@payez/next-mvp 4.1.10 → 4.1.12

package/src/api-handlers/account/masked-info.ts

@@ -1,45 +1,45 @@
-import { NextRequest, NextResponse } from 'next/server';
-import { idpFetchJSON } from '../../lib/idp-fetch';
-import { ENV_CONFIG } from '../../config/env';
-
-// IDP masked-info is POST and uses capital 'A' in /api/Account
-export async function POST(req: NextRequest) {
-  const url = `${ENV_CONFIG.IDP_URL}/api/Account/masked-info`;
-
-  // Forward request body if present; IDP often accepts empty object
-  let body = '{}';
-  try {
-    const raw = await req.text();
-    if (raw && raw.trim().length > 0) body = raw;
-  } catch {}
-
-  const result = await idpFetchJSON(req, url, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body
-  });
-
-  if (!result.ok) {
-    return NextResponse.json(
-      {
-        success: false,
-        message: 'Upstream error',
-        error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: result.json },
-        meta: { attemptedRefresh: result.attemptedRefresh },
-      },
-      { status: result.status }
-    );
-  }
-
-  const bodyJson: any = result.json;
-  // Unwrap if IDP returns envelope { success, data }
-  if (bodyJson && typeof bodyJson === 'object' && 'success' in bodyJson && 'data' in bodyJson) {
-    if ((bodyJson as any).success === true) {
-      return NextResponse.json((bodyJson as any).data, { status: 200 });
-    }
-    return NextResponse.json(bodyJson, { status: 200 });
-  }
-
-  // Passthrough otherwise
-  return NextResponse.json(bodyJson ?? {}, { status: 200 });
-}
+import { NextRequest, NextResponse } from 'next/server';
+import { idpFetchJSON } from '../../lib/idp-fetch';
+import { ENV_CONFIG } from '../../config/env';
+
+// IDP masked-info is POST and uses capital 'A' in /api/Account
+export async function POST(req: NextRequest) {
+  const url = `${ENV_CONFIG.IDP_URL}/api/Account/masked-info`;
+
+  // Forward request body if present; IDP often accepts empty object
+  let body = '{}';
+  try {
+    const raw = await req.text();
+    if (raw && raw.trim().length > 0) body = raw;
+  } catch {}
+
+  const result = await idpFetchJSON(req, url, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body
+  });
+
+  if (!result.ok) {
+    return NextResponse.json(
+      {
+        success: false,
+        message: 'Upstream error',
+        error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: result.json },
+        meta: { attemptedRefresh: result.attemptedRefresh },
+      },
+      { status: result.status }
+    );
+  }
+
+  const bodyJson: any = result.json;
+  // Unwrap if IDP returns envelope { success, data }
+  if (bodyJson && typeof bodyJson === 'object' && 'success' in bodyJson && 'data' in bodyJson) {
+    if ((bodyJson as any).success === true) {
+      return NextResponse.json((bodyJson as any).data, { status: 200 });
+    }
+    return NextResponse.json(bodyJson, { status: 200 });
+  }
+
+  // Passthrough otherwise
+  return NextResponse.json(bodyJson ?? {}, { status: 200 });
+}

