@payez/next-mvp 4.1.7 → 4.1.9

package/src/lib/idp-fetch.ts

@@ -1,111 +1,111 @@
-import { NextRequest } from 'next/server';
-import { getTokenTestAware } from './test-aware-get-token';
-import { getSession } from './session-store';
-import { internalRefresh } from './internal-api';
-
-/**
- * Centralized IDP fetch helper
- * - Injects Bearer from Redis session
- * - If access token is expired/near-expiry, triggers one refresh and retries fetch once
- * - Returns parsed JSON and HTTP status
- */
-export interface IdpFetchResult<T = any> {
-  ok: boolean;
-  status: number;
-  json: T | null;
-  attemptedRefresh: boolean;
-}
-
-function buildHeaders(req: NextRequest, bearer?: string, extra?: Record<string, string>) {
-  const headers: Record<string, string> = {
-    Accept: 'application/json',
-    'Content-Type': 'application/json',
-    ...extra,
-  };
-  const xfwd = req.headers.get('x-forwarded-for') || req.headers.get('x-real-ip');
-  if (xfwd) headers['X-Forwarded-For'] = xfwd.split(',')[0].trim();
-  const ua = req.headers.get('user-agent');
-  if (ua) headers['User-Agent'] = ua;
-  if (bearer) headers['Authorization'] = `Bearer ${bearer}`;
-  return headers;
-}
-
-async function ensureFreshAccessToken(req: NextRequest): Promise<{ sessionToken?: string; accessToken?: string }> {
-  const token = await getTokenTestAware(req);
-  // Support both field names: sessionToken (auth.ts JWT) and redisSessionId (legacy)
-  const sessionToken = (token?.sessionToken || token?.redisSessionId) as string | undefined;
-  console.log('[IDP_FETCH] ensureFreshAccessToken:', {
-    hasToken: !!token,
-    sessionToken: sessionToken?.substring(0, 20) + '...',
-    pathname: req.nextUrl.pathname
-  });
-  if (!sessionToken) {
-    console.warn('[IDP_FETCH] No sessionToken found in JWT - Bearer token will NOT be sent!');
-    return {};
-  }
-  let session = await getSession(sessionToken);
-  // Fall back to Better Auth: decode session from cookies to get IDP tokens
-  if (!session?.idpAccessToken) {
-    try {
-      const { decodeSession } = await import('../server/decode-session');
-      const decoded = await decodeSession(req.cookies);
-      if (decoded?.sessionData?.idpAccessToken) {
-        session = decoded.sessionData;
-      }
-    } catch { /* decodeSession unavailable in edge */ }
-  }
-  console.log('[IDP_FETCH] Redis session lookup:', {
-    hasSession: !!session,
-    hasAccessToken: !!session?.idpAccessToken,
-    bearerKeyId: session?.bearerKeyId || 'NOT_SET',
-    idpClientId: session?.idpClientId || 'NOT_SET',
-  });
-  if (!session?.idpAccessToken) return { sessionToken };
-  const now = Date.now();
-  const timeLeft = (session.idpAccessTokenExpires ?? now) - now;
-  // Treat tokens as effectively expired if within 5 minutes of expiry
-  if (timeLeft > 5 * 60 * 1000) {
-    return { sessionToken, accessToken: session.idpAccessToken };
-  }
-  // attempt refresh once via centralized internal API helper
-  try {
-    await internalRefresh(req.headers.get('cookie') || '', sessionToken);
-  } catch {}
-  session = await getSession(sessionToken);
-  return { sessionToken, accessToken: session?.idpAccessToken };
-}
-
-export async function idpFetchJSON<T = any>(
-  req: NextRequest,
-  targetUrl: string,
-  init: RequestInit = {}
-): Promise<IdpFetchResult<T>> {
-  let attemptedRefresh = false;
-  let { accessToken, sessionToken } = await ensureFreshAccessToken(req);
-
-  const makeCall = async (bearer?: string) => {
-    const res = await fetch(targetUrl, {
-      ...init,
-      headers: buildHeaders(req, bearer, init.headers as any),
-    });
-    let json: any = null;
-    try { json = await res.json(); } catch { json = null; }
-    return { res, json } as const;
-  };
-
-  // First attempt
-  let { res, json } = await makeCall(accessToken);
-  if ((res.status === 401 || res.status === 403) && sessionToken && !attemptedRefresh) {
-    attemptedRefresh = true;
-    try {
-      // Use centralized internal API helper for server-to-server calls
-      const rf = await internalRefresh(req.headers.get('cookie') || '', sessionToken);
-      if (rf.ok) {
-        const fresh = await getSession(sessionToken);
-        ({ res, json } = await makeCall(fresh?.idpAccessToken));
-      }
-    } catch {}
-  }
-
-  return { ok: res.ok, status: res.status, json: json as T | null, attemptedRefresh };
+import { NextRequest } from 'next/server';
+import { getTokenTestAware } from './test-aware-get-token';
+import { getSession } from './session-store';
