@payez/next-mvp 4.1.10 → 4.1.20

package/src/components/admin/VibeAdminContext.tsx

@@ -1,87 +1,87 @@
-'use client';
-
-import React, { createContext, useContext, ReactNode } from 'react';
-
-// -----------------------------------------------------------------------------
-// TYPES
-// -----------------------------------------------------------------------------
-
-export interface VibeAdminConfig {
-  /** Collection name for this tenant (e.g., "ideal_resume", "idealvibe_app") */
-  collectionName: string;
-  /** Display name for the app (e.g., "IdealResume", "IdealVibe") */
-  appName: string;
-  /** Optional logo URL */
-  logoUrl?: string;
-  /** Base path for admin routes (default: /vibe-admin) */
-  basePath?: string;
-  /** Custom tabs to add to the admin panel */
-  customTabs?: AdminTab[];
-  /** Theme mode override */
-  isDarkMode?: boolean;
-}
-
-export interface AdminTab {
-  id: string;
-  label: string;
-  icon?: React.ElementType;
-  component: React.ComponentType;
-}
-
-export interface VibeAdminContextValue extends VibeAdminConfig {
-  /** All tabs including defaults and custom */
-  allTabs: AdminTab[];
-}
-
-// -----------------------------------------------------------------------------
-// CONTEXT
-// -----------------------------------------------------------------------------
-
-const VibeAdminContext = createContext<VibeAdminContextValue | null>(null);
-
-// -----------------------------------------------------------------------------
-// HOOK
-// -----------------------------------------------------------------------------
-
-export function useVibeAdmin(): VibeAdminContextValue {
-  const context = useContext(VibeAdminContext);
-  if (!context) {
-    throw new Error('useVibeAdmin must be used within a VibeAdminProvider');
-  }
-  return context;
-}
-
-// -----------------------------------------------------------------------------
-// PROVIDER
-// -----------------------------------------------------------------------------
-
-interface VibeAdminProviderProps {
-  config: VibeAdminConfig;
-  children: ReactNode;
-}
-
-export function VibeAdminProvider({ config, children }: VibeAdminProviderProps) {
-  // Default tabs - will be populated with actual components
-  const defaultTabs: AdminTab[] = [
-    { id: 'stats', label: 'Stats', component: () => null },
-    { id: 'users', label: 'Users', component: () => null },
-    { id: 'sessions', label: 'Sessions', component: () => null },
-    { id: 'analytics', label: 'Analytics', component: () => null },
-  ];
-
-  const allTabs = [...defaultTabs, ...(config.customTabs || [])];
-
-  const value: VibeAdminContextValue = {
-    ...config,
-    basePath: config.basePath || '/vibe-admin',
-    allTabs,
-  };
-
-  return (
-    <VibeAdminContext.Provider value={value}>
-      {children}
-    </VibeAdminContext.Provider>
-  );
-}
-
-export default VibeAdminProvider;
+'use client';
+
+import React, { createContext, useContext, ReactNode } from 'react';
+
+// -----------------------------------------------------------------------------
+// TYPES
+// -----------------------------------------------------------------------------
+
+export interface VibeAdminConfig {
+  /** Collection name for this tenant (e.g., "ideal_resume", "idealvibe_app") */
+  collectionName: string;
+  /** Display name for the app (e.g., "IdealResume", "IdealVibe") */
+  appName: string;
+  /** Optional logo URL */
+  logoUrl?: string;
+  /** Base path for admin routes (default: /vibe-admin) */
+  basePath?: string;
+  /** Custom tabs to add to the admin panel */
+  customTabs?: AdminTab[];
+  /** Theme mode override */
+  isDarkMode?: boolean;
+}
+
+export interface AdminTab {
+  id: string;
+  label: string;
+  icon?: React.ElementType;
