@payez/next-mvp 4.1.21 → 4.4.0

package/src/models/SessionModel.ts

@@ -77,6 +77,46 @@ export interface SessionData {
   /** Whether MFA has been verified for this session */
   mfaVerified: boolean;
 
+  /**
+   * *** R807 (BAPert, card 362550). DID THE PRODUCER ACTUALLY SAY ANYTHING ABOUT MFA? ***
+   *
+   * `mfaVerified` above is deliberately FAIL-CLOSED: every construction site
+   * collapses an absent value to `false` (`?? false`), so by the time anyone
+   * reads it, "the producer said false" and "the producer said nothing" are
+   * indistinguishable. That collapse is CORRECT and must not be removed - a
+   * security consumer treating absence as "verified" is an AUTH BYPASS.
+   *
+   * But `routes/auth/viability.ts` asks a genuinely different question: "did the
+   * OAuth callback AFFIRMATIVELY set false, or did we simply never know?" It
+   * cannot ask that of a field whose absence has already been collapsed. This
+   * field carries that one bit, so the collapse can stay.
+   *
+   *   true      -> the producer emitted an explicit mfaVerified; `mfaVerified` is a measurement.
+   *   false     -> the producer emitted nothing; `mfaVerified`'s `false` is a DEFAULT, not a signal.
+   *   undefined -> LEGACY SESSION, minted before this field existed. Same meaning as `false`
+   *                for viability (do NOT force a re-challenge), and it is why this is
+   *                optional rather than defaulted: `?? false` here would be the very
+   *                absence-destroying move this field exists to undo.
+   *
+   * *** CONFINED, BY RULING: THIS FIELD MUST NEVER REACH AN AUTH DECISION. ***
+   * It exists to make viability LESS aggressive (suppressing a mass re-challenge of
+   * the pre-existing session population). Letting it influence an auth path would
+   * turn a permissive read into a fail-open, and R807 is void if it does. Gate on
+   * `mfaVerified` for anything that grants access; gate on this only to decide
+   * whether `mfaVerified === false` was a real statement.
+   *
+   * *** DECLARING IT HERE IS LOAD-BEARING FOR MORE THAN DOCUMENTATION. ***
+   * `SessionData` carries `[key: string]: any` (the "backward compatibility"
+   * member at the END of this interface, added for migration back-compat — it
+   * was line 147 before this block was inserted above it, which is the number
+   * quoted in R807/362550; adding these lines moved it down, so find it by name,
+   * not by number). Any field NOT declared explicitly is absorbed by that index
+   * signature and becomes `any` - so an undeclared `mfaSignalPresent` would let a
+   * typo at the consumer compile clean and read `undefined` forever, silently
+   * disabling the viability override. Measured, not assumed: see the card.
+   */
+  mfaSignalPresent?: boolean;
+
   /**
    * The IDP's own routing decision for a 2FA-pending login (cards 141688 /
    * 141741, IDP WO 113023). Wire name is snake — `next_step`.
@@ -175,6 +215,8 @@ export class SessionModel {
 
   // MFA State
   mfaVerified: boolean;
+  /** R807: see SessionData.mfaSignalPresent. Propagated verbatim, never defaulted. */
+  mfaSignalPresent?: boolean;
   mfaMethod?: 'email' | 'sms' | 'totp';
   mfaCompletedAt?: number;
   mfaExpiresAt?: number;
@@ -209,6 +251,10 @@ export class SessionModel {
 
     // MFA State
     this.mfaVerified = data.mfaVerified ?? false;
+    // *** R807: PROPAGATE, DO NOT DEFAULT. *** `?? false` here would destroy the
+    // legacy/never-knew distinction on every path through this class - invisibly,
+    // because callers construct a SessionModel without restating the field.
+    this.mfaSignalPresent = data.mfaSignalPresent;
     this.mfaMethod = data.mfaMethod;
     this.mfaCompletedAt = data.mfaCompletedAt;
     this.mfaExpiresAt = data.mfaExpiresAt;
@@ -266,6 +312,9 @@ export class SessionModel {
       decodedAccessToken: this.decodedAccessToken,
       bearerKeyId: this.bearerKeyId,
       mfaVerified: this.mfaVerified,
+      // R807: must survive the Redis round-trip, or the session is re-read as
+      // `legacy` one hop later and viability silently stops firing.
+      mfaSignalPresent: this.mfaSignalPresent,
       mfaMethod: this.mfaMethod,
       mfaCompletedAt: this.mfaCompletedAt,
       mfaExpiresAt: this.mfaExpiresAt,

package/src/pages/admin-login/page.tsx

@@ -16,9 +16,7 @@
 
 'use client';
 
