@payez/next-mvp 3.9.1 → 4.0.1

package/src/api-handlers/auth/update-session.ts

@@ -1,125 +1,123 @@
-/**
- * Authentication Update Session API Handler
- *
- * Handles session updates, particularly for 2FA status changes.
- * This handler is designed to be imported and used by Next.js applications
- * using the @payez/next-mvp package.
- *
- * @version 2.0
- * @requires Authentication (authenticated endpoint)
- */
-
-import { NextRequest, NextResponse } from 'next/server';
-import { getToken } from 'next-auth/jwt';
-import { getJwtCookieName } from '../../lib/app-slug';
-
-// Add protection headers to all responses
-function addSecurityHeaders(response: NextResponse) {
-  response.headers.set('Content-Security-Policy', "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';");
-  response.headers.set('X-Frame-Options', 'DENY');
-  response.headers.set('X-Content-Type-Options', 'nosniff');
-  response.headers.set('X-XSS-Protection', '1; mode=block');
-  response.headers.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains; preload');
-  response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
-  response.headers.set('Permissions-Policy', 'geolocation=(), microphone=(), camera=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()');
-  response.headers.set('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
-  response.headers.set('Pragma', 'no-cache');
-  response.headers.set('Expires', '0');
-  return response;
-}
-
-interface UpdateSessionRequest {
-  twoFactorSessionVerified?: boolean;
-  twoFactorMethod?: string;
-}
-
-interface UpdateSessionResponse {
-  success: boolean;
-  twoFactorSessionVerified: boolean;
-  twoFactorMethod?: string;
-}
-
-interface UpdateSessionConfig {
-  nextAuthSecret: string;
-}
-
-/**
- * Creates an update-session handler for Next.js API routes
- *
- * @param config Configuration for NextAuth
- * @returns Next.js POST handler function
- *
- * @example
- * ```typescript
- * // In your app's /app/api/auth/update-session/route.ts
- * import { createUpdateSessionHandler } from '@payez/next-mvp/api-handlers/auth/update-session';
- *
- * export const POST = createUpdateSessionHandler({
- *   nextAuthSecret: process.env.NEXTAUTH_SECRET!
- * });
- * ```
- */
-export function createUpdateSessionHandler(config: UpdateSessionConfig) {
-  const { nextAuthSecret } = config;
-
-  return async function POST(req: NextRequest) {
-    try {
-      let body: UpdateSessionRequest;
-
-      try {
-        body = await req.json();
-      } catch (parseError) {
-        return addSecurityHeaders(NextResponse.json(
-          { error: 'Invalid JSON format' },
-          { status: 400 }
-        ));
-      }
-
-      const { twoFactorSessionVerified, twoFactorMethod } = body;
-
-      // Get the current token
-      const token = await getToken({ req, secret: nextAuthSecret, cookieName: getJwtCookieName() });
-      if (!token) {
-        return addSecurityHeaders(NextResponse.json(
-          { error: 'No session token available' },
-          { status: 401 }
-        ));
-      }
-
-      // Update the token with 2FA challenge completion status
-      const updatedToken = {
-        ...token,
-        twoFactorSessionVerified: !!twoFactorSessionVerified,
-        twoFactorMethod: twoFactorMethod || token.twoFactorMethod
-      };
-
-      console.info('[UPDATE-SESSION] Session updated successfully', {
-        userId: token.sub,
-        twoFactorSessionVerified: updatedToken.twoFactorSessionVerified,
-        twoFactorMethod: updatedToken.twoFactorMethod
-      });
-
-      const responseData: UpdateSessionResponse = {
-        success: true,
-        twoFactorSessionVerified: updatedToken.twoFactorSessionVerified as boolean,
-        twoFactorMethod: updatedToken.twoFactorMethod as string | undefined
-      };
-
-      return addSecurityHeaders(NextResponse.json(responseData));
-    } catch (error) {
-      console.error('[UPDATE-SESSION] Error updating session', { error });
-      return addSecurityHeaders(NextResponse.json(
-        { error: 'Failed to update session' },
-        { status: 500 }
-      ));
-    }
-  };
-}
-
-/**
- * Default export for backward compatibility
- * Requires environment variable: NEXTAUTH_SECRET
- */
-export const POST = createUpdateSessionHandler({
