@payez/next-mvp 4.0.49 → 4.1.0

package/src/server/auth.ts

@@ -1,188 +1,78 @@
-/**
- * Server-side auth utilities for Better Auth.
- *
- * All server-side auth flows go through the Better Auth instance returned by
- * getAuthInstance(); use getSession(req) for the request-scoped session.
- */
-
-import 'server-only';
-import { createBetterAuthInstance } from '../auth/better-auth';
-import { getIDPClientConfig } from '../lib/idp-client-config';
-import {
-  getSession as getRedisSession,
-  getBetterAuthSession as getBetterAuthRedisSession,
-  type SessionData,
-} from '../lib/session-store';
-
-let authInstance: ReturnType<typeof createBetterAuthInstance> | null = null;
-let authInitPromise: Promise<ReturnType<typeof createBetterAuthInstance>> | null = null;
-
-export type IdpTokenResult =
-  | { success: true; accessToken: string; sessionData: SessionData }
-  | { success: false; error: 'NO_SESSION' | 'NO_TOKEN'; terminal: true };
-
-function buildSessionDataFromAuthSession(session: any): SessionData | null {
-  const user = session?.user;
-  if (!user?.id && !user?.email) {
-    return null;
-  }
-
-  const expiresAt = session?.session?.expiresAt
-    ? new Date(session.session.expiresAt).getTime()
-    : Date.now() + 24 * 60 * 60 * 1000;
-
-  return {
-    userId: user.userId || user.id || '',
-    email: user.email || '',
-    name: user.name || undefined,
-    roles: Array.isArray(user.roles) ? user.roles : [],
-    idpAccessToken: user.idpAccessToken,
-    idpRefreshToken: user.idpRefreshToken,
-    idpAccessTokenExpires: user.idpAccessTokenExpires || expiresAt,
-    mfaVerified: user.mfaVerified ?? user.twoFactorSessionVerified ?? false,
-    oauthProvider: user.oauthProvider,
-    idpClientId: user.idpClientId,
-    merchantId: user.merchantId,
-  };
-}
-
-function attachSessionData(session: any, sessionData: SessionData | null, sessionToken?: string) {
-  if (!sessionData) {
-    return session;
-  }
-
-  const enrichedSessionData = {
-    ...sessionData,
-    ...(sessionToken ? { sessionToken } : {}),
-  };
-
-  (session as any).sessionData = enrichedSessionData;
-
-  if (session?.user) {
-    const user = session.user as any;
-    user.userId = enrichedSessionData.userId || user.userId;
-    user.email = enrichedSessionData.email || user.email;
-    user.name = enrichedSessionData.name || user.name;
-    user.roles = enrichedSessionData.roles || user.roles || [];
-    user.idpAccessToken = enrichedSessionData.idpAccessToken;
-    user.idpRefreshToken = enrichedSessionData.idpRefreshToken;
-    user.idpAccessTokenExpires = enrichedSessionData.idpAccessTokenExpires;
-    user.mfaVerified = enrichedSessionData.mfaVerified;
-    user.twoFactorSessionVerified =
-      enrichedSessionData.mfaVerified ?? user.twoFactorSessionVerified;
-    user.oauthProvider = enrichedSessionData.oauthProvider || user.oauthProvider;
-    user.idpClientId = enrichedSessionData.idpClientId || user.idpClientId;
-    user.merchantId = enrichedSessionData.merchantId || user.merchantId;
-  }
-
-  return session;
-}
-
-/**
- * Get the initialized Better Auth instance (singleton).
- */
-export async function getAuthInstance() {
-  if (authInstance) return authInstance;
-  if (!authInitPromise) {
-    authInitPromise = getIDPClientConfig(true).then(config => {
-      authInstance = createBetterAuthInstance(config);
-      return authInstance;
-    });
-  }
-  return authInitPromise;
-}
-
-/**
- * Get the current session from a request.
- * Replaces getToken() and getServerSession().
- *
- * Returns the session object or null if not authenticated.
