@payez/next-mvp 3.0.0

package/dist/auth/auth-options.js

@@ -0,0 +1,213 @@
+"use strict";
+/**
+ * NextAuth Configuration (Refactored)
+ *
+ * This is the composition layer that wires together all auth modules.
+ * Individual logic lives in dedicated modules:
+ * - providers/ - Credentials and OAuth provider builders
+ * - callbacks/ - JWT, session, signIn callbacks
+ * - events/ - SignOut event handler
+ * - utils/ - Token utilities, IDP client
+ * - types/ - Type definitions
+ *
+ * CARGO CULT PATTERNS REMOVED:
+ * ============================
+ * The original auth-options.ts (1186 lines) had several anti-patterns that
+ * added complexity without benefit:
+ *
+ * 1. CALLBACK CONCURRENCY PROTECTION (removed)
+ *    - shouldExecuteCallback() / markCallbackComplete()
+ *    - A debouncing mechanism that tried to prevent callbacks from running
+ *      too frequently. NextAuth already handles this properly.
+ *    - Added complexity, caused race condition bugs, and leaked memory
+ *      (Map entries never cleaned up).
+ *
+ * 2. SESSION RESTORATION (removed)
+ *    - attemptSessionRestoration()
+ *    - Tried to restore sessions by calling refresh endpoint from JWT callback.
+ *    - Created circular dependencies and made debugging impossible.
+ *    - Clean approach: Session missing = user re-authenticates. Simple.
+ *
+ * 3. VARIABLE NAME SOUP (normalized in Phase 3)
+ *    - accessToken vs idpAccessToken vs oauthAccessToken
+ *    - twoFactorComplete vs mfaVerified vs requiresTwoFactor
+ *    - sessionToken vs redisSessionId
+ *    - Now: Clear prefixes (idp*, oauth*, mfa*) with documented meanings.
+ *
+ * 4. INLINE EVERYTHING (modularized in Phase 2)
+ *    - All logic was in one giant file with no separation of concerns.
+ *    - Now: Each module has one job and can be tested independently.
+ *
+ * @version 2.0.0
+ * @since auth-refactor-2026-01
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authOptions = void 0;
+exports.getAuthOptions = getAuthOptions;
+exports.clearAuthOptionsCache = clearAuthOptionsCache;
+const jwt_1 = require("next-auth/jwt");
+const idp_client_config_1 = require("../lib/idp-client-config");
+const app_slug_1 = require("../lib/app-slug");
+// Module imports
+const providers_1 = require("./providers");
+const callbacks_1 = require("./callbacks");
+const events_1 = require("./events");
+// ============================================================================
+// ENVIRONMENT HELPERS
+// ============================================================================
+/**
+ * Get AUTH_ISSUER_URL for JWT issuer claim.
+ * Required for SSO across apps.
+ */
+function getAuthIssuerUrl() {
+    const url = process.env.AUTH_ISSUER_URL;
+    if (!url) {
+        throw new Error('AUTH_ISSUER_URL environment variable is REQUIRED');
+    }
+    return url;
+}
+// ============================================================================
+// BASE AUTH OPTIONS
+// ============================================================================
+/**
+ * Base NextAuth configuration.
+ * Use getAuthOptions() for dynamic provider loading from IDP.