+  component: React.ComponentType;
+}
+
+export interface VibeAdminContextValue extends VibeAdminConfig {
+  /** All tabs including defaults and custom */
+  allTabs: AdminTab[];
+}
+
+// -----------------------------------------------------------------------------
+// CONTEXT
+// -----------------------------------------------------------------------------
+
+const VibeAdminContext = createContext<VibeAdminContextValue | null>(null);
+
+// -----------------------------------------------------------------------------
+// HOOK
+// -----------------------------------------------------------------------------
+
+export function useVibeAdmin(): VibeAdminContextValue {
+  const context = useContext(VibeAdminContext);
+  if (!context) {
+    throw new Error('useVibeAdmin must be used within a VibeAdminProvider');
+  }
+  return context;
+}
+
+// -----------------------------------------------------------------------------
+// PROVIDER
+// -----------------------------------------------------------------------------
+
+interface VibeAdminProviderProps {
+  config: VibeAdminConfig;
+  children: ReactNode;
+}
+
+export function VibeAdminProvider({ config, children }: VibeAdminProviderProps) {
+  // Default tabs - will be populated with actual components
+  const defaultTabs: AdminTab[] = [
+    { id: 'stats', label: 'Stats', component: () => null },
+    { id: 'users', label: 'Users', component: () => null },
+    { id: 'sessions', label: 'Sessions', component: () => null },
+    { id: 'analytics', label: 'Analytics', component: () => null },
+  ];
+
+  const allTabs = [...defaultTabs, ...(config.customTabs || [])];
+
+  const value: VibeAdminContextValue = {
+    ...config,
+    basePath: config.basePath || '/vibe-admin',
+    allTabs,
+  };
+
+  return (
+    <VibeAdminContext.Provider value={value}>
+      {children}
+    </VibeAdminContext.Provider>
+  );
+}
+
+export default VibeAdminProvider;

package/src/config/logging-config.ts

@@ -1,82 +1,82 @@
-import { promises as fs } from 'fs';
-import { watch, existsSync } from 'fs';
-import { LoggingConfig, LogLevel } from '../types/logging';
-
-const isEdgeRuntime = typeof (globalThis as any).EdgeRuntime !== 'undefined' || process.env.NEXT_RUNTIME === 'edge';
-
-class LoggingConfigManager {
-  private config: LoggingConfig | null = null;
-  private configPath: string;
-  private watchers: Set<(config: LoggingConfig) => void> = new Set();
-  private fileWatcher: ReturnType<typeof watch> | null = null;
-  private isEdgeRuntime: boolean;
-  private isBrowser: boolean;
-
-  constructor() {
-    this.isBrowser = typeof window !== 'undefined';
-    this.isEdgeRuntime = typeof (globalThis as any).EdgeRuntime !== 'undefined' || process.env.NEXT_RUNTIME === 'edge';
-    if (this.isEdgeRuntime || this.isBrowser) {
-      this.configPath = '/config/logging.json';
-      this.config = this.getDefaultConfig();
-    } else {
-      const cwd = process.cwd().replace(/\\/g, '/');
-      this.configPath = cwd + '/config/logging.json';
-    }
-  }
-
-  async loadConfig(): Promise<LoggingConfig> {
-    if (this.isEdgeRuntime || this.isBrowser) {
-      if (!this.config) { this.config = this.getDefaultConfig(); }
-      return this.config;
-    }
-    try {
-      const configContent = await fs.readFile(this.configPath, 'utf-8');
-      const rawConfig = JSON.parse(configContent);
-      const config = this.validateAndMergeConfig(rawConfig);
-      this.config = config; this.notifyWatchers(config); return config;
-    } catch (error) {
-      console.warn(`Failed to load logging config from ${this.configPath}:`, error);
-      return this.getDefaultConfig();
-    }
-  }
-
