@payez/next-mvp 4.1.11 → 4.1.20

package/src/lib/idp-fetch.ts

@@ -1,127 +1,127 @@
-import { NextRequest } from 'next/server';
-import { getTokenTestAware } from './test-aware-get-token';
-import { getSession } from './session-store';
-import { internalRefresh } from './internal-api';
-
-/**
- * Centralized IDP fetch helper
- * - Injects Bearer from Redis session
- * - If access token is expired/near-expiry, triggers one refresh and retries fetch once
- * - Returns parsed JSON and HTTP status
- */
-export interface IdpFetchResult<T = any> {
-  ok: boolean;
-  status: number;
-  json: T | null;
-  attemptedRefresh: boolean;
-}
-
-function buildHeaders(req: NextRequest, bearer?: string, extra?: Record<string, string>) {
-  const headers: Record<string, string> = {
-    Accept: 'application/json',
-    'Content-Type': 'application/json',
-    ...extra,
-  };
-  const xfwd = req.headers.get('x-forwarded-for') || req.headers.get('x-real-ip');
-  if (xfwd) headers['X-Forwarded-For'] = xfwd.split(',')[0].trim();
-  const ua = req.headers.get('user-agent');
-  if (ua) headers['User-Agent'] = ua;
-  if (bearer) headers['Authorization'] = `Bearer ${bearer}`;
-  return headers;
-}
-
-async function ensureFreshAccessToken(req: NextRequest): Promise<{ sessionToken?: string; accessToken?: string; hasRefreshToken?: boolean }> {
-  const token = await getTokenTestAware(req);
-  // Support both field names: sessionToken (auth.ts JWT) and redisSessionId (legacy)
-  const sessionToken = (token?.sessionToken || token?.redisSessionId) as string | undefined;
-  console.log('[IDP_FETCH] ensureFreshAccessToken:', {
-    hasToken: !!token,
-    sessionToken: sessionToken?.substring(0, 20) + '...',
-    pathname: req.nextUrl.pathname
-  });
-  if (!sessionToken) {
-    console.warn('[IDP_FETCH] No sessionToken found in JWT - Bearer token will NOT be sent!');
-    return {};
-  }
-  let session = await getSession(sessionToken);
-  // Fall back to Better Auth Redis key when app session is missing/stale
-  if (!session || !session.idpAccessToken) {
-    const { getBetterAuthSession } = await import('./session-store');
-    const baSession = await getBetterAuthSession(sessionToken);
-    if (baSession?.idpAccessToken) {
-      session = baSession;
-    }
-  }
-  // Fall back to Better Auth: decode session from cookies to get IDP tokens
-  if (!session?.idpAccessToken) {
-    try {
-      const { decodeSession } = await import('../server/decode-session');
-      const decoded = await decodeSession(req.cookies);
-      if (decoded?.sessionData?.idpAccessToken) {
-        session = decoded.sessionData;
-      }
-    } catch { /* decodeSession unavailable in edge */ }
-  }
-  console.log('[IDP_FETCH] Redis session lookup:', {
-    hasSession: !!session,
-    hasAccessToken: !!session?.idpAccessToken,
-    hasRefreshToken: !!session?.idpRefreshToken,
-    bearerKeyId: session?.bearerKeyId || 'NOT_SET',
-    idpClientId: session?.idpClientId || 'NOT_SET',
-  });
-  if (!session?.idpAccessToken) return { sessionToken };
-  const hasRefreshToken = !!session.idpRefreshToken;
-  const now = Date.now();
-  const timeLeft = (session.idpAccessTokenExpires ?? now) - now;
-  // Treat tokens as effectively expired if within 5 minutes of expiry
-  if (timeLeft > 5 * 60 * 1000) {
-    return { sessionToken, accessToken: session.idpAccessToken, hasRefreshToken };
-  }
-  // Only attempt refresh when we actually have a refresh token to use.
-  // Provisional tokens (issued before 2FA completion) have no refresh token.
