@payez/next-mvp 4.1.10 → 4.1.12

package/src/api-handlers/session/viability.ts

@@ -1,143 +1,143 @@
-/**
- * Session Viability Check API Handler for `@payez/next-mvp`
- *
- * This API route is called by the middleware to securely check if a session is valid.
- */
-
-import { NextRequest, NextResponse } from 'next/server';
-import { getSession as getRedisSession, getBetterAuthSession } from '../../lib/session-store';
-import { getSession } from '../../server/auth';
-import { isInitializationFailed, ensureInitialized } from '../../lib/startup-init';
-import { getIDPClientConfig } from '../../lib/idp-client-config';
-
-export async function GET(req: NextRequest) {
-  try {
-    // Ensure initialization is complete (auth signing secret resolved from IDP)
-    if (!process.env.BETTER_AUTH_SECRET && !process.env.NEXTAUTH_SECRET) {
-      try {
-        await ensureInitialized();
-      } catch (error) {
-        // Initialization failed - return 503
-        console.error('[API Viability] Initialization failed - returning 503');
-        return NextResponse.json(
-          {
-            error: 'Service Unavailable',
-            message: 'Authentication service is not properly configured',
-            code: 'AUTH_NOT_INITIALIZED'
-          },
-          { status: 503 }
-        );
-      }
-    }
-
-    // Double-check after initialization attempt
-    if (isInitializationFailed()) {
-      console.error('[API Viability] Initialization failed - returning 503');
-      return NextResponse.json(
-        {
-          error: 'Service Unavailable',
-          message: 'Authentication service is not properly configured',
-          code: 'AUTH_NOT_INITIALIZED'
-        },
-        { status: 503 }
-      );
-    }
-
-    // Get session from Better Auth
-    const betterAuthSession = await getSession(req);
-
-    // Debug logging
-    if (!betterAuthSession) {
-      console.warn('[VIABILITY] getSession returned null');
-    }
-
-    const sessionToken = betterAuthSession?.session?.token as string | undefined;
-    if (betterAuthSession && sessionToken) {
-      // Try legacy session store first, then Better Auth format
-      let sessionData = await getRedisSession(sessionToken);
-      if (!sessionData) {
-        // Better Auth stores sessions with ba:{appSlug}:{token} prefix
-        sessionData = await getBetterAuthSession(sessionToken);
-        if (sessionData) {
-          console.log('[VIABILITY] Found session in Better Auth store');
-        }
-      }
-      if (sessionData) {
-        // The session exists in Redis
-
-        // Check if access token is expired (for middleware decision-making)
-        const accessTokenExpires = sessionData.idpAccessTokenExpires || 0;
-        const accessTokenExpired = accessTokenExpires < Date.now();
-
-        // Get requires2FA from cached client config (client-wide setting)
-        let requires2FA = true; // Default to true for security
-        try {
-          const cachedConfig = await getIDPClientConfig();
-          requires2FA = cachedConfig.authSettings?.require2FA ?? true;
-        } catch (e) {
-          console.warn('[API Viability] Could not get client config, defaulting requires2FA to true');
-        }
-
-        // CRITICAL: OAuth sessions without refresh token always need 2FA completion
-        // to obtain a refresh token from the IDP. The OAuth callback sets mfaVerified=false
-        // when no refresh_token is present. This must override the client config.
-        if (sessionData.mfaVerified === false && !sessionData.idpRefreshToken) {
-          requires2FA = true;
-        }
-
-        // CRITICAL: Check if MFA has expired (2FA TTL enforcement)
-        // The session may have mfaVerified=true from days ago, but if mfaExpiresAt
-        // has passed, we must treat 2FA as incomplete to force re-verification.
-        const mfaExpiresAt = sessionData.mfaExpiresAt || 0;
-        const mfaExpired = mfaExpiresAt > 0 && mfaExpiresAt < Date.now();
-        // Check both field names for compatibility (mfaVerified is the normalized name)
-        const sessionMfaComplete = sessionData.mfaVerified ?? (sessionData as any).twoFactorComplete ?? false;
-        const effectiveTwoFactorComplete = sessionMfaComplete && !mfaExpired;
-
-        console.log('[VIABILITY] Session 2FA check:', {
-          sessionToken: sessionToken.substring(0, 8) + '...',
-          mfaVerified: sessionData.mfaVerified,
-          twoFactorComplete: (sessionData as any).twoFactorComplete,
-          sessionMfaComplete,
-          mfaExpired,
-          effectiveTwoFactorComplete,
-        });
-
-        if (mfaExpired && sessionMfaComplete) {
-          console.warn('[API Viability] MFA expired - forcing 2FA re-verification', {
-            mfaExpiresAt: new Date(mfaExpiresAt).toISOString(),
-            now: new Date().toISOString(),
-            hoursExpiredAgo: ((Date.now() - mfaExpiresAt) / (1000 * 60 * 60)).toFixed(1)
-          });
-        }
-
-        const response = {
-          authenticated: true,
-          sessionToken, // Include token for middleware tracking
-          // 2FA fields - critical for middleware redirect logic
-          requires2FA, // From cached client config (client-wide setting)
-          twoFactorComplete: effectiveTwoFactorComplete, // From session, BUT respects MFA TTL
-          // Token status for refresh decisions
-          accessTokenExpired,
-          hasRefreshToken: !!sessionData.idpRefreshToken
-        };
-        return NextResponse.json(response);
-      }
-
-      // CRITICAL: Cookie exists but Redis session is missing (stale cookie state)
-      // Return sessionToken so middleware can detect this and clear the stale cookie
-      console.warn('[VIABILITY] Stale cookie detected - session not in Redis');
-      return NextResponse.json({
-        authenticated: false,
-        sessionToken // Include token to enable stale cookie detection
-      });
-    }
-
-    // If there's no token at all, it's not authenticated
-    return NextResponse.json({ authenticated: false });
-
-  } catch (error) {
-    console.error('[API Viability] Error checking session viability:', error);