- */
-export async function getSession(request?: Request): Promise<any> {
-  const auth = await getAuthInstance();
-  if (!request) return null;
-
-  try {
-    const session = await auth.api.getSession({ headers: request.headers });
-    if (!session?.session?.token || !session?.user) return session;
-
-    const sessionToken = session.session.token as string;
-    let sessionData: SessionData | null = null;
-
-    // Prefer the app's normalized Redis session. Fall back to Better Auth's
-    // secondary storage record, then finally to whatever Better Auth already
-    // put on the request session object.
-    try {
-      sessionData = await getRedisSession(sessionToken);
-      if (!sessionData) {
-        sessionData = await getBetterAuthRedisSession(sessionToken);
-      }
-    } catch { /* Redis unavailable */ }
-
-    if (!sessionData) {
-      sessionData = buildSessionDataFromAuthSession(session);
-    }
-
-    return attachSessionData(session, sessionData, sessionToken);
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Get normalized session data for the current request.
- *
- * This prefers the app's Redis session because it carries the canonical
- * IDP token, roles, and tenant-specific user identity used by app routes.
- */
-export async function getSessionData(request?: Request): Promise<SessionData | null> {
-  const session = await getSession(request);
-  const sessionData =
-    ((session as any)?.sessionData as SessionData | undefined) ||
-    buildSessionDataFromAuthSession(session);
-
-  if (!sessionData) {
-    return null;
-  }
-
-  const sessionToken = session?.session?.token as string | undefined;
-  return sessionToken
-    ? { ...sessionData, sessionToken }
-    : sessionData;
-}
-
-/**
- * Get the current request's IDP access token without triggering a refresh.
- *
- * Use this for routes that only need the currently-issued bearer token and
- * should fail closed instead of performing token lifecycle work.
- */
-export async function getIdpToken(request?: Request): Promise<IdpTokenResult> {
-  const sessionData = await getSessionData(request);
-  if (!sessionData) {
-    return { success: false, error: 'NO_SESSION', terminal: true };
-  }
-
-  const accessToken = sessionData.idpAccessToken || (sessionData as any).accessToken;
-  if (!accessToken) {
-    return { success: false, error: 'NO_TOKEN', terminal: true };
-  }
-
-  return {
-    success: true,
-    accessToken,
-    sessionData,
-  };
-}
-
-/**
- * Get the current session, throwing if not authenticated.
- * Use in API handlers that require auth.
- */
-export async function requireSession(request: Request) {
-  const session = await getSession(request);
-  if (!session) {
-    throw new Error('Unauthorized');
-  }
-  return session;
-}
+/**
+ * Server-side auth utilities for Better Auth.
+ *
+ * All server-side auth flows go through the Better Auth instance returned by
+ * getAuthInstance(); use getSession(req) for the request-scoped session.
+ */
+
+import 'server-only';
+import { createBetterAuthInstance } from '../auth/better-auth';
+import { getIDPClientConfig } from '../lib/idp-client-config';
+
+let authInstance: ReturnType<typeof createBetterAuthInstance> | null = null;
+let authInitPromise: Promise<ReturnType<typeof createBetterAuthInstance>> | null = null;
+
+/**
+ * Get the initialized Better Auth instance (singleton).
+ */
+export async function getAuthInstance() {
+  if (authInstance) return authInstance;
+  if (!authInitPromise) {
+    authInitPromise = getIDPClientConfig(true).then(config => {
+      authInstance = createBetterAuthInstance(config);
+      return authInstance;
+    });
+  }
+  return authInitPromise;
+}
+
+/**
+ * Get the current session from a request.
+ * Replaces getToken() and getServerSession().
+ *
+ * Returns the session object or null if not authenticated.
