@payez/next-mvp 4.1.10 → 4.1.20

package/src/auth/unauthenticated-routes.ts

@@ -1,3 +1,3 @@
-// src/auth/unauthenticated-routes.ts
-// Re-exporting from route-config for backward compatibility
+// src/auth/unauthenticated-routes.ts
+// Re-exporting from route-config for backward compatibility
 export * from './route-config';

package/src/auth/utils/idp-client.ts

@@ -150,105 +150,23 @@ function getLoginErrorMessage(status: number, responseData: any): string {
 // ============================================================================
 
 /**
- * Register/authenticate OAuth user with IDP.
+ * idpOAuthCallback REMOVED 2026-08-05 (NextPert, BAPert 20168 / QAPert 20166).
  *
- * Called after OAuth provider (Google, etc.) redirects back.
- * Creates or retrieves IDP user and returns IDP tokens.
+ * It POSTed to /api/ExternalAuth/oauth-callback with provider, email, name,
+ * tokens and client_id — ALL ASSERTIONS, no id_token, nothing verifiable. After
+ * the 170003 fix (13436d56e) that call can only ever return 401.
  *
- * @param oauthData - Data from OAuth provider
- * @returns IDP response with tokens and user info
- */
-export async function idpOAuthCallback(oauthData: {
-  provider: string;
-  providerAccountId: string;
-  email: string;
-  name?: string;
-  image?: string;
-  accessToken?: string;
-  refreshToken?: string;
-  expiresAt?: number;
-}): Promise<IdpOAuthCallbackResponse> {
-  const idpUrl = getIdpUrl();
-  const clientId = getClientId();
-
-  try {
-    const response = await fetch(`${idpUrl}/api/ExternalAuth/oauth-callback`, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        'X-Client-Id': clientId,
-      },
-      body: JSON.stringify({
-        provider: oauthData.provider,
-        provider_account_id: oauthData.providerAccountId,
-        email: oauthData.email,
-        name: oauthData.name || '',
-        image: oauthData.image || '',
-        access_token: oauthData.accessToken || '',
-        refresh_token: oauthData.refreshToken || '',
-        expires_at: oauthData.expiresAt || 0,
-        client_id: clientId,
-      }),
-    });
-
-    if (!response.ok) {
-      const errorText = await response.text().catch(() => 'Unknown error');
-      console.error('[IDP_CLIENT] OAuth callback failed:', response.status, errorText);
-      return {
-        success: false,
-        error: {
-          code: `HTTP_${response.status}`,
-          message: 'OAuth registration failed',
-        },
-      };
-    }
-
-    const data = await response.json();
-    const responseData = data.data || data;
-
-    // Normalize snake_case to camelCase
-    return {
-      success: responseData.success !== false,
-      data: responseData.success !== false
-        ? {
-            accessToken: responseData.accessToken || responseData.access_token,
-            refreshToken: responseData.refreshToken || responseData.refresh_token,
-            isNewUser: responseData.isNewUser ?? responseData.is_new_user ?? false,
-            user: responseData.user
-              ? {
-                  userId: responseData.user.userId || responseData.user.user_id,
-                  email: responseData.user.email || responseData.user.Email,
-                  fullName: responseData.user.fullName || responseData.user.full_name || responseData.user.name,
-                  roles: responseData.user.roles || [],
-                }
-              : undefined,
-          }
-        : undefined,
-      error: responseData.error,
-    };
-  } catch (error) {
-    console.error('[IDP_CLIENT] OAuth callback request failed:', error);
-    return {
-      success: false,
-      error: {
-        code: 'NETWORK_ERROR',
-        message: 'Failed to connect to authentication service',
-      },
-    };
-  }
-}
-
-// ============================================================================
-// TOKEN REFRESH
-// ============================================================================
-
-/**
- * Refresh an expired access token using the refresh token.
+ * It was a SECOND caller of the same endpoint, and only the first
+ * (better-auth.ts, card 138635) was hardened — the same duplicated-integration
+ * trap the viability code documents ("adding the relay to just one would leave
+ * an app that mounts THIS one still blind").
  *
- * @param refreshToken - The refresh token from previous login
- * @param mfaContext - MFA context to preserve across refresh
- * @returns New tokens or error
+ * It had no call sites and was not reachable through the package exports map
+ * (no ./auth/utils key, no wildcard), so removing it breaks nothing. Deleted
+ * rather than fixed, because an unreachable function whose only outcome is a
+ * 401 that LOOKS like a security success is a trap for whoever finds it next.
  */
+
 export async function idpRefreshToken(
   refreshToken: string,
   mfaContext?: {

