@tinyrack/issuary-server 0.31.0 → 0.32.2

package/dist/routes/api/oauth/_provider/authorize/get.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/oauth/_provider/authorize/get.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAQ5D,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;qCA2FrC,CAAC"}
+{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/oauth/_provider/authorize/get.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAQ5D,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;qCA+FrC,CAAC"}

package/dist/routes/api/oauth/_provider/authorize/get.js

@@ -55,10 +55,14 @@ export const oauthProviderAuthorizeGet = new Hono().get('/oauth/:provider/author
     // Generate authorization URL and session data
     const { url, sessionData } = await oauthConnectService.generateAuthorizationUrl(provider, mode, return_url);
     // Store OAuth session data in secure session
+    if (mode === 'link' && c.var.verifiedUser) {
+        sessionData.linkSubject = c.var.verifiedUser.user.sub;
+        sessionData.linkEpoch = c.var.verifiedUser.user.token_epoch;
+    }
     session.set('oauth', sessionData);
     const providerConfig = oauthConnectService.getProvider(provider);
     if (providerConfig.response_mode === 'form_post') {
-        setCookie(c, 'oauth_state', await encrypt(JSON.stringify(sessionData), config.security.session_secret), {
+        setCookie(c, 'oauth_state', await encrypt(JSON.stringify({ sid: session.id, kind: 'oauth' }), config.security.session_secret), {
             path: `/api/oauth/${provider}/callback`,
             httpOnly: true,
             secure: true,

package/dist/routes/api/oauth/_provider/authorize/get.js.map

@@ -1 +1 @@
-{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../../../../src/routes/api/oauth/_provider/authorize/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAC/D,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AAEpD,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,IAAI,EAAU,CAAC,GAAG,CAC7D,4BAA4B,EAC5B,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC;IAC1B,QAAQ,EAAE,gBAAgB,CAAC,qBAAqB;IAChD,OAAO,EAAE,+BAA+B;IACxC,WAAW,EAAE,6DAA6D;IAC1E,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,4BAA4B;SAC1C;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,cAAc;SAC5B;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC;iBACjD;aACF;YACD,WAAW,EAAE,0BAA0B;SACxC;KACF;CACF,CAAC,EACF,SAAS,CACP,OAAO,EACP,CAAC,CAAC,MAAM,CAAC;IACP,QAAQ,EAAE,CAAC,CAAC,YAAY;CACzB,CAAC,CACH,EACD,SAAS,CACP,OAAO,EACP,CAAC,CAAC,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC;IACzC,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,EAAE;CACnC,CAAC,CACH,EACD,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC9B,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC5B,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IACnC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IAC9B,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAEvD,wCAAwC;IACxC,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;IACH,CAAC;IAED,8CAA8C;IAC9C,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,GACxB,MAAM,mBAAmB,CAAC,wBAAwB,CAChD,QAAQ,EACR,IAAI,EACJ,UAAU,CACX,CAAC;IAEJ,6CAA6C;IAC7C,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAElC,MAAM,cAAc,GAAG,mBAAmB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACjE,IAAI,cAAc,CAAC,aAAa,KAAK,WAAW,EAAE,CAAC;QACjD,SAAS,CACP,CAAC,EACD,aAAa,EACb,MAAM,OAAO,CACX,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAC3B,MAAM,CAAC,QAAQ,CAAC,cAAc,CAC/B,EACD;YACE,IAAI,EAAE,cAAc,QAAQ,WAAW;YACvC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,GAAG;SACZ,CACF,CAAC;IACJ,CAAC;IAED,6BAA6B;IAC7B,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC,CACF,CAAC"}
+{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../../../../src/routes/api/oauth/_provider/authorize/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAC/D,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AAEpD,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,IAAI,EAAU,CAAC,GAAG,CAC7D,4BAA4B,EAC5B,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC;IAC1B,QAAQ,EAAE,gBAAgB,CAAC,qBAAqB;IAChD,OAAO,EAAE,+BAA+B;IACxC,WAAW,EAAE,6DAA6D;IAC1E,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,4BAA4B;SAC1C;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,cAAc;SAC5B;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC;iBACjD;aACF;YACD,WAAW,EAAE,0BAA0B;SACxC;KACF;CACF,CAAC,EACF,SAAS,CACP,OAAO,EACP,CAAC,CAAC,MAAM,CAAC;IACP,QAAQ,EAAE,CAAC,CAAC,YAAY;CACzB,CAAC,CACH,EACD,SAAS,CACP,OAAO,EACP,CAAC,CAAC,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC;IACzC,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,EAAE;CACnC,CAAC,CACH,EACD,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC9B,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC5B,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IACnC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IAC9B,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAEvD,wCAAwC;IACxC,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;IACH,CAAC;IAED,8CAA8C;IAC9C,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,GACxB,MAAM,mBAAmB,CAAC,wBAAwB,CAChD,QAAQ,EACR,IAAI,EACJ,UAAU,CACX,CAAC;IAEJ,6CAA6C;IAC7C,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;QAC1C,WAAW,CAAC,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;QACtD,WAAW,CAAC,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC;IAC9D,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAElC,MAAM,cAAc,GAAG,mBAAmB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACjE,IAAI,cAAc,CAAC,aAAa,KAAK,WAAW,EAAE,CAAC;QACjD,SAAS,CACP,CAAC,EACD,aAAa,EACb,MAAM,OAAO,CACX,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAClD,MAAM,CAAC,QAAQ,CAAC,cAAc,CAC/B,EACD;YACE,IAAI,EAAE,cAAc,QAAQ,WAAW;YACvC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,GAAG;SACZ,CACF,CAAC;IACJ,CAAC;IAED,6BAA6B;IAC7B,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC,CACF,CAAC"}

