@payez/next-mvp 4.1.11 → 4.1.12

package/src/pages/admin-roles/index.ts

@@ -1,9 +1,9 @@
-/**
- * Admin Roles Page exports
- *
- * - RolesAdminPage: Read-only admin interface for viewing roles and permissions (/admin/roles)
- *
- * MVP scope: Role creation/editing deferred to post-MVP.
- */
-
-export { default as RolesAdminPage } from './RolesAdminPage';
+/**
+ * Admin Roles Page exports
+ *
+ * - RolesAdminPage: Read-only admin interface for viewing roles and permissions (/admin/roles)
+ *
+ * MVP scope: Role creation/editing deferred to post-MVP.
+ */
+
+export { default as RolesAdminPage } from './RolesAdminPage';

package/src/pages/security/EnhancedSecurityPage.tsx

@@ -200,9 +200,9 @@ export default function EnhancedSecurityPage() {
   const layout = useLayout();
   const colors = useColors();
 
-  // Re-auth action types (moved for scope)
-type ReAuthAction = 'enable_2fa' | 'disable_2fa' | 'export_data' | 'delete_account' | null;
-
+  // Re-auth action types (moved for scope)
+type ReAuthAction = 'enable_2fa' | 'disable_2fa' | 'export_data' | 'delete_account' | null;
+
   // Security data state (would come from API in production)
   const [securityData, setSecurityData] = useState<SecurityData | null>(null);
   const [loadingSecurityData, setLoadingSecurityData] = useState(true);
@@ -218,12 +218,12 @@ type ReAuthAction = 'enable_2fa' | 'disable_2fa' | 'export_data' | 'delete_accou
     new_password: '',
     confirm_password: '',
   });
-  const [showPasswords, setShowPasswords] = useState({ current: false, new: false, confirm: false });
-
-  // Re-authentication modal state (Security Addendum)
-  const [reAuthModal, setReAuthModal] = useState<{
-    isOpen: boolean;
-    action: ReAuthAction;
+  const [showPasswords, setShowPasswords] = useState({ current: false, new: false, confirm: false });
+
+  // Re-authentication modal state (Security Addendum)
+  const [reAuthModal, setReAuthModal] = useState<{
+    isOpen: boolean;
+    action: ReAuthAction;
   }>({ isOpen: false, action: null });
   const [submitting, setSubmitting] = useState(false);
   const [error, setError] = useState('');

package/src/routes/account/index.ts

@@ -1,32 +1,32 @@
-/**
- * Account Route Exports
- *
- * Provides ready-to-use route exports for all 2FA/account management endpoints.
- * These routes handle the complete 2FA flow with zero configuration.
- *
- * @example
- * ```typescript
- * // Import individual routes
- * export { POST } from '@payez/next-mvp/routes/account/masked-info';
- * export { POST } from '@payez/next-mvp/routes/account/send-code';
- * export { POST } from '@payez/next-mvp/routes/account/verify-email';
- * export { POST } from '@payez/next-mvp/routes/account/verify-sms';
- * ```
- *
- * @version 2.3.0
- * @since auth-ready-v2
- */
-
-// Export individual route modules
-export * as maskedInfo from './masked-info';
-export * as sendCode from './send-code';
-export * as verifyEmail from './verify-email';
-export * as verifySms from './verify-sms';
-export * as updatePhone from './update-phone';
-
-// Re-export POST handlers for convenience (all 2FA endpoints use POST)
-export { POST as maskedInfoPOST } from './masked-info';
-export { POST as sendCodePOST } from './send-code';
-export { POST as verifyEmailPOST } from './verify-email';
-export { POST as verifySmsPOST } from './verify-sms';
+/**
+ * Account Route Exports
+ *
+ * Provides ready-to-use route exports for all 2FA/account management endpoints.
+ * These routes handle the complete 2FA flow with zero configuration.
+ *
+ * @example
+ * ```typescript
+ * // Import individual routes
+ * export { POST } from '@payez/next-mvp/routes/account/masked-info';
+ * export { POST } from '@payez/next-mvp/routes/account/send-code';
+ * export { POST } from '@payez/next-mvp/routes/account/verify-email';
+ * export { POST } from '@payez/next-mvp/routes/account/verify-sms';
+ * ```
+ *
+ * @version 2.3.0
+ * @since auth-ready-v2
+ */
+
+// Export individual route modules
+export * as maskedInfo from './masked-info';
+export * as sendCode from './send-code';
+export * as verifyEmail from './verify-email';
+export * as verifySms from './verify-sms';
+export * as updatePhone from './update-phone';
+
+// Re-export POST handlers for convenience (all 2FA endpoints use POST)
+export { POST as maskedInfoPOST } from './masked-info';
+export { POST as sendCodePOST } from './send-code';
+export { POST as verifyEmailPOST } from './verify-email';
+export { POST as verifySmsPOST } from './verify-sms';
 export { POST as updatePhonePOST } from './update-phone';

