@payez/next-mvp 4.1.11 → 4.1.20

package/src/api-handlers/auth/login.ts

@@ -1,240 +1,240 @@
-/**
- * Authentication Login API Handler
- *
- * Handles user authentication against the external IDP service.
- * This handler is designed to be imported and used by Next.js applications
- * using the @payez/next-mvp package.
- *
- * @version 2.0
- * @requires No authentication (public endpoint)
- */
-
-import { NextRequest, NextResponse } from 'next/server';
-
-// Add protection headers to all responses
-function addSecurityHeaders(response: NextResponse) {
-  // Content Security Policy - restrictive for auth endpoints
-  response.headers.set('Content-Security-Policy', "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';");
-
-  // Prevent clickjacking
-  response.headers.set('X-Frame-Options', 'DENY');
-
-  // Prevent MIME type sniffing
-  response.headers.set('X-Content-Type-Options', 'nosniff');
-
-  // Enable XSS protection
-  response.headers.set('X-XSS-Protection', '1; mode=block');
-
-  // Strict transport security for HTTPS
-  response.headers.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains; preload');
-
-  // Referrer policy
-  response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
-
-  // Permissions policy
-  response.headers.set('Permissions-Policy', 'geolocation=(), microphone=(), camera=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()');
-
-  // Cache control for sensitive auth endpoints
-  response.headers.set('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
-  response.headers.set('Pragma', 'no-cache');
-  response.headers.set('Expires', '0');
-
-  return response;
-}
-
-interface LoginRequest {
-  username_or_email: string;
-  password: string;
-  client_id?: string;
-  client_type?: string;
-  two_factor_code?: string;
-  two_factor_recovery_code?: string;
-}
-
-interface LoginConfig {
-  idpBaseUrl: string;
-  clientId: string;
-  loginEndpoint?: string;
-  clientType?: string; // "partner" or "idp", defaults to "partner" for CryptAply
-}
-
-/**
- * Creates a login handler for Next.js API routes
- *
- * @param config Configuration for IDP connection
- * @returns Next.js POST handler function
- *
- * @example
- * ```typescript
- * // In your app's /app/api/auth/login/route.ts
- * import { createLoginHandler } from '@payez/next-mvp/api-handlers/auth/login';
- *
- * export const POST = createLoginHandler({
- *   idpBaseUrl: process.env.IDP_URL!,
- *   clientId: process.env.CLIENT_ID!,
- *   loginEndpoint: '/api/ExternalAuth/login'
- * });
- * ```
- */
-export function createLoginHandler(config: LoginConfig) {
-  const { idpBaseUrl, clientId, loginEndpoint = '/api/ExternalAuth/login', clientType = 'partner' } = config;
-
-  return async function POST(req: NextRequest) {
-    let body: LoginRequest;
-
-    try {
-      body = await req.json();
-    } catch (parseError) {
-      return NextResponse.json(
-        { error: 'Invalid JSON format' },
-        { status: 400 }
-      );
-    }
-
-    const { username_or_email, password, client_type, two_factor_code, two_factor_recovery_code } = body;
-
-    // Validate required fields
-    if (!username_or_email || typeof username_or_email !== 'string' || username_or_email.trim() === '') {
-      return NextResponse.json(
-        { error: 'username_or_email is required' },
-        { status: 400 }
-      );
-    }
-
-    if (!password || typeof password !== 'string' || password.trim() === '') {
-      return NextResponse.json(
-        { error: 'Password is required' },
-        { status: 400 }
-      );
-    }
-
-    const idpUrl = `${idpBaseUrl}${loginEndpoint}`;
-    const payload: any = {
-      username_or_email,
-      password,
-      client_id: clientId,
-      client_type: client_type || clientType // Use provided client_type or config default
-    };
-
-    // Add optional 2FA fields if provided
-    if (two_factor_code) {
-      payload.two_factor_code = two_factor_code;
-    }
-    if (two_factor_recovery_code) {
-      payload.two_factor_recovery_code = two_factor_recovery_code;