package/dist/routes/api/oauth/_provider/callback/get.d.ts

@@ -2,12 +2,9 @@ import type { AppEnv } from '../../../../../lib/app-env.ts';
 export declare const oauthProviderCallbackGet: import("hono/hono-base").HonoBase<AppEnv, {
     "/oauth/:provider/callback": {
         $get: {
-            output: {
-                code: any;
-                message: any;
-            };
-            outputFormat: "json";
-            status: any;
+            output: undefined;
+            outputFormat: "redirect";
+            status: 302;
             input: {
                 param: {
                     provider: string;
@@ -21,9 +18,12 @@ export declare const oauthProviderCallbackGet: import("hono/hono-base").HonoBase
                 };
             };
         } | {
-            output: undefined;
-            outputFormat: "redirect";
-            status: 302;
+            output: {
+                code: any;
+                message: any;
+            };
+            outputFormat: "json";
+            status: any;
             input: {
                 param: {
                     provider: string;

package/dist/routes/api/oauth/_provider/callback/get.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/oauth/_provider/callback/get.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAQ5D,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oCAoKpC,CAAC"}
+{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/oauth/_provider/callback/get.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAU5D,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oCAiMpC,CAAC"}

package/dist/routes/api/oauth/_provider/callback/get.js

@@ -6,10 +6,12 @@ import { verifyAuth, verifyOAuth } from '../../../../../middleware/auth.js';
 import { e, IssuaryError } from '../../../../../schemas/error.js';
 import { f } from '../../../../../schemas/field.js';
 import { r } from '../../../../../schemas/response.js';
+import { withBrowserSecurity } from '../../../../../services/browser-security.service.js';
+import { completeOAuthAuthentication } from '../../../../../services/oauth-browser-security.service.js';
 export const oauthProviderCallbackGet = new Hono().get('/oauth/:provider/callback', describeRoute({
     tags: [TAGS.OAUTH_CONNECT],
     summary: 'OAuth Callback',
-    description: 'Handles the callback from OAuth provider after user authorization',
+    description: 'Completes provider login, automatic account linking or registration atomically with browser state',
     responses: {
         302: {
             description: 'Redirect',
@@ -32,7 +34,13 @@ export const oauthProviderCallbackGet = new Hono().get('/oauth/:provider/callbac
                     ])),
                 },
             },
-            description: 'State mismatch, session expired, or invalid request',
+            description: 'State mismatch, expired or revoked OAuth authentication, an identity changed during linking or registration, or invalid request',
+        },
+        401: {
+            content: {
+                'application/json': { schema: resolver(e.Unauthorized.Schema) },
+            },
+            description: 'Browser session expired, revoked, or changed during authentication',
         },
         403: {
             content: {
@@ -59,10 +67,11 @@ export const oauthProviderCallbackGet = new Hono().get('/oauth/:provider/callbac
                     schema: resolver(z.union([
                         e.OAuthEmailConflict.Schema,
                         e.OAuthAccountAlreadyLinked.Schema,
+                        e.ConcurrentSecurityChange.Schema,
                     ])),
                 },
             },
-            description: 'Email conflict or account already linked',
+            description: 'Email conflict, account already linked, or concurrent security change',
         },
         502: {
             content: {
@@ -109,6 +118,8 @@ export const oauthProviderCallbackGet = new Hono().get('/oauth/:provider/callbac
     if (!oauthSession) {
         throw new e.OAuthSessionExpired.Error();
     }
+    let authenticationTransactionStarted = false;
+    let authenticationCommitted = false;
     let result;
     try {
         result = await oauthConnectService.processOAuthCallback({
@@ -118,10 +129,21 @@ export const oauthProviderCallbackGet = new Hono().get('/oauth/:provider/callbac
             oauthSession,
             userSub: c.var.verifiedUser?.user.sub,
             requestUrl: c.req.url,
+            completeAuthentication: async (proof, operation) => {
+                authenticationTransactionStarted = true;
+                const completed = await completeOAuthAuthentication(c, proof, operation);
+                authenticationCommitted = true;
+                return completed;
+            },
+            completeLink: (operation) => withBrowserSecurity(c, async () => {
+                await operation();
+                session.set('oauth', undefined);
+            }),
         });
     }
     catch (err) {
-        session.set('oauth', undefined);
+        if (!authenticationTransactionStarted)
+            session.set('oauth', undefined);
         if (err instanceof IssuaryError) {
             return c.json(err.toJson(), err.status);
         }
@@ -136,10 +158,12 @@ export const oauthProviderCallbackGet = new Hono().get('/oauth/:provider/callbac
         case 'terms_redirect':
             return c.redirect(result.url);
         case 'login_terms_redirect':
-            session.setUserSession(result.userSub);
+            if (!authenticationCommitted)
+                session.setUserSession(result.userSub, result.userEpoch);
             return c.redirect(result.termsUrl);
         case 'login_complete':
-            session.setUserSession(result.userSub);
+            if (!authenticationCommitted)
+                session.setUserSession(result.userSub, result.userEpoch);
             return c.redirect(result.returnUrl || '/profile');
     }
 });

