@payez/next-mvp 4.1.11 → 4.1.20

package/dist/routes/auth/viability.js

@@ -33,6 +33,60 @@ async function getTenantRequiresTwoFactor() {
         return true;
     }
 }
+/**
+ * Which 2FA methods the TENANT permits — cards 141688 + 141741.
+ *
+ * WHY THIS IS HERE: this endpoint answered "is 2FA required, and is it done?"
+ * and said nothing about WITH WHAT. Both the middleware gate and the
+ * verify-code page call this route, and NEITHER had any method data — so
+ * nothing in the system asked whether the user CAN complete the challenge it
+ * is about to demand. A user whose tenant allows only `totp`, with no
+ * authenticator enrolled, is sent to a page that offers email and sms.
+ *
+ * ⚠ THIS IS NOT A COMPLETION SIGNAL AND MUST NEVER BE READ AS ONE.
+ * It says what the tenant PERMITS. It says nothing about what the user has
+ * enrolled, and nothing about whether they have verified. The invariant
+ * (QAPert, acceptance J2/J5) is: METHOD-PRESENCE IS NOT VERIFIED. A user with
+ * one method is still challenged and still gated until they actually verify.
+ * `userHasCompletedTenantTwoFactorRequirements` remains the only field that
+ * answers "are they through".
+ *
+ * STILL MISSING, deliberately not guessed here: the ENROLLED set. That lives
+ * behind /api/mfa/methods and needs a call this route does not currently make.
+ * Allowed-only closes the "offered a method the tenant forbids" half; it does
+ * NOT close "has nothing enrolled and no way to enrol". Both halves are named
+ * in the cards so neither gets lost.
+ *
+ * NULL MEANS UNKNOWN — IT DOES NOT MEAN "NONE", AND IT DOES NOT MEAN
+ * "email and sms". If the client config cannot be read we do not know what the
+ * tenant permits, and every available guess is wrong in a way that matters:
+ *
+ *   - guessing ['email','sms'] fails OPEN. On a totp-only tenant that offers
+ *     the user two methods the tenant forbids — which is defect 141688 itself,
+ *     re-created by its own fix during a config outage.
+ *   - guessing [] fails CLOSED but locks the user out of a challenge they may
+ *     be perfectly able to complete.
+ *
+ * So we report the truth (we don't know) and let the consumer decide, rather
+ * than encoding a guess that reads like a measurement. Same reasoning as the
+ * nullable require_2fa fix: "absent" has to be expressible, or callers cannot
+ * tell a real value from a default.
+ *
+ * No local default: `allowed2FAMethods` is non-optional on AuthSettings and is
+ * populated on BOTH config construction paths (idp-client-config.ts:333, :514)
+ * with the tenant's value or the layer's own ['email','sms']. Repeating that
+ * default here would be a second source for one setting, free to drift.
+ */
+async function getTenantAllowed2FAMethods() {
+    try {
+        const config = await (0, idp_client_config_1.getIDPClientConfig)();
+        return config.authSettings.allowed2FAMethods;
+    }
+    catch {
+        console.warn('[VIABILITY] Could not get client config — reporting allowed 2FA methods as UNKNOWN (null), not guessing');
+        return null;
+    }
+}
 /**
  * GET /api/session/viability - Check if session is viable
  *
@@ -79,12 +133,38 @@ async function GET(req) {
                 reason: 'Stale session - cookie exists but session not found in Redis'
             });
         }
+        // Cards 141688/141741 — the IDP's routing decision, relayed verbatim.
+        // See the SessionData.nextStep doc. This is the field that tells the gate
+        // whether the user CAN complete a challenge; without it both consumers were
+        // sending zero-method users to a page they had no way to act on.
+        //
+        // Declared once, here, above every return: `session` is settled by this
+        // point, and all three authenticated responses must carry the SAME value.