-  if (hasRefreshToken) {
-    try {
-      await internalRefresh(req.headers.get('cookie') || '', sessionToken);
-    } catch {}
-    session = await getSession(sessionToken);
-    return { sessionToken, accessToken: session?.idpAccessToken, hasRefreshToken: !!session?.idpRefreshToken };
-  }
-  return { sessionToken, accessToken: session.idpAccessToken, hasRefreshToken };
-}
-
-export async function idpFetchJSON<T = any>(
-  req: NextRequest,
-  targetUrl: string,
-  init: RequestInit = {}
-): Promise<IdpFetchResult<T>> {
-  let attemptedRefresh = false;
-  let { accessToken, sessionToken, hasRefreshToken } = await ensureFreshAccessToken(req);
-
-  const makeCall = async (bearer?: string) => {
-    const res = await fetch(targetUrl, {
-      ...init,
-      headers: buildHeaders(req, bearer, init.headers as any),
-    });
-    let json: any = null;
-    try { json = await res.json(); } catch { json = null; }
-    return { res, json } as const;
-  };
-
-  // First attempt
-  let { res, json } = await makeCall(accessToken);
-  // Only attempt refresh on 401/403 if we actually have a refresh token.
-  // Provisional tokens (pre-2FA) have no refresh token — refreshing is futile.
-  if ((res.status === 401 || res.status === 403) && sessionToken && hasRefreshToken && !attemptedRefresh) {
-    attemptedRefresh = true;
-    try {
-      // Use centralized internal API helper for server-to-server calls
-      const rf = await internalRefresh(req.headers.get('cookie') || '', sessionToken);
-      if (rf.ok) {
-        const fresh = await getSession(sessionToken);
-        ({ res, json } = await makeCall(fresh?.idpAccessToken));
-      }
-    } catch {}
-  }
-
-  return { ok: res.ok, status: res.status, json: json as T | null, attemptedRefresh };
+import { NextRequest } from 'next/server';
+import { getTokenTestAware } from './test-aware-get-token';
+import { getSession } from './session-store';
+import { internalRefresh } from './internal-api';
+
+/**
+ * Centralized IDP fetch helper
+ * - Injects Bearer from Redis session
+ * - If access token is expired/near-expiry, triggers one refresh and retries fetch once
+ * - Returns parsed JSON and HTTP status
+ */
+export interface IdpFetchResult<T = any> {
+  ok: boolean;
+  status: number;
+  json: T | null;
+  attemptedRefresh: boolean;
+}
+
+function buildHeaders(req: NextRequest, bearer?: string, extra?: Record<string, string>) {
+  const headers: Record<string, string> = {
+    Accept: 'application/json',
+    'Content-Type': 'application/json',
+    ...extra,
+  };
+  const xfwd = req.headers.get('x-forwarded-for') || req.headers.get('x-real-ip');
+  if (xfwd) headers['X-Forwarded-For'] = xfwd.split(',')[0].trim();
+  const ua = req.headers.get('user-agent');
+  if (ua) headers['User-Agent'] = ua;
+  if (bearer) headers['Authorization'] = `Bearer ${bearer}`;
+  return headers;
+}
+
+async function ensureFreshAccessToken(req: NextRequest): Promise<{ sessionToken?: string; accessToken?: string; hasRefreshToken?: boolean }> {
+  const token = await getTokenTestAware(req);
+  // Support both field names: sessionToken (auth.ts JWT) and redisSessionId (legacy)
+  const sessionToken = (token?.sessionToken || token?.redisSessionId) as string | undefined;
+  console.log('[IDP_FETCH] ensureFreshAccessToken:', {
+    hasToken: !!token,
+    sessionToken: sessionToken?.substring(0, 20) + '...',
+    pathname: req.nextUrl.pathname
+  });
+  if (!sessionToken) {
+    console.warn('[IDP_FETCH] No sessionToken found in JWT - Bearer token will NOT be sent!');
+    return {};
+  }
+  let session = await getSession(sessionToken);
+  // Fall back to Better Auth Redis key when app session is missing/stale
+  if (!session || !session.idpAccessToken) {
+    const { getBetterAuthSession } = await import('./session-store');
+    const baSession = await getBetterAuthSession(sessionToken);
+    if (baSession?.idpAccessToken) {
+      session = baSession;
+    }
+  }
+  // Fall back to Better Auth: decode session from cookies to get IDP tokens
+  if (!session?.idpAccessToken) {
+    try {
+      const { decodeSession } = await import('../server/decode-session');
+      const decoded = await decodeSession(req.cookies);
+      if (decoded?.sessionData?.idpAccessToken) {
+        session = decoded.sessionData;
+      }
+    } catch { /* decodeSession unavailable in edge */ }
+  }
+  console.log('[IDP_FETCH] Redis session lookup:', {
+    hasSession: !!session,
+    hasAccessToken: !!session?.idpAccessToken,
+    hasRefreshToken: !!session?.idpRefreshToken,
+    bearerKeyId: session?.bearerKeyId || 'NOT_SET',
+    idpClientId: session?.idpClientId || 'NOT_SET',
+  });
+  if (!session?.idpAccessToken) return { sessionToken };
+  const hasRefreshToken = !!session.idpRefreshToken;
+  const now = Date.now();
+  const timeLeft = (session.idpAccessTokenExpires ?? now) - now;
+  // Treat tokens as effectively expired if within 5 minutes of expiry
+  if (timeLeft > 5 * 60 * 1000) {
+    return { sessionToken, accessToken: session.idpAccessToken, hasRefreshToken };
+  }
+  // Only attempt refresh when we actually have a refresh token to use.