+ */
+export async function getSession(request?: Request): Promise<any> {
+  const auth = await getAuthInstance();
+  if (!request) return null;
+
+  try {
+    const session = await auth.api.getSession({ headers: request.headers });
+    if (!session?.session?.token || !session?.user) return session;
+
+    // Enrich with IDP tokens from Redis (stored by post-login hook)
+    try {
+      const { getRedis } = await import('../lib/redis');
+      const { getAppSlug } = await import('../lib/app-slug');
+      const baKey = `ba:${getAppSlug()}:${session.session.token}`;
+      const baRaw = await getRedis().get(baKey);
+      if (baRaw) {
+        const baData = JSON.parse(baRaw);
+        if (baData.idpTokens) {
+          const u = session.user as any;
+          u.roles = baData.idpTokens.roles || [];
+          u.userId = baData.idpTokens.userId;
+          u.idpAccessToken = baData.idpTokens.idpAccessToken;
+          u.idpRefreshToken = baData.idpTokens.idpRefreshToken;
+          u.idpAccessTokenExpires = baData.idpTokens.idpAccessTokenExpires;
+        }
+      }
+    } catch { /* Redis unavailable */ }
+
+    return session;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Get the current session, throwing if not authenticated.
+ * Use in API handlers that require auth.
+ */
+export async function requireSession(request: Request) {
+  const session = await getSession(request);
+  if (!session) {
+    throw new Error('Unauthorized');
+  }
+  return session;
+}

package/src/server/decode-session.ts

@@ -1,200 +1,200 @@
-/**
- * Server-Side Session Decoder
- *
- * Uses Better Auth's server-side session API to get the current session.
- * Falls back to legacy JWT + Redis path if Better Auth session not found.
- */
-
-import 'server-only';
-import { cookies } from 'next/headers';
-import { jwtVerify, type JWTPayload } from 'jose';
-import { getSession, type SessionData } from '../lib/session-store';
-import { getIDPClientConfig } from '../lib/idp-client-config';
-import { getSessionCookieName, getSecureSessionCookieName } from '../lib/app-slug';
-import { ensureInitialized } from '../lib/startup-init';
-
-export interface DecodedSession {
-  sessionData: SessionData;
-  jwtPayload: JWTPayload & { sessionToken?: string; redisSessionId?: string };
-}
-
-/**
- * Try Better Auth's server-side session API.
- * Returns a DecodedSession if Better Auth has an active session, null otherwise.
- */
-async function tryBetterAuthSession(
-  requestCookies?: { get: (name: string) => { value: string } | undefined }
-): Promise<DecodedSession | null> {
-  try {
-    const { getBetterAuthInstance } = await import('../auth/better-auth');
-
-    let auth: any = null;
-    try {
-      auth = await getBetterAuthInstance();
-    } catch {
-      return null;
-    }
-
-    if (!auth?.api?.getSession) {
-      return null;
-    }
-
-    // Build headers from cookies for Better Auth to read
-    const cookieStore = requestCookies || (await cookies());
-    const headerObj = new Headers();
-
-    // Collect all cookies into a Cookie header
-    if ('getAll' in cookieStore && typeof cookieStore.getAll === 'function') {
-      const allCookies = (cookieStore as any).getAll();
-      const cookieStr = allCookies.map((c: any) => `${c.name}=${c.value}`).join('; ');
-      headerObj.set('cookie', cookieStr);
-    } else {
-      // Fallback: read known cookie names
-      const sessionCookieName = getSessionCookieName();
-      const secureCookieName = getSecureSessionCookieName();
-      const parts: string[] = [];
-      const sc = cookieStore.get(secureCookieName);
-      if (sc?.value) parts.push(`${secureCookieName}=${sc.value}`);
-      const nc = cookieStore.get(sessionCookieName);
-      if (nc?.value) parts.push(`${sessionCookieName}=${nc.value}`);
-      if (parts.length > 0) headerObj.set('cookie', parts.join('; '));
-    }
-
-    const result = await auth.api.getSession({ headers: headerObj });
-
-    if (!result?.session || !result?.user) {
-      return null;
-    }
-
-    // Read IDP tokens from BA Redis session (stored by callback route after OAuth)
-    let idpTokens: any = null;
-    try {
-      const { getRedis } = await import('../lib/redis');
-      const { getAppSlug } = await import('../lib/app-slug');
-      const baKey = `ba:${getAppSlug()}:${result.session.token}`;
-      const baRaw = await getRedis().get(baKey);
