@payez/next-mvp 4.1.4 → 4.1.6

package/dist/auth/better-auth.js

@@ -326,7 +326,10 @@ async function exchangeOAuthForIdpTokens(sessionToken, provider = 'google') {
             return false;
         }
         // Build IDP token data
-        const requiresTwoFactor = result.user?.requiresTwoFactor ?? result.requiresTwoFactor ?? false;
+        // CRITICAL: If the IDP withholds refresh_token without setting requiresTwoFactor,
+        // treat missing refresh token as "2FA required" so middleware redirects to verify-code.
+        const hasRefreshToken = !!result.refresh_token;
+        const requiresTwoFactor = result.user?.requiresTwoFactor ?? result.requiresTwoFactor ?? !hasRefreshToken;
         const idpTokenData = {
             idpAccessToken: result.access_token,
             idpRefreshToken: result.refresh_token,

package/dist/lib/ensure-fresh-access-token.js

@@ -38,7 +38,13 @@ async function ensureFreshAccessToken(sessionToken, config, options = {}) {
     const safetyWindowMs = options.safetyWindowMs ?? DEFAULT_SAFETY_WINDOW_MS;
     const lockWaitMs = options.lockWaitMs ?? DEFAULT_LOCK_WAIT_MS;
     const requestId = options.requestId ?? `ensure_fresh_${Date.now()}`;
-    const session = await (0, session_store_1.getSession)(sessionToken);
+    let session = await (0, session_store_1.getSession)(sessionToken);
+    if (!session || !session.idpRefreshToken) {
+        const baSession = await (0, session_store_1.getBetterAuthSession)(sessionToken);
+        if (baSession?.idpRefreshToken) {
+            session = baSession;
+        }
+    }
     if (!session) {
         return { ok: false, code: 'NO_SESSION', message: 'No session for token', status: 401, terminal: true };
     }
@@ -76,7 +82,12 @@ async function ensureFreshAccessToken(sessionToken, config, options = {}) {
                 await new Promise(r => setTimeout(r, 200));
                 const stillLocked = await (0, session_store_1.checkRefreshLock)(sessionToken);
                 if (!stillLocked) {
-                    const after = await (0, session_store_1.getSession)(sessionToken);
+                    let after = await (0, session_store_1.getSession)(sessionToken);
+                    if (!after || !after.idpRefreshToken) {
+                        const baAfter = await (0, session_store_1.getBetterAuthSession)(sessionToken);
+                        if (baAfter?.idpRefreshToken)
+                            after = baAfter;
+                    }
                     if (after?.idpAccessToken && after.idpAccessTokenExpires) {
                         const remaining = after.idpAccessTokenExpires - Date.now();
                         if (remaining > safetyWindowMs) {
@@ -106,7 +117,12 @@ async function ensureFreshAccessToken(sessionToken, config, options = {}) {
     }
     try {
         // Re-check after lock — another caller may have already refreshed.
-        const latest = await (0, session_store_1.getSession)(sessionToken);
+        let latest = await (0, session_store_1.getSession)(sessionToken);
+        if (!latest || !latest.idpRefreshToken) {
+            const baLatest = await (0, session_store_1.getBetterAuthSession)(sessionToken);
+            if (baLatest?.idpRefreshToken)
+                latest = baLatest;
+        }
         if (latest?.idpAccessToken && latest.idpAccessTokenExpires) {
             const latestRemaining = latest.idpAccessTokenExpires - Date.now();
             const latestJwtExp = decodeJwtExp(latest.idpAccessToken);

package/dist/middleware/auth-decision.js

@@ -43,7 +43,7 @@ function makeAuthDecision(context) {
             const safeCallbackUrl2 = callbackUrl.startsWith('/account-auth/') ? '/' : callbackUrl;
             return { type: 'redirect', location: `/account-auth/verify-code?callbackUrl=${encodeURIComponent(safeCallbackUrl2)}`, reason: '2fa_required_login_redirect' };
         }
-        return { type: 'allow' };
+        return { type: 'redirect', location: `/account-auth/verify-code?callbackUrl=${encodeURIComponent(safeCallbackUrl)}`, reason: '2fa_required' };
     }
     if (sessionPointer.expired) {
         if (isLoginPage)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "4.1.4",
+  "version": "4.1.6",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/auth/better-auth.ts

