@payez/next-mvp 4.1.10 → 4.1.20

package/src/api-handlers/account/recovery/verify-code.ts

@@ -1,25 +1,73 @@
-import { NextRequest, NextResponse } from 'next/server';
-
-function getIdpUrl(): string {
-  const url = process.env.IDP_URL;
-  if (!url) throw new Error('[IDP_URL] FATAL: IDP_URL environment variable is REQUIRED.');
-  return url;
-}
-
-export async function POST(req: NextRequest) {
-  const IDP_URL = getIdpUrl();
-  try {
-    const auth = req.headers.get('authorization') || '';
-    const token = auth.startsWith('Bearer ') ? auth.slice(7) : '';
-    const { code, method } = await req.json();
-    const upstream = await fetch(`${IDP_URL}/api/Account/recovery/verify-code`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${token}` },
-      body: JSON.stringify({ code, method }),
-    });
-    const data = await upstream.json().catch(() => ({}));
-    return NextResponse.json(data, { status: upstream.status });
-  } catch {
-    return NextResponse.json({ success: false, error: 'verify_code_failed' }, { status: 500 });
-  }
-}
+import { NextRequest, NextResponse } from 'next/server';
+import { idpFetchJSON } from '../../../lib/idp-fetch';
+import { ENV_CONFIG } from '../../../config/env';
+
+/**
+ * Account recovery — verify-code
+ *
+ * WHY THIS WAS REWRITTEN (2026-08-02, swept out of QAPert defect #7)
+ * This handler read the caller's bearer straight off the inbound request:
+ *
+ *     const auth  = req.headers.get('authorization') || '';
+ *     const token = auth.startsWith('Bearer ') ? auth.slice(7) : '';
+ *     ... headers: { 'Authorization': `Bearer ${token}` }
+ *
+ * Browsers send a session COOKIE and no Authorization header, so `token` was
+ * ALWAYS the empty string and this always called the IDP with a literal
+ * "Bearer " and nothing after it.
+ *
+ * THAT IS WORSE THAN THE profile.ts VERSION OF THIS BUG, in two ways:
+ *
+ *   1. profile.ts at least 401'd when the header was missing. This one has no
+ *      check at all — `|| ''` swallows the absence — so it proceeds to call
+ *      upstream with an empty credential and returns the IDP's rejection as an
+ *      opaque failure. The user sees recovery "not working", not "not
+ *      authenticated", and the log shows an upstream error rather than an auth
+ *      one. The defect hides itself.
+ *   2. It is BOTH HALVES of account recovery — send-code and verify-code — so
+ *      the entire recovery path is unreachable, not merely degraded. This is
+ *      the flow a locked-out user reaches for, i.e. it fails exactly when it is
+ *      the only thing left that could help them.
+ *
+ * Fixed the same way as profile.ts and masked-info.ts: idpFetchJSON resolves
+ * the caller's token from the server-side session, so the cookie works and the
+ * token is never handed to browser JavaScript.
+ *
+ * @package @payez/next-mvp
+ */
+
+export async function POST(req: NextRequest) {
+  let payload: unknown = {};
+  try {
+    payload = await req.json();
+  } catch {
+    return NextResponse.json(
+      { success: false, error: 'invalid_request', message: 'A JSON body is required' },
+      { status: 400 }
+    );
+  }
+
+  const result = await idpFetchJSON(
+    req,
+    `${ENV_CONFIG.IDP_URL}/api/Account/recovery/verify-code`,
+    {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(payload),
+    }
+  );
+
+  if (!result.ok) {
+    return NextResponse.json(
+      {
+        success: false,
+        error: 'verify_code_failed',
+        message: result.json?.message || 'Upstream error',
+        meta: { status: result.status, attemptedRefresh: result.attemptedRefresh },
+      },
+      { status: result.status }
+    );
+  }
+
+  return NextResponse.json(result.json, { status: 200 });
+}