-    }
-
-    // Extract client headers for forwarding to IDP
-    const clientHeaders: Record<string, string> = {};
-
-    // Forward client IP if available
-    const clientIp = req.headers.get('x-forwarded-for') || req.headers.get('x-real-ip');
-    if (clientIp) {
-      clientHeaders['X-Forwarded-For'] = clientIp.split(',')[0].trim();
-    }
-
-    // Forward user agent if available
-    const userAgent = req.headers.get('user-agent');
-    if (userAgent) {
-      clientHeaders['User-Agent'] = userAgent;
-    }
-
-    const headers = {
-      'Content-Type': 'application/json',
-      'Accept': 'application/json',
-      'Cookie': 'X-Device-Id=payez-PayEz-6c8201c35c1b44c9b2e823b36b95a718',
-      ...clientHeaders
-    };
-
-    try {
-      const backendResponse = await fetch(idpUrl, {
-        method: 'POST',
-        headers,
-        body: JSON.stringify(payload),
-      });
-
-      const rawText = await backendResponse.text();
-      let data: any;
-
-      try {
-        data = JSON.parse(rawText);
-      } catch (jsonError) {
-        console.error('[LOGIN] IDP returned non-JSON response', {
-          response: rawText,
-          status: backendResponse.status
-        });
-        return NextResponse.json(
-          { error: 'Invalid response from authentication service' },
-          { status: 502 }
-        );
-      }
-
-      if (!backendResponse.ok) {
-        // Handle rate limiting specifically
-        if (backendResponse.status === 429) {
-          const retryAfter = backendResponse.headers.get('retry-after');
-          const retryAfterSeconds = retryAfter ? parseInt(retryAfter) : 60;
-
-          return addSecurityHeaders(NextResponse.json({
-            success: false,
-            error: 'RATE_LIMIT_EXCEEDED',
-            message: 'Too many login attempts. Please try again later.',
-            retryAfter: retryAfterSeconds
-          }, { status: 429 }));
-        }
-
-        // Pass through error from IDP
-        console.error('[LOGIN] IDP service error', {
-          status: backendResponse.status,
-          error: data
-        });
-        return addSecurityHeaders(NextResponse.json(data, { status: backendResponse.status }));
-      }
-
-      if (!data.success) {
-        // IDP returned a canonical error envelope with HTTP 200
-        console.error('[LOGIN] IDP authentication failure', { error: data });
-        return addSecurityHeaders(NextResponse.json(data, { status: 200 }));
-      }
-
-      // Normalize response shape for NextAuth authorize()
-      const normalized = {
-        success: data?.success === true,
-        result: (data?.data && data?.data?.result) ? data.data.result : (data?.result ?? data),
-        // Preserve original payload for debugging/compatibility
-        original: data
-      };
-
-      return addSecurityHeaders(NextResponse.json(normalized as any));
-
-    } catch (error) {
-      // Handle network and other errors
-      console.error('[LOGIN] FETCH FAILED:', {
-        error: error instanceof Error ? error.message : String(error),
-        idpUrl
-      });
-
-      if (error instanceof Error && error.message.includes('fetch')) {
-        return NextResponse.json(
-          { error: 'Unable to connect to authentication service' },
-          { status: 503 }
-        );
-      }
-
-      return NextResponse.json(
-        { error: 'An unexpected error occurred during login' },
-        { status: 500 }
-      );
-    }
-  };
-}
-
-/**
- * Default export for backward compatibility
- * Requires environment variables: IDP_URL, CLIENT_ID
- */
-export const POST = createLoginHandler({
-  idpBaseUrl: process.env.IDP_URL!,
-  clientId: process.env.CLIENT_ID || 'payez_default_client',
-  loginEndpoint: '/api/ExternalAuth/login'
-});
+/**
+ * Authentication Login API Handler
+ *
+ * Handles user authentication against the external IDP service.
+ * This handler is designed to be imported and used by Next.js applications
+ * using the @payez/next-mvp package.
