@payez/next-mvp 4.0.46 → 4.0.49

package/src/routes/account/verify-sms.ts

@@ -30,7 +30,7 @@ export { POST } from '../../api-handlers/account/verify-sms';
  * Environment variables used:
  * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
  * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
- * - NEXTAUTH_SECRET (required)
+ * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
  *
  * Returns:
  * - Upgraded access token with MFA claim

package/src/routes/auth/refresh.ts

@@ -15,11 +15,9 @@
  */
 
 import { createRefreshHandler } from '../../api-handlers/auth/refresh';
-import { getIDPClientConfig } from '../../lib/idp-client-config';
 
-// Configuration is read at runtime from IDP config (cached)
-async function getConfig() {
-  const idpConfig = await getIDPClientConfig();
+// Configuration is read at runtime from environment.
+function getConfig() {
   const idpBaseUrl = process.env.IDP_URL;
   if (!idpBaseUrl) {
     throw new Error('[IDP_URL] FATAL: IDP_URL environment variable is REQUIRED.');
@@ -27,7 +25,6 @@ async function getConfig() {
   return {
     idpBaseUrl,
     clientId: process.env.CLIENT_ID || process.env.NEXT_PUBLIC_IDP_CLIENT_ID || '',
-    nextAuthSecret: idpConfig.nextAuthSecret || '',
     refreshEndpoint: process.env.REFRESH_ENDPOINT || '/api/ExternalAuth/refresh',
   };
 }
@@ -38,7 +35,6 @@ async function getConfig() {
  * Environment variables used:
  * - IDP_URL (REQUIRED)
  * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
- * - NEXTAUTH_SECRET (required)
  * - REFRESH_ENDPOINT (default: /api/ExternalAuth/refresh)
  */
 let _handler: ReturnType<typeof createRefreshHandler> | null = null;
@@ -47,8 +43,7 @@ import { NextRequest } from 'next/server';
 
 export async function POST(req: NextRequest) {
   if (!_handler) {
-    const config = await getConfig();
-    _handler = createRefreshHandler(config);
+    _handler = createRefreshHandler(getConfig());
   }
   return _handler(req);
 }

package/src/server/auth.ts

@@ -1,20 +1,83 @@
 /**
- * Server-side auth utilities for Better Auth (v4.0)
+ * Server-side auth utilities for Better Auth.
  *
- * Replaces:
- * - getToken() from next-auth/jwt
- * - getServerSession() from next-auth
- *
- * All server-side auth flows go through the Better Auth instance.
+ * All server-side auth flows go through the Better Auth instance returned by
+ * getAuthInstance(); use getSession(req) for the request-scoped session.
  */
 
 import 'server-only';
 import { createBetterAuthInstance } from '../auth/better-auth';
 import { getIDPClientConfig } from '../lib/idp-client-config';
+import {
+  getSession as getRedisSession,
+  getBetterAuthSession as getBetterAuthRedisSession,
+  type SessionData,
+} from '../lib/session-store';
 
 let authInstance: ReturnType<typeof createBetterAuthInstance> | null = null;
 let authInitPromise: Promise<ReturnType<typeof createBetterAuthInstance>> | null = null;
 
+export type IdpTokenResult =
+  | { success: true; accessToken: string; sessionData: SessionData }
+  | { success: false; error: 'NO_SESSION' | 'NO_TOKEN'; terminal: true };
+
+function buildSessionDataFromAuthSession(session: any): SessionData | null {
+  const user = session?.user;
+  if (!user?.id && !user?.email) {
+    return null;
+  }
+
+  const expiresAt = session?.session?.expiresAt
+    ? new Date(session.session.expiresAt).getTime()
+    : Date.now() + 24 * 60 * 60 * 1000;
+
+  return {
+    userId: user.userId || user.id || '',
+    email: user.email || '',
+    name: user.name || undefined,
+    roles: Array.isArray(user.roles) ? user.roles : [],
+    idpAccessToken: user.idpAccessToken,
+    idpRefreshToken: user.idpRefreshToken,
+    idpAccessTokenExpires: user.idpAccessTokenExpires || expiresAt,
+    mfaVerified: user.mfaVerified ?? user.twoFactorSessionVerified ?? false,
+    oauthProvider: user.oauthProvider,
+    idpClientId: user.idpClientId,
+    merchantId: user.merchantId,
+  };
+}
+
+function attachSessionData(session: any, sessionData: SessionData | null, sessionToken?: string) {
+  if (!sessionData) {
+    return session;
+  }
+
+  const enrichedSessionData = {
+    ...sessionData,
+    ...(sessionToken ? { sessionToken } : {}),
+  };
+
+  (session as any).sessionData = enrichedSessionData;
+
+  if (session?.user) {
+    const user = session.user as any;
+    user.userId = enrichedSessionData.userId || user.userId;
+    user.email = enrichedSessionData.email || user.email;
+    user.name = enrichedSessionData.name || user.name;
+    user.roles = enrichedSessionData.roles || user.roles || [];
+    user.idpAccessToken = enrichedSessionData.idpAccessToken;
+    user.idpRefreshToken = enrichedSessionData.idpRefreshToken;
+    user.idpAccessTokenExpires = enrichedSessionData.idpAccessTokenExpires;
+    user.mfaVerified = enrichedSessionData.mfaVerified;
+    user.twoFactorSessionVerified =
+      enrichedSessionData.mfaVerified ?? user.twoFactorSessionVerified;
+    user.oauthProvider = enrichedSessionData.oauthProvider || user.oauthProvider;
+    user.idpClientId = enrichedSessionData.idpClientId || user.idpClientId;
+    user.merchantId = enrichedSessionData.merchantId || user.merchantId;
+  }
+
+  return session;
+}
+
 /**
  * Get the initialized Better Auth instance (singleton).
  */
@@ -43,31 +106,75 @@ export async function getSession(request?: Request): Promise<any> {
     const session = await auth.api.getSession({ headers: request.headers });
     if (!session?.session?.token || !session?.user) return session;
 
