@payez/next-mvp 4.1.12 → 4.1.14

package/dist/auth/better-auth.d.ts

@@ -22,9 +22,6 @@ export interface BetterAuthSocialProvider {
     accessType?: 'offline' | 'online';
     hd?: string;
 }
-/**
- * Build Better Auth social providers from IDP config.
- */
 export declare function buildBetterAuthProviders(config: IDPClientConfig): Record<string, BetterAuthSocialProvider>;
 /**
  * Optional configuration for `createBetterAuthInstance`.

package/dist/auth/better-auth.js

@@ -53,6 +53,8 @@ exports.getBetterAuthHandler = getBetterAuthHandler;
 exports.exchangeOAuthForIdpTokens = exchangeOAuthForIdpTokens;
 exports.createAuthGetHandler = createAuthGetHandler;
 require("server-only");
+const node_async_hooks_1 = require("node:async_hooks");
+const jose_1 = require("jose"); // better-auth's own JWT dependency
 const better_auth_1 = require("better-auth");
 const next_js_1 = require("better-auth/next-js");
 const next_js_2 = require("better-auth/next-js");
@@ -63,6 +65,30 @@ const redis_1 = require("../lib/redis");
 /**
  * Build Better Auth social providers from IDP config.
  */
+/**
+ * REQUEST-SCOPED carrier for the provider's raw id_token. Card 138635.
+ *
+ * WHY THIS EXISTS: /api/ExternalAuth/oauth-callback mints an IDP bearer for any
+ * ASSERTED email — we send {provider, email} and nothing verifiable. The fix is
+ * for the IDP to require a provider-signed id_token and verify it itself. This
+ * is the client half: capture the token Better Auth already receives, and
+ * forward it. Additive — the IDP ignores it until its gate flips.
+ *
+ * WHY AsyncLocalStorage AND NOT REDIS (BAPert's ruling: forward, do not persist):
+ * an id_token is credential material. Writing it to the session record would put
+ * it one allow-list edit away from leaking out of /api/internal/session-data,
+ * and it would outlive the request that needed it. ALS scopes it to the single
+ * request, and it is gone when the request ends — nothing to expire, nothing to
+ * scrub, nothing to leak.
+ *
+ * SAFE BY CONSTRUCTION: getUserInfo (which fills this) and the post-callback
+ * exchange (which reads it) both run inside createAuthGetHandler's own request.
+ * VERIFIED, not assumed: better-auth.ts:452 awaits ba.GET(request) — the call
+ * that invokes getUserInfo — and the exchange follows at :465 in the SAME
+ * function. Outside that scope the store is undefined and the body simply omits
+ * id_token, which is the correct additive behaviour.
+ */
+const idTokenScope = new node_async_hooks_1.AsyncLocalStorage();
 function buildBetterAuthProviders(config) {
     const providers = {};
     for (const oauth of config.oauthProviders || []) {
@@ -92,6 +118,65 @@ function buildBetterAuthProviders(config) {
             accessType: rawAccessType === 'online' ? 'online' : rawAccessType === 'offline' ? 'offline' : undefined,
             hd: typeof rawHostedDomain === 'string' ? rawHostedDomain : undefined,
         };
+        /**
+         * CAPTURE THE RAW id_token — card 138635, client half.
+         *
+         * getUserInfo is the ONLY provider hook that receives the token set.
+         * mapProfileToUser cannot do this: it is handed the DECODED claims, and a
+         * signed JWT cannot be reconstructed from them. We need the raw token
+         * because the IDP must verify the signature ITSELF — a client-decoded
+         * claim is just another assertable field, which is the defect restated.
+         *
+         * ⚠ THIS REPLACES THE DEFAULT google getUserInfo ENTIRELY. Upstream calls
+         * `if (options.getUserInfo) return options.getUserInfo(token)` FIRST and
+         * returns our result verbatim, so everything the default did is now ours to
+         * do — including the `hd` hosted-domain restriction.
+         *
+         * `hd` IS NOT HYPOTHETICAL: it is wired from additionalParams.hd four lines
+         * above, so a client can restrict sign-in to a Google Workspace domain.
