@payez/next-mvp 4.1.14 → 4.1.21

package/scripts/check-internal-url-usage.sh

@@ -1,73 +1,73 @@
-#!/bin/bash
-#
-# CI Check: Detect incorrect internal API URL patterns
-#
-# This script fails if code is using req.url or req.nextUrl.origin to construct
-# URLs for internal API calls. These patterns cause 403 errors in Kubernetes
-# because they use the external HTTPS URL instead of INTERNAL_API_URL.
-#
-# CORRECT:   Use internalFetch() or internalRefresh() from @payez/next-mvp/lib/internal-api
-# INCORRECT: new URL('/api/...', req.url) or fetch(`${req.nextUrl.origin}/api/...`)
-#
-# NOTE: new URL(req.url) alone is FINE - it just parses the incoming request URL.
-#       The problem is when you construct a NEW path using req.url as the base.
-#
-
-set -e
-
-SEARCH_PATH="${1:-.}"
-ERRORS_FOUND=0
-
-echo "Checking for incorrect internal URL patterns in: $SEARCH_PATH"
-echo "========================================================================"
-
-# Pattern 1: new URL('/api/...', req.url) - constructing internal API URL from request
-# This catches: new URL('/api/...', req.url) and new URL("/api/...", req.url)
-# But NOT: new URL(req.url) which is just parsing the request
-echo ""
-echo "Checking for: new URL('/api/...', req.url) pattern"
-if grep -rn --include="*.ts" --include="*.tsx" -E "new URL\(['\"][^'\"]*['\"],\s*req\.url" "$SEARCH_PATH" 2>/dev/null | grep -v "node_modules" | grep -v "\.d\.ts"; then
-    echo "ERROR: Found 'new URL(path, req.url)' pattern. Use internalFetch() instead."
-    ERRORS_FOUND=1
-fi
-
-# Pattern 2: new URL('/api/...', req.nextUrl) or new URL(..., req.nextUrl.origin)
-echo ""
-echo "Checking for: new URL(..., req.nextUrl) pattern"
-if grep -rn --include="*.ts" --include="*.tsx" -E "new URL\([^)]+,\s*req\.nextUrl" "$SEARCH_PATH" 2>/dev/null | grep -v "node_modules" | grep -v "\.d\.ts"; then
-    echo "ERROR: Found 'new URL(..., req.nextUrl)' pattern. Use internalFetch() instead."
-    ERRORS_FOUND=1
-fi
-
-# Pattern 3: fetch with req.nextUrl.origin and /api/
-echo ""
-echo "Checking for: fetch with req.nextUrl.origin and /api/"
-if grep -rn --include="*.ts" --include="*.tsx" "req\.nextUrl\.origin.*\/api\/" "$SEARCH_PATH" 2>/dev/null | grep -v "node_modules" | grep -v "\.d\.ts"; then
-    echo "ERROR: Found 'req.nextUrl.origin' used with internal API route. Use internalFetch() instead."
-    ERRORS_FOUND=1
-fi
-
-# Pattern 4: Direct fetch to /api/auth/refresh without using internalRefresh (warning only)
-echo ""
-echo "Checking for: Direct fetch to /api/auth/refresh (should use internalRefresh)"
-if grep -rn --include="*.ts" --include="*.tsx" "fetch.*\/api\/auth\/refresh" "$SEARCH_PATH" 2>/dev/null | grep -v "node_modules" | grep -v "\.d\.ts" | grep -v "internal-api\.ts"; then
-    echo "WARNING: Found direct fetch to /api/auth/refresh. Consider using internalRefresh() helper."
-    # Not failing on this one as it might be intentional in some cases (client-side refresh)
-fi
-
-echo ""
-echo "========================================================================"
-
-if [ $ERRORS_FOUND -eq 1 ]; then
-    echo "FAILED: Dangerous internal URL patterns detected!"
-    echo ""
-    echo "Fix: Import and use helpers from @payez/next-mvp/lib/internal-api:"
-    echo "  import { internalFetch, internalRefresh } from '@payez/next-mvp/lib/internal-api';"
-    echo ""
-    echo "Why: Server-to-server calls must use INTERNAL_API_URL (http://service.namespace.svc.cluster.local)"
-    echo "     not the external URL from the request (https://api.example.com) which fails in Kubernetes."
-    exit 1
-else
-    echo "PASSED: No dangerous internal URL patterns found."
-    exit 0
-fi
+#!/bin/bash
+#
+# CI Check: Detect incorrect internal API URL patterns