-  async getConfig(): Promise<LoggingConfig> { if (!this.config) { return await this.loadConfig(); } return this.config; }
-  getConfigSync(): LoggingConfig { return this.config || this.getDefaultConfig(); }
-
-  startWatching(): void { if (this.isEdgeRuntime || this.isBrowser) { return; } if (this.fileWatcher) { return; } try { if (!existsSync(this.configPath)) { console.warn(`Logging config file not found at ${this.configPath} — watch disabled`); return; } this.fileWatcher = watch(this.configPath, { persistent: false }, (eventType) => { if (eventType === 'change') { this.loadConfig().catch(console.error); } }); } catch (error) { console.warn('Failed to start watching logging config file:', error); } }
-  stopWatching(): void { if (this.isEdgeRuntime || this.isBrowser) { return; } if (this.fileWatcher) { this.fileWatcher.close(); this.fileWatcher = null; } }
-  addWatcher(callback: (config: LoggingConfig) => void): void { this.watchers.add(callback); }
-  removeWatcher(callback: (config: LoggingConfig) => void): void { this.watchers.delete(callback); }
-  private notifyWatchers(config: LoggingConfig): void { this.watchers.forEach(cb => { try { cb(config); } catch (error) { console.error('Error in logging config watcher:', error); } }); }
-
-  private validateAndMergeConfig(rawConfig: any): LoggingConfig {
-    const defaults = this.getDefaultConfig();
-    const config: LoggingConfig = {
-      logLevel: this.validateLogLevel(rawConfig.logLevel) || this.validateLogLevel(process.env.LOG_LEVEL) || defaults.logLevel,
-      console: { enabled: rawConfig.console?.enabled ?? (process.env.LOG_CONSOLE === 'true' || process.env.NODE_ENV === 'development'), colors: rawConfig.console?.colors ?? defaults.console.colors },
-      graylog: { enabled: false, host: defaults.graylog.host, port: defaults.graylog.port, facility: defaults.graylog.facility, staticMeta: { ...defaults.graylog.staticMeta } },
-      components: { ...defaults.components, ...rawConfig.components },
-      levels: { ...defaults.levels, ...rawConfig.levels }
-    };
-    return config;
-  }
-  private validateLogLevel(level: any): LogLevel | null { const validLevels: LogLevel[] = ['error', 'warn', 'info', 'http', 'debug']; return validLevels.includes(level) ? level : null; }
-  private getHostname(): string { if (this.isEdgeRuntime) return 'edge-runtime'; if (this.isBrowser) return 'browser-client'; try { return require('os').hostname(); } catch { return 'unknown'; } }
-  private getDefaultConfig(): LoggingConfig {
-    return {
-      logLevel: 'info',
-      console: { enabled: process.env.NODE_ENV === 'development', colors: true },
-      graylog: { enabled: false, host: '127.0.0.1', port: 12201, facility: 'next-mvp', staticMeta: { service: 'next-mvp', application: 'next-mvp', version: '1.0.0', environment: process.env.NODE_ENV || 'development', hostname: this.getHostname(), instance: process.env.NEXT_INSTANCE_ID || 'unknown' } },
-      components: { auth: { enabled: true, prefix: '[AUTH]' }, idp: { enabled: true, prefix: '[IDP]' }, api: { enabled: true, prefix: '[API]' }, circuitBreaker: { enabled: true, prefix: '[CIRCUIT-BREAKER]' }, token: { enabled: true, prefix: '[TOKEN]' }, tokenSync: { enabled: true, prefix: '[TOKEN-SYNC]' }, tokenRefresh: { enabled: true, prefix: '[TOKEN-REFRESH]' }, redis: { enabled: true, prefix: '[REDIS]' } },
-      levels: { error: 0, warn: 1, info: 2, http: 3, debug: 4 }
-    };
-  }
-}
-
-export const loggingConfigManager = new LoggingConfigManager();
-export const getLoggingConfig = () => loggingConfigManager.getConfig();
-export const getLoggingConfigSync = () => loggingConfigManager.getConfigSync();
-export const startConfigWatching = () => loggingConfigManager.startWatching();
-export const stopConfigWatching = () => loggingConfigManager.stopWatching();
