@payez/next-mvp 4.1.20 → 4.4.0

package/dist/routes/auth/viability.js

@@ -72,21 +72,57 @@ async function getTenantRequiresTwoFactor() {
  * nullable require_2fa fix: "absent" has to be expressible, or callers cannot
  * tell a real value from a default.
  *
- * No local default: `allowed2FAMethods` is non-optional on AuthSettings and is
- * populated on BOTH config construction paths (idp-client-config.ts:333, :514)
- * with the tenant's value or the layer's own ['email','sms']. Repeating that
- * default here would be a second source for one setting, free to drift.
+ * No local default. 257255 UPDATE: allowed2FAMethods is now OPTIONAL on
+ * AuthSettings - the config mapper no longer substitutes ['email','sms'] when
+ * the document carries no policy, because that made "no policy" and "exactly
+ * these methods" indistinguishable. So absent now correctly reaches this
+ * function as undefined and is reported as UNKNOWN (null), which is what this
+ * function's own contract already said it wanted. Before the change it would
+ * have returned the mapper's fabrication AS IF IT WERE THE TENANT'S VALUE.
  */
 async function getTenantAllowed2FAMethods() {
     try {
         const config = await (0, idp_client_config_1.getIDPClientConfig)();
-        return config.authSettings.allowed2FAMethods;
+        // `?? null` is the whole point: undefined means the document carried no
+        // policy, and this function reports UNKNOWN rather than guessing.
+        return config.authSettings.allowed2FAMethods ?? null;
     }
     catch {
         console.warn('[VIABILITY] Could not get client config — reporting allowed 2FA methods as UNKNOWN (null), not guessing');
         return null;
     }
 }
+/**
+ * Resolve the client id reported to the caller.
+ *
+ * Was: `session?.idpClientId || process.env.IDP_CLIENT_ID || ''`. Two defects,
+ * both of the "report a confident value where the truth is unknown" family that
+ * card 221076 was about:
+ *
+ * 1. `|| ''` made "we do not know this session's client" indistinguishable from
+ *    "the client id is blank". Callers cannot tell absence from a known-empty
+ *    value, so nothing can react to the former. Absence is now `null`, which is
+ *    representable — and still falsy, so existing `if (!clientId)` guards behave
+ *    exactly as before.
+ *
+ * 2. The env fallback SILENTLY substitutes the deployment's default client for a
+ *    session whose own client is unknown. On a multi-tenant IDP that is a
+ *    cross-tenant wrong answer, not a default. It is kept for single-tenant
+ *    deployments that rely on it, but it now says so in the log rather than
+ *    passing the substitution off as the session's own identity.
+ */
+function resolveClientId(sessionClientId) {
+    if (sessionClientId)
+        return sessionClientId;
+    const envClientId = process.env.IDP_CLIENT_ID;
+    if (envClientId) {
+        console.warn('[VIABILITY_ROUTE] session carries no idpClientId - substituting IDP_CLIENT_ID ' +
+            'from the environment. On a multi-tenant deployment this is a DIFFERENT client ' +
+            'than the session belongs to.');
+        return envClientId;
+    }
+    return null;
+}
 /**
  * GET /api/session/viability - Check if session is viable
  *
@@ -157,9 +193,84 @@ async function GET(req) {
         // default that reads like a measurement. Same mistake as the nullable
         // require_2fa case: absent has to stay expressible.
         const nextStep = session?.nextStep;
+        /**
+         * 266007 — port the sibling's CRITICAL override (api-handlers/session/
+         * viability.ts:82-86) into this, the impl consumers actually MOUNT.
+         * An OAuth session whose callback set mfaVerified === false because no
+         * refresh_token was issued ALWAYS needs 2FA completion, whatever the
+         * tenant config says — completing 2FA is how it obtains one.
+         *
+         * STRICT === false, deliberately: an ABSENT mfaVerified (every session
+         * minted before that field existed) is not a signal, and treating it as
+         * one would force-rechallenge the entire existing session population.