+#
+# This script fails if code is using req.url or req.nextUrl.origin to construct
+# URLs for internal API calls. These patterns cause 403 errors in Kubernetes
+# because they use the external HTTPS URL instead of INTERNAL_API_URL.
+#
+# CORRECT:   Use internalFetch() or internalRefresh() from @payez/next-mvp/lib/internal-api
+# INCORRECT: new URL('/api/...', req.url) or fetch(`${req.nextUrl.origin}/api/...`)
+#
+# NOTE: new URL(req.url) alone is FINE - it just parses the incoming request URL.
+#       The problem is when you construct a NEW path using req.url as the base.
+#
+
+set -e
+
+SEARCH_PATH="${1:-.}"
+ERRORS_FOUND=0
+
+echo "Checking for incorrect internal URL patterns in: $SEARCH_PATH"
+echo "========================================================================"
+
+# Pattern 1: new URL('/api/...', req.url) - constructing internal API URL from request
+# This catches: new URL('/api/...', req.url) and new URL("/api/...", req.url)
+# But NOT: new URL(req.url) which is just parsing the request
+echo ""
+echo "Checking for: new URL('/api/...', req.url) pattern"
+if grep -rn --include="*.ts" --include="*.tsx" -E "new URL\(['\"][^'\"]*['\"],\s*req\.url" "$SEARCH_PATH" 2>/dev/null | grep -v "node_modules" | grep -v "\.d\.ts"; then
+    echo "ERROR: Found 'new URL(path, req.url)' pattern. Use internalFetch() instead."
+    ERRORS_FOUND=1
+fi
+
+# Pattern 2: new URL('/api/...', req.nextUrl) or new URL(..., req.nextUrl.origin)
+echo ""
+echo "Checking for: new URL(..., req.nextUrl) pattern"
+if grep -rn --include="*.ts" --include="*.tsx" -E "new URL\([^)]+,\s*req\.nextUrl" "$SEARCH_PATH" 2>/dev/null | grep -v "node_modules" | grep -v "\.d\.ts"; then
+    echo "ERROR: Found 'new URL(..., req.nextUrl)' pattern. Use internalFetch() instead."
+    ERRORS_FOUND=1
+fi
+
+# Pattern 3: fetch with req.nextUrl.origin and /api/
+echo ""
+echo "Checking for: fetch with req.nextUrl.origin and /api/"
+if grep -rn --include="*.ts" --include="*.tsx" "req\.nextUrl\.origin.*\/api\/" "$SEARCH_PATH" 2>/dev/null | grep -v "node_modules" | grep -v "\.d\.ts"; then
+    echo "ERROR: Found 'req.nextUrl.origin' used with internal API route. Use internalFetch() instead."
+    ERRORS_FOUND=1
+fi
+
+# Pattern 4: Direct fetch to /api/auth/refresh without using internalRefresh (warning only)
+echo ""
+echo "Checking for: Direct fetch to /api/auth/refresh (should use internalRefresh)"
+if grep -rn --include="*.ts" --include="*.tsx" "fetch.*\/api\/auth\/refresh" "$SEARCH_PATH" 2>/dev/null | grep -v "node_modules" | grep -v "\.d\.ts" | grep -v "internal-api\.ts"; then
+    echo "WARNING: Found direct fetch to /api/auth/refresh. Consider using internalRefresh() helper."
+    # Not failing on this one as it might be intentional in some cases (client-side refresh)
+fi
+
+echo ""
+echo "========================================================================"
+
+if [ $ERRORS_FOUND -eq 1 ]; then
+    echo "FAILED: Dangerous internal URL patterns detected!"
+    echo ""
+    echo "Fix: Import and use helpers from @payez/next-mvp/lib/internal-api:"
+    echo "  import { internalFetch, internalRefresh } from '@payez/next-mvp/lib/internal-api';"
+    echo ""
+    echo "Why: Server-to-server calls must use INTERNAL_API_URL (http://service.namespace.svc.cluster.local)"
+    echo "     not the external URL from the request (https://api.example.com) which fails in Kubernetes."
+    exit 1
+else
+    echo "PASSED: No dangerous internal URL patterns found."
+    exit 0
+fi

package/src/api-handlers/account/profile.ts

@@ -1,80 +1,99 @@
 import { NextRequest, NextResponse } from 'next/server';
+import { idpFetchJSON } from '../../lib/idp-fetch';
+import { ENV_CONFIG } from '../../config/env';
 
