@payez/next-mvp 4.1.11 → 4.1.12

package/src/api-handlers/auth/login.ts

@@ -1,240 +1,240 @@
-/**
- * Authentication Login API Handler
- *
- * Handles user authentication against the external IDP service.
- * This handler is designed to be imported and used by Next.js applications
- * using the @payez/next-mvp package.
- *
- * @version 2.0
- * @requires No authentication (public endpoint)
- */
-
-import { NextRequest, NextResponse } from 'next/server';
-
-// Add protection headers to all responses
-function addSecurityHeaders(response: NextResponse) {
-  // Content Security Policy - restrictive for auth endpoints
-  response.headers.set('Content-Security-Policy', "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';");
-
-  // Prevent clickjacking
-  response.headers.set('X-Frame-Options', 'DENY');
-
-  // Prevent MIME type sniffing
-  response.headers.set('X-Content-Type-Options', 'nosniff');
-
-  // Enable XSS protection
-  response.headers.set('X-XSS-Protection', '1; mode=block');
-
-  // Strict transport security for HTTPS
-  response.headers.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains; preload');
-
-  // Referrer policy
-  response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
-
-  // Permissions policy
-  response.headers.set('Permissions-Policy', 'geolocation=(), microphone=(), camera=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()');
-
-  // Cache control for sensitive auth endpoints
-  response.headers.set('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
-  response.headers.set('Pragma', 'no-cache');
-  response.headers.set('Expires', '0');
-
-  return response;
-}
-
-interface LoginRequest {
-  username_or_email: string;
-  password: string;
-  client_id?: string;
-  client_type?: string;
-  two_factor_code?: string;
-  two_factor_recovery_code?: string;
-}
-
-interface LoginConfig {
-  idpBaseUrl: string;
-  clientId: string;
-  loginEndpoint?: string;
-  clientType?: string; // "partner" or "idp", defaults to "partner" for CryptAply
-}
-
-/**
- * Creates a login handler for Next.js API routes
- *
- * @param config Configuration for IDP connection
- * @returns Next.js POST handler function
- *
- * @example
- * ```typescript
- * // In your app's /app/api/auth/login/route.ts
- * import { createLoginHandler } from '@payez/next-mvp/api-handlers/auth/login';
- *
- * export const POST = createLoginHandler({
- *   idpBaseUrl: process.env.IDP_URL!,
- *   clientId: process.env.CLIENT_ID!,
- *   loginEndpoint: '/api/ExternalAuth/login'
- * });
- * ```
- */
-export function createLoginHandler(config: LoginConfig) {
-  const { idpBaseUrl, clientId, loginEndpoint = '/api/ExternalAuth/login', clientType = 'partner' } = config;
-
-  return async function POST(req: NextRequest) {
-    let body: LoginRequest;
-
-    try {
-      body = await req.json();
-    } catch (parseError) {
-      return NextResponse.json(
-        { error: 'Invalid JSON format' },
-        { status: 400 }
-      );
-    }
-
-    const { username_or_email, password, client_type, two_factor_code, two_factor_recovery_code } = body;
-
-    // Validate required fields
-    if (!username_or_email || typeof username_or_email !== 'string' || username_or_email.trim() === '') {
-      return NextResponse.json(
-        { error: 'username_or_email is required' },
-        { status: 400 }
-      );
-    }
-
-    if (!password || typeof password !== 'string' || password.trim() === '') {
-      return NextResponse.json(
-        { error: 'Password is required' },
-        { status: 400 }
-      );
-    }
-
-    const idpUrl = `${idpBaseUrl}${loginEndpoint}`;
-    const payload: any = {
-      username_or_email,
-      password,
-      client_id: clientId,
-      client_type: client_type || clientType // Use provided client_type or config default
-    };
-
-    // Add optional 2FA fields if provided
-    if (two_factor_code) {
-      payload.two_factor_code = two_factor_code;
-    }
-    if (two_factor_recovery_code) {
-      payload.two_factor_recovery_code = two_factor_recovery_code;
-    }
-
-    // Extract client headers for forwarding to IDP
-    const clientHeaders: Record<string, string> = {};
-
-    // Forward client IP if available
-    const clientIp = req.headers.get('x-forwarded-for') || req.headers.get('x-real-ip');
-    if (clientIp) {
-      clientHeaders['X-Forwarded-For'] = clientIp.split(',')[0].trim();
-    }
-
-    // Forward user agent if available
-    const userAgent = req.headers.get('user-agent');
-    if (userAgent) {
-      clientHeaders['User-Agent'] = userAgent;
-    }
-
-    const headers = {
-      'Content-Type': 'application/json',
-      'Accept': 'application/json',
-      'Cookie': 'X-Device-Id=payez-PayEz-6c8201c35c1b44c9b2e823b36b95a718',
-      ...clientHeaders
-    };
-
-    try {
-      const backendResponse = await fetch(idpUrl, {
-        method: 'POST',
-        headers,
-        body: JSON.stringify(payload),
-      });
-
-      const rawText = await backendResponse.text();
-      let data: any;
-
-      try {
-        data = JSON.parse(rawText);
-      } catch (jsonError) {
-        console.error('[LOGIN] IDP returned non-JSON response', {