+ *
+ * @version 2.0
+ * @requires No authentication (public endpoint)
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+
+// Add protection headers to all responses
+function addSecurityHeaders(response: NextResponse) {
+  // Content Security Policy - restrictive for auth endpoints
+  response.headers.set('Content-Security-Policy', "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';");
+
+  // Prevent clickjacking
+  response.headers.set('X-Frame-Options', 'DENY');
+
+  // Prevent MIME type sniffing
+  response.headers.set('X-Content-Type-Options', 'nosniff');
+
+  // Enable XSS protection
+  response.headers.set('X-XSS-Protection', '1; mode=block');
+
+  // Strict transport security for HTTPS
+  response.headers.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains; preload');
+
+  // Referrer policy
+  response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
+
+  // Permissions policy
+  response.headers.set('Permissions-Policy', 'geolocation=(), microphone=(), camera=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()');
+
+  // Cache control for sensitive auth endpoints
+  response.headers.set('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
+  response.headers.set('Pragma', 'no-cache');
+  response.headers.set('Expires', '0');
+
+  return response;
+}
+
+interface LoginRequest {
+  username_or_email: string;
+  password: string;
+  client_id?: string;
+  client_type?: string;
+  two_factor_code?: string;
+  two_factor_recovery_code?: string;
+}
+
+interface LoginConfig {
+  idpBaseUrl: string;
+  clientId: string;
+  loginEndpoint?: string;
+  clientType?: string; // "partner" or "idp", defaults to "partner" for CryptAply
+}
+
+/**
+ * Creates a login handler for Next.js API routes
+ *
+ * @param config Configuration for IDP connection
+ * @returns Next.js POST handler function
+ *
+ * @example
+ * ```typescript
+ * // In your app's /app/api/auth/login/route.ts
+ * import { createLoginHandler } from '@payez/next-mvp/api-handlers/auth/login';
+ *
+ * export const POST = createLoginHandler({
+ *   idpBaseUrl: process.env.IDP_URL!,
+ *   clientId: process.env.CLIENT_ID!,
+ *   loginEndpoint: '/api/ExternalAuth/login'
+ * });
+ * ```
+ */
+export function createLoginHandler(config: LoginConfig) {
+  const { idpBaseUrl, clientId, loginEndpoint = '/api/ExternalAuth/login', clientType = 'partner' } = config;
+
+  return async function POST(req: NextRequest) {
+    let body: LoginRequest;
+
+    try {
+      body = await req.json();
+    } catch (parseError) {
+      return NextResponse.json(
+        { error: 'Invalid JSON format' },
+        { status: 400 }
+      );
+    }
+
+    const { username_or_email, password, client_type, two_factor_code, two_factor_recovery_code } = body;
+
+    // Validate required fields
+    if (!username_or_email || typeof username_or_email !== 'string' || username_or_email.trim() === '') {
+      return NextResponse.json(
+        { error: 'username_or_email is required' },
+        { status: 400 }
+      );
+    }
+
+    if (!password || typeof password !== 'string' || password.trim() === '') {
+      return NextResponse.json(
+        { error: 'Password is required' },
+        { status: 400 }
+      );
+    }
+
+    const idpUrl = `${idpBaseUrl}${loginEndpoint}`;
+    const payload: any = {
+      username_or_email,
+      password,
+      client_id: clientId,
+      client_type: client_type || clientType // Use provided client_type or config default
+    };
+
+    // Add optional 2FA fields if provided
+    if (two_factor_code) {
+      payload.two_factor_code = two_factor_code;
+    }
+    if (two_factor_recovery_code) {
+      payload.two_factor_recovery_code = two_factor_recovery_code;
+    }
+
+    // Extract client headers for forwarding to IDP
+    const clientHeaders: Record<string, string> = {};
+
+    // Forward client IP if available
+    const clientIp = req.headers.get('x-forwarded-for') || req.headers.get('x-real-ip');
+    if (clientIp) {
+      clientHeaders['X-Forwarded-For'] = clientIp.split(',')[0].trim();
+    }
+
+    // Forward user agent if available
+    const userAgent = req.headers.get('user-agent');
