@payez/next-mvp 4.1.21 → 4.4.1

package/dist/lib/idp-client-config.js

@@ -1,4 +1,26 @@
 "use strict";
+/* ============================================================================
+ *  ONE VALUE, ONE VARIABLE NAME.  CLIENT_ID.
+ *
+ *  DO NOT INTRODUCE A SECOND ENV VAR CARRYING A VALUE THAT ALREADY HAS ONE.
+ *  Not with a prefix. Not "just for the client side". Not "temporarily".
+ *
+ *  This value had THREE names before 2026-08-26:
+ *      CLIENT_ID              read by 8 server files - the real one
+ *      NEXT_PUBLIC_CLIENT_ID  read as a fallback in 6 places, ALL server-side
+ *      NEXT_CLIENT_ID         read by lib/demo-mode.ts, and set by dev-broker.ps1,
+ *                             which meant BROKER MODE NEVER PASSED THE CLIENT ID
+ *                             TO THE CONFIG AT ALL. The bug was the extra name.
+ *
+ *  The NEXT_PUBLIC_ prefix exists so Next inlines a value into the BROWSER bundle.
+ *  Nothing in the browser ever read it. So it bought nothing and merely LOOKED
+ *  justified - which is worse than an obviously arbitrary name, because it stops
+ *  the next person questioning it.
+ *
+ *  IF YOU NEED THIS VALUE SOMEWHERE NEW, READ CLIENT_ID. If you genuinely need it
+ *  in browser code, that is a real Next constraint - raise it, do not quietly add
+ *  a second spelling and leave the collision for someone else to measure.
+ * ============================================================================ */
 /**
  * IDP Client Configuration
  *
@@ -18,9 +40,39 @@
  *
  * @version 2.0.0 - Added Redis-backed caching
  */
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getIDPClientConfig = getIDPClientConfig;
 exports.clearConfigCache = clearConfigCache;
@@ -28,10 +80,66 @@ exports.clearConfigRedisCache = clearConfigRedisCache;
 exports.getEnabledProviders = getEnabledProviders;
 require("server-only");
 const crypto_1 = require("crypto");
-const redis_1 = __importDefault(require("./redis"));
+// REDIS IS IMPORTED LAZILY, AND THAT IS LOAD-BEARING.
+// A module-scope `import redis from './redis'` drags ioredis into EVERY bundle that
+// touches this file - including instrumentation.ts. Next compiles the instrumentation
+// hook for the EDGE runtime as well as node, and ioredis internally does
+// require('stream'), which does not exist on edge. The result was a BUILD ERROR in the
+// browser overlay for a code path the edge build never executes.
+//
+// The NEXT_RUNTIME check in instrumentation.ts is a RUNTIME guard; the bundler still
+// traces the import statically. Deferring the import to first use is what actually
+// keeps ioredis out of the graph. All four call sites below are already async.
+let _redisMod = null;
+async function getRedis() {
+    if (!_redisMod)
+        _redisMod = (await Promise.resolve().then(() => __importStar(require('./redis')))).default;
+    return _redisMod;
+}
 // ============================================================================
 // Cache & Fetch Deduplication
 // ============================================================================
+/**
+ * 261588 - THE OPERATOR'S SECRET, CAPTURED BEFORE THIS MODULE CAN CLOBBER IT.
+ *
+ * startup-init.ts:129 defers to an operator-set BETTER_AUTH_SECRET, and its sibling
+ * comment says that override is INTENDED ('allows deployment override for beta/staging').
+ * The config-refresh paths in this file then overwrote it minutes later, so a deliberate
+ * deployment override survived startup and was silently swapped on the first refresh -
+ * sessions signed before and after the swap carry DIFFERENT secrets. A real guard
+ * neutralised by a later path that did not get the memo.
+ *
+ * *** WHY THIS IS A MODULE-LOAD SNAPSHOT AND NOT `if (!process.env.BETTER_AUTH_SECRET)`. ***
+ * That naive guard is what the cache path uses (249808). It fixes the override, but it
+ * also means that once ANY refresh has populated the variable, NO later refresh can ever
+ * update it - so an IDP-side secret ROTATION silently stops propagating and the app keeps
+ * signing with a retired key. That trades one silent failure for another.
+ *
+ * Snapshotting at module load separates the two cases properly:
+ *   operator set it  -> never overwritten, for the process lifetime (the override is real)
+ *   operator did not -> every refresh may publish, so rotation still works
+ *
+ * This is read ONCE, at import, before any function here has had a chance to write.
