@payez/next-mvp 3.9.0 → 4.0.0

package/dist/api-handlers/auth/verify-code.js

@@ -1,94 +1,90 @@
-"use strict";
-/**
- * Authentication Verify Code / Complete 2FA API Handler
- *
- * Handles 2FA verification and token updates after successful verification.
- * This handler is designed to be imported and used by Next.js applications
- * using the @payez/next-mvp package.
- *
- * @version 2.0
- * @requires Authentication (authenticated endpoint)
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.POST = void 0;
-exports.createVerifyCodeHandler = createVerifyCodeHandler;
-const server_1 = require("next/server");
-const jwt_1 = require("next-auth/jwt");
-const session_store_1 = require("../../lib/session-store");
-const app_slug_1 = require("../../lib/app-slug");
-/**
- * Creates a verify-code/complete-2FA handler for Next.js API routes
- *
- * @param config Configuration for NextAuth
- * @returns Next.js POST handler function
- *
- * @example
- * ```typescript
- * // In your app's /app/api/auth/verify-code/route.ts
- * import { createVerifyCodeHandler } from '@payez/next-mvp/api-handlers/auth/verify-code';
- *
- * export const POST = createVerifyCodeHandler({
- *   nextAuthSecret: process.env.NEXTAUTH_SECRET!
- * });
- * ```
- */
-function createVerifyCodeHandler(config) {
-    const { nextAuthSecret } = config;
-    return async function POST(req) {
-        try {
-            let body;
-            try {
-                body = await req.json();
-            }
-            catch (parseError) {
-                return server_1.NextResponse.json({ success: false, message: 'Invalid JSON format' }, { status: 400 });
-            }
-            const { accessToken, refreshToken, accessTokenExpires, refreshTokenExpires } = body;
-            // Get current session token from JWT
-            let token = await (0, jwt_1.getToken)({ req, secret: nextAuthSecret, cookieName: (0, app_slug_1.getJwtCookieName)() });
-            // The sessionToken is stored in the JWT token object
-            // Support both field names: sessionToken (auth.ts JWT) and redisSessionId (legacy)
-            const sessionToken = (token?.sessionToken || token?.redisSessionId);
-            if (!sessionToken) {
-                console.error('[VERIFY-CODE] No session token found in JWT', {
-                    hasToken: !!token,
-                    tokenKeys: token ? Object.keys(token) : []
-                });
-                return server_1.NextResponse.json({ success: false, message: 'No session found' }, { status: 401 });
-            }
-            console.info('[VERIFY-CODE] Updating session with new tokens after 2FA', {
-                sessionToken: sessionToken.substring(0, 8) + '...',
-                userId: token?.sub,
-                hasAccessToken: !!accessToken,
-                hasRefreshToken: !!refreshToken,
-                accessTokenLength: accessToken?.length,
-                refreshTokenLength: refreshToken?.length
-            });
-            // Update tokens in Redis
-            await (0, session_store_1.updateTokens)(sessionToken, accessToken, refreshToken, accessTokenExpires, refreshTokenExpires);
-            // Mark 2FA as complete
-            await (0, session_store_1.mark2FAComplete)(sessionToken);
-            console.info('[VERIFY-CODE] 2FA completion successful', {
-                sessionToken: sessionToken.substring(0, 8) + '...',
-                userId: token?.sub
-            });
-            return server_1.NextResponse.json({
-                success: true,
-                message: '2FA verification complete'
-            });
-        }
-        catch (error) {
-            console.error('[VERIFY-CODE] Failed to complete 2FA', {
-                error: error instanceof Error ? error.message : String(error)
-            });
-            return server_1.NextResponse.json({ success: false, message: 'Failed to complete 2FA' }, { status: 500 });
-        }
-    };
-}
-/**
- * Default export for backward compatibility
- * Requires environment variable: NEXTAUTH_SECRET
- */
-exports.POST = createVerifyCodeHandler({
-    nextAuthSecret: process.env.NEXTAUTH_SECRET || ''
-});
+"use strict";
+/**
+ * Authentication Verify Code / Complete 2FA API Handler
+ *
+ * Handles 2FA verification and token updates after successful verification.