-          response: rawText,
-          status: backendResponse.status
-        });
-        return NextResponse.json(
-          { error: 'Invalid response from authentication service' },
-          { status: 502 }
-        );
-      }
-
-      if (!backendResponse.ok) {
-        // Handle rate limiting specifically
-        if (backendResponse.status === 429) {
-          const retryAfter = backendResponse.headers.get('retry-after');
-          const retryAfterSeconds = retryAfter ? parseInt(retryAfter) : 60;
-
-          return addSecurityHeaders(NextResponse.json({
-            success: false,
-            error: 'RATE_LIMIT_EXCEEDED',
-            message: 'Too many login attempts. Please try again later.',
-            retryAfter: retryAfterSeconds
-          }, { status: 429 }));
-        }
-
-        // Pass through error from IDP
-        console.error('[LOGIN] IDP service error', {
-          status: backendResponse.status,
-          error: data
-        });
-        return addSecurityHeaders(NextResponse.json(data, { status: backendResponse.status }));
-      }
-
-      if (!data.success) {
-        // IDP returned a canonical error envelope with HTTP 200
-        console.error('[LOGIN] IDP authentication failure', { error: data });
-        return addSecurityHeaders(NextResponse.json(data, { status: 200 }));
-      }
-
-      // Normalize response shape for NextAuth authorize()
-      const normalized = {
-        success: data?.success === true,
-        result: (data?.data && data?.data?.result) ? data.data.result : (data?.result ?? data),
-        // Preserve original payload for debugging/compatibility
-        original: data
-      };
-
-      return addSecurityHeaders(NextResponse.json(normalized as any));
-
-    } catch (error) {
-      // Handle network and other errors
-      console.error('[LOGIN] FETCH FAILED:', {
-        error: error instanceof Error ? error.message : String(error),
-        idpUrl
-      });
-
-      if (error instanceof Error && error.message.includes('fetch')) {
-        return NextResponse.json(
-          { error: 'Unable to connect to authentication service' },
-          { status: 503 }
-        );
-      }
-
-      return NextResponse.json(
-        { error: 'An unexpected error occurred during login' },
-        { status: 500 }
-      );
-    }
-  };
-}
-
-/**
- * Default export for backward compatibility
- * Requires environment variables: IDP_URL, CLIENT_ID
- */
-export const POST = createLoginHandler({
-  idpBaseUrl: process.env.IDP_URL!,
-  clientId: process.env.CLIENT_ID || 'payez_default_client',
-  loginEndpoint: '/api/ExternalAuth/login'
-});
+/**
+ * Authentication Login API Handler
+ *
+ * Handles user authentication against the external IDP service.
+ * This handler is designed to be imported and used by Next.js applications
+ * using the @payez/next-mvp package.
+ *
+ * @version 2.0
+ * @requires No authentication (public endpoint)
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+
+// Add protection headers to all responses
+function addSecurityHeaders(response: NextResponse) {
+  // Content Security Policy - restrictive for auth endpoints
+  response.headers.set('Content-Security-Policy', "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';");
+
+  // Prevent clickjacking
+  response.headers.set('X-Frame-Options', 'DENY');
+
+  // Prevent MIME type sniffing
+  response.headers.set('X-Content-Type-Options', 'nosniff');
+
+  // Enable XSS protection
+  response.headers.set('X-XSS-Protection', '1; mode=block');
+
+  // Strict transport security for HTTPS
+  response.headers.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains; preload');
+
+  // Referrer policy
+  response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
+
+  // Permissions policy
+  response.headers.set('Permissions-Policy', 'geolocation=(), microphone=(), camera=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()');
+
+  // Cache control for sensitive auth endpoints
+  response.headers.set('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
+  response.headers.set('Pragma', 'no-cache');
+  response.headers.set('Expires', '0');
+
+  return response;
+}
+
+interface LoginRequest {
+  username_or_email: string;
+  password: string;
+  client_id?: string;
+  client_type?: string;
+  two_factor_code?: string;
+  two_factor_recovery_code?: string;
+}
+
+interface LoginConfig {
+  idpBaseUrl: string;
+  clientId: string;
+  loginEndpoint?: string;
+  clientType?: string; // "partner" or "idp", defaults to "partner" for CryptAply
+}
+
+/**
+ * Creates a login handler for Next.js API routes
+ *
+ * @param config Configuration for IDP connection
+ * @returns Next.js POST handler function
+ *
+ * @example
+ * ```typescript
+ * // In your app's /app/api/auth/login/route.ts
+ * import { createLoginHandler } from '@payez/next-mvp/api-handlers/auth/login';
+ *
+ * export const POST = createLoginHandler({
+ *   idpBaseUrl: process.env.IDP_URL!,
+ *   clientId: process.env.CLIENT_ID!,
+ *   loginEndpoint: '/api/ExternalAuth/login'
+ * });
+ * ```
+ */
+export function createLoginHandler(config: LoginConfig) {
