@payez/next-mvp 4.1.6 → 4.1.8

package/dist/api-handlers/session/viability.js

@@ -59,8 +59,7 @@ async function GET(req) {
                 // Check if access token is expired (for middleware decision-making)
                 const accessTokenExpires = sessionData.idpAccessTokenExpires || 0;
                 const accessTokenExpired = accessTokenExpires < Date.now();
-                // Get requires2FA from cached client config (not session)
-                // This is a client-wide setting from the broker handshake
+                // Get requires2FA from cached client config (client-wide setting)
                 let requires2FA = true; // Default to true for security
                 try {
                     const cachedConfig = await (0, idp_client_config_1.getIDPClientConfig)();
@@ -69,6 +68,12 @@ async function GET(req) {
                 catch (e) {
                     console.warn('[API Viability] Could not get client config, defaulting requires2FA to true');
                 }
+                // CRITICAL: OAuth sessions without refresh token always need 2FA completion
+                // to obtain a refresh token from the IDP. The OAuth callback sets mfaVerified=false
+                // when no refresh_token is present. This must override the client config.
+                if (sessionData.mfaVerified === false && !sessionData.idpRefreshToken) {
+                    requires2FA = true;
+                }
                 // CRITICAL: Check if MFA has expired (2FA TTL enforcement)
                 // The session may have mfaVerified=true from days ago, but if mfaExpiresAt
                 // has passed, we must treat 2FA as incomplete to force re-verification.

package/dist/lib/idp-fetch.js

@@ -67,6 +67,14 @@ async function ensureFreshAccessToken(req) {
         return {};
     }
     let session = await (0, session_store_1.getSession)(sessionToken);
+    // Fall back to Better Auth Redis key when app session is missing/stale
+    if (!session || !session.idpAccessToken) {
+        const { getBetterAuthSession } = await Promise.resolve().then(() => __importStar(require('./session-store')));
+        const baSession = await getBetterAuthSession(sessionToken);
+        if (baSession?.idpAccessToken) {
+            session = baSession;
+        }
+    }
     // Fall back to Better Auth: decode session from cookies to get IDP tokens
     if (!session?.idpAccessToken) {
         try {
@@ -81,28 +89,34 @@ async function ensureFreshAccessToken(req) {
     console.log('[IDP_FETCH] Redis session lookup:', {
         hasSession: !!session,
         hasAccessToken: !!session?.idpAccessToken,
+        hasRefreshToken: !!session?.idpRefreshToken,
         bearerKeyId: session?.bearerKeyId || 'NOT_SET',
         idpClientId: session?.idpClientId || 'NOT_SET',
     });
     if (!session?.idpAccessToken)
         return { sessionToken };
+    const hasRefreshToken = !!session.idpRefreshToken;
     const now = Date.now();
     const timeLeft = (session.idpAccessTokenExpires ?? now) - now;
     // Treat tokens as effectively expired if within 5 minutes of expiry
     if (timeLeft > 5 * 60 * 1000) {
-        return { sessionToken, accessToken: session.idpAccessToken };
+        return { sessionToken, accessToken: session.idpAccessToken, hasRefreshToken };
     }
-    // attempt refresh once via centralized internal API helper
-    try {
-        await (0, internal_api_1.internalRefresh)(req.headers.get('cookie') || '', sessionToken);
+    // Only attempt refresh when we actually have a refresh token to use.
+    // Provisional tokens (issued before 2FA completion) have no refresh token.
+    if (hasRefreshToken) {
+        try {
+            await (0, internal_api_1.internalRefresh)(req.headers.get('cookie') || '', sessionToken);
+        }
+        catch { }
+        session = await (0, session_store_1.getSession)(sessionToken);
+        return { sessionToken, accessToken: session?.idpAccessToken, hasRefreshToken: !!session?.idpRefreshToken };
     }
-    catch { }
-    session = await (0, session_store_1.getSession)(sessionToken);
-    return { sessionToken, accessToken: session?.idpAccessToken };
+    return { sessionToken, accessToken: session.idpAccessToken, hasRefreshToken };
 }
 async function idpFetchJSON(req, targetUrl, init = {}) {
     let attemptedRefresh = false;
-    let { accessToken, sessionToken } = await ensureFreshAccessToken(req);
+    let { accessToken, sessionToken, hasRefreshToken } = await ensureFreshAccessToken(req);
     const makeCall = async (bearer) => {
         const res = await fetch(targetUrl, {
             ...init,
@@ -119,7 +133,9 @@ async function idpFetchJSON(req, targetUrl, init = {}) {
     };
     // First attempt
     let { res, json } = await makeCall(accessToken);
-    if ((res.status === 401 || res.status === 403) && sessionToken && !attemptedRefresh) {
+    // Only attempt refresh on 401/403 if we actually have a refresh token.
+    // Provisional tokens (pre-2FA) have no refresh token — refreshing is futile.
+    if ((res.status === 401 || res.status === 403) && sessionToken && hasRefreshToken && !attemptedRefresh) {
         attemptedRefresh = true;
         try {
             // Use centralized internal API helper for server-to-server calls

