nucleus-core-ts 0.9.700 → 0.9.702

package/dist/src/ElysiaPlugin/routes/auth/oauth/index.d.ts

@@ -9,6 +9,26 @@ interface MagicLinkToken {
     tokenHash: string;
     expiresAt: Date;
 }
+/**
+ * Build the Set-Cookie for the short-lived, single-use OAuth `state` CSRF cookie.
+ *
+ * Path is ALWAYS `/`, NOT the backend's internal OAuth `basePath`. The cookie is
+ * set when the browser starts the flow and must be re-sent on the provider's
+ * callback, but the EXTERNAL callback path is decided by the deployment's
+ * ingress/proxy (commonly `/api/auth/oauth/<provider>/callback` or
+ * `/oauth/<provider>`) and routinely differs from the backend-internal basePath
+ * (`/auth/oauth`). A basePath-scoped cookie then silently fails the browser's
+ * path match on the callback, the cookie is never attached, and the M6 CSRF
+ * check rejects the login with `invalid_state`. `Path=/` makes the cookie
+ * round-trip regardless of how the edge remaps the OAuth routes. `SameSite=Lax`
+ * is required so the top-level GET redirect back from the IdP still carries it;
+ * the cookie stays HttpOnly + single-use, so the wider path does not weaken CSRF.
+ */
+export declare function buildOAuthStateCookie(value: string, opts: {
+    maxAge: number;
+    secure?: boolean;
+    domain?: string;
+}): string;
 export declare function createOAuthRoutes(config: AuthRouteConfig, oauthService: OAuthService, signAccessToken: (userId: string, roles?: string[], claims?: string[], tenant?: string) => string, signRefreshToken: (userId: string) => string, createSession: (params: CreateSessionParams) => Promise<string>, saveSessionToDb?: (sessionId: string, params: CreateSessionParams, schemaName?: string) => Promise<{
     requiresApproval?: boolean;
     sessionId?: string;

package/dist/src/ElysiaPlugin/routes/auth/oauth/oauthStateCookie.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/Services/OAuth/stateStore.d.ts

@@ -16,6 +16,16 @@ export type RedisLike = {
  * Redis-backed store (P3) — works across instances and survives restarts. State
  * is single-use: consume() deletes the key before returning, so a replayed
  * callback (or a double-submit) finds nothing.
+ *
+ * IMPORTANT: store the payload as an OBJECT and let the store layer handle
+ * serialization. Do NOT JSON.stringify here / JSON.parse on read. The RedisLike
+ * implementations already serialize internally — the direct ioredis store
+ * `JSON.stringify`s on write and `JSON.parse`s on read, and the Dapr store's
+ * `state.get` AUTO-PARSES JSON strings back into objects. A pre-stringify here
+ * therefore round-trips fine on the direct store (double-encode cancels out) but
+ * breaks on Dapr: `read` returns a parsed OBJECT, so a second `JSON.parse(object)`
+ * throws ("[object Object]") and consume returns null → every OAuth login fails
+ * with `invalid_state`. Passing the object through works on BOTH backends.
  */
 export declare const createRedisOAuthStateStore: (redis: RedisLike) => OAuthStateStore;
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nucleus-core-ts",
-  "version": "0.9.700",
+  "version": "0.9.702",
   "description": "Production-ready, enterprise-grade TypeScript framework for building multi-tenant APIs",
   "author": "Hidayet Can \u00d6zcan <hidayetcan@gmail.com>",
   "license": "SEE LICENSE IN LICENSE",