@payez/next-mvp 4.1.6 → 4.1.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/dist/api-handlers/session/viability.js +7 -2
  2. package/package.json +1 -1
  3. package/src/api-handlers/session/viability.ts +8 -2
package/dist/api-handlers/session/viability.js CHANGED
@@ -59,8 +59,7 @@ async function GET(req) {
59
59
  // Check if access token is expired (for middleware decision-making)
60
60
  const accessTokenExpires = sessionData.idpAccessTokenExpires || 0;
61
61
  const accessTokenExpired = accessTokenExpires < Date.now();
62
- // Get requires2FA from cached client config (not session)
63
- // This is a client-wide setting from the broker handshake
62
+ // Get requires2FA from cached client config (client-wide setting)
64
63
  let requires2FA = true; // Default to true for security
65
64
  try {
66
65
  const cachedConfig = await (0, idp_client_config_1.getIDPClientConfig)();
@@ -69,6 +68,12 @@ async function GET(req) {
69
68
  catch (e) {
70
69
  console.warn('[API Viability] Could not get client config, defaulting requires2FA to true');
71
70
  }
71
+ // CRITICAL: OAuth sessions without refresh token always need 2FA completion
72
+ // to obtain a refresh token from the IDP. The OAuth callback sets mfaVerified=false
73
+ // when no refresh_token is present. This must override the client config.
74
+ if (sessionData.mfaVerified === false && !sessionData.idpRefreshToken) {
75
+ requires2FA = true;
76
+ }
72
77
  // CRITICAL: Check if MFA has expired (2FA TTL enforcement)
73
78
  // The session may have mfaVerified=true from days ago, but if mfaExpiresAt
74
79
  // has passed, we must treat 2FA as incomplete to force re-verification.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@payez/next-mvp",
3
- "version": "4.1.6",
3
+ "version": "4.1.7",
4
4
  "sideEffects": false,
5
5
  "main": "dist/index.js",
6
6
  "types": "dist/index.d.ts",
package/src/api-handlers/session/viability.ts CHANGED
@@ -69,8 +69,7 @@ export async function GET(req: NextRequest) {
69
69
  const accessTokenExpires = sessionData.idpAccessTokenExpires || 0;
70
70
  const accessTokenExpired = accessTokenExpires < Date.now();
71
71
 
72
- // Get requires2FA from cached client config (not session)
73
- // This is a client-wide setting from the broker handshake
72
+ // Get requires2FA from cached client config (client-wide setting)
74
73
  let requires2FA = true; // Default to true for security
75
74
  try {
76
75
  const cachedConfig = await getIDPClientConfig();
@@ -79,6 +78,13 @@ export async function GET(req: NextRequest) {
79
78
  console.warn('[API Viability] Could not get client config, defaulting requires2FA to true');
80
79
  }
81
80
 
81
+ // CRITICAL: OAuth sessions without refresh token always need 2FA completion
82
+ // to obtain a refresh token from the IDP. The OAuth callback sets mfaVerified=false
83
+ // when no refresh_token is present. This must override the client config.
84
+ if (sessionData.mfaVerified === false && !sessionData.idpRefreshToken) {
85
+ requires2FA = true;
86
+ }
87
+
82
88
  // CRITICAL: Check if MFA has expired (2FA TTL enforcement)
83
89
  // The session may have mfaVerified=true from days ago, but if mfaExpiresAt
84
90
  // has passed, we must treat 2FA as incomplete to force re-verification.