@payez/next-mvp 4.1.10 → 4.1.12

package/src/lib/jwt-decode-client.ts

@@ -1,45 +1,45 @@
-/**
- * Client-safe JWT decode (no Node.js dependencies)
- * This is a lightweight version for browser usage
- */
-
-// Decode base64url
-function base64urlDecode(base64url: string): string {
-  try {
-    // Convert base64url to base64
-    let base64 = base64url.replace(/-/g, '+').replace(/_/g, '/');
-    // Add padding if needed
-    while (base64.length % 4) {
-      base64 += '=';
-    }
-    return atob(base64);
-  } catch (e) {
-    throw new Error('Invalid base64url encoding');
-  }
-}
-
-/**
- * Simple JWT decode for client-side use (no signature verification)
- * @param token - JWT token string
- * @returns Decoded payload or null if invalid
- */
-export function jwtDecode<T = any>(token: string): T | null {
-  if (!token) return null;
-
-  try {
-    const parts = token.split('.');
-    if (parts.length < 2) {
-      console.error('[JWT] Invalid token format');
-      return null;
-    }
-
-    const payload = parts[1];
-    const decoded = base64urlDecode(payload);
-    const parsedPayload = JSON.parse(decoded);
-
-    return parsedPayload;
-  } catch (e) {
-    console.error('[JWT] Decode failed:', e instanceof Error ? e.message : 'Unknown error');
-    return null;
-  }
-}
+/**
+ * Client-safe JWT decode (no Node.js dependencies)
+ * This is a lightweight version for browser usage
+ */
+
+// Decode base64url
+function base64urlDecode(base64url: string): string {
+  try {
+    // Convert base64url to base64
+    let base64 = base64url.replace(/-/g, '+').replace(/_/g, '/');
+    // Add padding if needed
+    while (base64.length % 4) {
+      base64 += '=';
+    }
+    return atob(base64);
+  } catch (e) {
+    throw new Error('Invalid base64url encoding');
+  }
+}
+
+/**
+ * Simple JWT decode for client-side use (no signature verification)
+ * @param token - JWT token string
+ * @returns Decoded payload or null if invalid
+ */
+export function jwtDecode<T = any>(token: string): T | null {
+  if (!token) return null;
+
+  try {
+    const parts = token.split('.');
+    if (parts.length < 2) {
+      console.error('[JWT] Invalid token format');
+      return null;
+    }
+
+    const payload = parts[1];
+    const decoded = base64urlDecode(payload);
+    const parsedPayload = JSON.parse(decoded);
+
+    return parsedPayload;
+  } catch (e) {
+    console.error('[JWT] Decode failed:', e instanceof Error ? e.message : 'Unknown error');
+    return null;
+  }
+}

package/src/lib/rate-limit-service.ts

@@ -1,9 +1,9 @@
-import redis from '../lib/redis';
-import { logger } from '../config/logger';
-
-export interface RateLimitRule { endpoint: string; period: string; limit: number; }
-export interface RateLimitResult { isAllowed: boolean; requestCount: number; limit: number; retryAfterSeconds?: number; failedAttempts?: number; }
-
-export function createPayEzRateLimitResponse(retryAfterSeconds: number, remainingAttempts: number = 0) {
-  return { success: false, message: 'Too many failed attempts', user_info: null, errors: [ { code: 'RateLimitExceeded', message: 'Too many failed authentication attempts', resolution: `Please try again in ${retryAfterSeconds} seconds`, remainingAttempts } ] };
-}
+import redis from '../lib/redis';
+import { logger } from '../config/logger';
+
+export interface RateLimitRule { endpoint: string; period: string; limit: number; }
+export interface RateLimitResult { isAllowed: boolean; requestCount: number; limit: number; retryAfterSeconds?: number; failedAttempts?: number; }
+
+export function createPayEzRateLimitResponse(retryAfterSeconds: number, remainingAttempts: number = 0) {
+  return { success: false, message: 'Too many failed attempts', user_info: null, errors: [ { code: 'RateLimitExceeded', message: 'Too many failed authentication attempts', resolution: `Please try again in ${retryAfterSeconds} seconds`, remainingAttempts } ] };
+}