-  nextAuthSecret: process.env.NEXTAUTH_SECRET || ''
-});
+/**
+ * Authentication Update Session API Handler
+ *
+ * Handles session updates, particularly for 2FA status changes.
+ * This handler is designed to be imported and used by Next.js applications
+ * using the @payez/next-mvp package.
+ *
+ * @version 2.0
+ * @requires Authentication (authenticated endpoint)
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { getSession } from '../../server/auth';
+
+// Add protection headers to all responses
+function addSecurityHeaders(response: NextResponse) {
+  response.headers.set('Content-Security-Policy', "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';");
+  response.headers.set('X-Frame-Options', 'DENY');
+  response.headers.set('X-Content-Type-Options', 'nosniff');
+  response.headers.set('X-XSS-Protection', '1; mode=block');
+  response.headers.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains; preload');
+  response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
+  response.headers.set('Permissions-Policy', 'geolocation=(), microphone=(), camera=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()');
+  response.headers.set('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
+  response.headers.set('Pragma', 'no-cache');
+  response.headers.set('Expires', '0');
+  return response;
+}
+
+interface UpdateSessionRequest {
+  twoFactorSessionVerified?: boolean;
+  twoFactorMethod?: string;
+}
+
+interface UpdateSessionResponse {
+  success: boolean;
+  twoFactorSessionVerified: boolean;
+  twoFactorMethod?: string;
+}
+
+interface UpdateSessionConfig {
+  nextAuthSecret?: string; // Legacy - no longer used by Better Auth
+}
+
+/**
+ * Creates an update-session handler for Next.js API routes
+ *
+ * @param config Configuration for NextAuth
+ * @returns Next.js POST handler function
+ *
+ * @example
+ * ```typescript
+ * // In your app's /app/api/auth/update-session/route.ts
+ * import { createUpdateSessionHandler } from '@payez/next-mvp/api-handlers/auth/update-session';
+ *
+ * export const POST = createUpdateSessionHandler({
+ *   nextAuthSecret: process.env.NEXTAUTH_SECRET!
+ * });
+ * ```
+ */
+export function createUpdateSessionHandler(config: UpdateSessionConfig) {
+  const { nextAuthSecret } = config;
+
+  return async function POST(req: NextRequest) {
+    try {
+      let body: UpdateSessionRequest;
+
+      try {
+        body = await req.json();
+      } catch (parseError) {
+        return addSecurityHeaders(NextResponse.json(
+          { error: 'Invalid JSON format' },
+          { status: 400 }
+        ));
+      }
+
+      const { twoFactorSessionVerified, twoFactorMethod } = body;
+
+      // Get the current session from Better Auth
+      const session = await getSession(req);
+      if (!session) {
+        return addSecurityHeaders(NextResponse.json(
+          { error: 'No session token available' },
+          { status: 401 }
+        ));
+      }
+
+      // Update the session with 2FA challenge completion status
+      const updatedSession = {
+        twoFactorSessionVerified: !!twoFactorSessionVerified,
+        twoFactorMethod: twoFactorMethod || (session as any).twoFactorMethod
+      };
+
+      console.info('[UPDATE-SESSION] Session updated successfully', {
+        userId: session.user?.id,
+        twoFactorSessionVerified: updatedSession.twoFactorSessionVerified,
+        twoFactorMethod: updatedSession.twoFactorMethod
+      });
+
+      const responseData: UpdateSessionResponse = {
+        success: true,
+        twoFactorSessionVerified: updatedSession.twoFactorSessionVerified as boolean,
+        twoFactorMethod: updatedSession.twoFactorMethod as string | undefined
+      };
+
+      return addSecurityHeaders(NextResponse.json(responseData));
+    } catch (error) {
+      console.error('[UPDATE-SESSION] Error updating session', { error });
+      return addSecurityHeaders(NextResponse.json(
+        { error: 'Failed to update session' },
+        { status: 500 }
+      ));
+    }
+  };
+}
+
+/**
+ * Default export for backward compatibility
+ * Requires environment variable: NEXTAUTH_SECRET
+ */
+export const POST = createUpdateSessionHandler({
+  nextAuthSecret: process.env.NEXTAUTH_SECRET || ''
+});