package/src/api-handlers/account/reset-password.ts

@@ -1,23 +1,23 @@
-import { NextRequest, NextResponse } from 'next/server';
-
-function getIdpUrl(): string {
-  const url = process.env.IDP_URL;
-  if (!url) throw new Error('[IDP_URL] FATAL: IDP_URL environment variable is REQUIRED.');
-  return url;
-}
-
-export async function POST(req: NextRequest) {
-  const IDP_URL = getIdpUrl();
-  try {
-    const payload = await req.json();
-    const upstream = await fetch(`${IDP_URL}/api/Account/reset-password`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify(payload),
-    });
-    const data = await upstream.json().catch(() => ({}));
-    return NextResponse.json(data, { status: upstream.status });
-  } catch {
-    return NextResponse.json({ success: false, error: 'reset_password_failed' }, { status: 500 });
-  }
-}
+import { NextRequest, NextResponse } from 'next/server';
+
+function getIdpUrl(): string {
+  const url = process.env.IDP_URL;
+  if (!url) throw new Error('[IDP_URL] FATAL: IDP_URL environment variable is REQUIRED.');
+  return url;
+}
+
+export async function POST(req: NextRequest) {
+  const IDP_URL = getIdpUrl();
+  try {
+    const payload = await req.json();
+    const upstream = await fetch(`${IDP_URL}/api/Account/reset-password`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(payload),
+    });
+    const data = await upstream.json().catch(() => ({}));
+    return NextResponse.json(data, { status: upstream.status });
+  } catch {
+    return NextResponse.json({ success: false, error: 'reset_password_failed' }, { status: 500 });
+  }
+}

package/src/api-handlers/account/send-code.ts

@@ -1,76 +1,76 @@
-/**
- * Send 2FA Verification Code Handler
- *
- * Sends a verification code via email or SMS to the authenticated user.
- * Requires a provisional Bearer token (ACR=1) from initial login.
- *
- * @package @payez/next-mvp
- */
-
-import { NextRequest, NextResponse } from 'next/server';
-import { idpFetchJSON } from '../../lib/idp-fetch';
-import { ENV_CONFIG } from '../../config/env';
-
-export async function POST(req: NextRequest) {
-  try {
-    // Parse request body
-    const body = await req.json();
-    const method = String(body.method || '').toLowerCase();
-
-    if (method !== 'sms' && method !== 'email') {
-      return NextResponse.json(
-        {
-          success: false,
-          error: 'Method must be either "sms" or "email"',
-          code: 'INVALID_METHOD',
-        },
-        { status: 400 }
-      );
-    }
-
-    // Build IDP endpoint URL
-    const idpEndpoint = method === 'sms'
-      ? '/api/ExternalAuth/twofa/sms/send'
-      : '/api/ExternalAuth/twofa/email/send';
-
-    // Send client_id in body (lower_snake_case per PayEz standards)
-    const idpBody = JSON.stringify({ client_id: ENV_CONFIG.CLIENT_ID });
-
-    // Call IDP using idpFetchJSON which auto-injects Bearer token from Redis session
-    const result = await idpFetchJSON(req, `${ENV_CONFIG.IDP_URL}${idpEndpoint}`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: idpBody,
-    });
-
-    if (!result.ok) {
-      return NextResponse.json(
-        {
-          success: false,
-          error: result.json?.message || `Failed to send ${method} code`,
-          code: result.json?.code || 'IDP_ERROR',
-          meta: { attemptedRefresh: result.attemptedRefresh },
-        },
-        { status: result.status }
-      );
-    }
-
-    return NextResponse.json(
-      {
-        success: true,
-        message: `Verification code sent via ${method}`,
-      },
-      { status: 200 }
-    );
-  } catch (error) {
-    console.error('[SEND_CODE] Error:', error);
-    return NextResponse.json(
-      {
-        success: false,
-        error: 'Failed to send verification code',
-        code: 'INTERNAL_ERROR',
-      },
-      { status: 500 }
-    );
-  }
-}
+/**
+ * Send 2FA Verification Code Handler
+ *
+ * Sends a verification code via email or SMS to the authenticated user.
+ * Requires a provisional Bearer token (ACR=1) from initial login.
+ *
+ * @package @payez/next-mvp
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { idpFetchJSON } from '../../lib/idp-fetch';
+import { ENV_CONFIG } from '../../config/env';
+
+export async function POST(req: NextRequest) {
+  try {
+    // Parse request body
+    const body = await req.json();
+    const method = String(body.method || '').toLowerCase();
+
+    if (method !== 'sms' && method !== 'email') {
+      return NextResponse.json(
+        {
+          success: false,
+          error: 'Method must be either "sms" or "email"',
+          code: 'INVALID_METHOD',
+        },
+        { status: 400 }
+      );
+    }
+
+    // Build IDP endpoint URL
+    const idpEndpoint = method === 'sms'
+      ? '/api/ExternalAuth/twofa/sms/send'
+      : '/api/ExternalAuth/twofa/email/send';
+
+    // Send client_id in body (lower_snake_case per PayEz standards)
+    const idpBody = JSON.stringify({ client_id: ENV_CONFIG.CLIENT_ID });
+
+    // Call IDP using idpFetchJSON which auto-injects Bearer token from Redis session
+    const result = await idpFetchJSON(req, `${ENV_CONFIG.IDP_URL}${idpEndpoint}`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: idpBody,
+    });
+
+    if (!result.ok) {
+      return NextResponse.json(
+        {
+          success: false,
+          error: result.json?.message || `Failed to send ${method} code`,
+          code: result.json?.code || 'IDP_ERROR',
+          meta: { attemptedRefresh: result.attemptedRefresh },
+        },
+        { status: result.status }
+      );
+    }
+
+    return NextResponse.json(
+      {
+        success: true,
+        message: `Verification code sent via ${method}`,
+      },
+      { status: 200 }
+    );
+  } catch (error) {
+    console.error('[SEND_CODE] Error:', error);
+    return NextResponse.json(
+      {
+        success: false,
+        error: 'Failed to send verification code',
+        code: 'INTERNAL_ERROR',
+      },
+      { status: 500 }
+    );
+  }
+}