@@ -342,7 +342,10 @@ export async function exchangeOAuthForIdpTokens(
     }
 
     // Build IDP token data
-    const requiresTwoFactor = result.user?.requiresTwoFactor ?? result.requiresTwoFactor ?? false;
+    // CRITICAL: If the IDP withholds refresh_token without setting requiresTwoFactor,
+    // treat missing refresh token as "2FA required" so middleware redirects to verify-code.
+    const hasRefreshToken = !!result.refresh_token;
+    const requiresTwoFactor = result.user?.requiresTwoFactor ?? result.requiresTwoFactor ?? !hasRefreshToken;
     const idpTokenData = {
       idpAccessToken: result.access_token,
       idpRefreshToken: result.refresh_token,

package/src/lib/ensure-fresh-access-token.ts

@@ -15,6 +15,7 @@
  */
 import {
   getSession,
+  getBetterAuthSession,
   updateSession,
   acquireRefreshLock,
   releaseRefreshLock,
@@ -81,7 +82,13 @@ export async function ensureFreshAccessToken(
   const lockWaitMs = options.lockWaitMs ?? DEFAULT_LOCK_WAIT_MS;
   const requestId = options.requestId ?? `ensure_fresh_${Date.now()}`;
 
-  const session = await getSession(sessionToken);
+  let session = await getSession(sessionToken);
+  if (!session || !session.idpRefreshToken) {
+    const baSession = await getBetterAuthSession(sessionToken);
+    if (baSession?.idpRefreshToken) {
+      session = baSession;
+    }
+  }
   if (!session) {
     return { ok: false, code: 'NO_SESSION', message: 'No session for token', status: 401, terminal: true };
   }
@@ -125,7 +132,11 @@ export async function ensureFreshAccessToken(
         await new Promise(r => setTimeout(r, 200));
         const stillLocked = await checkRefreshLock(sessionToken);
         if (!stillLocked) {
-          const after = await getSession(sessionToken);
+          let after = await getSession(sessionToken);
+          if (!after || !after.idpRefreshToken) {
+            const baAfter = await getBetterAuthSession(sessionToken);
+            if (baAfter?.idpRefreshToken) after = baAfter;
+          }
           if (after?.idpAccessToken && after.idpAccessTokenExpires) {
             const remaining = after.idpAccessTokenExpires - Date.now();
             if (remaining > safetyWindowMs) {
@@ -155,7 +166,11 @@ export async function ensureFreshAccessToken(
 
   try {
     // Re-check after lock — another caller may have already refreshed.
-    const latest = await getSession(sessionToken);
+    let latest = await getSession(sessionToken);
+    if (!latest || !latest.idpRefreshToken) {
+      const baLatest = await getBetterAuthSession(sessionToken);
+      if (baLatest?.idpRefreshToken) latest = baLatest;
+    }
     if (latest?.idpAccessToken && latest.idpAccessTokenExpires) {
       const latestRemaining = latest.idpAccessTokenExpires - Date.now();
       const latestJwtExp = decodeJwtExp(latest.idpAccessToken);