 /**
  * Account Profile API Handler
- * Simple proxy to IDP profile endpoint
  *
- * GET /api/account/profile - Get user profile
- * PUT /api/account/profile - Update user profile
+ * GET /api/account/profile  - Get user profile
+ * PUT /api/account/profile  - Update user profile
+ *
+ * WHY THIS WAS REWRITTEN (2026-08-02, QAPert defect #7)
+ * Reported as "/api/account/profile 401s on the same cookie masked-info
+ * accepts (200)". Two endpoints disagreeing about one cookie meant two auth
+ * implementations, and they were:
+ *
+ *   masked-info.ts  idpFetchJSON(req, ...)           resolves the caller's token
+ *                                                    from the server-side session
+ *   profile.ts      req.headers.get('authorization') required an INBOUND bearer
+ *
+ * A browser sends a session COOKIE and no Authorization header, so the old
+ * profile.ts 401'd EVERY browser request by construction. Nothing was revoked
+ * and no token was stale — the handler demanded a credential the app does not
+ * use.
+ *
+ * THE OLD AUTH CHECK WAS A VENEER. It tested that the header was PRESENT, never
+ * that it was valid, then forwarded it upstream unexamined. Any string at all
+ * got past it and the IDP did the real work. It looked like enforcement and
+ * enforced nothing.
+ *
+ * WHAT THE WORKAROUND COST US: consumers could not call this with a cookie, so
+ * the graft's useProfile hook fetched the raw IDP access token from
+ * /api/session/idp-token INTO BROWSER JAVASCRIPT and re-sent it as a bearer.
+ * That defeats the reason idpFetchJSON exists — it keeps the token server-side
+ * precisely so client-side script can never hold it. The bearer-only handler
+ * did not merely fail; it pushed its callers into exposing the token.
+ *
+ * Switching to idpFetchJSON makes the cookie work, so the hook's token round
+ * trip can be deleted and /api/session/idp-token drops to a single deliberate
+ * caller: the jwt-inspect debug page.
+ *
+ * @package @payez/next-mvp
  */
 
-function getIdpUrl(): string {
-  const url = process.env.IDP_URL;
-  if (!url) {
-    throw new Error('[IDP_URL] FATAL: IDP_URL environment variable is REQUIRED.');
-  }
-  return url;
-}
-
 export async function GET(req: NextRequest) {
-  const IDP_URL = getIdpUrl();
-  const authHeader = req.headers.get('authorization');
+  const result = await idpFetchJSON(req, `${ENV_CONFIG.IDP_URL}/api/Account/profile`, {
+    method: 'GET',
+    headers: { 'Content-Type': 'application/json' },
+  });
 
-  if (!authHeader) {
+  if (!result.ok) {
     return NextResponse.json(
-      { success: false, error: { code: 'UNAUTHORIZED', message: 'Authentication required' } },
-      { status: 401 }
-    );
-  }
-
-  try {
-    const upstream = await fetch(`${IDP_URL}/api/Account/profile`, {
-      method: 'GET',
-      headers: {
-        'Content-Type': 'application/json',
-        'Authorization': authHeader,
+      {
+        success: false,
+        error: {
+          code: 'UPSTREAM_SERVICE_ERROR',
+          message: result.json?.message || 'Failed to fetch profile',
+          status: result.status,
+        },
+        meta: { attemptedRefresh: result.attemptedRefresh },
       },
-    });
-
-    const data = await upstream.json().catch(() => ({}));
-    return NextResponse.json(data, { status: upstream.status });
-  } catch (error) {
-    return NextResponse.json(
-      { success: false, error: { code: 'UPSTREAM_ERROR', message: 'Failed to fetch profile' } },
-      { status: 500 }
+      { status: result.status }
     );
   }
+
+  return NextResponse.json(result.json, { status: 200 });
 }
 
 export async function PUT(req: NextRequest) {
-  const IDP_URL = getIdpUrl();
-  const authHeader = req.headers.get('authorization');
-
-  if (!authHeader) {
-    return NextResponse.json(
-      { success: false, error: { code: 'UNAUTHORIZED', message: 'Authentication required' } },
-      { status: 401 }
-    );
-  }
-
+  let body = '{}';
   try {
-    const body = await req.text();
+    const raw = await req.text();
+    if (raw && raw.trim().length > 0) body = raw;
+  } catch {
+    // Empty body is valid here; the IDP validates the payload.
+  }
 