-      if (baRaw) {
-        const baData = JSON.parse(baRaw);
-        idpTokens = baData.idpTokens;
-      }
-    } catch { /* Redis unavailable */ }
-
-    // Map Better Auth session + IDP tokens to SessionData
-    const sessionData: SessionData = {
-      userId: idpTokens?.userId || result.user.id || '',
-      email: idpTokens?.email || result.user.email || '',
-      name: idpTokens?.name || result.user.name || undefined,
-      roles: idpTokens?.roles || [],
-      idpAccessToken: idpTokens?.idpAccessToken,
-      idpRefreshToken: idpTokens?.idpRefreshToken,
-      idpAccessTokenExpires: idpTokens?.idpAccessTokenExpires
-        || (result.session.expiresAt ? new Date(result.session.expiresAt).getTime() : Date.now() + 24 * 60 * 60 * 1000),
-      mfaVerified: idpTokens?.mfaVerified ?? false,
-      oauthProvider: 'google',
-    };
-
-    // Backwards compat: session.user.email works alongside session.email
-    (sessionData as any).user = {
-      id: sessionData.userId,
-      email: sessionData.email,
-      name: sessionData.name,
-      roles: sessionData.roles,
-      image: result.user.image,
-      oauthProvider: sessionData.oauthProvider,
-    };
-
-    const jwtPayload: DecodedSession['jwtPayload'] = {
-      sub: result.user.id,
-      email: result.user.email,
-      name: result.user.name,
-      iat: Math.floor(Date.now() / 1000),
-      exp: sessionData.idpAccessTokenExpires / 1000,
-      sessionToken: result.session.token,
-    };
-
-    return { sessionData, jwtPayload };
-  } catch (error) {
-    console.warn('[DECODE-SESSION] Better Auth session check failed:', error instanceof Error ? error.message : String(error));
-    return null;
-  }
-}
-
-/**
- * Decode the session from cookies.
- * Tries Better Auth first, falls back to legacy JWT + Redis.
- *
- * @param requestCookies Optional cookie getter for API route context (NextRequest.cookies).
- *                       If omitted, uses next/headers cookies() for server components.
- */
-export async function decodeSession(
-  requestCookies?: { get: (name: string) => { value: string } | undefined }
-): Promise<DecodedSession | null> {
-  try {
-    await ensureInitialized();
-
-    // Try Better Auth session first
-    const betterAuthSession = await tryBetterAuthSession(requestCookies);
-    if (betterAuthSession) {
-      return betterAuthSession;
-    }
-
-    // Fall back to legacy JWT + Redis path
-    const cookieStore = requestCookies || (await cookies());
-    const sessionCookieName = getSessionCookieName();
-    const secureCookieName = getSecureSessionCookieName();
-
-    const cookieValue =
-      cookieStore.get(secureCookieName)?.value ||
-      cookieStore.get(sessionCookieName)?.value;
-
-    if (!cookieValue) {
-      return null;
-    }
-
-    const config = await getIDPClientConfig();
-    const secret = config.authSecret;
-    if (!secret) {
-      console.error('[DECODE-SESSION] No authSecret available from IDP config');
-      return null;
-    }
-
-    const secretKey = new TextEncoder().encode(secret);
-    let payload: JWTPayload;
-    try {
-      const result = await jwtVerify(cookieValue, secretKey);
-      payload = result.payload;
-    } catch (jwtError) {
-      console.warn('[DECODE-SESSION] JWT verification failed:', jwtError instanceof Error ? jwtError.message : String(jwtError));
-      return null;
-    }
-
-    const sessionToken = (payload as any).sessionToken || (payload as any).redisSessionId;
-    if (!sessionToken) {
-      console.warn('[DECODE-SESSION] JWT payload missing sessionToken/redisSessionId');
-      return null;
-    }
-
-    const sessionData = await getSession(sessionToken);
-    if (!sessionData) {
-      return null;
-    }
-
-    // Backwards compat: session.user.email works alongside session.email
-    if (!(sessionData as any).user) {
-      (sessionData as any).user = {
-        id: sessionData.userId,
-        email: sessionData.email,
-        name: sessionData.name,
-        roles: sessionData.roles,
-      };
-    }
-
-    return {
-      sessionData,
-      jwtPayload: payload as DecodedSession['jwtPayload'],
-    };
-  } catch (error) {
-    console.error('[DECODE-SESSION] Error:', error instanceof Error ? error.message : String(error));
-    return null;
-  }
-}
+/**
+ * Server-Side Session Decoder
+ *
+ * Uses Better Auth's server-side session API to get the current session.