+ */
+const OPERATOR_AUTH_SECRET = process.env.BETTER_AUTH_SECRET;
+const OPERATOR_NEXTAUTH_SECRET = process.env.NEXTAUTH_SECRET;
+let operatorOverrideLogged = false;
+/** Publish the resolved auth secret WITHOUT ever overwriting an operator-set value. */
+function publishAuthSecret(value, source) {
+    if (OPERATOR_AUTH_SECRET) {
+        if (!operatorOverrideLogged) {
+            operatorOverrideLogged = true;
+            console.log(`[IDP_CONFIG] BETTER_AUTH_SECRET was set by the deployment; keeping it and ignoring the ${source} value (261588). ` +
+                'Unset it if you want the IDP to supply the signing secret.');
+        }
+    }
+    else {
+        process.env.BETTER_AUTH_SECRET = value;
+    }
+    if (!OPERATOR_NEXTAUTH_SECRET) {
+        process.env.NEXTAUTH_SECRET = value;
+    }
+}
 let cachedConfig = null;
 let cacheExpiry = 0;
 let pendingFetch = null; // Prevents parallel fetches
@@ -39,20 +147,79 @@ let pendingFetch = null; // Prevents parallel fetches
 // Redis Cache Configuration
 // ============================================================================
 const REDIS_CONFIG_KEY_PREFIX = 'idp_config:';
+/**
+ * 263437 - THE CACHE KEY MUST NAME THE BACKEND THE VALUE CAME FROM.
+ *
+ * The key was `idp_config:{CLIENT_ID}` - client slug ONLY. The cached value is fully
+ * determined by (backend origin, clientId): Layer 3 below fetches from
+ * INTERNAL_IDP_URL || IDP_URL for CLIENT_ID. Two instances pointed at DIFFERENT IDP
+ * backends but carrying the same slug are therefore indistinguishable to this cache,
+ * and whichever writes last serves BOTH - with ITS backend's client scope.
+ *
+ * WHY NOT REDIS_INSTANCE_ID (the originally proposed discriminator):
+ * it names the STORE, not the backend. Two legs on separate stores cannot collide in
+ * the first place; put them on ONE store - the shape this fix exists to survive - and
+ * they report the SAME instance id, so the keys recollide and the bug returns with a
+ * fix sitting in front of it. A discriminator that is only distinct in the
+ * configuration where the collision is already impossible discriminates nothing.
+ *
+ * SCOPE NOTE, so this is not over-read the way 273385 was: an undiscriminated key is a
+ * LATENT hazard, not the explanation for any wrong-tenant symptom measured on the walk
+ * rigs. Measured 2026-08-28 from three seats - the 93 and AKS legs were never on one
+ * store, and each backend independently returns the same blob for this slug. If you are
+ * chasing a wrong clientId, the value came from the IDP record, not from this cache.
+ */
+function getConfigBackendTag() {
+    // Must mirror Layer 3's selection EXACTLY (INTERNAL_IDP_URL wins), or the key would
+    // name a backend the value did not come from.
+    const rawBackend = process.env.INTERNAL_IDP_URL || process.env.IDP_URL;
+    if (!rawBackend) {
+        throw new Error('[IDP_CONFIG] FATAL: INTERNAL_IDP_URL or IDP_URL must be set - the config cache key names the backend the cached value came from');
+    }
+    // ORIGIN, not the full URL: a path or trailing-slash difference is not a different
+    // backend, and letting it fork the key would silently halve the cache hit rate - a
+    // quieter bug in the same family. An unparseable value is used VERBATIM rather than
+    // collapsed to a constant, which would reintroduce the collision it is meant to stop.
+    let backendIdentity;
+    try {
+        backendIdentity = new URL(rawBackend).origin.toLowerCase();
+    }
+    catch {
+        backendIdentity = rawBackend.trim().toLowerCase();
+    }
+    // A short digest, not the raw origin: keeps keys bounded and does not publish the
+    // internal topology to anyone holding KEYS on a shared store.
+    return (0, crypto_1.createHash)('sha256').update(backendIdentity).digest('hex').slice(0, 12);
+}
 function getRedisConfigKey() {
-    const clientId = process.env.CLIENT_ID || process.env.NEXT_PUBLIC_CLIENT_ID || 'default';
-    return `${REDIS_CONFIG_KEY_PREFIX}${clientId}`;
+    // ONE ENV VAR: CLIENT_ID. Collapsed 2026-08-26.
+    // There were three names for this value - CLIENT_ID, NEXT_PUBLIC_CLIENT_ID and
+    // NEXT_CLIENT_ID. The NEXT_PUBLIC_ prefix exists so Next inlines a value into the
+    // BROWSER bundle; nothing in the browser ever read it, so it bought nothing and
+    // merely looked justified. Verified before removal: all 7 consuming sites set
+    // CLIENT_ID in their env; none relied on the fallback.
