@payez/next-mvp 4.1.5 → 4.1.7

package/dist/api-handlers/session/viability.js

@@ -59,8 +59,7 @@ async function GET(req) {
                 // Check if access token is expired (for middleware decision-making)
                 const accessTokenExpires = sessionData.idpAccessTokenExpires || 0;
                 const accessTokenExpired = accessTokenExpires < Date.now();
-                // Get requires2FA from cached client config (not session)
-                // This is a client-wide setting from the broker handshake
+                // Get requires2FA from cached client config (client-wide setting)
                 let requires2FA = true; // Default to true for security
                 try {
                     const cachedConfig = await (0, idp_client_config_1.getIDPClientConfig)();
@@ -69,6 +68,12 @@ async function GET(req) {
                 catch (e) {
                     console.warn('[API Viability] Could not get client config, defaulting requires2FA to true');
                 }
+                // CRITICAL: OAuth sessions without refresh token always need 2FA completion
+                // to obtain a refresh token from the IDP. The OAuth callback sets mfaVerified=false
+                // when no refresh_token is present. This must override the client config.
+                if (sessionData.mfaVerified === false && !sessionData.idpRefreshToken) {
+                    requires2FA = true;
+                }
                 // CRITICAL: Check if MFA has expired (2FA TTL enforcement)
                 // The session may have mfaVerified=true from days ago, but if mfaExpiresAt
                 // has passed, we must treat 2FA as incomplete to force re-verification.

package/dist/middleware/auth-decision.js

@@ -43,7 +43,7 @@ function makeAuthDecision(context) {
             const safeCallbackUrl2 = callbackUrl.startsWith('/account-auth/') ? '/' : callbackUrl;
             return { type: 'redirect', location: `/account-auth/verify-code?callbackUrl=${encodeURIComponent(safeCallbackUrl2)}`, reason: '2fa_required_login_redirect' };
         }
-        return { type: 'allow' };
+        return { type: 'redirect', location: `/account-auth/verify-code?callbackUrl=${encodeURIComponent(safeCallbackUrl)}`, reason: '2fa_required' };
     }
     if (sessionPointer.expired) {
         if (isLoginPage)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "4.1.5",
+  "version": "4.1.7",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/api-handlers/session/viability.ts

@@ -69,8 +69,7 @@ export async function GET(req: NextRequest) {
         const accessTokenExpires = sessionData.idpAccessTokenExpires || 0;
         const accessTokenExpired = accessTokenExpires < Date.now();
 
-        // Get requires2FA from cached client config (not session)
-        // This is a client-wide setting from the broker handshake
+        // Get requires2FA from cached client config (client-wide setting)
         let requires2FA = true; // Default to true for security
         try {
           const cachedConfig = await getIDPClientConfig();
@@ -79,6 +78,13 @@ export async function GET(req: NextRequest) {
           console.warn('[API Viability] Could not get client config, defaulting requires2FA to true');
         }
 
+        // CRITICAL: OAuth sessions without refresh token always need 2FA completion
+        // to obtain a refresh token from the IDP. The OAuth callback sets mfaVerified=false
+        // when no refresh_token is present. This must override the client config.
+        if (sessionData.mfaVerified === false && !sessionData.idpRefreshToken) {
+          requires2FA = true;
+        }
+
         // CRITICAL: Check if MFA has expired (2FA TTL enforcement)
         // The session may have mfaVerified=true from days ago, but if mfaExpiresAt
         // has passed, we must treat 2FA as incomplete to force re-verification.