+         * Silently dropping it would let ANY Google account into a client that had
+         * restricted itself — a security regression introduced by a security fix.
+         * (Measured on 93: zero clients set it today. That is a reason to be
+         * careful, not a reason to skip it — it is configurable and unused, which
+         * is exactly the state in which a regression goes unnoticed.)
+         *
+         * SO WE DO NOT OVERRIDE AT ALL WHEN `hd` IS SET. We take the hook over
+         * ONLY where upstream's check is PROVABLY VACUOUS — its own first line is
+         * `if (!configuredHostedDomain) return true`. With no hd configured the
+         * default would return true unconditionally, so omitting it is equivalent
+         * by the library's own definition rather than by our judgement.
+         *
+         * A client that DOES set hd keeps the stock provider, keeps its domain
+         * restriction, and simply does not contribute an id_token yet. Losing a
+         * capability is an acceptable cost; silently losing a security control is
+         * not. (better-auth does not re-export the predicate through its public
+         * types, and reimplementing a security check is how two copies drift — so
+         * the honest move is to not need it.)
+         */
+        if (name === 'google' && !providers[name].hd) {
+            providers[name].getUserInfo = async (token) => {
+                if (!token?.idToken)
+                    return null;
+                // The only new behaviour: hand the raw token to this request's scope.
+                const scope = idTokenScope.getStore();
+                if (scope)
+                    scope.idToken = token.idToken;
+                // Mirrors the upstream default (google.mjs) verbatim, minus the hd
+                // branch that cannot fire here — so overriding the hook changes WHAT WE
+                // KEEP, never what we ACCEPT.
+                const claims = (0, jose_1.decodeJwt)(token.idToken);
+                return {
+                    user: {
+                        id: claims.sub,
+                        name: claims.name,
+                        email: claims.email,
+                        image: claims.picture,
+                        emailVerified: claims.email_verified,
+                    },
+                    data: claims,
+                };
+            };
+        }
     }
     return providers;
 }
@@ -297,6 +382,30 @@ async function exchangeOAuthForIdpTokens(sessionToken, provider = 'google') {
                 name,
                 image,
                 client_id: config.clientSlug || String(config.clientId),
+                /**
+                 * Card 138635 — the RAW provider id_token, forwarded verbatim.
+                 *
+                 * Every other field in this body is an ASSERTION. The endpoint mints an
+                 * IDP bearer from them today with no cryptographic check of any kind,
+                 * which is why it is a complete authentication bypass and why it has
+                 * been publicly reachable for 488 days.
+                 *
+                 * This field is the only one the IDP can VERIFY: signature against
+                 * Google's JWKS, plus iss / exp / aud, and then read email_verified
+                 * from the verified claims. Additive — the IDP ignores it until its
+                 * gate flips, so this cannot break a login on its own.
+                 *
+                 * RAW, AND NOTHING DERIVED FROM IT (BAPert's ruling). We do NOT send a
+                 * decoded email_verified. A client-computed verification flag is a body
+                 * field with a better story: an attacker posts email_verified:true and
+                 * the defect is rebuilt one layer up. The IDP verifies for itself or
+                 * the fix is theatre.
+                 *
+                 * Absent when this runs outside the OAuth callback scope — the key is
+                 * simply omitted rather than sent null, so "we never captured one" stays
+                 * distinguishable from "the provider issued none".
+                 */
+                ...(idTokenScope.getStore()?.idToken ? { id_token: idTokenScope.getStore().idToken } : {}),
             }),
         });
         const oauthResText = await oauthRes.text();
@@ -380,45 +489,52 @@ async function exchangeOAuthForIdpTokens(sessionToken, provider = 'google') {
  */
 function createAuthGetHandler(loginPath = '/account-auth/login') {
     return async function GET(request) {
-        const ba = await getBetterAuthHandler();
-        if (!ba) {
-            return new Response('Auth handler not configured', { status: 500 });
-        }
-        const response = await ba.GET(request);
-        // Intercept auth errors (state mismatch, expired cookies) — redirect to login cleanly
-        if (response.status === 302) {
-            const location = response.headers.get('location') || '';
-            if (location.includes('/api/auth/error') || location.includes('please_restart')) {
-                console.warn('[BETTER_AUTH] OAuth state error, redirecting to login');
-                return Response.redirect(new URL(loginPath, request.url), 302);
+        // Card 138635: establish the request-scoped carrier for the provider's raw
+        // id_token. It must wrap BOTH ba.GET (which invokes getUserInfo, the only
+        // hook that sees the token) and the exchange below (which forwards it).
