@payez/next-mvp 3.2.1 → 3.2.2

package/dist/middleware/create-middleware.js

@@ -317,7 +317,8 @@ async function checkViability(request, endpoint, log) {
                 'Cache-Control': 'no-store',
                 'Cookie': request.headers.get('cookie') || ''
             },
-            credentials: 'include'
+            credentials: 'include',
+            signal: AbortSignal.timeout(5000),
         });
         if (response.ok) {
             const data = await response.json();
@@ -364,14 +365,17 @@ const RBAC_EXEMPT_PATHS = ['/error', '/unauthorized', '/service-unavailable'];
 /** Handle 'allow' decision - run RBAC if enabled */
 async function handleAllow(request, pathname, sessionPointer, sessionStatus) {
     const isPublic = (0, route_config_1.isUnauthenticatedRoute)(pathname);
-    if ((0, rbac_check_1.isRBACEnabled)() && !isPublic) {
+    if ((0, rbac_check_1.isRBACEnabled)() && !isPublic && sessionPointer.exists) {
         // Skip RBAC for error/fallback pages to prevent redirect loops
         if (RBAC_EXEMPT_PATHS.some(p => pathname.startsWith(p))) {
             return server_1.NextResponse.next();
         }
         if (!sessionPointer.clientId) {
-            console.error('[MIDDLEWARE] RBAC: No clientId');
-            return server_1.NextResponse.redirect(new URL('/error?code=no_client_id', request.url));
+            console.error('[MIDDLEWARE] RBAC: No clientId — returning 401');
+            if (pathname.startsWith('/api/')) {
+                return server_1.NextResponse.json({ error: 'Unauthorized — missing clientId for RBAC' }, { status: 401 });
+            }
+            return server_1.NextResponse.redirect(new URL('/unauthorized', request.url));
         }
         try {
             const result = await (0, rbac_check_1.checkPagePermission)(pathname, sessionPointer.roles, sessionPointer.clientId);
@@ -419,7 +423,8 @@ async function handleRefresh(request, safeCallback, opts) {
                 'x-session-token': request.cookies.get((0, app_slug_1.getSessionCookieName)())?.value ||
                     request.cookies.get((0, app_slug_1.getSecureSessionCookieName)())?.value || ''
             },
-            credentials: 'include'
+            credentials: 'include',
+            signal: AbortSignal.timeout(5000),
         });
         if (response.ok) {
             const data = await response.json();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "3.2.1",
+  "version": "3.2.2",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/middleware/create-middleware.ts

@@ -439,7 +439,8 @@ async function checkViability(
         'Cache-Control': 'no-store',
         'Cookie': request.headers.get('cookie') || ''
       },
-      credentials: 'include'
+      credentials: 'include',
+      signal: AbortSignal.timeout(5000),
     });
 
     if (response.ok) {
@@ -515,15 +516,21 @@ async function handleAllow(
 ): Promise<NextResponse> {
   const isPublic = isUnauthenticatedRoute(pathname);
 
-  if (isRBACEnabled() && !isPublic) {
+  if (isRBACEnabled() && !isPublic && sessionPointer.exists) {
     // Skip RBAC for error/fallback pages to prevent redirect loops
     if (RBAC_EXEMPT_PATHS.some(p => pathname.startsWith(p))) {
       return NextResponse.next();
     }
 
     if (!sessionPointer.clientId) {
-      console.error('[MIDDLEWARE] RBAC: No clientId');
-      return NextResponse.redirect(new URL('/error?code=no_client_id', request.url));
+      console.error('[MIDDLEWARE] RBAC: No clientId — returning 401');
+      if (pathname.startsWith('/api/')) {
+        return NextResponse.json(
+          { error: 'Unauthorized — missing clientId for RBAC' },
+          { status: 401 }
+        );
+      }
+      return NextResponse.redirect(new URL('/unauthorized', request.url));
     }
 
     try {
@@ -591,7 +598,8 @@ async function handleRefresh(
         'x-session-token': request.cookies.get(getSessionCookieName())?.value ||
                            request.cookies.get(getSecureSessionCookieName())?.value || ''
       },
-      credentials: 'include'
+      credentials: 'include',
+      signal: AbortSignal.timeout(5000),
     });
 
     if (response.ok) {