+         *
+         * *** R807 (BAPert, card 362550) - WHY THE `=== false` TEST ALONE NO LONGER
+         * CARRIES THAT INTENT, AND WHAT RESTORES IT. ***
+         *
+         * The intent above is right, but by the time a session reaches here the
+         * distinction it depends on IS ALREADY GONE: every construction site
+         * (session-store, decode-session, token-lifecycle x2, SessionModel) collapses
+         * an absent mfaVerified to `false` via `?? false`. So `=== false` had stopped
+         * meaning "the callback affirmatively said false" and had come to mean
+         * "affirmatively false OR never knew" - i.e. the exact mass re-challenge this
+         * comment says it is preventing. The guard read as strict while behaving as
+         * permissive, because the collapse happens upstream and out of sight.
+         *
+         * R807 keeps `mfaVerified` fail-closed at all five sites (removing `?? false`
+         * would be an AUTH BYPASS - a session that never proved MFA read as having
+         * proved it) and gives THIS question its own signal instead. So the test is
+         * now two parts:
+         *
+         *   mfaSignalPresent === true  -> the producer really did emit a value, so the
+         *                                 `false` below is a MEASUREMENT. Fire.
+         *   absent / false             -> LEGACY session (minted before the signal
+         *                                 existed) or a path with no IDP tokens at all.
+         *                                 NOT a signal. Do NOT force a re-challenge.
+         *
+         * That absent-means-do-not-fire read is the migration behaviour, and it is
+         * what preserves this comment's original guarantee verbatim through rollout:
+         * on the day this ships, EVERY existing session has no signal and none of them
+         * is re-challenged.
+         *
+         * *** AND IT IS SAFE ONLY BECAUSE IT IS CONFINED HERE. *** mfaSignalPresent is
+         * permissive by construction - it can only ever SUPPRESS this override. It must
+         * never reach a path that grants access; gate those on `mfaVerified`, which is
+         * still fail-closed everywhere. R807 is void if this signal escapes into an
+         * auth decision.
+         *
+         * Declared once here, like nextStep above, so the three authenticated
+         * responses cannot drift apart. Feeds the legacy `requires2FA` field the
+         * middleware actually gates on; `tenantRequiresTwoFactor` stays pure —
+         * it names TENANT policy, and this override is not tenant state.
+         */
+        const oauthSessionNeedsTwoFactor = session?.mfaSignalPresent === true &&
+            session?.mfaVerified === false &&
+            !(session.idpRefreshToken || session?.refreshToken);
         // Check access token expiry
         const now = Math.floor(Date.now() / 1000);
-        const accessTokenExpires = token.accessTokenExpires || token.exp;
+        // 240654 addendum 2: fall back to the Redis session's own expiry.
+        //
+        // The first two reads come off the Better Auth session OBJECT. A Path-B
+        // synthetic session — the shape server/auth.ts builds for a legacy JWS
+        // session — carries NEITHER: it is `{session:{token}, user:{...}}` with no
+        // accessTokenExpires and no exp. So every legacy session fell into the
+        // "no expiry info" branch below and answered needsRefresh:true on EVERY
+        // viability read from the moment of login, while the token was in fact
+        // fresh (15-minute TTL measured). Benign for the viable/authenticated
+        // verdict, but it recommends a refresh constantly, which is pure perf
+        // noise and multiplies exposure to the empty-clientId refresh path (223542).
+        //
+        // lib/session-store puts the real value on the session as
+        // idpAccessTokenExpires, in MILLISECONDS (better-auth.ts:784 sets
+        // `Date.now() + expires_in * 1000`). The other two sources are in SECONDS.
+        // Mixing units here would be a silent disaster, so note that the
+        // normalisation below (`> 1e12 ? /1000 : as-is`) already discriminates
+        // them by magnitude: a seconds timestamp is ~1.7e9, a milliseconds one
+        // ~1.7e12. This fallback is therefore safe in either unit, and that
+        // existing normaliser is load-bearing for it -- do not remove it.