+    //
+    // AND IT MUST THROW, NOT DEFAULT. This clientId is the REDIS CACHE KEY. The old
+    // `|| 'default'` meant an app that failed to set the id did not fail - it read and
+    // wrote config under `idp_config:default`, silently sharing one cache slot with
+    // every other misconfigured app, while Layer 3 THREW for that same missing value.
+    // Two behaviours for one missing variable, and the silent one owned the cache.
+    const clientId = process.env.CLIENT_ID;
+    if (!clientId) {
+        throw new Error('[IDP_CONFIG] FATAL: CLIENT_ID must be set - it is the config cache key, and defaulting it shares one cache entry across misconfigured apps');
+    }
+    return `${REDIS_CONFIG_KEY_PREFIX}${clientId}:${getConfigBackendTag()}`;
 }
 async function getConfigFromRedis() {
     try {
         const key = getRedisConfigKey();
-        const cached = await redis_1.default.get(key);
+        const cached = await (await getRedis()).get(key);
         if (!cached)
             return null;
         const parsed = JSON.parse(cached);
         if (Date.now() >= parsed.expiresAt) {
             // Expired, delete it
-            await redis_1.default.del(key);
+            await (await getRedis()).del(key);
             return null;
         }
         return parsed.config;
@@ -71,7 +238,7 @@ async function setConfigInRedis(config) {
             expiresAt: Date.now() + (ttlSeconds * 1000)
         };
         // Store with TTL slightly longer than the logical expiry to allow for clock skew
-        await redis_1.default.set(key, JSON.stringify(data), 'EX', ttlSeconds + 10);
+        await (await getRedis()).set(key, JSON.stringify(data), 'EX', ttlSeconds + 10);
     }
     catch (error) {
         console.warn('[IDP_CONFIG] Failed to write to Redis cache:', error);
@@ -101,7 +268,19 @@ const MAX_BACKOFF_MS = 30000; // 30 seconds max backoff
 async function getIDPClientConfig(forceRefresh = false) {
     const now = Date.now();
     // Layer 1: Return in-memory cached if still valid (skip if forceRefresh)
-    if (!forceRefresh && cachedConfig && now < cacheExpiry) {
+    //
+    // The `cachedConfig.authSecret` term is DEFENCE IN DEPTH, not redundancy.
+    // Both writers are validated (the fetch path checks before caching; the
+    // Redis path requires a non-empty secret to count as a hit), so in principle
+    // an empty config can no longer be cached. This makes that property TRUE AT
+    // THE POINT OF USE instead of only provable by reading the whole file —
+    // DotNetPert 21184 and DotNetPert-Scout 21178 both argued for guarding the
+    // return, and they are right that it is the shape that cannot drift: a
+    // future third writer, or a cache restored from an older build's Redis
+    // entry, is caught here regardless of what the writers do.
+    // The cost is one boolean; the failure it prevents is every session signed
+    // with a secret published on npm.
+    if (!forceRefresh && cachedConfig && cachedConfig.authSecret && now < cacheExpiry) {
         return cachedConfig;
     }
     // If a fetch is already in progress, wait for it instead of starting another
@@ -111,16 +290,98 @@ async function getIDPClientConfig(forceRefresh = false) {
     // Layer 2: Check Redis cache (skip if forceRefresh - startup should always get fresh data)
     if (!forceRefresh) {
         const redisConfig = await getConfigFromRedis();
-        if (redisConfig) {
+        // A cached entry is only USABLE if it carries a secret — see the note
+        // below. `redisConfig && !authSecret` must behave like a cache MISS, so
+        // the emptiness test belongs here, in the condition that gates the
+        // `return`, and not merely around the assignment inside it.
+        // ── 249808 FOLLOW-THROUGH: THE CACHE MAY NEVER *ESTABLISH* THE SECRET. ──
+        //
+        // The rule stated just above - "a cached entry is only USABLE if it
+        // carries a secret" - was right and did not go far enough. The cache
+        // must also never be the FIRST source of the signing secret, because
+        // this blob is unauthenticated (bare JSON.parse, no MAC, and its own
+        // `expiresAt` sits inside the attacker-writable value).
+        //
+        // Guarding the ASSIGNMENT (the earlier 4.1.39 fix) protects a secret
+        // that already exists. It does nothing when none exists yet - and that
+        // window is real: the graft CATCHES the FATAL that startup-init throws
+        // when the IDP is unreachable at boot (graft instrumentation.ts:65-69,
+        // "BETTER_AUTH_SECRET may be unavailable until then"), so the app can
+        // serve requests with no secret established. The first request would
+        // then take the signing key from the cache - which is the whole
+        // forgery vector, arriving through the back door of a fix that had
+        // closed the front one.