-    return NextResponse.json({ authenticated: false }, { status: 500 });
-  }
+/**
+ * Session Viability Check API Handler for `@payez/next-mvp`
+ *
+ * This API route is called by the middleware to securely check if a session is valid.
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { getSession as getRedisSession, getBetterAuthSession } from '../../lib/session-store';
+import { getSession } from '../../server/auth';
+import { isInitializationFailed, ensureInitialized } from '../../lib/startup-init';
+import { getIDPClientConfig } from '../../lib/idp-client-config';
+
+export async function GET(req: NextRequest) {
+  try {
+    // Ensure initialization is complete (auth signing secret resolved from IDP)
+    if (!process.env.BETTER_AUTH_SECRET && !process.env.NEXTAUTH_SECRET) {
+      try {
+        await ensureInitialized();
+      } catch (error) {
+        // Initialization failed - return 503
+        console.error('[API Viability] Initialization failed - returning 503');
+        return NextResponse.json(
+          {
+            error: 'Service Unavailable',
+            message: 'Authentication service is not properly configured',
+            code: 'AUTH_NOT_INITIALIZED'
+          },
+          { status: 503 }
+        );
+      }
+    }
+
+    // Double-check after initialization attempt
+    if (isInitializationFailed()) {
+      console.error('[API Viability] Initialization failed - returning 503');
+      return NextResponse.json(
+        {
+          error: 'Service Unavailable',
+          message: 'Authentication service is not properly configured',
+          code: 'AUTH_NOT_INITIALIZED'
+        },
+        { status: 503 }
+      );
+    }
+
+    // Get session from Better Auth
+    const betterAuthSession = await getSession(req);
+
+    // Debug logging
+    if (!betterAuthSession) {
+      console.warn('[VIABILITY] getSession returned null');
+    }
+
+    const sessionToken = betterAuthSession?.session?.token as string | undefined;
+    if (betterAuthSession && sessionToken) {
+      // Try legacy session store first, then Better Auth format
+      let sessionData = await getRedisSession(sessionToken);
+      if (!sessionData) {
+        // Better Auth stores sessions with ba:{appSlug}:{token} prefix
+        sessionData = await getBetterAuthSession(sessionToken);
+        if (sessionData) {
+          console.log('[VIABILITY] Found session in Better Auth store');
+        }
+      }
+      if (sessionData) {
+        // The session exists in Redis
+
+        // Check if access token is expired (for middleware decision-making)
+        const accessTokenExpires = sessionData.idpAccessTokenExpires || 0;
+        const accessTokenExpired = accessTokenExpires < Date.now();
+
+        // Get requires2FA from cached client config (client-wide setting)
+        let requires2FA = true; // Default to true for security
+        try {
+          const cachedConfig = await getIDPClientConfig();
+          requires2FA = cachedConfig.authSettings?.require2FA ?? true;
+        } catch (e) {
+          console.warn('[API Viability] Could not get client config, defaulting requires2FA to true');
+        }
+
+        // CRITICAL: OAuth sessions without refresh token always need 2FA completion
+        // to obtain a refresh token from the IDP. The OAuth callback sets mfaVerified=false
+        // when no refresh_token is present. This must override the client config.
+        if (sessionData.mfaVerified === false && !sessionData.idpRefreshToken) {
+          requires2FA = true;
+        }
+
+        // CRITICAL: Check if MFA has expired (2FA TTL enforcement)
+        // The session may have mfaVerified=true from days ago, but if mfaExpiresAt
+        // has passed, we must treat 2FA as incomplete to force re-verification.
+        const mfaExpiresAt = sessionData.mfaExpiresAt || 0;
+        const mfaExpired = mfaExpiresAt > 0 && mfaExpiresAt < Date.now();
+        // Check both field names for compatibility (mfaVerified is the normalized name)
+        const sessionMfaComplete = sessionData.mfaVerified ?? (sessionData as any).twoFactorComplete ?? false;
+        const effectiveTwoFactorComplete = sessionMfaComplete && !mfaExpired;
+
+        console.log('[VIABILITY] Session 2FA check:', {
+          sessionToken: sessionToken.substring(0, 8) + '...',
+          mfaVerified: sessionData.mfaVerified,
+          twoFactorComplete: (sessionData as any).twoFactorComplete,
+          sessionMfaComplete,
+          mfaExpired,
+          effectiveTwoFactorComplete,
+        });
+
+        if (mfaExpired && sessionMfaComplete) {
+          console.warn('[API Viability] MFA expired - forcing 2FA re-verification', {
+            mfaExpiresAt: new Date(mfaExpiresAt).toISOString(),
+            now: new Date().toISOString(),
+            hoursExpiredAgo: ((Date.now() - mfaExpiresAt) / (1000 * 60 * 60)).toFixed(1)
+          });
+        }
+
+        const response = {
+          authenticated: true,
+          sessionToken, // Include token for middleware tracking
+          // 2FA fields - critical for middleware redirect logic
+          requires2FA, // From cached client config (client-wide setting)
+          twoFactorComplete: effectiveTwoFactorComplete, // From session, BUT respects MFA TTL
+          // Token status for refresh decisions
+          accessTokenExpired,
+          hasRefreshToken: !!sessionData.idpRefreshToken
+        };
+        return NextResponse.json(response);
+      }
+
+      // CRITICAL: Cookie exists but Redis session is missing (stale cookie state)
+      // Return sessionToken so middleware can detect this and clear the stale cookie
+      console.warn('[VIABILITY] Stale cookie detected - session not in Redis');
+      return NextResponse.json({
+        authenticated: false,
+        sessionToken // Include token to enable stale cookie detection
+      });
+    }
+
+    // If there's no token at all, it's not authenticated
+    return NextResponse.json({ authenticated: false });
+
+  } catch (error) {
+    console.error('[API Viability] Error checking session viability:', error);
+    return NextResponse.json({ authenticated: false }, { status: 500 });
+  }
 }