package/src/client/better-auth-client.ts

@@ -1,70 +1,70 @@
-/**
- * Better Auth Client.
- *
- * Import from '@payez/next-mvp/client/better-auth-client'.
- *
- * Includes useSessionCompat() — returns a { data, status } shape so existing
- * components written against the legacy hook don't need destructure changes.
- */
-
-import { createAuthClient } from 'better-auth/react';
-import { magicLinkClient } from 'better-auth/client/plugins';
-import { useMemo } from 'react';
-
-export const authClient = createAuthClient({
-  // baseURL derived from BETTER_AUTH_URL or window.location.origin
-  plugins: [magicLinkClient()],
-});
-
-// Convenience exports
-export const { useSession, signIn, signOut } = authClient;
-
-
-/**
- * NextAuth-compatible useSession wrapper.
- *
- * Maps Better Auth's { data, error, isPending } to NextAuth's { data, status, update }.
- * Drop-in replacement — no destructure changes needed in consuming components.
- */
-export function useSessionCompat() {
-  const baSession = authClient.useSession();
-
-  const status = useMemo(() => {
-    if (baSession.isPending) return 'loading' as const;
-    if (baSession.data) return 'authenticated' as const;
-    return 'unauthenticated' as const;
-  }, [baSession.isPending, baSession.data]);
-
-  // Map Better Auth session shape to NextAuth session shape
-  const data = useMemo(() => {
-    if (!baSession.data) return null;
-    return {
-      ...baSession.data,
-      user: baSession.data.user,
-      expires: '', // Better Auth handles expiry differently
-    };
-  }, [baSession.data]);
-
-  return {
-    data,
-    status,
-    update: async () => {
-      // Better Auth doesn't have a direct "refresh session" call.
-      // Force refetch by invalidating the query.
-      // TODO: Wire to proper session refresh when available.
-      return data;
-    },
-  };
-}
-
-/**
- * NextAuth-compatible signOut wrapper.
- *
- * Maps NextAuth signOut({ redirect, callbackUrl }) to Better Auth.
- */
-export async function signOutCompat(options?: { redirect?: boolean; callbackUrl?: string }) {
-  await authClient.signOut();
-  if (options?.redirect !== false && options?.callbackUrl) {
-    window.location.href = options.callbackUrl;
-  }
-}
+/**
+ * Better Auth Client.
+ *
+ * Import from '@payez/next-mvp/client/better-auth-client'.
+ *
+ * Includes useSessionCompat() — returns a { data, status } shape so existing
+ * components written against the legacy hook don't need destructure changes.
+ */
+
+import { createAuthClient } from 'better-auth/react';
+import { magicLinkClient } from 'better-auth/client/plugins';
+import { useMemo } from 'react';
+
+export const authClient = createAuthClient({
+  // baseURL derived from BETTER_AUTH_URL or window.location.origin
+  plugins: [magicLinkClient()],
+});
+
+// Convenience exports
+export const { useSession, signIn, signOut } = authClient;
+
+
+/**
+ * NextAuth-compatible useSession wrapper.
+ *
+ * Maps Better Auth's { data, error, isPending } to NextAuth's { data, status, update }.
+ * Drop-in replacement — no destructure changes needed in consuming components.
+ */
+export function useSessionCompat() {
+  const baSession = authClient.useSession();
+
+  const status = useMemo(() => {
+    if (baSession.isPending) return 'loading' as const;
+    if (baSession.data) return 'authenticated' as const;
+    return 'unauthenticated' as const;
+  }, [baSession.isPending, baSession.data]);
+
+  // Map Better Auth session shape to NextAuth session shape
+  const data = useMemo(() => {
+    if (!baSession.data) return null;
+    return {
+      ...baSession.data,
+      user: baSession.data.user,
+      expires: '', // Better Auth handles expiry differently
+    };
+  }, [baSession.data]);
+
+  return {
+    data,
+    status,
+    update: async () => {
+      // Better Auth doesn't have a direct "refresh session" call.
+      // Force refetch by invalidating the query.
+      // TODO: Wire to proper session refresh when available.
+      return data;
+    },
+  };
+}
+
+/**
+ * NextAuth-compatible signOut wrapper.
+ *
+ * Maps NextAuth signOut({ redirect, callbackUrl }) to Better Auth.
+ */
+export async function signOutCompat(options?: { redirect?: boolean; callbackUrl?: string }) {
+  await authClient.signOut();
+  if (options?.redirect !== false && options?.callbackUrl) {
+    window.location.href = options.callbackUrl;
+  }
+}

