@getstrata/core 2.2.29 → 2.2.31

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @getstrata/core changelog
 
+## 2.2.31
+
+Preserve JWT issuance precision across millisecond revocation cutoffs without changing expiration. Generated MFA setup rejects stale concurrent state changes and atomically commits credential revocation in SQLite/non-RLS as well as Postgres RLS. Adds real HTTP initial/replacement races, revocation rollback and withheld-success recovery regressions; intentional fresh replacement remains supported.
+
+## 2.2.30
+
+Basic authentication resolution is reused only within the same Request and unchanged credentials, preventing middleware/controller lookups from consuming MFA recovery proofs twice. Adds real HTTP replay/concurrency and credential/guard invalidation regressions.
+
 ## 2.2.29
 
 MFA recovery-code persistence atomically claims the validated snapshot and rejects stale requests before credential issuance. Basic authentication fails closed and consumes under the verified RLS identifier scope. Adds native SQLite/Postgres/MySQL concurrency and restricted-role regressions.

package/dist/core/auth/guard.d.ts

@@ -26,6 +26,7 @@ declare class CompositeGuard implements AuthGuard {
 }
 declare class AuthManager {
     private readonly guard;
+    private basicResolutions;
     private readonly namedGuards;
     constructor(guard: AuthGuard);
     registerGuard(name: string, next: AuthGuard): this;

package/dist/entries/auth/jwt.js

@@ -124,11 +124,11 @@ function signaturesMatch(left, right) {
   return timingSafeEqual(leftBuffer, rightBuffer);
 }
 function signJwt(payload, options = {}) {
-  const now = Math.floor(Date.now() / 1000);
+  const issuedAt = Date.now() / 1000;
   const body = {
     ...payload,
-    iat: now,
-    exp: now + jwtTtlSeconds(options.ttlSeconds)
+    iat: issuedAt,
+    exp: Math.floor(issuedAt) + jwtTtlSeconds(options.ttlSeconds)
   };
   const header = encodeJson({ alg: "HS256", typ: "JWT" });
   const data = encodeJson(body);

package/dist/entries/auth/jwtGuard.js

@@ -292,11 +292,11 @@ function signaturesMatch(left, right) {
   return timingSafeEqual(leftBuffer, rightBuffer);
 }
 function signJwt(payload, options = {}) {
-  const now = Math.floor(Date.now() / 1000);
+  const issuedAt = Date.now() / 1000;
   const body = {
     ...payload,
-    iat: now,
-    exp: now + jwtTtlSeconds(options.ttlSeconds)
+    iat: issuedAt,
+    exp: Math.floor(issuedAt) + jwtTtlSeconds(options.ttlSeconds)
   };
   const header = encodeJson({ alg: "HS256", typ: "JWT" });
   const data = encodeJson(body);

package/dist/index.js

@@ -1920,11 +1920,11 @@ function signaturesMatch(left, right) {
   return timingSafeEqual2(leftBuffer, rightBuffer);
 }
 function signJwt(payload, options = {}) {
-  const now = Math.floor(Date.now() / 1000);
+  const issuedAt = Date.now() / 1000;
   const body = {
     ...payload,
-    iat: now,
-    exp: now + jwtTtlSeconds(options.ttlSeconds)
+    iat: issuedAt,
+    exp: Math.floor(issuedAt) + jwtTtlSeconds(options.ttlSeconds)
   };
   const header = encodeJson({ alg: "HS256", typ: "JWT" });
   const data = encodeJson(body);
@@ -2117,6 +2117,7 @@ var SESSION_GUARD_NAMES = ["web", "session", "default"];
 
 class AuthManager {
   guard;
+  basicResolutions = new WeakMap;
   namedGuards = new Map;
   constructor(guard) {
     this.guard = guard;
@@ -2128,6 +2129,7 @@ class AuthManager {
       throw new Error("Auth guard name must not be empty.");
     }
     this.namedGuards.set(trimmed, next);
+    this.basicResolutions = new WeakMap;
     return this;
   }
   use(name = "default") {
@@ -2148,7 +2150,25 @@ class AuthManager {
     if (!request) {
       return { user: currentAuthUser(), credentialSource: null };
     }
-    return await this.authenticateRequest(request);
+    if (authorizationScheme(request) !== "basic") {
+      this.basicResolutions.delete(request);
+      return await this.authenticateRequest(request);
+    }
+    const authorization = request.headers.get("authorization");
+    const mfaCode = request.headers.get("x-mfa-code");
+    const cached = this.basicResolutions.get(request);
+    if (cached && cached.authorization === authorization && cached.mfaCode === mfaCode) {
+      return await cached.result;
+    }
+    const entry = { authorization, mfaCode, result: this.authenticateRequest(request) };
+    this.basicResolutions.set(request, entry);
+    try {
+      return await entry.result;
+    } catch (error) {
+      if (this.basicResolutions.get(request) === entry)
+        this.basicResolutions.delete(request);
+      throw error;
+    }
   }
   user(request) {
     return this.resolve(request);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "2.2.29",
+  "version": "2.2.31",
   "description": "Strata Bun framework public API",
   "type": "module",
   "license": "MIT",