package/src/middleware/auth-decision.ts

@@ -1,43 +1,43 @@
-/**
- * Auth Decision Engine (lifted)
- */
-import { NextRequest } from 'next/server';
-
-export interface AuthContext {
-  pathname: string;
-  isPublicRoute: boolean;
-  isLoginPage: boolean;
-  searchParams: URLSearchParams;
-  sessionPointer: { exists: boolean; sessionToken?: string; expired?: boolean; hasRefreshToken?: boolean; };
-  sessionStatus: { exists: boolean | null; forceInvalid: boolean | null; requires2FA: boolean; twoFactorComplete: boolean; };
-  circuitBreakerOpen: boolean;
-}
-
-export type AuthAction = 
-  | { type: 'allow' }
-  | { type: 'redirect'; location: string; reason: string; clearCookies?: boolean }
-  | { type: 'service_error'; reason: string };
-
-export function makeAuthDecision(context: AuthContext): AuthAction {
-  const { pathname, isPublicRoute, isLoginPage, searchParams, sessionPointer, sessionStatus, circuitBreakerOpen } = context;
-  // SAFEGUARD: Never use auth pages as callback URLs to prevent redirect loops
-  const safeCallbackUrl = pathname.startsWith('/account-auth/') ? '/' : pathname;
-  if (isPublicRoute && !isLoginPage) return { type: 'allow' };
-  if (circuitBreakerOpen) { if (isLoginPage) return { type: 'allow' }; return { type: 'redirect', location: '/account-auth/login?error=ServiceUnavailable&reason=CircuitBreakerOpen', reason: 'CircuitBreakerOpen', clearCookies: true }; }
-  if (!sessionPointer.exists) { if (isLoginPage) return { type: 'allow' }; if (pathname === '/') { const unauthUrl = process.env.UNAUTHENTICATED_REDIRECT_URL || '/account-auth/login'; return { type: 'redirect', location: unauthUrl, reason: 'unauthenticated_root_redirect' }; } return { type: 'redirect', location: `/account-auth/login?callbackUrl=${encodeURIComponent(safeCallbackUrl)}`, reason: 'no_session_pointer' }; }
-  if (sessionStatus.exists === null || sessionStatus.forceInvalid === null) return { type: 'service_error', reason: 'redis_unavailable' };
-  if (sessionStatus.forceInvalid) { if (isLoginPage) return { type: 'allow' }; return { type: 'redirect', location: `/account-auth/login?callbackUrl=${encodeURIComponent(safeCallbackUrl)}&reason=force_invalidated`, reason: 'force_invalidated' }; }
-  if (!sessionStatus.exists) { if (isLoginPage) return { type: 'allow' }; return { type: 'redirect', location: `/account-auth/login?callbackUrl=${encodeURIComponent(safeCallbackUrl)}&reason=stale_session`, reason: 'stale_session' }; }
-  if (sessionStatus.requires2FA && !sessionStatus.twoFactorComplete) {
-    if (pathname === '/account-auth/verify-code') return { type: 'allow' };
-    if (isLoginPage) { const callbackUrl = searchParams.get('callbackUrl') || '/'; const safeCallbackUrl2 = callbackUrl.startsWith('/account-auth/') ? '/' : callbackUrl; return { type: 'redirect', location: `/account-auth/verify-code?callbackUrl=${encodeURIComponent(safeCallbackUrl2)}`, reason: '2fa_required_login_redirect' }; }
-    return { type: 'allow' };
-  }
-  if (sessionPointer.expired) { if (isLoginPage) return { type: 'allow' }; return { type: 'redirect', location: `/account-auth/login?callbackUrl=${encodeURIComponent(safeCallbackUrl)}&error=SessionExpired`, reason: 'token_expired' }; }
-  if (pathname === '/') return { type: 'redirect', location: '/', reason: 'authenticated_root_redirect' };
-  if (isLoginPage) { const callbackUrl = searchParams.get('callbackUrl') || '/'; const safeCallbackUrl = callbackUrl.startsWith('/account-auth/') ? '/' : callbackUrl; return { type: 'redirect', location: safeCallbackUrl, reason: 'already_authenticated' }; }
-  return { type: 'allow' };
-}
-
-export function isLoginPage(pathname: string): boolean { return pathname === '/account-auth/login'; }
-export function getCallbackUrl(pathname: string, searchParams: URLSearchParams): string { if (pathname.startsWith('/account-auth/')) return '/'; const existingCallback = searchParams.get('callbackUrl'); if (existingCallback && !existingCallback.startsWith('/account-auth/')) return existingCallback; return pathname; }
+/**
+ * Auth Decision Engine (lifted)