package/src/api-handlers/account/profile.ts

@@ -1,80 +1,80 @@
-import { NextRequest, NextResponse } from 'next/server';
-
-/**
- * Account Profile API Handler
- * Simple proxy to IDP profile endpoint
- *
- * GET /api/account/profile - Get user profile
- * PUT /api/account/profile - Update user profile
- */
-
-function getIdpUrl(): string {
-  const url = process.env.IDP_URL;
-  if (!url) {
-    throw new Error('[IDP_URL] FATAL: IDP_URL environment variable is REQUIRED.');
-  }
-  return url;
-}
-
-export async function GET(req: NextRequest) {
-  const IDP_URL = getIdpUrl();
-  const authHeader = req.headers.get('authorization');
-
-  if (!authHeader) {
-    return NextResponse.json(
-      { success: false, error: { code: 'UNAUTHORIZED', message: 'Authentication required' } },
-      { status: 401 }
-    );
-  }
-
-  try {
-    const upstream = await fetch(`${IDP_URL}/api/Account/profile`, {
-      method: 'GET',
-      headers: {
-        'Content-Type': 'application/json',
-        'Authorization': authHeader,
-      },
-    });
-
-    const data = await upstream.json().catch(() => ({}));
-    return NextResponse.json(data, { status: upstream.status });
-  } catch (error) {
-    return NextResponse.json(
-      { success: false, error: { code: 'UPSTREAM_ERROR', message: 'Failed to fetch profile' } },
-      { status: 500 }
-    );
-  }
-}
-
-export async function PUT(req: NextRequest) {
-  const IDP_URL = getIdpUrl();
-  const authHeader = req.headers.get('authorization');
-
-  if (!authHeader) {
-    return NextResponse.json(
-      { success: false, error: { code: 'UNAUTHORIZED', message: 'Authentication required' } },
-      { status: 401 }
-    );
-  }
-
-  try {
-    const body = await req.text();
-
-    const upstream = await fetch(`${IDP_URL}/api/Account/profile`, {
-      method: 'PUT',
-      headers: {
-        'Content-Type': 'application/json',
-        'Authorization': authHeader,
-      },
-      body,
-    });
-
-    const data = await upstream.json().catch(() => ({}));
-    return NextResponse.json(data, { status: upstream.status });
-  } catch (error) {
-    return NextResponse.json(
-      { success: false, error: { code: 'UPSTREAM_ERROR', message: 'Failed to update profile' } },
-      { status: 500 }
-    );
-  }
-}
+import { NextRequest, NextResponse } from 'next/server';
+
+/**
+ * Account Profile API Handler
+ * Simple proxy to IDP profile endpoint
+ *
+ * GET /api/account/profile - Get user profile
+ * PUT /api/account/profile - Update user profile
+ */
+
+function getIdpUrl(): string {
+  const url = process.env.IDP_URL;
+  if (!url) {
+    throw new Error('[IDP_URL] FATAL: IDP_URL environment variable is REQUIRED.');
+  }
+  return url;
+}
+
+export async function GET(req: NextRequest) {
+  const IDP_URL = getIdpUrl();
+  const authHeader = req.headers.get('authorization');
+
+  if (!authHeader) {
+    return NextResponse.json(
+      { success: false, error: { code: 'UNAUTHORIZED', message: 'Authentication required' } },
+      { status: 401 }
+    );
+  }
+
+  try {
+    const upstream = await fetch(`${IDP_URL}/api/Account/profile`, {
+      method: 'GET',
+      headers: {
+        'Content-Type': 'application/json',
+        'Authorization': authHeader,
+      },
+    });
+
+    const data = await upstream.json().catch(() => ({}));
+    return NextResponse.json(data, { status: upstream.status });
+  } catch (error) {
+    return NextResponse.json(
+      { success: false, error: { code: 'UPSTREAM_ERROR', message: 'Failed to fetch profile' } },
+      { status: 500 }
+    );
+  }
+}
+
+export async function PUT(req: NextRequest) {
+  const IDP_URL = getIdpUrl();
+  const authHeader = req.headers.get('authorization');
+
+  if (!authHeader) {
+    return NextResponse.json(
+      { success: false, error: { code: 'UNAUTHORIZED', message: 'Authentication required' } },
+      { status: 401 }
+    );
+  }
+
+  try {
+    const body = await req.text();
+
+    const upstream = await fetch(`${IDP_URL}/api/Account/profile`, {
+      method: 'PUT',
+      headers: {
+        'Content-Type': 'application/json',
+        'Authorization': authHeader,
+      },
+      body,
+    });
+
+    const data = await upstream.json().catch(() => ({}));
+    return NextResponse.json(data, { status: upstream.status });
+  } catch (error) {
+    return NextResponse.json(
+      { success: false, error: { code: 'UPSTREAM_ERROR', message: 'Failed to update profile' } },
+      { status: 500 }
+    );
+  }
+}