+ */
+exports.authOptions = {
+    // Session uses JWT strategy - JWT contains only redisSessionId
+    session: {
+        strategy: 'jwt',
+        maxAge: 30 * 24 * 60 * 60, // 30 days default, overridden by IDP config
+    },
+    // Custom JWT handling for SSO issuer
+    jwt: {
+        encode: async (params) => {
+            try {
+                const issuer = getAuthIssuerUrl();
+                console.log('[JWT_ENCODE] Encoding token:', {
+                    hasToken: !!params.token,
+                    hasSecret: !!params.secret,
+                    secretLength: params.secret?.length || 0,
+                    issuer,
+                    tokenKeys: params.token ? Object.keys(params.token) : [],
+                });
+                const encoded = await (0, jwt_1.encode)({
+                    ...params,
+                    secret: params.secret,
+                    token: {
+                        ...params.token,
+                        iss: issuer,
+                    },
+                });
+                console.log('[JWT_ENCODE] Success, encoded length:', encoded?.length || 0);
+                return encoded;
+            }
+            catch (error) {
+                console.error('[JWT_ENCODE] FAILED:', error);
+                throw error;
+            }
+        },
+        decode: async (params) => {
+            const decoded = await (0, jwt_1.decode)(params);
+            if (decoded?.iss && decoded.iss !== getAuthIssuerUrl()) {
+                console.error('[JWT] Invalid issuer. Expected:', getAuthIssuerUrl(), 'Got:', decoded.iss);
+                return null; // Hard enforcement - reject mismatched issuers
+            }
+            return decoded;
+        },
+    },
+    // Cookie configuration for multi-app support
+    // In production, use __Secure- prefixed cookie names for enhanced security
+    cookies: {
+        sessionToken: {
+            name: process.env.NODE_ENV === 'production' ? (0, app_slug_1.getSecureSessionCookieName)() : (0, app_slug_1.getSessionCookieName)(),
+            options: {
+                httpOnly: true,
+                sameSite: 'lax',
+                path: '/',
+                secure: process.env.NODE_ENV === 'production',
+            },
+        },
+        csrfToken: {
+            name: process.env.NODE_ENV === 'production' ? (0, app_slug_1.getSecureCsrfCookieName)() : (0, app_slug_1.getCsrfCookieName)(),
+            options: {
+                httpOnly: true,
+                sameSite: 'lax',
+                path: '/',
+                secure: process.env.NODE_ENV === 'production',
+            },
+        },
+        callbackUrl: {
+            name: (0, app_slug_1.getCallbackUrlCookieName)(),
+            options: {
+                sameSite: 'lax',
+                path: '/',
+                secure: process.env.NODE_ENV === 'production',
+            },
+        },
+    },
+    // Providers - credentials only in base, OAuth added dynamically
+    providers: [(0, providers_1.createCredentialsProvider)()],
+    // Callbacks wired to modular implementations
+    callbacks: {
+        jwt: callbacks_1.jwtCallback,
+        session: callbacks_1.sessionCallback, // Type cast needed for NextAuth compatibility
+        signIn: callbacks_1.signInCallback,
+    },
+    // Events
+    events: {
+        signOut: events_1.handleSignOut,
+    },
+    // Custom pages
+    pages: {
+        signIn: '/account-auth/login',
+        error: '/account-auth/login',
+    },
+    debug: false,
+};
+// ============================================================================
+// DYNAMIC AUTH OPTIONS (WITH IDP OAUTH PROVIDERS)
+// ============================================================================
+let cachedAuthOptions = null;
+let authOptionsPromise = null;
+/**
+ * Get auth options with dynamically loaded OAuth providers from IDP.
+ * Uses caching to avoid rebuilding on every request.
+ */
+async function getAuthOptions() {
+    if (cachedAuthOptions) {
+        return cachedAuthOptions;
+    }
+    if (authOptionsPromise) {
+        return authOptionsPromise;
+    }
+    authOptionsPromise = buildDynamicAuthOptions();
+    cachedAuthOptions = await authOptionsPromise;
+    authOptionsPromise = null;
+    return cachedAuthOptions;
+}
+/**
+ * Build auth options with dynamic OAuth providers from IDP.
+ */
+async function buildDynamicAuthOptions() {
+    const idpConfig = await (0, idp_client_config_1.getIDPClientConfig)();
+    const oauthProviders = (0, providers_1.buildOAuthProviders)(idpConfig);
+    return {
+        ...exports.authOptions,
+        secret: idpConfig.nextAuthSecret || process.env.NEXTAUTH_SECRET,
+        session: {
+            ...exports.authOptions.session,
+            maxAge: idpConfig.authSettings?.rememberMeDays
+                ? idpConfig.authSettings.rememberMeDays * 24 * 60 * 60
+                : 30 * 24 * 60 * 60,
+        },
+        providers: [(0, providers_1.createCredentialsProvider)(), ...oauthProviders],
+    };
+}
+/**
+ * Clear cached auth options (when IDP config changes).