package/src/api-handlers/account/validate-password.ts

@@ -1,118 +1,118 @@
-import { NextRequest, NextResponse } from 'next/server';
-
-interface ValidatePasswordRequest {
-  password: string;
-}
-
-interface ValidatePasswordResponse {
-  is_valid: boolean;
-  score: number;
-  failed_requirements: string[];
-  tip?: string;
-  policy?: {
-    min_length?: number;
-    require_uppercase?: boolean;
-    require_lowercase?: boolean;
-    require_digit?: boolean;
-    require_special?: boolean;
-    min_strength_score?: number;
-  };
-}
-
-export async function POST(req: NextRequest) {
-  try {
-    const body = await req.json();
-    const { password } = body as ValidatePasswordRequest;
-    const requestId = req.headers.get('x-request-id') ?? crypto.randomUUID();
-
-    // Validate input
-    if (!password || typeof password !== 'string') {
-      return NextResponse.json(
-        {
-          is_valid: false,
-          score: 0,
-          failed_requirements: ['Password is required'],
-        } as ValidatePasswordResponse,
-        {
-          status: 200, // Return 200 even for validation errors to keep UI responsive
-          headers: { 'Cache-Control': 'no-store' },
-        }
-      );
-    }
-
-    // Get IDP base URL and client ID from environment
-    const idpBaseUrl = process.env.IDP_URL;
-
-    const clientId = process.env.CLIENT_ID || process.env.NEXT_PUBLIC_CLIENT_ID;
-
-    if (!idpBaseUrl) {
-      console.error('[VALIDATE_PASSWORD] IDP_URL not configured');
-      return NextResponse.json(
-        {
-          is_valid: false,
-          score: 0,
-          failed_requirements: ['Password validation service unavailable'],
-        } as ValidatePasswordResponse,
-        {
-          status: 200,
-          headers: { 'Cache-Control': 'no-store' },
-        }
-      );
-    }
-
-    // Proxy request to IDP
-    const idpUrl = `${idpBaseUrl}/api/Account/validate-password`;
-    const payload = {
-      password,
-      client_id: clientId,
-    };
-
-    const idpResponse = await fetch(idpUrl, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        'x-request-id': requestId,
-      },
-      body: JSON.stringify(payload),
-    });
-
-    const responseData = await idpResponse.json().catch(() => ({}));
-
-    if (!idpResponse.ok) {
-      console.error('[VALIDATE_PASSWORD] IDP error:', {
-        status: idpResponse.status,
-        response: responseData,
-      });
-      return NextResponse.json(
-        {
-          is_valid: false,
-          score: 0,
-          failed_requirements: ['Password validation failed'],
-        } as ValidatePasswordResponse,
-        {
-          status: 200,
-          headers: { 'Cache-Control': 'no-store' },
-        }
-      );
-    }
-
-    // Return the IDP response with proper structure
-    return NextResponse.json(responseData as ValidatePasswordResponse, {
-      status: 200,
-      headers: { 'Cache-Control': 'no-store' },
-    });
-  } catch (error) {
-    console.error('[VALIDATE_PASSWORD] Error:', error);
-    return NextResponse.json(
-      {
-        is_valid: false,
-        score: 0,
-        failed_requirements: ['Password validation failed'],
-      } as ValidatePasswordResponse,
-      {
-        status: 200,
-        headers: { 'Cache-Control': 'no-store' },
-      }
-    );
-  }
-}
+import { NextRequest, NextResponse } from 'next/server';