-    const upstream = await fetch(`${IDP_URL}/api/Account/profile`, {
-      method: 'PUT',
-      headers: {
-        'Content-Type': 'application/json',
-        'Authorization': authHeader,
-      },
-      body,
-    });
+  const result = await idpFetchJSON(req, `${ENV_CONFIG.IDP_URL}/api/Account/profile`, {
+    method: 'PUT',
+    headers: { 'Content-Type': 'application/json' },
+    body,
+  });
 
-    const data = await upstream.json().catch(() => ({}));
-    return NextResponse.json(data, { status: upstream.status });
-  } catch (error) {
+  if (!result.ok) {
     return NextResponse.json(
-      { success: false, error: { code: 'UPSTREAM_ERROR', message: 'Failed to update profile' } },
-      { status: 500 }
+      {
+        success: false,
+        error: {
+          code: 'UPSTREAM_SERVICE_ERROR',
+          message: result.json?.message || 'Failed to update profile',
+          status: result.status,
+        },
+        meta: { attemptedRefresh: result.attemptedRefresh },
+      },
+      { status: result.status }
     );
   }
+
+  return NextResponse.json(result.json, { status: 200 });
 }

package/src/api-handlers/account/recovery/send-code.ts

@@ -1,25 +1,73 @@
 import { NextRequest, NextResponse } from 'next/server';
+import { idpFetchJSON } from '../../../lib/idp-fetch';
+import { ENV_CONFIG } from '../../../config/env';
 
-function getIdpUrl(): string {
-  const url = process.env.IDP_URL;
-  if (!url) throw new Error('[IDP_URL] FATAL: IDP_URL environment variable is REQUIRED.');
-  return url;
-}
+/**
+ * Account recovery — send-code
+ *
+ * WHY THIS WAS REWRITTEN (2026-08-02, swept out of QAPert defect #7)
+ * This handler read the caller's bearer straight off the inbound request:
+ *
+ *     const auth  = req.headers.get('authorization') || '';
+ *     const token = auth.startsWith('Bearer ') ? auth.slice(7) : '';
+ *     ... headers: { 'Authorization': `Bearer ${token}` }
+ *
+ * Browsers send a session COOKIE and no Authorization header, so `token` was
+ * ALWAYS the empty string and this always called the IDP with a literal
+ * "Bearer " and nothing after it.
+ *
+ * THAT IS WORSE THAN THE profile.ts VERSION OF THIS BUG, in two ways:
+ *
+ *   1. profile.ts at least 401'd when the header was missing. This one has no
+ *      check at all — `|| ''` swallows the absence — so it proceeds to call
+ *      upstream with an empty credential and returns the IDP's rejection as an
+ *      opaque failure. The user sees recovery "not working", not "not
+ *      authenticated", and the log shows an upstream error rather than an auth
+ *      one. The defect hides itself.
+ *   2. It is BOTH HALVES of account recovery — send-code and verify-code — so
+ *      the entire recovery path is unreachable, not merely degraded. This is
+ *      the flow a locked-out user reaches for, i.e. it fails exactly when it is
+ *      the only thing left that could help them.
+ *
+ * Fixed the same way as profile.ts and masked-info.ts: idpFetchJSON resolves
+ * the caller's token from the server-side session, so the cookie works and the
+ * token is never handed to browser JavaScript.
+ *
+ * @package @payez/next-mvp
+ */
 