+  // Provisional tokens (issued before 2FA completion) have no refresh token.
+  if (hasRefreshToken) {
+    try {
+      await internalRefresh(req.headers.get('cookie') || '', sessionToken);
+    } catch {}
+    session = await getSession(sessionToken);
+    return { sessionToken, accessToken: session?.idpAccessToken, hasRefreshToken: !!session?.idpRefreshToken };
+  }
+  return { sessionToken, accessToken: session.idpAccessToken, hasRefreshToken };
+}
+
+export async function idpFetchJSON<T = any>(
+  req: NextRequest,
+  targetUrl: string,
+  init: RequestInit = {}
+): Promise<IdpFetchResult<T>> {
+  let attemptedRefresh = false;
+  let { accessToken, sessionToken, hasRefreshToken } = await ensureFreshAccessToken(req);
+
+  const makeCall = async (bearer?: string) => {
+    const res = await fetch(targetUrl, {
+      ...init,
+      headers: buildHeaders(req, bearer, init.headers as any),
+    });
+    let json: any = null;
+    try { json = await res.json(); } catch { json = null; }
+    return { res, json } as const;
+  };
+
+  // First attempt
+  let { res, json } = await makeCall(accessToken);
+  // Only attempt refresh on 401/403 if we actually have a refresh token.
+  // Provisional tokens (pre-2FA) have no refresh token — refreshing is futile.
+  if ((res.status === 401 || res.status === 403) && sessionToken && hasRefreshToken && !attemptedRefresh) {
+    attemptedRefresh = true;
+    try {
+      // Use centralized internal API helper for server-to-server calls
+      const rf = await internalRefresh(req.headers.get('cookie') || '', sessionToken);
+      if (rf.ok) {
+        const fresh = await getSession(sessionToken);
+        ({ res, json } = await makeCall(fresh?.idpAccessToken));
+      }
+    } catch {}
+  }
+
+  return { ok: res.ok, status: res.status, json: json as T | null, attemptedRefresh };
 }

package/src/lib/internal-api.ts

@@ -1,171 +1,171 @@
-/**
- * Centralized internal API helper for the app to call ITSELF.
- *
- * IMPORTANT: All calls from the Next.js server to its own API routes MUST use
- * these functions. Never use req.url, req.nextUrl.origin, or construct URLs
- * from the incoming request.
- *
- * WHY HTTP IS REQUIRED (not optional):
- * - This is the app calling its OWN backend within the same pod/container
- * - NextAuth cookies are encrypted based on request protocol
- * - TLS is terminated at ingress, so the pod receives HTTP internally
- * - Using HTTPS here causes cookie decryption failures and 403 errors
- * - This is NOT about "K8s traffic doesn't need TLS" - it's about
- *   protocol consistency for cookie/session encryption
- *
- * Environment:
- * - INTERNAL_API_URL: Required in production (e.g., http://service.namespace.svc.cluster.local:80)
- * - Falls back to http://localhost:3200 in development only
- */
-
-/**
- * Get the internal API base URL for the app to call itself.
- *
- * @throws Error in production if INTERNAL_API_URL is not set
- * @returns The base URL (no trailing slash)
- */
-export function getInternalApiUrl(): string {
-  const url = process.env.INTERNAL_API_URL;
-  if (url) return url.replace(/\/$/, ''); // strip trailing slash
-
-  if (process.env.NODE_ENV !== 'production') {
-    return 'http://localhost:3200';
-  }
-
-  throw new Error(
-    '[INTERNAL_API_URL] FATAL: INTERNAL_API_URL environment variable is REQUIRED in production. ' +
-    'This is for the app to call ITSELF. MUST be HTTP (not HTTPS) due to cookie encryption. ' +
-    'Set to http://service.namespace.svc.cluster.local:80'
-  );
-}
-
-/**
- * Options for internal fetch calls
- */
-export interface InternalFetchOptions extends Omit<RequestInit, 'headers'> {
-  /** Additional headers to include */
-  headers?: Record<string, string>;
-  /** Cookie header to forward (typically from req.headers.get('cookie')) */
-  cookie?: string;
-  /** Session token for x-session-token header */
-  sessionToken?: string;
-  /** Request ID for tracing */
-  requestId?: string;
-  /** Parse response as JSON (default: true) */
-  parseJson?: boolean;
-}
-
-/**
- * Result of an internal fetch call
- */
-export interface InternalFetchResult<T = unknown> {
-  ok: boolean;
-  status: number;
-  statusText: string;
-  data: T | null;
-  response: Response;
-}
-
-/**
- * Make a fetch call to an internal API route (app calling itself).