-export const addConfigWatcher = (callback: (config: LoggingConfig) => void) => loggingConfigManager.addWatcher(callback);
-export const removeConfigWatcher = (callback: (config: LoggingConfig) => void) => loggingConfigManager.removeWatcher(callback);
+import { promises as fs } from 'fs';
+import { watch, existsSync } from 'fs';
+import { LoggingConfig, LogLevel } from '../types/logging';
+
+const isEdgeRuntime = typeof (globalThis as any).EdgeRuntime !== 'undefined' || process.env.NEXT_RUNTIME === 'edge';
+
+class LoggingConfigManager {
+  private config: LoggingConfig | null = null;
+  private configPath: string;
+  private watchers: Set<(config: LoggingConfig) => void> = new Set();
+  private fileWatcher: ReturnType<typeof watch> | null = null;
+  private isEdgeRuntime: boolean;
+  private isBrowser: boolean;
+
+  constructor() {
+    this.isBrowser = typeof window !== 'undefined';
+    this.isEdgeRuntime = typeof (globalThis as any).EdgeRuntime !== 'undefined' || process.env.NEXT_RUNTIME === 'edge';
+    if (this.isEdgeRuntime || this.isBrowser) {
+      this.configPath = '/config/logging.json';
+      this.config = this.getDefaultConfig();
+    } else {
+      const cwd = process.cwd().replace(/\\/g, '/');
+      this.configPath = cwd + '/config/logging.json';
+    }
+  }
+
+  async loadConfig(): Promise<LoggingConfig> {
+    if (this.isEdgeRuntime || this.isBrowser) {
+      if (!this.config) { this.config = this.getDefaultConfig(); }
+      return this.config;
+    }
+    try {
+      const configContent = await fs.readFile(this.configPath, 'utf-8');
+      const rawConfig = JSON.parse(configContent);
+      const config = this.validateAndMergeConfig(rawConfig);
+      this.config = config; this.notifyWatchers(config); return config;
+    } catch (error) {
+      console.warn(`Failed to load logging config from ${this.configPath}:`, error);
+      return this.getDefaultConfig();
+    }
+  }
+
+  async getConfig(): Promise<LoggingConfig> { if (!this.config) { return await this.loadConfig(); } return this.config; }
+  getConfigSync(): LoggingConfig { return this.config || this.getDefaultConfig(); }
+
+  startWatching(): void { if (this.isEdgeRuntime || this.isBrowser) { return; } if (this.fileWatcher) { return; } try { if (!existsSync(this.configPath)) { console.warn(`Logging config file not found at ${this.configPath} — watch disabled`); return; } this.fileWatcher = watch(this.configPath, { persistent: false }, (eventType) => { if (eventType === 'change') { this.loadConfig().catch(console.error); } }); } catch (error) { console.warn('Failed to start watching logging config file:', error); } }
+  stopWatching(): void { if (this.isEdgeRuntime || this.isBrowser) { return; } if (this.fileWatcher) { this.fileWatcher.close(); this.fileWatcher = null; } }
+  addWatcher(callback: (config: LoggingConfig) => void): void { this.watchers.add(callback); }
+  removeWatcher(callback: (config: LoggingConfig) => void): void { this.watchers.delete(callback); }
+  private notifyWatchers(config: LoggingConfig): void { this.watchers.forEach(cb => { try { cb(config); } catch (error) { console.error('Error in logging config watcher:', error); } }); }
+
+  private validateAndMergeConfig(rawConfig: any): LoggingConfig {
+    const defaults = this.getDefaultConfig();
+    const config: LoggingConfig = {
+      logLevel: this.validateLogLevel(rawConfig.logLevel) || this.validateLogLevel(process.env.LOG_LEVEL) || defaults.logLevel,
+      console: { enabled: rawConfig.console?.enabled ?? (process.env.LOG_CONSOLE === 'true' || process.env.NODE_ENV === 'development'), colors: rawConfig.console?.colors ?? defaults.console.colors },
