@payez/next-mvp 4.1.20 → 4.4.0

package/src/auth/utils/idp-client.ts

@@ -38,7 +38,7 @@ export function getIdpUrl(): string {
  * Get client ID for this application.
  */
 export function getClientId(): string {
-  const clientId = process.env.CLIENT_ID || process.env.NEXT_PUBLIC_CLIENT_ID;
+  const clientId = process.env.CLIENT_ID;
   if (!clientId) {
     throw new Error('[IDP_CLIENT] FATAL: CLIENT_ID environment variable is REQUIRED');
   }

package/src/client/AuthContext.tsx

@@ -42,6 +42,12 @@ export function AuthProvider({ children, config, useDynamicProviders = true }: A
   const [dynamicProviders, setDynamicProviders] = useState<FederatedProvider[]>([]);
   const [providersLoaded, setProvidersLoaded] = useState(!useDynamicProviders);
 
+  // What the IDP says this client offers. null until /api/auth/settings answers.
+  const [serverSettings, setServerSettings] = useState<{
+    allowFederatedLogin: boolean;
+    allowTraditionalLogin: boolean;
+  } | null>(null);
+
   // Create QueryClient instance for React Query - used internally by MVP hooks
   const [queryClient] = useState(() => new QueryClient({
     defaultOptions: {
@@ -61,32 +67,53 @@ export function AuthProvider({ children, config, useDynamicProviders = true }: A
 
     async function fetchDynamicProviders() {
       try {
-        // Better Auth doesn't have a getProviders equivalent.
-        // Use static provider map based on configured social providers.
-        const result: Record<string, { id: string; name: string }> | null = {
-          google: { id: 'google', name: 'Google' },
-        };
+        // READ THE IDP. This used to be a hardcoded literal:
+        //     const result = { google: { id: 'google', name: 'Google' } };
+        // sitting under a comment saying providers were loaded dynamically. It returned
+        // Google for every client regardless of what the tenant actually had enabled -
+        // a config-shaped constant, which is the one thing configuration must never be.
+        //
+        // /api/auth/settings already serves the real answer (enabledProviders,
+        // allowFederatedLogin, enablePasswordReset) and nothing consumed it.
+        const response = await fetch('/api/auth/settings');
+        if (!response.ok) {
+          // No silent substitution. Absent settings means we do not know what this
+          // client offers, and inventing a provider list is how a tenant ends up with a
+          // sign-in button their IDP will refuse.
+          console.error('[AuthProvider] /api/auth/settings returned ' + response.status +
+            ' - provider list unknown. Mount ./routes/auth/settings.');
+          return;
+        }
 
+        const body = await response.json();
+        const settings = body?.data ?? body;
         if (!mounted) return;
 
-        if (result) {
-          // Filter to OAuth providers only and map to FederatedProvider type
-          const oauthProviders = Object.keys(result)
-            .filter(id => OAUTH_PROVIDER_IDS.includes(id))
-            .map(id => PROVIDER_MAP[id])
-            .filter((p): p is FederatedProvider => p !== undefined);
-
-          setDynamicProviders(oauthProviders);
-        }
+        const ids: string[] = Array.isArray(settings?.enabledProviders)
+          ? settings.enabledProviders
+          : [];
+
+        const oauthProviders = ids
+          .filter(id => OAUTH_PROVIDER_IDS.includes(id))
+          .map(id => PROVIDER_MAP[id])
+          .filter((p): p is FederatedProvider => p !== undefined);
+
+        setDynamicProviders(oauthProviders);
+        setServerSettings({
+          allowFederatedLogin: settings?.allowFederatedLogin !== false,
+          // TRADITIONAL DEFAULTS ON. The IDP does not carry an explicit flag for it yet;
+          // until it does, username/password is available unless a site opts out. An
+          // OAuth-only client is a deliberate choice, not the default.
+          allowTraditionalLogin: settings?.allowTraditionalLogin !== false,
+        });
       } catch (err) {
-        // Fall back to static config providers on error
+        console.error('[AuthProvider] could not read /api/auth/settings:', err);
       } finally {
         if (mounted) {
           setProvidersLoaded(true);
         }
       }
     }
-
     fetchDynamicProviders();
 