+        //
+        // So: with no trusted secret in hand, THIS CACHE ENTRY IS A MISS. Fall
+        // through to Layer 3, the IDP fetch, which is authoritative and already
+        // guarded to throw on an empty secret. Escalation to truth, exactly as
+        // the empty-secret case above does.
+        //
+        // Accepts either name, matching startup-init.ts:147 which verifies
+        // `BETTER_AUTH_SECRET || NEXTAUTH_SECRET` during the rename transition.
+        //
+        // COST, bounded: only while no secret is established does this force an
+        // IDP round trip. startup-init calls getIDPClientConfig(TRUE) and so
+        // skips Layer 2 regardless, meaning normal boot is unaffected; once the
+        // secret exists the cache serves every non-forced caller as before. The
+        // only behaviour that changes is in the window where the alternative was
+        // trusting an unauthenticated store for a signing key.
+        const haveTrustedSecret = !!(process.env.BETTER_AUTH_SECRET || process.env.NEXTAUTH_SECRET);
+        if (redisConfig && redisConfig.authSecret && haveTrustedSecret) {
             // Restore to in-memory cache
             cachedConfig = redisConfig;
             cacheExpiry = Date.now() + ((redisConfig.configCacheTtlSeconds || 300) * 1000);
             // Set BETTER_AUTH_SECRET from cached config (also set legacy
             // NEXTAUTH_SECRET during the rename transition).
-            if (redisConfig.authSecret) {
-                process.env.BETTER_AUTH_SECRET = redisConfig.authSecret;
-                process.env.NEXTAUTH_SECRET = redisConfig.authSecret;
-            }
+            //
+            // ⚠ THE EMPTY CASE IS NOT A NO-OP — IT WAS, AND THAT WAS THE HOLE.
+            // The three FETCH paths (:225 external, :353 internal, post-parse)
+            // throw on an empty authSecret, because an empty secret reaching
+            // betterAuth() is silently replaced by the PUBLIC DEFAULT_SECRET
+            // (create-context.mjs:79) rather than rejected. This path used to
+            // just skip the assignment and `return redisConfig` below — so a
+            // cached config with an empty secret bypassed ALL THREE guards, and
+            // it is checked FIRST, before any of them. Redis persistence made it
+            // durable across restarts. Found by QAPert (21175) after I claimed
+            // the guards covered every path; they covered every FETCH path.
+            //
+            // Resolution is deliberately NOT a throw: a corrupt cache entry
+            // should not take the app down when the authoritative source is one
+            // call away. Treat it as a MISS and fall through to the fetch paths,
+            // which are guarded and will throw if the IDP is genuinely empty.
+            // That is escalation to truth, not a fallback that weakens the check.
+            // ── 249808: AN EXPLICIT BETTER_AUTH_SECRET NOW WINS OVER THE CACHE. ──
+            //
+            // These two assignments were UNCONDITIONAL. That made the Redis
+            // cache authoritative for the SESSION SIGNING KEY, and the cache is
+            // not a trusted input: getConfigFromRedis() does a bare JSON.parse
+            // with no signature or MAC, and its only freshness check is an
+            // `expiresAt` field that lives INSIDE the same attacker-writable
+            // blob. So anyone who could write that key chose the signing secret,
+            // and knowing the secret means minting a validly-signed session for
+            // any user — including one who has never logged in. Forgery, not
+            // theft: it survives flushing the store and revoking refresh tokens,
+            // because it needs neither.
+            //
+            // THE FILE ALREADY KNEW THE RIGHT PATTERN. Five lines below, a mere
+            // URL defers to an explicitly-configured value, with a comment
+            // blessing deployment override. startup-init.ts:129 defers on THIS
+            // VERY SECRET (`config.authSecret && !process.env.BETTER_AUTH_SECRET`).
+            // The signing key was the one value in the package taking an
+            // untrusted cache's word unconditionally — protected less carefully
+            // than a base URL.
+            //
+            // Deferring restores that consistency and makes an explicitly-set
+            // BETTER_AUTH_SECRET a REAL secret: a value the deployment owns and
+            // the cache cannot override.
+            //
+            // BOUND, stated so nobody over-reads this: it closes the vector only
+            // where BETTER_AUTH_SECRET IS ACTUALLY SET. Where it is unset the
+            // cache still supplies it and the exposure stands — so this is
+            // necessary, cheap and strictly-better, NOT sufficient on its own.
+            // Locking the store and setting the secret explicitly in every
+            // deployment remain required.