package/src/client/fetchWithSession.ts

@@ -1,21 +1,21 @@
-import { useRef } from 'react';
-
-export async function fetchWithSession(input: RequestInfo | URL, init: RequestInit = {}, opts: { retry?: number } = {}): Promise<Response> {
-  const retry = opts.retry ?? 1;
-  const doFetch = async (): Promise<Response> => {
-    const res = await fetch(input, { ...init, credentials: 'include' });
-    if (res.ok) return res;
-    if (res.status === 401 && retry > 0) {
-      const rf = await fetch('/api/auth/refresh', { method: 'POST', headers: { 'Accept': 'application/json' }, credentials: 'include' });
-      if (rf.ok) return fetchWithSession(input, init, { retry: retry - 1 });
-    }
-    if ((res.status === 409 || res.status === 503) && retry > 0) {
-      const retryAfter = res.headers.get('Retry-After');
-      const waitMs = retryAfter ? parseInt(retryAfter) * 1000 : 1000;
-      await new Promise(r => setTimeout(r, Math.min(waitMs, 3000)));
-      return fetchWithSession(input, init, { retry: retry - 1 });
-    }
-    return res;
-  };
-  return doFetch();
-}
+import { useRef } from 'react';
+
+export async function fetchWithSession(input: RequestInfo | URL, init: RequestInit = {}, opts: { retry?: number } = {}): Promise<Response> {
+  const retry = opts.retry ?? 1;
+  const doFetch = async (): Promise<Response> => {
+    const res = await fetch(input, { ...init, credentials: 'include' });
+    if (res.ok) return res;
+    if (res.status === 401 && retry > 0) {
+      const rf = await fetch('/api/auth/refresh', { method: 'POST', headers: { 'Accept': 'application/json' }, credentials: 'include' });
+      if (rf.ok) return fetchWithSession(input, init, { retry: retry - 1 });
+    }
+    if ((res.status === 409 || res.status === 503) && retry > 0) {
+      const retryAfter = res.headers.get('Retry-After');
+      const waitMs = retryAfter ? parseInt(retryAfter) * 1000 : 1000;
+      await new Promise(r => setTimeout(r, Math.min(waitMs, 3000)));
+      return fetchWithSession(input, init, { retry: retry - 1 });
+    }
+    return res;
+  };
+  return doFetch();
+}