     return () => {
@@ -102,7 +129,12 @@ export function AuthProvider({ children, config, useDynamicProviders = true }: A
   const authConfig: AuthConfig = {
     ...defaultConfig,
     ...config,
-    providers, // Override with dynamic providers if enabled
+    providers, // from the IDP when useDynamicProviders is on
+    // THE SERVER DECIDES, THE SITE MAY OVERRIDE. A site that passes an explicit value
+    // still wins; absent that, what the tenant's IDP reports is what renders. A client
+    // hardcoding its own auth mode is how a sign-in screen and its IDP disagree.
+    allowFederatedLogin: config?.allowFederatedLogin ?? serverSettings?.allowFederatedLogin ?? true,
+    allowTraditionalLogin: config?.allowTraditionalLogin ?? serverSettings?.allowTraditionalLogin ?? true,
   };
 
   return (
@@ -134,10 +166,14 @@ export function useFederatedProviders(): FederatedProvider[] {
 
 export function useFederatedAuthEnabled(): boolean {
   const config = useAuthConfig();
-  return config.mode === 'federated' && config.providers.length > 0;
+  // Was `config.mode === 'federated'`, which made the two mutually exclusive and let a
+  // site's hardcoded mode silently hide what the IDP offers.
+  return config.allowFederatedLogin !== false && config.providers.length > 0;
 }
 
 export function useTraditionalAuthEnabled(): boolean {
   const config = useAuthConfig();
-  return config.mode === 'traditional';
+  // Was `config.mode === 'traditional'`. Both can be on at once - that is the normal
+  // case, and OAuth-only is the exception a client opts into.
+  return config.allowTraditionalLogin !== false;
 }

package/src/components/account/UserAvatarMenu.tsx

@@ -104,6 +104,17 @@ export function UserAvatarMenu({
     } else {
       // Use NEXT_PUBLIC env var or default to root
       const logoutUrl = process.env.NEXT_PUBLIC_LOGOUT_REDIRECT_URL || '/';
+      // 272068: revoke server-side BEFORE the better-auth client sign-out clears
+      // the cookie jar. authClient.signOut() ALONE leaves the server-side sess
+      // record alive - a copied pre-signout cookie still authenticates. The
+      // logout route (routes/auth/logout) runs deleteSessionEverywhere and
+      // clears the __Secure- twin; it must still see the cookie, so it goes
+      // first. Best-effort: a failed revoke must not trap the user on the page.
+      try {
+        await fetch('/api/auth/logout', { method: 'POST', credentials: 'include' });
+      } catch {
+        // sign-out continues regardless
+      }
       await authClient.signOut();
       window.location.href = logoutUrl;
     }

package/src/components/auth/ModeAwareLoginPage.tsx

@@ -42,8 +42,12 @@ export function ModeAwareLoginPage({
     }
   };
 
-  const isFederated = config.mode === 'federated';
-  const isTraditional = config.mode === 'traditional';
+  // READ THE FLAGS, NOT `mode`. A single mode made these mutually exclusive, so a site
+  // could only ever show ONE of OAuth or username/password. Both are normal together;
+  // OAuth-only is the exception a client opts into. Source is the IDP
+  // (/api/auth/settings) unless the site deliberately overrides.
+  const isFederated = config.allowFederatedLogin !== false && config.providers.length > 0;
+  const isTraditional = config.allowTraditionalLogin !== false;
   const totalLoading = isLoading || localLoading;
 
   return (
@@ -60,7 +64,7 @@ export function ModeAwareLoginPage({
         </div>
       )}
 
-      {/* Federated Only Mode */}
+      {/* Federated. Renders alongside the form below when the client offers both. */}
       {isFederated && (
         <FederatedAuthSection
           providers={config.providers}
@@ -69,7 +73,20 @@ export function ModeAwareLoginPage({
         />
       )}
 
-      {/* Traditional Only Mode */}
+      {/* Separator, only when BOTH are offered. Previously the two sections rendered
+          flush against each other because a single `mode` meant only one could ever
+          appear — nothing needed to sit between them. */}
+      {isFederated && isTraditional && (
+        <div className="flex items-center gap-3 my-6" aria-hidden="true">
+          <span className="h-px flex-1" style={{ background: 'var(--border-default, #e5e7eb)' }} />
+          <span className="text-xs uppercase tracking-wide" style={{ color: 'var(--text-muted, #6b7280)' }}>
+            or
+          </span>
+          <span className="h-px flex-1" style={{ background: 'var(--border-default, #e5e7eb)' }} />
+        </div>
+      )}
+
+      {/* Username / password. */}
       {isTraditional && (
         <TraditionalAuthSection
           email={email}
@@ -84,51 +101,25 @@ export function ModeAwareLoginPage({
         />
       )}
 