+        // Deriving it per-branch would let the paths drift apart silently.
+        //
+        // NO `?? null` HERE, DELIBERATELY — and this is the whole safety argument:
+        //
+        //   undefined = we never captured it. Every session minted BEFORE this
+        //               change is in that state, and there are live ones in Redis
+        //               right now. JSON.stringify omits the key, so the consumer
+        //               sees no field and knows it is uninformed.
+        //   null      = the IDP affirmatively said "nothing outstanding".
+        //
+        // Collapsing the first into the second with `?? null` would tell the gate
+        // "fully authenticated, nothing to do" about every pre-existing session —
+        // including a zero-method user who must be sent to enrol. That is a
+        // fail-open on the entire existing session population, produced by a
+        // default that reads like a measurement. Same mistake as the nullable
+        // require_2fa case: absent has to stay expressible.
+        const nextStep = session?.nextStep;
         // Check access token expiry
         const now = Math.floor(Date.now() / 1000);
         const accessTokenExpires = token.accessTokenExpires || token.exp;
         if (!accessTokenExpires) {
             // No expiry info, assume viable but recommend refresh
             const tenantRequiresTwoFactor = await getTenantRequiresTwoFactor();
+            // Cards 141688/141741 — see getTenantAllowed2FAMethods. NOT a completion signal.
+            const tenantAllowed2FAMethods = await getTenantAllowed2FAMethods();
             // CRITICAL: Check if MFA has expired (2FA TTL enforcement)
             const mfaExpiresAt = session?.mfaExpiresAt || 0;
             const mfaExpired = mfaExpiresAt > 0 && mfaExpiresAt < Date.now();
@@ -103,6 +183,8 @@ async function GET(req) {
                 tenantRequiresTwoFactor,
                 userHasCompletedTenantTwoFactorRequirements,
                 userStillNeedsTwoFactor,
+                tenantAllowed2FAMethods,
+                nextStep,
                 // Legacy field names for backwards compatibility
                 requires2FA: tenantRequiresTwoFactor,
                 twoFactorComplete: userHasCompletedTenantTwoFactorRequirements,
@@ -121,6 +203,8 @@ async function GET(req) {
         const hasRefreshToken = !!(session?.idpRefreshToken || session?.refreshToken || token.refreshToken);
         // CLEAR NAMING: Tenant-wide 2FA requirement from client config
         const tenantRequiresTwoFactor = await getTenantRequiresTwoFactor();
+        // Cards 141688/141741 — see getTenantAllowed2FAMethods. NOT a completion signal.
+        const tenantAllowed2FAMethods = await getTenantAllowed2FAMethods();
         // CRITICAL: Check if MFA has expired (2FA TTL enforcement)
         // The session may have mfaVerified=true from days ago, but if mfaExpiresAt
         // has passed, we must treat 2FA as incomplete to force re-verification.
@@ -159,6 +243,8 @@ async function GET(req) {
                 tenantRequiresTwoFactor,
                 userHasCompletedTenantTwoFactorRequirements,
                 userStillNeedsTwoFactor,
+                tenantAllowed2FAMethods,
+                nextStep,
                 // Legacy names for backwards compatibility
                 requires2FA: tenantRequiresTwoFactor,
                 twoFactorComplete: userHasCompletedTenantTwoFactorRequirements,
@@ -180,6 +266,8 @@ async function GET(req) {
             tenantRequiresTwoFactor,
             userHasCompletedTenantTwoFactorRequirements,
             userStillNeedsTwoFactor,
+            tenantAllowed2FAMethods,
+            nextStep,
             // Legacy names for backwards compatibility
             requires2FA: tenantRequiresTwoFactor,
             twoFactorComplete: userHasCompletedTenantTwoFactorRequirements,