package/dist/routes/api/oauth/_provider/callback/get.js.map

@@ -1 +1 @@
-{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../../../../src/routes/api/oauth/_provider/callback/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,oCAAoC,CAAC;AAGvD,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,IAAI,EAAU,CAAC,GAAG,CAC5D,2BAA2B,EAC3B,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC;IAC1B,OAAO,EAAE,gBAAgB;IACzB,WAAW,EACT,mEAAmE;IACrE,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,UAAU;SACxB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC;iBAC1C;aACF;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,KAAK,CAAC;wBACN,CAAC,CAAC,kBAAkB,CAAC,MAAM;wBAC3B,CAAC,CAAC,mBAAmB,CAAC,MAAM;wBAC5B,CAAC,CAAC,mBAAmB,CAAC,MAAM;qBAC7B,CAAC,CACH;iBACF;aACF;YACD,WAAW,EAAE,qDAAqD;SACnE;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,KAAK,CAAC;wBACN,CAAC,CAAC,qBAAqB,CAAC,MAAM;wBAC9B,CAAC,CAAC,2BAA2B,CAAC,MAAM;qBACrC,CAAC,CACH;iBACF;aACF;YACD,WAAW,EAAE,sDAAsD;SACpE;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC;iBACjD;aACF;YACD,WAAW,EAAE,0BAA0B;SACxC;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,KAAK,CAAC;wBACN,CAAC,CAAC,kBAAkB,CAAC,MAAM;wBAC3B,CAAC,CAAC,yBAAyB,CAAC,MAAM;qBACnC,CAAC,CACH;iBACF;aACF;YACD,WAAW,EAAE,0CAA0C;SACxD;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,KAAK,CAAC;wBACN,CAAC,CAAC,wBAAwB,CAAC,MAAM;wBACjC,CAAC,CAAC,mBAAmB,CAAC,MAAM;qBAC7B,CAAC,CACH;iBACF;aACF;YACD,WAAW,EAAE,2CAA2C;SACzD;KACF;CACF,CAAC,EACF,SAAS,CACP,OAAO,EACP,CAAC,CAAC,MAAM,CAAC;IACP,QAAQ,EAAE,CAAC,CAAC,YAAY;CACzB,CAAC,CACH,EACD,SAAS,CACP,OAAO,EACP,CAAC,CAAC,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;IACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CACH,EACD,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC9B,WAAW,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC/B,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;IAC1B,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACvD,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC;IAEzC,8BAA8B;IAC9B,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAChE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QAChD,IAAI,iBAAiB,EAAE,CAAC;YACtB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,yBAAyB,EAAE,iBAAiB,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,YAAY,EAAE,SAAS,EAAE,CAAC;YAC5B,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAChC,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,+BAA+B;IAC/B,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,MAAM,IAAI,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;IAC1C,CAAC;IAED,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;IAC1C,CAAC;IAED,IAAI,MAA2B,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,mBAAmB,CAAC,oBAAoB,CAAC;YACtD,QAAQ;YACR,IAAI;YACJ,KAAK;YACL,YAAY;YACZ,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,GAAG;YACrC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG;SACtB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAChC,IAAI,GAAG,YAAY,YAAY,EAAE,CAAC;YAChC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAEhC,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;QACtB,KAAK,gBAAgB;YACnB,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,KAAK,eAAe;YAClB,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtC,KAAK,gBAAgB;YACnB,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,KAAK,sBAAsB;YACzB,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACvC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrC,KAAK,gBAAgB;YACnB,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACvC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,IAAI,UAAU,CAAC,CAAC;IACtD,CAAC;AACH,CAAC,CACF,CAAC"}
+{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../../../../src/routes/api/oauth/_provider/callback/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,oCAAoC,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qDAAqD,CAAC;AAC1F,OAAO,EAAE,2BAA2B,EAAE,MAAM,2DAA2D,CAAC;AAGxG,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,IAAI,EAAU,CAAC,GAAG,CAC5D,2BAA2B,EAC3B,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC;IAC1B,OAAO,EAAE,gBAAgB;IACzB,WAAW,EACT,mGAAmG;IACrG,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,UAAU;SACxB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC;iBAC1C;aACF;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,KAAK,CAAC;wBACN,CAAC,CAAC,kBAAkB,CAAC,MAAM;wBAC3B,CAAC,CAAC,mBAAmB,CAAC,MAAM;wBAC5B,CAAC,CAAC,mBAAmB,CAAC,MAAM;qBAC7B,CAAC,CACH;iBACF;aACF;YACD,WAAW,EACT,iIAAiI;SACpI;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE;aAChE;YACD,WAAW,EACT,oEAAoE;SACvE;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,KAAK,CAAC;wBACN,CAAC,CAAC,qBAAqB,CAAC,MAAM;wBAC9B,CAAC,CAAC,2BAA2B,CAAC,MAAM;qBACrC,CAAC,CACH;iBACF;aACF;YACD,WAAW,EAAE,sDAAsD;SACpE;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC;iBACjD;aACF;YACD,WAAW,EAAE,0BAA0B;SACxC;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,KAAK,CAAC;wBACN,CAAC,CAAC,kBAAkB,CAAC,MAAM;wBAC3B,CAAC,CAAC,yBAAyB,CAAC,MAAM;wBAClC,CAAC,CAAC,wBAAwB,CAAC,MAAM;qBAClC,CAAC,CACH;iBACF;aACF;YACD,WAAW,EACT,uEAAuE;SAC1E;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,KAAK,CAAC;wBACN,CAAC,CAAC,wBAAwB,CAAC,MAAM;wBACjC,CAAC,CAAC,mBAAmB,CAAC,MAAM;qBAC7B,CAAC,CACH;iBACF;aACF;YACD,WAAW,EAAE,2CAA2C;SACzD;KACF;CACF,CAAC,EACF,SAAS,CACP,OAAO,EACP,CAAC,CAAC,MAAM,CAAC;IACP,QAAQ,EAAE,CAAC,CAAC,YAAY;CACzB,CAAC,CACH,EACD,SAAS,CACP,OAAO,EACP,CAAC,CAAC,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;IACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CACH,EACD,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC9B,WAAW,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC/B,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;IAC1B,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACvD,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC;IAEzC,8BAA8B;IAC9B,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAChE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QAChD,IAAI,iBAAiB,EAAE,CAAC;YACtB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,yBAAyB,EAAE,iBAAiB,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,YAAY,EAAE,SAAS,EAAE,CAAC;YAC5B,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAChC,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,+BAA+B;IAC/B,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,MAAM,IAAI,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;IAC1C,CAAC;IAED,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;IAC1C,CAAC;IAED,IAAI,gCAAgC,GAAG,KAAK,CAAC;IAC7C,IAAI,uBAAuB,GAAG,KAAK,CAAC;IACpC,IAAI,MAA2B,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,mBAAmB,CAAC,oBAAoB,CAAC;YACtD,QAAQ;YACR,IAAI;YACJ,KAAK;YACL,YAAY;YACZ,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,GAAG;YACrC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG;YACrB,sBAAsB,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;gBACjD,gCAAgC,GAAG,IAAI,CAAC;gBACxC,MAAM,SAAS,GAAG,MAAM,2BAA2B,CACjD,CAAC,EACD,KAAK,EACL,SAAS,CACV,CAAC;gBACF,uBAAuB,GAAG,IAAI,CAAC;gBAC/B,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,YAAY,EAAE,CAAC,SAAS,EAAE,EAAE,CAC1B,mBAAmB,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE;gBAChC,MAAM,SAAS,EAAE,CAAC;gBAClB,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAClC,CAAC,CAAC;SACL,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,gCAAgC;YAAE,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACvE,IAAI,GAAG,YAAY,YAAY,EAAE,CAAC;YAChC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAEhC,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;QACtB,KAAK,gBAAgB;YACnB,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,KAAK,eAAe;YAClB,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtC,KAAK,gBAAgB;YACnB,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,KAAK,sBAAsB;YACzB,IAAI,CAAC,uBAAuB;gBAC1B,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAC3D,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrC,KAAK,gBAAgB;YACnB,IAAI,CAAC,uBAAuB;gBAC1B,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAC3D,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,IAAI,UAAU,CAAC,CAAC;IACtD,CAAC;AACH,CAAC,CACF,CAAC"}