+ * This handler is designed to be imported and used by Next.js applications
+ * using the @payez/next-mvp package.
+ *
+ * @version 2.0
+ * @requires Authentication (authenticated endpoint)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = void 0;
+exports.createVerifyCodeHandler = createVerifyCodeHandler;
+const server_1 = require("next/server");
+const auth_1 = require("../../server/auth");
+const session_store_1 = require("../../lib/session-store");
+/**
+ * Creates a verify-code/complete-2FA handler for Next.js API routes
+ *
+ * @param config Configuration for NextAuth
+ * @returns Next.js POST handler function
+ *
+ * @example
+ * ```typescript
+ * // In your app's /app/api/auth/verify-code/route.ts
+ * import { createVerifyCodeHandler } from '@payez/next-mvp/api-handlers/auth/verify-code';
+ *
+ * export const POST = createVerifyCodeHandler({
+ *   nextAuthSecret: process.env.NEXTAUTH_SECRET!
+ * });
+ * ```
+ */
+function createVerifyCodeHandler(config) {
+    const { nextAuthSecret } = config;
+    return async function POST(req) {
+        try {
+            let body;
+            try {
+                body = await req.json();
+            }
+            catch (parseError) {
+                return server_1.NextResponse.json({ success: false, message: 'Invalid JSON format' }, { status: 400 });
+            }
+            const { accessToken, refreshToken, accessTokenExpires, refreshTokenExpires } = body;
+            // Get current session from Better Auth
+            const betterAuthSession = await (0, auth_1.getSession)(req);
+            const sessionToken = betterAuthSession?.session?.token;
+            if (!sessionToken) {
+                console.error('[VERIFY-CODE] No session token found', {
+                    hasSession: !!betterAuthSession,
+                });
+                return server_1.NextResponse.json({ success: false, message: 'No session found' }, { status: 401 });
+            }
+            console.info('[VERIFY-CODE] Updating session with new tokens after 2FA', {
+                sessionToken: sessionToken.substring(0, 8) + '...',
+                userId: betterAuthSession?.user?.id,
+                hasAccessToken: !!accessToken,
+                hasRefreshToken: !!refreshToken,
+                accessTokenLength: accessToken?.length,
+                refreshTokenLength: refreshToken?.length
+            });
+            // Update tokens in Redis
+            await (0, session_store_1.updateTokens)(sessionToken, accessToken, refreshToken, accessTokenExpires, refreshTokenExpires);
+            // Mark 2FA as complete
+            await (0, session_store_1.mark2FAComplete)(sessionToken);
+            console.info('[VERIFY-CODE] 2FA completion successful', {
+                sessionToken: sessionToken.substring(0, 8) + '...',
+                userId: betterAuthSession?.user?.id
+            });
+            return server_1.NextResponse.json({
+                success: true,
+                message: '2FA verification complete'
+            });
+        }
+        catch (error) {
+            console.error('[VERIFY-CODE] Failed to complete 2FA', {
+                error: error instanceof Error ? error.message : String(error)
+            });
+            return server_1.NextResponse.json({ success: false, message: 'Failed to complete 2FA' }, { status: 500 });
+        }
+    };
+}
+/**
+ * Default export for backward compatibility
+ * Requires environment variable: NEXTAUTH_SECRET
+ */
+exports.POST = createVerifyCodeHandler({
+    nextAuthSecret: process.env.NEXTAUTH_SECRET || ''
+});

package/dist/api-handlers/session/viability.js

@@ -1,146 +1,114 @@
-"use strict";
-/**
- * Session Viability Check API Handler for `@payez/next-mvp`
- *
- * This API route is called by the middleware to securely check if a session is valid.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.GET = GET;
-const server_1 = require("next/server");
-const session_store_1 = require("../../lib/session-store");
-const jwt_1 = require("next-auth/jwt");
-const startup_init_1 = require("../../lib/startup-init");
-const app_slug_1 = require("../../lib/app-slug");
-const idp_client_config_1 = require("../../lib/idp-client-config");
-/**
- * Get NextAuth secret from IDP config (cached).
- * NEVER use process.env.NEXTAUTH_SECRET directly - it may not be set.
