@payez/next-mvp 4.0.7 → 4.0.9

package/dist/auth/better-auth.d.ts

@@ -33,11 +33,16 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig): im
     secret: string;
     socialProviders: Record<string, BetterAuthSocialProvider>;
     trustedOrigins: string[];
+    secondaryStorage: {
+        get: (key: string) => Promise<string | null>;
+        set: (key: string, value: string, ttl?: number) => Promise<void>;
+        delete: (key: string) => Promise<void>;
+    };
     session: {
         cookieCache: {
             enabled: true;
             maxAge: number;
-            refreshCache: true;
+            refreshCache: false;
         };
     };
     advanced: {

package/dist/auth/better-auth.js

@@ -22,6 +22,7 @@ const next_js_1 = require("better-auth/next-js");
 const next_js_2 = require("better-auth/next-js");
 const idp_client_config_1 = require("../lib/idp-client-config");
 const app_slug_1 = require("../lib/app-slug");
+const redis_1 = require("../lib/redis");
 /**
  * Build Better Auth social providers from IDP config.
  */
@@ -63,13 +64,40 @@ function createBetterAuthInstance(idpConfig) {
             'http://localhost:3400',
             'http://localhost:3600',
         ],
-        // No database — stateless mode. Better Auth defaults to JWE cookie cache.
-        // Session cookie cache with refreshCache for DB-less setup.
+        // Redis-backed session storage via secondaryStorage
+        secondaryStorage: {
+            get: async (key) => {
+                try {
+                    return await (0, redis_1.getRedis)().get(`ba:${appSlug}:${key}`);
+                }
+                catch {
+                    return null;
+                }
+            },
+            set: async (key, value, ttl) => {
+                try {
+                    const redis = (0, redis_1.getRedis)();
+                    if (ttl) {
+                        await redis.setex(`ba:${appSlug}:${key}`, ttl, value);
+                    }
+                    else {
+                        await redis.setex(`ba:${appSlug}:${key}`, 7 * 24 * 60 * 60, value);
+                    }
+                }
+                catch { /* Redis unavailable — cookie cache still works */ }
+            },
+            delete: async (key) => {
+                try {
+                    await (0, redis_1.getRedis)().del(`ba:${appSlug}:${key}`);
+                }
+                catch { /* ignore */ }
+            },
+        },
         session: {
             cookieCache: {
                 enabled: true,
                 maxAge: 300,
-                refreshCache: true,
+                refreshCache: false,
             },
         },
         // Cookie prefix must match slim-middleware expectations ({slug}.session-token)

package/dist/lib/token-lifecycle.js

@@ -25,6 +25,8 @@ exports.ensureFreshToken = ensureFreshToken;
 exports.getFreshAuthHeader = getFreshAuthHeader;
 const session_store_1 = require("./session-store");
 const auth_1 = require("../server/auth");
+const redis_1 = require("./redis");
+const app_slug_1 = require("./app-slug");
 // 5 minute threshold for "needs refresh" - matches refresh handler pattern
 const REFRESH_THRESHOLD_MS = 5 * 60 * 1000;
 // Concurrent refresh handling configuration
@@ -220,8 +222,45 @@ async function ensureFreshToken(request) {
             };
         }
         const sessionToken = betterAuthSession.session.token;
-        // 2. Get session data from Redis
+        // 2. Get session data from Redis (legacy prefix), or Better Auth's secondary storage
         let sessionData = await (0, session_store_1.getSession)(sessionToken);
+        if (!sessionData) {
+            // Try Better Auth's secondaryStorage key (ba:{slug}:{token})
+            try {
+                const baKey = `ba:${(0, app_slug_1.getAppSlug)()}:${sessionToken}`;
+                const baRaw = await (0, redis_1.getRedis)().get(baKey);
+                if (baRaw) {
+                    const baSession = JSON.parse(baRaw);
+                    // Map Better Auth session to SessionData
+                    sessionData = {
+                        userId: baSession.user?.id || betterAuthSession.user?.id || '',
+                        email: baSession.user?.email || betterAuthSession.user?.email || '',
+                        name: baSession.user?.name || betterAuthSession.user?.name,
+                        roles: [],
+                        idpAccessTokenExpires: baSession.session?.expiresAt
+                            ? new Date(baSession.session.expiresAt).getTime()
+                            : Date.now() + 24 * 60 * 60 * 1000,
+                        mfaVerified: true,
+                        oauthProvider: 'google',
+                    };
+                }
+            }
+            catch { /* Redis unavailable */ }
+        }
+        if (!sessionData) {
+            // Last resort: build from Better Auth in-memory session
+            if (betterAuthSession.user) {
+                sessionData = {
+                    userId: betterAuthSession.user.id || '',
+                    email: betterAuthSession.user.email || '',
+                    name: betterAuthSession.user.name,
+                    roles: [],
+                    idpAccessTokenExpires: Date.now() + 24 * 60 * 60 * 1000,
+                    mfaVerified: true,
+                    oauthProvider: 'google',
+                };
+            }
+        }
         if (!sessionData) {
             return {
                 success: false,

