@payez/next-mvp 4.0.46 → 4.0.49

package/dist/server/auth.js

@@ -1,55 +1,71 @@
 "use strict";
 /**
- * Server-side auth utilities for Better Auth (v4.0)
+ * Server-side auth utilities for Better Auth.
  *
- * Replaces:
- * - getToken() from next-auth/jwt
- * - getServerSession() from next-auth
- *
- * All server-side auth flows go through the Better Auth instance.
+ * All server-side auth flows go through the Better Auth instance returned by
+ * getAuthInstance(); use getSession(req) for the request-scoped session.
  */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getAuthInstance = getAuthInstance;
 exports.getSession = getSession;
+exports.getSessionData = getSessionData;
+exports.getIdpToken = getIdpToken;
 exports.requireSession = requireSession;
 require("server-only");
 const better_auth_1 = require("../auth/better-auth");
 const idp_client_config_1 = require("../lib/idp-client-config");
+const session_store_1 = require("../lib/session-store");
 let authInstance = null;
 let authInitPromise = null;
+function buildSessionDataFromAuthSession(session) {
+    const user = session?.user;
+    if (!user?.id && !user?.email) {
+        return null;
+    }
+    const expiresAt = session?.session?.expiresAt
+        ? new Date(session.session.expiresAt).getTime()
+        : Date.now() + 24 * 60 * 60 * 1000;
+    return {
+        userId: user.userId || user.id || '',
+        email: user.email || '',
+        name: user.name || undefined,
+        roles: Array.isArray(user.roles) ? user.roles : [],
+        idpAccessToken: user.idpAccessToken,
+        idpRefreshToken: user.idpRefreshToken,
+        idpAccessTokenExpires: user.idpAccessTokenExpires || expiresAt,
+        mfaVerified: user.mfaVerified ?? user.twoFactorSessionVerified ?? false,
+        oauthProvider: user.oauthProvider,
+        idpClientId: user.idpClientId,
+        merchantId: user.merchantId,
+    };
+}
+function attachSessionData(session, sessionData, sessionToken) {
+    if (!sessionData) {
+        return session;
+    }
+    const enrichedSessionData = {
+        ...sessionData,
+        ...(sessionToken ? { sessionToken } : {}),
+    };
+    session.sessionData = enrichedSessionData;
+    if (session?.user) {
+        const user = session.user;
+        user.userId = enrichedSessionData.userId || user.userId;
+        user.email = enrichedSessionData.email || user.email;
+        user.name = enrichedSessionData.name || user.name;
+        user.roles = enrichedSessionData.roles || user.roles || [];
+        user.idpAccessToken = enrichedSessionData.idpAccessToken;
+        user.idpRefreshToken = enrichedSessionData.idpRefreshToken;
+        user.idpAccessTokenExpires = enrichedSessionData.idpAccessTokenExpires;
+        user.mfaVerified = enrichedSessionData.mfaVerified;
+        user.twoFactorSessionVerified =
+            enrichedSessionData.mfaVerified ?? user.twoFactorSessionVerified;
+        user.oauthProvider = enrichedSessionData.oauthProvider || user.oauthProvider;
+        user.idpClientId = enrichedSessionData.idpClientId || user.idpClientId;
+        user.merchantId = enrichedSessionData.merchantId || user.merchantId;
+    }
+    return session;
+}
 /**
  * Get the initialized Better Auth instance (singleton).
  */
@@ -78,31 +94,66 @@ async function getSession(request) {
         const session = await auth.api.getSession({ headers: request.headers });
         if (!session?.session?.token || !session?.user)
             return session;
-        // Enrich with IDP tokens from Redis (stored by post-login hook)
+        const sessionToken = session.session.token;
+        let sessionData = null;
+        // Prefer the app's normalized Redis session. Fall back to Better Auth's
+        // secondary storage record, then finally to whatever Better Auth already
+        // put on the request session object.
         try {
-            const { getRedis } = await Promise.resolve().then(() => __importStar(require('../lib/redis')));
-            const { getAppSlug } = await Promise.resolve().then(() => __importStar(require('../lib/app-slug')));
-            const baKey = `ba:${getAppSlug()}:${session.session.token}`;
-            const baRaw = await getRedis().get(baKey);
-            if (baRaw) {
-                const baData = JSON.parse(baRaw);
-                if (baData.idpTokens) {
-                    const u = session.user;
-                    u.roles = baData.idpTokens.roles || [];
-                    u.userId = baData.idpTokens.userId;
-                    u.idpAccessToken = baData.idpTokens.idpAccessToken;
-                    u.idpRefreshToken = baData.idpTokens.idpRefreshToken;
-                    u.idpAccessTokenExpires = baData.idpTokens.idpAccessTokenExpires;
-                }
+            sessionData = await (0, session_store_1.getSession)(sessionToken);
+            if (!sessionData) {
+                sessionData = await (0, session_store_1.getBetterAuthSession)(sessionToken);
             }
         }
         catch { /* Redis unavailable */ }
-        return session;
+        if (!sessionData) {
+            sessionData = buildSessionDataFromAuthSession(session);
+        }
+        return attachSessionData(session, sessionData, sessionToken);
     }
     catch {
         return null;
     }
 }
+/**
+ * Get normalized session data for the current request.
+ *
+ * This prefers the app's Redis session because it carries the canonical
+ * IDP token, roles, and tenant-specific user identity used by app routes.
+ */
+async function getSessionData(request) {
+    const session = await getSession(request);
+    const sessionData = session?.sessionData ||
+        buildSessionDataFromAuthSession(session);
+    if (!sessionData) {
+        return null;
+    }
+    const sessionToken = session?.session?.token;
+    return sessionToken
+        ? { ...sessionData, sessionToken }
+        : sessionData;
+}
+/**
+ * Get the current request's IDP access token without triggering a refresh.
+ *
+ * Use this for routes that only need the currently-issued bearer token and
+ * should fail closed instead of performing token lifecycle work.
+ */
+async function getIdpToken(request) {
+    const sessionData = await getSessionData(request);
+    if (!sessionData) {
+        return { success: false, error: 'NO_SESSION', terminal: true };
+    }
+    const accessToken = sessionData.idpAccessToken || sessionData.accessToken;
+    if (!accessToken) {
+        return { success: false, error: 'NO_TOKEN', terminal: true };
+    }
+    return {
+        success: true,
+        accessToken,
+        sessionData,
+    };
+}
 /**
  * Get the current session, throwing if not authenticated.
  * Use in API handlers that require auth.