- */
-async function getNextAuthSecret() {
-    const config = await (0, idp_client_config_1.getIDPClientConfig)();
-    return config.nextAuthSecret || '';
-}
-async function GET(req) {
-    try {
-        // Ensure initialization is complete
-        if (!process.env.NEXTAUTH_SECRET) {
-            try {
-                await (0, startup_init_1.ensureInitialized)();
-            }
-            catch (error) {
-                // Initialization failed - return 503
-                console.error('[API Viability] Initialization failed - returning 503');
-                return server_1.NextResponse.json({
-                    error: 'Service Unavailable',
-                    message: 'Authentication service is not properly configured',
-                    code: 'AUTH_NOT_INITIALIZED'
-                }, { status: 503 });
-            }
-        }
-        // Double-check after initialization attempt
-        if ((0, startup_init_1.isInitializationFailed)()) {
-            console.error('[API Viability] Initialization failed - returning 503');
-            return server_1.NextResponse.json({
-                error: 'Service Unavailable',
-                message: 'Authentication service is not properly configured',
-                code: 'AUTH_NOT_INITIALIZED'
-            }, { status: 503 });
-        }
-        // Get secret from IDP config (same source as session.ts and token-lifecycle.ts)
-        const secret = await getNextAuthSecret();
-        if (!secret) {
-            console.error('[API Viability] NEXTAUTH_SECRET not available from IDP config');
-            return server_1.NextResponse.json({
-                error: 'Service Unavailable',
-                message: 'Authentication service is not properly configured',
-                code: 'AUTH_NOT_INITIALIZED'
-            }, { status: 503 });
-        }
-        // getToken is the recommended way to get the JWT from a request
-        const cookieName = (0, app_slug_1.getJwtCookieName)();
-        const token = await (0, jwt_1.getToken)({ req, secret, cookieName });
-        // Debug logging to diagnose AKS-specific issues
-        if (!token) {
-            const cookieHeader = req.headers.get('cookie') || '';
-            const hasCookie = cookieHeader.includes(cookieName);
-            const cookieMatch = cookieHeader.match(new RegExp(`${cookieName}=([^;]*)`));
-            const cookieValue = cookieMatch ? cookieMatch[1] : null;
-            console.warn('[VIABILITY] getToken returned null:', {
-                cookieName,
-                hasCookie,
-                cookieValueLength: cookieValue?.length || 0,
-                cookieValuePreview: cookieValue ? cookieValue.substring(0, 30) + '...' : 'EMPTY',
-                secretLength: secret.length,
-                secretPreview: secret ? secret.substring(0, 10) + '...' : 'EMPTY',
-            });
-        }
-        // Support both field names: sessionToken (auth.ts JWT) and redisSessionId (legacy)
-        const sessionToken = (token?.sessionToken || token?.redisSessionId);
-        if (token && sessionToken) {
-            const sessionData = await (0, session_store_1.getSession)(sessionToken);
-            if (sessionData) {
-                // The session exists in Redis
-                // Check if access token is expired (for middleware decision-making)
-                const accessTokenExpires = sessionData.idpAccessTokenExpires || 0;
-                const accessTokenExpired = accessTokenExpires < Date.now();
-                // Get requires2FA from cached client config (not session)
-                // This is a client-wide setting from the broker handshake
-                let requires2FA = true; // Default to true for security
-                try {
-                    const cachedConfig = await (0, idp_client_config_1.getIDPClientConfig)();
-                    requires2FA = cachedConfig.authSettings?.require2FA ?? true;
-                }
-                catch (e) {
-                    console.warn('[API Viability] Could not get client config, defaulting requires2FA to true');
-                }
-                // CRITICAL: Check if MFA has expired (2FA TTL enforcement)
-                // The session may have mfaVerified=true from days ago, but if mfaExpiresAt
-                // has passed, we must treat 2FA as incomplete to force re-verification.