+ */
+function clearAuthOptionsCache() {
+    cachedAuthOptions = null;
+    authOptionsPromise = null;
+}

package/dist/auth/callbacks/index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Auth Callbacks - Public Exports
+ */
+export { jwtCallback } from './jwt';
+export { sessionCallback } from './session';
+export { signInCallback } from './signin';

package/dist/auth/callbacks/index.js

@@ -0,0 +1,12 @@
+"use strict";
+/**
+ * Auth Callbacks - Public Exports
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signInCallback = exports.sessionCallback = exports.jwtCallback = void 0;
+var jwt_1 = require("./jwt");
+Object.defineProperty(exports, "jwtCallback", { enumerable: true, get: function () { return jwt_1.jwtCallback; } });
+var session_1 = require("./session");
+Object.defineProperty(exports, "sessionCallback", { enumerable: true, get: function () { return session_1.sessionCallback; } });
+var signin_1 = require("./signin");
+Object.defineProperty(exports, "signInCallback", { enumerable: true, get: function () { return signin_1.signInCallback; } });

package/dist/auth/callbacks/jwt.d.ts

@@ -0,0 +1,45 @@
+/**
+ * JWT Callback
+ *
+ * Minimal token strategy - only store redisSessionId in JWT.
+ * All session data lives in Redis, not in the browser cookie.
+ *
+ * HANDLES:
+ * - Initial sign-in (credentials): Store redisSessionId from authorize()
+ * - Initial sign-in (OAuth): Register with IDP, create session, store redisSessionId
+ * - Subsequent requests: Validate session exists, return token
+ *
+ * @version 1.0.0
+ * @since auth-refactor-2026-01
+ */
+import type { JWT } from 'next-auth/jwt';
+import type { User, Account } from 'next-auth';
+interface JwtCallbackParams {
+    token: JWT;
+    user?: User | any;
+    account?: Account | null;
+    trigger?: 'signIn' | 'signUp' | 'update';
+}
+interface JwtCallbackResult extends JWT {
+    /** Redis session ID - the key to look up session data */
+    redisSessionId?: string;
+    /** User ID from IDP */
+    sub: string;
+    /** Error code if session validation failed */
+    error?: string;
+    /** Flag for OAuth users who need immediate 2FA redirect */
+    requiresTwoFactorRedirect?: boolean;
+}
+/**
+ * JWT callback - builds the NextAuth JWT token.
+ *
+ * MINIMAL TOKEN STRATEGY:
+ * - Only store redisSessionId (key to Redis session)
+ * - All tokens and user data live in Redis
+ * - Browser cookie stays small and secure
+ *
+ * @param params - JWT callback parameters from NextAuth
+ * @returns JWT payload to store in browser cookie
+ */
+export declare function jwtCallback({ token, user, account, trigger, }: JwtCallbackParams): Promise<JwtCallbackResult>;
+export {};

package/dist/auth/callbacks/jwt.js

@@ -0,0 +1,305 @@
+"use strict";
+/**
+ * JWT Callback
+ *
+ * Minimal token strategy - only store redisSessionId in JWT.
+ * All session data lives in Redis, not in the browser cookie.
+ *
+ * HANDLES:
+ * - Initial sign-in (credentials): Store redisSessionId from authorize()
+ * - Initial sign-in (OAuth): Register with IDP, create session, store redisSessionId
+ * - Subsequent requests: Validate session exists, return token
+ *
+ * @version 1.0.0
+ * @since auth-refactor-2026-01
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.jwtCallback = jwtCallback;
+const crypto_1 = require("crypto");
+const session_store_1 = require("../../lib/session-store");
+const idp_client_config_1 = require("../../lib/idp-client-config");
+const idp_client_1 = require("../utils/idp-client");
+const token_utils_1 = require("../utils/token-utils");
+// NOTE: Using any for sessionData until Phase 3 normalizes types
+// ============================================================================
+// VIBE ROLE FETCHING
+// ============================================================================
+/**
+ * Generate HMAC signature for Vibe API request.
+ */
+function generateVibeSignature(endpoint, clientId, timestamp) {
+    const signingKey = process.env.VIBE_SIGNING_KEY;
+    if (!signingKey) {
+        return '';
+    }
+    const stringToSign = `${timestamp}|GET|${endpoint}|${clientId}`;
+    return (0, crypto_1.createHmac)('sha256', Buffer.from(signingKey, 'base64'))
+        .update(stringToSign)
+        .digest('base64');
+}
+/**
+ * Fetch user's roles from Vibe API.
+ * Returns empty array on failure (non-blocking).
+ * Uses HMAC signature for authentication when signing key is configured.