 export async function POST(req: NextRequest) {
-  const IDP_URL = getIdpUrl();
+  let payload: unknown = {};
   try {
-    const auth = req.headers.get('authorization') || '';
-    const token = auth.startsWith('Bearer ') ? auth.slice(7) : '';
-    const { method } = await req.json();
-    const upstream = await fetch(`${IDP_URL}/api/Account/recovery/send-code`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${token}` },
-      body: JSON.stringify({ method }),
-    });
-    const data = await upstream.json().catch(() => ({}));
-    return NextResponse.json(data, { status: upstream.status });
+    payload = await req.json();
   } catch {
-    return NextResponse.json({ success: false, error: 'send_code_failed' }, { status: 500 });
+    return NextResponse.json(
+      { success: false, error: 'invalid_request', message: 'A JSON body is required' },
+      { status: 400 }
+    );
   }
+
+  const result = await idpFetchJSON(
+    req,
+    `${ENV_CONFIG.IDP_URL}/api/Account/recovery/send-code`,
+    {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(payload),
+    }
+  );
+
+  if (!result.ok) {
+    return NextResponse.json(
+      {
+        success: false,
+        error: 'send_code_failed',
+        message: result.json?.message || 'Upstream error',
+        meta: { status: result.status, attemptedRefresh: result.attemptedRefresh },
+      },
+      { status: result.status }
+    );
+  }
+
+  return NextResponse.json(result.json, { status: 200 });
 }

package/src/api-handlers/account/recovery/verify-code.ts

@@ -1,25 +1,73 @@
 import { NextRequest, NextResponse } from 'next/server';
+import { idpFetchJSON } from '../../../lib/idp-fetch';
+import { ENV_CONFIG } from '../../../config/env';
 
-function getIdpUrl(): string {
-  const url = process.env.IDP_URL;
-  if (!url) throw new Error('[IDP_URL] FATAL: IDP_URL environment variable is REQUIRED.');
-  return url;
-}
+/**
+ * Account recovery — verify-code
+ *
+ * WHY THIS WAS REWRITTEN (2026-08-02, swept out of QAPert defect #7)
+ * This handler read the caller's bearer straight off the inbound request:
+ *
+ *     const auth  = req.headers.get('authorization') || '';
+ *     const token = auth.startsWith('Bearer ') ? auth.slice(7) : '';
+ *     ... headers: { 'Authorization': `Bearer ${token}` }
+ *
+ * Browsers send a session COOKIE and no Authorization header, so `token` was
+ * ALWAYS the empty string and this always called the IDP with a literal
+ * "Bearer " and nothing after it.
+ *
+ * THAT IS WORSE THAN THE profile.ts VERSION OF THIS BUG, in two ways:
+ *
+ *   1. profile.ts at least 401'd when the header was missing. This one has no
+ *      check at all — `|| ''` swallows the absence — so it proceeds to call
+ *      upstream with an empty credential and returns the IDP's rejection as an
+ *      opaque failure. The user sees recovery "not working", not "not
+ *      authenticated", and the log shows an upstream error rather than an auth
+ *      one. The defect hides itself.
+ *   2. It is BOTH HALVES of account recovery — send-code and verify-code — so
+ *      the entire recovery path is unreachable, not merely degraded. This is
+ *      the flow a locked-out user reaches for, i.e. it fails exactly when it is
+ *      the only thing left that could help them.
+ *
+ * Fixed the same way as profile.ts and masked-info.ts: idpFetchJSON resolves
+ * the caller's token from the server-side session, so the cookie works and the
+ * token is never handed to browser JavaScript.
+ *
+ * @package @payez/next-mvp
+ */
 
 export async function POST(req: NextRequest) {
-  const IDP_URL = getIdpUrl();
+  let payload: unknown = {};
   try {
-    const auth = req.headers.get('authorization') || '';
-    const token = auth.startsWith('Bearer ') ? auth.slice(7) : '';
-    const { code, method } = await req.json();
-    const upstream = await fetch(`${IDP_URL}/api/Account/recovery/verify-code`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${token}` },
-      body: JSON.stringify({ code, method }),
-    });
-    const data = await upstream.json().catch(() => ({}));
-    return NextResponse.json(data, { status: upstream.status });
+    payload = await req.json();
   } catch {
-    return NextResponse.json({ success: false, error: 'verify_code_failed' }, { status: 500 });
+    return NextResponse.json(
+      { success: false, error: 'invalid_request', message: 'A JSON body is required' },
+      { status: 400 }
+    );
   }
+
+  const result = await idpFetchJSON(
+    req,
+    `${ENV_CONFIG.IDP_URL}/api/Account/recovery/verify-code`,
+    {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(payload),
+    }
+  );
+
+  if (!result.ok) {
+    return NextResponse.json(
+      {
+        success: false,
+        error: 'verify_code_failed',
+        message: result.json?.message || 'Upstream error',
+        meta: { status: result.status, attemptedRefresh: result.attemptedRefresh },
+      },
+      { status: result.status }
+    );
+  }
+
+  return NextResponse.json(result.json, { status: 200 });
 }