package/src/api-handlers/account/recovery/initiate.ts

@@ -1,23 +1,23 @@
-import { NextRequest, NextResponse } from 'next/server';
-
-function getIdpUrl(): string {
-  const url = process.env.IDP_URL;
-  if (!url) throw new Error('[IDP_URL] FATAL: IDP_URL environment variable is REQUIRED.');
-  return url;
-}
-
-export async function POST(req: NextRequest) {
-  const IDP_URL = getIdpUrl();
-  try {
-    const { email } = await req.json();
-    const upstream = await fetch(`${IDP_URL}/api/Account/recovery/initiate`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ email }),
-    });
-    const data = await upstream.json().catch(() => ({}));
-    return NextResponse.json(data, { status: upstream.status });
-  } catch (e) {
-    return NextResponse.json({ success: false, error: 'initiate_failed' }, { status: 500 });
-  }
-}
+import { NextRequest, NextResponse } from 'next/server';
+
+function getIdpUrl(): string {
+  const url = process.env.IDP_URL;
+  if (!url) throw new Error('[IDP_URL] FATAL: IDP_URL environment variable is REQUIRED.');
+  return url;
+}
+
+export async function POST(req: NextRequest) {
+  const IDP_URL = getIdpUrl();
+  try {
+    const { email } = await req.json();
+    const upstream = await fetch(`${IDP_URL}/api/Account/recovery/initiate`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ email }),
+    });
+    const data = await upstream.json().catch(() => ({}));
+    return NextResponse.json(data, { status: upstream.status });
+  } catch (e) {
+    return NextResponse.json({ success: false, error: 'initiate_failed' }, { status: 500 });
+  }
+}

package/src/api-handlers/account/recovery/send-code.ts

@@ -1,25 +1,25 @@
-import { NextRequest, NextResponse } from 'next/server';
-
-function getIdpUrl(): string {
-  const url = process.env.IDP_URL;
-  if (!url) throw new Error('[IDP_URL] FATAL: IDP_URL environment variable is REQUIRED.');
-  return url;
-}
-
-export async function POST(req: NextRequest) {
-  const IDP_URL = getIdpUrl();
-  try {
-    const auth = req.headers.get('authorization') || '';
-    const token = auth.startsWith('Bearer ') ? auth.slice(7) : '';
-    const { method } = await req.json();
-    const upstream = await fetch(`${IDP_URL}/api/Account/recovery/send-code`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${token}` },
-      body: JSON.stringify({ method }),
-    });
-    const data = await upstream.json().catch(() => ({}));
-    return NextResponse.json(data, { status: upstream.status });
-  } catch {
-    return NextResponse.json({ success: false, error: 'send_code_failed' }, { status: 500 });
-  }
-}
+import { NextRequest, NextResponse } from 'next/server';
+
+function getIdpUrl(): string {
+  const url = process.env.IDP_URL;
+  if (!url) throw new Error('[IDP_URL] FATAL: IDP_URL environment variable is REQUIRED.');
+  return url;
+}
+
+export async function POST(req: NextRequest) {
+  const IDP_URL = getIdpUrl();
+  try {
+    const auth = req.headers.get('authorization') || '';
+    const token = auth.startsWith('Bearer ') ? auth.slice(7) : '';
+    const { method } = await req.json();
+    const upstream = await fetch(`${IDP_URL}/api/Account/recovery/send-code`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${token}` },
+      body: JSON.stringify({ method }),
+    });
+    const data = await upstream.json().catch(() => ({}));
+    return NextResponse.json(data, { status: upstream.status });
+  } catch {
+    return NextResponse.json({ success: false, error: 'send_code_failed' }, { status: 500 });
+  }
+}