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "4.1.6",
+  "version": "4.1.8",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/api-handlers/session/viability.ts

@@ -69,8 +69,7 @@ export async function GET(req: NextRequest) {
         const accessTokenExpires = sessionData.idpAccessTokenExpires || 0;
         const accessTokenExpired = accessTokenExpires < Date.now();
 
-        // Get requires2FA from cached client config (not session)
-        // This is a client-wide setting from the broker handshake
+        // Get requires2FA from cached client config (client-wide setting)
         let requires2FA = true; // Default to true for security
         try {
           const cachedConfig = await getIDPClientConfig();
@@ -79,6 +78,13 @@ export async function GET(req: NextRequest) {
           console.warn('[API Viability] Could not get client config, defaulting requires2FA to true');
         }
 
+        // CRITICAL: OAuth sessions without refresh token always need 2FA completion
+        // to obtain a refresh token from the IDP. The OAuth callback sets mfaVerified=false
+        // when no refresh_token is present. This must override the client config.
+        if (sessionData.mfaVerified === false && !sessionData.idpRefreshToken) {
+          requires2FA = true;
+        }
+
         // CRITICAL: Check if MFA has expired (2FA TTL enforcement)
         // The session may have mfaVerified=true from days ago, but if mfaExpiresAt
         // has passed, we must treat 2FA as incomplete to force re-verification.