+ */
+async function fetchVibeRoles(userId, clientId) {
+    const vibeApiUrl = process.env.VIBE_API_URL;
+    if (!vibeApiUrl) {
+        return [];
+    }
+    const endpoint = `/api/v1/users/${userId}/roles`;
+    const timestamp = Math.floor(Date.now() / 1000);
+    const signature = generateVibeSignature(endpoint, clientId, timestamp);
+    // Build headers with optional signature
+    const headers = {
+        'Accept': 'application/json',
+        'X-Client-Id': clientId,
+        'X-Vibe-Client-Id': clientId,
+    };
+    if (signature) {
+        headers['X-Vibe-Timestamp'] = String(timestamp);
+        headers['X-Vibe-Signature'] = signature;
+    }
+    try {
+        const response = await fetch(`${vibeApiUrl}${endpoint}`, {
+            method: 'GET',
+            headers,
+            // 2 second timeout
+            signal: AbortSignal.timeout(2000),
+        });
+        if (!response.ok) {
+            console.warn('[JWT_CALLBACK] Failed to fetch Vibe roles:', response.status);
+            return [];
+        }
+        const data = await response.json();
+        const roles = data.roles?.map((r) => r.role_name || r) || [];
+        console.log('[JWT_CALLBACK] Fetched Vibe roles:', roles);
+        return roles;
+    }
+    catch (error) {
+        console.warn('[JWT_CALLBACK] Error fetching Vibe roles (continuing with IDP roles only):', error);
+        return [];
+    }
+}
+/**
+ * Merge IDP roles with Vibe roles, deduplicating.
+ */
+function mergeRoles(idpRoles, vibeRoles) {
+    return [...new Set([...idpRoles, ...vibeRoles])];
+}
+// ============================================================================
+// JWT CALLBACK
+// ============================================================================
+/**
+ * JWT callback - builds the NextAuth JWT token.
+ *
+ * MINIMAL TOKEN STRATEGY:
+ * - Only store redisSessionId (key to Redis session)
+ * - All tokens and user data live in Redis
+ * - Browser cookie stays small and secure
+ *
+ * @param params - JWT callback parameters from NextAuth
+ * @returns JWT payload to store in browser cookie
+ */
+async function jwtCallback({ token, user, account, trigger, }) {
+    console.log('[JWT_CALLBACK] Called with:', {
+        trigger,
+        hasAccount: !!account,
+        provider: account?.provider,
+        hasUser: !!user,
+        userEmail: user?.email,
+        existingRedisSessionId: token?.redisSessionId ? 'yes' : 'no',
+    });
+    // -------------------------------------------------------------------------
+    // OAuth Sign-In: Register with IDP and create session
+    // -------------------------------------------------------------------------
+    if (account && account.provider !== 'credentials') {
+        console.log('[JWT_CALLBACK] Handling OAuth sign-in for provider:', account.provider);
+        return handleOAuthSignIn(token, user, account);
+    }
+    // -------------------------------------------------------------------------
+    // Credentials Sign-In: Session already created in authorize()
+    // -------------------------------------------------------------------------
+    if (user && user.redisSessionId) {
+        // Credentials authorize() returns redisSessionId
+        const redisSessionId = user.redisSessionId;
+        return {
+            ...token,
+            redisSessionId,
+            sub: user.id || token.sub || 'unknown',
+        };
+    }
+    // -------------------------------------------------------------------------
+    // Subsequent Requests: Validate session exists
+    // -------------------------------------------------------------------------
+    const redisSessionId = user?.redisSessionId || token?.redisSessionId || token?.redisSessionId;
+    if (!redisSessionId) {
+        return { ...token, error: 'NoSession', sub: token.sub || 'unknown' };
+    }
+    // Validate session still exists in Redis
+    try {
+        const sessionData = await (0, session_store_1.getSession)(redisSessionId);
+        if (!sessionData) {
+            // Session expired or deleted
+            return { ...token, error: 'SessionNotFound', sub: token.sub || 'unknown' };
+        }
+        // Check if refresh token has expired (session should be terminated)
+        if (sessionData.idpRefreshTokenExpires && Date.now() >= sessionData.idpRefreshTokenExpires) {
+            return { ...token, error: 'RefreshTokenExpired', sub: token.sub || 'unknown' };
+        }
+        // Check if MFA has expired (requires step-up authentication)
+        if (sessionData.mfaExpiresAt && Date.now() > sessionData.mfaExpiresAt) {
+            return {
+                ...token,
+                redisSessionId,
+                sub: sessionData.userId,
+                error: 'MfaExpired',
+            };
+        }
+    }
+    catch (error) {
+        console.error('[JWT_CALLBACK] Session validation error:', error);
+        return { ...token, error: 'SessionError', sub: token.sub || 'unknown' };
+    }
+    // Session is valid - return minimal token
+    return {
+        ...token,
+        redisSessionId,
+        sub: token.sub || 'unknown',
+    };
+}
+// ============================================================================
+// OAUTH SIGN-IN HANDLER
+// ============================================================================
+/**
+ * Handle OAuth sign-in by registering with IDP and creating session.