package/src/auth/better-auth.ts

@@ -18,7 +18,6 @@ import type { IDPClientConfig } from '../lib/idp-client-config';
 import { getIDPClientConfig } from '../lib/idp-client-config';
 import { getAppSlug } from '../lib/app-slug';
 import { getRedis } from '../lib/redis';
-import { SESSION_TTL } from '../lib/session-store';
 
 /**
  * Better Auth social provider config shape.
@@ -124,19 +123,15 @@ export function createBetterAuthInstance(
     // Redis-backed session storage via secondaryStorage
     secondaryStorage: {
       get: async (key: string) => {
-        try {
-          return await getRedis().get(`ba:${appSlug}:${key}`);
-        } catch { return null; }
+        return await getRedis().get(`ba:${appSlug}:${key}`);
       },
       set: async (key: string, value: string, ttl?: number) => {
-        try {
-          const redis = getRedis();
-          if (ttl) {
-            await redis.setex(`ba:${appSlug}:${key}`, ttl, value);
-          } else {
-            await redis.setex(`ba:${appSlug}:${key}`, SESSION_TTL, value);
-          }
-        } catch { /* Redis unavailable — cookie cache still works */ }
+        const redis = getRedis();
+        if (ttl) {
+          await redis.setex(`ba:${appSlug}:${key}`, ttl, value);
+        } else {
+          await redis.setex(`ba:${appSlug}:${key}`, 7 * 24 * 60 * 60, value);
+        }
       },
       delete: async (key: string) => {
         try {
@@ -365,14 +360,14 @@ export async function exchangeOAuthForIdpTokens(
 