package/src/api-handlers/account/verify-email.ts

@@ -54,6 +54,11 @@ export async function POST(req: NextRequest) {
     const unwrappedData = result.json?.data || result.json;
 
     // If we have new tokens, update the session to complete 2FA
+    // Reports whether the session ACTUALLY transitioned. Must not be assumed
+    // from a 2xx: the IDP can verify the code while we fail to transition
+    // (no tokens returned, or no resolvable session token).
+    let sessionTransitioned = false;
+
     if (unwrappedData.access_token && unwrappedData.refresh_token) {
       // Get session token from NextAuth
       // Support both field names: sessionToken (auth.ts JWT) and redisSessionId (legacy)
@@ -97,18 +102,27 @@ export async function POST(req: NextRequest) {
           'email' // Store 2FA method for refresh token flow
         );
 
+        sessionTransitioned = true;
+
         console.log('[VERIFY_EMAIL] Session updated successfully', {
           accessTokenExpires: new Date(accessTokenExpires).toISOString(),
           refreshTokenExpires: new Date(refreshTokenExpires).toISOString()
         });
+      } else {
+        console.warn('[VERIFY_EMAIL] IDP verified the code but no session token was resolvable — session NOT transitioned');
       }
+    } else {
+      console.warn('[VERIFY_EMAIL] IDP returned 2xx without tokens — session NOT transitioned');
     }
 
     // Return simplified success response (don't expose tokens to client)
     return NextResponse.json({
       success: true,
       verificationSuccessful: true,
-      twoFactorSessionVerified: true,
+      // NOT a copy of `success` — reports what actually happened. A client that
+      // trusted a hardcoded true would show the user as MFA-verified while the
+      // session still says otherwise.
+      twoFactorSessionVerified: sessionTransitioned,
       message: unwrappedData.message || 'Email code verified successfully'
     }, { status: 200 });
   } catch (error) {

package/src/api-handlers/account/verify-sms.ts

@@ -54,6 +54,11 @@ export async function POST(req: NextRequest) {
     const unwrappedData = result.json?.data || result.json;
 
     // If we have new tokens, update the session to complete 2FA
+    // Reports whether the session ACTUALLY transitioned. Must not be assumed
+    // from a 2xx: the IDP can verify the code while we fail to transition
+    // (no tokens returned, or no resolvable session token).
+    let sessionTransitioned = false;
+
     if (unwrappedData.access_token && unwrappedData.refresh_token) {
       // Get session token from NextAuth
       // Support both field names: sessionToken (auth.ts JWT) and redisSessionId (legacy)
@@ -97,18 +102,27 @@ export async function POST(req: NextRequest) {
           'sms' // Store 2FA method for refresh token flow
         );
 
+        sessionTransitioned = true;
+
         console.log('[VERIFY_SMS] Session updated successfully', {
           accessTokenExpires: new Date(accessTokenExpires).toISOString(),
           refreshTokenExpires: new Date(refreshTokenExpires).toISOString()
         });
+      } else {
+        console.warn('[VERIFY_SMS] IDP verified the code but no session token was resolvable — session NOT transitioned');
       }
+    } else {
+      console.warn('[VERIFY_SMS] IDP returned 2xx without tokens — session NOT transitioned');
     }
 
     // Return simplified success response (don't expose tokens to client)
     return NextResponse.json({
       success: true,
       verificationSuccessful: true,
-      twoFactorSessionVerified: true,
+      // NOT a copy of `success` — reports what actually happened. A client that
+      // trusted a hardcoded true would show the user as MFA-verified while the
+      // session still says otherwise.
+      twoFactorSessionVerified: sessionTransitioned,
       message: unwrappedData.message || 'SMS code verified successfully'
     }, { status: 200 });
   } catch (error) {