+ */
+async function handleOAuthSignIn(token, user, account) {
+    console.log('[JWT_CALLBACK] handleOAuthSignIn starting for:', {
+        provider: account.provider,
+        email: user?.email,
+        providerAccountId: account.providerAccountId,
+    });
+    try {
+        // Call IDP to register/authenticate OAuth user
+        const idpResult = await (0, idp_client_1.idpOAuthCallback)({
+            provider: account.provider,
+            providerAccountId: account.providerAccountId,
+            email: user?.email || '',
+            name: user?.name || '',
+            image: user?.image || '',
+            accessToken: account.access_token,
+            refreshToken: account.refresh_token,
+            expiresAt: account.expires_at,
+        });
+        // Build session data using normalized field names
+        let sessionData;
+        let mfaVerified = false;
+        if (idpResult.success && idpResult.data?.accessToken) {
+            // IDP integration succeeded - we have IDP tokens
+            const decoded = (0, token_utils_1.decodeIdpAccessToken)(idpResult.data.accessToken);
+            const amrClaims = decoded ? (0, token_utils_1.extractAmrFromToken)(decoded) : [];
+            const acrLevel = decoded?.acr || '1';
+            // Extract kid from JWT header (CRITICAL: different from client_id in payload)
+            const bearerKeyId = (0, token_utils_1.extractKidFromToken)(idpResult.data.accessToken);
+            if (bearerKeyId) {
+                console.log('[JWT_CALLBACK] Extracted bearerKeyId (kid) from JWT header:', bearerKeyId);
+            }
+            else {
+                console.warn('[JWT_CALLBACK] No kid found in JWT header');
+            }
+            // Check if MFA is required for this client
+            try {
+                const clientConfig = await (0, idp_client_config_1.getIDPClientConfig)();
+                const require2FA = clientConfig?.authSettings?.require2FA ?? true;
+                mfaVerified = !require2FA; // If MFA not required, mark as verified
+            }
+            catch {
+                // Default to requiring MFA if config unavailable
+                mfaVerified = false;
+            }
+            sessionData = {
+                userId: idpResult.data.user?.userId?.toString() || account.providerAccountId,
+                email: idpResult.data.user?.email || user?.email || '',
+                name: idpResult.data.user?.fullName || user?.name || '',
+                roles: idpResult.data.user?.roles || [],
+                // IDP tokens (normalized names)
+                idpAccessToken: idpResult.data.accessToken,
+                idpRefreshToken: idpResult.data.refreshToken,
+                idpAccessTokenExpires: decoded?.exp ? (0, token_utils_1.expClaimToMs)(decoded.exp) : Date.now() + 3600000,
+                decodedAccessToken: decoded || undefined,
+                // Bearer key ID from JWT header (NOT client_id from payload)
+                bearerKeyId,
+                // MFA state (normalized names)
+                mfaVerified,
+                authenticationMethods: amrClaims,
+                authenticationLevel: acrLevel,
+                // OAuth provider info (normalized names)
+                oauthProvider: account.provider,
+                oauthProviderToken: account.access_token,
+                oauthProviderRefreshToken: account.refresh_token,
+                // Multi-tenant info
+                idpClientId: decoded?.client_id,
+                merchantId: decoded?.merchant_id,
+            };
+        }
+        else {
+            // IDP integration failed - create OAuth-only session
+            // This allows OAuth login to work even if IDP is unavailable
+            mfaVerified = true; // OAuth IS multi-factor (Google/Microsoft handle MFA)
+            sessionData = {
+                userId: account.providerAccountId,
+                email: user?.email || '',
+                name: user?.name || '',
+                roles: [],
+                mfaVerified: true, // OAuth IS multi-factor
+                oauthProvider: account.provider,
+                oauthProviderToken: account.access_token,