package/src/lib/redis.ts

@@ -1,27 +1,27 @@
-// E:\Repos\PayEz-Next-MVP\packages\next-mvp\src\lib\redis.ts
-import Redis, { RedisOptions } from 'ioredis';
-
-let client: Redis | null = null;
-
-function createClient(): Redis {
-  const url = process.env.REDIS_URL;
-
-  if (url && url.trim() !== '') {
-    // Use a standard configuration for better Docker compatibility
-    return new Redis(url);
-  }
-
-  // No REDIS_URL set, create a client that will fail fast.
-  return new Redis({ lazyConnect: true });
-}
-
-export function getRedis(): Redis {
-  if (!client) {
-    client = createClient();
-  }
-  return client;
-}
-
-const redis = getRedis();
-export { redis };
+// E:\Repos\PayEz-Next-MVP\packages\next-mvp\src\lib\redis.ts
+import Redis, { RedisOptions } from 'ioredis';
+
+let client: Redis | null = null;
+
+function createClient(): Redis {
+  const url = process.env.REDIS_URL;
+
+  if (url && url.trim() !== '') {
+    // Use a standard configuration for better Docker compatibility
+    return new Redis(url);
+  }
+
+  // No REDIS_URL set, create a client that will fail fast.
+  return new Redis({ lazyConnect: true });
+}
+
+export function getRedis(): Redis {
+  if (!client) {
+    client = createClient();
+  }
+  return client;
+}
+
+const redis = getRedis();
+export { redis };
 export default redis;

