@payez/next-mvp 3.0.0

package/src/api-handlers/account/change-password.ts

@@ -0,0 +1,145 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { getToken } from 'next-auth/jwt';
+import { resolveNextAuthSecret } from '../../lib/nextauth-secret';
+import { getSession } from '../../lib/session-store';
+import { getJwtCookieName } from '../../lib/app-slug';
+
+interface ChangePasswordRequest {
+  current_password: string;
+  new_password: string;
+  confirm_password: string;
+}
+
+import { nanoid } from 'nanoid';
+
+// ...
+
+export async function POST(req: NextRequest) {
+  const requestId = nanoid();
+  try {
+    // Get session token from NextAuth JWT
+    // Support both field names: sessionToken (auth.ts JWT) and redisSessionId (legacy)
+    const token = await getToken({ req, secret: process.env.NEXTAUTH_SECRET, cookieName: getJwtCookieName() });
+    const sessionToken = (token?.sessionToken || token?.redisSessionId) as string | undefined;
+    if (!token || typeof sessionToken !== 'string') {
+      return NextResponse.json({ success: false, message: 'Unauthorized' }, { status: 401 });
+    }
+    const sessionData = await getSession(sessionToken);
+    // NOTE: Field is idpAccessToken (not accessToken) per normalized naming convention
+    if (!sessionData?.idpAccessToken) {
+      return NextResponse.json(
+        {
+          success: false,
+          message: 'Authentication required - no access token available',
+          error_code: 'UNAUTHORIZED',
+          request_id: requestId,
+        },
+        { status: 401 }
+      );
+    }
+
+    const body = await req.json();
+    const { current_password, new_password, confirm_password } = body as ChangePasswordRequest;
+
+    // Validate input
+    if (!current_password || !new_password || !confirm_password) {
+      return NextResponse.json(
+        {
+          success: false,
+          message: 'Current password, new password, and confirmation are required',
+          error_code: 'VALIDATION_ERROR',
+          request_id: requestId,
+        },
+        { status: 400 }
+      );
+    }
+
+    if (new_password !== confirm_password) {
+      return NextResponse.json(
+        {
+          success: false,
+          message: 'New password and confirmation do not match',
+          error_code: 'VALIDATION_ERROR',
+          request_id: requestId,
+        },
+        { status: 400 }
+      );
+    }
+
+    // Get IDP base URL from environment
+    const idpBaseUrl = process.env.IDP_URL;
+
+    if (!idpBaseUrl) {
+      console.error('[CHANGE_PASSWORD] IDP_URL not configured');
+      return NextResponse.json(
+        {
+          success: false,
+          message: 'Service configuration error',
+          error_code: 'CONFIGURATION_ERROR',
+          request_id: requestId,
+        },
+        { status: 500 }
+      );
+    }
+
+    // Proxy request to IDP
+    const idpUrl = `${idpBaseUrl}/api/Account/change-password`;
+    const idpResponse = await fetch(idpUrl, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'Authorization': `Bearer ${sessionData.idpAccessToken}`,
+        'x-request-id': requestId,
+      },
+      body: JSON.stringify({
+        current_password,
+        new_password,
+        confirm_password,
+      }),
+    });
+
+    const responseData = await idpResponse.json().catch(() => ({}));
+
+    if (!idpResponse.ok) {
+      // Extract error message from IDP response
+      let errorMessage = 'Failed to change password';
+
+      if (responseData.message) {
+        errorMessage = responseData.message;
+      } else if (responseData.details?.value && Array.isArray(responseData.details.value) && responseData.details.value.length > 0) {
+        errorMessage = responseData.details.value[0].message || errorMessage;
+      } else if (responseData.details?.message) {
+        errorMessage = responseData.details.message;
+      }
+
+      return NextResponse.json(
+        {
+          success: false,
+          message: errorMessage,
+          error_code: responseData.error_code || 'CHANGE_PASSWORD_FAILED',
+          request_id: requestId,
+          details: responseData.details,
+        },
+        { status: idpResponse.status }
+      );
+    }
+
+    return NextResponse.json({
+      success: true,
+      message: responseData.message || 'Password changed successfully',
+      request_id: requestId,
+    });
+  } catch (error) {
+    console.error('[CHANGE_PASSWORD] Error:', error);
+    const requestId = req.headers.get('x-request-id') ?? crypto.randomUUID();
+    return NextResponse.json(
+      {
+        success: false,
+        message: error instanceof Error ? error.message : 'Failed to change password',
+        error_code: 'INTERNAL_ERROR',
+        request_id: requestId,
+      },
+      { status: 500 }
+    );
+  }
+}

