@payez/next-mvp 3.2.1 → 3.2.3

package/dist/middleware/create-middleware.d.ts

@@ -96,5 +96,7 @@ export interface MvpMiddlewareOptions {
     onRefreshFailure?: (status: number, isNetworkError: boolean) => void;
     /** Additional paths to bypass middleware (beyond /api/auth/ and /api/session/) */
     bypassPaths?: string[];
+    /** Paths exempt from RBAC checks (auth still enforced, just no page-permission check) */
+    rbacExemptPaths?: string[];
 }
 export declare function createMvpMiddleware(options?: MvpMiddlewareOptions): (request: NextRequest) => Promise<NextResponse>;

package/dist/middleware/create-middleware.js

@@ -232,6 +232,7 @@ function createMvpMiddleware(options = {}) {
     const viabilityEndpoint = options.viabilityEndpoint || '/api/session/viability';
     const refreshEndpoint = options.refreshEndpoint || '/api/auth/refresh';
     const bypassPaths = options.bypassPaths || [];
+    const rbacExemptPaths = options.rbacExemptPaths || [];
     return async function middleware(request) {
         const { pathname, searchParams } = request.nextUrl;
         // =========================================================================
@@ -287,6 +288,7 @@ function createMvpMiddleware(options = {}) {
             circuitBreaker: cb,
             logger: log,
             refreshEndpoint,
+            rbacExemptPaths,
             onRefreshSuccess: options.onRefreshSuccess,
             onRefreshFailure: options.onRefreshFailure,
         });
@@ -317,7 +319,8 @@ async function checkViability(request, endpoint, log) {
                 'Cache-Control': 'no-store',
                 'Cookie': request.headers.get('cookie') || ''
             },
-            credentials: 'include'
+            credentials: 'include',
+            signal: AbortSignal.timeout(5000),
         });
         if (response.ok) {
             const data = await response.json();
@@ -350,7 +353,7 @@ async function executeDecision(request, decision, pathname, sessionPointer, sess
     const safeCallback = getSafeCallbackUrl(pathname);
     switch (decision.type) {
         case 'allow':
-            return handleAllow(request, pathname, sessionPointer, sessionStatus);
+            return handleAllow(request, pathname, sessionPointer, sessionStatus, opts.rbacExemptPaths);
         case 'redirect':
             return redirectTo(request, decision.location, decision.clearCookies);
         case 'service_error':
@@ -362,16 +365,20 @@ async function executeDecision(request, decision, pathname, sessionPointer, sess
 /** Paths that must never be RBAC-checked (they are RBAC redirect targets) */
 const RBAC_EXEMPT_PATHS = ['/error', '/unauthorized', '/service-unavailable'];
 /** Handle 'allow' decision - run RBAC if enabled */
-async function handleAllow(request, pathname, sessionPointer, sessionStatus) {
+async function handleAllow(request, pathname, sessionPointer, sessionStatus, rbacExemptPaths = []) {
     const isPublic = (0, route_config_1.isUnauthenticatedRoute)(pathname);
-    if ((0, rbac_check_1.isRBACEnabled)() && !isPublic) {
-        // Skip RBAC for error/fallback pages to prevent redirect loops
-        if (RBAC_EXEMPT_PATHS.some(p => pathname.startsWith(p))) {
+    if ((0, rbac_check_1.isRBACEnabled)() && !isPublic && sessionPointer.exists) {
+        // Skip RBAC for error/fallback pages (prevent redirect loops) and app-configured exempt paths
+        if (RBAC_EXEMPT_PATHS.some(p => pathname.startsWith(p)) ||
+            rbacExemptPaths.some(p => pathname.startsWith(p))) {
             return server_1.NextResponse.next();
         }
         if (!sessionPointer.clientId) {
-            console.error('[MIDDLEWARE] RBAC: No clientId');
-            return server_1.NextResponse.redirect(new URL('/error?code=no_client_id', request.url));
+            console.error('[MIDDLEWARE] RBAC: No clientId — returning 401');
+            if (pathname.startsWith('/api/')) {
+                return server_1.NextResponse.json({ error: 'Unauthorized — missing clientId for RBAC' }, { status: 401 });
+            }
+            return server_1.NextResponse.redirect(new URL('/unauthorized', request.url));
         }
         try {
             const result = await (0, rbac_check_1.checkPagePermission)(pathname, sessionPointer.roles, sessionPointer.clientId);
@@ -419,7 +426,8 @@ async function handleRefresh(request, safeCallback, opts) {
                 'x-session-token': request.cookies.get((0, app_slug_1.getSessionCookieName)())?.value ||
                     request.cookies.get((0, app_slug_1.getSecureSessionCookieName)())?.value || ''
             },
-            credentials: 'include'
+            credentials: 'include',
+            signal: AbortSignal.timeout(5000),
         });
         if (response.ok) {
             const data = await response.json();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "3.2.1",
+  "version": "3.2.3",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/middleware/create-middleware.ts