     // Store in BA Redis session (for decodeSession)
     baData.idpTokens = idpTokenData;
-    await getRedis().setex(baKey, SESSION_TTL, JSON.stringify(baData));
+    await getRedis().setex(baKey, 7 * 24 * 60 * 60, JSON.stringify(baData));
 
     // Write to canonical session store so refresh handler and token lifecycle can find the tokens.
     // Key format: {sessionPrefix}{token} — same key that getSession() reads from.
     try {
       const { getSessionPrefix } = await import('../lib/app-slug');
       const canonicalKey = `${getSessionPrefix()}${sessionToken}`;
-      await getRedis().setex(canonicalKey, SESSION_TTL, JSON.stringify({
+      await getRedis().setex(canonicalKey, 7 * 24 * 60 * 60, JSON.stringify({
         ...idpTokenData,
         oauthProvider: provider,
       }));

package/src/auth/unauthenticated-routes.ts

@@ -1,3 +1,3 @@
-// src/auth/unauthenticated-routes.ts
-// Re-exporting from route-config for backward compatibility
+// src/auth/unauthenticated-routes.ts
+// Re-exporting from route-config for backward compatibility
 export * from './route-config';

package/src/client/better-auth-client.ts

@@ -1,70 +1,70 @@
-/**
- * Better Auth Client.
- *
- * Import from '@payez/next-mvp/client/better-auth-client'.
- *
- * Includes useSessionCompat() — returns a { data, status } shape so existing
- * components written against the legacy hook don't need destructure changes.
- */
-
-import { createAuthClient } from 'better-auth/react';
-import { magicLinkClient } from 'better-auth/client/plugins';
-import { useMemo } from 'react';
-
-export const authClient = createAuthClient({
-  // baseURL derived from BETTER_AUTH_URL or window.location.origin
-  plugins: [magicLinkClient()],
-});
-
-// Convenience exports
-export const { useSession, signIn, signOut } = authClient;
-
-
-/**
- * NextAuth-compatible useSession wrapper.
- *
- * Maps Better Auth's { data, error, isPending } to NextAuth's { data, status, update }.
- * Drop-in replacement — no destructure changes needed in consuming components.
- */
-export function useSessionCompat() {
-  const baSession = authClient.useSession();
-
-  const status = useMemo(() => {
-    if (baSession.isPending) return 'loading' as const;
-    if (baSession.data) return 'authenticated' as const;
-    return 'unauthenticated' as const;
-  }, [baSession.isPending, baSession.data]);
-
-  // Map Better Auth session shape to NextAuth session shape
-  const data = useMemo(() => {
-    if (!baSession.data) return null;
-    return {
-      ...baSession.data,
-      user: baSession.data.user,
-      expires: '', // Better Auth handles expiry differently
-    };
-  }, [baSession.data]);
-
-  return {
-    data,
-    status,
-    update: async () => {
-      // Better Auth doesn't have a direct "refresh session" call.
-      // Force refetch by invalidating the query.
-      // TODO: Wire to proper session refresh when available.
-      return data;
-    },
-  };
-}
-
-/**
- * NextAuth-compatible signOut wrapper.
- *
- * Maps NextAuth signOut({ redirect, callbackUrl }) to Better Auth.
- */
-export async function signOutCompat(options?: { redirect?: boolean; callbackUrl?: string }) {
-  await authClient.signOut();
-  if (options?.redirect !== false && options?.callbackUrl) {
-    window.location.href = options.callbackUrl;
-  }
-}
+/**
+ * Better Auth Client.
+ *
+ * Import from '@payez/next-mvp/client/better-auth-client'.
+ *
+ * Includes useSessionCompat() — returns a { data, status } shape so existing
+ * components written against the legacy hook don't need destructure changes.
+ */
+
+import { createAuthClient } from 'better-auth/react';
+import { magicLinkClient } from 'better-auth/client/plugins';
+import { useMemo } from 'react';
+
+export const authClient = createAuthClient({
+  // baseURL derived from BETTER_AUTH_URL or window.location.origin
+  plugins: [magicLinkClient()],
+});
+
+// Convenience exports
+export const { useSession, signIn, signOut } = authClient;
+
+
+/**
+ * NextAuth-compatible useSession wrapper.
+ *
+ * Maps Better Auth's { data, error, isPending } to NextAuth's { data, status, update }.
+ * Drop-in replacement — no destructure changes needed in consuming components.
+ */
+export function useSessionCompat() {
+  const baSession = authClient.useSession();
+
+  const status = useMemo(() => {
+    if (baSession.isPending) return 'loading' as const;
+    if (baSession.data) return 'authenticated' as const;
+    return 'unauthenticated' as const;
+  }, [baSession.isPending, baSession.data]);
+
+  // Map Better Auth session shape to NextAuth session shape
+  const data = useMemo(() => {
+    if (!baSession.data) return null;
+    return {
+      ...baSession.data,
+      user: baSession.data.user,
+      expires: '', // Better Auth handles expiry differently
+    };
+  }, [baSession.data]);
+
+  return {
+    data,
+    status,
+    update: async () => {
+      // Better Auth doesn't have a direct "refresh session" call.
+      // Force refetch by invalidating the query.
+      // TODO: Wire to proper session refresh when available.
+      return data;
+    },
+  };
+}
+
+/**
+ * NextAuth-compatible signOut wrapper.
+ *
+ * Maps NextAuth signOut({ redirect, callbackUrl }) to Better Auth.
+ */
+export async function signOutCompat(options?: { redirect?: boolean; callbackUrl?: string }) {
+  await authClient.signOut();
+  if (options?.redirect !== false && options?.callbackUrl) {
+    window.location.href = options.callbackUrl;
+  }
+}