-      {/* Hybrid Mode - Show both */}
-      {isFederated === false && isTraditional === false && (
-        <>
-          <FederatedAuthSection
-            providers={config.providers}
-            onProviderClick={handleFederatedClick}
-            isLoading={totalLoading}
-          />
-
-          {config.providers.length > 0 && (
-            <div className="relative my-6">
-              <div className="absolute inset-0 flex items-center">
-                <div
-                  className="w-full"
-                  style={{
-                    borderTop: '1px solid var(--border-default)',
-                  }}
-                ></div>
-              </div>
-              <div className="relative flex justify-center text-sm">
-                <span
-                  className="px-2"
-                  style={{
-                    background: 'var(--bg-card)',
-                    color: 'var(--text-secondary)',
-                  }}
-                >
-                  Or sign in with email
-                </span>
-              </div>
-            </div>
-          )}
-
-          <TraditionalAuthSection
-            email={email}
-            password={password}
-            onEmailChange={setEmail}
-            onPasswordChange={setPassword}
-            onSubmit={handleTraditionalSubmit}
-            isLoading={totalLoading}
-            buttonText="Sign In"
-            showForgotPassword={config.enableRecovery}
-            onForgotPassword={onForgotPassword}
-          />
-        </>
+      {/* NEITHER is offered. This branch used to be labelled "Hybrid Mode - Show both"
+          and rendered BOTH sections on the same condition - so a client configured with
+          no sign-in method at all got the full form. Say so instead: a blank card leaves
+          the user pressing nothing, and the operator with no idea what is wrong. */}
+      {!isFederated && !isTraditional && (
+        <div
+          role="alert"
+          className="px-4 py-3 rounded-lg text-sm text-left"
+          style={{
+            border: '1px solid var(--border-default, #e5e7eb)',
+            color: 'var(--text-primary, #111827)',
+          }}
+        >
+          <p className="font-semibold">Sign-in is not available for this application.</p>
+          <p className="mt-1">
+            No sign-in method is enabled for this client. An administrator needs to enable
+            a federated provider or username and password sign-in.
+          </p>
+        </div>
       )}
     </>
   );

package/src/components/auth/ModeAwareSignupPage.tsx

@@ -46,8 +46,11 @@ export function ModeAwareSignupPage({
     }
   };
 
-  const isFederated = config.mode === 'federated';
-  const isTraditional = config.mode === 'traditional';
+  // Same change as ModeAwareLoginPage: read the independent flags, not the single mode.
+  // Leaving signup on `mode` would have made sign-in and sign-up disagree about what the
+  // client offers - the worse half of a half-migration.
+  const isFederated = config.allowFederatedLogin !== false && config.providers.length > 0;
+  const isTraditional = config.allowTraditionalLogin !== false;
   const totalLoading = isLoading || localLoading;
 
   return (

package/src/components/auth/TraditionalAuthSection.tsx

@@ -25,8 +25,12 @@ export function TraditionalAuthSection({
   showForgotPassword = true,
   onForgotPassword,
 }: Props) {
+  // text-left is DELIBERATE and load-bearing: a host card with text-align:center made the
+  // Email label render CENTRED while Password stayed left, because Password sits in a flex
+  // row (for the forgot link) that ignores inherited alignment and Email did not. A shared
+  // component must not inherit its alignment from whatever wraps it.
   return (
-    <form onSubmit={onSubmit} className="space-y-4">
+    <form onSubmit={onSubmit} className="space-y-4 text-left">
       {/* Email */}
       <div>
         <label className="block text-sm font-medium mb-2" style={{ color: 'var(--text-primary)' }}>