+
+interface ValidatePasswordRequest {
+  password: string;
+}
+
+interface ValidatePasswordResponse {
+  is_valid: boolean;
+  score: number;
+  failed_requirements: string[];
+  tip?: string;
+  policy?: {
+    min_length?: number;
+    require_uppercase?: boolean;
+    require_lowercase?: boolean;
+    require_digit?: boolean;
+    require_special?: boolean;
+    min_strength_score?: number;
+  };
+}
+
+export async function POST(req: NextRequest) {
+  try {
+    const body = await req.json();
+    const { password } = body as ValidatePasswordRequest;
+    const requestId = req.headers.get('x-request-id') ?? crypto.randomUUID();
+
+    // Validate input
+    if (!password || typeof password !== 'string') {
+      return NextResponse.json(
+        {
+          is_valid: false,
+          score: 0,
+          failed_requirements: ['Password is required'],
+        } as ValidatePasswordResponse,
+        {
+          status: 200, // Return 200 even for validation errors to keep UI responsive
+          headers: { 'Cache-Control': 'no-store' },
+        }
+      );
+    }
+
+    // Get IDP base URL and client ID from environment
+    const idpBaseUrl = process.env.IDP_URL;
+
+    const clientId = process.env.CLIENT_ID || process.env.NEXT_PUBLIC_CLIENT_ID;
+
+    if (!idpBaseUrl) {
+      console.error('[VALIDATE_PASSWORD] IDP_URL not configured');
+      return NextResponse.json(
+        {
+          is_valid: false,
+          score: 0,
+          failed_requirements: ['Password validation service unavailable'],
+        } as ValidatePasswordResponse,
+        {
+          status: 200,
+          headers: { 'Cache-Control': 'no-store' },
+        }
+      );
+    }
+
+    // Proxy request to IDP
+    const idpUrl = `${idpBaseUrl}/api/Account/validate-password`;
+    const payload = {
+      password,
+      client_id: clientId,
+    };
+
+    const idpResponse = await fetch(idpUrl, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'x-request-id': requestId,
+      },
+      body: JSON.stringify(payload),
+    });
+
+    const responseData = await idpResponse.json().catch(() => ({}));
+
+    if (!idpResponse.ok) {
+      console.error('[VALIDATE_PASSWORD] IDP error:', {
+        status: idpResponse.status,
+        response: responseData,
+      });
+      return NextResponse.json(
+        {
+          is_valid: false,
+          score: 0,
+          failed_requirements: ['Password validation failed'],
+        } as ValidatePasswordResponse,
+        {
+          status: 200,
+          headers: { 'Cache-Control': 'no-store' },
+        }
+      );
+    }
+
+    // Return the IDP response with proper structure
+    return NextResponse.json(responseData as ValidatePasswordResponse, {
+      status: 200,
+      headers: { 'Cache-Control': 'no-store' },
+    });
+  } catch (error) {
+    console.error('[VALIDATE_PASSWORD] Error:', error);
+    return NextResponse.json(
+      {
+        is_valid: false,
+        score: 0,
+        failed_requirements: ['Password validation failed'],
+      } as ValidatePasswordResponse,
+      {
+        status: 200,
+        headers: { 'Cache-Control': 'no-store' },
+      }
+    );
+  }
+}

package/src/api-handlers/account/verify-email.ts

@@ -54,6 +54,11 @@ export async function POST(req: NextRequest) {
     const unwrappedData = result.json?.data || result.json;
 