+        // Wrapping the whole handler is what makes "never persisted" achievable —
+        // the token exists only for the life of this request.
+        return idTokenScope.run({}, async () => {
+            const ba = await getBetterAuthHandler();
+            if (!ba) {
+                return new Response('Auth handler not configured', { status: 500 });
             }
-        }
-        // After successful OAuth callback: exchange Google identity for IDP tokens
-        const url = new URL(request.url);
-        if (url.pathname.includes('/callback/') && response.status === 302) {
-            try {
-                const auth = await getBetterAuthInstance();
-                if (auth?.api?.getSession) {
-                    const setCookies = response.headers.getSetCookie?.() || [];
-                    const cookieHeader = setCookies
-                        .map((c) => c.split(';')[0])
-                        .join('; ');
-                    const headers = new Headers();
-                    headers.set('cookie', cookieHeader);
-                    const session = await auth.api.getSession({ headers });
-                    if (session?.session?.token) {
-                        console.log('[BETTER_AUTH] Got session token from callback:', session.session.token.substring(0, 10), '| email:', session.user?.email);
-                        await exchangeOAuthForIdpTokens(session.session.token);
-                    }
-                    else {
-                        console.warn('[BETTER_AUTH] Could not get session after OAuth callback');
-                    }
+            const response = await ba.GET(request);
+            // Intercept auth errors (state mismatch, expired cookies) — redirect to login cleanly
+            if (response.status === 302) {
+                const location = response.headers.get('location') || '';
+                if (location.includes('/api/auth/error') || location.includes('please_restart')) {
+                    console.warn('[BETTER_AUTH] OAuth state error, redirecting to login');
+                    return Response.redirect(new URL(loginPath, request.url), 302);
                 }
             }
-            catch (err) {
-                console.error('[BETTER_AUTH] IDP token exchange failed:', err.message);
+            // After successful OAuth callback: exchange Google identity for IDP tokens
+            const url = new URL(request.url);
+            if (url.pathname.includes('/callback/') && response.status === 302) {
+                try {
+                    const auth = await getBetterAuthInstance();
+                    if (auth?.api?.getSession) {
+                        const setCookies = response.headers.getSetCookie?.() || [];
+                        const cookieHeader = setCookies
+                            .map((c) => c.split(';')[0])
+                            .join('; ');
+                        const headers = new Headers();
+                        headers.set('cookie', cookieHeader);
+                        const session = await auth.api.getSession({ headers });
+                        if (session?.session?.token) {
+                            console.log('[BETTER_AUTH] Got session token from callback:', session.session.token.substring(0, 10), '| email:', session.user?.email);
+                            await exchangeOAuthForIdpTokens(session.session.token);
+                        }
+                        else {
+                            console.warn('[BETTER_AUTH] Could not get session after OAuth callback');
+                        }
+                    }
+                }
+                catch (err) {
+                    console.error('[BETTER_AUTH] IDP token exchange failed:', err.message);
+                }
             }
-        }
-        return response;
+            return response;
+        });
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "4.1.12",
+  "version": "4.1.14",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -891,4 +891,4 @@
     "typescript": "^5.4.5",
     "zustand": "^4.5.5"
   }
-}
+}

package/scripts/check-internal-url-usage.sh

@@ -1,73 +1,73 @@
-#!/bin/bash
-#
-# CI Check: Detect incorrect internal API URL patterns
-#
-# This script fails if code is using req.url or req.nextUrl.origin to construct
-# URLs for internal API calls. These patterns cause 403 errors in Kubernetes
-# because they use the external HTTPS URL instead of INTERNAL_API_URL.