+  const { idpBaseUrl, clientId, loginEndpoint = '/api/ExternalAuth/login', clientType = 'partner' } = config;
+
+  return async function POST(req: NextRequest) {
+    let body: LoginRequest;
+
+    try {
+      body = await req.json();
+    } catch (parseError) {
+      return NextResponse.json(
+        { error: 'Invalid JSON format' },
+        { status: 400 }
+      );
+    }
+
+    const { username_or_email, password, client_type, two_factor_code, two_factor_recovery_code } = body;
+
+    // Validate required fields
+    if (!username_or_email || typeof username_or_email !== 'string' || username_or_email.trim() === '') {
+      return NextResponse.json(
+        { error: 'username_or_email is required' },
+        { status: 400 }
+      );
+    }
+
+    if (!password || typeof password !== 'string' || password.trim() === '') {
+      return NextResponse.json(
+        { error: 'Password is required' },
+        { status: 400 }
+      );
+    }
+
+    const idpUrl = `${idpBaseUrl}${loginEndpoint}`;
+    const payload: any = {
+      username_or_email,
+      password,
+      client_id: clientId,
+      client_type: client_type || clientType // Use provided client_type or config default
+    };
+
+    // Add optional 2FA fields if provided
+    if (two_factor_code) {
+      payload.two_factor_code = two_factor_code;
+    }
+    if (two_factor_recovery_code) {
+      payload.two_factor_recovery_code = two_factor_recovery_code;
+    }
+
+    // Extract client headers for forwarding to IDP
+    const clientHeaders: Record<string, string> = {};
+
+    // Forward client IP if available
+    const clientIp = req.headers.get('x-forwarded-for') || req.headers.get('x-real-ip');
+    if (clientIp) {
+      clientHeaders['X-Forwarded-For'] = clientIp.split(',')[0].trim();
+    }
+
+    // Forward user agent if available
+    const userAgent = req.headers.get('user-agent');
+    if (userAgent) {
+      clientHeaders['User-Agent'] = userAgent;
+    }
+
+    const headers = {
+      'Content-Type': 'application/json',
+      'Accept': 'application/json',
+      'Cookie': 'X-Device-Id=payez-PayEz-6c8201c35c1b44c9b2e823b36b95a718',
+      ...clientHeaders
+    };
+
+    try {
+      const backendResponse = await fetch(idpUrl, {
+        method: 'POST',
+        headers,
+        body: JSON.stringify(payload),
+      });
+
+      const rawText = await backendResponse.text();
+      let data: any;
+
+      try {
+        data = JSON.parse(rawText);
+      } catch (jsonError) {
+        console.error('[LOGIN] IDP returned non-JSON response', {
+          response: rawText,
+          status: backendResponse.status
+        });
+        return NextResponse.json(
+          { error: 'Invalid response from authentication service' },
+          { status: 502 }
+        );
+      }
+
+      if (!backendResponse.ok) {
+        // Handle rate limiting specifically
+        if (backendResponse.status === 429) {
+          const retryAfter = backendResponse.headers.get('retry-after');
+          const retryAfterSeconds = retryAfter ? parseInt(retryAfter) : 60;
+
+          return addSecurityHeaders(NextResponse.json({
+            success: false,
+            error: 'RATE_LIMIT_EXCEEDED',
+            message: 'Too many login attempts. Please try again later.',
+            retryAfter: retryAfterSeconds
+          }, { status: 429 }));
+        }
+
+        // Pass through error from IDP
+        console.error('[LOGIN] IDP service error', {
+          status: backendResponse.status,
+          error: data
+        });
+        return addSecurityHeaders(NextResponse.json(data, { status: backendResponse.status }));
+      }
+
+      if (!data.success) {
+        // IDP returned a canonical error envelope with HTTP 200
+        console.error('[LOGIN] IDP authentication failure', { error: data });
+        return addSecurityHeaders(NextResponse.json(data, { status: 200 }));
+      }
+
+      // Normalize response shape for NextAuth authorize()
+      const normalized = {
+        success: data?.success === true,
+        result: (data?.data && data?.data?.result) ? data.data.result : (data?.result ?? data),
+        // Preserve original payload for debugging/compatibility
+        original: data
+      };
+
+      return addSecurityHeaders(NextResponse.json(normalized as any));
+
+    } catch (error) {
+      // Handle network and other errors
+      console.error('[LOGIN] FETCH FAILED:', {
+        error: error instanceof Error ? error.message : String(error),
+        idpUrl
+      });
+
+      if (error instanceof Error && error.message.includes('fetch')) {
+        return NextResponse.json(
+          { error: 'Unable to connect to authentication service' },
+          { status: 503 }
+        );
+      }
+
+      return NextResponse.json(
+        { error: 'An unexpected error occurred during login' },
+        { status: 500 }
+      );
+    }
+  };
+}
+
+/**
+ * Default export for backward compatibility
+ * Requires environment variables: IDP_URL, CLIENT_ID
+ */
+export const POST = createLoginHandler({
+  idpBaseUrl: process.env.IDP_URL!,
+  clientId: process.env.CLIENT_ID || 'payez_default_client',
+  loginEndpoint: '/api/ExternalAuth/login'
+});