-                const mfaExpiresAt = sessionData.mfaExpiresAt || 0;
-                const mfaExpired = mfaExpiresAt > 0 && mfaExpiresAt < Date.now();
-                // Check both field names for compatibility (mfaVerified is the normalized name)
-                const sessionMfaComplete = sessionData.mfaVerified ?? sessionData.twoFactorComplete ?? false;
-                const effectiveTwoFactorComplete = sessionMfaComplete && !mfaExpired;
-                console.log('[VIABILITY] Session 2FA check:', {
-                    sessionToken: sessionToken.substring(0, 8) + '...',
-                    mfaVerified: sessionData.mfaVerified,
-                    twoFactorComplete: sessionData.twoFactorComplete,
-                    sessionMfaComplete,
-                    mfaExpired,
-                    effectiveTwoFactorComplete,
-                });
-                if (mfaExpired && sessionMfaComplete) {
-                    console.warn('[API Viability] MFA expired - forcing 2FA re-verification', {
-                        mfaExpiresAt: new Date(mfaExpiresAt).toISOString(),
-                        now: new Date().toISOString(),
-                        hoursExpiredAgo: ((Date.now() - mfaExpiresAt) / (1000 * 60 * 60)).toFixed(1)
-                    });
-                }
-                const response = {
-                    authenticated: true,
-                    sessionToken, // Include token for middleware tracking
-                    // 2FA fields - critical for middleware redirect logic
-                    requires2FA, // From cached client config (client-wide setting)
-                    twoFactorComplete: effectiveTwoFactorComplete, // From session, BUT respects MFA TTL
-                    // Token status for refresh decisions
-                    accessTokenExpired,
-                    hasRefreshToken: !!sessionData.idpRefreshToken
-                };
-                return server_1.NextResponse.json(response);
-            }
-            // CRITICAL: Cookie exists but Redis session is missing (stale cookie state)
-            // Return sessionToken so middleware can detect this and clear the stale cookie
-            console.warn('[VIABILITY] Stale cookie detected - session not in Redis');
-            return server_1.NextResponse.json({
-                authenticated: false,
-                sessionToken // Include token to enable stale cookie detection
-            });
-        }
-        // If there's no token at all, it's not authenticated
-        return server_1.NextResponse.json({ authenticated: false });
-    }
-    catch (error) {
-        console.error('[API Viability] Error checking session viability:', error);
-        return server_1.NextResponse.json({ authenticated: false }, { status: 500 });
-    }
-}
+"use strict";
+/**
+ * Session Viability Check API Handler for `@payez/next-mvp`
+ *
+ * This API route is called by the middleware to securely check if a session is valid.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GET = GET;
+const server_1 = require("next/server");
+const session_store_1 = require("../../lib/session-store");
+const auth_1 = require("../../server/auth");
+const startup_init_1 = require("../../lib/startup-init");
+const idp_client_config_1 = require("../../lib/idp-client-config");
+async function GET(req) {
+    try {
+        // Ensure initialization is complete
+        if (!process.env.NEXTAUTH_SECRET) {
+            try {
+                await (0, startup_init_1.ensureInitialized)();
+            }
+            catch (error) {
+                // Initialization failed - return 503
+                console.error('[API Viability] Initialization failed - returning 503');
+                return server_1.NextResponse.json({
+                    error: 'Service Unavailable',
+                    message: 'Authentication service is not properly configured',
+                    code: 'AUTH_NOT_INITIALIZED'
+                }, { status: 503 });
+            }
+        }
+        // Double-check after initialization attempt
+        if ((0, startup_init_1.isInitializationFailed)()) {
+            console.error('[API Viability] Initialization failed - returning 503');
+            return server_1.NextResponse.json({
+                error: 'Service Unavailable',
+                message: 'Authentication service is not properly configured',
+                code: 'AUTH_NOT_INITIALIZED'
+            }, { status: 503 });
+        }
+        // Get session from Better Auth
+        const betterAuthSession = await (0, auth_1.getSession)(req);
+        // Debug logging
+        if (!betterAuthSession) {
+            console.warn('[VIABILITY] getSession returned null');
+        }
+        const sessionToken = betterAuthSession?.session?.token;
+        if (betterAuthSession && sessionToken) {
+            const sessionData = await (0, session_store_1.getSession)(sessionToken);
+            if (sessionData) {
+                // The session exists in Redis
+                // Check if access token is expired (for middleware decision-making)
+                const accessTokenExpires = sessionData.idpAccessTokenExpires || 0;
+                const accessTokenExpired = accessTokenExpires < Date.now();
+                // Get requires2FA from cached client config (not session)
+                // This is a client-wide setting from the broker handshake
+                let requires2FA = true; // Default to true for security
+                try {
+                    const cachedConfig = await (0, idp_client_config_1.getIDPClientConfig)();
+                    requires2FA = cachedConfig.authSettings?.require2FA ?? true;
+                }
+                catch (e) {
+                    console.warn('[API Viability] Could not get client config, defaulting requires2FA to true');
+                }
+                // CRITICAL: Check if MFA has expired (2FA TTL enforcement)
+                // The session may have mfaVerified=true from days ago, but if mfaExpiresAt
+                // has passed, we must treat 2FA as incomplete to force re-verification.