package/dist/routes/api/oauth/_provider/callback/post.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/oauth/_provider/callback/post.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AA4B5D,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oCAiLrC,CAAC"}
+{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/oauth/_provider/callback/post.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAmB5D,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oCA6LrC,CAAC"}

package/dist/routes/api/oauth/_provider/callback/post.js

@@ -1,22 +1,14 @@
 import { Hono } from 'hono';
-import { deleteCookie, getCookie } from 'hono/cookie';
+import { deleteCookie } from 'hono/cookie';
 import { describeRoute, resolver, validator } from 'hono-openapi';
 import { z } from 'zod';
-import { decrypt } from '../../../../../lib/crypto.js';
 import { TAGS } from '../../../../../lib/swagger-tags.js';
 import { verifyAuth, verifyOAuth } from '../../../../../middleware/auth.js';
 import { e, IssuaryError } from '../../../../../schemas/error.js';
 import { f } from '../../../../../schemas/field.js';
 import { r } from '../../../../../schemas/response.js';
-const OAuthStateCookieSchema = z
-    .object({
-    state: z.string(),
-    codeVerifier: z.string(),
-    providerId: z.string(),
-    mode: f.oauthConnectMode,
-    returnUrl: z.string().optional(),
-})
-    .strict();
+import { withBrowserSecurity } from '../../../../../services/browser-security.service.js';
+import { completeOAuthAuthentication } from '../../../../../services/oauth-browser-security.service.js';
 const OAuthProviderCallbackFormBody = z
     .object({
     code: f.authorizationCode.optional(),
@@ -51,7 +43,13 @@ export const oauthProviderCallbackPost = new Hono().post('/oauth/:provider/callb
                     ])),
                 },
             },
-            description: 'State mismatch, session expired, or invalid request',
+            description: 'State mismatch, expired or revoked OAuth authentication, an identity changed during linking or registration, or invalid request',
+        },
+        401: {
+            content: {
+                'application/json': { schema: resolver(e.Unauthorized.Schema) },
+            },
+            description: 'Browser session expired, revoked, or changed during authentication',
         },
         403: {
             content: {
@@ -78,10 +76,11 @@ export const oauthProviderCallbackPost = new Hono().post('/oauth/:provider/callb
                     schema: resolver(z.union([
                         e.OAuthEmailConflict.Schema,
                         e.OAuthAccountAlreadyLinked.Schema,
+                        e.ConcurrentSecurityChange.Schema,
                     ])),
                 },
             },
-            description: 'Email conflict or account already linked',
+            description: 'Email conflict, account already linked, or concurrent security change',
         },
         502: {
             content: {
@@ -102,22 +101,8 @@ export const oauthProviderCallbackPost = new Hono().post('/oauth/:provider/callb
     const { code, state, error, error_description } = c.req.valid('form');
     const { session } = c.var;
     const { config, oauthConnectService } = c.var.services;
-    let oauthSession = c.var.verifiedOAuth;
+    const oauthSession = c.var.verifiedOAuth;
     const oauthStateCookiePath = `/api/oauth/${provider}/callback`;
-    if (!oauthSession) {
-        const oauthStateCookie = getCookie(c, 'oauth_state');
-        if (oauthStateCookie) {
-            const decrypted = await decrypt(oauthStateCookie, config.security.session_secret);
-            if (decrypted) {
-                try {
-                    oauthSession = OAuthStateCookieSchema.parse(JSON.parse(decrypted));
-                }
-                catch {
-                    oauthSession = undefined;
-                }
-            }
-        }
-    }
     // Handle OAuth error response
     if (error) {
         const errorUrl = new URL('/login', config.server.public_origin);
@@ -139,6 +124,8 @@ export const oauthProviderCallbackPost = new Hono().post('/oauth/:provider/callb
     if (!oauthSession) {
         throw new e.OAuthSessionExpired.Error();
     }
+    let authenticationTransactionStarted = false;
+    let authenticationCommitted = false;
     let result;
     try {
         result = await oauthConnectService.processOAuthCallback({
@@ -148,10 +135,21 @@ export const oauthProviderCallbackPost = new Hono().post('/oauth/:provider/callb
             oauthSession,
             userSub: c.var.verifiedUser?.user.sub,
             requestUrl: c.req.url,
+            completeAuthentication: async (proof, operation) => {
+                authenticationTransactionStarted = true;
+                const completed = await completeOAuthAuthentication(c, proof, operation);
+                authenticationCommitted = true;
+                return completed;
+            },
+            completeLink: (operation) => withBrowserSecurity(c, async () => {
+                await operation();
+                session.set('oauth', undefined);
+            }),
         });
     }
     catch (err) {
-        session.set('oauth', undefined);
+        if (!authenticationTransactionStarted)
+            session.set('oauth', undefined);
         deleteCookie(c, 'oauth_state', { path: oauthStateCookiePath });
         if (err instanceof IssuaryError) {
             return c.json(err.toJson(), err.status);
@@ -168,10 +166,12 @@ export const oauthProviderCallbackPost = new Hono().post('/oauth/:provider/callb
         case 'terms_redirect':
             return c.redirect(result.url);
         case 'login_terms_redirect':
-            session.setUserSession(result.userSub);
+            if (!authenticationCommitted)
+                session.setUserSession(result.userSub, result.userEpoch);
             return c.redirect(result.termsUrl);
         case 'login_complete':
-            session.setUserSession(result.userSub);
+            if (!authenticationCommitted)
+                session.setUserSession(result.userSub, result.userEpoch);
             return c.redirect(result.returnUrl || '/profile');
     }
 });

