@getstrata/core 2.2.32 → 2.2.34

package/dist/entries/auth/sessionCookie.js

@@ -2,6 +2,38 @@
 // ../../src/core/auth/sessionCookie.ts
 import { createHmac, timingSafeEqual } from "crypto";
 
+// ../../src/core/http/cookies.ts
+function readRequestCookie(request, name) {
+  const cookies = request.cookies;
+  if (cookies && typeof cookies.get === "function") {
+    const value = cookies.get(name);
+    if (value) {
+      return value;
+    }
+  }
+  const header = request.headers.get("cookie");
+  if (!header) {
+    return null;
+  }
+  for (const part of header.split(";")) {
+    const idx = part.indexOf("=");
+    if (idx === -1)
+      continue;
+    const cookieName = part.slice(0, idx).trim();
+    if (cookieName !== name)
+      continue;
+    try {
+      return decodeURIComponent(part.slice(idx + 1).trim());
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function readBunRequestCookie(request, name) {
+  return request.cookies.get(name) ?? readRequestCookie(request, name);
+}
+
 // ../../src/core/runtime/appEnv.ts
 var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
 function normalizeEnvValue(value) {
@@ -108,25 +140,12 @@ function sessionRememberTtlSeconds() {
 function resolveSessionSecret() {
   return requireConfiguredSecret(["SESSION_SECRET"], "session-secret");
 }
-function signSession(userId, issuedAt, ttlSeconds) {
-  const payload = ttlSeconds === undefined ? `${userId}.${issuedAt}` : `${userId}.${issuedAt}.${ttlSeconds}`;
+function signSession(userId, issuedAt, ttlSeconds, authVersion) {
+  const payload = authVersion !== undefined ? `v2.${userId}.${issuedAt}.${ttlSeconds}.${authVersion}` : ttlSeconds === undefined ? `${userId}.${issuedAt}` : `${userId}.${issuedAt}.${ttlSeconds}`;
   const signature = createHmac("sha256", resolveSessionSecret()).update(payload).digest("hex");
   return `${payload}.${signature}`;
 }
-function readCookieValue(request, cookieName) {
-  const cookieHeader = request.headers.get("cookie");
-  if (!cookieHeader) {
-    return null;
-  }
-  for (const part of cookieHeader.split(";")) {
-    const [name, ...rest] = part.trim().split("=");
-    if (name === cookieName) {
-      return decodeURIComponent(rest.join("="));
-    }
-  }
-  return null;
-}
-function readSignedSession(userIdRaw, issuedAtRaw, cookieSignature, ttlSeconds, remember) {
+function readSignedSession(userIdRaw, issuedAtRaw, cookieSignature, ttlSeconds, remember, authVersion) {
   const userId = Number.parseInt(userIdRaw, 10);
   const issuedAt = Number.parseInt(issuedAtRaw, 10);
   if (!Number.isInteger(userId) || userId <= 0 || !Number.isFinite(issuedAt)) {
@@ -138,7 +157,7 @@ function readSignedSession(userIdRaw, issuedAtRaw, cookieSignature, ttlSeconds,
   if (Date.now() - issuedAt > ttlSeconds * 1000) {
     return null;
   }
-  const expectedSignature = (remember ? signSession(userId, issuedAt, ttlSeconds) : signSession(userId, issuedAt)).split(".").pop();
+  const expectedSignature = (authVersion !== undefined ? signSession(userId, issuedAt, ttlSeconds, authVersion) : remember ? signSession(userId, issuedAt, ttlSeconds) : signSession(userId, issuedAt)).split(".").pop();
   if (!expectedSignature || !cookieSignature) {
     return null;
   }
@@ -150,14 +169,20 @@ function readSignedSession(userIdRaw, issuedAtRaw, cookieSignature, ttlSeconds,
   if (!timingSafeEqual(expectedBuffer, actualBuffer)) {
     return null;
   }
-  return { userId, issuedAt };
+  return { userId, issuedAt, ...authVersion !== undefined ? { authVersion } : {} };
 }
 function readSession(request) {
-  const cookieValue = readCookieValue(request, sessionCookieName());
+  const cookieValue = readRequestCookie(request, sessionCookieName());
   if (!cookieValue) {
     return null;
   }
   const parts = cookieValue.split(".");
+  if (parts.length === 6 && parts[0] === "v2") {
+    const fields = parts.slice(1, 5);
+    if (fields.some((value) => !/^(0|[1-9][0-9]*)$/.test(value) || !Number.isSafeInteger(Number(value))))
+      return null;
+    return readSignedSession(String(parts[1]), String(parts[2]), parts[5], Number(parts[3]), true, Number(parts[4]));
+  }
   if (parts.length === 4) {
     const [userIdRaw, issuedAtRaw, ttlRaw, cookieSignature] = parts;
     return readSignedSession(String(userIdRaw), String(issuedAtRaw), cookieSignature, Number.parseInt(String(ttlRaw), 10), true);
@@ -182,15 +207,18 @@ function isSessionInvalidated(issuedAt, validAfter) {
   return issuedAt < timestamp;
 }
 function createSessionCookieDetails(userId, options = {}) {
+  if (options.authVersion !== undefined && (!Number.isSafeInteger(options.authVersion) || options.authVersion < 0))
+    throw new RangeError("authVersion must be a non-negative safe integer.");
   const issuedAt = Date.now();
   const ttlSeconds = options.remember ? sessionRememberTtlSeconds() : sessionTtlSeconds();
-  const value = options.remember ? signSession(userId, issuedAt, ttlSeconds) : signSession(userId, issuedAt);
+  const value = options.authVersion !== undefined ? signSession(userId, issuedAt, ttlSeconds, options.authVersion) : options.remember ? signSession(userId, issuedAt, ttlSeconds) : signSession(userId, issuedAt);
   const secure = isProductionEnv() ? "; Secure" : "";
   return {
     header: `${sessionCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${ttlSeconds}${secure}`,
     userId,
     issuedAt,
-    ttlSeconds
+    ttlSeconds,
+    ...options.authVersion !== undefined ? { authVersion: options.authVersion } : {}
   };
 }
 function createSessionCookie(userId, options = {}) {