+ */
+import { NextRequest } from 'next/server';
+
+export interface AuthContext {
+  pathname: string;
+  isPublicRoute: boolean;
+  isLoginPage: boolean;
+  searchParams: URLSearchParams;
+  sessionPointer: { exists: boolean; sessionToken?: string; expired?: boolean; hasRefreshToken?: boolean; };
+  sessionStatus: { exists: boolean | null; forceInvalid: boolean | null; requires2FA: boolean; twoFactorComplete: boolean; };
+  circuitBreakerOpen: boolean;
+}
+
+export type AuthAction = 
+  | { type: 'allow' }
+  | { type: 'redirect'; location: string; reason: string; clearCookies?: boolean }
+  | { type: 'service_error'; reason: string };
+
+export function makeAuthDecision(context: AuthContext): AuthAction {
+  const { pathname, isPublicRoute, isLoginPage, searchParams, sessionPointer, sessionStatus, circuitBreakerOpen } = context;
+  // SAFEGUARD: Never use auth pages as callback URLs to prevent redirect loops
+  const safeCallbackUrl = pathname.startsWith('/account-auth/') ? '/' : pathname;
+  if (isPublicRoute && !isLoginPage) return { type: 'allow' };
+  if (circuitBreakerOpen) { if (isLoginPage) return { type: 'allow' }; return { type: 'redirect', location: '/account-auth/login?error=ServiceUnavailable&reason=CircuitBreakerOpen', reason: 'CircuitBreakerOpen', clearCookies: true }; }
+  if (!sessionPointer.exists) { if (isLoginPage) return { type: 'allow' }; if (pathname === '/') { const unauthUrl = process.env.UNAUTHENTICATED_REDIRECT_URL || '/account-auth/login'; return { type: 'redirect', location: unauthUrl, reason: 'unauthenticated_root_redirect' }; } return { type: 'redirect', location: `/account-auth/login?callbackUrl=${encodeURIComponent(safeCallbackUrl)}`, reason: 'no_session_pointer' }; }
+  if (sessionStatus.exists === null || sessionStatus.forceInvalid === null) return { type: 'service_error', reason: 'redis_unavailable' };
+  if (sessionStatus.forceInvalid) { if (isLoginPage) return { type: 'allow' }; return { type: 'redirect', location: `/account-auth/login?callbackUrl=${encodeURIComponent(safeCallbackUrl)}&reason=force_invalidated`, reason: 'force_invalidated' }; }
+  if (!sessionStatus.exists) { if (isLoginPage) return { type: 'allow' }; return { type: 'redirect', location: `/account-auth/login?callbackUrl=${encodeURIComponent(safeCallbackUrl)}&reason=stale_session`, reason: 'stale_session' }; }
+  if (sessionStatus.requires2FA && !sessionStatus.twoFactorComplete) {
+    if (pathname === '/account-auth/verify-code') return { type: 'allow' };
+    if (isLoginPage) { const callbackUrl = searchParams.get('callbackUrl') || '/'; const safeCallbackUrl2 = callbackUrl.startsWith('/account-auth/') ? '/' : callbackUrl; return { type: 'redirect', location: `/account-auth/verify-code?callbackUrl=${encodeURIComponent(safeCallbackUrl2)}`, reason: '2fa_required_login_redirect' }; }
+    return { type: 'redirect', location: `/account-auth/verify-code?callbackUrl=${encodeURIComponent(safeCallbackUrl)}`, reason: '2fa_required' };
+  }
+  if (sessionPointer.expired) { if (isLoginPage) return { type: 'allow' }; return { type: 'redirect', location: `/account-auth/login?callbackUrl=${encodeURIComponent(safeCallbackUrl)}&error=SessionExpired`, reason: 'token_expired' }; }
+  if (pathname === '/') return { type: 'redirect', location: '/', reason: 'authenticated_root_redirect' };
+  if (isLoginPage) { const callbackUrl = searchParams.get('callbackUrl') || '/'; const safeCallbackUrl = callbackUrl.startsWith('/account-auth/') ? '/' : callbackUrl; return { type: 'redirect', location: safeCallbackUrl, reason: 'already_authenticated' }; }
+  return { type: 'allow' };
+}
+
+export function isLoginPage(pathname: string): boolean { return pathname === '/account-auth/login'; }
+export function getCallbackUrl(pathname: string, searchParams: URLSearchParams): string { if (pathname.startsWith('/account-auth/')) return '/'; const existingCallback = searchParams.get('callbackUrl'); if (existingCallback && !existingCallback.startsWith('/account-auth/')) return existingCallback; return pathname; }