+        const accessTokenExpires = token.accessTokenExpires ||
+            token.exp ||
+            session?.idpAccessTokenExpires;
         if (!accessTokenExpires) {
             // No expiry info, assume viable but recommend refresh
             const tenantRequiresTwoFactor = await getTenantRequiresTwoFactor();
@@ -186,7 +297,7 @@ async function GET(req) {
                 tenantAllowed2FAMethods,
                 nextStep,
                 // Legacy field names for backwards compatibility
-                requires2FA: tenantRequiresTwoFactor,
+                requires2FA: tenantRequiresTwoFactor || oauthSessionNeedsTwoFactor,
                 twoFactorComplete: userHasCompletedTenantTwoFactorRequirements,
                 accessTokenExpired: false,
                 reason: 'No expiry information'
@@ -246,13 +357,13 @@ async function GET(req) {
                 tenantAllowed2FAMethods,
                 nextStep,
                 // Legacy names for backwards compatibility
-                requires2FA: tenantRequiresTwoFactor,
+                requires2FA: tenantRequiresTwoFactor || oauthSessionNeedsTwoFactor,
                 twoFactorComplete: userHasCompletedTenantTwoFactorRequirements,
                 accessTokenExpired: true,
                 reason: 'Token expired',
                 // RBAC fields
                 roles: session?.roles || [],
-                clientId: session?.idpClientId || process.env.IDP_CLIENT_ID || '',
+                clientId: resolveClientId(session?.idpClientId),
             });
         }
         return server_1.NextResponse.json({
@@ -269,13 +380,13 @@ async function GET(req) {
             tenantAllowed2FAMethods,
             nextStep,
             // Legacy names for backwards compatibility
-            requires2FA: tenantRequiresTwoFactor,
+            requires2FA: tenantRequiresTwoFactor || oauthSessionNeedsTwoFactor,
             twoFactorComplete: userHasCompletedTenantTwoFactorRequirements,
             accessTokenExpired: false,
             expiresAt: new Date(expiryTime * 1000).toISOString(),
             // RBAC fields
             roles: session?.roles || [],
-            clientId: session?.idpClientId || process.env.IDP_CLIENT_ID || '',
+            clientId: resolveClientId(session?.idpClientId),
         });
     }
     catch (error) {

package/dist/server/auth-guard.js

@@ -70,29 +70,36 @@ async function authGuard(options) {
         (0, navigation_1.redirect)(`${loginUrl}?callbackUrl=${callbackUrl}&reason=invalidated`);
     }
     // --- 2FA check ---
+    // This try wraps ONLY the config fetch, because that is the only thing here
+    // that can genuinely fail. Do NOT widen it to cover the redirect below:
+    // next/navigation's redirect() signals by THROWING a NEXT_REDIRECT digest, so
+    // a redirect inside this try is caught by the catch and rewritten into a
+    // service-unavailable page - denying a 2FA user the one page that would let
+    // them satisfy the challenge, and reporting it as an outage. See card 312242.
+    let requires2FA;
     try {
         const config = await (0, idp_client_config_1.getIDPClientConfig)();
-        const requires2FA = config.authSettings?.require2FA ?? true;
-        if (requires2FA) {
-            const mfaVerified = sessionData.mfaVerified ?? sessionData.twoFactorComplete ?? false;
-            const mfaExpiresAt = sessionData.mfaExpiresAt || 0;
-            const mfaExpired = mfaExpiresAt > 0 && mfaExpiresAt < Date.now();
-            if (!mfaVerified || mfaExpired) {
-                console.log('[AUTH-GUARD] 2FA required', {
-                    mfaVerified,
-                    mfaExpired,
-                    userId: sessionData.userId,
-                    pathname,
-                });
-                (0, navigation_1.redirect)(`${verifyCodeUrl}?callbackUrl=${callbackUrl}`);
-            }
-        }
+        requires2FA = config.authSettings?.require2FA ?? true;
     }
     catch (error) {
         // If we can't check 2FA config, fail closed
         console.error('[AUTH-GUARD] 2FA config check failed:', error instanceof Error ? error.message : String(error));
         (0, navigation_1.redirect)(serviceUnavailableUrl);
     }
+    if (requires2FA) {
+        const mfaVerified = sessionData.mfaVerified ?? sessionData.twoFactorComplete ?? false;
+        const mfaExpiresAt = sessionData.mfaExpiresAt || 0;
+        const mfaExpired = mfaExpiresAt > 0 && mfaExpiresAt < Date.now();
+        if (!mfaVerified || mfaExpired) {
+            console.log('[AUTH-GUARD] 2FA required', {
+                mfaVerified,
+                mfaExpired,
+                userId: sessionData.userId,
+                pathname,
+            });
+            (0, navigation_1.redirect)(`${verifyCodeUrl}?callbackUrl=${callbackUrl}`);
+        }
+    }
     // --- Custom checks (beta, admin, etc.) ---
     if (options?.checks) {
         for (const check of options.checks) {

package/dist/server/auth.d.ts

@@ -12,12 +12,18 @@ export type IdpTokenResult = {
     sessionData: SessionData;
 } | {
     success: false;
-    error: 'NO_SESSION' | 'NO_TOKEN';
+    error: 'NO_SESSION';
     terminal: true;
+} | {
+    success: false;
+    error: 'NO_TOKEN';
+    terminal: true;
+} | {
+    success: false;
+    error: 'NO_TOKEN_PENDING_2FA';
+    terminal: false;
+    sessionData: SessionData;
 };
-/**
- * Get the initialized Better Auth instance (singleton).
