@payez/next-mvp 4.1.21 → 4.4.0

package/dist/server/decode-session.js

@@ -47,6 +47,7 @@ const session_store_1 = require("../lib/session-store");
 const idp_client_config_1 = require("../lib/idp-client-config");
 const app_slug_1 = require("../lib/app-slug");
 const startup_init_1 = require("../lib/startup-init");
+const session_cookie_shape_1 = require("../lib/session-cookie-shape");
 /**
  * Try Better Auth's server-side session API.
  * Returns a DecodedSession if Better Auth has an active session, null otherwise.
@@ -126,6 +127,43 @@ async function tryBetterAuthSession(requestCookies) {
             }
         }
         catch { /* Redis unavailable */ }
+        // LEG-1 FAIL-CLOSED ON UNUSABLE ROLES (card 340015, BAPert R412, 2026-09-03).
+        //
+        // `idpTokens.roles` is the ONLY source of roles for every role-gated route
+        // (see :109 below). When it is empty this leg used to return a perfectly
+        // valid-LOOKING session carrying `roles: []` — so the caller was
+        // authenticated but authorised for nothing. Every admin screen 403s and
+        // renders its chrome with no data and NO ERROR TEXT: it does not look
+        // broken, it looks empty.
+        //
+        // Three independent causes produce that state, so the test is on the
+        // CONDITION THAT ACTUALLY HARMS — "no usable roles" — rather than on any
+        // one route to it. A fourth cause is then covered for free:
+        //   A  MINT        the password / admin-login lane never writes the block
+        //                  (it never calls storeIdpTokensInSession), so it is
+        //                  absent from birth.
+        //   B  CLOBBER     better-auth's own 24h session refresh rebuilds the
+        //                  `ba:` record as `{session, user}` and drops the
+        //                  `idpTokens` SIBLING structurally, not conditionally
+        //                  (better-auth internal-adapter.mjs:287). This hits the
+        //                  OAuth and passkey lanes too — they are safe for 24
+        //                  hours and then stop being safe.
+        //   C  DERIVATION  the block is PRESENT and fully populated with only
+        //                  `roles` empty (card 339748). `!idpTokens` is FALSE
+        //                  here and cannot see it — which is exactly why the
+        //                  predicate is `!idpTokens?.roles?.length` and not an
+        //                  absence check.
+        //
+        // Declining here hands the request to the legacy `{slug}:sess:` leg below,
+        // which carries the same roles. *** IF THAT RECORD IS ALSO ABSENT THE USER
+        // IS SIGNED OUT. THAT IS DELIBERATE AND ACCEPTED, NOT A REGRESSION *** —
+        // an honest, visible sign-out in place of a silently half-authorised
+        // session. Read the commit message before treating a sign-out here as a
+        // bug introduced by this fix.
+        if (!idpTokens?.roles?.length) {
+            console.warn('[DECODE-SESSION] Leg 1 declining: idpTokens unusable (no roles) for session', result.session.token.substring(0, 10), '— falling through to the sess: leg');
+            return null;
+        }
         // Map Better Auth session + IDP tokens to SessionData
         const sessionData = {
             userId: idpTokens?.userId || result.user.id || '',
@@ -137,6 +175,9 @@ async function tryBetterAuthSession(requestCookies) {
             idpAccessTokenExpires: idpTokens?.idpAccessTokenExpires
                 || (result.session.expiresAt ? new Date(result.session.expiresAt).getTime() : Date.now() + 24 * 60 * 60 * 1000),
             mfaVerified: idpTokens?.mfaVerified ?? false,
+            // R807 (362550): fail-closed collapse above stays; this preserves the bit it
+            // destroys. Explicit `false` counts as a signal - hence `!== undefined`.
+            mfaSignalPresent: idpTokens?.mfaVerified !== undefined,
             /**
              * ⚠ WAS HARDCODED `'google'` — third site of QAPert finding #3 (card
              * 167892), found by sweeping rather than by report.
@@ -207,23 +248,56 @@ async function decodeSession(requestCookies) {
             console.error('[DECODE-SESSION] No authSecret available from IDP config');
             return null;
         }
-        const secretKey = new TextEncoder().encode(secret);
+        // BA-SHAPE-AWARE FALLBACK LEG (183047, 2026-08-08).
+        //
+        // Better Auth mints session cookies as `{token}.{base64(hmac)}` — TWO
+        // segments, one dot. jose's `jwtVerify()` below requires a genuine
+        // compact JWS — THREE segments — and throws "Invalid Compact JWS" on a
+        // BA-shaped cookie unconditionally, before it ever looks at the secret.
+        // Since Better Auth is the only minter in production, that meant this
+        // fallback could never succeed for the cookies it actually receives: any
+        // single Better-Auth-primary miss (secondary-storage eviction, disabled
+        // cookie cache, in-flight secret divergence) read as total session
+        // death, because the ONLY fallback was structurally blind to the only
+        // shape it would ever be handed.
+        //
+        // Check the shape FIRST. A BA-hmac cookie skips jose entirely and goes
+        // straight to the Redis-canonical liveness check below — same posture
+        // as the JWS path always had (no signature re-check here either; Redis
+        // presence is the authority). A JWS-shaped cookie (legacy NextAuth-era,
+        // if any still linger) keeps the original jwtVerify path unchanged.
+        const shaped = (0, session_cookie_shape_1.extractSessionTokenFromCookieValue)(cookieValue);
+        let sessionToken;
         let payload;
-        try {
-            const result = await (0, jose_1.jwtVerify)(cookieValue, secretKey);
-            payload = result.payload;
+        if (shaped?.shape === 'ba-hmac') {
+            sessionToken = shaped.token;
         }
-        catch (jwtError) {
-            console.warn('[DECODE-SESSION] JWT verification failed:', jwtError instanceof Error ? jwtError.message : String(jwtError));
-            return null;
+        else {
+            const secretKey = new TextEncoder().encode(secret);
+            try {
+                const result = await (0, jose_1.jwtVerify)(cookieValue, secretKey);
+                payload = result.payload;
+            }
+            catch (jwtError) {
+                console.warn('[DECODE-SESSION] JWT verification failed:', jwtError instanceof Error ? jwtError.message : String(jwtError));
+                return null;
+            }
+            sessionToken = payload.sessionToken || payload.redisSessionId;
         }
-        const sessionToken = payload.sessionToken || payload.redisSessionId;
         if (!sessionToken) {
-            console.warn('[DECODE-SESSION] JWT payload missing sessionToken/redisSessionId');
+            console.warn('[DECODE-SESSION] No sessionToken resolved from cookie (shape:', shaped?.shape ?? 'unrecognized', ')');
             return null;
         }
         const sessionData = await (0, session_store_1.getSession)(sessionToken);
         if (!sessionData) {
+            // The OTHER half of R412(ii). There are two ways decodeSession returns
+            // null and they mean different things, so they must not both be silent:
+            // Leg 1 declining is routine and recoverable (this leg normally holds
+            // the roles), whereas reaching HERE means there is no fallback record
+            // either and the caller is about to be signed out. Different meanings,
+            // different remediations — do not ship a second silent path while
+            // fixing a silent path.
+            console.warn('[DECODE-SESSION] No sess: record for token', sessionToken.substring(0, 10), '— no fallback available, session will be signed out');
             return null;
         }
         // Backwards compat: session.user.email works alongside session.email
@@ -237,7 +311,7 @@ async function decodeSession(requestCookies) {
         }
         return {
             sessionData,
-            jwtPayload: payload,
+            jwtPayload: (payload ?? { sessionToken }),
         };
     }
     catch (error) {