+                const mfaExpiresAt = sessionData.mfaExpiresAt || 0;
+                const mfaExpired = mfaExpiresAt > 0 && mfaExpiresAt < Date.now();
+                // Check both field names for compatibility (mfaVerified is the normalized name)
+                const sessionMfaComplete = sessionData.mfaVerified ?? sessionData.twoFactorComplete ?? false;
+                const effectiveTwoFactorComplete = sessionMfaComplete && !mfaExpired;
+                console.log('[VIABILITY] Session 2FA check:', {
+                    sessionToken: sessionToken.substring(0, 8) + '...',
+                    mfaVerified: sessionData.mfaVerified,
+                    twoFactorComplete: sessionData.twoFactorComplete,
+                    sessionMfaComplete,
+                    mfaExpired,
+                    effectiveTwoFactorComplete,
+                });
+                if (mfaExpired && sessionMfaComplete) {
+                    console.warn('[API Viability] MFA expired - forcing 2FA re-verification', {
+                        mfaExpiresAt: new Date(mfaExpiresAt).toISOString(),
+                        now: new Date().toISOString(),
+                        hoursExpiredAgo: ((Date.now() - mfaExpiresAt) / (1000 * 60 * 60)).toFixed(1)
+                    });
+                }
+                const response = {
+                    authenticated: true,
+                    sessionToken, // Include token for middleware tracking
+                    // 2FA fields - critical for middleware redirect logic
+                    requires2FA, // From cached client config (client-wide setting)
+                    twoFactorComplete: effectiveTwoFactorComplete, // From session, BUT respects MFA TTL
+                    // Token status for refresh decisions
+                    accessTokenExpired,
+                    hasRefreshToken: !!sessionData.idpRefreshToken
+                };
+                return server_1.NextResponse.json(response);
+            }
+            // CRITICAL: Cookie exists but Redis session is missing (stale cookie state)
+            // Return sessionToken so middleware can detect this and clear the stale cookie
+            console.warn('[VIABILITY] Stale cookie detected - session not in Redis');
+            return server_1.NextResponse.json({
+                authenticated: false,
+                sessionToken // Include token to enable stale cookie detection
+            });
+        }
+        // If there's no token at all, it's not authenticated
+        return server_1.NextResponse.json({ authenticated: false });
+    }
+    catch (error) {
+        console.error('[API Viability] Error checking session viability:', error);
+        return server_1.NextResponse.json({ authenticated: false }, { status: 500 });
+    }
+}

package/dist/api-handlers/test/force-expire.js

@@ -1,65 +1,59 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.POST = void 0;
-const server_1 = require("next/server");
-const jwt_1 = require("next-auth/jwt");
-const session_store_1 = require("../../lib/session-store");
-const app_slug_1 = require("../../lib/app-slug");
-/**
- * Force-expire access token for testing refresh flow.
- *
- * Sets the access token expiry to 2 minutes in the past,
- * which will trigger a refresh on the next API call.