package/dist/server/auth.d.ts

@@ -16,11 +16,16 @@ export declare function getAuthInstance(): Promise<import("better-auth/types").A
     secret: string;
     socialProviders: Record<string, import("../auth/better-auth").BetterAuthSocialProvider>;
     trustedOrigins: string[];
+    secondaryStorage: {
+        get: (key: string) => Promise<string | null>;
+        set: (key: string, value: string, ttl?: number) => Promise<void>;
+        delete: (key: string) => Promise<void>;
+    };
     session: {
         cookieCache: {
             enabled: true;
             maxAge: number;
-            refreshCache: true;
+            refreshCache: false;
         };
     };
     advanced: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "4.0.7",
+  "version": "4.0.9",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/auth/better-auth.ts

@@ -16,6 +16,7 @@ import { toNextJsHandler } from 'better-auth/next-js';
 import type { IDPClientConfig } from '../lib/idp-client-config';
 import { getIDPClientConfig } from '../lib/idp-client-config';
 import { getAppSlug } from '../lib/app-slug';
+import { getRedis } from '../lib/redis';
 
 /**
  * Better Auth social provider config shape.
@@ -76,13 +77,35 @@ export function createBetterAuthInstance(idpConfig: IDPClientConfig) {
       'http://localhost:3600',
     ],
 
-    // No database — stateless mode. Better Auth defaults to JWE cookie cache.
-    // Session cookie cache with refreshCache for DB-less setup.
+    // Redis-backed session storage via secondaryStorage
+    secondaryStorage: {
+      get: async (key: string) => {
+        try {
+          return await getRedis().get(`ba:${appSlug}:${key}`);
+        } catch { return null; }
+      },
+      set: async (key: string, value: string, ttl?: number) => {
+        try {
+          const redis = getRedis();
+          if (ttl) {
+            await redis.setex(`ba:${appSlug}:${key}`, ttl, value);
+          } else {
+            await redis.setex(`ba:${appSlug}:${key}`, 7 * 24 * 60 * 60, value);
+          }
+        } catch { /* Redis unavailable — cookie cache still works */ }
+      },
+      delete: async (key: string) => {
+        try {
+          await getRedis().del(`ba:${appSlug}:${key}`);
+        } catch { /* ignore */ }
+      },
+    },
+
     session: {
       cookieCache: {
         enabled: true,
         maxAge: 300,
-        refreshCache: true,
+        refreshCache: false,
       },
     },
 

package/src/lib/token-lifecycle.ts

@@ -23,6 +23,8 @@
 import { NextRequest } from 'next/server';
 import { getSession as getRedisSession, SessionData } from './session-store';
 import { getSession as getBetterAuthSession } from '../server/auth';
+import { getRedis } from './redis';
+import { getAppSlug } from './app-slug';
 
 // 5 minute threshold for "needs refresh" - matches refresh handler pattern
 const REFRESH_THRESHOLD_MS = 5 * 60 * 1000;
@@ -282,9 +284,47 @@ export async function ensureFreshToken(
 
     const sessionToken = betterAuthSession.session.token;
 
-    // 2. Get session data from Redis
+    // 2. Get session data from Redis (legacy prefix), or Better Auth's secondary storage
     let sessionData = await getRedisSession(sessionToken);
 
+    if (!sessionData) {
+      // Try Better Auth's secondaryStorage key (ba:{slug}:{token})
+      try {
+        const baKey = `ba:${getAppSlug()}:${sessionToken}`;
+        const baRaw = await getRedis().get(baKey);
+        if (baRaw) {
+          const baSession = JSON.parse(baRaw);
+          // Map Better Auth session to SessionData
+          sessionData = {
+            userId: baSession.user?.id || betterAuthSession.user?.id || '',
+            email: baSession.user?.email || betterAuthSession.user?.email || '',
+            name: baSession.user?.name || betterAuthSession.user?.name,
+            roles: [],
+            idpAccessTokenExpires: baSession.session?.expiresAt
+              ? new Date(baSession.session.expiresAt).getTime()
+              : Date.now() + 24 * 60 * 60 * 1000,
+            mfaVerified: true,
+            oauthProvider: 'google',
+          } as SessionData;
+        }
+      } catch { /* Redis unavailable */ }
+    }
+
+    if (!sessionData) {
+      // Last resort: build from Better Auth in-memory session
+      if (betterAuthSession.user) {
+        sessionData = {
+          userId: betterAuthSession.user.id || '',
+          email: betterAuthSession.user.email || '',
+          name: betterAuthSession.user.name,
+          roles: [],
+          idpAccessTokenExpires: Date.now() + 24 * 60 * 60 * 1000,
+          mfaVerified: true,
+          oauthProvider: 'google',
+        } as SessionData;
+      }
+    }
+
     if (!sessionData) {
       return {
         success: false,