package/dist/routes/mfa/backup-code-verify.d.ts

@@ -0,0 +1 @@
+export { POST } from '../../api-handlers/mfa/backup-code-verify';

package/dist/routes/mfa/backup-code-verify.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = void 0;
+var backup_code_verify_1 = require("../../api-handlers/mfa/backup-code-verify");
+Object.defineProperty(exports, "POST", { enumerable: true, get: function () { return backup_code_verify_1.POST; } });

package/dist/routes/mfa/backup-codes.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Ready-to-Use MFA Backup Codes Route
+ *
+ * @example
+ * ```typescript
+ * // app/api/mfa/backup-codes/route.ts
+ * export { POST } from '@payez/next-mvp/routes/mfa/backup-codes';
+ * ```
+ */
+export { POST } from '../../api-handlers/mfa/backup-codes';

package/dist/routes/mfa/backup-codes.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = void 0;
+/**
+ * Ready-to-Use MFA Backup Codes Route
+ *
+ * @example
+ * ```typescript
+ * // app/api/mfa/backup-codes/route.ts
+ * export { POST } from '@payez/next-mvp/routes/mfa/backup-codes';
+ * ```
+ */
+var backup_codes_1 = require("../../api-handlers/mfa/backup-codes");
+Object.defineProperty(exports, "POST", { enumerable: true, get: function () { return backup_codes_1.POST; } });

package/dist/routes/mfa/methods.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Ready-to-Use MFA Methods Route (list / remove)
+ *
+ * @example
+ * ```typescript
+ * // app/api/mfa/methods/route.ts
+ * export { GET } from '@payez/next-mvp/routes/mfa/methods';
+ * // app/api/mfa/methods/[id]/route.ts
+ * export { DELETE } from '@payez/next-mvp/routes/mfa/methods';
+ * ```
+ */
+import { NextRequest } from 'next/server';
+import { GET as listMethods } from '../../api-handlers/mfa/methods';
+export declare const GET: typeof listMethods;
+type Ctx = {
+    params: Promise<{
+        id: string;
+    }>;
+};
+export declare function DELETE(req: NextRequest, ctx: Ctx): Promise<import("next/server").NextResponse<any>>;
+export {};

package/dist/routes/mfa/methods.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GET = void 0;
+exports.DELETE = DELETE;
+const methods_1 = require("../../api-handlers/mfa/methods");
+exports.GET = methods_1.GET;
+async function DELETE(req, ctx) {
+    const { id } = await ctx.params;
+    return (0, methods_1.DELETE)(req, id);
+}

package/dist/routes/mfa/totp-confirm.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Ready-to-Use TOTP Confirm Route
+ *
+ * @example
+ * ```typescript
+ * // app/api/mfa/totp/confirm/route.ts
+ * export { POST } from '@payez/next-mvp/routes/mfa/totp-confirm';
+ * ```
+ */
+export { POST } from '../../api-handlers/mfa/totp-confirm';

package/dist/routes/mfa/totp-confirm.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = void 0;
+/**
+ * Ready-to-Use TOTP Confirm Route
+ *
+ * @example
+ * ```typescript
+ * // app/api/mfa/totp/confirm/route.ts
+ * export { POST } from '@payez/next-mvp/routes/mfa/totp-confirm';
+ * ```
+ */
+var totp_confirm_1 = require("../../api-handlers/mfa/totp-confirm");
+Object.defineProperty(exports, "POST", { enumerable: true, get: function () { return totp_confirm_1.POST; } });

package/dist/routes/mfa/totp-enroll.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Ready-to-Use TOTP Enrol Route
+ *
+ * @example
+ * ```typescript
+ * // app/api/mfa/totp/enroll/route.ts
+ * export { POST } from '@payez/next-mvp/routes/mfa/totp-enroll';
+ * ```
+ */
+export { POST } from '../../api-handlers/mfa/totp-enroll';

package/dist/routes/mfa/totp-enroll.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = void 0;
+/**
+ * Ready-to-Use TOTP Enrol Route
+ *
+ * @example
+ * ```typescript
+ * // app/api/mfa/totp/enroll/route.ts
+ * export { POST } from '@payez/next-mvp/routes/mfa/totp-enroll';
+ * ```
+ */
+var totp_enroll_1 = require("../../api-handlers/mfa/totp-enroll");
+Object.defineProperty(exports, "POST", { enumerable: true, get: function () { return totp_enroll_1.POST; } });

package/dist/routes/mfa/totp-verify.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Ready-to-Use TOTP Verify Route (2FA CHALLENGE, not enrolment)
+ *
+ * Verifies an authenticator code at LOGIN and transitions the session to
+ * MFA-verified. Pair with totp-enroll/totp-confirm, which only ENROL a factor
+ * and deliberately do not touch session 2FA state.
+ *
+ * @example
+ * ```typescript
+ * // app/api/mfa/totp/verify/route.ts
+ * export { POST } from '@payez/next-mvp/routes/mfa/totp-verify';
+ * ```
+ */
+export { POST } from '../../api-handlers/mfa/totp-verify';