- *
- * Usage in consuming app:
- * ```typescript
- * // app/api/test/force-expire/route.ts
- * export { POST } from '@payez/next-mvp/api-handlers/test/force-expire';
- * ```
- */
-const POST = async (req) => {
-    try {
-        const secret = process.env.NEXTAUTH_SECRET;
-        if (!secret) {
-            return server_1.NextResponse.json({ success: false, error: 'NEXTAUTH_SECRET not configured' }, { status: 500 });
-        }
-        const cookieName = (0, app_slug_1.getJwtCookieName)();
-        const token = await (0, jwt_1.getToken)({ req, secret, cookieName });
-        let sessionToken = token?.redisSessionId;
-        if (!sessionToken) {
-            const headerSessionToken = req.headers.get('x-session-token') || req.headers.get('X-Session-Token');
-            if (headerSessionToken) {
-                sessionToken = headerSessionToken;
-            }
-            else {
-                console.warn('[TEST_EXPIRE] No session token in JWT cookie or X-Session-Token header');
-                return server_1.NextResponse.json({ success: false, error: 'No session token' }, { status: 401 });
-            }
-        }
-        const session = await (0, session_store_1.getSession)(sessionToken);
-        if (!session) {
-            return server_1.NextResponse.json({ success: false, error: 'Session not found' }, { status: 404 });
-        }
-        const now = Date.now();
-        const forced = now - (2 * 60 * 1000); // two minutes ago
-        const prev = session.idpAccessTokenExpires || null;
-        await (0, session_store_1.updateSession)(sessionToken, { idpAccessTokenExpires: forced });
-        console.log('[TEST_EXPIRE] Forced access token expiry for session', {
-            sessionToken: sessionToken.substring(0, 8) + '...',
-            previous: prev ? new Date(prev).toISOString() : null,
-            newExpiry: new Date(forced).toISOString()
-        });
-        return server_1.NextResponse.json({
-            success: true,
-            previous: prev,
-            previousIso: prev ? new Date(prev).toISOString() : null,
-            newExpiry: forced,
-            newExpiryIso: new Date(forced).toISOString()
-        });
-    }
-    catch (e) {
-        console.error('[TEST_EXPIRE] Error:', e);
-        return server_1.NextResponse.json({ success: false, error: e instanceof Error ? e.message : String(e) }, { status: 500 });
-    }
-};
-exports.POST = POST;
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = void 0;
+const server_1 = require("next/server");
+const auth_1 = require("../../server/auth");
+const session_store_1 = require("../../lib/session-store");
+/**
+ * Force-expire access token for testing refresh flow.
+ *
+ * Sets the access token expiry to 2 minutes in the past,
+ * which will trigger a refresh on the next API call.
+ *
+ * Usage in consuming app:
+ * ```typescript
+ * // app/api/test/force-expire/route.ts
+ * export { POST } from '@payez/next-mvp/api-handlers/test/force-expire';
+ * ```
+ */
+const POST = async (req) => {
+    try {
+        const betterAuthSession = await (0, auth_1.getSession)(req);
+        let sessionToken = betterAuthSession?.session?.token;
+        if (!sessionToken) {
+            const headerSessionToken = req.headers.get('x-session-token') || req.headers.get('X-Session-Token');
+            if (headerSessionToken) {
+                sessionToken = headerSessionToken;
+            }
+            else {
+                console.warn('[TEST_EXPIRE] No session token or X-Session-Token header');
+                return server_1.NextResponse.json({ success: false, error: 'No session token' }, { status: 401 });
+            }
+        }
+        const session = await (0, session_store_1.getSession)(sessionToken);
+        if (!session) {
+            return server_1.NextResponse.json({ success: false, error: 'Session not found' }, { status: 404 });
+        }
+        const now = Date.now();
+        const forced = now - (2 * 60 * 1000); // two minutes ago
+        const prev = session.idpAccessTokenExpires || null;
+        await (0, session_store_1.updateSession)(sessionToken, { idpAccessTokenExpires: forced });
+        console.log('[TEST_EXPIRE] Forced access token expiry for session', {
+            sessionToken: sessionToken.substring(0, 8) + '...',
+            previous: prev ? new Date(prev).toISOString() : null,
+            newExpiry: new Date(forced).toISOString()
+        });
+        return server_1.NextResponse.json({
+            success: true,
+            previous: prev,
+            previousIso: prev ? new Date(prev).toISOString() : null,
+            newExpiry: forced,
+            newExpiryIso: new Date(forced).toISOString()
+        });
+    }
+    catch (e) {
+        console.error('[TEST_EXPIRE] Error:', e);
+        return server_1.NextResponse.json({ success: false, error: e instanceof Error ? e.message : String(e) }, { status: 500 });
+    }
+};
+exports.POST = POST;