package/src/middleware/auth-decision.ts

@@ -1,43 +1,43 @@
-/**
- * Auth Decision Engine (lifted)
- */
-import { NextRequest } from 'next/server';
-
-export interface AuthContext {
-  pathname: string;
-  isPublicRoute: boolean;
-  isLoginPage: boolean;
-  searchParams: URLSearchParams;
-  sessionPointer: { exists: boolean; sessionToken?: string; expired?: boolean; hasRefreshToken?: boolean; };
-  sessionStatus: { exists: boolean | null; forceInvalid: boolean | null; requires2FA: boolean; twoFactorComplete: boolean; };
-  circuitBreakerOpen: boolean;
-}
-
-export type AuthAction = 
-  | { type: 'allow' }
-  | { type: 'redirect'; location: string; reason: string; clearCookies?: boolean }
-  | { type: 'service_error'; reason: string };
-
-export function makeAuthDecision(context: AuthContext): AuthAction {
-  const { pathname, isPublicRoute, isLoginPage, searchParams, sessionPointer, sessionStatus, circuitBreakerOpen } = context;
-  // SAFEGUARD: Never use auth pages as callback URLs to prevent redirect loops
-  const safeCallbackUrl = pathname.startsWith('/account-auth/') ? '/' : pathname;
-  if (isPublicRoute && !isLoginPage) return { type: 'allow' };
-  if (circuitBreakerOpen) { if (isLoginPage) return { type: 'allow' }; return { type: 'redirect', location: '/account-auth/login?error=ServiceUnavailable&reason=CircuitBreakerOpen', reason: 'CircuitBreakerOpen', clearCookies: true }; }
-  if (!sessionPointer.exists) { if (isLoginPage) return { type: 'allow' }; if (pathname === '/') { const unauthUrl = process.env.UNAUTHENTICATED_REDIRECT_URL || '/account-auth/login'; return { type: 'redirect', location: unauthUrl, reason: 'unauthenticated_root_redirect' }; } return { type: 'redirect', location: `/account-auth/login?callbackUrl=${encodeURIComponent(safeCallbackUrl)}`, reason: 'no_session_pointer' }; }
-  if (sessionStatus.exists === null || sessionStatus.forceInvalid === null) return { type: 'service_error', reason: 'redis_unavailable' };
-  if (sessionStatus.forceInvalid) { if (isLoginPage) return { type: 'allow' }; return { type: 'redirect', location: `/account-auth/login?callbackUrl=${encodeURIComponent(safeCallbackUrl)}&reason=force_invalidated`, reason: 'force_invalidated' }; }
-  if (!sessionStatus.exists) { if (isLoginPage) return { type: 'allow' }; return { type: 'redirect', location: `/account-auth/login?callbackUrl=${encodeURIComponent(safeCallbackUrl)}&reason=stale_session`, reason: 'stale_session' }; }
-  if (sessionStatus.requires2FA && !sessionStatus.twoFactorComplete) {
-    if (pathname === '/account-auth/verify-code') return { type: 'allow' };
-    if (isLoginPage) { const callbackUrl = searchParams.get('callbackUrl') || '/'; const safeCallbackUrl2 = callbackUrl.startsWith('/account-auth/') ? '/' : callbackUrl; return { type: 'redirect', location: `/account-auth/verify-code?callbackUrl=${encodeURIComponent(safeCallbackUrl2)}`, reason: '2fa_required_login_redirect' }; }
-    return { type: 'allow' };
-  }
-  if (sessionPointer.expired) { if (isLoginPage) return { type: 'allow' }; return { type: 'redirect', location: `/account-auth/login?callbackUrl=${encodeURIComponent(safeCallbackUrl)}&error=SessionExpired`, reason: 'token_expired' }; }
-  if (pathname === '/') return { type: 'redirect', location: '/', reason: 'authenticated_root_redirect' };
-  if (isLoginPage) { const callbackUrl = searchParams.get('callbackUrl') || '/'; const safeCallbackUrl = callbackUrl.startsWith('/account-auth/') ? '/' : callbackUrl; return { type: 'redirect', location: safeCallbackUrl, reason: 'already_authenticated' }; }
-  return { type: 'allow' };
-}
-
-export function isLoginPage(pathname: string): boolean { return pathname === '/account-auth/login'; }
-export function getCallbackUrl(pathname: string, searchParams: URLSearchParams): string { if (pathname.startsWith('/account-auth/')) return '/'; const existingCallback = searchParams.get('callbackUrl'); if (existingCallback && !existingCallback.startsWith('/account-auth/')) return existingCallback; return pathname; }
+/**
+ * Auth Decision Engine (lifted)