package/src/client/index.ts

@@ -1,13 +1,13 @@
-/**
- * Client-Side Exports
- *
- * This module exports only client-safe code for use in browser environments.
- * Server-only utilities and Node.js dependencies are excluded.
- */
-
-// Client-side fetch utility
-export { fetchWithAuth } from './fetch-with-auth';
-
-// Authentication context and hooks
-export { AuthProvider, useAuthConfig, useAuthMode, useFederatedProviders, useFederatedAuthEnabled, useTraditionalAuthEnabled } from './AuthContext';
-export type { AuthConfig } from '../types/auth';
+/**
+ * Client-Side Exports
+ *
+ * This module exports only client-safe code for use in browser environments.
+ * Server-only utilities and Node.js dependencies are excluded.
+ */
+
+// Client-side fetch utility
+export { fetchWithAuth } from './fetch-with-auth';
+
+// Authentication context and hooks
+export { AuthProvider, useAuthConfig, useAuthMode, useFederatedProviders, useFederatedAuthEnabled, useTraditionalAuthEnabled } from './AuthContext';
+export type { AuthConfig } from '../types/auth';

package/src/client/useAnonSession.ts

@@ -1,131 +1,131 @@
-/**
- * useAnonSession - React hook for anonymous session management
- *
- * Provides access to anonymous session preferences stored in Redis.
- * Works before user logs in, preferences persist across visits.
- */
-
-'use client';
-
-import { useState, useEffect, useCallback } from 'react';
-
-export interface AnonPreferences {
-  theme?: string;
-  locale?: string;
-  [key: string]: any;
-}
-
-export interface AnonMetrics {
-  resumeGenerationCount?: number;
-  firstVisit?: number;
-  lastVisit?: number;
-  visitCount?: number;
-  [key: string]: any;
-}
-
-export interface AnonSession {
-  id: string;
-  preferences: AnonPreferences;
-  metrics: AnonMetrics;
-}
-
-export interface UseAnonSessionReturn {
-  session: AnonSession | null;
-  isLoading: boolean;
-  error: string | null;
-  updatePreferences: (preferences: Partial<AnonPreferences>) => Promise<void>;
-  setTheme: (theme: string) => Promise<void>;
-  refresh: () => Promise<void>;
-}
-
-/**
- * Hook to manage anonymous session state
- */
-export function useAnonSession(): UseAnonSessionReturn {
-  const [session, setSession] = useState<AnonSession | null>(null);
-  const [isLoading, setIsLoading] = useState(true);
-  const [error, setError] = useState<string | null>(null);
-
-  // Fetch session on mount
-  const fetchSession = useCallback(async () => {
-    try {
-      setIsLoading(true);
-      setError(null);
-
-      const response = await fetch('/api/anon/preferences', {
-        method: 'GET',
-        credentials: 'include', // Important for cookies
-      });
-
-      if (!response.ok) {
-        throw new Error('Failed to fetch preferences');
-      }
-
-      const data = await response.json();
-      if (data.success && data.data) {
-        setSession({
-          id: data.data.id,
-          preferences: data.data.preferences || {},
-          metrics: data.data.metrics || {},
-        });
-      }
-    } catch (err) {
-      console.error('[useAnonSession] Error fetching session:', err);
-      setError(err instanceof Error ? err.message : 'Unknown error');
-    } finally {
-      setIsLoading(false);
-    }
-  }, []);
-
-  useEffect(() => {
-    fetchSession();
-  }, [fetchSession]);
-
-  // Update preferences
-  const updatePreferences = useCallback(async (preferences: Partial<AnonPreferences>) => {
-    try {
-      setError(null);
-
-      const response = await fetch('/api/anon/preferences', {
-        method: 'POST',
-        credentials: 'include',
-        headers: {
-          'Content-Type': 'application/json',
-        },
-        body: JSON.stringify({ preferences }),
-      });
-
-      if (!response.ok) {
-        throw new Error('Failed to update preferences');
-      }
-
-      const data = await response.json();
-      if (data.success && data.data) {
-        setSession(prev => prev ? {
-          ...prev,