+    if (userAgent) {
+      clientHeaders['User-Agent'] = userAgent;
+    }
+
+    const headers = {
+      'Content-Type': 'application/json',
+      'Accept': 'application/json',
+      'Cookie': 'X-Device-Id=payez-PayEz-6c8201c35c1b44c9b2e823b36b95a718',
+      ...clientHeaders
+    };
+
+    try {
+      const backendResponse = await fetch(idpUrl, {
+        method: 'POST',
+        headers,
+        body: JSON.stringify(payload),
+      });
+
+      const rawText = await backendResponse.text();
+      let data: any;
+
+      try {
+        data = JSON.parse(rawText);
+      } catch (jsonError) {
+        console.error('[LOGIN] IDP returned non-JSON response', {
+          response: rawText,
+          status: backendResponse.status
+        });
+        return NextResponse.json(
+          { error: 'Invalid response from authentication service' },
+          { status: 502 }
+        );
+      }
+
+      if (!backendResponse.ok) {
+        // Handle rate limiting specifically
+        if (backendResponse.status === 429) {
+          const retryAfter = backendResponse.headers.get('retry-after');
+          const retryAfterSeconds = retryAfter ? parseInt(retryAfter) : 60;
+
+          return addSecurityHeaders(NextResponse.json({
+            success: false,
+            error: 'RATE_LIMIT_EXCEEDED',
+            message: 'Too many login attempts. Please try again later.',
+            retryAfter: retryAfterSeconds
+          }, { status: 429 }));
+        }
+
+        // Pass through error from IDP
+        console.error('[LOGIN] IDP service error', {
+          status: backendResponse.status,
+          error: data
+        });
+        return addSecurityHeaders(NextResponse.json(data, { status: backendResponse.status }));
+      }
+
+      if (!data.success) {
+        // IDP returned a canonical error envelope with HTTP 200
+        console.error('[LOGIN] IDP authentication failure', { error: data });
+        return addSecurityHeaders(NextResponse.json(data, { status: 200 }));
+      }
+
+      // Normalize response shape for NextAuth authorize()
+      const normalized = {
+        success: data?.success === true,
+        result: (data?.data && data?.data?.result) ? data.data.result : (data?.result ?? data),
+        // Preserve original payload for debugging/compatibility
+        original: data
+      };
+
+      return addSecurityHeaders(NextResponse.json(normalized as any));
+
+    } catch (error) {
+      // Handle network and other errors
+      console.error('[LOGIN] FETCH FAILED:', {
+        error: error instanceof Error ? error.message : String(error),
+        idpUrl
+      });
+
+      if (error instanceof Error && error.message.includes('fetch')) {
+        return NextResponse.json(
+          { error: 'Unable to connect to authentication service' },
+          { status: 503 }
+        );
+      }
+
+      return NextResponse.json(
+        { error: 'An unexpected error occurred during login' },
+        { status: 500 }
+      );
+    }
+  };
+}
+
+/**
+ * Default export for backward compatibility
+ * Requires environment variables: IDP_URL, CLIENT_ID
+ */
+export const POST = createLoginHandler({
+  idpBaseUrl: process.env.IDP_URL!,
+  clientId: process.env.CLIENT_ID || 'payez_default_client',
+  loginEndpoint: '/api/ExternalAuth/login'
+});

package/src/api-handlers/auth/passkey-signin.ts

@@ -0,0 +1,98 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { ENV_CONFIG } from '../../config/env';
+import { getIDPClientConfig } from '../../lib/idp-client-config';
+
+/**
+ * Passkey SIGN-IN ceremony (ANONYMOUS — no session exists yet):
+ *   optionsPOST -> POST /api/ExternalAuth/passwordless/passkey/options
+ *   verifyPOST  -> POST /api/ExternalAuth/passwordless/passkey/verify
+ *
+ * Anon idiom copied from auth/better-auth.ts (exchangeOAuthForIdpTokens):
+ * direct fetch to the IDP, client identified by client_id from the resolved
+ * IDP client config (slug preferred, numeric id fallback) — sent BOTH as the
+ * X-Client-Id header (the probe-verified routing key) and merged into the
+ * body when the caller did not supply one.