+            publishAuthSecret(redisConfig.authSecret, 'Redis-cached IDP config');
             // Set IDENTITY_CLIENT_BASE_EXTERNAL_URL from cached config.
             // Only set if not already defined (allows deployment override for beta/staging).
             if (redisConfig.baseClientUrl && !process.env.IDENTITY_CLIENT_BASE_EXTERNAL_URL) {
@@ -132,9 +393,10 @@ async function getIDPClientConfig(forceRefresh = false) {
     // Layer 3: Fetch from IDP
     const internalIdpUrl = process.env.INTERNAL_IDP_URL;
     const idpUrl = process.env.IDP_URL;
-    const clientIdStr = process.env.CLIENT_ID || process.env.NEXT_PUBLIC_CLIENT_ID;
+    // CLIENT_ID only - see the note at the cache-key site above.
+    const clientIdStr = process.env.CLIENT_ID;
     if (!clientIdStr) {
-        throw new Error('[IDP_CONFIG] FATAL: CLIENT_ID or NEXT_PUBLIC_CLIENT_ID must be set');
+        throw new Error('[IDP_CONFIG] FATAL: CLIENT_ID must be set');
     }
     if (!internalIdpUrl && !idpUrl) {
         throw new Error('[IDP_CONFIG] FATAL: INTERNAL_IDP_URL or IDP_URL must be set');
@@ -145,20 +407,43 @@ async function getIDPClientConfig(forceRefresh = false) {
         : fetchConfigFromIDP(idpUrl, clientIdStr);
     pendingFetch = fetcher
         .then(async (config) => {
+        // ── VALIDATE BEFORE CACHING. ORDER IS THE WHOLE FIX. ────────────
+        // This block used to assign cachedConfig and await setConfigInRedis
+        // FIRST and throw afterwards — so a response with an empty secret
+        // poisoned BOTH caches on its way to failing. The throw only stopped
+        // THAT call: the next one hit the in-memory layer (`return
+        // cachedConfig`), which has no guard because it is a cache read, and
+        // handed the empty config to betterAuth() — where empty silently
+        // becomes the public DEFAULT_SECRET. Redis made it survive restarts.
+        //
+        // Guarding every cached RETURN would also work, and DotNetPert-Scout
+        // (21178) is right that it is the more robust shape in general. But
+        // there are four such returns and one writer, and the invariant we
+        // actually want is "an unvalidated config is never cached at all".
+        // Enforce it where it is cheapest to keep true.
+        if (!config.authSecret) {
+            // ⚠ LOAD-BEARING THROW — DO NOT SOFTEN TO A DEFAULT OR A WARNING.
+            // better-auth does NOT treat an empty secret as missing: at
+            // create-context.mjs:79 it substitutes DEFAULT_SECRET
+            // ("better-auth-secret-12345678901234567890"), which ships in the
+            // PUBLIC npm package, and its !secret guard can then never fire.
+            // The only remaining protection there is an isProduction gate — so
+            // outside production an empty secret means every session is signed
+            // with a string anyone can read off npm and forge.
+            // This throw is what stops that. It is also what turned the
+            // 2026-08-05 nextauth_secret spelling bug into a loud FATAL instead
+            // of a silently forgeable app.
+            throw new Error('[IDP_CONFIG] FATAL: IDP did not return authSecret');
+        }
+        // Validated above — only now is it safe to cache or publish.
+        publishAuthSecret(config.authSecret, 'freshly-fetched IDP config');
         // Cache with TTL from response (default 5 minutes)
         cachedConfig = config;
         cacheExpiry = Date.now() + ((config.configCacheTtlSeconds || 300) * 1000);
-        // Store in Redis for persistence across module reloads
+        // Store in Redis for persistence across module reloads. This is the
+        // write that made a bad config outlive the process, so it must stay
+        // BELOW the guard, never above it.
         await setConfigInRedis(config);
-        // Set BETTER_AUTH_SECRET from config (also set legacy
-        // NEXTAUTH_SECRET during the rename transition).
-        if (config.authSecret) {
-            process.env.BETTER_AUTH_SECRET = config.authSecret;
-            process.env.NEXTAUTH_SECRET = config.authSecret;
-        }
-        else {
-            throw new Error('[IDP_CONFIG] FATAL: IDP did not return authSecret');
-        }
         // Set IDENTITY_CLIENT_BASE_EXTERNAL_URL from config.