-          preferences: data.data.preferences,
-        } : null);
-      }
-    } catch (err) {
-      console.error('[useAnonSession] Error updating preferences:', err);
-      setError(err instanceof Error ? err.message : 'Unknown error');
-      throw err;
-    }
-  }, []);
-
-  // Convenience method to set theme
-  const setTheme = useCallback(async (theme: string) => {
-    await updatePreferences({ theme });
-  }, [updatePreferences]);
-
-  return {
-    session,
-    isLoading,
-    error,
-    updatePreferences,
-    setTheme,
-    refresh: fetchSession,
-  };
-}
-
-export default useAnonSession;
+/**
+ * useAnonSession - React hook for anonymous session management
+ *
+ * Provides access to anonymous session preferences stored in Redis.
+ * Works before user logs in, preferences persist across visits.
+ */
+
+'use client';
+
+import { useState, useEffect, useCallback } from 'react';
+
+export interface AnonPreferences {
+  theme?: string;
+  locale?: string;
+  [key: string]: any;
+}
+
+export interface AnonMetrics {
+  resumeGenerationCount?: number;
+  firstVisit?: number;
+  lastVisit?: number;
+  visitCount?: number;
+  [key: string]: any;
+}
+
+export interface AnonSession {
+  id: string;
+  preferences: AnonPreferences;
+  metrics: AnonMetrics;
+}
+
+export interface UseAnonSessionReturn {
+  session: AnonSession | null;
+  isLoading: boolean;
+  error: string | null;
+  updatePreferences: (preferences: Partial<AnonPreferences>) => Promise<void>;
+  setTheme: (theme: string) => Promise<void>;
+  refresh: () => Promise<void>;
+}
+
+/**
+ * Hook to manage anonymous session state
+ */
+export function useAnonSession(): UseAnonSessionReturn {
+  const [session, setSession] = useState<AnonSession | null>(null);
+  const [isLoading, setIsLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+
+  // Fetch session on mount
+  const fetchSession = useCallback(async () => {
+    try {
+      setIsLoading(true);
+      setError(null);
+
+      const response = await fetch('/api/anon/preferences', {
+        method: 'GET',
+        credentials: 'include', // Important for cookies
+      });
+
+      if (!response.ok) {
+        throw new Error('Failed to fetch preferences');
+      }
+
+      const data = await response.json();
+      if (data.success && data.data) {
+        setSession({
+          id: data.data.id,
+          preferences: data.data.preferences || {},
+          metrics: data.data.metrics || {},
+        });
+      }
+    } catch (err) {
+      console.error('[useAnonSession] Error fetching session:', err);
+      setError(err instanceof Error ? err.message : 'Unknown error');
+    } finally {
+      setIsLoading(false);
+    }
+  }, []);
+
+  useEffect(() => {
+    fetchSession();
+  }, [fetchSession]);
+
+  // Update preferences
+  const updatePreferences = useCallback(async (preferences: Partial<AnonPreferences>) => {
+    try {
+      setError(null);
+
+      const response = await fetch('/api/anon/preferences', {
+        method: 'POST',
+        credentials: 'include',
+        headers: {
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ preferences }),
+      });
+
+      if (!response.ok) {
+        throw new Error('Failed to update preferences');
+      }
+
+      const data = await response.json();
+      if (data.success && data.data) {
+        setSession(prev => prev ? {
+          ...prev,
+          preferences: data.data.preferences,
+        } : null);
+      }
+    } catch (err) {
+      console.error('[useAnonSession] Error updating preferences:', err);
+      setError(err instanceof Error ? err.message : 'Unknown error');
+      throw err;
+    }
+  }, []);
+
+  // Convenience method to set theme
+  const setTheme = useCallback(async (theme: string) => {
+    await updatePreferences({ theme });
+  }, [updatePreferences]);
+
+  return {
+    session,
+    isLoading,
+    error,
+    updatePreferences,
+    setTheme,
+    refresh: fetchSession,
+  };
+}
+
+export default useAnonSession;