+ *
+ * The verify response is passed through WITHOUT unwrapping: this is a
+ * sign-in, its payload carries the grant the caller's session layer consumes.
+ */
+
+async function clientKey(): Promise<string> {
+  const config = await getIDPClientConfig();
+  return config.clientSlug || String(config.clientId);
+}
+
+async function anonCall(req: NextRequest, path: string) {
+  let parsed: Record<string, unknown> = {};
+  try {
+    const raw = await req.text();
+    if (raw && raw.trim().length > 0) parsed = JSON.parse(raw);
+  } catch {}
+
+  const key = await clientKey();
+  const res = await fetch(`${ENV_CONFIG.IDP_URL}${path}`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', 'X-Client-Id': key },
+    body: JSON.stringify({ client_id: key, ...parsed }),
+    cache: 'no-store',
+  });
+  const json = await res.json().catch(() => null);
+  return { res, json };
+}
+
+export async function optionsPOST(req: NextRequest) {
+  const { res, json } = await anonCall(req, '/api/ExternalAuth/passwordless/passkey/options');
+  return NextResponse.json(json ?? { success: false, message: 'Empty upstream response' }, { status: res.status });
+}
+
+/**
+ * VERIFY DOES NOT USE anonCall — IT MUST RESHAPE, NOT SPREAD.
+ *
+ * The IDP contract is three fields (PasskeyModels.cs:36 PasskeyAuthVerifyRequest):
+ *     assertion_id : string
+ *     response     : the WHOLE AuthenticatorAssertionRawResponse from
+ *                    navigator.credentials.get()
+ *     client_id    : string
+ *
+ * anonCall SPREADS the caller's body (`{ client_id, ...parsed }`). For options
+ * that is harmless. For verify it is fatal: spreading an assertion hoists
+ * id/rawId/type to the top level and leaves `response` holding only the INNER
+ * {clientDataJSON, authenticatorData, signature, userHandle}. The IDP's guard
+ * then answers "response is required" in 4-12ms WITHOUT REACHING THE CRYPTO —
+ * a timing signature DotNetPert used to prove the caller was still spreading
+ * long after the graft-side plugin had been fixed.
+ *
+ * This route and the Better Auth plugin endpoint are TWO PATHS to the same IDP
+ * endpoint. Fixing only the plugin left this one live, spreading, and reachable
+ * on a URL one segment away from the correct one — which is what kept the
+ * sign-in leg red across several runs.
+ *
+ * Accepts the assertion either already nested (`{ assertion_id, response }`) or
+ * flat (`{ assertion_id, id, rawId, type, response }`) and normalises both, so a
+ * caller written against either shape works.
+ */
+export async function verifyPOST(req: NextRequest) {
+  let parsed: Record<string, unknown> = {};
+  try {
+    const raw = await req.text();
+    if (raw && raw.trim().length > 0) parsed = JSON.parse(raw);
+  } catch { /* empty body -> the IDP's own validation answers */ }
+
+  const { assertion_id: assertionId, response, ...rest } = parsed;
+
+  // Already-nested callers send `response` holding a full assertion (it has an
+  // `id`). Flat callers send the assertion's own fields alongside assertion_id,
+  // and their `response` is the inner attestation half — not a whole assertion.
+  const nested = response && typeof response === 'object' && 'id' in (response as object);
+  const assertion = nested ? response : { ...rest, response };
+
+  const key = await clientKey();
+  const res = await fetch(`${ENV_CONFIG.IDP_URL}/api/ExternalAuth/passwordless/passkey/verify`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', 'X-Client-Id': key },
+    body: JSON.stringify({ client_id: key, assertion_id: assertionId, response: assertion }),
+    cache: 'no-store',
+  });
+  const json = await res.json().catch(() => null);
+  return NextResponse.json(json ?? { success: false, message: 'Empty upstream response' }, { status: res.status });
+}

package/src/api-handlers/auth/validate.ts

@@ -1,44 +1,44 @@
-import { NextRequest, NextResponse } from 'next/server';
-import { idpFetchJSON } from '../../lib/idp-fetch';
-import { ENV_CONFIG, API_ENDPOINTS } from '../../config/env';
-import { getTokenTestAware } from '../../lib/test-aware-get-token';
-import { getSession } from '../../lib/session-store';
-
-/**
- * Validates current access token with the IDP and returns normalized info.
