Patch identity core security flow

Author: pan-canon

identity-core/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@interdead/identity-core",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "Headless identity kernel that wires Discord OAuth with portable storage adapters using a hexagonal/ports-and-adapters layout.",
   "type": "module",
   "main": "dist/esm/index.js",

identity-core/package.json

@@ -11,6 +11,7 @@ export interface CloudflareBindings {
   readonly kv?: {
     get: (key: string) => Promise<string | null>;
     put: (key: string, value: string) => Promise<void>;
+    delete: (key: string) => Promise<void>;
   };
 }
 
@@ -51,7 +52,7 @@ export class CloudflareProfileRepositoryAdapter implements IIdentityRepository {
       "DELETE FROM profiles WHERE profile_id = ?",
       [profileId],
     );
-    await this.bindings.kv?.put(`identity:${profileId}`, "");
+    await this.bindings.kv?.delete(`identity:${profileId}`);
     this.logger.warn("Deleted profile from Cloudflare", { profileId });
   }
 }

identity-core/src/adapters/CloudflareProfileRepositoryAdapter.ts

@@ -8,6 +8,7 @@ import {
   ILogger,
   ISessionStore,
 } from "../ports/index.js";
+import { IdentityCoreError } from "../utils/errorMapper.js";
 
 export interface IdentityLinkOptions {
   readonly allowUsernameOverride?: boolean;
@@ -42,6 +43,12 @@ export class IdentityLinkService {
       throw new Error("Discord OAuth is disabled for this runtime");
     }
 
+    if (metadata.profileId !== profileId) {
+      throw new IdentityCoreError(
+        "Profile metadata does not match requested profile id",
+      );
+    }
+
     const linkPayload: DiscordProfileLink =
       options.discordLink ?? (await this.discordPort.exchangeCode(code));
     const policy = options.policy ?? new DiscordLinkPolicy();