package/src/lib/refresh-token-validator.ts

@@ -1,64 +1,64 @@
-import { jwtDecode } from './jwt-decode';
-import { tokenRefreshLogger } from '../config/logger';
-
-interface RefreshTokenPayload { exp: number; iat: number; jti: string; user_id: string; token_type: string; binding: string; }
-
-export function isRefreshTokenValid(token: string): boolean {
-  if (!token) return false;
-  try { const decoded = jwtDecode<RefreshTokenPayload>(token); if (!decoded) return false; const now = Math.floor(Date.now() / 1000); if (decoded.exp < now) return false; if (decoded.token_type !== 'refresh_token') return false; return true; } catch { return false; }
-}
-
-export function isRefreshTokenExpiring(token: string, bufferMinutes: number = 60): boolean {
-  if (!token) return true;
-  try { const decoded = jwtDecode<RefreshTokenPayload>(token); if (!decoded?.exp) return true; const now = Math.floor(Date.now() / 1000); const buffer = bufferMinutes * 60; return decoded.exp <= (now + buffer); } catch { return true; }
-}
-
-export function getRefreshTokenExpiration(token: string): number | null {
-  if (!token) return null; try { const decoded = jwtDecode<RefreshTokenPayload>(token); if (!decoded?.exp) return null; return decoded.exp * 1000; } catch { return null; }
-}
-
-export function getRefreshTokenTimeRemaining(token: string): number | null {
-  if (!token) return null; try { const decoded = jwtDecode<RefreshTokenPayload>(token); if (!decoded?.exp) return null; const now = Math.floor(Date.now() / 1000); const timeRemaining = decoded.exp - now; return timeRemaining > 0 ? timeRemaining : null; } catch { return null; }
-}
-
-export interface RefreshViabilityCheck {
-  canRefresh: boolean;
-  reason: 'valid_refresh_token' | 'no_refresh_token' | 'refresh_token_expired' | 'session_missing';
-  timeRemaining?: number;
-  expiresAt?: string;
-  accessTokenExpired?: boolean;
-  accessTokenTimeRemaining?: number;
-}
-
-export function checkRefreshViability(sessionData: any): RefreshViabilityCheck {
-  if (!sessionData) return { canRefresh: false, reason: 'session_missing' };
-  let accessTokenExpired = false; let accessTokenTimeRemaining: number | undefined;
-  if (sessionData.idpAccessTokenExpires) {
-    const now = Date.now(); let expiresAtMs = sessionData.idpAccessTokenExpires;
-    if (typeof expiresAtMs === 'string') expiresAtMs = parseInt(expiresAtMs, 10);
-    if (expiresAtMs < 1000000000000) expiresAtMs = expiresAtMs * 1000;
-    accessTokenTimeRemaining = Math.floor((expiresAtMs - now) / 1000);
-    const bufferSec = 5 * 60; // 5 minutes pre-expiry buffer
-    accessTokenExpired = accessTokenTimeRemaining <= bufferSec;
-    tokenRefreshLogger.debug('[REFRESH_VIABILITY] Access token expiration check', { now, expiresAtMs, accessTokenTimeRemaining, bufferSec, accessTokenExpired });
-  }
-  if (!sessionData.idpRefreshToken) return { canRefresh: false, reason: 'no_refresh_token', accessTokenExpired, accessTokenTimeRemaining };
-  if (sessionData.idpRefreshTokenExpires) {
-    let refreshExpMs = sessionData.idpRefreshTokenExpires;
-    if (typeof refreshExpMs === 'string') refreshExpMs = parseInt(refreshExpMs, 10);
-    if (refreshExpMs < 1000000000000) refreshExpMs = refreshExpMs * 1000;
-    const nowMs = Date.now(); const timeRemainingSec = Math.floor((refreshExpMs - nowMs) / 1000);
-    if (timeRemainingSec <= 0) return { canRefresh: false, reason: 'refresh_token_expired', accessTokenExpired, accessTokenTimeRemaining };
-    return { canRefresh: true, reason: 'valid_refresh_token', timeRemaining: timeRemainingSec, expiresAt: new Date(refreshExpMs).toISOString(), accessTokenExpired, accessTokenTimeRemaining };
-  }
-  try {
-    const decoded = jwtDecode<RefreshTokenPayload>(sessionData.idpRefreshToken); const nowSec = Math.floor(Date.now() / 1000);
-    if (!decoded?.exp || decoded.token_type !== 'refresh_token') return { canRefresh: false, reason: 'refresh_token_expired', accessTokenExpired, accessTokenTimeRemaining };
-    const timeRemaining = decoded.exp - nowSec; if (timeRemaining <= 0) return { canRefresh: false, reason: 'refresh_token_expired', accessTokenExpired, accessTokenTimeRemaining };
-    const expiresAtIso = new Date(decoded.exp * 1000).toISOString();
-    return { canRefresh: true, reason: 'valid_refresh_token', timeRemaining, expiresAt: expiresAtIso, accessTokenExpired, accessTokenTimeRemaining };
-  } catch (error) {
-    tokenRefreshLogger.debug('[REFRESH_VIABILITY] Failed to decode refresh token for viability', { error: error instanceof Error ? error.message : String(error) });
-    return { canRefresh: false, reason: 'refresh_token_expired', accessTokenExpired, accessTokenTimeRemaining };
-  }
-}
+import { jwtDecode } from './jwt-decode';
+import { tokenRefreshLogger } from '../config/logger';
+
+interface RefreshTokenPayload { exp: number; iat: number; jti: string; user_id: string; token_type: string; binding: string; }
+
+export function isRefreshTokenValid(token: string): boolean {
+  if (!token) return false;
+  try { const decoded = jwtDecode<RefreshTokenPayload>(token); if (!decoded) return false; const now = Math.floor(Date.now() / 1000); if (decoded.exp < now) return false; if (decoded.token_type !== 'refresh_token') return false; return true; } catch { return false; }