package/dist/entries/auth/sessionGuard.js

@@ -147,9 +147,54 @@ function resolveAbilitiesForRole(role) {
   return [...MEMBER_ABILITIES];
 }
 
+// ../../src/core/auth/accountState.ts
+function isAccountActive(record) {
+  return record.is_active === undefined || record.is_active === true;
+}
+function isAuthUserActive(user) {
+  return user.isActive === undefined || user.isActive === true;
+}
+function matchesAuthVersion(issued, current) {
+  if (current === undefined)
+    return true;
+  return Number.isSafeInteger(current) && current >= 0 && typeof issued === "number" && Number.isSafeInteger(issued) && issued >= 0 && issued === current;
+}
+
 // ../../src/core/auth/sessionCookie.ts
 import { createHmac, timingSafeEqual } from "crypto";
 
+// ../../src/core/http/cookies.ts
+function readRequestCookie(request, name) {
+  const cookies = request.cookies;
+  if (cookies && typeof cookies.get === "function") {
+    const value = cookies.get(name);
+    if (value) {
+      return value;
+    }
+  }
+  const header = request.headers.get("cookie");
+  if (!header) {
+    return null;
+  }
+  for (const part of header.split(";")) {
+    const idx = part.indexOf("=");
+    if (idx === -1)
+      continue;
+    const cookieName = part.slice(0, idx).trim();
+    if (cookieName !== name)
+      continue;
+    try {
+      return decodeURIComponent(part.slice(idx + 1).trim());
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function readBunRequestCookie(request, name) {
+  return request.cookies.get(name) ?? readRequestCookie(request, name);
+}
+
 // ../../src/core/runtime/appEnv.ts
 var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
 function normalizeEnvValue(value) {
@@ -256,25 +301,12 @@ function sessionRememberTtlSeconds() {
 function resolveSessionSecret() {
   return requireConfiguredSecret(["SESSION_SECRET"], "session-secret");
 }
-function signSession(userId, issuedAt, ttlSeconds) {
-  const payload = ttlSeconds === undefined ? `${userId}.${issuedAt}` : `${userId}.${issuedAt}.${ttlSeconds}`;
+function signSession(userId, issuedAt, ttlSeconds, authVersion) {
+  const payload = authVersion !== undefined ? `v2.${userId}.${issuedAt}.${ttlSeconds}.${authVersion}` : ttlSeconds === undefined ? `${userId}.${issuedAt}` : `${userId}.${issuedAt}.${ttlSeconds}`;
   const signature = createHmac("sha256", resolveSessionSecret()).update(payload).digest("hex");
   return `${payload}.${signature}`;
 }
-function readCookieValue(request, cookieName) {
-  const cookieHeader = request.headers.get("cookie");
-  if (!cookieHeader) {
-    return null;
-  }
-  for (const part of cookieHeader.split(";")) {
-    const [name, ...rest] = part.trim().split("=");
-    if (name === cookieName) {
-      return decodeURIComponent(rest.join("="));
-    }
-  }
-  return null;
-}
-function readSignedSession(userIdRaw, issuedAtRaw, cookieSignature, ttlSeconds, remember) {
+function readSignedSession(userIdRaw, issuedAtRaw, cookieSignature, ttlSeconds, remember, authVersion) {
   const userId = Number.parseInt(userIdRaw, 10);
   const issuedAt = Number.parseInt(issuedAtRaw, 10);
   if (!Number.isInteger(userId) || userId <= 0 || !Number.isFinite(issuedAt)) {
@@ -286,7 +318,7 @@ function readSignedSession(userIdRaw, issuedAtRaw, cookieSignature, ttlSeconds,
   if (Date.now() - issuedAt > ttlSeconds * 1000) {
     return null;
   }
-  const expectedSignature = (remember ? signSession(userId, issuedAt, ttlSeconds) : signSession(userId, issuedAt)).split(".").pop();