- */
 export declare function getAuthInstance(): Promise<import("better-auth/types").Auth<{
     baseURL: string;
     secret: string;
@@ -150,6 +156,166 @@ export declare function getAuthInstance(): Promise<import("better-auth/types").A
             max: number;
         }[];
         options: import("better-auth/plugins/magic-link").MagicLinkOptions;
+    } | {
+        id: "generic-oauth";
+        init: (ctx: import("@better-auth/core").AuthContext) => {
+            context: {
+                socialProviders: import("better-auth/*").OAuthProvider<Record<string, any>, Partial<import("better-auth/*").ProviderOptions<any>>>[];
+            };
+        };
+        endpoints: {
+            signInWithOAuth2: import("better-call").StrictEndpoint<"/sign-in/oauth2", {
+                method: "POST";
+                body: import("zod").ZodObject<{
+                    providerId: import("zod").ZodString;
+                    callbackURL: import("zod").ZodOptional<import("zod").ZodString>;
+                    errorCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
+                    newUserCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
+                    disableRedirect: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                    scopes: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                    requestSignUp: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                    additionalData: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
+                }, import("better-auth/*").$strip>;
+                metadata: {
+                    openapi: {
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                url: {
+                                                    type: string;
+                                                };
+                                                redirect: {
+                                                    type: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                url: string;
+                redirect: boolean;
+            }>;
+            oAuth2Callback: import("better-call").StrictEndpoint<"/oauth2/callback/:providerId", {
+                method: "GET";
+                query: import("zod").ZodObject<{
+                    code: import("zod").ZodOptional<import("zod").ZodString>;
+                    error: import("zod").ZodOptional<import("zod").ZodString>;
+                    error_description: import("zod").ZodOptional<import("zod").ZodString>;
+                    state: import("zod").ZodOptional<import("zod").ZodString>;
+                    iss: import("zod").ZodOptional<import("zod").ZodString>;
+                }, import("better-auth/*").$strip>;
+                metadata: {
+                    allowedMediaTypes: string[];
+                    openapi: {
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                url: {
+                                                    type: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                    scope: "server";
+                };
+            }, void>;
+            oAuth2LinkAccount: import("better-call").StrictEndpoint<"/oauth2/link", {
+                method: "POST";
+                body: import("zod").ZodObject<{
+                    providerId: import("zod").ZodString;
+                    callbackURL: import("zod").ZodString;
+                    scopes: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                    errorCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
+                }, import("better-auth/*").$strip>;
+                use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+                    session: {
+                        session: Record<string, any> & {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        };
+                        user: Record<string, any> & {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            email: string;
+                            emailVerified: boolean;
+                            name: string;
+                            image?: string | null | undefined;
+                        };
+                    };
+                }>)[];
+                metadata: {
+                    openapi: {
+                        description: string;
+                        responses: {
+                            "200": {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                url: {
+                                                    type: string;
+                                                    format: string;
+                                                    description: string;
+                                                };