+}
+
+export function isRefreshTokenExpiring(token: string, bufferMinutes: number = 60): boolean {
+  if (!token) return true;
+  try { const decoded = jwtDecode<RefreshTokenPayload>(token); if (!decoded?.exp) return true; const now = Math.floor(Date.now() / 1000); const buffer = bufferMinutes * 60; return decoded.exp <= (now + buffer); } catch { return true; }
+}
+
+export function getRefreshTokenExpiration(token: string): number | null {
+  if (!token) return null; try { const decoded = jwtDecode<RefreshTokenPayload>(token); if (!decoded?.exp) return null; return decoded.exp * 1000; } catch { return null; }
+}
+
+export function getRefreshTokenTimeRemaining(token: string): number | null {
+  if (!token) return null; try { const decoded = jwtDecode<RefreshTokenPayload>(token); if (!decoded?.exp) return null; const now = Math.floor(Date.now() / 1000); const timeRemaining = decoded.exp - now; return timeRemaining > 0 ? timeRemaining : null; } catch { return null; }
+}
+
+export interface RefreshViabilityCheck {
+  canRefresh: boolean;
+  reason: 'valid_refresh_token' | 'no_refresh_token' | 'refresh_token_expired' | 'session_missing';
+  timeRemaining?: number;
+  expiresAt?: string;
+  accessTokenExpired?: boolean;
+  accessTokenTimeRemaining?: number;
+}
+
+export function checkRefreshViability(sessionData: any): RefreshViabilityCheck {
+  if (!sessionData) return { canRefresh: false, reason: 'session_missing' };
+  let accessTokenExpired = false; let accessTokenTimeRemaining: number | undefined;
+  if (sessionData.idpAccessTokenExpires) {
+    const now = Date.now(); let expiresAtMs = sessionData.idpAccessTokenExpires;
+    if (typeof expiresAtMs === 'string') expiresAtMs = parseInt(expiresAtMs, 10);
+    if (expiresAtMs < 1000000000000) expiresAtMs = expiresAtMs * 1000;
+    accessTokenTimeRemaining = Math.floor((expiresAtMs - now) / 1000);
+    const bufferSec = 5 * 60; // 5 minutes pre-expiry buffer
+    accessTokenExpired = accessTokenTimeRemaining <= bufferSec;
+    tokenRefreshLogger.debug('[REFRESH_VIABILITY] Access token expiration check', { now, expiresAtMs, accessTokenTimeRemaining, bufferSec, accessTokenExpired });
+  }
+  if (!sessionData.idpRefreshToken) return { canRefresh: false, reason: 'no_refresh_token', accessTokenExpired, accessTokenTimeRemaining };
+  if (sessionData.idpRefreshTokenExpires) {
+    let refreshExpMs = sessionData.idpRefreshTokenExpires;
+    if (typeof refreshExpMs === 'string') refreshExpMs = parseInt(refreshExpMs, 10);
+    if (refreshExpMs < 1000000000000) refreshExpMs = refreshExpMs * 1000;
+    const nowMs = Date.now(); const timeRemainingSec = Math.floor((refreshExpMs - nowMs) / 1000);
+    if (timeRemainingSec <= 0) return { canRefresh: false, reason: 'refresh_token_expired', accessTokenExpired, accessTokenTimeRemaining };
+    return { canRefresh: true, reason: 'valid_refresh_token', timeRemaining: timeRemainingSec, expiresAt: new Date(refreshExpMs).toISOString(), accessTokenExpired, accessTokenTimeRemaining };
+  }
+  try {
+    const decoded = jwtDecode<RefreshTokenPayload>(sessionData.idpRefreshToken); const nowSec = Math.floor(Date.now() / 1000);
+    if (!decoded?.exp || decoded.token_type !== 'refresh_token') return { canRefresh: false, reason: 'refresh_token_expired', accessTokenExpired, accessTokenTimeRemaining };
+    const timeRemaining = decoded.exp - nowSec; if (timeRemaining <= 0) return { canRefresh: false, reason: 'refresh_token_expired', accessTokenExpired, accessTokenTimeRemaining };
+    const expiresAtIso = new Date(decoded.exp * 1000).toISOString();
+    return { canRefresh: true, reason: 'valid_refresh_token', timeRemaining, expiresAt: expiresAtIso, accessTokenExpired, accessTokenTimeRemaining };
+  } catch (error) {
+    tokenRefreshLogger.debug('[REFRESH_VIABILITY] Failed to decode refresh token for viability', { error: error instanceof Error ? error.message : String(error) });
+    return { canRefresh: false, reason: 'refresh_token_expired', accessTokenExpired, accessTokenTimeRemaining };
+  }
+}

package/src/lib/secret-validation.ts

@@ -1,8 +1,8 @@
-export function validateAuthSecret(secret: string): { valid: boolean; reason?: string } {
-  if (!secret || typeof secret !== 'string') return { valid: false, reason: 'missing' };
-  if (secret.length < 32) return { valid: false, reason: 'too_short' };
-  const classes = [/[a-z]/, /[A-Z]/, /[0-9]/, /[^a-zA-Z0-9]/];
-  const score = classes.reduce((acc, re) => acc + (re.test(secret) ? 1 : 0), 0);
-  if (score < 3) return { valid: false, reason: 'weak' };
-  return { valid: true };
-}
+export function validateAuthSecret(secret: string): { valid: boolean; reason?: string } {
+  if (!secret || typeof secret !== 'string') return { valid: false, reason: 'missing' };
+  if (secret.length < 32) return { valid: false, reason: 'too_short' };
+  const classes = [/[a-z]/, /[A-Z]/, /[0-9]/, /[^a-zA-Z0-9]/];
+  const score = classes.reduce((acc, re) => acc + (re.test(secret) ? 1 : 0), 0);
+  if (score < 3) return { valid: false, reason: 'weak' };
+  return { valid: true };
+}