+  const expectedSignature = (authVersion !== undefined ? signSession(userId, issuedAt, ttlSeconds, authVersion) : remember ? signSession(userId, issuedAt, ttlSeconds) : signSession(userId, issuedAt)).split(".").pop();
   if (!expectedSignature || !cookieSignature) {
     return null;
   }
@@ -298,14 +330,20 @@ function readSignedSession(userIdRaw, issuedAtRaw, cookieSignature, ttlSeconds,
   if (!timingSafeEqual(expectedBuffer, actualBuffer)) {
     return null;
   }
-  return { userId, issuedAt };
+  return { userId, issuedAt, ...authVersion !== undefined ? { authVersion } : {} };
 }
 function readSession(request) {
-  const cookieValue = readCookieValue(request, sessionCookieName());
+  const cookieValue = readRequestCookie(request, sessionCookieName());
   if (!cookieValue) {
     return null;
   }
   const parts = cookieValue.split(".");
+  if (parts.length === 6 && parts[0] === "v2") {
+    const fields = parts.slice(1, 5);
+    if (fields.some((value) => !/^(0|[1-9][0-9]*)$/.test(value) || !Number.isSafeInteger(Number(value))))
+      return null;
+    return readSignedSession(String(parts[1]), String(parts[2]), parts[5], Number(parts[3]), true, Number(parts[4]));
+  }
   if (parts.length === 4) {
     const [userIdRaw, issuedAtRaw, ttlRaw, cookieSignature] = parts;
     return readSignedSession(String(userIdRaw), String(issuedAtRaw), cookieSignature, Number.parseInt(String(ttlRaw), 10), true);
@@ -330,15 +368,18 @@ function isSessionInvalidated(issuedAt, validAfter) {
   return issuedAt < timestamp;
 }
 function createSessionCookieDetails(userId, options = {}) {
+  if (options.authVersion !== undefined && (!Number.isSafeInteger(options.authVersion) || options.authVersion < 0))
+    throw new RangeError("authVersion must be a non-negative safe integer.");
   const issuedAt = Date.now();
   const ttlSeconds = options.remember ? sessionRememberTtlSeconds() : sessionTtlSeconds();
-  const value = options.remember ? signSession(userId, issuedAt, ttlSeconds) : signSession(userId, issuedAt);
+  const value = options.authVersion !== undefined ? signSession(userId, issuedAt, ttlSeconds, options.authVersion) : options.remember ? signSession(userId, issuedAt, ttlSeconds) : signSession(userId, issuedAt);
   const secure = isProductionEnv() ? "; Secure" : "";
   return {
     header: `${sessionCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${ttlSeconds}${secure}`,
     userId,
     issuedAt,
-    ttlSeconds
+    ttlSeconds,
+    ...options.authVersion !== undefined ? { authVersion: options.authVersion } : {}
   };
 }
 function createSessionCookie(userId, options = {}) {
@@ -366,7 +407,9 @@ class SessionGuard {
     }
     try {
       const user = await tokenService.findByIdOrThrow(session.userId);
-      if (isSessionInvalidated(session.issuedAt, user.session_valid_after)) {
+      if (!isAccountActive(user) || !matchesAuthVersion(session.authVersion, user.auth_version))
+        return null;
+      if (user.auth_version === undefined && isSessionInvalidated(session.issuedAt, user.session_valid_after)) {
         return null;
       }
       if (typeof tokenService.hasActiveBrowserSession === "function") {
@@ -378,6 +421,7 @@ class SessionGuard {
       return {
         id: user.id,
         role: user.role,
+        ...user.auth_version !== undefined ? { authVersion: user.auth_version } : {},
         abilities: resolveAbilitiesForRole(user.role),
         emailVerifiedAt: user.email_verified_at ?? null
       };