package/src/routes/account/masked-info.ts

@@ -1,37 +1,37 @@
-/**
- * Ready-to-Use Masked Info Route
- *
- * Provides a pre-configured handler for fetching masked contact information
- * during 2FA flow. Can be imported directly into your app's API routes with
- * zero configuration.
- *
- * @example
- * ```typescript
- * // app/api/account/masked-info/route.ts
- * export { POST } from '@payez/next-mvp/routes/account/masked-info';
- * ```
- *
- * @version 2.3.0
- * @since auth-ready-v2
- */
-
-// Re-export the POST handler from api-handlers
-// Note: IDP uses POST for masked-info endpoint
-export { POST } from '../../api-handlers/account/masked-info';
-
-/**
- * Pre-configured POST handler for masked contact information
- *
- * This endpoint is typically called during the 2FA flow to display masked
- * email/phone options to the user.
- *
- * Environment variables used:
- * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
- * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
- * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
- *
- * Returns:
- * - Masked email addresses
- * - Masked phone numbers
- * - Contact method preferences
+/**
+ * Ready-to-Use Masked Info Route
+ *
+ * Provides a pre-configured handler for fetching masked contact information
+ * during 2FA flow. Can be imported directly into your app's API routes with
+ * zero configuration.
+ *
+ * @example
+ * ```typescript
+ * // app/api/account/masked-info/route.ts
+ * export { POST } from '@payez/next-mvp/routes/account/masked-info';
+ * ```
+ *
+ * @version 2.3.0
+ * @since auth-ready-v2
+ */
+
+// Re-export the POST handler from api-handlers
+// Note: IDP uses POST for masked-info endpoint
+export { POST } from '../../api-handlers/account/masked-info';
+
+/**
+ * Pre-configured POST handler for masked contact information
+ *
+ * This endpoint is typically called during the 2FA flow to display masked
+ * email/phone options to the user.
+ *
+ * Environment variables used:
+ * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
+ * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
+ * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
+ *
+ * Returns:
+ * - Masked email addresses
+ * - Masked phone numbers
+ * - Contact method preferences
  */

package/src/routes/account/send-code.ts

@@ -1,40 +1,40 @@
-/**
- * Ready-to-Use Send Code Route
- *
- * Provides a pre-configured handler for sending 2FA verification codes
- * to the user's registered contact methods. Can be imported directly
- * into your app's API routes with zero configuration.
- *
- * @example
- * ```typescript
- * // app/api/account/send-code/route.ts
- * export { POST } from '@payez/next-mvp/routes/account/send-code';
- * ```
- *
- * @version 2.3.0
- * @since auth-ready-v2
- */
-
-// Re-export the POST handler from api-handlers
-export { POST } from '../../api-handlers/account/send-code';
-
-/**
- * Pre-configured POST handler for sending verification codes
- *
- * This endpoint triggers the IDP to send a verification code to the
- * user's selected contact method (email or SMS).
- *
- * Request body:
- * - method: 'email' | 'sms' - The contact method to use
- * - contactId: string - ID of the masked contact to send to
- *
- * Environment variables used:
- * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
- * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
- * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
- *
- * Returns:
- * - Success status
- * - Rate limit information
- * - Cooldown timer if applicable
+/**
+ * Ready-to-Use Send Code Route
+ *
+ * Provides a pre-configured handler for sending 2FA verification codes
+ * to the user's registered contact methods. Can be imported directly
+ * into your app's API routes with zero configuration.
+ *
+ * @example
+ * ```typescript
+ * // app/api/account/send-code/route.ts
+ * export { POST } from '@payez/next-mvp/routes/account/send-code';
+ * ```
+ *
+ * @version 2.3.0
+ * @since auth-ready-v2
+ */
+
+// Re-export the POST handler from api-handlers
+export { POST } from '../../api-handlers/account/send-code';
+
+/**
+ * Pre-configured POST handler for sending verification codes
+ *
+ * This endpoint triggers the IDP to send a verification code to the
+ * user's selected contact method (email or SMS).
+ *
+ * Request body:
+ * - method: 'email' | 'sms' - The contact method to use
+ * - contactId: string - ID of the masked contact to send to
+ *
+ * Environment variables used:
+ * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
+ * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
+ * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
+ *
+ * Returns:
+ * - Success status
+ * - Rate limit information
+ * - Cooldown timer if applicable
  */