package/src/lib/idp-fetch.ts

@@ -1,111 +1,127 @@
-import { NextRequest } from 'next/server';
-import { getTokenTestAware } from './test-aware-get-token';
-import { getSession } from './session-store';
-import { internalRefresh } from './internal-api';
-
-/**
- * Centralized IDP fetch helper
- * - Injects Bearer from Redis session
- * - If access token is expired/near-expiry, triggers one refresh and retries fetch once
- * - Returns parsed JSON and HTTP status
- */
-export interface IdpFetchResult<T = any> {
-  ok: boolean;
-  status: number;
-  json: T | null;
-  attemptedRefresh: boolean;
-}
-
-function buildHeaders(req: NextRequest, bearer?: string, extra?: Record<string, string>) {
-  const headers: Record<string, string> = {
-    Accept: 'application/json',
-    'Content-Type': 'application/json',
-    ...extra,
-  };
-  const xfwd = req.headers.get('x-forwarded-for') || req.headers.get('x-real-ip');
-  if (xfwd) headers['X-Forwarded-For'] = xfwd.split(',')[0].trim();
-  const ua = req.headers.get('user-agent');
-  if (ua) headers['User-Agent'] = ua;
-  if (bearer) headers['Authorization'] = `Bearer ${bearer}`;
-  return headers;
-}
-
-async function ensureFreshAccessToken(req: NextRequest): Promise<{ sessionToken?: string; accessToken?: string }> {
-  const token = await getTokenTestAware(req);
-  // Support both field names: sessionToken (auth.ts JWT) and redisSessionId (legacy)
-  const sessionToken = (token?.sessionToken || token?.redisSessionId) as string | undefined;
-  console.log('[IDP_FETCH] ensureFreshAccessToken:', {
-    hasToken: !!token,
-    sessionToken: sessionToken?.substring(0, 20) + '...',
-    pathname: req.nextUrl.pathname
-  });
-  if (!sessionToken) {
-    console.warn('[IDP_FETCH] No sessionToken found in JWT - Bearer token will NOT be sent!');
-    return {};
-  }
-  let session = await getSession(sessionToken);
-  // Fall back to Better Auth: decode session from cookies to get IDP tokens
-  if (!session?.idpAccessToken) {
-    try {
-      const { decodeSession } = await import('../server/decode-session');
-      const decoded = await decodeSession(req.cookies);
-      if (decoded?.sessionData?.idpAccessToken) {
-        session = decoded.sessionData;
-      }
-    } catch { /* decodeSession unavailable in edge */ }
-  }
-  console.log('[IDP_FETCH] Redis session lookup:', {
-    hasSession: !!session,
-    hasAccessToken: !!session?.idpAccessToken,
-    bearerKeyId: session?.bearerKeyId || 'NOT_SET',
-    idpClientId: session?.idpClientId || 'NOT_SET',
-  });
-  if (!session?.idpAccessToken) return { sessionToken };
-  const now = Date.now();
-  const timeLeft = (session.idpAccessTokenExpires ?? now) - now;
-  // Treat tokens as effectively expired if within 5 minutes of expiry
-  if (timeLeft > 5 * 60 * 1000) {
-    return { sessionToken, accessToken: session.idpAccessToken };
-  }
-  // attempt refresh once via centralized internal API helper
-  try {
-    await internalRefresh(req.headers.get('cookie') || '', sessionToken);
-  } catch {}
-  session = await getSession(sessionToken);
-  return { sessionToken, accessToken: session?.idpAccessToken };
-}
-
-export async function idpFetchJSON<T = any>(
-  req: NextRequest,
-  targetUrl: string,
-  init: RequestInit = {}
-): Promise<IdpFetchResult<T>> {
-  let attemptedRefresh = false;
-  let { accessToken, sessionToken } = await ensureFreshAccessToken(req);
-
-  const makeCall = async (bearer?: string) => {
-    const res = await fetch(targetUrl, {
-      ...init,
-      headers: buildHeaders(req, bearer, init.headers as any),
-    });
-    let json: any = null;
-    try { json = await res.json(); } catch { json = null; }
-    return { res, json } as const;
-  };
-
-  // First attempt
-  let { res, json } = await makeCall(accessToken);
-  if ((res.status === 401 || res.status === 403) && sessionToken && !attemptedRefresh) {
-    attemptedRefresh = true;
-    try {
-      // Use centralized internal API helper for server-to-server calls
-      const rf = await internalRefresh(req.headers.get('cookie') || '', sessionToken);
-      if (rf.ok) {
-        const fresh = await getSession(sessionToken);
-        ({ res, json } = await makeCall(fresh?.idpAccessToken));
-      }
-    } catch {}
-  }
-
-  return { ok: res.ok, status: res.status, json: json as T | null, attemptedRefresh };
+import { NextRequest } from 'next/server';
+import { getTokenTestAware } from './test-aware-get-token';
+import { getSession } from './session-store';
+import { internalRefresh } from './internal-api';
+
+/**
+ * Centralized IDP fetch helper
+ * - Injects Bearer from Redis session
+ * - If access token is expired/near-expiry, triggers one refresh and retries fetch once
+ * - Returns parsed JSON and HTTP status
+ */