package/src/api-handlers/account/masked-info.ts

@@ -0,0 +1,45 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { idpFetchJSON } from '../../lib/idp-fetch';
+import { ENV_CONFIG } from '../../config/env';
+
+// IDP masked-info is POST and uses capital 'A' in /api/Account
+export async function POST(req: NextRequest) {
+  const url = `${ENV_CONFIG.IDP_URL}/api/Account/masked-info`;
+
+  // Forward request body if present; IDP often accepts empty object
+  let body = '{}';
+  try {
+    const raw = await req.text();
+    if (raw && raw.trim().length > 0) body = raw;
+  } catch {}
+
+  const result = await idpFetchJSON(req, url, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body
+  });
+
+  if (!result.ok) {
+    return NextResponse.json(
+      {
+        success: false,
+        message: 'Upstream error',
+        error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: result.json },
+        meta: { attemptedRefresh: result.attemptedRefresh },
+      },
+      { status: result.status }
+    );
+  }
+
+  const bodyJson: any = result.json;
+  // Unwrap if IDP returns envelope { success, data }
+  if (bodyJson && typeof bodyJson === 'object' && 'success' in bodyJson && 'data' in bodyJson) {
+    if ((bodyJson as any).success === true) {
+      return NextResponse.json((bodyJson as any).data, { status: 200 });
+    }
+    return NextResponse.json(bodyJson, { status: 200 });
+  }
+
+  // Passthrough otherwise
+  return NextResponse.json(bodyJson ?? {}, { status: 200 });
+}

package/src/api-handlers/account/profile.ts

@@ -0,0 +1,80 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+/**
+ * Account Profile API Handler
+ * Simple proxy to IDP profile endpoint
+ *
+ * GET /api/account/profile - Get user profile
+ * PUT /api/account/profile - Update user profile
+ */
+
+function getIdpUrl(): string {
+  const url = process.env.IDP_URL;
+  if (!url) {
+    throw new Error('[IDP_URL] FATAL: IDP_URL environment variable is REQUIRED.');
+  }
+  return url;
+}
+
+export async function GET(req: NextRequest) {
+  const IDP_URL = getIdpUrl();
+  const authHeader = req.headers.get('authorization');
+
+  if (!authHeader) {
+    return NextResponse.json(
+      { success: false, error: { code: 'UNAUTHORIZED', message: 'Authentication required' } },
+      { status: 401 }
+    );
+  }
+
+  try {
+    const upstream = await fetch(`${IDP_URL}/api/Account/profile`, {
+      method: 'GET',
+      headers: {
+        'Content-Type': 'application/json',
+        'Authorization': authHeader,
+      },
+    });
+
+    const data = await upstream.json().catch(() => ({}));
+    return NextResponse.json(data, { status: upstream.status });
+  } catch (error) {
+    return NextResponse.json(
+      { success: false, error: { code: 'UPSTREAM_ERROR', message: 'Failed to fetch profile' } },
+      { status: 500 }
+    );
+  }
+}
+
+export async function PUT(req: NextRequest) {
+  const IDP_URL = getIdpUrl();
+  const authHeader = req.headers.get('authorization');
+
+  if (!authHeader) {
+    return NextResponse.json(
+      { success: false, error: { code: 'UNAUTHORIZED', message: 'Authentication required' } },
+      { status: 401 }
+    );
+  }
+
+  try {
+    const body = await req.text();
+
+    const upstream = await fetch(`${IDP_URL}/api/Account/profile`, {
+      method: 'PUT',
+      headers: {
+        'Content-Type': 'application/json',
+        'Authorization': authHeader,
+      },
+      body,
+    });
+
+    const data = await upstream.json().catch(() => ({}));
+    return NextResponse.json(data, { status: upstream.status });
+  } catch (error) {
+    return NextResponse.json(
+      { success: false, error: { code: 'UPSTREAM_ERROR', message: 'Failed to update profile' } },
+      { status: 500 }
+    );
+  }
+}