package/src/routes/account/verify-email.ts

@@ -1,41 +1,41 @@
-/**
- * Ready-to-Use Verify Email Route
- *
- * Provides a pre-configured handler for verifying email-based 2FA codes.
- * Can be imported directly into your app's API routes with zero configuration.
- *
- * @example
- * ```typescript
- * // app/api/account/verify-email/route.ts
- * export { POST } from '@payez/next-mvp/routes/account/verify-email';
- * ```
- *
- * @version 2.3.0
- * @since auth-ready-v2
- */
-
-// Re-export the POST handler from api-handlers
-export { POST } from '../../api-handlers/account/verify-email';
-
-/**
- * Pre-configured POST handler for verifying email 2FA codes
- *
- * This endpoint verifies the code sent to the user's email address
- * and upgrades the provisional session to a full session.
- *
- * Request body:
- * - code: string - The 6-digit verification code
- * - emailId: string - ID of the email address used
- *
- * Environment variables used:
- * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
- * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
- * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
- *
- * Returns:
- * - Upgraded access token with MFA claim
- * - New refresh token
- * - Session upgrade status
- * - AMR (Authentication Methods Reference) array
- * - ACR (Authentication Context Class) level
+/**
+ * Ready-to-Use Verify Email Route
+ *
+ * Provides a pre-configured handler for verifying email-based 2FA codes.
+ * Can be imported directly into your app's API routes with zero configuration.
+ *
+ * @example
+ * ```typescript
+ * // app/api/account/verify-email/route.ts
+ * export { POST } from '@payez/next-mvp/routes/account/verify-email';
+ * ```
+ *
+ * @version 2.3.0
+ * @since auth-ready-v2
+ */
+
+// Re-export the POST handler from api-handlers
+export { POST } from '../../api-handlers/account/verify-email';
+
+/**
+ * Pre-configured POST handler for verifying email 2FA codes
+ *
+ * This endpoint verifies the code sent to the user's email address
+ * and upgrades the provisional session to a full session.
+ *
+ * Request body:
+ * - code: string - The 6-digit verification code
+ * - emailId: string - ID of the email address used
+ *
+ * Environment variables used:
+ * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
+ * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
+ * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
+ *
+ * Returns:
+ * - Upgraded access token with MFA claim
+ * - New refresh token
+ * - Session upgrade status
+ * - AMR (Authentication Methods Reference) array
+ * - ACR (Authentication Context Class) level
  */

package/src/routes/account/verify-sms.ts

@@ -1,41 +1,41 @@
-/**
- * Ready-to-Use Verify SMS Route
- *
- * Provides a pre-configured handler for verifying SMS-based 2FA codes.
- * Can be imported directly into your app's API routes with zero configuration.
- *
- * @example
- * ```typescript
- * // app/api/account/verify-sms/route.ts
- * export { POST } from '@payez/next-mvp/routes/account/verify-sms';
- * ```
- *
- * @version 2.3.0
- * @since auth-ready-v2
- */
-
-// Re-export the POST handler from api-handlers
-export { POST } from '../../api-handlers/account/verify-sms';
-
-/**
- * Pre-configured POST handler for verifying SMS 2FA codes
- *
- * This endpoint verifies the code sent to the user's phone number
- * and upgrades the provisional session to a full session.
- *
- * Request body:
- * - code: string - The 6-digit verification code
- * - phoneId: string - ID of the phone number used
- *
- * Environment variables used:
- * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
- * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
- * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
- *
- * Returns:
- * - Upgraded access token with MFA claim
- * - New refresh token
- * - Session upgrade status
- * - AMR (Authentication Methods Reference) array
- * - ACR (Authentication Context Class) level
+/**
+ * Ready-to-Use Verify SMS Route
+ *
+ * Provides a pre-configured handler for verifying SMS-based 2FA codes.
+ * Can be imported directly into your app's API routes with zero configuration.
+ *
+ * @example
+ * ```typescript
+ * // app/api/account/verify-sms/route.ts
+ * export { POST } from '@payez/next-mvp/routes/account/verify-sms';
+ * ```
+ *
+ * @version 2.3.0
+ * @since auth-ready-v2
+ */
+
+// Re-export the POST handler from api-handlers
+export { POST } from '../../api-handlers/account/verify-sms';
+
+/**
+ * Pre-configured POST handler for verifying SMS 2FA codes
+ *
+ * This endpoint verifies the code sent to the user's phone number
+ * and upgrades the provisional session to a full session.
+ *
+ * Request body:
+ * - code: string - The 6-digit verification code
+ * - phoneId: string - ID of the phone number used
+ *
+ * Environment variables used:
+ * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
+ * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
+ * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
+ *
+ * Returns:
+ * - Upgraded access token with MFA claim
+ * - New refresh token
+ * - Session upgrade status
+ * - AMR (Authentication Methods Reference) array
+ * - ACR (Authentication Context Class) level
  */