package/dist/routes/api/oauth/_provider/callback/post.js.map

@@ -1 +1 @@
-{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../../../src/routes/api/oauth/_provider/callback/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,oCAAoC,CAAC;AAGvD,MAAM,sBAAsB,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,IAAI,EAAE,CAAC,CAAC,gBAAgB;IACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,6BAA6B,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;IACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC;KACD,QAAQ,CAAC,iCAAiC,CAAC,CAAC;AAE/C,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CAC9D,2BAA2B,EAC3B,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC;IAC1B,OAAO,EAAE,uBAAuB;IAChC,WAAW,EACT,gEAAgE;IAClE,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,UAAU;SACxB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC;iBAC1C;aACF;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,KAAK,CAAC;wBACN,CAAC,CAAC,kBAAkB,CAAC,MAAM;wBAC3B,CAAC,CAAC,mBAAmB,CAAC,MAAM;wBAC5B,CAAC,CAAC,mBAAmB,CAAC,MAAM;qBAC7B,CAAC,CACH;iBACF;aACF;YACD,WAAW,EAAE,qDAAqD;SACnE;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,KAAK,CAAC;wBACN,CAAC,CAAC,qBAAqB,CAAC,MAAM;wBAC9B,CAAC,CAAC,2BAA2B,CAAC,MAAM;qBACrC,CAAC,CACH;iBACF;aACF;YACD,WAAW,EAAE,sDAAsD;SACpE;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC;iBACjD;aACF;YACD,WAAW,EAAE,0BAA0B;SACxC;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,KAAK,CAAC;wBACN,CAAC,CAAC,kBAAkB,CAAC,MAAM;wBAC3B,CAAC,CAAC,yBAAyB,CAAC,MAAM;qBACnC,CAAC,CACH;iBACF;aACF;YACD,WAAW,EAAE,0CAA0C;SACxD;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,KAAK,CAAC;wBACN,CAAC,CAAC,wBAAwB,CAAC,MAAM;wBACjC,CAAC,CAAC,mBAAmB,CAAC,MAAM;qBAC7B,CAAC,CACH;iBACF;aACF;YACD,WAAW,EAAE,2CAA2C;SACzD;KACF;CACF,CAAC,EACF,SAAS,CACP,OAAO,EACP,CAAC,CAAC,MAAM,CAAC;IACP,QAAQ,EAAE,CAAC,CAAC,YAAY;CACzB,CAAC,CACH,EACD,SAAS,CAAC,MAAM,EAAE,6BAA6B,CAAC,EAChD,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC9B,WAAW,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC/B,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;IAC1B,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACvD,IAAI,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC;IACvC,MAAM,oBAAoB,GAAG,cAAc,QAAQ,WAAW,CAAC;IAE/D,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,gBAAgB,GAAG,SAAS,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;QACrD,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,SAAS,GAAG,MAAM,OAAO,CAC7B,gBAAgB,EAChB,MAAM,CAAC,QAAQ,CAAC,cAAc,CAC/B,CAAC;YACF,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC;oBACH,YAAY,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;gBACrE,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY,GAAG,SAAS,CAAC;gBAC3B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAChE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QAChD,IAAI,iBAAiB,EAAE,CAAC;YACtB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,yBAAyB,EAAE,iBAAiB,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,YAAY,EAAE,SAAS,EAAE,CAAC;YAC5B,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAChC,YAAY,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAC/D,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,+BAA+B;IAC/B,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,MAAM,IAAI,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;IAC1C,CAAC;IAED,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;IAC1C,CAAC;IAED,IAAI,MAA2B,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,mBAAmB,CAAC,oBAAoB,CAAC;YACtD,QAAQ;YACR,IAAI;YACJ,KAAK;YACL,YAAY;YACZ,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,GAAG;YACrC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG;SACtB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAChC,YAAY,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAC/D,IAAI,GAAG,YAAY,YAAY,EAAE,CAAC;YAChC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAChC,YAAY,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAE/D,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;QACtB,KAAK,gBAAgB;YACnB,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,KAAK,eAAe;YAClB,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtC,KAAK,gBAAgB;YACnB,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,KAAK,sBAAsB;YACzB,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACvC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrC,KAAK,gBAAgB;YACnB,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACvC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,IAAI,UAAU,CAAC,CAAC;IACtD,CAAC;AACH,CAAC,CACF,CAAC"}
+{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../../../src/routes/api/oauth/_provider/callback/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,oCAAoC,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qDAAqD,CAAC;AAC1F,OAAO,EAAE,2BAA2B,EAAE,MAAM,2DAA2D,CAAC;AAGxG,MAAM,6BAA6B,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;IACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC;KACD,QAAQ,CAAC,iCAAiC,CAAC,CAAC;AAE/C,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CAC9D,2BAA2B,EAC3B,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC;IAC1B,OAAO,EAAE,uBAAuB;IAChC,WAAW,EACT,gEAAgE;IAClE,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,UAAU;SACxB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC;iBAC1C;aACF;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,KAAK,CAAC;wBACN,CAAC,CAAC,kBAAkB,CAAC,MAAM;wBAC3B,CAAC,CAAC,mBAAmB,CAAC,MAAM;wBAC5B,CAAC,CAAC,mBAAmB,CAAC,MAAM;qBAC7B,CAAC,CACH;iBACF;aACF;YACD,WAAW,EACT,iIAAiI;SACpI;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE;aAChE;YACD,WAAW,EACT,oEAAoE;SACvE;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,KAAK,CAAC;wBACN,CAAC,CAAC,qBAAqB,CAAC,MAAM;wBAC9B,CAAC,CAAC,2BAA2B,CAAC,MAAM;qBACrC,CAAC,CACH;iBACF;aACF;YACD,WAAW,EAAE,sDAAsD;SACpE;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC;iBACjD;aACF;YACD,WAAW,EAAE,0BAA0B;SACxC;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,KAAK,CAAC;wBACN,CAAC,CAAC,kBAAkB,CAAC,MAAM;wBAC3B,CAAC,CAAC,yBAAyB,CAAC,MAAM;wBAClC,CAAC,CAAC,wBAAwB,CAAC,MAAM;qBAClC,CAAC,CACH;iBACF;aACF;YACD,WAAW,EACT,uEAAuE;SAC1E;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,KAAK,CAAC;wBACN,CAAC,CAAC,wBAAwB,CAAC,MAAM;wBACjC,CAAC,CAAC,mBAAmB,CAAC,MAAM;qBAC7B,CAAC,CACH;iBACF;aACF;YACD,WAAW,EAAE,2CAA2C;SACzD;KACF;CACF,CAAC,EACF,SAAS,CACP,OAAO,EACP,CAAC,CAAC,MAAM,CAAC;IACP,QAAQ,EAAE,CAAC,CAAC,YAAY;CACzB,CAAC,CACH,EACD,SAAS,CAAC,MAAM,EAAE,6BAA6B,CAAC,EAChD,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC9B,WAAW,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC/B,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;IAC1B,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACvD,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC;IACzC,MAAM,oBAAoB,GAAG,cAAc,QAAQ,WAAW,CAAC;IAE/D,8BAA8B;IAC9B,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAChE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QAChD,IAAI,iBAAiB,EAAE,CAAC;YACtB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,yBAAyB,EAAE,iBAAiB,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,YAAY,EAAE,SAAS,EAAE,CAAC;YAC5B,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAChC,YAAY,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAC/D,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,+BAA+B;IAC/B,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,MAAM,IAAI,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;IAC1C,CAAC;IAED,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;IAC1C,CAAC;IAED,IAAI,gCAAgC,GAAG,KAAK,CAAC;IAC7C,IAAI,uBAAuB,GAAG,KAAK,CAAC;IACpC,IAAI,MAA2B,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,mBAAmB,CAAC,oBAAoB,CAAC;YACtD,QAAQ;YACR,IAAI;YACJ,KAAK;YACL,YAAY;YACZ,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,GAAG;YACrC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG;YACrB,sBAAsB,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;gBACjD,gCAAgC,GAAG,IAAI,CAAC;gBACxC,MAAM,SAAS,GAAG,MAAM,2BAA2B,CACjD,CAAC,EACD,KAAK,EACL,SAAS,CACV,CAAC;gBACF,uBAAuB,GAAG,IAAI,CAAC;gBAC/B,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,YAAY,EAAE,CAAC,SAAS,EAAE,EAAE,CAC1B,mBAAmB,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE;gBAChC,MAAM,SAAS,EAAE,CAAC;gBAClB,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAClC,CAAC,CAAC;SACL,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,gCAAgC;YAAE,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACvE,YAAY,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAC/D,IAAI,GAAG,YAAY,YAAY,EAAE,CAAC;YAChC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAChC,YAAY,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAE/D,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;QACtB,KAAK,gBAAgB;YACnB,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,KAAK,eAAe;YAClB,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtC,KAAK,gBAAgB;YACnB,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,KAAK,sBAAsB;YACzB,IAAI,CAAC,uBAAuB;gBAC1B,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAC3D,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrC,KAAK,gBAAgB;YACnB,IAAI,CAAC,uBAAuB;gBAC1B,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAC3D,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,IAAI,UAAU,CAAC,CAAC;IACtD,CAAC;AACH,CAAC,CACF,CAAC"}