+ * Falls back to legacy JWT + Redis path if Better Auth session not found.
+ */
+
+import 'server-only';
+import { cookies } from 'next/headers';
+import { jwtVerify, type JWTPayload } from 'jose';
+import { getSession, type SessionData } from '../lib/session-store';
+import { getIDPClientConfig } from '../lib/idp-client-config';
+import { getSessionCookieName, getSecureSessionCookieName } from '../lib/app-slug';
+import { ensureInitialized } from '../lib/startup-init';
+
+export interface DecodedSession {
+  sessionData: SessionData;
+  jwtPayload: JWTPayload & { sessionToken?: string; redisSessionId?: string };
+}
+
+/**
+ * Try Better Auth's server-side session API.
+ * Returns a DecodedSession if Better Auth has an active session, null otherwise.
+ */
+async function tryBetterAuthSession(
+  requestCookies?: { get: (name: string) => { value: string } | undefined }
+): Promise<DecodedSession | null> {
+  try {
+    const { getBetterAuthInstance } = await import('../auth/better-auth');
+
+    let auth: any = null;
+    try {
+      auth = await getBetterAuthInstance();
+    } catch {
+      return null;
+    }
+
+    if (!auth?.api?.getSession) {
+      return null;
+    }
+
+    // Build headers from cookies for Better Auth to read
+    const cookieStore = requestCookies || (await cookies());
+    const headerObj = new Headers();
+
+    // Collect all cookies into a Cookie header
+    if ('getAll' in cookieStore && typeof cookieStore.getAll === 'function') {
+      const allCookies = (cookieStore as any).getAll();
+      const cookieStr = allCookies.map((c: any) => `${c.name}=${c.value}`).join('; ');
+      headerObj.set('cookie', cookieStr);
+    } else {
+      // Fallback: read known cookie names
+      const sessionCookieName = getSessionCookieName();
+      const secureCookieName = getSecureSessionCookieName();
+      const parts: string[] = [];
+      const sc = cookieStore.get(secureCookieName);
+      if (sc?.value) parts.push(`${secureCookieName}=${sc.value}`);
+      const nc = cookieStore.get(sessionCookieName);
+      if (nc?.value) parts.push(`${sessionCookieName}=${nc.value}`);
+      if (parts.length > 0) headerObj.set('cookie', parts.join('; '));
+    }
+
+    const result = await auth.api.getSession({ headers: headerObj });
+
+    if (!result?.session || !result?.user) {
+      return null;
+    }
+
+    // Read IDP tokens from BA Redis session (stored by callback route after OAuth)
+    let idpTokens: any = null;
+    try {
+      const { getRedis } = await import('../lib/redis');
+      const { getAppSlug } = await import('../lib/app-slug');
+      const baKey = `ba:${getAppSlug()}:${result.session.token}`;
+      const baRaw = await getRedis().get(baKey);
+      if (baRaw) {
+        const baData = JSON.parse(baRaw);
+        idpTokens = baData.idpTokens;
+      }
+    } catch { /* Redis unavailable */ }
+
+    // Map Better Auth session + IDP tokens to SessionData
+    const sessionData: SessionData = {
+      userId: idpTokens?.userId || result.user.id || '',
+      email: idpTokens?.email || result.user.email || '',
+      name: idpTokens?.name || result.user.name || undefined,
+      roles: idpTokens?.roles || [],
+      idpAccessToken: idpTokens?.idpAccessToken,
+      idpRefreshToken: idpTokens?.idpRefreshToken,
+      idpAccessTokenExpires: idpTokens?.idpAccessTokenExpires
+        || (result.session.expiresAt ? new Date(result.session.expiresAt).getTime() : Date.now() + 24 * 60 * 60 * 1000),