         // Only set if not already defined (allows deployment override for beta/staging).
         if (config.baseClientUrl && !process.env.IDENTITY_CLIENT_BASE_EXTERNAL_URL) {
@@ -185,7 +470,7 @@ function clearConfigCache() {
 async function clearConfigRedisCache() {
     try {
         const key = getRedisConfigKey();
-        await redis_1.default.del(key);
+        await (await getRedis()).del(key);
         console.log('[IDP_CONFIG] Redis cache cleared:', key);
     }
     catch (error) {
@@ -249,8 +534,13 @@ async function fetchConfigFromInternalIDP(internalIdpUrl, clientIdStr) {
             additionalParams: p.additionalParams ?? p.additional_params
         })),
         authSettings: {
-            require2FA: configData.authSettings?.require2FA ?? configData.auth_settings?.require_2fa ?? true,
-            allowed2FAMethods: configData.authSettings?.allowed2FAMethods ?? configData.auth_settings?.allowed_2fa_methods ?? ['email', 'sms'],
+            // 257255: terminal `?? true` / `?? ['email','sms']` REMOVED. They
+            // made a document with NO auth policy indistinguishable from one
+            // carrying exactly those values, one layer below the route that
+            // reports policy - so even a corrected settings.ts would have
+            // validated a fabrication. Undefined now means "not carried".
+            require2FA: configData.authSettings?.require2FA ?? configData.auth_settings?.require_2fa,
+            allowed2FAMethods: configData.authSettings?.allowed2FAMethods ?? configData.auth_settings?.allowed_2fa_methods,
             mfaGracePeriodHours: configData.authSettings?.mfaGracePeriodHours ?? configData.auth_settings?.mfa_grace_period_hours ?? 24,
             mfaRememberDeviceDays: configData.authSettings?.mfaRememberDeviceDays ?? configData.auth_settings?.mfa_remember_device_days ?? 30,
             sessionTimeoutMinutes: configData.authSettings?.sessionTimeoutMinutes ?? configData.auth_settings?.session_timeout_minutes ?? 60,
@@ -258,7 +548,25 @@ async function fetchConfigFromInternalIDP(internalIdpUrl, clientIdStr) {
             allowRememberMe: configData.authSettings?.allowRememberMe ?? configData.auth_settings?.allow_remember_me ?? true,
             rememberMeDays: configData.authSettings?.rememberMeDays ?? configData.auth_settings?.remember_me_days ?? 30,
             lockoutThreshold: configData.authSettings?.lockoutThreshold ?? configData.auth_settings?.lockout_threshold ?? 5,
-            lockoutDurationMinutes: configData.authSettings?.lockoutDurationMinutes ?? configData.auth_settings?.lockout_duration_minutes ?? 15
+            lockoutDurationMinutes: configData.authSettings?.lockoutDurationMinutes ?? configData.auth_settings?.lockout_duration_minutes ?? 15,
+            // 240447: read the tenant policy the IDP already sends. Applied to
+            // BOTH parse paths (fetchConfigFromInternalIDP and
+            // fetchConfigFromIDP) — fixing one would leave the other silently
+            // omitting these, which is the partial-fix trap.
+            //
+            // Same dual-casing idiom as every field above, but with NO
+            // `?? default` tail, deliberately. The others default because a
+            // wrong timeout is a nuisance; a wrong registration flag is a LIE
+            // about what the tenant permits, and the hardcoded `true` in
+            // routes/auth/settings was exactly that lie. `undefined` has to
+            // survive to the consumer so it can decide, instead of being
+            // handed a guess wearing the costume of a measurement.
+            allowPublicRegistration: configData.authSettings?.allowPublicRegistration ??
+                configData.auth_settings?.allow_public_registration,
+            allowSocialLogin: configData.authSettings?.allowSocialLogin ??
+                configData.auth_settings?.allow_social_login,
+            enablePasswordReset: configData.authSettings?.enablePasswordReset ??
+                configData.auth_settings?.enable_password_reset
         },
         branding: {
             theme: configData.branding?.theme,
@@ -269,6 +577,9 @@ async function fetchConfigFromInternalIDP(internalIdpUrl, clientIdStr) {
         baseClientUrl: configData.baseClientUrl ?? configData.base_client_url ?? configData.BaseClientUrl
     };
     if (!config.authSecret) {
+        // LOAD-BEARING — see the note on the external path's equivalent throw.
+        // An empty secret reaching betterAuth() becomes the PUBLIC default, not an
+        // error. Never replace this with a fallback.
         throw new Error('[IDP_CONFIG] FATAL: Internal IDP did not return authSecret');
     }
     console.log(`[IDP_CONFIG] Internal IDP config loaded for ${clientIdStr}`);
@@ -283,7 +594,12 @@ async function fetchConfigFromIDP(idpUrl, clientIdStr) {
         const timeSinceFailure = Date.now() - lastFailureTime;
         if (timeSinceFailure < CIRCUIT_OPEN_MS) {
             // Circuit is open - return stale cache if available
-            if (cachedConfig) {
+            // Stale cache is acceptable here; a stale config with NO SECRET is
+            // not. These two paths fire exactly when the IDP is unreachable —
+            // the worst moment to hand betterAuth() an empty secret, which it
+            // silently upgrades to the public DEFAULT_SECRET. Falling through to
+            // a hard failure is correct: unavailable beats forgeable.