+      graylog: { enabled: false, host: defaults.graylog.host, port: defaults.graylog.port, facility: defaults.graylog.facility, staticMeta: { ...defaults.graylog.staticMeta } },
+      components: { ...defaults.components, ...rawConfig.components },
+      levels: { ...defaults.levels, ...rawConfig.levels }
+    };
+    return config;
+  }
+  private validateLogLevel(level: any): LogLevel | null { const validLevels: LogLevel[] = ['error', 'warn', 'info', 'http', 'debug']; return validLevels.includes(level) ? level : null; }
+  private getHostname(): string { if (this.isEdgeRuntime) return 'edge-runtime'; if (this.isBrowser) return 'browser-client'; try { return require('os').hostname(); } catch { return 'unknown'; } }
+  private getDefaultConfig(): LoggingConfig {
+    return {
+      logLevel: 'info',
+      console: { enabled: process.env.NODE_ENV === 'development', colors: true },
+      graylog: { enabled: false, host: '127.0.0.1', port: 12201, facility: 'next-mvp', staticMeta: { service: 'next-mvp', application: 'next-mvp', version: '1.0.0', environment: process.env.NODE_ENV || 'development', hostname: this.getHostname(), instance: process.env.NEXT_INSTANCE_ID || 'unknown' } },
+      components: { auth: { enabled: true, prefix: '[AUTH]' }, idp: { enabled: true, prefix: '[IDP]' }, api: { enabled: true, prefix: '[API]' }, circuitBreaker: { enabled: true, prefix: '[CIRCUIT-BREAKER]' }, token: { enabled: true, prefix: '[TOKEN]' }, tokenSync: { enabled: true, prefix: '[TOKEN-SYNC]' }, tokenRefresh: { enabled: true, prefix: '[TOKEN-REFRESH]' }, redis: { enabled: true, prefix: '[REDIS]' } },
+      levels: { error: 0, warn: 1, info: 2, http: 3, debug: 4 }
+    };
+  }
+}
+
+export const loggingConfigManager = new LoggingConfigManager();
+export const getLoggingConfig = () => loggingConfigManager.getConfig();
+export const getLoggingConfigSync = () => loggingConfigManager.getConfigSync();
+export const startConfigWatching = () => loggingConfigManager.startWatching();
+export const stopConfigWatching = () => loggingConfigManager.stopWatching();
+export const addConfigWatcher = (callback: (config: LoggingConfig) => void) => loggingConfigManager.addWatcher(callback);
+export const removeConfigWatcher = (callback: (config: LoggingConfig) => void) => loggingConfigManager.removeWatcher(callback);

package/src/config/unauthenticated-routes.ts

@@ -1,19 +1,19 @@
-export interface UnauthenticatedRouteConfig { pattern: string; description: string; allowDuringCircuitBreakerOpen?: boolean; requiresRateLimit?: boolean; }
-export const UNAUTHENTICATED_ROUTES: UnauthenticatedRouteConfig[] = [
-  { pattern: '/account-auth/*', description: 'All authentication pages', allowDuringCircuitBreakerOpen: true },
-  { pattern: '/account-auth/login', description: 'Login page', allowDuringCircuitBreakerOpen: true },
-  { pattern: '/account-auth/verify-code', description: '2FA page', allowDuringCircuitBreakerOpen: true },
-  { pattern: '/api/auth/*', description: 'Auth API endpoints', allowDuringCircuitBreakerOpen: true, requiresRateLimit: true },
-  { pattern: '/api/session/refresh-viability', description: 'Refresh viability check', allowDuringCircuitBreakerOpen: true },
-  { pattern: '/landing', description: 'Public landing', allowDuringCircuitBreakerOpen: true },
-  { pattern: '/service-unavailable', description: 'Service unavailable', allowDuringCircuitBreakerOpen: true },
-  { pattern: '/favicon.ico', description: 'Favicon', allowDuringCircuitBreakerOpen: true },
-  { pattern: '/robots.txt', description: 'Robots.txt', allowDuringCircuitBreakerOpen: true },
-  { pattern: '/sitemap.xml', description: 'Sitemap', allowDuringCircuitBreakerOpen: true },
-  { pattern: '/_next/*', description: 'Next.js assets', allowDuringCircuitBreakerOpen: true },