package/src/api-handlers/account/recovery/verify-code.ts

@@ -1,25 +1,25 @@
-import { NextRequest, NextResponse } from 'next/server';
-
-function getIdpUrl(): string {
-  const url = process.env.IDP_URL;
-  if (!url) throw new Error('[IDP_URL] FATAL: IDP_URL environment variable is REQUIRED.');
-  return url;
-}
-
-export async function POST(req: NextRequest) {
-  const IDP_URL = getIdpUrl();
-  try {
-    const auth = req.headers.get('authorization') || '';
-    const token = auth.startsWith('Bearer ') ? auth.slice(7) : '';
-    const { code, method } = await req.json();
-    const upstream = await fetch(`${IDP_URL}/api/Account/recovery/verify-code`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${token}` },
-      body: JSON.stringify({ code, method }),
-    });
-    const data = await upstream.json().catch(() => ({}));
-    return NextResponse.json(data, { status: upstream.status });
-  } catch {
-    return NextResponse.json({ success: false, error: 'verify_code_failed' }, { status: 500 });
-  }
-}
+import { NextRequest, NextResponse } from 'next/server';
+
+function getIdpUrl(): string {
+  const url = process.env.IDP_URL;
+  if (!url) throw new Error('[IDP_URL] FATAL: IDP_URL environment variable is REQUIRED.');
+  return url;
+}
+
+export async function POST(req: NextRequest) {
+  const IDP_URL = getIdpUrl();
+  try {
+    const auth = req.headers.get('authorization') || '';
+    const token = auth.startsWith('Bearer ') ? auth.slice(7) : '';
+    const { code, method } = await req.json();
+    const upstream = await fetch(`${IDP_URL}/api/Account/recovery/verify-code`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${token}` },
+      body: JSON.stringify({ code, method }),
+    });
+    const data = await upstream.json().catch(() => ({}));
+    return NextResponse.json(data, { status: upstream.status });
+  } catch {
+    return NextResponse.json({ success: false, error: 'verify_code_failed' }, { status: 500 });
+  }
+}

package/src/api-handlers/account/reset-password.ts

@@ -1,23 +1,23 @@
-import { NextRequest, NextResponse } from 'next/server';
-
-function getIdpUrl(): string {
-  const url = process.env.IDP_URL;
-  if (!url) throw new Error('[IDP_URL] FATAL: IDP_URL environment variable is REQUIRED.');
-  return url;
-}
-
-export async function POST(req: NextRequest) {
-  const IDP_URL = getIdpUrl();
-  try {
-    const payload = await req.json();
-    const upstream = await fetch(`${IDP_URL}/api/Account/reset-password`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify(payload),
-    });
-    const data = await upstream.json().catch(() => ({}));
-    return NextResponse.json(data, { status: upstream.status });
-  } catch {
-    return NextResponse.json({ success: false, error: 'reset_password_failed' }, { status: 500 });
-  }
-}
+import { NextRequest, NextResponse } from 'next/server';
+
+function getIdpUrl(): string {
+  const url = process.env.IDP_URL;
+  if (!url) throw new Error('[IDP_URL] FATAL: IDP_URL environment variable is REQUIRED.');
+  return url;
+}
+
+export async function POST(req: NextRequest) {
+  const IDP_URL = getIdpUrl();
+  try {
+    const payload = await req.json();
+    const upstream = await fetch(`${IDP_URL}/api/Account/reset-password`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(payload),
+    });
+    const data = await upstream.json().catch(() => ({}));
+    return NextResponse.json(data, { status: upstream.status });
+  } catch {
+    return NextResponse.json({ success: false, error: 'reset_password_failed' }, { status: 500 });
+  }
+}