+            if (cachedConfig && cachedConfig.authSecret) {
                 return cachedConfig;
             }
             throw new Error(`[IDP_CONFIG] Circuit breaker OPEN - no cached config available. Retry in ${Math.round((CIRCUIT_OPEN_MS - timeSinceFailure) / 1000)}s`);
@@ -300,7 +616,12 @@ async function fetchConfigFromIDP(idpUrl, clientIdStr) {
         if (timeSinceFailure < backoffMs) {
             const remainingMs = backoffMs - timeSinceFailure;
             // Return stale cache during backoff if available
-            if (cachedConfig) {
+            // Stale cache is acceptable here; a stale config with NO SECRET is
+            // not. These two paths fire exactly when the IDP is unreachable —
+            // the worst moment to hand betterAuth() an empty secret, which it
+            // silently upgrades to the public DEFAULT_SECRET. Falling through to
+            // a hard failure is correct: unavailable beats forgeable.
+            if (cachedConfig && cachedConfig.authSecret) {
                 return cachedConfig;
             }
             throw new Error(`[IDP_CONFIG] In backoff period - retry in ${Math.round(remainingMs)}ms`);
@@ -406,9 +727,13 @@ async function fetchConfigFromIDP(idpUrl, clientIdStr) {
                         console.warn('[IDP_CONFIG] DEPRECATION: require2FA found at top-level. Should be nested under auth_settings. Update IDP.');
                         return topLevel;
                     }
-                    return true; // Default to true for security
+                    // 257255: was `return true`. A default here is a FABRICATED
+                    // POLICY - QAPert measured the same client as require_2fa TRUE
+                    // on AKS and FALSE on dev-93, so any constant is wrong in one
+                    // environment by construction. Undefined = "not carried".
+                    return undefined;
                 })(),
-                allowed2FAMethods: configData.authSettings?.allowed2FAMethods ?? configData.auth_settings?.allowed_2fa_methods ?? ['email', 'sms'],
+                allowed2FAMethods: configData.authSettings?.allowed2FAMethods ?? configData.auth_settings?.allowed_2fa_methods,
                 mfaGracePeriodHours: configData.authSettings?.mfaGracePeriodHours ?? configData.auth_settings?.mfa_grace_period_hours ?? 24,
                 mfaRememberDeviceDays: configData.authSettings?.mfaRememberDeviceDays ?? configData.auth_settings?.mfa_remember_device_days ?? 30,
                 sessionTimeoutMinutes: configData.authSettings?.sessionTimeoutMinutes ?? configData.auth_settings?.session_timeout_minutes ?? 60,
@@ -416,7 +741,25 @@ async function fetchConfigFromIDP(idpUrl, clientIdStr) {
                 allowRememberMe: configData.authSettings?.allowRememberMe ?? configData.auth_settings?.allow_remember_me ?? true,
                 rememberMeDays: configData.authSettings?.rememberMeDays ?? configData.auth_settings?.remember_me_days ?? 30,
                 lockoutThreshold: configData.authSettings?.lockoutThreshold ?? configData.auth_settings?.lockout_threshold ?? 5,
-                lockoutDurationMinutes: configData.authSettings?.lockoutDurationMinutes ?? configData.auth_settings?.lockout_duration_minutes ?? 15
+                lockoutDurationMinutes: configData.authSettings?.lockoutDurationMinutes ?? configData.auth_settings?.lockout_duration_minutes ?? 15,
+                // 240447: read the tenant policy the IDP already sends. Applied to
+                // BOTH parse paths (fetchConfigFromInternalIDP and
+                // fetchConfigFromIDP) — fixing one would leave the other silently
+                // omitting these, which is the partial-fix trap.
+                //
+                // Same dual-casing idiom as every field above, but with NO
+                // `?? default` tail, deliberately. The others default because a
+                // wrong timeout is a nuisance; a wrong registration flag is a LIE
+                // about what the tenant permits, and the hardcoded `true` in
+                // routes/auth/settings was exactly that lie. `undefined` has to
+                // survive to the consumer so it can decide, instead of being
+                // handed a guess wearing the costume of a measurement.
+                allowPublicRegistration: configData.authSettings?.allowPublicRegistration ??