package/src/api-handlers/account/recovery/initiate.ts

@@ -0,0 +1,23 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+function getIdpUrl(): string {
+  const url = process.env.IDP_URL;
+  if (!url) throw new Error('[IDP_URL] FATAL: IDP_URL environment variable is REQUIRED.');
+  return url;
+}
+
+export async function POST(req: NextRequest) {
+  const IDP_URL = getIdpUrl();
+  try {
+    const { email } = await req.json();
+    const upstream = await fetch(`${IDP_URL}/api/Account/recovery/initiate`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ email }),
+    });
+    const data = await upstream.json().catch(() => ({}));
+    return NextResponse.json(data, { status: upstream.status });
+  } catch (e) {
+    return NextResponse.json({ success: false, error: 'initiate_failed' }, { status: 500 });
+  }
+}

package/src/api-handlers/account/recovery/send-code.ts

@@ -0,0 +1,25 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+function getIdpUrl(): string {
+  const url = process.env.IDP_URL;
+  if (!url) throw new Error('[IDP_URL] FATAL: IDP_URL environment variable is REQUIRED.');
+  return url;
+}
+
+export async function POST(req: NextRequest) {
+  const IDP_URL = getIdpUrl();
+  try {
+    const auth = req.headers.get('authorization') || '';
+    const token = auth.startsWith('Bearer ') ? auth.slice(7) : '';
+    const { method } = await req.json();
+    const upstream = await fetch(`${IDP_URL}/api/Account/recovery/send-code`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${token}` },
+      body: JSON.stringify({ method }),
+    });
+    const data = await upstream.json().catch(() => ({}));
+    return NextResponse.json(data, { status: upstream.status });
+  } catch {
+    return NextResponse.json({ success: false, error: 'send_code_failed' }, { status: 500 });
+  }
+}

package/src/api-handlers/account/recovery/verify-code.ts

@@ -0,0 +1,25 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+function getIdpUrl(): string {
+  const url = process.env.IDP_URL;
+  if (!url) throw new Error('[IDP_URL] FATAL: IDP_URL environment variable is REQUIRED.');
+  return url;
+}
+
+export async function POST(req: NextRequest) {
+  const IDP_URL = getIdpUrl();
+  try {
+    const auth = req.headers.get('authorization') || '';
+    const token = auth.startsWith('Bearer ') ? auth.slice(7) : '';
+    const { code, method } = await req.json();
+    const upstream = await fetch(`${IDP_URL}/api/Account/recovery/verify-code`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${token}` },
+      body: JSON.stringify({ code, method }),
+    });
+    const data = await upstream.json().catch(() => ({}));
+    return NextResponse.json(data, { status: upstream.status });
+  } catch {
+    return NextResponse.json({ success: false, error: 'verify_code_failed' }, { status: 500 });
+  }
+}

package/src/api-handlers/account/reset-password.ts

@@ -0,0 +1,23 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+function getIdpUrl(): string {
+  const url = process.env.IDP_URL;
+  if (!url) throw new Error('[IDP_URL] FATAL: IDP_URL environment variable is REQUIRED.');
+  return url;
+}
+
+export async function POST(req: NextRequest) {
+  const IDP_URL = getIdpUrl();
+  try {
+    const payload = await req.json();
+    const upstream = await fetch(`${IDP_URL}/api/Account/reset-password`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(payload),
+    });
+    const data = await upstream.json().catch(() => ({}));
+    return NextResponse.json(data, { status: upstream.status });
+  } catch {
+    return NextResponse.json({ success: false, error: 'reset_password_failed' }, { status: 500 });
+  }
+}

