@payez/next-mvp 4.1.8 → 4.1.10

package/dist/api-handlers/auth/refresh.js

@@ -371,7 +371,7 @@ function createRefreshHandler(config) {
                     const errorMessage = idpError.message || 'Token refresh failed';
                     // CRITICAL: 401 means token is definitively invalid - always discard
                     // This prevents redirect loops where viability check keeps returning canRefresh:true
-                    const discardToken = refreshResponse.status === 401 || idpError.discard_token === true;
+                    let discardToken = refreshResponse.status === 401 || idpError.discard_token === true;
                     const retryable = refreshResponse.status !== 401 && idpError.retryable === true;
                     const resolution = idpError.resolution || null;
                     // ============================================================================
@@ -408,20 +408,43 @@ function createRefreshHandler(config) {
                     console.error('[AUTH_REFRESH] Full IDP error response:', JSON.stringify(responseData, null, 2).substring(0, 1000));
                     // If IDP signals to discard token, clear it from Redis
                     if (discardToken) {
-                        console.error('[AUTH_REFRESH] ⚠️ REFRESH_TOKEN_REMOVAL: IDP signaled discard_token', {
-                            reason: 'IDP_DISCARD_TOKEN',
-                            errorCode,
-                            userId,
-                            sessionToken: sessionToken.substring(0, 8) + '...',
-                            hadRefreshToken: !!currentSession.idpRefreshToken,
-                            stack: new Error().stack
-                        });
-                        await (0, session_store_1.updateSession)(sessionToken, {
-                            idpRefreshToken: '',
-                            idpRefreshTokenExpires: undefined,
-                            refreshTokenClearedAt: Date.now(),
-                            refreshTokenClearedReason: `IDP_DISCARD_TOKEN:${errorCode}`
-                        });
+                        // Race-safe discard (CAS): only clear if the refresh token we sent is STILL
+                        // the current one. A concurrent refresh may have already rotated it — our 401
+                        // is then stale, and wiping here would silently log out a healthy session
+                        // (the rotation-race wipe, QA 6873 site 2). Skip the wipe + drop terminal if changed.
+                        const postRefresh = await (0, session_store_1.getSession)(sessionToken);
+                        const tokenUnchanged = !!originalRefreshToken && postRefresh?.idpRefreshToken === originalRefreshToken;
+                        if (tokenUnchanged) {
+                            console.error('[AUTH_REFRESH] ⚠️ REFRESH_TOKEN_REMOVAL: IDP signaled discard_token', {
+                                reason: 'IDP_DISCARD_TOKEN',
+                                errorCode,
+                                userId,
+                                sessionToken: sessionToken.substring(0, 8) + '...',
+                                hadRefreshToken: !!currentSession.idpRefreshToken,
+                                stack: new Error().stack
+                            });
+                            await (0, session_store_1.updateSession)(sessionToken, {
+                                idpRefreshToken: '',
+                                idpRefreshTokenExpires: undefined,
+                                refreshTokenClearedAt: Date.now(),
+                                refreshTokenClearedReason: `IDP_DISCARD_TOKEN:${errorCode}`
+                            });
+                        }
+                        else {
+                            // Concurrent refresh already rotated the token — our 401 is stale. Return the
+                            // freshly-rotated token directly so the loser succeeds without a retry
+                            // (race-fix follow-up #1).
+                            discardToken = false;
+                            console.warn('[AUTH_REFRESH] Discard suppressed: refresh token already rotated by a concurrent refresh — returning the fresh token (race-safe).');
+                            if (postRefresh?.idpAccessToken && postRefresh.idpAccessTokenExpires) {
+                                return server_1.NextResponse.json({
+                                    refreshed: true,
+                                    reason: 'completed_by_concurrent_request',
+                                    accessTokenExpires: postRefresh.idpAccessTokenExpires,
+                                    hasRefreshToken: !!postRefresh.idpRefreshToken,
+                                });
+                            }
+                        }
                     }
                     return server_1.NextResponse.json({
                         error: errorMessage,