package/src/hooks/useAuthSettings.ts

@@ -57,7 +57,14 @@ export function useAuthSettings(): AuthSettings | null {
  */
 export function useRequires2FA(): boolean {
     const authSettings = useAuthSettings();
-    return authSettings?.require2FA ?? true; // Default to true for security
+    // 257255: DELIBERATELY LEFT FAIL-CLOSED, and flagged rather than silently kept.
+    // QAPert proved any hardcoded fallback is wrong in one environment (same client
+    // is require_2fa TRUE on AKS, FALSE on dev-93), so `?? true` is not correct - it
+    // is merely the SAFE direction: it demands more auth rather than less, and
+    // flipping it to false would be fail-OPEN. The genuinely correct answer is to
+    // propagate "unknown" to the caller, which is a breaking signature change
+    // (boolean -> boolean | null) and needs its own decision. Tracked on 257255.
+    return authSettings?.require2FA ?? true;
 }
 
 /**
@@ -67,7 +74,12 @@ export function useRequires2FA(): boolean {
  */
 export function useAllowed2FAMethods(): string[] {
     const authSettings = useAuthSettings();
-    return authSettings?.allowed2FAMethods ?? ['email', 'sms'];
+    // 257255 / v32(a) OFFER NOTHING YOU CANNOT CONFIRM.
+    // Was `?? ['email','sms']` - a fabricated method list rendered whenever the
+    // policy could not be read. On 2026-08-24 that told users to use email+sms
+    // while the database said emailcode+totp. An empty list is the honest answer;
+    // the caller must show "we could not load sign-in options" rather than guess.
+    return authSettings?.allowed2FAMethods ?? [];
 }
 
 /**

package/src/hooks/usePublicAuthSettings.ts

@@ -12,11 +12,19 @@ import type { FederatedProvider } from '../types/auth';
 
 export interface PublicAuthSettings {
     enabledProviders: FederatedProvider[];
-    allowPublicRegistration: boolean;
     allowFederatedLogin: boolean;
-    enablePasswordReset: boolean;
     require2FA: boolean;
     allowed2FAMethods: string[];
+    // OPTIONAL: present only when the IDP states them, never invented.
+    // 257255 removed these on the basis that "the config document does not
+    // carry them"; the 240447 loader fix has since made the document carry
+    // them, so routes/auth/settings.ts reads and returns them again. They stay
+    // OPTIONAL because an older IDP build may omit them, and `?? true` would
+    // re-create the exact permission claim this card exists to kill.
+    // (The @example below already assumed this field - it referenced
+    // settings?.allowPublicRegistration while the type had removed it.)
+    allowPublicRegistration?: boolean;
+    enablePasswordReset?: boolean;
 }
 
 export interface UsePublicAuthSettingsResult {
@@ -35,14 +43,19 @@ const PROVIDER_MAP: Record<string, FederatedProvider> = {
     'azure-ad': 'microsoft',
 };
 
-const DEFAULT_SETTINGS: PublicAuthSettings = {
-    enabledProviders: [],
-    allowPublicRegistration: true,
-    allowFederatedLogin: false,
-    enablePasswordReset: true,
-    require2FA: true,
-    allowed2FAMethods: ['email', 'sms'],
-};
+// 257255 / BAPert ruling v32(a): DEFAULT_SETTINGS DELETED.
+//
+// It was substituted on BOTH failure branches below, so a page kept rendering
+// require2FA=true with methods ['email','sms'] whenever the fetch failed - a
+// FABRICATED AUTHORIZATION POLICY, client-side. Hard-failing the endpoint alone
+// does not fix that: it just moves the lie from the server to the browser.
+//
+// QAPert's measurement makes this a proof rather than a preference: the SAME
+// client is require_2fa=TRUE on AKS and FALSE on dev-93, so any hardcoded
+// fallback is wrong in at least one environment BY CONSTRUCTION.
+//
+// On failure `settings` stays NULL and `error` is set. Callers must render an
+// honest "we could not load sign-in options" state and OFFER NOTHING.
 