package/dist/routes/api/oauth/_provider/delete.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/oauth/_provider/delete.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAQzD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;2BAiE/B,CAAC"}
+{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/oauth/_provider/delete.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAYzD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;2BAoE/B,CAAC"}

package/dist/routes/api/oauth/_provider/delete.js

@@ -1,12 +1,13 @@
 import { Hono } from 'hono';
 import { describeRoute, resolver, validator } from 'hono-openapi';
 import { z } from 'zod';
-import { OPENAPI_SECURITY } from '../../../../lib/openapi.js';
+import { OPENAPI_SECURITY, securityMutationDocumentation, } from '../../../../lib/openapi.js';
 import { TAGS } from '../../../../lib/swagger-tags.js';
 import { verifyAuth } from '../../../../middleware/auth.js';
 import { e } from '../../../../schemas/error.js';
 import { f } from '../../../../schemas/field.js';
 import { r } from '../../../../schemas/response.js';
+import { withBrowserSecurity } from '../../../../services/browser-security.service.js';
 export const oauthProviderDelete = new Hono().delete('/oauth/:provider', describeRoute({
     tags: [TAGS.OAUTH_CONNECT],
     security: OPENAPI_SECURITY.cookieSession,
@@ -48,15 +49,17 @@ export const oauthProviderDelete = new Hono().delete('/oauth/:provider', describ
     },
 }), validator('param', z.object({
     provider: f.providerName,
-})), verifyAuth(), async (c) => {
-    const params = c.req.valid('param');
-    const { user: userEntity } = c.var.verifiedUser;
-    const { oauthConnectService } = c.var.services;
-    const { provider } = params;
-    // Verify provider exists
-    oauthConnectService.getProvider(provider);
-    // Unlink the OAuth account
-    await oauthConnectService.unlinkOAuthAccount(userEntity.sub, provider);
-    return c.json({ ok: true }, 200);
+})), verifyAuth(), securityMutationDocumentation, async (c) => {
+    return withBrowserSecurity(c, async () => {
+        const params = c.req.valid('param');
+        const { user: userEntity } = c.var.verifiedUser;
+        const { oauthConnectService } = c.var.services;
+        const { provider } = params;
+        // Verify provider exists
+        oauthConnectService.getProvider(provider);
+        // Unlink the OAuth account
+        await oauthConnectService.unlinkOAuthAccount(userEntity.sub, provider);
+        return c.json({ ok: true }, 200);
+    });
 });
 //# sourceMappingURL=delete.js.map