package/dist/routes/mfa/totp-verify.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = void 0;
+/**
+ * Ready-to-Use TOTP Verify Route (2FA CHALLENGE, not enrolment)
+ *
+ * Verifies an authenticator code at LOGIN and transitions the session to
+ * MFA-verified. Pair with totp-enroll/totp-confirm, which only ENROL a factor
+ * and deliberately do not touch session 2FA state.
+ *
+ * @example
+ * ```typescript
+ * // app/api/mfa/totp/verify/route.ts
+ * export { POST } from '@payez/next-mvp/routes/mfa/totp-verify';
+ * ```
+ */
+var totp_verify_1 = require("../../api-handlers/mfa/totp-verify");
+Object.defineProperty(exports, "POST", { enumerable: true, get: function () { return totp_verify_1.POST; } });

package/dist/routes/passkeys/list.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Ready-to-Use Passkey List Route
+ *
+ * @example
+ * ```typescript
+ * // app/api/passkeys/route.ts
+ * export { GET } from '@payez/next-mvp/routes/passkeys/list';
+ * ```
+ */
+export { GET } from '../../api-handlers/passkeys/list';

package/dist/routes/passkeys/list.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GET = void 0;
+/**
+ * Ready-to-Use Passkey List Route
+ *
+ * @example
+ * ```typescript
+ * // app/api/passkeys/route.ts
+ * export { GET } from '@payez/next-mvp/routes/passkeys/list';
+ * ```
+ */
+var list_1 = require("../../api-handlers/passkeys/list");
+Object.defineProperty(exports, "GET", { enumerable: true, get: function () { return list_1.GET; } });

package/dist/routes/passkeys/manage.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Ready-to-Use Passkey Manage Route (rename / revoke one key)
+ *
+ * @example
+ * ```typescript
+ * // app/api/passkeys/[id]/route.ts
+ * export { PATCH, DELETE } from '@payez/next-mvp/routes/passkeys/manage';
+ * ```
+ */
+import { NextRequest } from 'next/server';
+type Ctx = {
+    params: Promise<{
+        id: string;
+    }>;
+};
+export declare function PATCH(req: NextRequest, ctx: Ctx): Promise<import("next/server").NextResponse<any>>;
+export declare function DELETE(req: NextRequest, ctx: Ctx): Promise<import("next/server").NextResponse<any>>;
+export {};

package/dist/routes/passkeys/manage.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PATCH = PATCH;
+exports.DELETE = DELETE;
+const manage_1 = require("../../api-handlers/passkeys/manage");
+async function PATCH(req, ctx) {
+    const { id } = await ctx.params;
+    return (0, manage_1.PATCH)(req, id);
+}
+async function DELETE(req, ctx) {
+    const { id } = await ctx.params;
+    return (0, manage_1.DELETE)(req, id);
+}

package/dist/routes/passkeys/register-options.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Ready-to-Use Passkey Registration Options Route
+ *
+ * @example
+ * ```typescript
+ * // app/api/passkeys/register/options/route.ts
+ * export { POST } from '@payez/next-mvp/routes/passkeys/register-options';
+ * ```
+ */
+export { POST } from '../../api-handlers/passkeys/register-options';

package/dist/routes/passkeys/register-options.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = void 0;
+/**
+ * Ready-to-Use Passkey Registration Options Route
+ *
+ * @example
+ * ```typescript
+ * // app/api/passkeys/register/options/route.ts
+ * export { POST } from '@payez/next-mvp/routes/passkeys/register-options';
+ * ```
+ */
+var register_options_1 = require("../../api-handlers/passkeys/register-options");
+Object.defineProperty(exports, "POST", { enumerable: true, get: function () { return register_options_1.POST; } });

package/dist/routes/passkeys/register-verify.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Ready-to-Use Passkey Registration Verify Route
+ *
+ * @example
+ * ```typescript
+ * // app/api/passkeys/register/verify/route.ts
+ * export { POST } from '@payez/next-mvp/routes/passkeys/register-verify';
+ * ```
+ */
+export { POST } from '../../api-handlers/passkeys/register-verify';