 /**
  * Hook to fetch public auth settings for login/signup pages.
@@ -98,7 +111,12 @@ export function usePublicAuthSettings(): UsePublicAuthSettingsResult {
                         enabledProviders: providers,
                     });
                 } else {
-                    setSettings(DEFAULT_SETTINGS);
+                    // The endpoint told us it could not read a policy (503 +
+                    // success:false + code). Do NOT invent one - surface it.
+                    const code = data?.error?.code ?? 'POLICY_UNAVAILABLE';
+                    setSettings(null);
+                    setError(new Error(`[auth-settings] ${code}: sign-in options unavailable`));
+                    return;
                 }
 
                 setError(null);
@@ -106,7 +124,7 @@ export function usePublicAuthSettings(): UsePublicAuthSettingsResult {
                 if (!mounted) return;
                 console.warn('[usePublicAuthSettings] Failed to fetch settings:', err);
                 setError(err instanceof Error ? err : new Error(String(err)));
-                setSettings(DEFAULT_SETTINGS);
+                setSettings(null);   // 257255: never fabricate a policy
             } finally {
                 if (mounted) {
                     setIsLoading(false);
@@ -136,14 +154,18 @@ export function useFederatedLoginEnabled(): boolean {
  * Hook to check if public registration is enabled.
  */
 export function usePublicRegistrationEnabled(): boolean {
-    const { settings } = usePublicAuthSettings();
-    return settings?.allowPublicRegistration ?? true;
+    // 257255: was `?? true`, which OFFERED a sign-up lane the IDP may forbid -
+    // card 240447 measured exactly that on portal. The field is no longer served
+    // (it was never read from config), so this is now always fail-closed until
+    // the config document carries it.
+    return false;
 }
 
 /**
  * Hook to check if password reset is enabled.
  */
 export function usePasswordResetEnabled(): boolean {
-    const { settings } = usePublicAuthSettings();
-    return settings?.enablePasswordReset ?? true;
+    // 257255: was `?? true` and was never read from config. Fail-closed until
+    // the config document carries it.
+    return false;
 }

package/src/lib/client-key.ts

@@ -0,0 +1,88 @@
+/**
+ * ONE resolver for "which client is this request for?" — card 268410.
+ *
+ * THE ASYMMETRY THIS EXISTS TO SURVIVE (measured at source in the IDP,
+ * RequirePayEzUnAuthorizedAttribute.cs):
+ *
+ *   :31-33  int.TryParse succeeds -> Items[PayEzClientId] = numericId; return;   NO existence check
+ *   :41-47  slug -> GetClientIdByNameAsync; if null -> NotFoundResult()          VALIDATED
+ *   :55     no client id at all -> NotFoundResult()
+ *
+ * So a WRONG SLUG 404s loudly. A WRONG NUMERIC is silently accepted and the
+ * request is answered for whatever client that number happens to be. On a
+ * multi-tenant identity service that is a WRONG-TENANT ANSWER, not merely a bug.
+ *
+ * And a stale numeric is the DOCUMENTED NORMAL CASE, not a hypothetical: numeric
+ * ids are environment-specific (card 250596 — 79 was dev-93's id for the SAME
+ * slug, and the merge collapsed 76 into 12), while the slug is stable across
+ * environments.
+ *
+ * WHY THE FALLBACK WAS SILENT: idp-client-config.ts:462 and :669 resolve
+ * `clientSlug: ... ?? ''`. Empty string is FALSY, so the idiom every call site
+ * used —
+ *
+ *     config.clientSlug || String(config.clientId)
+ *
+ * — falls through to the numeric arm whenever the IDP config carries no slug,
+ * with nothing emitted to say it happened. Absence collapsed into a
+ * usable-looking default: the same class the graft's passkey plugin already
+ * called out when `|| ''` made an unset env var look like a valid client_id.
+ *
+ * WHAT THIS DOES **NOT** DO: it does not flip precedence. Slug still wins, the
+ * numeric fallback is still taken, and every deployment that works today keeps
+ * working byte-for-byte. Blanket-flipping these to numeric-first is the
+ * dangerous-looking-safe change the 268410 ruling explicitly holds.
+ *
+ * WHAT IT DOES: it makes the dangerous arm ATTRIBUTABLE. Taking the numeric
+ * fallback now emits a warning naming the call site, so a wrong-tenant answer
+ * is diagnosable in seconds instead of being indistinguishable from a correct
+ * one. That ambiguity is what cost hours on S12.
+ */
+
+export interface ClientKeySource {
+    clientSlug?: string | null;
+    clientId?: string | number | null;
+}
+
+export interface ResolvedClientKey {
+    /** The routing key to send as X-Client-Id / client_id, or null if none resolved. */
+    key: string | null;
+    /** True when the environment-specific numeric arm was taken. */
+    usedNumericFallback: boolean;
+}
+
+/**
+ * Resolve the IDP routing key from a client config.
+ *
+ * `site` names the caller (e.g. 'admin/analytics') and appears verbatim in the
+ * fallback warning — that string is the whole diagnostic value, so pass a real one.
+ *
+ * Pure and non-throwing: callers decide whether a null key is fatal (refuse) or
+ * merely means "omit the header". Both shapes exist in this package and both
+ * are correct for their path.
+ */
+export function resolveClientKey(
+    config: ClientKeySource | null | undefined,
+    site: string
+): ResolvedClientKey {
+    const slug = typeof config?.clientSlug === 'string' ? config.clientSlug.trim() : '';
+    if (slug) return { key: slug, usedNumericFallback: false };
+
+    const rawNumeric = config?.clientId;
+    // Guard String(undefined) === 'undefined' — a 13-char string that is not a
+    // slug and not a number, so the IDP would 404 it with no hint as to why.
+    if (rawNumeric === null || rawNumeric === undefined) {
+        return { key: null, usedNumericFallback: false };
+    }
+    const numeric = String(rawNumeric).trim();
+    if (!numeric) return { key: null, usedNumericFallback: false };
+
+    console.warn(
+        `[client-key] ${site}: no clientSlug on the resolved IDP config — falling back to the ` +
+        `NUMERIC client id ${numeric}. Numeric ids are ENVIRONMENT-SPECIFIC and the IDP accepts ` +
+        `them with NO existence check, so if this number is stale for this environment the ` +
+        `request is being answered for the WRONG CLIENT, silently. Card 268410.`
+    );
+
+    return { key: numeric, usedNumericFallback: true };
+}