package/src/api-handlers/account/send-code.ts

@@ -0,0 +1,76 @@
+/**
+ * Send 2FA Verification Code Handler
+ *
+ * Sends a verification code via email or SMS to the authenticated user.
+ * Requires a provisional Bearer token (ACR=1) from initial login.
+ *
+ * @package @payez/next-mvp
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { idpFetchJSON } from '../../lib/idp-fetch';
+import { ENV_CONFIG } from '../../config/env';
+
+export async function POST(req: NextRequest) {
+  try {
+    // Parse request body
+    const body = await req.json();
+    const method = String(body.method || '').toLowerCase();
+
+    if (method !== 'sms' && method !== 'email') {
+      return NextResponse.json(
+        {
+          success: false,
+          error: 'Method must be either "sms" or "email"',
+          code: 'INVALID_METHOD',
+        },
+        { status: 400 }
+      );
+    }
+
+    // Build IDP endpoint URL
+    const idpEndpoint = method === 'sms'
+      ? '/api/ExternalAuth/twofa/sms/send'
+      : '/api/ExternalAuth/twofa/email/send';
+
+    // Send client_id in body (lower_snake_case per PayEz standards)
+    const idpBody = JSON.stringify({ client_id: ENV_CONFIG.CLIENT_ID });
+
+    // Call IDP using idpFetchJSON which auto-injects Bearer token from Redis session
+    const result = await idpFetchJSON(req, `${ENV_CONFIG.IDP_URL}${idpEndpoint}`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: idpBody,
+    });
+
+    if (!result.ok) {
+      return NextResponse.json(
+        {
+          success: false,
+          error: result.json?.message || `Failed to send ${method} code`,
+          code: result.json?.code || 'IDP_ERROR',
+          meta: { attemptedRefresh: result.attemptedRefresh },
+        },
+        { status: result.status }
+      );
+    }
+
+    return NextResponse.json(
+      {
+        success: true,
+        message: `Verification code sent via ${method}`,
+      },
+      { status: 200 }
+    );
+  } catch (error) {
+    console.error('[SEND_CODE] Error:', error);
+    return NextResponse.json(
+      {
+        success: false,
+        error: 'Failed to send verification code',
+        code: 'INTERNAL_ERROR',
+      },
+      { status: 500 }
+    );
+  }
+}

package/src/api-handlers/account/update-phone.ts

@@ -0,0 +1,79 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { idpFetchJSON } from '../../lib/idp-fetch';
+import { ENV_CONFIG } from '../../config/env';
+
+/**
+ * Update Phone Number API Handler
+ *
+ * PATCH /api/account/update-phone - Update user's phone number
+ * Used for 2FA setup - users need to add a phone to enable SMS verification.
+ */
+export async function POST(req: NextRequest) {
+  try {
+    // Parse request body
+    let body: { phoneNumber?: string };
+    try {
+      body = await req.json();
+    } catch {
+      return NextResponse.json(
+        { success: false, error: { code: 'INVALID_JSON', message: 'Invalid request body' } },
+        { status: 400 }
+      );
+    }
+
+    const { phoneNumber } = body;
+
+    if (!phoneNumber) {
+      return NextResponse.json(
+        { success: false, error: { code: 'INVALID_INPUT', message: 'Phone number is required' } },
+        { status: 400 }
+      );
+    }
+
+    // PATCH profile with phone_number only
+    const url = `${ENV_CONFIG.IDP_URL}/api/Account/profile`;
+    const result = await idpFetchJSON(req, url, {
+      method: 'PATCH',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ phone_number: phoneNumber }),
+    });
+
+    if (!result.ok) {
+      console.error('[UPDATE_PHONE] IDP error:', result.status, result.json);
+      return NextResponse.json(
+        {
+          success: false,
+          error: {
+            code: (result.json as any)?.error?.code || 'UPDATE_FAILED',
+            message: (result.json as any)?.error?.message || 'Failed to update phone number',
+          },
+          meta: { attemptedRefresh: result.attemptedRefresh },
+        },
+        { status: result.status }
+      );
+    }
+
+    const responseData = result.json as any;
+
+    // Unwrap if IDP returns envelope { success, data }
+    if (responseData && typeof responseData === 'object' && 'success' in responseData && 'data' in responseData) {
+      return NextResponse.json({
+        success: true,
+        message: 'Phone number updated successfully',
+        data: responseData.data,
+      });
+    }
+
+    return NextResponse.json({
+      success: true,
+      message: 'Phone number updated successfully',
+      data: responseData,
+    });
+  } catch (error) {
+    console.error('[UPDATE_PHONE] Error:', error);
+    return NextResponse.json(
+      { success: false, error: { code: 'INTERNAL_ERROR', message: 'Failed to update phone number' } },
+      { status: 500 }
+    );
+  }
+}