-#
-# CORRECT:   Use internalFetch() or internalRefresh() from @payez/next-mvp/lib/internal-api
-# INCORRECT: new URL('/api/...', req.url) or fetch(`${req.nextUrl.origin}/api/...`)
-#
-# NOTE: new URL(req.url) alone is FINE - it just parses the incoming request URL.
-#       The problem is when you construct a NEW path using req.url as the base.
-#
-
-set -e
-
-SEARCH_PATH="${1:-.}"
-ERRORS_FOUND=0
-
-echo "Checking for incorrect internal URL patterns in: $SEARCH_PATH"
-echo "========================================================================"
-
-# Pattern 1: new URL('/api/...', req.url) - constructing internal API URL from request
-# This catches: new URL('/api/...', req.url) and new URL("/api/...", req.url)
-# But NOT: new URL(req.url) which is just parsing the request
-echo ""
-echo "Checking for: new URL('/api/...', req.url) pattern"
-if grep -rn --include="*.ts" --include="*.tsx" -E "new URL\(['\"][^'\"]*['\"],\s*req\.url" "$SEARCH_PATH" 2>/dev/null | grep -v "node_modules" | grep -v "\.d\.ts"; then
-    echo "ERROR: Found 'new URL(path, req.url)' pattern. Use internalFetch() instead."
-    ERRORS_FOUND=1
-fi
-
-# Pattern 2: new URL('/api/...', req.nextUrl) or new URL(..., req.nextUrl.origin)
-echo ""
-echo "Checking for: new URL(..., req.nextUrl) pattern"
-if grep -rn --include="*.ts" --include="*.tsx" -E "new URL\([^)]+,\s*req\.nextUrl" "$SEARCH_PATH" 2>/dev/null | grep -v "node_modules" | grep -v "\.d\.ts"; then
-    echo "ERROR: Found 'new URL(..., req.nextUrl)' pattern. Use internalFetch() instead."
-    ERRORS_FOUND=1
-fi
-
-# Pattern 3: fetch with req.nextUrl.origin and /api/
-echo ""
-echo "Checking for: fetch with req.nextUrl.origin and /api/"
-if grep -rn --include="*.ts" --include="*.tsx" "req\.nextUrl\.origin.*\/api\/" "$SEARCH_PATH" 2>/dev/null | grep -v "node_modules" | grep -v "\.d\.ts"; then
-    echo "ERROR: Found 'req.nextUrl.origin' used with internal API route. Use internalFetch() instead."
-    ERRORS_FOUND=1
-fi
-
-# Pattern 4: Direct fetch to /api/auth/refresh without using internalRefresh (warning only)
-echo ""
-echo "Checking for: Direct fetch to /api/auth/refresh (should use internalRefresh)"
-if grep -rn --include="*.ts" --include="*.tsx" "fetch.*\/api\/auth\/refresh" "$SEARCH_PATH" 2>/dev/null | grep -v "node_modules" | grep -v "\.d\.ts" | grep -v "internal-api\.ts"; then
-    echo "WARNING: Found direct fetch to /api/auth/refresh. Consider using internalRefresh() helper."
-    # Not failing on this one as it might be intentional in some cases (client-side refresh)
-fi
-
-echo ""
-echo "========================================================================"
-
-if [ $ERRORS_FOUND -eq 1 ]; then
-    echo "FAILED: Dangerous internal URL patterns detected!"
-    echo ""
-    echo "Fix: Import and use helpers from @payez/next-mvp/lib/internal-api:"
-    echo "  import { internalFetch, internalRefresh } from '@payez/next-mvp/lib/internal-api';"
-    echo ""
-    echo "Why: Server-to-server calls must use INTERNAL_API_URL (http://service.namespace.svc.cluster.local)"
-    echo "     not the external URL from the request (https://api.example.com) which fails in Kubernetes."
-    exit 1
-else
-    echo "PASSED: No dangerous internal URL patterns found."
-    exit 0
-fi
+#!/bin/bash
+#
+# CI Check: Detect incorrect internal API URL patterns
+#
+# This script fails if code is using req.url or req.nextUrl.origin to construct
+# URLs for internal API calls. These patterns cause 403 errors in Kubernetes
+# because they use the external HTTPS URL instead of INTERNAL_API_URL.