package/src/api-handlers/auth/refresh.ts

@@ -400,7 +400,7 @@ export function createRefreshHandler(config: RefreshConfig) {
           const errorMessage = idpError.message || 'Token refresh failed';
           // CRITICAL: 401 means token is definitively invalid - always discard
           // This prevents redirect loops where viability check keeps returning canRefresh:true
-          let discardToken = refreshResponse.status === 401 || idpError.discard_token === true;
+          const discardToken = refreshResponse.status === 401 || idpError.discard_token === true;
           const retryable = refreshResponse.status !== 401 && idpError.retryable === true;
           const resolution = idpError.resolution || null;
 
@@ -442,43 +442,20 @@ export function createRefreshHandler(config: RefreshConfig) {
 
           // If IDP signals to discard token, clear it from Redis
           if (discardToken) {
-            // Race-safe discard (CAS): only clear if the refresh token we sent is STILL
-            // the current one. A concurrent refresh may have already rotated it — our 401
-            // is then stale, and wiping here would silently log out a healthy session
-            // (the rotation-race wipe, QA 6873 site 2). Skip the wipe + drop terminal if changed.
-            const postRefresh = await getSession(sessionToken);
-            const tokenUnchanged =
-              !!originalRefreshToken && postRefresh?.idpRefreshToken === originalRefreshToken;
-            if (tokenUnchanged) {
-              console.error('[AUTH_REFRESH] ⚠️ REFRESH_TOKEN_REMOVAL: IDP signaled discard_token', {
-                reason: 'IDP_DISCARD_TOKEN',
-                errorCode,
-                userId,
-                sessionToken: sessionToken.substring(0, 8) + '...',
-                hadRefreshToken: !!currentSession.idpRefreshToken,
-                stack: new Error().stack
-              });
-              await updateSession(sessionToken, {
-                idpRefreshToken: '',
-                idpRefreshTokenExpires: undefined,
-                refreshTokenClearedAt: Date.now(),
-                refreshTokenClearedReason: `IDP_DISCARD_TOKEN:${errorCode}`
-              });
-            } else {
-              // Concurrent refresh already rotated the token — our 401 is stale. Return the
-              // freshly-rotated token directly so the loser succeeds without a retry
-              // (race-fix follow-up #1).
-              discardToken = false;
-              console.warn('[AUTH_REFRESH] Discard suppressed: refresh token already rotated by a concurrent refresh — returning the fresh token (race-safe).');
-              if (postRefresh?.idpAccessToken && postRefresh.idpAccessTokenExpires) {
-                return NextResponse.json({
-                  refreshed: true,
-                  reason: 'completed_by_concurrent_request',
-                  accessTokenExpires: postRefresh.idpAccessTokenExpires,
-                  hasRefreshToken: !!postRefresh.idpRefreshToken,
-                });
-              }
-            }
+            console.error('[AUTH_REFRESH] ⚠️ REFRESH_TOKEN_REMOVAL: IDP signaled discard_token', {
+              reason: 'IDP_DISCARD_TOKEN',
+              errorCode,
+              userId,
+              sessionToken: sessionToken.substring(0, 8) + '...',
+              hadRefreshToken: !!currentSession.idpRefreshToken,
+              stack: new Error().stack
+            });
+            await updateSession(sessionToken, {
+              idpRefreshToken: '',
+              idpRefreshTokenExpires: undefined,
+              refreshTokenClearedAt: Date.now(),
+              refreshTokenClearedReason: `IDP_DISCARD_TOKEN:${errorCode}`
+            });
           }
 