package/dist/routes/api/oauth/_provider/delete.js.map

@@ -1 +1 @@
-{"version":3,"file":"delete.js","sourceRoot":"","sources":["../../../../../src/routes/api/oauth/_provider/delete.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AAEpD,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,IAAI,EAAU,CAAC,MAAM,CAC1D,kBAAkB,EAClB,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC;IAC1B,QAAQ,EAAE,gBAAgB,CAAC,aAAa;IACxC,OAAO,EAAE,sBAAsB;IAC/B,WAAW,EAAE,iDAAiD;IAC9D,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;iBAC/B;aACF;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC;iBACtD;aACF;YACD,WAAW,EAAE,gCAAgC;SAC9C;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,cAAc;SAC5B;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC;iBACjD;aACF;YACD,WAAW,EACT,iEAAiE;SACpE;KACF;CACF,CAAC,EACF,SAAS,CACP,OAAO,EACP,CAAC,CAAC,MAAM,CAAC;IACP,QAAQ,EAAE,CAAC,CAAC,YAAY;CACzB,CAAC,CACH,EACD,UAAU,EAAE,EACZ,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;IAChD,MAAM,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAE/C,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAE5B,yBAAyB;IACzB,mBAAmB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAE1C,2BAA2B;IAC3B,MAAM,mBAAmB,CAAC,kBAAkB,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAEvE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC,CACF,CAAC"}
+{"version":3,"file":"delete.js","sourceRoot":"","sources":["../../../../../src/routes/api/oauth/_provider/delete.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,6BAA6B,GAC9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kDAAkD,CAAC;AAEvF,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,IAAI,EAAU,CAAC,MAAM,CAC1D,kBAAkB,EAClB,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC;IAC1B,QAAQ,EAAE,gBAAgB,CAAC,aAAa;IACxC,OAAO,EAAE,sBAAsB;IAC/B,WAAW,EAAE,iDAAiD;IAC9D,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;iBAC/B;aACF;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC;iBACtD;aACF;YACD,WAAW,EAAE,gCAAgC;SAC9C;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,cAAc;SAC5B;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC;iBACjD;aACF;YACD,WAAW,EACT,iEAAiE;SACpE;KACF;CACF,CAAC,EACF,SAAS,CACP,OAAO,EACP,CAAC,CAAC,MAAM,CAAC;IACP,QAAQ,EAAE,CAAC,CAAC,YAAY;CACzB,CAAC,CACH,EACD,UAAU,EAAE,EACZ,6BAA6B,EAC7B,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,OAAO,mBAAmB,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;QAChD,MAAM,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAE/C,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;QAE5B,yBAAyB;QACzB,mBAAmB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAE1C,2BAA2B;QAC3B,MAAM,mBAAmB,CAAC,kBAAkB,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAEvE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC,CACF,CAAC"}

package/dist/routes/api/oauth/index.d.ts

@@ -2,12 +2,9 @@ import type { AppEnv } from '../../../lib/app-env.ts';
 export declare const oauthRoutes: import("hono/hono-base").HonoBase<AppEnv, import("hono/types").BlankSchema | import("hono/types").MergeSchemaPath<{
     "/oauth/:provider/callback": {
         $get: {
-            output: {
-                code: any;
-                message: any;
-            };
-            outputFormat: "json";
-            status: any;
+            output: undefined;
+            outputFormat: "redirect";
+            status: 302;
             input: {
                 param: {
                     provider: string;
@@ -21,9 +18,12 @@ export declare const oauthRoutes: import("hono/hono-base").HonoBase<AppEnv, impo
                 };
             };
         } | {
-            output: undefined;
-            outputFormat: "redirect";
-            status: 302;
+            output: {
+                code: any;
+                message: any;
+            };
+            outputFormat: "json";
+            status: any;
             input: {
                 param: {
                     provider: string;
@@ -87,12 +87,9 @@ export declare const oauthRoutes: import("hono/hono-base").HonoBase<AppEnv, impo
 }, "/"> | import("hono/types").MergeSchemaPath<{
     "/oauth/:provider/callback": {
         $post: {
-            output: {
-                code: any;
-                message: any;
-            };
-            outputFormat: "json";
-            status: any;
+            output: undefined;
+            outputFormat: "redirect";
+            status: 302;
             input: {
                 param: {
                     provider: string;
@@ -106,9 +103,12 @@ export declare const oauthRoutes: import("hono/hono-base").HonoBase<AppEnv, impo
                 };
             };
         } | {
-            output: undefined;
-            outputFormat: "redirect";
-            status: 302;
+            output: {
+                code: any;
+                message: any;
+            };
+            outputFormat: "json";
+            status: any;
             input: {
                 param: {
                     provider: string;

package/dist/routes/api/terms/consent/post.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/terms/consent/post.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAOzD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;yBAmI5B,CAAC"}
+{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/terms/consent/post.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAYzD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;yBAqJ5B,CAAC"}