+                    configData.auth_settings?.allow_public_registration,
+                allowSocialLogin: configData.authSettings?.allowSocialLogin ??
+                    configData.auth_settings?.allow_social_login,
+                enablePasswordReset: configData.authSettings?.enablePasswordReset ??
+                    configData.auth_settings?.enable_password_reset
             },
             branding: {
                 theme: configData.branding?.theme,
@@ -433,6 +776,8 @@ async function fetchConfigFromIDP(idpUrl, clientIdStr) {
             throw new Error('[IDP_CONFIG] FATAL: clientId is empty or missing after parsing');
         }
         if (!config.authSecret) {
+            // LOAD-BEARING — empty must fail here, never downstream. betterAuth()
+            // silently substitutes a public constant for an empty secret.
             throw new Error('[IDP_CONFIG] FATAL: authSecret is empty after parsing');
         }
         // Success - reset failure tracking

package/dist/lib/idp-fetch.d.ts

@@ -1,4 +1,6 @@
 import { NextRequest } from 'next/server';
+import { assertAbsoluteIdpUrl } from './idp-url-guard';
+export { assertAbsoluteIdpUrl };
 /**
  * Centralized IDP fetch helper
  * - Injects Bearer from Redis session

package/dist/lib/idp-fetch.js

@@ -33,19 +33,37 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertAbsoluteIdpUrl = void 0;
 exports.idpFetchJSON = idpFetchJSON;
 const test_aware_get_token_1 = require("./test-aware-get-token");
 const session_store_1 = require("./session-store");
 const internal_api_1 = require("./internal-api");
+const idp_url_guard_1 = require("./idp-url-guard");
+Object.defineProperty(exports, "assertAbsoluteIdpUrl", { enumerable: true, get: function () { return idp_url_guard_1.assertAbsoluteIdpUrl; } });
 function buildHeaders(req, bearer, extra) {
     const headers = {
         Accept: 'application/json',
         'Content-Type': 'application/json',
         ...extra,
     };
+    /**
+     * 269334 / R21: forward the FULL X-Forwarded-For chain, do NOT collapse to [0].
+     *
+     * `.split(',')[0]` took the LEFT-most entry - the value the ORIGINAL client
+     * supplied, which is forgeable - and discarded the rest of the chain. That both
+     * (a) forwards the attacker-controlled value and (b) destroys the chain the
+     * receiving side needs to identify the real client by counting trusted hops from
+     * the right. This app cannot itself observe the TCP peer (Next 16.2.12 route
+     * handler, no socket), so the correct division of labour is: the IDP's ingress
+     * (Envoy, use_remote_address:true) APPENDS the real observed peer, the IDP counts
+     * xff_num_trusted_hops from the right, and THIS layer's only job is to not throw
+     * the chain away. Forwarding the full value is byte-identical to today for any
+     * consumer reading [0], so it cannot regress current behaviour; it only stops
+     * discarding the entries the trusted-hop logic will need.
+     */
     const xfwd = req.headers.get('x-forwarded-for') || req.headers.get('x-real-ip');
     if (xfwd)
-        headers['X-Forwarded-For'] = xfwd.split(',')[0].trim();
+        headers['X-Forwarded-For'] = xfwd;
     const ua = req.headers.get('user-agent');
     if (ua)
         headers['User-Agent'] = ua;
@@ -117,7 +135,19 @@ async function ensureFreshAccessToken(req) {
 async function idpFetchJSON(req, targetUrl, init = {}) {
     let attemptedRefresh = false;
     let { accessToken, sessionToken, hasRefreshToken } = await ensureFreshAccessToken(req);
+    (0, idp_url_guard_1.assertAbsoluteIdpUrl)(targetUrl);
     const makeCall = async (bearer) => {
+        // NOTE (307290): this fetch is UNGUARDED, and so is the first call to it at
+        // the "First attempt" below. Only the JSON PARSE (try/catch immediately
+        // after) and the RETRY are guarded. A transport-level failure - DNS, refused,
+        // TLS, timeout - therefore throws straight out of idpFetchJSON, past the thin
+        // route handlers that call it, and Next answers 500. This is long-standing and
+        // NOT introduced by 307290; but 307290's middleware carve-out lets expired-token
+        // /api/ requests reach these handlers where middleware previously redirected
+        // them away, so it routes a NEW POPULATION at this pre-existing risk. If IDP
+        // reachability blips after that change, suspect this line before suspecting the
+        // carve-out. Correcting b4b8ffae's message, which wrongly said every risky
+        // branch here is try/caught.
         const res = await fetch(targetUrl, {
             ...init,
             headers: buildHeaders(req, bearer, init.headers),