package/src/lib/demo-mode.ts

@@ -12,6 +12,7 @@ export function isAuthConfigured(): boolean {
   return !!(
     process.env.BETTER_AUTH_SECRET ||
     process.env.NEXTAUTH_SECRET ||
-    (process.env.NEXT_CLIENT_ID && process.env.NEXT_CLIENT_PRIVATE_KEY_PEM)
+  // was NEXT_CLIENT_ID - a third name for CLIENT_ID, read only here. Collapsed 2026-08-26.
+    (process.env.CLIENT_ID && process.env.NEXT_CLIENT_PRIVATE_KEY_PEM)
   );
 }

package/src/lib/ensure-fresh-access-token.ts

@@ -95,6 +95,13 @@ export async function ensureFreshAccessToken(
 
   const storedToken = session.idpAccessToken;
   if (!storedToken) {
+    // Card 187871: same conflation as getIdpToken (server/auth.ts) - a live
+    // session with no access token and mfaVerified !== true is a user
+    // mid-2FA, not dead. Only terminal once the session itself claims 2FA
+    // is already done.
+    if (session.mfaVerified !== true) {
+      return { ok: false, code: 'NO_TOKEN_PENDING_2FA', message: 'Two-factor authentication required', status: 401, terminal: false };
+    }
     return { ok: false, code: 'NO_TOKEN', message: 'No IDP access token in session', status: 401, terminal: true };
   }
 
@@ -354,7 +361,11 @@ export async function ensureFreshAccessToken(
       bearerKeyId: newKid || session.bearerKeyId,
       authenticationMethods: amrClaims,
       authenticationLevel: acrLevel,
-      mfaVerified: amrClaims.includes('mfa') || session.mfaVerified,
+      // 170007 rule 2 (BAPert ruling on 121350): re-derive from the token
+      // every exchange, never carry forward. See the identical fix + full
+      // rationale in api-handlers/auth/refresh.ts's sessionUpdate — this is
+      // the same defect duplicated at a second call site.
+      mfaVerified: amrClaims.includes('mfa'),
       mfaCompletedAt: decoded?.mfa_time ? parseInt(decoded.mfa_time) * 1000 : session.mfaCompletedAt,
       mfaExpiresAt: decoded?.mfa_expires ? parseInt(decoded.mfa_expires) * 1000 : session.mfaExpiresAt,
       mfaValidityHours: decoded?.mfa_validity_hours ? parseInt(decoded.mfa_validity_hours) : session.mfaValidityHours,