-  { pattern: '/public/*', description: 'Public assets', allowDuringCircuitBreakerOpen: true }
-];
-export function isUnauthenticatedRoute(pathname: string): boolean { return UNAUTHENTICATED_ROUTES.some(route => route.pattern.endsWith('*') ? pathname.startsWith(route.pattern.slice(0, -1)) : pathname === route.pattern); }
-export function isAllowedDuringCircuitBreakerOpen(pathname: string): boolean { const route = UNAUTHENTICATED_ROUTES.find(route => route.pattern.endsWith('*') ? pathname.startsWith(route.pattern.slice(0, -1)) : pathname === route.pattern); return route?.allowDuringCircuitBreakerOpen === true; }
-export function requiresRateLimit(pathname: string): boolean { const route = UNAUTHENTICATED_ROUTES.find(route => route.pattern.endsWith('*') ? pathname.startsWith(route.pattern.slice(0, -1)) : pathname === route.pattern); return route?.requiresRateLimit === true; }
-export default { UNAUTHENTICATED_ROUTES, isUnauthenticatedRoute, isAllowedDuringCircuitBreakerOpen, requiresRateLimit };
+export interface UnauthenticatedRouteConfig { pattern: string; description: string; allowDuringCircuitBreakerOpen?: boolean; requiresRateLimit?: boolean; }
+export const UNAUTHENTICATED_ROUTES: UnauthenticatedRouteConfig[] = [
+  { pattern: '/account-auth/*', description: 'All authentication pages', allowDuringCircuitBreakerOpen: true },
+  { pattern: '/account-auth/login', description: 'Login page', allowDuringCircuitBreakerOpen: true },
+  { pattern: '/account-auth/verify-code', description: '2FA page', allowDuringCircuitBreakerOpen: true },
+  { pattern: '/api/auth/*', description: 'Auth API endpoints', allowDuringCircuitBreakerOpen: true, requiresRateLimit: true },
+  { pattern: '/api/session/refresh-viability', description: 'Refresh viability check', allowDuringCircuitBreakerOpen: true },
+  { pattern: '/landing', description: 'Public landing', allowDuringCircuitBreakerOpen: true },
+  { pattern: '/service-unavailable', description: 'Service unavailable', allowDuringCircuitBreakerOpen: true },
+  { pattern: '/favicon.ico', description: 'Favicon', allowDuringCircuitBreakerOpen: true },
+  { pattern: '/robots.txt', description: 'Robots.txt', allowDuringCircuitBreakerOpen: true },
+  { pattern: '/sitemap.xml', description: 'Sitemap', allowDuringCircuitBreakerOpen: true },
+  { pattern: '/_next/*', description: 'Next.js assets', allowDuringCircuitBreakerOpen: true },
+  { pattern: '/public/*', description: 'Public assets', allowDuringCircuitBreakerOpen: true }
+];
+export function isUnauthenticatedRoute(pathname: string): boolean { return UNAUTHENTICATED_ROUTES.some(route => route.pattern.endsWith('*') ? pathname.startsWith(route.pattern.slice(0, -1)) : pathname === route.pattern); }
+export function isAllowedDuringCircuitBreakerOpen(pathname: string): boolean { const route = UNAUTHENTICATED_ROUTES.find(route => route.pattern.endsWith('*') ? pathname.startsWith(route.pattern.slice(0, -1)) : pathname === route.pattern); return route?.allowDuringCircuitBreakerOpen === true; }
+export function requiresRateLimit(pathname: string): boolean { const route = UNAUTHENTICATED_ROUTES.find(route => route.pattern.endsWith('*') ? pathname.startsWith(route.pattern.slice(0, -1)) : pathname === route.pattern); return route?.requiresRateLimit === true; }
+export default { UNAUTHENTICATED_ROUTES, isUnauthenticatedRoute, isAllowedDuringCircuitBreakerOpen, requiresRateLimit };

package/src/edge/internal-api-url.ts

@@ -1,65 +1,65 @@
-/**
- * Internal API URL Utility for Edge Runtime
- *
- * INTERNAL_API_URL is REQUIRED. This is the URL for THIS application calling ITSELF.
- * Used for middleware to call its own API routes (e.g., /api/session/viability).