package/src/api-handlers/account/send-code.ts

@@ -1,76 +1,76 @@
-/**
- * Send 2FA Verification Code Handler
- *
- * Sends a verification code via email or SMS to the authenticated user.
- * Requires a provisional Bearer token (ACR=1) from initial login.
- *
- * @package @payez/next-mvp
- */
-
-import { NextRequest, NextResponse } from 'next/server';
-import { idpFetchJSON } from '../../lib/idp-fetch';
-import { ENV_CONFIG } from '../../config/env';
-
-export async function POST(req: NextRequest) {
-  try {
-    // Parse request body
-    const body = await req.json();
-    const method = String(body.method || '').toLowerCase();
-
-    if (method !== 'sms' && method !== 'email') {
-      return NextResponse.json(
-        {
-          success: false,
-          error: 'Method must be either "sms" or "email"',
-          code: 'INVALID_METHOD',
-        },
-        { status: 400 }
-      );
-    }
-
-    // Build IDP endpoint URL
-    const idpEndpoint = method === 'sms'
-      ? '/api/ExternalAuth/twofa/sms/send'
-      : '/api/ExternalAuth/twofa/email/send';
-
-    // Send client_id in body (lower_snake_case per PayEz standards)
-    const idpBody = JSON.stringify({ client_id: ENV_CONFIG.CLIENT_ID });
-
-    // Call IDP using idpFetchJSON which auto-injects Bearer token from Redis session
-    const result = await idpFetchJSON(req, `${ENV_CONFIG.IDP_URL}${idpEndpoint}`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: idpBody,
-    });
-
-    if (!result.ok) {
-      return NextResponse.json(
-        {
-          success: false,
-          error: result.json?.message || `Failed to send ${method} code`,
-          code: result.json?.code || 'IDP_ERROR',
-          meta: { attemptedRefresh: result.attemptedRefresh },
-        },
-        { status: result.status }
-      );
-    }
-
-    return NextResponse.json(
-      {
-        success: true,
-        message: `Verification code sent via ${method}`,
-      },
-      { status: 200 }
-    );
-  } catch (error) {
-    console.error('[SEND_CODE] Error:', error);
-    return NextResponse.json(
-      {
-        success: false,
-        error: 'Failed to send verification code',
-        code: 'INTERNAL_ERROR',
-      },
-      { status: 500 }
-    );
-  }
-}
+/**
+ * Send 2FA Verification Code Handler
+ *
+ * Sends a verification code via email or SMS to the authenticated user.
+ * Requires a provisional Bearer token (ACR=1) from initial login.
+ *
+ * @package @payez/next-mvp
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { idpFetchJSON } from '../../lib/idp-fetch';
+import { ENV_CONFIG } from '../../config/env';
+
+export async function POST(req: NextRequest) {
+  try {
+    // Parse request body
+    const body = await req.json();
+    const method = String(body.method || '').toLowerCase();
+
+    if (method !== 'sms' && method !== 'email') {
+      return NextResponse.json(
+        {
+          success: false,
+          error: 'Method must be either "sms" or "email"',
+          code: 'INVALID_METHOD',
+        },
+        { status: 400 }
+      );
+    }
+
+    // Build IDP endpoint URL
+    const idpEndpoint = method === 'sms'
+      ? '/api/ExternalAuth/twofa/sms/send'
+      : '/api/ExternalAuth/twofa/email/send';
+
+    // Send client_id in body (lower_snake_case per PayEz standards)
+    const idpBody = JSON.stringify({ client_id: ENV_CONFIG.CLIENT_ID });
+
+    // Call IDP using idpFetchJSON which auto-injects Bearer token from Redis session
+    const result = await idpFetchJSON(req, `${ENV_CONFIG.IDP_URL}${idpEndpoint}`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: idpBody,
+    });
+
+    if (!result.ok) {
+      return NextResponse.json(
+        {
+          success: false,
+          error: result.json?.message || `Failed to send ${method} code`,
+          code: result.json?.code || 'IDP_ERROR',
+          meta: { attemptedRefresh: result.attemptedRefresh },
+        },
+        { status: result.status }
+      );
+    }
+
+    return NextResponse.json(
+      {
+        success: true,
+        message: `Verification code sent via ${method}`,
+      },
+      { status: 200 }
+    );
+  } catch (error) {
+    console.error('[SEND_CODE] Error:', error);
+    return NextResponse.json(
+      {
+        success: false,
+        error: 'Failed to send verification code',
+        code: 'INTERNAL_ERROR',
+      },
+      { status: 500 }
+    );
+  }
+}