-    // Enrich with IDP tokens from Redis (stored by post-login hook)
+    const sessionToken = session.session.token as string;
+    let sessionData: SessionData | null = null;
+
+    // Prefer the app's normalized Redis session. Fall back to Better Auth's
+    // secondary storage record, then finally to whatever Better Auth already
+    // put on the request session object.
     try {
-      const { getRedis } = await import('../lib/redis');
-      const { getAppSlug } = await import('../lib/app-slug');
-      const baKey = `ba:${getAppSlug()}:${session.session.token}`;
-      const baRaw = await getRedis().get(baKey);
-      if (baRaw) {
-        const baData = JSON.parse(baRaw);
-        if (baData.idpTokens) {
-          const u = session.user as any;
-          u.roles = baData.idpTokens.roles || [];
-          u.userId = baData.idpTokens.userId;
-          u.idpAccessToken = baData.idpTokens.idpAccessToken;
-          u.idpRefreshToken = baData.idpTokens.idpRefreshToken;
-          u.idpAccessTokenExpires = baData.idpTokens.idpAccessTokenExpires;
-        }
+      sessionData = await getRedisSession(sessionToken);
+      if (!sessionData) {
+        sessionData = await getBetterAuthRedisSession(sessionToken);
       }
     } catch { /* Redis unavailable */ }
 
-    return session;
+    if (!sessionData) {
+      sessionData = buildSessionDataFromAuthSession(session);
+    }
+
+    return attachSessionData(session, sessionData, sessionToken);
   } catch {
     return null;
   }
 }
 
+/**
+ * Get normalized session data for the current request.
+ *
+ * This prefers the app's Redis session because it carries the canonical
+ * IDP token, roles, and tenant-specific user identity used by app routes.
+ */
+export async function getSessionData(request?: Request): Promise<SessionData | null> {
+  const session = await getSession(request);
+  const sessionData =
+    ((session as any)?.sessionData as SessionData | undefined) ||
+    buildSessionDataFromAuthSession(session);
+
+  if (!sessionData) {
+    return null;
+  }
+
+  const sessionToken = session?.session?.token as string | undefined;
+  return sessionToken
+    ? { ...sessionData, sessionToken }
+    : sessionData;
+}
+
+/**
+ * Get the current request's IDP access token without triggering a refresh.
+ *
+ * Use this for routes that only need the currently-issued bearer token and
+ * should fail closed instead of performing token lifecycle work.
+ */
+export async function getIdpToken(request?: Request): Promise<IdpTokenResult> {
+  const sessionData = await getSessionData(request);
+  if (!sessionData) {
+    return { success: false, error: 'NO_SESSION', terminal: true };
+  }
+
+  const accessToken = sessionData.idpAccessToken || (sessionData as any).accessToken;
+  if (!accessToken) {
+    return { success: false, error: 'NO_TOKEN', terminal: true };
+  }
+
+  return {
+    success: true,
+    accessToken,
+    sessionData,
+  };
+}
+
 /**
  * Get the current session, throwing if not authenticated.
  * Use in API handlers that require auth.

package/src/server/decode-session.ts

@@ -152,9 +152,9 @@ export async function decodeSession(
     }
 
     const config = await getIDPClientConfig();
-    const secret = config.nextAuthSecret;
+    const secret = config.authSecret;
     if (!secret) {
-      console.error('[DECODE-SESSION] No nextAuthSecret available from IDP config');
+      console.error('[DECODE-SESSION] No authSecret available from IDP config');
       return null;
     }
 

package/dist/lib/nextauth-secret.d.ts

@@ -1,10 +0,0 @@
-import 'server-only';
-/**
- * Resolve the NextAuth secret (server-only).
- *
- * Priority:
- * 1) Use process.env.NEXTAUTH_SECRET if present (allows overrides/production)
- * 2) Fetch from IDP broker endpoint - IDP handles all Key Vault/signing
- * 3) Cache result in-memory and set process.env.NEXTAUTH_SECRET for subsequent calls
- */
-export declare function resolveNextAuthSecret(): Promise<string>;