+import { internalRefresh } from './internal-api';
+
+/**
+ * Centralized IDP fetch helper
+ * - Injects Bearer from Redis session
+ * - If access token is expired/near-expiry, triggers one refresh and retries fetch once
+ * - Returns parsed JSON and HTTP status
+ */
+export interface IdpFetchResult<T = any> {
+  ok: boolean;
+  status: number;
+  json: T | null;
+  attemptedRefresh: boolean;
+}
+
+function buildHeaders(req: NextRequest, bearer?: string, extra?: Record<string, string>) {
+  const headers: Record<string, string> = {
+    Accept: 'application/json',
+    'Content-Type': 'application/json',
+    ...extra,
+  };
+  const xfwd = req.headers.get('x-forwarded-for') || req.headers.get('x-real-ip');
+  if (xfwd) headers['X-Forwarded-For'] = xfwd.split(',')[0].trim();
+  const ua = req.headers.get('user-agent');
+  if (ua) headers['User-Agent'] = ua;
+  if (bearer) headers['Authorization'] = `Bearer ${bearer}`;
+  return headers;
+}
+
+async function ensureFreshAccessToken(req: NextRequest): Promise<{ sessionToken?: string; accessToken?: string }> {
+  const token = await getTokenTestAware(req);
+  // Support both field names: sessionToken (auth.ts JWT) and redisSessionId (legacy)
+  const sessionToken = (token?.sessionToken || token?.redisSessionId) as string | undefined;
+  console.log('[IDP_FETCH] ensureFreshAccessToken:', {
+    hasToken: !!token,
+    sessionToken: sessionToken?.substring(0, 20) + '...',
+    pathname: req.nextUrl.pathname
+  });
+  if (!sessionToken) {
+    console.warn('[IDP_FETCH] No sessionToken found in JWT - Bearer token will NOT be sent!');
+    return {};
+  }
+  let session = await getSession(sessionToken);
+  // Fall back to Better Auth: decode session from cookies to get IDP tokens
+  if (!session?.idpAccessToken) {
+    try {
+      const { decodeSession } = await import('../server/decode-session');
+      const decoded = await decodeSession(req.cookies);
+      if (decoded?.sessionData?.idpAccessToken) {
+        session = decoded.sessionData;
+      }
+    } catch { /* decodeSession unavailable in edge */ }
+  }
+  console.log('[IDP_FETCH] Redis session lookup:', {
+    hasSession: !!session,
+    hasAccessToken: !!session?.idpAccessToken,
+    bearerKeyId: session?.bearerKeyId || 'NOT_SET',
+    idpClientId: session?.idpClientId || 'NOT_SET',
+  });
+  if (!session?.idpAccessToken) return { sessionToken };
+  const now = Date.now();
+  const timeLeft = (session.idpAccessTokenExpires ?? now) - now;
+  // Treat tokens as effectively expired if within 5 minutes of expiry
+  if (timeLeft > 5 * 60 * 1000) {
+    return { sessionToken, accessToken: session.idpAccessToken };
+  }
+  // attempt refresh once via centralized internal API helper
+  try {
+    await internalRefresh(req.headers.get('cookie') || '', sessionToken);
+  } catch {}
+  session = await getSession(sessionToken);
+  return { sessionToken, accessToken: session?.idpAccessToken };
+}
+
+export async function idpFetchJSON<T = any>(
+  req: NextRequest,
+  targetUrl: string,
+  init: RequestInit = {}
+): Promise<IdpFetchResult<T>> {
+  let attemptedRefresh = false;
+  let { accessToken, sessionToken } = await ensureFreshAccessToken(req);
+
+  const makeCall = async (bearer?: string) => {
+    const res = await fetch(targetUrl, {
+      ...init,
+      headers: buildHeaders(req, bearer, init.headers as any),
+    });
+    let json: any = null;
+    try { json = await res.json(); } catch { json = null; }
+    return { res, json } as const;
+  };
+
+  // First attempt
+  let { res, json } = await makeCall(accessToken);
+  if ((res.status === 401 || res.status === 403) && sessionToken && !attemptedRefresh) {
+    attemptedRefresh = true;
+    try {
+      // Use centralized internal API helper for server-to-server calls
+      const rf = await internalRefresh(req.headers.get('cookie') || '', sessionToken);
+      if (rf.ok) {
+        const fresh = await getSession(sessionToken);
+        ({ res, json } = await makeCall(fresh?.idpAccessToken));
+      }
+    } catch {}
+  }
+
+  return { ok: res.ok, status: res.status, json: json as T | null, attemptedRefresh };
 }

package/src/lib/jwt-decode.ts

@@ -1,83 +1,83 @@
-import { jwtDecode as originalJwtDecode } from 'jwt-decode';
-
-// Define JwtPayload interface since jwt-decode v4 doesn't export it
-export interface JwtPayload {
-    iss?: string;
-    sub?: string;
-    aud?: string[] | string;
-    exp?: number;
-    nbf?: number;
-    iat?: number;
-    jti?: string;
-}
-
-/**
- * JWT Header structure.