package/dist/types/auth.d.ts

@@ -2,7 +2,25 @@ import { JwtPayload } from 'jwt-decode';
 export type AuthMode = 'traditional' | 'federated';
 export type FederatedProvider = 'google' | 'microsoft' | 'facebook' | 'github' | 'apple';
 export interface AuthConfig {
+    /**
+     * @deprecated Superseded by allowFederatedLogin / allowTraditionalLogin.
+     * A single mode made the two mutually exclusive, so a site could only ever show ONE of
+     * OAuth or username/password - and because sites set it themselves, a client's sign-in
+     * screen could contradict what its own IDP offered. Kept so existing callers compile.
+     */
     mode: AuthMode;
+    /**
+     * Whether federated (OAuth) sign-in is offered. Defaults to what the IDP reports at
+     * /api/auth/settings; a site may override. Both this and allowTraditionalLogin can be
+     * true at once - that is the normal case.
+     */
+    allowFederatedLogin?: boolean;
+    /**
+     * Whether username/password sign-in is offered. DEFAULTS ON. The IDP does not carry an
+     * explicit flag for it yet; until it does, it is available unless a site opts out.
+     * An OAuth-only client is a deliberate choice, never the default.
+     */
+    allowTraditionalLogin?: boolean;
     providers: FederatedProvider[];
     enableRecovery: boolean;
     enableEmailSignup: boolean;