- *
- * WHY HTTP IS REQUIRED (not optional):
- * - This is the app calling its OWN backend within the same pod/container
- * - NextAuth cookies are encrypted based on request protocol
- * - TLS is terminated at ingress, so the pod receives HTTP internally
- * - Using HTTPS here causes cookie decryption failures
- * - This is NOT about "K8s internal traffic doesn't need TLS" - it's about
- *   protocol consistency for cookie encryption
- *
- * This is NOT for calling the IDP - use IDP_URL for that.
- *
- * For local dev, set INTERNAL_API_URL=http://localhost:3000 (or your dev port).
- *
- * @module edge/internal-api-url
- * @version 3.0.0
- */
-
-import { NextRequest } from 'next/server';
-
-/**
- * Get the internal API base URL for middleware to call its own API routes.
- *
- * THROWS if INTERNAL_API_URL is not set. No fallbacks.
- *
- * @param request - The Next.js request object (unused, kept for API compatibility)
- * @returns Base URL string for constructing internal API calls
- * @throws Error if INTERNAL_API_URL environment variable is not set
- *
- * @example
- * ```typescript
- * import { getInternalApiUrl } from '@payez/next-mvp/edge';
- *
- * export async function middleware(request: NextRequest) {
- *   const baseUrl = getInternalApiUrl(request);
- *   const apiUrl = new URL('/api/session/check', baseUrl);
- *
- *   const response = await fetch(apiUrl, {
- *     headers: {
- *       'Cookie': request.headers.get('cookie') || ''
- *     }
- *   });
- * }
- * ```
- *
- * @environment INTERNAL_API_URL - REQUIRED. URL for this app to call ITSELF.
- *   MUST be HTTP (not HTTPS) - see module docs for why.
- *   K8s: http://myapp.namespace.svc.cluster.local:80
- *   Local: http://localhost:3000
- */
-export function getInternalApiUrl(request: NextRequest): string {
-  const internalUrl = process.env.INTERNAL_API_URL;
-  if (!internalUrl) {
-    throw new Error(
-      '[INTERNAL_API_URL] FATAL: INTERNAL_API_URL environment variable is REQUIRED. ' +
-      'This is for the app to call ITSELF. MUST be HTTP (not HTTPS). ' +
-      'Set to http://myapp.namespace.svc.cluster.local:80 (K8s) or http://localhost:3000 (local).'
-    );
-  }
-  return internalUrl;
-}
+/**
+ * Internal API URL Utility for Edge Runtime
+ *
+ * INTERNAL_API_URL is REQUIRED. This is the URL for THIS application calling ITSELF.
+ * Used for middleware to call its own API routes (e.g., /api/session/viability).
+ *
+ * WHY HTTP IS REQUIRED (not optional):
+ * - This is the app calling its OWN backend within the same pod/container
+ * - NextAuth cookies are encrypted based on request protocol
+ * - TLS is terminated at ingress, so the pod receives HTTP internally
+ * - Using HTTPS here causes cookie decryption failures
+ * - This is NOT about "K8s internal traffic doesn't need TLS" - it's about
+ *   protocol consistency for cookie encryption
+ *
+ * This is NOT for calling the IDP - use IDP_URL for that.
+ *
+ * For local dev, set INTERNAL_API_URL=http://localhost:3000 (or your dev port).
+ *
+ * @module edge/internal-api-url
+ * @version 3.0.0
+ */
+
+import { NextRequest } from 'next/server';
+
+/**
+ * Get the internal API base URL for middleware to call its own API routes.
+ *
+ * THROWS if INTERNAL_API_URL is not set. No fallbacks.
+ *
+ * @param request - The Next.js request object (unused, kept for API compatibility)
+ * @returns Base URL string for constructing internal API calls
+ * @throws Error if INTERNAL_API_URL environment variable is not set
+ *
+ * @example
+ * ```typescript
+ * import { getInternalApiUrl } from '@payez/next-mvp/edge';
+ *
+ * export async function middleware(request: NextRequest) {
+ *   const baseUrl = getInternalApiUrl(request);
+ *   const apiUrl = new URL('/api/session/check', baseUrl);
+ *
+ *   const response = await fetch(apiUrl, {
+ *     headers: {
+ *       'Cookie': request.headers.get('cookie') || ''
+ *     }
+ *   });
+ * }
+ * ```
+ *
+ * @environment INTERNAL_API_URL - REQUIRED. URL for this app to call ITSELF.