package/src/client/fetchWithSession.ts

@@ -1,21 +1,21 @@
-import { useRef } from 'react';
-
-export async function fetchWithSession(input: RequestInfo | URL, init: RequestInit = {}, opts: { retry?: number } = {}): Promise<Response> {
-  const retry = opts.retry ?? 1;
-  const doFetch = async (): Promise<Response> => {
-    const res = await fetch(input, { ...init, credentials: 'include' });
-    if (res.ok) return res;
-    if (res.status === 401 && retry > 0) {
-      const rf = await fetch('/api/auth/refresh', { method: 'POST', headers: { 'Accept': 'application/json' }, credentials: 'include' });
-      if (rf.ok) return fetchWithSession(input, init, { retry: retry - 1 });
-    }
-    if ((res.status === 409 || res.status === 503) && retry > 0) {
-      const retryAfter = res.headers.get('Retry-After');
-      const waitMs = retryAfter ? parseInt(retryAfter) * 1000 : 1000;
-      await new Promise(r => setTimeout(r, Math.min(waitMs, 3000)));
-      return fetchWithSession(input, init, { retry: retry - 1 });
-    }
-    return res;
-  };
-  return doFetch();
-}
+import { useRef } from 'react';
+
+export async function fetchWithSession(input: RequestInfo | URL, init: RequestInit = {}, opts: { retry?: number } = {}): Promise<Response> {
+  const retry = opts.retry ?? 1;
+  const doFetch = async (): Promise<Response> => {
+    const res = await fetch(input, { ...init, credentials: 'include' });
+    if (res.ok) return res;
+    if (res.status === 401 && retry > 0) {
+      const rf = await fetch('/api/auth/refresh', { method: 'POST', headers: { 'Accept': 'application/json' }, credentials: 'include' });
+      if (rf.ok) return fetchWithSession(input, init, { retry: retry - 1 });
+    }
+    if ((res.status === 409 || res.status === 503) && retry > 0) {
+      const retryAfter = res.headers.get('Retry-After');
+      const waitMs = retryAfter ? parseInt(retryAfter) * 1000 : 1000;
+      await new Promise(r => setTimeout(r, Math.min(waitMs, 3000)));
+      return fetchWithSession(input, init, { retry: retry - 1 });
+    }
+    return res;
+  };
+  return doFetch();
+}

package/src/client/index.ts

@@ -1,13 +1,13 @@
-/**
- * Client-Side Exports
- *
- * This module exports only client-safe code for use in browser environments.
- * Server-only utilities and Node.js dependencies are excluded.
- */
-
-// Client-side fetch utility
-export { fetchWithAuth } from './fetch-with-auth';
-
-// Authentication context and hooks
-export { AuthProvider, useAuthConfig, useAuthMode, useFederatedProviders, useFederatedAuthEnabled, useTraditionalAuthEnabled } from './AuthContext';
-export type { AuthConfig } from '../types/auth';
+/**
+ * Client-Side Exports
+ *
+ * This module exports only client-safe code for use in browser environments.
+ * Server-only utilities and Node.js dependencies are excluded.
+ */
+
+// Client-side fetch utility
+export { fetchWithAuth } from './fetch-with-auth';
+
+// Authentication context and hooks
+export { AuthProvider, useAuthConfig, useAuthMode, useFederatedProviders, useFederatedAuthEnabled, useTraditionalAuthEnabled } from './AuthContext';
+export type { AuthConfig } from '../types/auth';