- * Contains metadata about the token including the signing key ID.
- */
-export interface JwtHeader {
-    /** Algorithm used to sign the token (e.g., 'RS256', 'HS256') */
-    alg: string;
-    /** Token type (typically 'JWT') */
-    typ?: string;
-    /** Key ID - identifies which key was used to sign this token */
-    kid?: string;
-    /** Content type */
-    cty?: string;
-}
-
-/**
- * Decode JWT payload (standard claims).
- * This is a thin wrapper around jwt-decode library.
- */
-export function jwtDecode<T = JwtPayload>(token: string): T {
-    return originalJwtDecode<T>(token);
-}
-
-/**
- * Decode JWT header to extract kid, alg, and other header claims.
- *
- * The JWT header contains critical information:
- * - kid: Key ID used to sign the token (needed for key governance)
- * - alg: Algorithm used for signing
- * - typ: Token type
- *
- * @param token - The JWT token string
- * @returns Decoded header or null if decoding fails
- */
-export function decodeJwtHeader(token: string): JwtHeader | null {
-    try {
-        if (!token || typeof token !== 'string') {
-            return null;
-        }
-
-        const parts = token.split('.');
-        if (parts.length !== 3) {
-            console.warn('[JWT_DECODE] Invalid JWT structure - expected 3 parts, got', parts.length);
-            return null;
-        }
-
-        // Decode base64url header (part 0)
-        const headerB64 = parts[0].replace(/-/g, '+').replace(/_/g, '/');
-        const headerJson = typeof atob !== 'undefined'
-            ? atob(headerB64)
-            : Buffer.from(headerB64, 'base64').toString('utf-8');
-
-        return JSON.parse(headerJson) as JwtHeader;
-    } catch (error) {
-        console.error('[JWT_DECODE] Failed to decode JWT header:', error);
-        return null;
-    }
-}
-
-/**
- * Extract just the kid (Key ID) from a JWT token.
- * Convenience function for when you only need the key ID.
- *
- * @param token - The JWT token string
- * @returns The kid value or undefined if not present/decodable
- */
-export function extractKidFromToken(token: string): string | undefined {
-    const header = decodeJwtHeader(token);
-    return header?.kid;
+import { jwtDecode as originalJwtDecode } from 'jwt-decode';
+
+// Define JwtPayload interface since jwt-decode v4 doesn't export it
+export interface JwtPayload {
+    iss?: string;
+    sub?: string;
+    aud?: string[] | string;
+    exp?: number;
+    nbf?: number;
+    iat?: number;
+    jti?: string;
+}
+
+/**
+ * JWT Header structure.
+ * Contains metadata about the token including the signing key ID.
+ */
+export interface JwtHeader {
+    /** Algorithm used to sign the token (e.g., 'RS256', 'HS256') */
+    alg: string;
+    /** Token type (typically 'JWT') */
+    typ?: string;
+    /** Key ID - identifies which key was used to sign this token */
+    kid?: string;
+    /** Content type */
+    cty?: string;
+}
+
+/**
+ * Decode JWT payload (standard claims).
+ * This is a thin wrapper around jwt-decode library.
+ */
+export function jwtDecode<T = JwtPayload>(token: string): T {
+    return originalJwtDecode<T>(token);
+}
+
+/**
+ * Decode JWT header to extract kid, alg, and other header claims.
+ *
+ * The JWT header contains critical information:
+ * - kid: Key ID used to sign the token (needed for key governance)
+ * - alg: Algorithm used for signing
+ * - typ: Token type
+ *
+ * @param token - The JWT token string
+ * @returns Decoded header or null if decoding fails
+ */
+export function decodeJwtHeader(token: string): JwtHeader | null {
+    try {
+        if (!token || typeof token !== 'string') {
+            return null;
+        }
+
+        const parts = token.split('.');
+        if (parts.length !== 3) {
+            console.warn('[JWT_DECODE] Invalid JWT structure - expected 3 parts, got', parts.length);
+            return null;
+        }
+
+        // Decode base64url header (part 0)
+        const headerB64 = parts[0].replace(/-/g, '+').replace(/_/g, '/');
+        const headerJson = typeof atob !== 'undefined'
+            ? atob(headerB64)
+            : Buffer.from(headerB64, 'base64').toString('utf-8');
+
+        return JSON.parse(headerJson) as JwtHeader;
+    } catch (error) {
+        console.error('[JWT_DECODE] Failed to decode JWT header:', error);
+        return null;
+    }
+}
+
+/**
+ * Extract just the kid (Key ID) from a JWT token.
+ * Convenience function for when you only need the key ID.
+ *
+ * @param token - The JWT token string
+ * @returns The kid value or undefined if not present/decodable
+ */
+export function extractKidFromToken(token: string): string | undefined {
+    const header = decodeJwtHeader(token);
+    return header?.kid;
 }