-import React, { useState } from 'react';
-import { authClient } from '../../client/better-auth-client';
-import { useSearchParams } from 'next/navigation';
+import React from 'react';
 import { Suspense } from 'react';
 import { useBranding, useColors } from '../../theme/useTheme';
 
@@ -36,48 +34,12 @@ interface AdminLoginFormProps {
 function AdminLoginForm({
   title = 'Admin Login',
   subtitle = 'Authorized personnel only',
-  callbackUrl: propCallbackUrl,
   logo,
 }: AdminLoginFormProps) {
-  const searchParams = useSearchParams();
-  const callbackUrl = propCallbackUrl || searchParams?.get('callbackUrl') || '/dashboard';
-
   const branding = useBranding();
   const colors = useColors();
-
-  const [email, setEmail] = useState('');
-  const [password, setPassword] = useState('');
-  const [showPassword, setShowPassword] = useState(false);
-  const [isLoading, setIsLoading] = useState(false);
-  const [error, setError] = useState<string | null>(null);
-
-  const handleSubmit = async (e: React.FormEvent) => {
-    e.preventDefault();
-    setIsLoading(true);
-    setError(null);
-
-    try {
-      const result = await authClient.signIn.email({
-        email,
-        password,
-        callbackURL: callbackUrl,
-      });
-
-      if ((result as any)?.error) {
-        const errorMsg = typeof (result as any).error === 'object'
-          ? ((result as any).error as any).message || 'Invalid credentials'
-          : String((result as any).error);
-        setError(errorMsg);
-      } else if (result?.data) {
-        // Redirect to verify-code for 2FA or directly to callback
-        window.location.href = `/account-auth/verify-code?callbackUrl=${encodeURIComponent(callbackUrl)}`;
-      }
-    } catch (err) {
-      setError('An unexpected error occurred');
-    } finally {
-      setIsLoading(false);
-    }
-  };
+  void branding;
+  void colors;
 
   return (
     <div className="min-h-screen flex items-center justify-center bg-gradient-to-br from-slate-700 via-slate-800 to-slate-900 p-4">
@@ -97,92 +59,20 @@ function AdminLoginForm({
           {subtitle}
         </p>
 