+      mfaVerified: idpTokens?.mfaVerified ?? false,
+      oauthProvider: 'google',
+    };
+
+    // Backwards compat: session.user.email works alongside session.email
+    (sessionData as any).user = {
+      id: sessionData.userId,
+      email: sessionData.email,
+      name: sessionData.name,
+      roles: sessionData.roles,
+      image: result.user.image,
+      oauthProvider: sessionData.oauthProvider,
+    };
+
+    const jwtPayload: DecodedSession['jwtPayload'] = {
+      sub: result.user.id,
+      email: result.user.email,
+      name: result.user.name,
+      iat: Math.floor(Date.now() / 1000),
+      exp: sessionData.idpAccessTokenExpires / 1000,
+      sessionToken: result.session.token,
+    };
+
+    return { sessionData, jwtPayload };
+  } catch (error) {
+    console.warn('[DECODE-SESSION] Better Auth session check failed:', error instanceof Error ? error.message : String(error));
+    return null;
+  }
+}
+
+/**
+ * Decode the session from cookies.
+ * Tries Better Auth first, falls back to legacy JWT + Redis.
+ *
+ * @param requestCookies Optional cookie getter for API route context (NextRequest.cookies).
+ *                       If omitted, uses next/headers cookies() for server components.
+ */
+export async function decodeSession(
+  requestCookies?: { get: (name: string) => { value: string } | undefined }
+): Promise<DecodedSession | null> {
+  try {
+    await ensureInitialized();
+
+    // Try Better Auth session first
+    const betterAuthSession = await tryBetterAuthSession(requestCookies);
+    if (betterAuthSession) {
+      return betterAuthSession;
+    }
+
+    // Fall back to legacy JWT + Redis path
+    const cookieStore = requestCookies || (await cookies());
+    const sessionCookieName = getSessionCookieName();
+    const secureCookieName = getSecureSessionCookieName();
+
+    const cookieValue =
+      cookieStore.get(secureCookieName)?.value ||
+      cookieStore.get(sessionCookieName)?.value;
+
+    if (!cookieValue) {
+      return null;
+    }
+
+    const config = await getIDPClientConfig();
+    const secret = config.authSecret;
+    if (!secret) {
+      console.error('[DECODE-SESSION] No authSecret available from IDP config');
+      return null;
+    }
+
+    const secretKey = new TextEncoder().encode(secret);
+    let payload: JWTPayload;
+    try {
+      const result = await jwtVerify(cookieValue, secretKey);
+      payload = result.payload;
+    } catch (jwtError) {
+      console.warn('[DECODE-SESSION] JWT verification failed:', jwtError instanceof Error ? jwtError.message : String(jwtError));
+      return null;
+    }
+
+    const sessionToken = (payload as any).sessionToken || (payload as any).redisSessionId;
+    if (!sessionToken) {
+      console.warn('[DECODE-SESSION] JWT payload missing sessionToken/redisSessionId');
+      return null;
+    }
+
+    const sessionData = await getSession(sessionToken);
+    if (!sessionData) {
+      return null;
+    }
+
+    // Backwards compat: session.user.email works alongside session.email
+    if (!(sessionData as any).user) {
+      (sessionData as any).user = {
+        id: sessionData.userId,
+        email: sessionData.email,
+        name: sessionData.name,
+        roles: sessionData.roles,
+      };
+    }
+
+    return {
+      sessionData,
+      jwtPayload: payload as DecodedSession['jwtPayload'],
+    };
+  } catch (error) {
+    console.error('[DECODE-SESSION] Error:', error instanceof Error ? error.message : String(error));
+    return null;
+  }
+}