package/src/api-handlers/account/validate-password.ts

@@ -0,0 +1,118 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+interface ValidatePasswordRequest {
+  password: string;
+}
+
+interface ValidatePasswordResponse {
+  is_valid: boolean;
+  score: number;
+  failed_requirements: string[];
+  tip?: string;
+  policy?: {
+    min_length?: number;
+    require_uppercase?: boolean;
+    require_lowercase?: boolean;
+    require_digit?: boolean;
+    require_special?: boolean;
+    min_strength_score?: number;
+  };
+}
+
+export async function POST(req: NextRequest) {
+  try {
+    const body = await req.json();
+    const { password } = body as ValidatePasswordRequest;
+    const requestId = req.headers.get('x-request-id') ?? crypto.randomUUID();
+
+    // Validate input
+    if (!password || typeof password !== 'string') {
+      return NextResponse.json(
+        {
+          is_valid: false,
+          score: 0,
+          failed_requirements: ['Password is required'],
+        } as ValidatePasswordResponse,
+        {
+          status: 200, // Return 200 even for validation errors to keep UI responsive
+          headers: { 'Cache-Control': 'no-store' },
+        }
+      );
+    }
+
+    // Get IDP base URL and client ID from environment
+    const idpBaseUrl = process.env.IDP_URL;
+
+    const clientId = process.env.CLIENT_ID || process.env.NEXT_PUBLIC_CLIENT_ID;
+
+    if (!idpBaseUrl) {
+      console.error('[VALIDATE_PASSWORD] IDP_URL not configured');
+      return NextResponse.json(
+        {
+          is_valid: false,
+          score: 0,
+          failed_requirements: ['Password validation service unavailable'],
+        } as ValidatePasswordResponse,
+        {
+          status: 200,
+          headers: { 'Cache-Control': 'no-store' },
+        }
+      );
+    }
+
+    // Proxy request to IDP
+    const idpUrl = `${idpBaseUrl}/api/Account/validate-password`;
+    const payload = {
+      password,
+      client_id: clientId,
+    };
+
+    const idpResponse = await fetch(idpUrl, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'x-request-id': requestId,
+      },
+      body: JSON.stringify(payload),
+    });
+
+    const responseData = await idpResponse.json().catch(() => ({}));
+
+    if (!idpResponse.ok) {
+      console.error('[VALIDATE_PASSWORD] IDP error:', {
+        status: idpResponse.status,
+        response: responseData,
+      });
+      return NextResponse.json(
+        {
+          is_valid: false,
+          score: 0,
+          failed_requirements: ['Password validation failed'],
+        } as ValidatePasswordResponse,
+        {
+          status: 200,
+          headers: { 'Cache-Control': 'no-store' },
+        }
+      );
+    }
+
+    // Return the IDP response with proper structure
+    return NextResponse.json(responseData as ValidatePasswordResponse, {
+      status: 200,
+      headers: { 'Cache-Control': 'no-store' },
+    });
+  } catch (error) {
+    console.error('[VALIDATE_PASSWORD] Error:', error);
+    return NextResponse.json(
+      {
+        is_valid: false,
+        score: 0,
+        failed_requirements: ['Password validation failed'],
+      } as ValidatePasswordResponse,
+      {
+        status: 200,
+        headers: { 'Cache-Control': 'no-store' },
+      }
+    );
+  }
+}