- *
- * @param path - The API path (e.g., '/api/auth/refresh')
- * @param options - Fetch options
- * @returns The fetch result with parsed data
- *
- * @example
- * ```ts
- * // Simple GET
- * const result = await internalFetch('/api/health');
- *
- * // POST with session
- * const result = await internalFetch('/api/auth/refresh', {
- *   method: 'POST',
- *   cookie: req.headers.get('cookie') || '',
- *   sessionToken: token.redisSessionId,
- *   body: JSON.stringify({ refresh_token: refreshToken }),
- * });
- * ```
- */
-export async function internalFetch<T = unknown>(
-  path: string,
-  options: InternalFetchOptions = {}
-): Promise<InternalFetchResult<T>> {
-  const {
-    headers: extraHeaders = {},
-    cookie,
-    sessionToken,
-    requestId,
-    parseJson = true,
-    ...fetchOptions
-  } = options;
-
-  const baseUrl = getInternalApiUrl();
-  const url = `${baseUrl}${path.startsWith('/') ? path : `/${path}`}`;
-
-  // Build headers
-  const headers: Record<string, string> = {
-    'Accept': 'application/json',
-    'Content-Type': 'application/json',
-    ...extraHeaders,
-  };
-
-  if (cookie) {
-    headers['Cookie'] = cookie;
-  }
-  if (sessionToken) {
-    headers['X-Session-Token'] = sessionToken;
-  }
-  if (requestId) {
-    headers['X-Request-Id'] = requestId;
-  }
-
-  const response = await fetch(url, {
-    ...fetchOptions,
-    headers,
-  });
-
-  let data: T | null = null;
-  if (parseJson) {
-    try {
-      data = await response.json() as T;
-    } catch {
-      data = null;
-    }
-  }
-
-  return {
-    ok: response.ok,
-    status: response.status,
-    statusText: response.statusText,
-    data,
-    response,
-  };
-}
-
-/**
- * Trigger a token refresh via the internal API.
- * This is a convenience wrapper for the common refresh pattern.
- *
- * @param cookie - The cookie header from the incoming request
- * @param sessionToken - The session token
- * @param refreshToken - Optional refresh token to include in body
- * @param requestId - Optional request ID for tracing
- * @returns Whether the refresh was successful
- */
-export async function internalRefresh(
-  cookie: string,
-  sessionToken: string,
-  refreshToken?: string,
-  requestId?: string
-): Promise<{ ok: boolean; status: number }> {
-  const result = await internalFetch('/api/auth/refresh', {
-    method: 'POST',
-    cookie,
-    sessionToken,
-    requestId,
-    body: refreshToken ? JSON.stringify({ refresh_token: refreshToken }) : undefined,
-  });
-
-  return { ok: result.ok, status: result.status };
-}
+/**
+ * Centralized internal API helper for the app to call ITSELF.
+ *
+ * IMPORTANT: All calls from the Next.js server to its own API routes MUST use
+ * these functions. Never use req.url, req.nextUrl.origin, or construct URLs
+ * from the incoming request.
+ *
+ * WHY HTTP IS REQUIRED (not optional):
+ * - This is the app calling its OWN backend within the same pod/container
+ * - NextAuth cookies are encrypted based on request protocol
+ * - TLS is terminated at ingress, so the pod receives HTTP internally
+ * - Using HTTPS here causes cookie decryption failures and 403 errors
+ * - This is NOT about "K8s traffic doesn't need TLS" - it's about
+ *   protocol consistency for cookie/session encryption
+ *
+ * Environment:
+ * - INTERNAL_API_URL: Required in production (e.g., http://service.namespace.svc.cluster.local:80)
+ * - Falls back to http://localhost:3200 in development only
+ */
+
+/**
+ * Get the internal API base URL for the app to call itself.
