claimAssertionOnce (lib/assertion-replay.ts)

Prevents replay attacks by enforcing single-use ID Token assertions in OIDC flows.

// Source: https://github.com/rekey-dev/rekey | License: MIT | Copyright 2026 Rekey
// Provided via justclaw.it.com; keep this notice with the code.
/**
 * Single-use enforcement for ID Token assertions.
 *
 * An operator assertion (POST /api/v1/tenant/auth/oidc/assert) travels through
 * the buyer's browser to get from the site that obtained it to the panel that
 * redeems it. It is signed and short-lived, but nothing in the OIDC ID Token
 * makes it single-use, there is no `jti`, so without this a token captured
 * in transit (browser history, a shared machine, an over-broad referrer) could
 * be replayed for the rest of its ten-minute life to mint another operator
 * session.
 *
 * The claim key is SHA-256 of the token, never the token: this store is not a
 * place a bearer credential s

... (truncated -- full source via MCP)