-        {/* Error */}
-        {error && (
-          <div className="mb-6 px-4 py-3 rounded-lg bg-red-500 text-white text-center text-sm">
-            {error}
-          </div>
-        )}
-
-        {/* Login Form */}
-        <form onSubmit={handleSubmit} className="space-y-4">
-          <div>
-            <label
-              htmlFor="admin-email"
-              className="block text-sm font-medium mb-2 text-slate-700"
-            >
-              Email
-            </label>
-            <input
-              id="admin-email"
-              type="email"
-              value={email}
-              onChange={(e) => setEmail(e.target.value)}
-              required
-              disabled={isLoading}
-              autoComplete="email"
-              className="w-full px-4 py-3 rounded-lg border border-slate-300 bg-white text-slate-900 placeholder-slate-400 focus:outline-none focus:ring-2 focus:ring-slate-500 focus:border-transparent disabled:opacity-50 disabled:cursor-not-allowed"
-              placeholder="admin@example.com"
-            />
-          </div>
-
-          <div>
-            <label
-              htmlFor="admin-password"
-              className="block text-sm font-medium mb-2 text-slate-700"
-            >
-              Password
-            </label>
-            <div className="relative">
-              <input
-                id="admin-password"
-                type={showPassword ? 'text' : 'password'}
-                value={password}
-                onChange={(e) => setPassword(e.target.value)}
-                required
-                disabled={isLoading}
-                autoComplete="current-password"
-                className="w-full px-4 py-3 pr-12 rounded-lg border border-slate-300 bg-white text-slate-900 placeholder-slate-400 focus:outline-none focus:ring-2 focus:ring-slate-500 focus:border-transparent disabled:opacity-50 disabled:cursor-not-allowed"
-                placeholder="Enter your password"
-              />
-              <button
-                type="button"
-                onClick={() => setShowPassword(!showPassword)}
-                className="absolute right-3 top-1/2 transform -translate-y-1/2 text-slate-500 hover:text-slate-700"
-                aria-label={showPassword ? 'Hide password' : 'Show password'}
-              >
-                {showPassword ? (
-                  <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" className="w-5 h-5">
-                    <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M13.875 18.825A10.05 10.05 0 0112 19c-4.478 0-8.268-2.943-9.543-7a9.97 9.97 0 011.563-3.029m5.858.908a3 3 0 114.243 4.243M9.878 9.878l4.242 4.242M9.878 9.878L6.464 6.464m7.535 7.535l3.415 3.414M3 3l3.464 3.464M21 21l-3.415-3.414" />
-                  </svg>
-                ) : (
-                  <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" className="w-5 h-5">
-                    <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M15 12a3 3 0 11-6 0 3 3 0 016 0z" />
-                    <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M2.458 12C3.732 7.943 7.523 5 12 5c4.478 0 8.268 2.943 9.542 7-1.274 4.057-5.064 7-9.542 7-4.477 0-8.268-2.943-9.542-7z" />
-                  </svg>
-                )}
-              </button>
-            </div>
-          </div>
-
-          <button
-            type="submit"
-            disabled={isLoading}
-            className="w-full py-3 px-4 rounded-lg font-semibold text-white transition-colors bg-slate-700 hover:bg-slate-800 disabled:bg-slate-400 disabled:cursor-not-allowed"
-          >
-            {isLoading ? (
-              <span className="flex items-center justify-center">
-                <svg className="animate-spin -ml-1 mr-3 h-5 w-5 text-white" fill="none" viewBox="0 0 24 24">
-                  <circle className="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" strokeWidth="4" />
-                  <path className="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z" />
-                </svg>
-                Signing in...
-              </span>
-            ) : (
-              'Sign In'
-            )}
-          </button>
-        </form>
+        {/* EMAIL/PASSWORD FORM REMOVED — same root cause as pages/login (see that
+            file's identical note): `emailAndPassword` appears ZERO times in
+            better-auth.ts, so authClient.signIn.email always returned "Email and
+            password is not enabled". Unlike pages/login, THIS page's form was never
+            removed when that happened — it kept accepting input and 400ing on every
+            submit, real credentials included (QAPert 32622, live-verified against a
+            seeded TOTP fixture 2026-08-22). The 222363 accessibility work made the
+            error STATE correct; it never made the endpoint real — a dead door that
+            looks alive is worse than an absent one (BAPert 32626). Removed 4.1.31.
+            To ADD real admin password auth: wire this page to the IDP's password
+            endpoint directly (the same one the graft's auth-flow BFF used to call,
+            or its package-pattern successor per Jon's B ruling, 32627) — NOT
+            authClient.signIn.email, which has never worked and was never wired to
+            anything. Restore a form only together with that wiring. */}
 
         {/* Security notice */}
         <p className="mt-6 text-center text-xs text-slate-500">

package/src/pages/security/EnhancedSecurityPage.tsx

@@ -10,6 +10,13 @@
  * - Danger zone (data export, account deletion)
  *
  * @see docs/specs/MEMBER_SELF_SERVICE_SPEC.md
+ *
+ * @deprecated RETIRED (BAPert ruling, card 221074, 2026-08-18). The canonical,
+ * maintained copy is graft-local:
+ * idp_admin_ui_graft/src/app/account/security/EnhancedSecurityPage.tsx.
+ * What stage serves is what was scored against Clerk; this package copy was
+ * imported by nothing in the graft and receives NO further fixes. Do not
+ * import it into new work.
  */
 