+                                                redirect: {
+                                                    type: string;
+                                                    description: string;
+                                                    enum: boolean[];
+                                                };
+                                            };
+                                            required: string[];
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                url: string;
+                redirect: boolean;
+            }>;
+        };
+        options: import("better-auth/plugins/generic-oauth").GenericOAuthOptions;
+        $ERROR_CODES: {
+            INVALID_OAUTH_CONFIGURATION: import("better-auth/*").RawError<"INVALID_OAUTH_CONFIGURATION">;
+            TOKEN_URL_NOT_FOUND: import("better-auth/*").RawError<"TOKEN_URL_NOT_FOUND">;
+            PROVIDER_CONFIG_NOT_FOUND: import("better-auth/*").RawError<"PROVIDER_CONFIG_NOT_FOUND">;
+            PROVIDER_ID_REQUIRED: import("better-auth/*").RawError<"PROVIDER_ID_REQUIRED">;
+            INVALID_OAUTH_CONFIG: import("better-auth/*").RawError<"INVALID_OAUTH_CONFIG">;
+            SESSION_REQUIRED: import("better-auth/*").RawError<"SESSION_REQUIRED">;
+            ISSUER_MISMATCH: import("better-auth/*").RawError<"ISSUER_MISMATCH">;
+            ISSUER_MISSING: import("better-auth/*").RawError<"ISSUER_MISSING">;
+        };
     })[]];
 }>>;
 /**

package/dist/server/auth.js

@@ -49,9 +49,9 @@ require("server-only");
 const better_auth_1 = require("../auth/better-auth");
 const idp_client_config_1 = require("../lib/idp-client-config");
 const session_store_1 = require("../lib/session-store");
-const app_slug_1 = require("../lib/app-slug");
+const session_cookie_shape_1 = require("../lib/session-cookie-shape");
+const single_flight_1 = require("../lib/single-flight");
 let authInstance = null;
-let authInitPromise = null;
 function buildSessionDataFromAuthSession(session) {
     const user = session?.user;
     if (!user?.id && !user?.email) {
@@ -105,82 +105,41 @@ function attachSessionData(session, sessionData, sessionToken) {
 }
 /**
  * Get the initialized Better Auth instance (singleton).
+ *
+ * 244549: the single-flight memoisation lives in lib/single-flight.ts rather
+ * than inline here, and that placement is deliberate rather than tidiness.
+ * The bug being fixed -- a REJECTED init promise cached for the life of the
+ * process, so recovery was restart-only -- went unnoticed precisely because
+ * this module cannot be loaded in a unit test: importing it pulls in
+ * better-auth and the whole IDP config stack. Extracted into a zero-import
+ * module, the retry semantics are covered by
+ * test/single-flight-retry.test.cjs, which imports dist/ and therefore
+ * exercises the artefact that actually ships.
+ *
+ * Semantics, all asserted by that suite: concurrent callers share ONE
+ * underlying init; a rejection reaches every caller awaiting that attempt
+ * (failures stay loud -- getIDPClientConfig is fail-loud by design and callers
+ * depend on it); the NEXT call after a failure starts a fresh attempt; and a
+ * slow failure never evicts a newer in-flight attempt.
  */
+const authInit = (0, single_flight_1.createSingleFlight)(async () => {
+    const config = await (0, idp_client_config_1.getIDPClientConfig)(true);
+    authInstance = (0, better_auth_1.createBetterAuthInstance)(config);
+    // 185121 line 1, path 2: this module-scope instance had NO creation log
+    // line — first-called during a config transition window it pinned a
+    // divergent secret INVISIBLY. Name the path and the secret fingerprint
+    // (the createBetterAuthInstance line already logged the same hash;
+    // this line is what attributes it to THIS init path).
+    // Guard matches createBetterAuthInstance's: getIDPClientConfig currently
+    // throws FATAL on a missing authSecret (QAPert 27328 verified), but that
+    // guarantee is one refactor away — log ABSENT rather than ever throw here.
+    console.log(`[AUTH] getAuthInstance: created BA instance via server/auth.ts — authSecret ${config.authSecret ? `sha256:${(0, better_auth_1.secretFingerprint)(config.authSecret)}` : 'ABSENT'}`);
+    return authInstance;
+});
 async function getAuthInstance() {
     if (authInstance)
         return authInstance;
-    if (!authInitPromise) {
-        authInitPromise = (0, idp_client_config_1.getIDPClientConfig)(true).then(config => {
-            authInstance = (0, better_auth_1.createBetterAuthInstance)(config);
-            return authInstance;
-        });
-    }
-    return authInitPromise;
-}
-/**
- * JWT body-decode helper — base64-decode only, NO signature verification.
