@payez/next-mvp 4.0.42 → 4.0.44

package/dist/auth/better-auth.d.ts

@@ -27,6 +27,13 @@ export declare function buildBetterAuthProviders(config: IDPClientConfig): Recor
  * Use to add credentials/custom signin endpoints from the host app.
  */
 export type BetterAuthExtraPlugins = any[];
+/**
+ * Optional overrides for createBetterAuthInstance.
+ */
+export interface BetterAuthInstanceOptions {
+    /** Path suffix for the BA mount (default: '/api/auth'). Use '/api/ba-auth' for migration scenarios. */
+    basePath?: string;
+}
 /**
  * Create Better Auth instance from IDP config.
  *
@@ -35,8 +42,9 @@ export type BetterAuthExtraPlugins = any[];
  *
  * @param idpConfig IDP client config (from getIDPClientConfig)
  * @param extraPlugins Optional plugins to add (e.g., credentials plugin from host app)
+ * @param options Optional overrides (e.g., basePath for migration scenarios)
  */
-export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, extraPlugins?: BetterAuthExtraPlugins): import("better-auth").Auth<{
+export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, extraPlugins?: BetterAuthExtraPlugins, options?: BetterAuthInstanceOptions): import("better-auth").Auth<{
     baseURL: string;
     secret: string;
     socialProviders: Record<string, BetterAuthSocialProvider>;

package/dist/auth/better-auth.js

@@ -83,15 +83,17 @@ function buildBetterAuthProviders(config) {
  *
  * @param idpConfig IDP client config (from getIDPClientConfig)
  * @param extraPlugins Optional plugins to add (e.g., credentials plugin from host app)
+ * @param options Optional overrides (e.g., basePath for migration scenarios)
  */
-function createBetterAuthInstance(idpConfig, extraPlugins = []) {
+function createBetterAuthInstance(idpConfig, extraPlugins = [], options = {}) {
     const appSlug = idpConfig.clientSlug || (0, app_slug_1.getAppSlug)();
+    const basePath = options.basePath || '/api/auth';
     // Resolve base URL: BETTER_AUTH_URL env > IDP config > localhost fallback
-    // Must include /api/auth since that's where the catch-all route is mounted
+    // basePath defaults to /api/auth but can be overridden via options for migration scenarios
     const rawBaseURL = process.env.BETTER_AUTH_URL
         || idpConfig.baseClientUrl
         || `http://localhost:${process.env.PORT || '3000'}`;
-    const baseURL = rawBaseURL.replace(/\/+$/, '') + '/api/auth';
+    const baseURL = rawBaseURL.replace(/\/+$/, '') + basePath;
     return (0, better_auth_1.betterAuth)({
         baseURL,
         secret: idpConfig.nextAuthSecret,

package/dist/lib/api-handler.js

@@ -183,12 +183,18 @@ class ApiHandler {
                 }
             }
             catch { /* ignore */ }
-            // Check if token needs refresh
-            // Skip entirely if there's no refresh token — nothing to refresh with
+            // Check if token needs refresh.
+            // Skip the optimization (hasRefreshToken check) when access token is missing —
+            // some session shapes store the refresh token under different field names,
+            // and we still want a refresh attempt to populate the access token.
             const thresholdMs = 5 * 60 * 1000;
             const expires = sessionData.idpAccessTokenExpires || 0;
-            const hasRefreshToken = !!sessionData.idpRefreshToken;
-            const needsRefresh = hasRefreshToken && (!accessToken || (expires - Date.now()) <= thresholdMs);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            const hasRefreshToken = !!(sessionData.idpRefreshToken || sessionData.refreshToken);
+            const accessTokenStale = !accessToken || (expires - Date.now()) <= thresholdMs;
+            // If we already have a fresh access token, skip refresh entirely (no lock).
+            // If we don't, only attempt refresh when we have a refresh token to use.
+            const needsRefresh = accessTokenStale && hasRefreshToken;
             if (needsRefresh) {
                 const refreshResult = await this.handleCoordinatedRefresh(req, token, sessionData, ctx);
                 if (refreshResult.blocked) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "4.0.42",
+  "version": "4.0.44",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/auth/better-auth.ts

@@ -55,6 +55,14 @@ export function buildBetterAuthProviders(
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 export type BetterAuthExtraPlugins = any[];
 
+/**
+ * Optional overrides for createBetterAuthInstance.
+ */
+export interface BetterAuthInstanceOptions {
+  /** Path suffix for the BA mount (default: '/api/auth'). Use '/api/ba-auth' for migration scenarios. */
+  basePath?: string;
+}
+
 /**
  * Create Better Auth instance from IDP config.
  *
@@ -63,16 +71,22 @@ export type BetterAuthExtraPlugins = any[];
  *
  * @param idpConfig IDP client config (from getIDPClientConfig)
  * @param extraPlugins Optional plugins to add (e.g., credentials plugin from host app)
+ * @param options Optional overrides (e.g., basePath for migration scenarios)
  */
-export function createBetterAuthInstance(idpConfig: IDPClientConfig, extraPlugins: BetterAuthExtraPlugins = []) {
+export function createBetterAuthInstance(
+  idpConfig: IDPClientConfig,
+  extraPlugins: BetterAuthExtraPlugins = [],
+  options: BetterAuthInstanceOptions = {}
+) {
   const appSlug = idpConfig.clientSlug || getAppSlug();
+  const basePath = options.basePath || '/api/auth';
 
   // Resolve base URL: BETTER_AUTH_URL env > IDP config > localhost fallback
-  // Must include /api/auth since that's where the catch-all route is mounted
+  // basePath defaults to /api/auth but can be overridden via options for migration scenarios
   const rawBaseURL = process.env.BETTER_AUTH_URL
     || idpConfig.baseClientUrl
     || `http://localhost:${process.env.PORT || '3000'}`;
-  const baseURL = rawBaseURL.replace(/\/+$/, '') + '/api/auth';
+  const baseURL = rawBaseURL.replace(/\/+$/, '') + basePath;
 
   return betterAuth({
     baseURL,

package/src/lib/api-handler.ts

@@ -278,12 +278,18 @@ export class ApiHandler {
         }
       } catch { /* ignore */ }
 
-      // Check if token needs refresh
-      // Skip entirely if there's no refresh token — nothing to refresh with
+      // Check if token needs refresh.
+      // Skip the optimization (hasRefreshToken check) when access token is missing —
+      // some session shapes store the refresh token under different field names,
+      // and we still want a refresh attempt to populate the access token.
       const thresholdMs = 5 * 60 * 1000;
       const expires = sessionData.idpAccessTokenExpires || 0;
-      const hasRefreshToken = !!sessionData.idpRefreshToken;
-      const needsRefresh = hasRefreshToken && (!accessToken || (expires - Date.now()) <= thresholdMs);
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      const hasRefreshToken = !!(sessionData.idpRefreshToken || (sessionData as any).refreshToken);
+      const accessTokenStale = !accessToken || (expires - Date.now()) <= thresholdMs;
+      // If we already have a fresh access token, skip refresh entirely (no lock).
+      // If we don't, only attempt refresh when we have a refresh token to use.
+      const needsRefresh = accessTokenStale && hasRefreshToken;
 
       if (needsRefresh) {
         const refreshResult = await this.handleCoordinatedRefresh(req, token, sessionData, ctx);