package/dist/auth/better-auth.js

@@ -60,6 +60,7 @@ const magic_link_1 = require("better-auth/plugins/magic-link");
 const idp_client_config_1 = require("../lib/idp-client-config");
 const app_slug_1 = require("../lib/app-slug");
 const redis_1 = require("../lib/redis");
+const session_store_1 = require("../lib/session-store");
 /**
  * Build Better Auth social providers from IDP config.
  */
@@ -139,7 +140,7 @@ function createBetterAuthInstance(idpConfig, opts = {}) {
                         await redis.setex(`ba:${appSlug}:${key}`, ttl, value);
                     }
                     else {
-                        await redis.setex(`ba:${appSlug}:${key}`, 7 * 24 * 60 * 60, value);
+                        await redis.setex(`ba:${appSlug}:${key}`, session_store_1.SESSION_TTL, value);
                     }
                 }
                 catch { /* Redis unavailable — cookie cache still works */ }
@@ -347,13 +348,13 @@ async function exchangeOAuthForIdpTokens(sessionToken, provider = 'google') {
         };
         // Store in BA Redis session (for decodeSession)
         baData.idpTokens = idpTokenData;
-        await (0, redis_1.getRedis)().setex(baKey, 7 * 24 * 60 * 60, JSON.stringify(baData));
+        await (0, redis_1.getRedis)().setex(baKey, session_store_1.SESSION_TTL, JSON.stringify(baData));
         // Write to canonical session store so refresh handler and token lifecycle can find the tokens.
         // Key format: {sessionPrefix}{token} — same key that getSession() reads from.
         try {
             const { getSessionPrefix } = await Promise.resolve().then(() => __importStar(require('../lib/app-slug')));
             const canonicalKey = `${getSessionPrefix()}${sessionToken}`;
-            await (0, redis_1.getRedis)().setex(canonicalKey, 7 * 24 * 60 * 60, JSON.stringify({
+            await (0, redis_1.getRedis)().setex(canonicalKey, session_store_1.SESSION_TTL, JSON.stringify({
                 ...idpTokenData,
                 oauthProvider: provider,
             }));

package/dist/lib/ensure-fresh-access-token.js

@@ -200,15 +200,38 @@ async function ensureFreshAccessToken(sessionToken, config, options = {}) {
         if (!idpResponse.ok) {
             const idpError = responseData?.error || {};
             const code = idpError.code || 'UNKNOWN_ERROR';
-            const discardToken = idpResponse.status === 401 || idpError.discard_token === true;
+            let discardToken = idpResponse.status === 401 || idpError.discard_token === true;
             const retryable = idpResponse.status !== 401 && idpError.retryable === true;
             if (discardToken) {
-                await (0, session_store_1.updateSession)(sessionToken, {
-                    idpRefreshToken: '',
-                    idpRefreshTokenExpires: undefined,
-                    refreshTokenClearedAt: Date.now(),
-                    refreshTokenClearedReason: `IDP_DISCARD_TOKEN:${code}`,
-                });
+                // Race-safe discard (CAS): only clear if the refresh token we used is STILL
+                // current. A concurrent refresh may have already rotated it — our 401 is then
+                // stale/expected, and wiping here would silently log out a healthy session
+                // (the rotation-race wipe, QA 6873 site 1/2). Compare-and-skip if it changed;
+                // a concurrent rotation is NOT a terminal condition.
+                const postRefresh = await (0, session_store_1.getSession)(sessionToken);
+                const tokenUnchanged = !!session.idpRefreshToken && postRefresh?.idpRefreshToken === session.idpRefreshToken;
+                if (tokenUnchanged) {
+                    await (0, session_store_1.updateSession)(sessionToken, {
+                        idpRefreshToken: '',
+                        idpRefreshTokenExpires: undefined,
+                        refreshTokenClearedAt: Date.now(),
+                        refreshTokenClearedReason: `IDP_DISCARD_TOKEN:${code}`,
+                    });
+                }
+                else {
+                    // Concurrent refresh already rotated the token — our 401 is stale. Return the
+                    // freshly-rotated token directly so the loser succeeds without a retry round-trip
+                    // (race-fix follow-up #1).
+                    discardToken = false;
+                    if (postRefresh?.idpAccessToken && postRefresh.idpAccessTokenExpires) {
+                        return {
+                            ok: true,
+                            accessToken: postRefresh.idpAccessToken,
+                            accessTokenExpires: postRefresh.idpAccessTokenExpires,
+                            refreshed: true,
+                        };
+                    }
+                }
             }
             return {
                 ok: false,