+ *   MUST be HTTP (not HTTPS) - see module docs for why.
+ *   K8s: http://myapp.namespace.svc.cluster.local:80
+ *   Local: http://localhost:3000
+ */
+export function getInternalApiUrl(request: NextRequest): string {
+  const internalUrl = process.env.INTERNAL_API_URL;
+  if (!internalUrl) {
+    throw new Error(
+      '[INTERNAL_API_URL] FATAL: INTERNAL_API_URL environment variable is REQUIRED. ' +
+      'This is for the app to call ITSELF. MUST be HTTP (not HTTPS). ' +
+      'Set to http://myapp.namespace.svc.cluster.local:80 (K8s) or http://localhost:3000 (local).'
+    );
+  }
+  return internalUrl;
+}

package/src/edge/middleware.ts

@@ -1,42 +1,42 @@
-/**
- * Edge Runtime Compatible Exports
- *
- * This module exports only Edge Runtime compatible code for use in Next.js middleware.
- * Client-side utilities that depend on browser APIs or server-only code are excluded.
- */
-
-// Authentication middleware and configuration (Edge Runtime compatible)
-export { makeAuthDecision } from '../auth/auth-decision';
-export {
-  isUnauthenticatedRoute,
-  configurePublicRoutes,
-  getRouteConfig,
-  configure2FABypassRoutes,
-  should2FABypass,
-  get2FABypassConfig
-} from '../auth/route-config';
-export type { UnauthenticatedRouteConfig, ProtectedRouteConfig } from '../auth/route-config';
-export { createMvpMiddleware } from '../middleware/create-middleware';
-export type {
-  MvpMiddlewareOptions,
-  CircuitBreakerProvider,
-  MiddlewareLogger,
-  AuthContext,
-  AuthAction,
-  SessionPointer,
-  SessionStatus
-} from '../middleware/create-middleware';
-
-// Two-Factor Authentication Presets (Edge Runtime compatible)
-export {
-  TwoFactorPresets,
-  AMRValues,
-  ACRLevels,
-  validateAMR,
-  validateACR,
-  checkTwoFactorRequirements
-} from '../middleware/twofa-presets';
-export type { TwoFactorRequirements, RouteConfig } from '../middleware/twofa-presets';
-
-// Internal API URL utilities for Edge Runtime
-export { getInternalApiUrl } from './internal-api-url';
+/**
+ * Edge Runtime Compatible Exports
+ *
+ * This module exports only Edge Runtime compatible code for use in Next.js middleware.
+ * Client-side utilities that depend on browser APIs or server-only code are excluded.
+ */
+
+// Authentication middleware and configuration (Edge Runtime compatible)
+export { makeAuthDecision } from '../auth/auth-decision';
+export {
+  isUnauthenticatedRoute,
+  configurePublicRoutes,
+  getRouteConfig,
+  configure2FABypassRoutes,
+  should2FABypass,
+  get2FABypassConfig
+} from '../auth/route-config';
+export type { UnauthenticatedRouteConfig, ProtectedRouteConfig } from '../auth/route-config';
+export { createMvpMiddleware } from '../middleware/create-middleware';
+export type {
+  MvpMiddlewareOptions,
+  CircuitBreakerProvider,
+  MiddlewareLogger,
+  AuthContext,
+  AuthAction,
+  SessionPointer,
+  SessionStatus
+} from '../middleware/create-middleware';
+
+// Two-Factor Authentication Presets (Edge Runtime compatible)
+export {
+  TwoFactorPresets,
+  AMRValues,
+  ACRLevels,
+  validateAMR,
+  validateACR,
+  checkTwoFactorRequirements
+} from '../middleware/twofa-presets';
+export type { TwoFactorRequirements, RouteConfig } from '../middleware/twofa-presets';
+
+// Internal API URL utilities for Edge Runtime
+export { getInternalApiUrl } from './internal-api-url';