@@ -108,6 +108,8 @@ export interface MvpMiddlewareOptions {
   onRefreshFailure?: (status: number, isNetworkError: boolean) => void;
   /** Additional paths to bypass middleware (beyond /api/auth/ and /api/session/) */
   bypassPaths?: string[];
+  /** Paths exempt from RBAC checks (auth still enforced, just no page-permission check) */
+  rbacExemptPaths?: string[];
 }
 
 // =============================================================================
@@ -336,6 +338,7 @@ export function createMvpMiddleware(options: MvpMiddlewareOptions = {}) {
   const viabilityEndpoint = options.viabilityEndpoint || '/api/session/viability';
   const refreshEndpoint = options.refreshEndpoint || '/api/auth/refresh';
   const bypassPaths = options.bypassPaths || [];
+  const rbacExemptPaths = options.rbacExemptPaths || [];
 
   return async function middleware(request: NextRequest): Promise<NextResponse> {
     const { pathname, searchParams } = request.nextUrl;
@@ -400,6 +403,7 @@ export function createMvpMiddleware(options: MvpMiddlewareOptions = {}) {
       circuitBreaker: cb,
       logger: log,
       refreshEndpoint,
+      rbacExemptPaths,
       onRefreshSuccess: options.onRefreshSuccess,
       onRefreshFailure: options.onRefreshFailure,
     });
@@ -439,7 +443,8 @@ async function checkViability(
         'Cache-Control': 'no-store',
         'Cookie': request.headers.get('cookie') || ''
       },
-      credentials: 'include'
+      credentials: 'include',
+      signal: AbortSignal.timeout(5000),
     });
 
     if (response.ok) {
@@ -473,6 +478,7 @@ interface ExecuteOptions {
   circuitBreaker: CircuitBreakerProvider;
   logger: MiddlewareLogger;
   refreshEndpoint: string;
+  rbacExemptPaths: string[];
   onRefreshSuccess?: () => void;
   onRefreshFailure?: (status: number, isNetworkError: boolean) => void;
 }
@@ -490,7 +496,7 @@ async function executeDecision(
 
   switch (decision.type) {
     case 'allow':
-      return handleAllow(request, pathname, sessionPointer, sessionStatus);
+      return handleAllow(request, pathname, sessionPointer, sessionStatus, opts.rbacExemptPaths);
 
     case 'redirect':
       return redirectTo(request, decision.location, decision.clearCookies);
@@ -511,19 +517,27 @@ async function handleAllow(
   request: NextRequest,
   pathname: string,
   sessionPointer: SessionPointer,
-  sessionStatus: SessionStatus
+  sessionStatus: SessionStatus,
+  rbacExemptPaths: string[] = []
 ): Promise<NextResponse> {
   const isPublic = isUnauthenticatedRoute(pathname);
 
-  if (isRBACEnabled() && !isPublic) {
-    // Skip RBAC for error/fallback pages to prevent redirect loops
-    if (RBAC_EXEMPT_PATHS.some(p => pathname.startsWith(p))) {
+  if (isRBACEnabled() && !isPublic && sessionPointer.exists) {
+    // Skip RBAC for error/fallback pages (prevent redirect loops) and app-configured exempt paths
+    if (RBAC_EXEMPT_PATHS.some(p => pathname.startsWith(p)) ||
+        rbacExemptPaths.some(p => pathname.startsWith(p))) {
       return NextResponse.next();
     }
 
     if (!sessionPointer.clientId) {
-      console.error('[MIDDLEWARE] RBAC: No clientId');
-      return NextResponse.redirect(new URL('/error?code=no_client_id', request.url));
+      console.error('[MIDDLEWARE] RBAC: No clientId — returning 401');
+      if (pathname.startsWith('/api/')) {
+        return NextResponse.json(
+          { error: 'Unauthorized — missing clientId for RBAC' },
+          { status: 401 }
+        );
+      }
+      return NextResponse.redirect(new URL('/unauthorized', request.url));
     }
 
     try {
@@ -591,7 +605,8 @@ async function handleRefresh(
         'x-session-token': request.cookies.get(getSessionCookieName())?.value ||
                            request.cookies.get(getSecureSessionCookieName())?.value || ''
       },
-      credentials: 'include'
+      credentials: 'include',
+      signal: AbortSignal.timeout(5000),
     });
 
     if (response.ok) {