package/dist/lib/session-store.d.ts

@@ -9,6 +9,7 @@
  */
 import { SessionData } from '../models/SessionModel';
 export type { SessionData } from '../models/SessionModel';
+export declare const SESSION_TTL: number;
 export interface RefreshLockInfo {
     sessionToken: string;
     acquiredAt: number;

package/dist/lib/session-store.js

@@ -12,6 +12,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.SESSION_TTL = void 0;
 exports.generateSessionToken = generateSessionToken;
 exports.createSession = createSession;
 exports.getSession = getSession;
@@ -46,7 +47,10 @@ const getSessionVersionKey = (token) => `${(0, app_slug_1.getSessionPrefix)()}ve
 // Better Auth uses a different key format: ba:{appSlug}:{token}
 const getBetterAuthSessionKey = (token, appSlug) => `ba:${appSlug || 'app'}:${token}`;
 const REFRESH_LOCK_TTL = 60; // 60 seconds
-const SESSION_TTL = 3 * 24 * 60 * 60; // 3 days in seconds (matches refresh token lifetime)
+// 3 days in seconds (matches refresh token lifetime). EXPORTED as the single source
+// of session TTL — better-auth.ts derives its BA-session Redis TTL from this so the
+// two can never drift apart again (the 7d-vs-3d drift = the zombie-session window, QA 6952).
+exports.SESSION_TTL = 3 * 24 * 60 * 60;
 /**
  * Generates a new session token.
  * @returns A new session token string.
@@ -66,8 +70,8 @@ async function createSession(data) {
     const versionKey = getSessionVersionKey(sessionToken);
     try {
         await redis_1.default.multi()
-            .setex(key, SESSION_TTL, JSON.stringify(data))
-            .setex(versionKey, SESSION_TTL, '1')
+            .setex(key, exports.SESSION_TTL, JSON.stringify(data))
+            .setex(versionKey, exports.SESSION_TTL, '1')
             .exec();
     }
     catch (error) {
@@ -148,7 +152,7 @@ async function getBetterAuthSession(sessionToken, appSlug) {
  */
 async function touchSession(token) {
     const key = getSessionKey(token);
-    await redis_1.default.expire(key, SESSION_TTL);
+    await redis_1.default.expire(key, exports.SESSION_TTL);
 }
 /**
  * Retrieves a session along with a version identifier for optimistic locking.
@@ -214,9 +218,9 @@ async function setSession(sessionToken, data) {
     const key = getSessionKey(sessionToken);
     const versionKey = getSessionVersionKey(sessionToken);
     await redis_1.default.multi()
-        .setex(key, SESSION_TTL, JSON.stringify(data))
+        .setex(key, exports.SESSION_TTL, JSON.stringify(data))
         .incr(versionKey)
-        .expire(versionKey, SESSION_TTL)
+        .expire(versionKey, exports.SESSION_TTL)
         .exec();
 }
 /**
@@ -254,9 +258,9 @@ async function updateSession(sessionToken, updates) {
     const updatedSession = { ...currentSession, ...updates };
     // Write the entire updated session back to Redis with version increment
     await redis_1.default.multi()
-        .setex(key, SESSION_TTL, JSON.stringify(updatedSession))
+        .setex(key, exports.SESSION_TTL, JSON.stringify(updatedSession))
         .incr(versionKey)
-        .expire(versionKey, SESSION_TTL)
+        .expire(versionKey, exports.SESSION_TTL)
         .exec();
     return updatedSession;
 }