     // If we have new tokens, update the session to complete 2FA
+    // Reports whether the session ACTUALLY transitioned. Must not be assumed
+    // from a 2xx: the IDP can verify the code while we fail to transition
+    // (no tokens returned, or no resolvable session token).
+    let sessionTransitioned = false;
+
     if (unwrappedData.access_token && unwrappedData.refresh_token) {
       // Get session token from NextAuth
       // Support both field names: sessionToken (auth.ts JWT) and redisSessionId (legacy)
@@ -97,18 +102,27 @@ export async function POST(req: NextRequest) {
           'email' // Store 2FA method for refresh token flow
         );
 
+        sessionTransitioned = true;
+
         console.log('[VERIFY_EMAIL] Session updated successfully', {
           accessTokenExpires: new Date(accessTokenExpires).toISOString(),
           refreshTokenExpires: new Date(refreshTokenExpires).toISOString()
         });
+      } else {
+        console.warn('[VERIFY_EMAIL] IDP verified the code but no session token was resolvable — session NOT transitioned');
       }
+    } else {
+      console.warn('[VERIFY_EMAIL] IDP returned 2xx without tokens — session NOT transitioned');
     }
 
     // Return simplified success response (don't expose tokens to client)
     return NextResponse.json({
       success: true,
       verificationSuccessful: true,
-      twoFactorSessionVerified: true,
+      // NOT a copy of `success` — reports what actually happened. A client that
+      // trusted a hardcoded true would show the user as MFA-verified while the
+      // session still says otherwise.
+      twoFactorSessionVerified: sessionTransitioned,
       message: unwrappedData.message || 'Email code verified successfully'
     }, { status: 200 });
   } catch (error) {

package/src/api-handlers/account/verify-sms.ts

@@ -54,6 +54,11 @@ export async function POST(req: NextRequest) {
     const unwrappedData = result.json?.data || result.json;
 
     // If we have new tokens, update the session to complete 2FA
+    // Reports whether the session ACTUALLY transitioned. Must not be assumed
+    // from a 2xx: the IDP can verify the code while we fail to transition
+    // (no tokens returned, or no resolvable session token).
+    let sessionTransitioned = false;
+
     if (unwrappedData.access_token && unwrappedData.refresh_token) {
       // Get session token from NextAuth
       // Support both field names: sessionToken (auth.ts JWT) and redisSessionId (legacy)
@@ -97,18 +102,27 @@ export async function POST(req: NextRequest) {
           'sms' // Store 2FA method for refresh token flow
         );
 
+        sessionTransitioned = true;
+
         console.log('[VERIFY_SMS] Session updated successfully', {
           accessTokenExpires: new Date(accessTokenExpires).toISOString(),
           refreshTokenExpires: new Date(refreshTokenExpires).toISOString()
         });
+      } else {
+        console.warn('[VERIFY_SMS] IDP verified the code but no session token was resolvable — session NOT transitioned');
       }
+    } else {
+      console.warn('[VERIFY_SMS] IDP returned 2xx without tokens — session NOT transitioned');
     }
 
     // Return simplified success response (don't expose tokens to client)
     return NextResponse.json({
       success: true,
       verificationSuccessful: true,
-      twoFactorSessionVerified: true,
+      // NOT a copy of `success` — reports what actually happened. A client that
+      // trusted a hardcoded true would show the user as MFA-verified while the
+      // session still says otherwise.
+      twoFactorSessionVerified: sessionTransitioned,
       message: unwrappedData.message || 'SMS code verified successfully'
     }, { status: 200 });
   } catch (error) {