+ *
+ * @throws Error in production if INTERNAL_API_URL is not set
+ * @returns The base URL (no trailing slash)
+ */
+export function getInternalApiUrl(): string {
+  const url = process.env.INTERNAL_API_URL;
+  if (url) return url.replace(/\/$/, ''); // strip trailing slash
+
+  if (process.env.NODE_ENV !== 'production') {
+    return 'http://localhost:3200';
+  }
+
+  throw new Error(
+    '[INTERNAL_API_URL] FATAL: INTERNAL_API_URL environment variable is REQUIRED in production. ' +
+    'This is for the app to call ITSELF. MUST be HTTP (not HTTPS) due to cookie encryption. ' +
+    'Set to http://service.namespace.svc.cluster.local:80'
+  );
+}
+
+/**
+ * Options for internal fetch calls
+ */
+export interface InternalFetchOptions extends Omit<RequestInit, 'headers'> {
+  /** Additional headers to include */
+  headers?: Record<string, string>;
+  /** Cookie header to forward (typically from req.headers.get('cookie')) */
+  cookie?: string;
+  /** Session token for x-session-token header */
+  sessionToken?: string;
+  /** Request ID for tracing */
+  requestId?: string;
+  /** Parse response as JSON (default: true) */
+  parseJson?: boolean;
+}
+
+/**
+ * Result of an internal fetch call
+ */
+export interface InternalFetchResult<T = unknown> {
+  ok: boolean;
+  status: number;
+  statusText: string;
+  data: T | null;
+  response: Response;
+}
+
+/**
+ * Make a fetch call to an internal API route (app calling itself).
+ *
+ * @param path - The API path (e.g., '/api/auth/refresh')
+ * @param options - Fetch options
+ * @returns The fetch result with parsed data
+ *
+ * @example
+ * ```ts
+ * // Simple GET
+ * const result = await internalFetch('/api/health');
+ *
+ * // POST with session
+ * const result = await internalFetch('/api/auth/refresh', {
+ *   method: 'POST',
+ *   cookie: req.headers.get('cookie') || '',
+ *   sessionToken: token.redisSessionId,
+ *   body: JSON.stringify({ refresh_token: refreshToken }),
+ * });
+ * ```
+ */
+export async function internalFetch<T = unknown>(
+  path: string,
+  options: InternalFetchOptions = {}
+): Promise<InternalFetchResult<T>> {
+  const {
+    headers: extraHeaders = {},
+    cookie,
+    sessionToken,
+    requestId,
+    parseJson = true,
+    ...fetchOptions
+  } = options;
+
+  const baseUrl = getInternalApiUrl();
+  const url = `${baseUrl}${path.startsWith('/') ? path : `/${path}`}`;
+
+  // Build headers
+  const headers: Record<string, string> = {
+    'Accept': 'application/json',
+    'Content-Type': 'application/json',
+    ...extraHeaders,
+  };
+
+  if (cookie) {
+    headers['Cookie'] = cookie;
+  }
+  if (sessionToken) {
+    headers['X-Session-Token'] = sessionToken;
+  }
+  if (requestId) {
+    headers['X-Request-Id'] = requestId;
+  }
+
+  const response = await fetch(url, {
+    ...fetchOptions,
+    headers,
+  });
+
+  let data: T | null = null;
+  if (parseJson) {
+    try {
+      data = await response.json() as T;
+    } catch {
+      data = null;
+    }
+  }
+
+  return {
+    ok: response.ok,
+    status: response.status,
+    statusText: response.statusText,
+    data,
+    response,
+  };
+}
+
+/**
+ * Trigger a token refresh via the internal API.
+ * This is a convenience wrapper for the common refresh pattern.
+ *
+ * @param cookie - The cookie header from the incoming request
+ * @param sessionToken - The session token
+ * @param refreshToken - Optional refresh token to include in body
+ * @param requestId - Optional request ID for tracing
+ * @returns Whether the refresh was successful
+ */
+export async function internalRefresh(
+  cookie: string,
+  sessionToken: string,
+  refreshToken?: string,
+  requestId?: string
+): Promise<{ ok: boolean; status: number }> {
+  const result = await internalFetch('/api/auth/refresh', {
+    method: 'POST',
+    cookie,
+    sessionToken,
+    requestId,
+    body: refreshToken ? JSON.stringify({ refresh_token: refreshToken }) : undefined,
+  });
+
+  return { ok: result.ok, status: result.status };
+}