nucleus-core-ts 0.9.700 → 0.9.701

package/dist/src/ElysiaPlugin/routes/auth/oauth/index.d.ts

@@ -9,6 +9,26 @@ interface MagicLinkToken {
     tokenHash: string;
     expiresAt: Date;
 }
+/**
+ * Build the Set-Cookie for the short-lived, single-use OAuth `state` CSRF cookie.
+ *
+ * Path is ALWAYS `/`, NOT the backend's internal OAuth `basePath`. The cookie is
+ * set when the browser starts the flow and must be re-sent on the provider's
+ * callback, but the EXTERNAL callback path is decided by the deployment's
+ * ingress/proxy (commonly `/api/auth/oauth/<provider>/callback` or
+ * `/oauth/<provider>`) and routinely differs from the backend-internal basePath
+ * (`/auth/oauth`). A basePath-scoped cookie then silently fails the browser's
+ * path match on the callback, the cookie is never attached, and the M6 CSRF
+ * check rejects the login with `invalid_state`. `Path=/` makes the cookie
+ * round-trip regardless of how the edge remaps the OAuth routes. `SameSite=Lax`
+ * is required so the top-level GET redirect back from the IdP still carries it;
+ * the cookie stays HttpOnly + single-use, so the wider path does not weaken CSRF.
+ */
+export declare function buildOAuthStateCookie(value: string, opts: {
+    maxAge: number;
+    secure?: boolean;
+    domain?: string;
+}): string;
 export declare function createOAuthRoutes(config: AuthRouteConfig, oauthService: OAuthService, signAccessToken: (userId: string, roles?: string[], claims?: string[], tenant?: string) => string, signRefreshToken: (userId: string) => string, createSession: (params: CreateSessionParams) => Promise<string>, saveSessionToDb?: (sessionId: string, params: CreateSessionParams, schemaName?: string) => Promise<{
     requiresApproval?: boolean;
     sessionId?: string;

package/dist/src/ElysiaPlugin/routes/auth/oauth/oauthStateCookie.test.d.ts

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nucleus-core-ts",
-  "version": "0.9.700",
+  "version": "0.9.701",
   "description": "Production-ready, enterprise-grade TypeScript framework for building multi-tenant APIs",
   "author": "Hidayet Can \u00d6zcan <hidayetcan@gmail.com>",
   "license": "SEE LICENSE IN LICENSE",