@payez/next-mvp 4.0.8 → 4.0.10

package/dist/auth/better-auth.d.ts

@@ -42,6 +42,7 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig): im
         cookieCache: {
             enabled: true;
             maxAge: number;
+            refreshCache: false;
         };
     };
     advanced: {

package/dist/auth/better-auth.js

@@ -97,6 +97,7 @@ function createBetterAuthInstance(idpConfig) {
             cookieCache: {
                 enabled: true,
                 maxAge: 300,
+                refreshCache: false,
             },
         },
         // Cookie prefix must match slim-middleware expectations ({slug}.session-token)

package/dist/lib/token-lifecycle.js

@@ -25,6 +25,8 @@ exports.ensureFreshToken = ensureFreshToken;
 exports.getFreshAuthHeader = getFreshAuthHeader;
 const session_store_1 = require("./session-store");
 const auth_1 = require("../server/auth");
+const redis_1 = require("./redis");
+const app_slug_1 = require("./app-slug");
 // 5 minute threshold for "needs refresh" - matches refresh handler pattern
 const REFRESH_THRESHOLD_MS = 5 * 60 * 1000;
 // Concurrent refresh handling configuration
@@ -220,8 +222,45 @@ async function ensureFreshToken(request) {
             };
         }
         const sessionToken = betterAuthSession.session.token;
-        // 2. Get session data from Redis
+        // 2. Get session data from Redis (legacy prefix), or Better Auth's secondary storage
         let sessionData = await (0, session_store_1.getSession)(sessionToken);
+        if (!sessionData) {
+            // Try Better Auth's secondaryStorage key (ba:{slug}:{token})
+            try {
+                const baKey = `ba:${(0, app_slug_1.getAppSlug)()}:${sessionToken}`;
+                const baRaw = await (0, redis_1.getRedis)().get(baKey);
+                if (baRaw) {
+                    const baSession = JSON.parse(baRaw);
+                    // Map Better Auth session to SessionData
+                    sessionData = {
+                        userId: baSession.user?.id || betterAuthSession.user?.id || '',
+                        email: baSession.user?.email || betterAuthSession.user?.email || '',
+                        name: baSession.user?.name || betterAuthSession.user?.name,
+                        roles: [],
+                        idpAccessTokenExpires: baSession.session?.expiresAt
+                            ? new Date(baSession.session.expiresAt).getTime()
+                            : Date.now() + 24 * 60 * 60 * 1000,
+                        mfaVerified: true,
+                        oauthProvider: 'google',
+                    };
+                }
+            }
+            catch { /* Redis unavailable */ }
+        }
+        if (!sessionData) {
+            // Last resort: build from Better Auth in-memory session
+            if (betterAuthSession.user) {
+                sessionData = {
+                    userId: betterAuthSession.user.id || '',
+                    email: betterAuthSession.user.email || '',
+                    name: betterAuthSession.user.name,
+                    roles: [],
+                    idpAccessTokenExpires: Date.now() + 24 * 60 * 60 * 1000,
+                    mfaVerified: true,
+                    oauthProvider: 'google',
+                };
+            }
+        }
         if (!sessionData) {
             return {
                 success: false,
@@ -313,17 +352,10 @@ async function ensureFreshToken(request) {
             // immediately available in Vibe's JWKS cache
             await delay(KEY_PROPAGATION_DELAY_MS);
         }
-        // 6. Validate we have a token
-        if (!sessionData.idpAccessToken) {
-            return {
-                success: false,
-                error: 'NO_TOKEN',
-                message: 'No access token available',
-            };
-        }
+        // 6. Return session — accessToken may be empty for social-only OAuth sessions
         return {
             success: true,
-            accessToken: sessionData.idpAccessToken,
+            accessToken: sessionData.idpAccessToken || '',
             sessionData,
         };
     }

package/dist/server/auth.d.ts

@@ -25,6 +25,7 @@ export declare function getAuthInstance(): Promise<import("better-auth/types").A
         cookieCache: {
             enabled: true;
             maxAge: number;
+            refreshCache: false;
         };
     };
     advanced: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "4.0.8",
+  "version": "4.0.10",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/auth/better-auth.ts

@@ -105,6 +105,7 @@ export function createBetterAuthInstance(idpConfig: IDPClientConfig) {
       cookieCache: {
         enabled: true,
         maxAge: 300,
+        refreshCache: false,
       },
     },
 

package/src/lib/token-lifecycle.ts

@@ -23,6 +23,8 @@
 import { NextRequest } from 'next/server';
 import { getSession as getRedisSession, SessionData } from './session-store';
 import { getSession as getBetterAuthSession } from '../server/auth';
+import { getRedis } from './redis';
+import { getAppSlug } from './app-slug';
 
 // 5 minute threshold for "needs refresh" - matches refresh handler pattern
 const REFRESH_THRESHOLD_MS = 5 * 60 * 1000;
@@ -282,9 +284,47 @@ export async function ensureFreshToken(
 
     const sessionToken = betterAuthSession.session.token;
 
-    // 2. Get session data from Redis
+    // 2. Get session data from Redis (legacy prefix), or Better Auth's secondary storage
     let sessionData = await getRedisSession(sessionToken);
 
+    if (!sessionData) {
+      // Try Better Auth's secondaryStorage key (ba:{slug}:{token})
+      try {
+        const baKey = `ba:${getAppSlug()}:${sessionToken}`;
+        const baRaw = await getRedis().get(baKey);
+        if (baRaw) {
+          const baSession = JSON.parse(baRaw);
+          // Map Better Auth session to SessionData
+          sessionData = {
+            userId: baSession.user?.id || betterAuthSession.user?.id || '',
+            email: baSession.user?.email || betterAuthSession.user?.email || '',
+            name: baSession.user?.name || betterAuthSession.user?.name,
+            roles: [],
+            idpAccessTokenExpires: baSession.session?.expiresAt
+              ? new Date(baSession.session.expiresAt).getTime()
+              : Date.now() + 24 * 60 * 60 * 1000,
+            mfaVerified: true,
+            oauthProvider: 'google',
+          } as SessionData;
+        }
+      } catch { /* Redis unavailable */ }
+    }
+
+    if (!sessionData) {
+      // Last resort: build from Better Auth in-memory session
+      if (betterAuthSession.user) {
+        sessionData = {
+          userId: betterAuthSession.user.id || '',
+          email: betterAuthSession.user.email || '',
+          name: betterAuthSession.user.name,
+          roles: [],
+          idpAccessTokenExpires: Date.now() + 24 * 60 * 60 * 1000,
+          mfaVerified: true,
+          oauthProvider: 'google',
+        } as SessionData;
+      }
+    }
+
     if (!sessionData) {
       return {
         success: false,
@@ -386,18 +426,10 @@ export async function ensureFreshToken(
       await delay(KEY_PROPAGATION_DELAY_MS);
     }
 
-    // 6. Validate we have a token
-    if (!sessionData.idpAccessToken) {
-      return {
-        success: false,
-        error: 'NO_TOKEN',
-        message: 'No access token available',
-      };
-    }
-
+    // 6. Return session — accessToken may be empty for social-only OAuth sessions
     return {
       success: true,
-      accessToken: sessionData.idpAccessToken,
+      accessToken: sessionData.idpAccessToken || '',
       sessionData,
     };
   } catch (error) {