           return NextResponse.json({

package/src/api-handlers/auth/validate.ts

@@ -1,44 +1,44 @@
-import { NextRequest, NextResponse } from 'next/server';
-import { idpFetchJSON } from '../../lib/idp-fetch';
-import { ENV_CONFIG, API_ENDPOINTS } from '../../config/env';
-import { getTokenTestAware } from '../../lib/test-aware-get-token';
-import { getSession } from '../../lib/session-store';
-
-/**
- * Validates current access token with the IDP and returns normalized info.
- * Sources access token from Authorization header or Redis session via cookie.
- */
-export async function GET(req: NextRequest) {
-  try {
-    // 1) Prefer Authorization header if present
-    let bearer: string | undefined = undefined;
-    const authHeader = req.headers.get('authorization') || req.headers.get('Authorization');
-    if (authHeader && /^Bearer\s+/i.test(authHeader)) bearer = authHeader.replace(/^Bearer\s+/i, '').trim();
-
-    // 2) If not, resolve from session
-    if (!bearer) {
-      const tok = await getTokenTestAware(req);
-      const sessionToken = tok?.sessionToken as string | undefined;
-      if (sessionToken) {
-        const sess = await getSession(sessionToken);
-        bearer = sess?.accessToken;
-      }
-    }
-
-    if (!bearer) {
-      return NextResponse.json({ success: false, error: { code: 'UNAUTHORIZED', message: 'No access token available' } }, { status: 401 });
-    }
-
-    const url = `${ENV_CONFIG.IDP_URL}${API_ENDPOINTS.externalAuth.validate}`;
-    const result = await idpFetchJSON(req, url, { method: 'GET', headers: { Authorization: `Bearer ${bearer}` } });
-
-    if (!result.ok) {
-      return NextResponse.json({ success: false, error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status }, data: result.json }, { status: result.status });
-    }
-
-    // Passthrough normalized
-    return NextResponse.json(result.json ?? { success: true }, { status: 200 });
-  } catch (e: any) {
-    return NextResponse.json({ success: false, error: { code: 'INTERNAL_SERVER_ERROR', message: e?.message || 'validate error' } }, { status: 500 });
-  }
+import { NextRequest, NextResponse } from 'next/server';
+import { idpFetchJSON } from '../../lib/idp-fetch';
+import { ENV_CONFIG, API_ENDPOINTS } from '../../config/env';
+import { getTokenTestAware } from '../../lib/test-aware-get-token';
+import { getSession } from '../../lib/session-store';
+
+/**
+ * Validates current access token with the IDP and returns normalized info.
+ * Sources access token from Authorization header or Redis session via cookie.
+ */
+export async function GET(req: NextRequest) {
+  try {
+    // 1) Prefer Authorization header if present
+    let bearer: string | undefined = undefined;
+    const authHeader = req.headers.get('authorization') || req.headers.get('Authorization');
+    if (authHeader && /^Bearer\s+/i.test(authHeader)) bearer = authHeader.replace(/^Bearer\s+/i, '').trim();
+
+    // 2) If not, resolve from session
+    if (!bearer) {
+      const tok = await getTokenTestAware(req);
+      const sessionToken = tok?.sessionToken as string | undefined;
+      if (sessionToken) {
+        const sess = await getSession(sessionToken);
+        bearer = sess?.accessToken;
+      }
+    }
+
+    if (!bearer) {
+      return NextResponse.json({ success: false, error: { code: 'UNAUTHORIZED', message: 'No access token available' } }, { status: 401 });
+    }
+
+    const url = `${ENV_CONFIG.IDP_URL}${API_ENDPOINTS.externalAuth.validate}`;
+    const result = await idpFetchJSON(req, url, { method: 'GET', headers: { Authorization: `Bearer ${bearer}` } });
+
+    if (!result.ok) {
+      return NextResponse.json({ success: false, error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status }, data: result.json }, { status: result.status });
+    }
+
+    // Passthrough normalized
+    return NextResponse.json(result.json ?? { success: true }, { status: 200 });
+  } catch (e: any) {
+    return NextResponse.json({ success: false, error: { code: 'INTERNAL_SERVER_ERROR', message: e?.message || 'validate error' } }, { status: 500 });
+  }
 }