+export interface IdpFetchResult<T = any> {
+  ok: boolean;
+  status: number;
+  json: T | null;
+  attemptedRefresh: boolean;
+}
+
+function buildHeaders(req: NextRequest, bearer?: string, extra?: Record<string, string>) {
+  const headers: Record<string, string> = {
+    Accept: 'application/json',
+    'Content-Type': 'application/json',
+    ...extra,
+  };
+  const xfwd = req.headers.get('x-forwarded-for') || req.headers.get('x-real-ip');
+  if (xfwd) headers['X-Forwarded-For'] = xfwd.split(',')[0].trim();
+  const ua = req.headers.get('user-agent');
+  if (ua) headers['User-Agent'] = ua;
+  if (bearer) headers['Authorization'] = `Bearer ${bearer}`;
+  return headers;
+}
+
+async function ensureFreshAccessToken(req: NextRequest): Promise<{ sessionToken?: string; accessToken?: string; hasRefreshToken?: boolean }> {
+  const token = await getTokenTestAware(req);
+  // Support both field names: sessionToken (auth.ts JWT) and redisSessionId (legacy)
+  const sessionToken = (token?.sessionToken || token?.redisSessionId) as string | undefined;
+  console.log('[IDP_FETCH] ensureFreshAccessToken:', {
+    hasToken: !!token,
+    sessionToken: sessionToken?.substring(0, 20) + '...',
+    pathname: req.nextUrl.pathname
+  });
+  if (!sessionToken) {
+    console.warn('[IDP_FETCH] No sessionToken found in JWT - Bearer token will NOT be sent!');
+    return {};
+  }
+  let session = await getSession(sessionToken);
+  // Fall back to Better Auth Redis key when app session is missing/stale
+  if (!session || !session.idpAccessToken) {
+    const { getBetterAuthSession } = await import('./session-store');
+    const baSession = await getBetterAuthSession(sessionToken);
+    if (baSession?.idpAccessToken) {
+      session = baSession;
+    }
+  }
+  // Fall back to Better Auth: decode session from cookies to get IDP tokens
+  if (!session?.idpAccessToken) {
+    try {
+      const { decodeSession } = await import('../server/decode-session');
+      const decoded = await decodeSession(req.cookies);
+      if (decoded?.sessionData?.idpAccessToken) {
+        session = decoded.sessionData;
+      }
+    } catch { /* decodeSession unavailable in edge */ }
+  }
+  console.log('[IDP_FETCH] Redis session lookup:', {
+    hasSession: !!session,
+    hasAccessToken: !!session?.idpAccessToken,
+    hasRefreshToken: !!session?.idpRefreshToken,
+    bearerKeyId: session?.bearerKeyId || 'NOT_SET',
+    idpClientId: session?.idpClientId || 'NOT_SET',
+  });
+  if (!session?.idpAccessToken) return { sessionToken };
+  const hasRefreshToken = !!session.idpRefreshToken;
+  const now = Date.now();
+  const timeLeft = (session.idpAccessTokenExpires ?? now) - now;
+  // Treat tokens as effectively expired if within 5 minutes of expiry
+  if (timeLeft > 5 * 60 * 1000) {
+    return { sessionToken, accessToken: session.idpAccessToken, hasRefreshToken };
+  }
+  // Only attempt refresh when we actually have a refresh token to use.
+  // Provisional tokens (issued before 2FA completion) have no refresh token.
+  if (hasRefreshToken) {
+    try {
+      await internalRefresh(req.headers.get('cookie') || '', sessionToken);
+    } catch {}
+    session = await getSession(sessionToken);
+    return { sessionToken, accessToken: session?.idpAccessToken, hasRefreshToken: !!session?.idpRefreshToken };
+  }
+  return { sessionToken, accessToken: session.idpAccessToken, hasRefreshToken };
+}
+
+export async function idpFetchJSON<T = any>(
+  req: NextRequest,
+  targetUrl: string,
+  init: RequestInit = {}
+): Promise<IdpFetchResult<T>> {
+  let attemptedRefresh = false;
+  let { accessToken, sessionToken, hasRefreshToken } = await ensureFreshAccessToken(req);
+
+  const makeCall = async (bearer?: string) => {
+    const res = await fetch(targetUrl, {
+      ...init,
+      headers: buildHeaders(req, bearer, init.headers as any),
+    });
+    let json: any = null;
+    try { json = await res.json(); } catch { json = null; }
+    return { res, json } as const;
+  };
+
+  // First attempt
+  let { res, json } = await makeCall(accessToken);
+  // Only attempt refresh on 401/403 if we actually have a refresh token.
+  // Provisional tokens (pre-2FA) have no refresh token — refreshing is futile.
+  if ((res.status === 401 || res.status === 403) && sessionToken && hasRefreshToken && !attemptedRefresh) {
+    attemptedRefresh = true;
+    try {
+      // Use centralized internal API helper for server-to-server calls
+      const rf = await internalRefresh(req.headers.get('cookie') || '', sessionToken);
+      if (rf.ok) {
+        const fresh = await getSession(sessionToken);
+        ({ res, json } = await makeCall(fresh?.idpAccessToken));
+      }
+    } catch {}
+  }
+
+  return { ok: res.ok, status: res.status, json: json as T | null, attemptedRefresh };
 }