package/dist/server/decode-session.js

@@ -166,9 +166,9 @@ async function decodeSession(requestCookies) {
             return null;
         }
         const config = await (0, idp_client_config_1.getIDPClientConfig)();
-        const secret = config.nextAuthSecret;
+        const secret = config.authSecret;
         if (!secret) {
-            console.error('[DECODE-SESSION] No nextAuthSecret available from IDP config');
+            console.error('[DECODE-SESSION] No authSecret available from IDP config');
             return null;
         }
         const secretKey = new TextEncoder().encode(secret);

package/dist/vibe/hooks/index.d.ts

@@ -141,7 +141,7 @@ export declare function useVibeMutation<T extends VibeTableName, Op extends Muta
 /**
  * Convenience hook for creating records.
  */
-export declare function useVibeCreate<T extends VibeTableName>(table: T, options?: Omit<UseVibeMutationOptions<T, 'create'>, never>): import("@tanstack/react-query").UseMutationResult<VibeTableType<T>, VibeError, Omit<VibeTableType<T>, "id" | "created_at" | "updated_at">, unknown>;
+export declare function useVibeCreate<T extends VibeTableName>(table: T, options?: Omit<UseVibeMutationOptions<T, 'create'>, never>): import("@tanstack/react-query").UseMutationResult<VibeTableType<T>, VibeError, Omit<VibeTableType<T>, "created_at" | "id" | "updated_at">, unknown>;
 /**
  * Convenience hook for updating records.
  */