 'use client';
@@ -195,10 +202,53 @@ function formatRelativeTime(dateString?: string): string {
   } catch { return dateString; }
 }
 
-export default function EnhancedSecurityPage() {
+export interface EnhancedSecurityPageProps {
+  /**
+   * 152745. Where "Enable 2FA" navigates to start enrollment. Deliberately a
+   * PROP, not a hardcoded route: this component ships in a shared package
+   * consumed by apps whose enrollment routes differ (idp_admin_ui_graft has
+   * one at /user-authentication/multi-factor; idealresume — per QAPert's
+   * 170047 gate — has NONE at all). Hardcoding either app's route into the
+   * package would be wrong for the other, and would silently reproduce the
+   * exact "advertises 2FA, nothing reachable" defect this card exists to
+   * fix. Undefined -> the button renders honestly disabled (see below),
+   * never a fake-live control pointing nowhere.
+   */
+  mfaEnrollHref?: string;
+  /**
+   * 152745. Called when "Disable 2FA" is clicked. Left to the consumer for
+   * the same reason as mfaEnrollHref: disabling 2FA is a real, consequential
+   * write (DELETE /api/Account/mfa/methods/{id} per cluster card 170059) and
+   * this package has no opinion on which method id, confirmation flow, or
+   * step-up policy a given app requires. Undefined -> honestly disabled.
+   */
+  onDisable2FA?: () => Promise<void> | void;
+}
+
+/**
+ * @deprecated RETIRED (BAPert ruling, card 221074, 2026-08-18). Canonical copy:
+ * idp_admin_ui_graft/src/app/account/security/EnhancedSecurityPage.tsx.
+ * This copy receives NO further fixes. Do not import.
+ */
+export default function EnhancedSecurityPage({ mfaEnrollHref, onDisable2FA }: EnhancedSecurityPageProps = {}) {
   const { data: profileData, isLoading: isProfileLoading } = useProfile();
   const layout = useLayout();
   const colors = useColors();
+  const [disabling2FA, setDisabling2FA] = useState(false);
+  const [disable2FAError, setDisable2FAError] = useState('');
+
+  const handleDisable2FA = async () => {
+    if (!onDisable2FA || disabling2FA) return;
+    setDisable2FAError('');
+    try {
+      setDisabling2FA(true);
+      await onDisable2FA();
+    } catch (err: any) {
+      setDisable2FAError(err?.message || 'Failed to disable two-factor authentication');
+    } finally {
+      setDisabling2FA(false);
+    }
+  };
 