+                oauthProviderRefreshToken: account.refresh_token,
+                idpAccessTokenExpires: account.expires_at
+                    ? account.expires_at * 1000
+                    : Date.now() + 3600000,
+            };
+        }
+        // -------------------------------------------------------------------------
+        // ROLE MERGING: Fetch Vibe roles and merge with IDP roles
+        // -------------------------------------------------------------------------
+        const clientId = sessionData.idpClientId || process.env.IDP_CLIENT_ID || '';
+        if (clientId && sessionData.userId) {
+            const vibeRoles = await fetchVibeRoles(sessionData.userId, clientId);
+            // SECURITY: Filter out protected IDP-level role prefixes to prevent injection
+            const safeVibeRoles = vibeRoles.filter(r => !r.startsWith('payez_'));
+            const idpRoles = sessionData.roles || [];
+            sessionData.roles = mergeRoles(idpRoles, safeVibeRoles);
+            console.log('[JWT_CALLBACK] Merged roles:', {
+                idpRoles,
+                vibeRoles,
+                safeVibeRoles,
+                merged: sessionData.roles,
+            });
+        }
+        // Create Redis session
+        console.log('[JWT_CALLBACK] Creating Redis session for:', {
+            userId: sessionData.userId,
+            email: sessionData.email,
+            mfaVerified: sessionData.mfaVerified,
+            roles: sessionData.roles,
+        });
+        const redisSessionId = await (0, session_store_1.createSession)(sessionData);
+        console.log('[JWT_CALLBACK] Redis session created:', {
+            redisSessionId: redisSessionId ? redisSessionId.substring(0, 8) + '...' : 'NONE',
+        });
+        // Check if immediate MFA redirect is needed
+        const needsImmediateTwoFactor = !mfaVerified;
+        return {
+            ...token,
+            redisSessionId,
+            sub: sessionData.userId,
+            requiresTwoFactorRedirect: needsImmediateTwoFactor,
+        };
+    }
+    catch (error) {
+        console.error('[JWT_CALLBACK] handleOAuthSignIn FAILED:', error);
+        return { ...token, error: 'OAuthSignInFailed', sub: token.sub || 'unknown' };
+    }
+}

package/dist/auth/callbacks/session.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Session Callback
+ *
+ * Builds the NextAuth session from Redis session data.
+ * The JWT only contains redisSessionId - all user data comes from Redis.
+ *
+ * FLOW:
+ * 1. Extract redisSessionId from JWT token
+ * 2. Fetch session data from Redis
+ * 3. Build NextAuth session with user info
+ *
+ * @version 1.0.0
+ * @since auth-refactor-2026-01
+ */
+import type { Session } from 'next-auth';
+import type { JWT } from 'next-auth/jwt';
+interface SessionCallbackParams {
+    session: Session;
+    token: JWT & {
+        /** Redis session ID - the key to look up session data */
+        redisSessionId?: string;
+        error?: string;
+    };
+}
+interface AppSessionUser {
+    id: string;
+    email: string;
+    name?: string;
+    roles: string[];
+    twoFactorSessionVerified: boolean;
+    requiresTwoFactor: boolean;
+    authenticationMethods?: string[];
+    authenticationLevel?: string;
+    mfaCompletedAt?: number;
+    mfaExpiresAt?: number;
+    mfaValidityHours?: number;
+    oauthProvider?: string;
+    idpClientId?: string;
+    merchantId?: string;
+    bearerKeyId?: string;
+}
+interface AppSession extends Omit<Session, 'user'> {
+    user: AppSessionUser;
+    sessionToken?: string;
+    accessToken?: string;
+    refreshToken?: string;
+    accessTokenExpires?: number;
+    error?: string;
+}
+/**
+ * Session callback - builds NextAuth session from Redis.
+ *
+ * This callback is called whenever getSession() or useSession() is used.
+ * It fetches the full session from Redis and exposes it to the client.
+ *
+ * @param params - Session callback parameters from NextAuth
+ * @returns AppSession with user data from Redis
+ */
+export declare function sessionCallback({ session, token, }: SessionCallbackParams): Promise<AppSession>;
+export {};