@payez/next-mvp 4.1.2 → 4.1.3

package/dist/routes/auth/viability.js

@@ -54,8 +54,21 @@ async function GET(req) {
         }
         const token = baSession;
         const sessionToken = baSession.session?.token;
-        const session = sessionToken ? await (0, session_store_1.getSession)(sessionToken) : null;
-        // CRITICAL: Detect stale cookie state (JWT exists but Redis session missing)
+        // Try the canonical session-store first; fall back to the Better-Auth-keyed
+        // Redis record (`ba:{appSlug}:{token}`) when the canonical lookup misses.
+        // Without the fallback, any consumer that wrote a BA session via the OAuth
+        // callback path or dev-login and didn't separately populate the canonical
+        // store would land here with a "Stale session" verdict, even though the BA
+        // stack just resolved the cookie cleanly. Keeps the two viability impls
+        // (this route + `api-handlers/session/viability.ts`) in lockstep.
+        let session = sessionToken ? await (0, session_store_1.getSession)(sessionToken) : null;
+        if (sessionToken && !session) {
+            session = await (0, session_store_1.getBetterAuthSession)(sessionToken);
+            if (session) {
+                console.log('[VIABILITY] Found session in Better Auth store (fallback)');
+            }
+        }
+        // CRITICAL: Detect stale cookie state (cookie exists but neither store has the session)
         if (sessionToken && !session) {
             console.warn('[VIABILITY] Stale cookie detected - session not in Redis');
             return server_1.NextResponse.json({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "4.1.2",
+  "version": "4.1.3",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/routes/auth/viability.ts

@@ -16,7 +16,10 @@
 
 import { NextRequest, NextResponse } from 'next/server';
 import { getSession as getBetterAuthSession } from '../../server/auth';
-import { getSession as getRedisSession } from '../../lib/session-store';
+import {
+  getSession as getRedisSession,
+  getBetterAuthSession as getBetterAuthRedisSession,
+} from '../../lib/session-store';
 import { getIDPClientConfig } from '../../lib/idp-client-config';
 
 /**
@@ -55,9 +58,23 @@ export async function GET(req: NextRequest) {
 
     const token = baSession as any;
     const sessionToken = baSession.session?.token;
-    const session = sessionToken ? await getRedisSession(sessionToken) : null;
 
-    // CRITICAL: Detect stale cookie state (JWT exists but Redis session missing)
+    // Try the canonical session-store first; fall back to the Better-Auth-keyed
+    // Redis record (`ba:{appSlug}:{token}`) when the canonical lookup misses.
+    // Without the fallback, any consumer that wrote a BA session via the OAuth
+    // callback path or dev-login and didn't separately populate the canonical
+    // store would land here with a "Stale session" verdict, even though the BA
+    // stack just resolved the cookie cleanly. Keeps the two viability impls
+    // (this route + `api-handlers/session/viability.ts`) in lockstep.
+    let session = sessionToken ? await getRedisSession(sessionToken) : null;
+    if (sessionToken && !session) {
+      session = await getBetterAuthRedisSession(sessionToken);
+      if (session) {
+        console.log('[VIABILITY] Found session in Better Auth store (fallback)');
+      }
+    }
+
+    // CRITICAL: Detect stale cookie state (cookie exists but neither store has the session)
     if (sessionToken && !session) {
       console.warn('[VIABILITY] Stale cookie detected - session not in Redis');
       return NextResponse.json({