- * Sources access token from Authorization header or Redis session via cookie.
- */
-export async function GET(req: NextRequest) {
-  try {
-    // 1) Prefer Authorization header if present
-    let bearer: string | undefined = undefined;
-    const authHeader = req.headers.get('authorization') || req.headers.get('Authorization');
-    if (authHeader && /^Bearer\s+/i.test(authHeader)) bearer = authHeader.replace(/^Bearer\s+/i, '').trim();
-
-    // 2) If not, resolve from session
-    if (!bearer) {
-      const tok = await getTokenTestAware(req);
-      const sessionToken = tok?.sessionToken as string | undefined;
-      if (sessionToken) {
-        const sess = await getSession(sessionToken);
-        bearer = sess?.accessToken;
-      }
-    }
-
-    if (!bearer) {
-      return NextResponse.json({ success: false, error: { code: 'UNAUTHORIZED', message: 'No access token available' } }, { status: 401 });
-    }
-
-    const url = `${ENV_CONFIG.IDP_URL}${API_ENDPOINTS.externalAuth.validate}`;
-    const result = await idpFetchJSON(req, url, { method: 'GET', headers: { Authorization: `Bearer ${bearer}` } });
-
-    if (!result.ok) {
-      return NextResponse.json({ success: false, error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status }, data: result.json }, { status: result.status });
-    }
-
-    // Passthrough normalized
-    return NextResponse.json(result.json ?? { success: true }, { status: 200 });
-  } catch (e: any) {
-    return NextResponse.json({ success: false, error: { code: 'INTERNAL_SERVER_ERROR', message: e?.message || 'validate error' } }, { status: 500 });
-  }
+import { NextRequest, NextResponse } from 'next/server';
+import { idpFetchJSON } from '../../lib/idp-fetch';
+import { ENV_CONFIG, API_ENDPOINTS } from '../../config/env';
+import { getTokenTestAware } from '../../lib/test-aware-get-token';
+import { getSession } from '../../lib/session-store';
+
+/**
+ * Validates current access token with the IDP and returns normalized info.
+ * Sources access token from Authorization header or Redis session via cookie.
+ */
+export async function GET(req: NextRequest) {
+  try {
+    // 1) Prefer Authorization header if present
+    let bearer: string | undefined = undefined;
+    const authHeader = req.headers.get('authorization') || req.headers.get('Authorization');
+    if (authHeader && /^Bearer\s+/i.test(authHeader)) bearer = authHeader.replace(/^Bearer\s+/i, '').trim();
+
+    // 2) If not, resolve from session
+    if (!bearer) {
+      const tok = await getTokenTestAware(req);
+      const sessionToken = tok?.sessionToken as string | undefined;
+      if (sessionToken) {
+        const sess = await getSession(sessionToken);
+        bearer = sess?.accessToken;
+      }
+    }
+
+    if (!bearer) {
+      return NextResponse.json({ success: false, error: { code: 'UNAUTHORIZED', message: 'No access token available' } }, { status: 401 });
+    }
+
+    const url = `${ENV_CONFIG.IDP_URL}${API_ENDPOINTS.externalAuth.validate}`;
+    const result = await idpFetchJSON(req, url, { method: 'GET', headers: { Authorization: `Bearer ${bearer}` } });
+
+    if (!result.ok) {
+      return NextResponse.json({ success: false, error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status }, data: result.json }, { status: result.status });
+    }
+
+    // Passthrough normalized
+    return NextResponse.json(result.json ?? { success: true }, { status: 200 });
+  } catch (e: any) {
+    return NextResponse.json({ success: false, error: { code: 'INTERNAL_SERVER_ERROR', message: e?.message || 'validate error' } }, { status: 500 });
+  }
 }