+#
+# CORRECT:   Use internalFetch() or internalRefresh() from @payez/next-mvp/lib/internal-api
+# INCORRECT: new URL('/api/...', req.url) or fetch(`${req.nextUrl.origin}/api/...`)
+#
+# NOTE: new URL(req.url) alone is FINE - it just parses the incoming request URL.
+#       The problem is when you construct a NEW path using req.url as the base.
+#
+
+set -e
+
+SEARCH_PATH="${1:-.}"
+ERRORS_FOUND=0
+
+echo "Checking for incorrect internal URL patterns in: $SEARCH_PATH"
+echo "========================================================================"
+
+# Pattern 1: new URL('/api/...', req.url) - constructing internal API URL from request
+# This catches: new URL('/api/...', req.url) and new URL("/api/...", req.url)
+# But NOT: new URL(req.url) which is just parsing the request
+echo ""
+echo "Checking for: new URL('/api/...', req.url) pattern"
+if grep -rn --include="*.ts" --include="*.tsx" -E "new URL\(['\"][^'\"]*['\"],\s*req\.url" "$SEARCH_PATH" 2>/dev/null | grep -v "node_modules" | grep -v "\.d\.ts"; then
+    echo "ERROR: Found 'new URL(path, req.url)' pattern. Use internalFetch() instead."
+    ERRORS_FOUND=1
+fi
+
+# Pattern 2: new URL('/api/...', req.nextUrl) or new URL(..., req.nextUrl.origin)
+echo ""
+echo "Checking for: new URL(..., req.nextUrl) pattern"
+if grep -rn --include="*.ts" --include="*.tsx" -E "new URL\([^)]+,\s*req\.nextUrl" "$SEARCH_PATH" 2>/dev/null | grep -v "node_modules" | grep -v "\.d\.ts"; then
+    echo "ERROR: Found 'new URL(..., req.nextUrl)' pattern. Use internalFetch() instead."
+    ERRORS_FOUND=1
+fi
+
+# Pattern 3: fetch with req.nextUrl.origin and /api/
+echo ""
+echo "Checking for: fetch with req.nextUrl.origin and /api/"
+if grep -rn --include="*.ts" --include="*.tsx" "req\.nextUrl\.origin.*\/api\/" "$SEARCH_PATH" 2>/dev/null | grep -v "node_modules" | grep -v "\.d\.ts"; then
+    echo "ERROR: Found 'req.nextUrl.origin' used with internal API route. Use internalFetch() instead."
+    ERRORS_FOUND=1
+fi
+
+# Pattern 4: Direct fetch to /api/auth/refresh without using internalRefresh (warning only)
+echo ""
+echo "Checking for: Direct fetch to /api/auth/refresh (should use internalRefresh)"
+if grep -rn --include="*.ts" --include="*.tsx" "fetch.*\/api\/auth\/refresh" "$SEARCH_PATH" 2>/dev/null | grep -v "node_modules" | grep -v "\.d\.ts" | grep -v "internal-api\.ts"; then
+    echo "WARNING: Found direct fetch to /api/auth/refresh. Consider using internalRefresh() helper."
+    # Not failing on this one as it might be intentional in some cases (client-side refresh)
+fi
+
+echo ""
+echo "========================================================================"
+
+if [ $ERRORS_FOUND -eq 1 ]; then
+    echo "FAILED: Dangerous internal URL patterns detected!"
+    echo ""
+    echo "Fix: Import and use helpers from @payez/next-mvp/lib/internal-api:"
+    echo "  import { internalFetch, internalRefresh } from '@payez/next-mvp/lib/internal-api';"
+    echo ""
+    echo "Why: Server-to-server calls must use INTERNAL_API_URL (http://service.namespace.svc.cluster.local)"
+    echo "     not the external URL from the request (https://api.example.com) which fails in Kubernetes."
+    exit 1
+else
+    echo "PASSED: No dangerous internal URL patterns found."
+    exit 0
+fi