@payez/next-mvp 3.6.1 → 3.7.0

package/dist/lib/idp-client-config.js

@@ -136,6 +136,9 @@ async function getIDPClientConfig(forceRefresh = false) {
     if (!clientIdStr) {
         throw new Error('[IDP_CONFIG] FATAL: CLIENT_ID or NEXT_PUBLIC_CLIENT_ID must be set');
     }
+    if (!process.env.PAYEZ_CLIENT_SECRET) {
+        throw new Error('[IDP_CONFIG] FATAL: PAYEZ_CLIENT_SECRET is required. Inject via container env or K8s Secret — never .env files.');
+    }
     // Start fetch and store promise so concurrent callers wait for same result
     pendingFetch = fetchConfigFromIDP(idpUrl, clientIdStr)
         .then(async (config) => {
@@ -219,7 +222,8 @@ async function fetchConfigFromIDP(idpUrl, clientIdStr) {
             issuer: clientIdStr,
             subject: clientIdStr,
             audience: 'urn:payez:externalauth:clientconfig',
-            expires_in: 60
+            expires_in: 60,
+            client_secret: process.env.PAYEZ_CLIENT_SECRET,
         };
         const signingResp = await fetch(signingUrl, {
             method: 'POST',

package/dist/lib/nextauth-secret.js

@@ -31,6 +31,9 @@ async function resolveNextAuthSecret() {
     const clientIdStr = process.env.CLIENT_ID;
     if (!clientIdStr || clientIdStr.trim() === '')
         throw new Error('CLIENT_ID is required (e.g., "ideal_resume_website")');
+    if (!process.env.PAYEZ_CLIENT_SECRET) {
+        throw new Error('[NEXTAUTH-SECRET] FATAL: PAYEZ_CLIENT_SECRET is required. Inject via container env or K8s Secret — never .env files.');
+    }
     // Step 1: Request IDP to sign a client assertion (IDP has the keys, not us)
     const signingUrl = new URL(`${base.replace(/\/$/, '')}/api/ExternalAuth/sign-client-assertion`);
     // Client ID passed via X-Client-Id header, not query string
@@ -38,7 +41,8 @@ async function resolveNextAuthSecret() {
         issuer: clientIdStr,
         subject: clientIdStr,
         audience: 'urn:payez:externalauth:nextauthsecret',
-        expires_in: 60
+        expires_in: 60,
+        client_secret: process.env.PAYEZ_CLIENT_SECRET,
     };
     const signingResp = await fetch(signingUrl.toString(), {
         method: 'POST',
@@ -75,7 +79,7 @@ async function resolveNextAuthSecret() {
             'X-Client-Id': clientIdStr,
             'X-Correlation-Id': (0, crypto_1.randomUUID)().replace(/-/g, ''),
         },
-        body: JSON.stringify({ client_assertion }),
+        body: JSON.stringify({ client_assertion, client_secret: process.env.PAYEZ_CLIENT_SECRET }),
         cache: 'no-store'
     });
     if (!proxyResp.ok) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "3.6.1",
+  "version": "3.7.0",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/lib/idp-client-config.ts

@@ -196,6 +196,9 @@ export async function getIDPClientConfig(forceRefresh: boolean = false): Promise
     if (!clientIdStr) {
         throw new Error('[IDP_CONFIG] FATAL: CLIENT_ID or NEXT_PUBLIC_CLIENT_ID must be set');
     }
+    if (!process.env.PAYEZ_CLIENT_SECRET) {
+        throw new Error('[IDP_CONFIG] FATAL: PAYEZ_CLIENT_SECRET is required. Inject via container env or K8s Secret — never .env files.');
+    }
 
     // Start fetch and store promise so concurrent callers wait for same result
     pendingFetch = fetchConfigFromIDP(idpUrl, clientIdStr)
@@ -291,7 +294,8 @@ async function fetchConfigFromIDP(idpUrl: string, clientIdStr: string): Promise<
         issuer: clientIdStr,
         subject: clientIdStr,
         audience: 'urn:payez:externalauth:clientconfig',
-        expires_in: 60
+        expires_in: 60,
+        client_secret: process.env.PAYEZ_CLIENT_SECRET,
     };
 
     const signingResp = await fetch(signingUrl, {

package/src/lib/nextauth-secret.ts

@@ -32,6 +32,10 @@ export async function resolveNextAuthSecret(): Promise<string> {
   const clientIdStr = process.env.CLIENT_ID;
   if (!clientIdStr || clientIdStr.trim() === '') throw new Error('CLIENT_ID is required (e.g., "ideal_resume_website")');
 
+  if (!process.env.PAYEZ_CLIENT_SECRET) {
+    throw new Error('[NEXTAUTH-SECRET] FATAL: PAYEZ_CLIENT_SECRET is required. Inject via container env or K8s Secret — never .env files.');
+  }
+
   // Step 1: Request IDP to sign a client assertion (IDP has the keys, not us)
 
   const signingUrl = new URL(`${base.replace(/\/$/, '')}/api/ExternalAuth/sign-client-assertion`);
@@ -41,7 +45,8 @@ export async function resolveNextAuthSecret(): Promise<string> {
     issuer: clientIdStr,
     subject: clientIdStr,
     audience: 'urn:payez:externalauth:nextauthsecret',
-    expires_in: 60
+    expires_in: 60,
+    client_secret: process.env.PAYEZ_CLIENT_SECRET,
   };
 
   const signingResp = await fetch(signingUrl.toString(), {
@@ -87,7 +92,7 @@ export async function resolveNextAuthSecret(): Promise<string> {
       'X-Client-Id': clientIdStr,
       'X-Correlation-Id': randomUUID().replace(/-/g, ''),
     },
-    body: JSON.stringify({ client_assertion }),
+    body: JSON.stringify({ client_assertion, client_secret: process.env.PAYEZ_CLIENT_SECRET }),
     cache: 'no-store'
   } as RequestInit);