- * Safe because the value is then used as a Redis lookup key: Redis is the
- * liveness gate, so an attacker forging a JWT body with a guessed
- * sessionToken claim still has to land on a real Redis session (infeasible
- * against high-entropy UUIDs). Used by the canonical-fallback path in
- * `getSession` to extract the session token when Better Auth's primary
- * path returns null (cookie cache miss / secondary storage eviction).
- */
-function decodeJwtBody(jwt) {
-    try {
-        const parts = jwt.split('.');
-        if (parts.length !== 3)
-            return null;
-        const decoded = Buffer.from(parts[1], 'base64').toString('utf-8');
-        return JSON.parse(decoded);
-    }
-    catch {
-        return null;
-    }
-}
-/** Extract the session-token claim from the Better Auth session cookie
- *  WITHOUT going through Better Auth's `auth.api.getSession()`. Handles
- *  both single-cookie and chunked-cookie cases (Better Auth chunks long
- *  JWTs across `{name}.0`, `{name}.1`, …). Returns the raw `sessionToken`
- *  claim suitable for use as a Redis key. Returns null if no cookie is
- *  present or the JWT can't be parsed. */
-function extractSessionTokenFromCookie(request) {
-    const cookieHeader = request.headers.get('cookie');
-    if (!cookieHeader)
-        return null;
-    const cookieName = (0, app_slug_1.getSessionCookieName)();
-    let rawJwt = null;
-    // Direct cookie first.
-    const chunks = [];
-    for (const part of cookieHeader.split(';')) {
-        const trimmed = part.trim();
-        const eq = trimmed.indexOf('=');
-        if (eq === -1)
-            continue;
-        const k = trimmed.slice(0, eq);
-        const v = trimmed.slice(eq + 1);
-        if (k === cookieName) {
-            rawJwt = decodeURIComponent(v);
-            break;
-        }
-        if (k.startsWith(`${cookieName}.`)) {
-            const idx = parseInt(k.split('.').pop() || '0', 10);
-            if (Number.isFinite(idx))
-                chunks.push({ idx, value: decodeURIComponent(v) });
-        }
-    }
-    // Chunked cookies fallback (Better Auth splits long JWTs across .0/.1/.2 …).
-    if (!rawJwt && chunks.length > 0) {
-        chunks.sort((a, b) => a.idx - b.idx);
-        rawJwt = chunks.map(c => c.value).join('');
-    }
-    if (!rawJwt)
-        return null;
-    const decoded = decodeJwtBody(rawJwt);
-    if (decoded && typeof decoded === 'object' && typeof decoded.sessionToken === 'string') {
-        return decoded.sessionToken;
-    }
-    return null;
+    return authInit.get();
 }
 /**
  * Get the current session from a request.
@@ -232,7 +191,7 @@ async function getSession(request) {
     // in-memory cookie cache returned stale-null. No JWT signature check —
     // Redis lookup is the validation: an attacker forging a session-token
     // claim hits NO_SESSION because Redis has no matching entry.
-    const sessionToken = extractSessionTokenFromCookie(request);
+    const sessionToken = (0, session_cookie_shape_1.extractSessionTokenFromCookie)(request);
     if (!sessionToken)
         return null;
     let sessionData = null;
@@ -292,6 +251,14 @@ async function getIdpToken(request) {
     }
     const accessToken = sessionData.idpAccessToken || sessionData.accessToken;
     if (!accessToken) {
+        // Card 187871: a live Better Auth session with no idpAccessToken and
+        // mfaVerified !== true is a user mid-2FA, not a dead session - the IDP
+        // withholds the full token until 2FA completes (idp-fetch.ts:81/113).
+        // Only treat this as terminal once the session itself claims 2FA is
+        // already done; a token missing AFTER that is genuinely broken.
+        if (sessionData.mfaVerified !== true) {
+            return { success: false, error: 'NO_TOKEN_PENDING_2FA', terminal: false, sessionData };
+        }
         return { success: false, error: 'NO_TOKEN', terminal: true };
     }
     return {