      return await entry.result;
+    } catch (error) {
+      if (this.basicResolutions.get(request) === entry)
+        this.basicResolutions.delete(request);
+      throw error;
+    }
   }
   user(request) {
     return this.resolve(request);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "2.2.29",
+  "version": "2.2.30",
   "description": "Strata Bun framework public API",
   "type": "module",
   "license": "MIT",