package/dist/entries/http/cookies.js

@@ -19,7 +19,11 @@ function readRequestCookie(request, name) {
     const cookieName = part.slice(0, idx).trim();
     if (cookieName !== name)
       continue;
-    return decodeURIComponent(part.slice(idx + 1).trim());
+    try {
+      return decodeURIComponent(part.slice(idx + 1).trim());
+    } catch {
+      return null;
+    }
   }
   return null;
 }

package/dist/entries/http/csrfMiddleware.js

@@ -139,7 +139,11 @@ function readRequestCookie(request, name) {
     const cookieName = part.slice(0, idx).trim();
     if (cookieName !== name)
       continue;
-    return decodeURIComponent(part.slice(idx + 1).trim());
+    try {
+      return decodeURIComponent(part.slice(idx + 1).trim());
+    } catch {
+      return null;
+    }
   }
   return null;
 }

package/dist/entries/http/csrfToken.js

@@ -135,7 +135,11 @@ function readRequestCookie(request, name) {
     const cookieName = part.slice(0, idx).trim();
     if (cookieName !== name)
       continue;
-    return decodeURIComponent(part.slice(idx + 1).trim());
+    try {
+      return decodeURIComponent(part.slice(idx + 1).trim());
+    } catch {
+      return null;
+    }
   }
   return null;
 }

package/dist/entries/http/requirePasswordConfirmMiddleware.js

@@ -106,7 +106,7 @@ function createRequirePasswordConfirmMiddleware() {
       return Response.redirect("/login", 302);
     }
     const userId = resolveUserId(user);
-    if (hasFreshPasswordConfirmation(request, userId)) {
+    if (hasFreshPasswordConfirmation(request, userId, user.authVersion)) {
       return await next();
     }
     if (requestPrefersJson(request)) {

package/dist/entries/jobs/exportAuditLogsJob.js

@@ -306,6 +306,20 @@ async function dispatchQueuedModelEvents(queued) {
     }
   }
 }
+async function dispatchModelEvent(event, payload) {
+  await eventBus.dispatchTransactional(event, payload);
+  const state = deferredModelEvents.getStore();
+  const frame = state?.frames[state.frames.length - 1];
+  if (frame) {
+    frame.push({
+      event,
+      payload,
+      tenant: currentTenant()
+    });
+    return;
+  }
+  await eventBus.dispatch(event, payload);
+}
 async function runWithDeferredModelEvents(callback) {
   const existing = deferredModelEvents.getStore();
   if (existing) {

package/dist/entries/queue/queueMetrics.js

@@ -691,6 +691,20 @@ async function dispatchQueuedModelEvents(queued) {
     }
   }
 }
+async function dispatchModelEvent(event, payload) {
+  await eventBus.dispatchTransactional(event, payload);
+  const state = deferredModelEvents.getStore();
+  const frame = state?.frames[state.frames.length - 1];
+  if (frame) {
+    frame.push({
+      event,
+      payload,
+      tenant: currentTenant()
+    });
+    return;
+  }
+  await eventBus.dispatch(event, payload);
+}
 async function runWithDeferredModelEvents(callback) {
   const existing = deferredModelEvents.getStore();
   if (existing) {

package/dist/entries/tenant/databaseTenantContext.js

@@ -306,6 +306,20 @@ async function dispatchQueuedModelEvents(queued) {
     }
   }
 }
+async function dispatchModelEvent(event, payload) {
+  await eventBus.dispatchTransactional(event, payload);
+  const state = deferredModelEvents.getStore();
+  const frame = state?.frames[state.frames.length - 1];
+  if (frame) {
+    frame.push({
+      event,
+      payload,
+      tenant: currentTenant()
+    });
+    return;
+  }
+  await eventBus.dispatch(event, payload);
+}
 async function runWithDeferredModelEvents(callback) {
   const existing = deferredModelEvents.getStore();
   if (existing) {

package/dist/entries/tenant/tenantDatabaseScope.js

@@ -239,6 +239,20 @@ async function dispatchQueuedModelEvents(queued) {
     }
   }
 }
+async function dispatchModelEvent(event, payload) {
+  await eventBus.dispatchTransactional(event, payload);
+  const state = deferredModelEvents.getStore();
+  const frame = state?.frames[state.frames.length - 1];
+  if (frame) {
+    frame.push({
+      event,
+      payload,
+      tenant: currentTenant()
+    });
+    return;
+  }
+  await eventBus.dispatch(event, payload);
+}
 async function runWithDeferredModelEvents(callback) {
   const existing = deferredModelEvents.getStore();
   if (existing) {