package/dist/routes/api/terms/consent/post.js

@@ -1,11 +1,14 @@
+import { UniqueConstraintViolationException } from '@mikro-orm/core';
 import { Hono } from 'hono';
 import { describeRoute, resolver, validator } from 'hono-openapi';
 import { z } from 'zod';
-import { OPENAPI_SECURITY } from '../../../../lib/openapi.js';
+import { OPENAPI_SECURITY, securityMutationDocumentation, } from '../../../../lib/openapi.js';
 import { TAGS } from '../../../../lib/swagger-tags.js';
 import { verifyAuth } from '../../../../middleware/auth.js';
 import { e } from '../../../../schemas/error.js';
 import { termsSchema } from '../../../../schemas/terms.js';
+import { withBrowserSecurity } from '../../../../services/browser-security.service.js';
+import { lockTermsPolicy } from '../../../../services/terms-policy.service.js';
 /**
  * POST /api/terms/consent
  *
@@ -17,7 +20,7 @@ export const termsConsentPost = new Hono().post('/terms/consent', describeRoute(
     summary: 'Submit terms consent',
     description: 'Record user consent decisions for terms of service. ' +
         'Required terms must be agreed to. ' +
-        'For pending OAuth registration, this also completes user registration.',
+        'Pending OAuth tokens can create a new account only; if that identity or email now exists, restart OAuth login.',
     responses: {
         200: {
             content: {
@@ -52,60 +55,73 @@ export const termsConsentPost = new Hono().post('/terms/consent', describeRoute(
             description: 'Registration email not allowed',
         },
     },
-}), validator('json', termsSchema.TermsConsentRequest), verifyAuth({ optional: true }), async (c) => {
+}), validator('json', termsSchema.TermsConsentRequest), verifyAuth({ optional: true }), securityMutationDocumentation, async (c) => {
     const body = c.req.valid('json');
     const { consents, registrationToken } = body;
     const session = c.var.session;
     const { mikro, termsService, oauthConnectService } = c.var.services;
     // Check for pending OAuth registration (stored in DB, referenced by token)
     if (registrationToken) {
-        const pendingRegistration = await mikro.pendingOAuthRegistration.findValidByToken(registrationToken);
-        if (!pendingRegistration) {
-            throw new e.OAuthSessionExpired.Error();
+        try {
+            return await session.atomic(async () => {
+                await lockTermsPolicy(mikro.em, 'read');
+                const pendingRegistration = await mikro.pendingOAuthRegistration.claim(registrationToken);
+                if (!pendingRegistration) {
+                    throw new e.OAuthSessionExpired.Error();
+                }
+                // Validate explicit terms consent
+                const validation = await termsService.validateExplicitConsents(consents);
+                if (!validation.valid) {
+                    throw new e.ValidationError.Error(`Missing required terms: ${validation.missingTerms.join(', ')}`);
+                }
+                // Complete OAuth registration
+                const result = await oauthConnectService.completeOAuthRegistration({
+                    providerId: pendingRegistration.providerId,
+                    tokens: {
+                        access_token: pendingRegistration.accessToken,
+                        refresh_token: pendingRegistration.refreshToken ?? undefined,
+                        expires_in: pendingRegistration.expiresIn ?? undefined,
+                        token_type: pendingRegistration.tokenType,
+                    },
+                    userInfo: pendingRegistration.userInfo,
+                    consents,
+                });
+                // Set user session
+                session.setUserSession(result.user.sub, result.user.token_epoch);
+                // Clean up: remove DB record
+                await mikro.pendingOAuthRegistration.consumeByToken(registrationToken);
+                return c.json({
+                    ok: true,
+                    recorded: consents.length,
+                    registered: true,
+                }, 200);
+            });
         }
-        // Validate explicit terms consent
-        const validation = await termsService.validateExplicitConsents(consents);
-        if (!validation.valid) {
-            throw new e.ValidationError.Error(`Missing required terms: ${validation.missingTerms.join(', ')}`);
+        catch (error) {
+            // Another new-account flow may win the unique identity/email insert.
+            if (error instanceof UniqueConstraintViolationException)
+                throw new e.OAuthSessionExpired.Error();
+            throw error;
         }
-        // Complete OAuth registration
-        const result = await oauthConnectService.completeOAuthRegistration({
-            providerId: pendingRegistration.providerId,
-            tokens: {
-                access_token: pendingRegistration.accessToken,
-                refresh_token: pendingRegistration.refreshToken ?? undefined,
-                expires_in: pendingRegistration.expiresIn ?? undefined,
-                token_type: pendingRegistration.tokenType,
-            },
-            userInfo: pendingRegistration.userInfo,
-            consents,
-        });
-        // Set user session
-        session.setUserSession(result.user.sub);
-        // Clean up: remove DB record
-        await mikro.pendingOAuthRegistration.consumeByToken(registrationToken);
-        return c.json({
-            ok: true,
-            recorded: consents.length,
-            registered: true,
-        }, 200);
     }
     // Standard flow: authenticated user recording consent
     const verifiedAuth = c.var.verifiedUser;
     if (!verifiedAuth) {
         throw new e.Unauthorized.Error();
     }
-    // Validate and record consents
-    const { validation, records } = await termsService.validateAndRecordConsents({
-        userSub: verifiedAuth.user.sub,
-        consents,
-    });
-    if (!validation.valid) {
-        throw new e.ValidationError.Error(`Missing required terms: ${validation.missingTerms.join(', ')}`);
-    }
-    return c.json({
-        ok: true,
-        recorded: records.length,
-    }, 200);
+    return withBrowserSecurity(c, async () => {
+        // Validate and record consents
+        const { validation, records } = await termsService.validateAndRecordConsents({
+            userSub: verifiedAuth.user.sub,
+            consents,
+        });
+        if (!validation.valid) {
+            throw new e.ValidationError.Error(`Missing required terms: ${validation.missingTerms.join(', ')}`);
+        }
+        return c.json({
+            ok: true,
+            recorded: records.length,
+        }, 200);
+    }, { termsPolicy: 'read' });
 });
 //# sourceMappingURL=post.js.map