package/dist/routes/passkeys/register-verify.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = void 0;
+/**
+ * Ready-to-Use Passkey Registration Verify Route
+ *
+ * @example
+ * ```typescript
+ * // app/api/passkeys/register/verify/route.ts
+ * export { POST } from '@payez/next-mvp/routes/passkeys/register-verify';
+ * ```
+ */
+var register_verify_1 = require("../../api-handlers/passkeys/register-verify");
+Object.defineProperty(exports, "POST", { enumerable: true, get: function () { return register_verify_1.POST; } });

package/dist/server/auth.d.ts

@@ -55,7 +55,7 @@ export declare function getAuthInstance(): Promise<import("better-auth/types").A
                 handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
             }[];
         };
-    }, ...{
+    }, ...(import("@better-auth/core").BetterAuthPlugin | {
         id: "magic-link";
         endpoints: {
             signInMagicLink: import("better-call").StrictEndpoint<"/sign-in/magic-link", {
@@ -150,7 +150,7 @@ export declare function getAuthInstance(): Promise<import("better-auth/types").A
             max: number;
         }[];
         options: import("better-auth/plugins/magic-link").MagicLinkOptions;
-    }[]];
+    })[]];
 }>>;
 /**
  * Get the current session from a request.

package/dist/server/decode-session.js

@@ -96,8 +96,30 @@ async function tryBetterAuthSession(requestCookies) {
         try {
             const { getRedis } = await Promise.resolve().then(() => __importStar(require('../lib/redis')));
             const { getAppSlug } = await Promise.resolve().then(() => __importStar(require('../lib/app-slug')));
-            const baKey = `ba:${getAppSlug()}:${result.session.token}`;
-            const baRaw = await getRedis().get(baKey);
+            // KEY-COMPOSER MISMATCH FIX (2026-08-02).
+            // better-auth writes this key as `ba:${idpConfig.clientSlug || getAppSlug()}:...`
+            // (better-auth.ts:99). This reader used getAppSlug() ALONE, so on any
+            // deployment where the IDP returns a clientSlug that differs from
+            // APP_SLUG the lookup missed entirely: idpTokens stayed null, and every
+            // caller looked unauthenticated regardless of their real session.
+            // Observed live: writer produced ba:idp_admin_ui_graft:<token> while this
+            // reader asked for ba:payez_idp_admin_web:<token>.
+            //
+            // Try the writer's composition FIRST, then the original as a fallback.
+            // Additive on purpose: it can only ever find MORE sessions than before,
+            // so no consumer whose keys already resolved can regress.
+            let baRaw = null;
+            try {
+                const idpCfg = await (0, idp_client_config_1.getIDPClientConfig)();
+                const writerSlug = idpCfg?.clientSlug;
+                if (writerSlug) {
+                    baRaw = await getRedis().get(`ba:${writerSlug}:${result.session.token}`);
+                }
+            }
+            catch { /* config unavailable — fall through to the legacy key */ }
+            if (!baRaw) {
+                baRaw = await getRedis().get(`ba:${getAppSlug()}:${result.session.token}`);
+            }
             if (baRaw) {
                 const baData = JSON.parse(baRaw);
                 idpTokens = baData.idpTokens;
@@ -115,7 +137,19 @@ async function tryBetterAuthSession(requestCookies) {
             idpAccessTokenExpires: idpTokens?.idpAccessTokenExpires
                 || (result.session.expiresAt ? new Date(result.session.expiresAt).getTime() : Date.now() + 24 * 60 * 60 * 1000),
             mfaVerified: idpTokens?.mfaVerified ?? false,
-            oauthProvider: 'google',
+            /**
+             * ⚠ WAS HARDCODED `'google'` — third site of QAPert finding #3 (card
+             * 167892), found by sweeping rather than by report.
+             *
+             * Note the line ABOVE is already honest: mfaVerified derives from what
+             * was stored. This one asserted the provider anyway, so a passkey
+             * sign-in decoded here was relabelled a Google OAuth sign-in — the
+             * provenance the sign-in path deliberately records, overwritten on read.
+             *
+             * The IDP emits NO provider claim (DotNetPert), so when it was not
+             * stored the honest answer is UNSET, not a guess.
+             */
+            oauthProvider: idpTokens?.oauthProvider ?? undefined,
             idpClientId: idpTokens?.idpClientId ?? idpTokens?.clientId,
             merchantId: idpTokens?.merchantId,
         };