+ */
+import { NextRequest } from 'next/server';
+
+export interface AuthContext {
+  pathname: string;
+  isPublicRoute: boolean;
+  isLoginPage: boolean;
+  searchParams: URLSearchParams;
+  sessionPointer: { exists: boolean; sessionToken?: string; expired?: boolean; hasRefreshToken?: boolean; };
+  sessionStatus: { exists: boolean | null; forceInvalid: boolean | null; requires2FA: boolean; twoFactorComplete: boolean; };
+  circuitBreakerOpen: boolean;
+}
+
+export type AuthAction = 
+  | { type: 'allow' }
+  | { type: 'redirect'; location: string; reason: string; clearCookies?: boolean }
+  | { type: 'service_error'; reason: string };
+
+export function makeAuthDecision(context: AuthContext): AuthAction {
+  const { pathname, isPublicRoute, isLoginPage, searchParams, sessionPointer, sessionStatus, circuitBreakerOpen } = context;
+  // SAFEGUARD: Never use auth pages as callback URLs to prevent redirect loops
+  const safeCallbackUrl = pathname.startsWith('/account-auth/') ? '/' : pathname;
+  if (isPublicRoute && !isLoginPage) return { type: 'allow' };
+  if (circuitBreakerOpen) { if (isLoginPage) return { type: 'allow' }; return { type: 'redirect', location: '/account-auth/login?error=ServiceUnavailable&reason=CircuitBreakerOpen', reason: 'CircuitBreakerOpen', clearCookies: true }; }
+  if (!sessionPointer.exists) { if (isLoginPage) return { type: 'allow' }; if (pathname === '/') { const unauthUrl = process.env.UNAUTHENTICATED_REDIRECT_URL || '/account-auth/login'; return { type: 'redirect', location: unauthUrl, reason: 'unauthenticated_root_redirect' }; } return { type: 'redirect', location: `/account-auth/login?callbackUrl=${encodeURIComponent(safeCallbackUrl)}`, reason: 'no_session_pointer' }; }
+  if (sessionStatus.exists === null || sessionStatus.forceInvalid === null) return { type: 'service_error', reason: 'redis_unavailable' };
+  if (sessionStatus.forceInvalid) { if (isLoginPage) return { type: 'allow' }; return { type: 'redirect', location: `/account-auth/login?callbackUrl=${encodeURIComponent(safeCallbackUrl)}&reason=force_invalidated`, reason: 'force_invalidated' }; }
+  if (!sessionStatus.exists) { if (isLoginPage) return { type: 'allow' }; return { type: 'redirect', location: `/account-auth/login?callbackUrl=${encodeURIComponent(safeCallbackUrl)}&reason=stale_session`, reason: 'stale_session' }; }
+  if (sessionStatus.requires2FA && !sessionStatus.twoFactorComplete) {
+    if (pathname === '/account-auth/verify-code') return { type: 'allow' };
+    if (isLoginPage) { const callbackUrl = searchParams.get('callbackUrl') || '/'; const safeCallbackUrl2 = callbackUrl.startsWith('/account-auth/') ? '/' : callbackUrl; return { type: 'redirect', location: `/account-auth/verify-code?callbackUrl=${encodeURIComponent(safeCallbackUrl2)}`, reason: '2fa_required_login_redirect' }; }
+    return { type: 'redirect', location: `/account-auth/verify-code?callbackUrl=${encodeURIComponent(safeCallbackUrl)}`, reason: '2fa_required' };
+  }
+  if (sessionPointer.expired) { if (isLoginPage) return { type: 'allow' }; return { type: 'redirect', location: `/account-auth/login?callbackUrl=${encodeURIComponent(safeCallbackUrl)}&error=SessionExpired`, reason: 'token_expired' }; }
+  if (pathname === '/') return { type: 'redirect', location: '/', reason: 'authenticated_root_redirect' };
+  if (isLoginPage) { const callbackUrl = searchParams.get('callbackUrl') || '/'; const safeCallbackUrl = callbackUrl.startsWith('/account-auth/') ? '/' : callbackUrl; return { type: 'redirect', location: safeCallbackUrl, reason: 'already_authenticated' }; }
+  return { type: 'allow' };
+}
+
+export function isLoginPage(pathname: string): boolean { return pathname === '/account-auth/login'; }
+export function getCallbackUrl(pathname: string, searchParams: URLSearchParams): string { if (pathname.startsWith('/account-auth/')) return '/'; const existingCallback = searchParams.get('callbackUrl'); if (existingCallback && !existingCallback.startsWith('/account-auth/')) return existingCallback; return pathname; }