package/src/api-handlers/auth/verify-code.ts

@@ -10,9 +10,8 @@
  */
 
 import { NextRequest, NextResponse } from 'next/server';
-import { getToken } from 'next-auth/jwt';
+import { getSession } from '../../server/auth';
 import { updateTokens, mark2FAComplete } from '../../lib/session-store';
-import { getJwtCookieName } from '../../lib/app-slug';
 
 interface VerifyCodeRequest {
   accessToken: string;
@@ -22,7 +21,7 @@ interface VerifyCodeRequest {
 }
 
 interface VerifyCodeConfig {
-  nextAuthSecret: string;
+  nextAuthSecret?: string; // Legacy - no longer used by Better Auth
 }
 
 /**
@@ -59,17 +58,14 @@ export function createVerifyCodeHandler(config: VerifyCodeConfig) {
 
       const { accessToken, refreshToken, accessTokenExpires, refreshTokenExpires } = body;
 
-      // Get current session token from JWT
-      let token: any = await getToken({ req, secret: nextAuthSecret, cookieName: getJwtCookieName() });
+      // Get current session from Better Auth
+      const betterAuthSession = await getSession(req);
 
-      // The sessionToken is stored in the JWT token object
-      // Support both field names: sessionToken (auth.ts JWT) and redisSessionId (legacy)
-      const sessionToken = (token?.sessionToken || token?.redisSessionId) as string;
+      const sessionToken = betterAuthSession?.session?.token as string;
 
       if (!sessionToken) {
-        console.error('[VERIFY-CODE] No session token found in JWT', {
-          hasToken: !!token,
-          tokenKeys: token ? Object.keys(token) : []
+        console.error('[VERIFY-CODE] No session token found', {
+          hasSession: !!betterAuthSession,
         });
         return NextResponse.json(
           { success: false, message: 'No session found' },
@@ -79,7 +75,7 @@ export function createVerifyCodeHandler(config: VerifyCodeConfig) {
 
       console.info('[VERIFY-CODE] Updating session with new tokens after 2FA', {
         sessionToken: sessionToken.substring(0, 8) + '...',
-        userId: token?.sub,
+        userId: betterAuthSession?.user?.id,
         hasAccessToken: !!accessToken,
         hasRefreshToken: !!refreshToken,
         accessTokenLength: accessToken?.length,
@@ -100,7 +96,7 @@ export function createVerifyCodeHandler(config: VerifyCodeConfig) {
 
       console.info('[VERIFY-CODE] 2FA completion successful', {
         sessionToken: sessionToken.substring(0, 8) + '...',
-        userId: token?.sub
+        userId: betterAuthSession?.user?.id
       });
 
       return NextResponse.json({

package/src/api-handlers/session/viability.ts

@@ -5,21 +5,11 @@
  */
 
 import { NextRequest, NextResponse } from 'next/server';
-import { getSession } from '../../lib/session-store';
-import { getToken } from 'next-auth/jwt';
+import { getSession as getRedisSession } from '../../lib/session-store';
+import { getSession } from '../../server/auth';
 import { isInitializationFailed, ensureInitialized } from '../../lib/startup-init';
-import { getJwtCookieName } from '../../lib/app-slug';
 import { getIDPClientConfig } from '../../lib/idp-client-config';
 
-/**
- * Get NextAuth secret from IDP config (cached).
- * NEVER use process.env.NEXTAUTH_SECRET directly - it may not be set.
- */
-async function getNextAuthSecret(): Promise<string> {
-  const config = await getIDPClientConfig();
-  return config.nextAuthSecret || '';
-}
-
 export async function GET(req: NextRequest) {
   try {
     // Ensure initialization is complete
@@ -53,44 +43,17 @@ export async function GET(req: NextRequest) {
       );
     }
 