   // Re-auth action types (moved for scope)
 type ReAuthAction = 'enable_2fa' | 'disable_2fa' | 'export_data' | 'delete_account' | null;
@@ -437,16 +487,52 @@ type ReAuthAction = 'enable_2fa' | 'disable_2fa' | 'export_data' | 'delete_accou
               <StatusBadge enabled={twoFactorEnabled} isDark={isDark} />
             </div>
             {twoFactorEnabled ? (
-              <div className="flex gap-2">
-                <button className={`px-3 py-1.5 text-sm rounded border ${isDark ? 'border-slate-600 hover:bg-slate-700' : 'border-gray-300 hover:bg-gray-50'} ${textSecondary}`}>
-                  Change Method
-                </button>
-                <button className="px-3 py-1.5 text-sm rounded border border-red-500 text-red-500 hover:bg-red-500/10">
-                  Disable 2FA
-                </button>
+              <div className="flex flex-col gap-2">
+                <div className="flex gap-2">
+                  <button className={`px-3 py-1.5 text-sm rounded border ${isDark ? 'border-slate-600 hover:bg-slate-700' : 'border-gray-300 hover:bg-gray-50'} ${textSecondary}`}>
+                    Change Method
+                  </button>
+                  {/* 152745: was a dead styled button (no onClick/type/href) that
+                      advertised a working control. Disabling a real 2FA method
+                      is consequential (DELETE .../mfa/methods/{id}, cluster
+                      170059), so this package has no default action — only a
+                      consumer-supplied onDisable2FA makes it live. Unwired, it
+                      renders honestly disabled rather than clickable-looking. */}
+                  <button
+                    type="button"
+                    onClick={handleDisable2FA}
+                    disabled={!onDisable2FA || disabling2FA}
+                    title={!onDisable2FA ? 'Disabling two-factor authentication is not available here' : undefined}
+                    className="px-3 py-1.5 text-sm rounded border border-red-500 text-red-500 hover:bg-red-500/10 disabled:opacity-40 disabled:cursor-not-allowed disabled:hover:bg-transparent"
+                  >
+                    {disabling2FA ? 'Disabling...' : 'Disable 2FA'}
+                  </button>
+                </div>
+                {disable2FAError && <p className="text-xs text-red-400">{disable2FAError}</p>}
               </div>
+            ) : mfaEnrollHref ? (
+              // 152745: real navigation to the consumer's own enrollment
+              // route (a plain <a>, matching "Back to Profile" below — this
+              // package has no opinion on which router the host app uses).
+              <a
+                href={mfaEnrollHref}
+                className="inline-block px-4 py-2 bg-blue-600 text-white rounded-md hover:bg-blue-700"
+              >
+                Enable 2FA
+              </a>
             ) : (
-              <button className="px-4 py-2 bg-blue-600 text-white rounded-md hover:bg-blue-700">
+              // 152745: no enrollment destination configured. This is the
+              // case QAPert's 170047 gate found live on idealresume.online —
+              // rendering an active-looking button here would be the exact
+              // "advertises 2FA, nothing reachable" defect this card exists
+              // to close, just moved from "no onClick" to "onClick navigates
+              // to a 404". Honestly disabled instead.
+              <button
+                type="button"
+                disabled
+                title="Two-factor authentication enrollment is not available here"
+                className="px-4 py-2 bg-blue-600 text-white rounded-md opacity-40 cursor-not-allowed"
+              >
                 Enable 2FA
               </button>
             )}

package/src/pages/security/index.ts

@@ -6,4 +6,7 @@
  */
 
 export { default as SecurityPage } from './page';
+// RETIRED (BAPert ruling, card 221074, 2026-08-18): canonical copy is
+// graft-local at idp_admin_ui_graft/src/app/account/security/EnhancedSecurityPage.tsx.
+/** @deprecated use the graft-local canonical copy (card 221074) */
 export { default as EnhancedSecurityPage } from './EnhancedSecurityPage';

package/src/pages/test-env/EmergencyLogoutPage.tsx

@@ -4,14 +4,26 @@ import { authClient } from '../../client/better-auth-client';
 import { useState, useEffect } from 'react';
 
 /**
- * Emergency Logout Page
+ * ⚠️ DESTRUCTIVE DEBUG PAGE — NOT INTENDED FOR PRODUCTION. ⚠️
  *
- * Nuclear option for clearing auth state when things go wrong.
- * Clears cookies, localStorage, and forces NextAuth signout.
+ * Emergency Logout Page. Nuclear option for clearing auth state when things go
+ * wrong: clears cookies, clears localStorage, and forces a signout.
  *
- * Usage in consuming app:
+ * ────────────────────────── SCOPE, STATED HONESTLY (QAPert 35000 sweep) ──────────────────────────
+ * This is the MILDEST of the four test-env pages and this warning is
+ * deliberately weaker than its siblings'. The damage is SELF-INFLICTED and
+ * recoverable: a visitor can only destroy their OWN client-side auth state,
+ * and the remedy is to sign in again. It exposes no credential and mutates no
+ * other user's state. Do not read the banner above as equivalent to the JWT
+ * inspector's — inflating a mild finding is how real ones get discounted.
+ *
+ * It is flagged only because it ships with no env gate of its own, and because
+ * clearing localStorage wholesale can discard unrelated application state that
+ * a consuming app kept there. Mounting it is the gate.
+ *
+ * ────────────────────────── IF YOU MOUNT IT, MOUNT IT LIKE THIS ──────────────────────────
  * ```typescript
- * // app/test-env/emergency-logout/page.tsx
+ * // app/test-env/emergency-logout/page.tsx   — TEST/DEV ENVIRONMENTS ONLY
  * export { EmergencyLogoutPage as default } from '@payez/next-mvp/pages/test-env';
  * ```
  */