@payez/next-mvp 3.6.2 → 3.7.0

package/src/lib/idp-client-config.ts

@@ -196,6 +196,9 @@ export async function getIDPClientConfig(forceRefresh: boolean = false): Promise
     if (!clientIdStr) {
         throw new Error('[IDP_CONFIG] FATAL: CLIENT_ID or NEXT_PUBLIC_CLIENT_ID must be set');
     }
+    if (!process.env.PAYEZ_CLIENT_SECRET) {
+        throw new Error('[IDP_CONFIG] FATAL: PAYEZ_CLIENT_SECRET is required. Inject via container env or K8s Secret — never .env files.');
+    }
 
     // Start fetch and store promise so concurrent callers wait for same result
     pendingFetch = fetchConfigFromIDP(idpUrl, clientIdStr)
@@ -291,7 +294,8 @@ async function fetchConfigFromIDP(idpUrl: string, clientIdStr: string): Promise<
         issuer: clientIdStr,
         subject: clientIdStr,
         audience: 'urn:payez:externalauth:clientconfig',
-        expires_in: 60
+        expires_in: 60,
+        client_secret: process.env.PAYEZ_CLIENT_SECRET,
     };
 
     const signingResp = await fetch(signingUrl, {

package/src/lib/nextauth-secret.ts

@@ -32,6 +32,10 @@ export async function resolveNextAuthSecret(): Promise<string> {
   const clientIdStr = process.env.CLIENT_ID;
   if (!clientIdStr || clientIdStr.trim() === '') throw new Error('CLIENT_ID is required (e.g., "ideal_resume_website")');
 
+  if (!process.env.PAYEZ_CLIENT_SECRET) {
+    throw new Error('[NEXTAUTH-SECRET] FATAL: PAYEZ_CLIENT_SECRET is required. Inject via container env or K8s Secret — never .env files.');
+  }
+
   // Step 1: Request IDP to sign a client assertion (IDP has the keys, not us)
 
   const signingUrl = new URL(`${base.replace(/\/$/, '')}/api/ExternalAuth/sign-client-assertion`);
@@ -41,7 +45,8 @@ export async function resolveNextAuthSecret(): Promise<string> {
     issuer: clientIdStr,
     subject: clientIdStr,
     audience: 'urn:payez:externalauth:nextauthsecret',
-    expires_in: 60
+    expires_in: 60,
+    client_secret: process.env.PAYEZ_CLIENT_SECRET,
   };
 
   const signingResp = await fetch(signingUrl.toString(), {
@@ -87,7 +92,7 @@ export async function resolveNextAuthSecret(): Promise<string> {
       'X-Client-Id': clientIdStr,
       'X-Correlation-Id': randomUUID().replace(/-/g, ''),
     },
-    body: JSON.stringify({ client_assertion }),
+    body: JSON.stringify({ client_assertion, client_secret: process.env.PAYEZ_CLIENT_SECRET }),
     cache: 'no-store'
   } as RequestInit);