-    // Get secret from IDP config (same source as session.ts and token-lifecycle.ts)
-    const secret = await getNextAuthSecret();
-    if (!secret) {
-      console.error('[API Viability] NEXTAUTH_SECRET not available from IDP config');
-      return NextResponse.json(
-        {
-          error: 'Service Unavailable',
-          message: 'Authentication service is not properly configured',
-          code: 'AUTH_NOT_INITIALIZED'
-        },
-        { status: 503 }
-      );
-    }
-
-    // getToken is the recommended way to get the JWT from a request
-    const cookieName = getJwtCookieName();
-    const token = await getToken({ req, secret, cookieName });
+    // Get session from Better Auth
+    const betterAuthSession = await getSession(req);
 
-    // Debug logging to diagnose AKS-specific issues
-    if (!token) {
-      const cookieHeader = req.headers.get('cookie') || '';
-      const hasCookie = cookieHeader.includes(cookieName);
-      const cookieMatch = cookieHeader.match(new RegExp(`${cookieName}=([^;]*)`));
-      const cookieValue = cookieMatch ? cookieMatch[1] : null;
-      console.warn('[VIABILITY] getToken returned null:', {
-        cookieName,
-        hasCookie,
-        cookieValueLength: cookieValue?.length || 0,
-        cookieValuePreview: cookieValue ? cookieValue.substring(0, 30) + '...' : 'EMPTY',
-        secretLength: secret.length,
-        secretPreview: secret ? secret.substring(0, 10) + '...' : 'EMPTY',
-      });
+    // Debug logging
+    if (!betterAuthSession) {
+      console.warn('[VIABILITY] getSession returned null');
     }
 
-    // Support both field names: sessionToken (auth.ts JWT) and redisSessionId (legacy)
-    const sessionToken = (token?.sessionToken || token?.redisSessionId) as string | undefined;
-    if (token && sessionToken) {
-      const sessionData = await getSession(sessionToken);
+    const sessionToken = betterAuthSession?.session?.token as string | undefined;
+    if (betterAuthSession && sessionToken) {
+      const sessionData = await getRedisSession(sessionToken);
       if (sessionData) {
         // The session exists in Redis
 

package/src/api-handlers/test/force-expire.ts

@@ -1,7 +1,6 @@
 import { NextRequest, NextResponse } from 'next/server';
-import { getToken } from 'next-auth/jwt';
+import { getSession as getBetterAuthSession } from '../../server/auth';
 import { getSession, updateSession } from '../../lib/session-store';
-import { getJwtCookieName } from '../../lib/app-slug';
 
 /**
  * Force-expire access token for testing refresh flow.
@@ -17,21 +16,15 @@ import { getJwtCookieName } from '../../lib/app-slug';
  */
 export const POST = async (req: NextRequest) => {
   try {
-    const secret = process.env.NEXTAUTH_SECRET;
-    if (!secret) {
-      return NextResponse.json({ success: false, error: 'NEXTAUTH_SECRET not configured' }, { status: 500 });
-    }
-
-    const cookieName = getJwtCookieName();
-    const token = await getToken({ req, secret, cookieName });
+    const betterAuthSession = await getBetterAuthSession(req);
 
-    let sessionToken = token?.redisSessionId as string | undefined;
+    let sessionToken = betterAuthSession?.session?.token as string | undefined;
     if (!sessionToken) {
       const headerSessionToken = req.headers.get('x-session-token') || req.headers.get('X-Session-Token');
       if (headerSessionToken) {
         sessionToken = headerSessionToken;
       } else {
-        console.warn('[TEST_EXPIRE] No session token in JWT cookie or X-Session-Token header');
+        console.warn('[TEST_EXPIRE] No session token or X-Session-Token header');
         return NextResponse.json({ success: false, error: 'No session token' }, { status: 401 });
       }
     }

package/src/auth/auth-decision.ts

@@ -163,7 +163,7 @@ export function makeAuthDecision(context: AuthContext): AuthAction {
     return { type: 'allow' };
   }
 
-  // Token expired - redirect to login (let NextAuth handle refresh)
+  // Token expired - redirect to login
   if (sessionPointer.expired) {
     if (isLoginPage) {
       return { type: 'allow' };