package/src/routes/auth/index.ts

@@ -1,23 +1,23 @@
-/**
- * @payez/next-mvp Ready-to-Use Route Exports
- *
- * Pre-configured route handlers that can be imported directly
- * into your Next.js app with zero configuration.
- *
- * @version 2.0.0
- * @since auth-ready-v2
- */
-
-// Export individual route handlers
-export { POST as refreshPOST } from './refresh';
-export { GET as sessionGET, POST as sessionPOST } from './session';
-export { POST as logoutPOST } from './logout';
-export { GET as viabilityGET } from './viability';
-export { GET as nextAuthGET, POST as nextAuthPOST } from './nextauth';
-
-// Also export as namespaced objects for cleaner imports
-export * as refresh from './refresh';
-export * as session from './session';
-export * as logout from './logout';
-export * as viability from './viability';
+/**
+ * @payez/next-mvp Ready-to-Use Route Exports
+ *
+ * Pre-configured route handlers that can be imported directly
+ * into your Next.js app with zero configuration.
+ *
+ * @version 2.0.0
+ * @since auth-ready-v2
+ */
+
+// Export individual route handlers
+export { POST as refreshPOST } from './refresh';
+export { GET as sessionGET, POST as sessionPOST } from './session';
+export { POST as logoutPOST } from './logout';
+export { GET as viabilityGET } from './viability';
+export { GET as nextAuthGET, POST as nextAuthPOST } from './nextauth';
+
+// Also export as namespaced objects for cleaner imports
+export * as refresh from './refresh';
+export * as session from './session';
+export * as logout from './logout';
+export * as viability from './viability';
 export * as nextauth from './nextauth';

package/src/routes/auth/refresh.ts

@@ -1,49 +1,49 @@
-/**
- * Ready-to-Use Refresh Token Route
- *
- * Provides a pre-configured refresh handler that can be imported directly
- * into your app's API routes with zero configuration.
- *
- * @example
- * ```typescript
- * // app/api/auth/refresh/route.ts
- * export { POST } from '@payez/next-mvp/routes/auth/refresh';
- * ```
- *
- * @version 2.0.0
- * @since auth-ready-v2
- */
-
-import { createRefreshHandler } from '../../api-handlers/auth/refresh';
-
-// Configuration is read at runtime from environment.
-function getConfig() {
-  const idpBaseUrl = process.env.IDP_URL;
-  if (!idpBaseUrl) {
-    throw new Error('[IDP_URL] FATAL: IDP_URL environment variable is REQUIRED.');
-  }
-  return {
-    idpBaseUrl,
-    clientId: process.env.CLIENT_ID || process.env.NEXT_PUBLIC_IDP_CLIENT_ID || '',
-    refreshEndpoint: process.env.REFRESH_ENDPOINT || '/api/ExternalAuth/refresh',
-  };
-}
-
-/**
- * Pre-configured POST handler for token refresh
- *
- * Environment variables used:
- * - IDP_URL (REQUIRED)
- * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
- * - REFRESH_ENDPOINT (default: /api/ExternalAuth/refresh)
- */
-let _handler: ReturnType<typeof createRefreshHandler> | null = null;
-
-import { NextRequest } from 'next/server';
-
-export async function POST(req: NextRequest) {
-  if (!_handler) {
-    _handler = createRefreshHandler(getConfig());
-  }
-  return _handler(req);
+/**
+ * Ready-to-Use Refresh Token Route
+ *
+ * Provides a pre-configured refresh handler that can be imported directly
+ * into your app's API routes with zero configuration.
+ *
+ * @example
+ * ```typescript
+ * // app/api/auth/refresh/route.ts
+ * export { POST } from '@payez/next-mvp/routes/auth/refresh';
+ * ```
+ *
+ * @version 2.0.0
+ * @since auth-ready-v2
+ */
+
+import { createRefreshHandler } from '../../api-handlers/auth/refresh';
+
+// Configuration is read at runtime from environment.
+function getConfig() {
+  const idpBaseUrl = process.env.IDP_URL;
+  if (!idpBaseUrl) {
+    throw new Error('[IDP_URL] FATAL: IDP_URL environment variable is REQUIRED.');
+  }
+  return {
+    idpBaseUrl,
+    clientId: process.env.CLIENT_ID || process.env.NEXT_PUBLIC_IDP_CLIENT_ID || '',
+    refreshEndpoint: process.env.REFRESH_ENDPOINT || '/api/ExternalAuth/refresh',
+  };
+}
+
+/**
+ * Pre-configured POST handler for token refresh
+ *
+ * Environment variables used:
+ * - IDP_URL (REQUIRED)
+ * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
+ * - REFRESH_ENDPOINT (default: /api/ExternalAuth/refresh)
+ */
+let _handler: ReturnType<typeof createRefreshHandler> | null = null;
+
+import { NextRequest } from 'next/server';
+
+export async function POST(req: NextRequest) {
+  if (!_handler) {
+    _handler = createRefreshHandler(getConfig());
+  }
+  return _handler(req);
 }