@payez/next-mvp 4.1.8 → 4.1.10

package/src/api-handlers/auth/refresh.ts

@@ -400,7 +400,7 @@ export function createRefreshHandler(config: RefreshConfig) {
           const errorMessage = idpError.message || 'Token refresh failed';
           // CRITICAL: 401 means token is definitively invalid - always discard
           // This prevents redirect loops where viability check keeps returning canRefresh:true
-          const discardToken = refreshResponse.status === 401 || idpError.discard_token === true;
+          let discardToken = refreshResponse.status === 401 || idpError.discard_token === true;
           const retryable = refreshResponse.status !== 401 && idpError.retryable === true;
           const resolution = idpError.resolution || null;
 
@@ -442,20 +442,43 @@ export function createRefreshHandler(config: RefreshConfig) {
 
           // If IDP signals to discard token, clear it from Redis
           if (discardToken) {
-            console.error('[AUTH_REFRESH] ⚠️ REFRESH_TOKEN_REMOVAL: IDP signaled discard_token', {
-              reason: 'IDP_DISCARD_TOKEN',
-              errorCode,
-              userId,
-              sessionToken: sessionToken.substring(0, 8) + '...',
-              hadRefreshToken: !!currentSession.idpRefreshToken,
-              stack: new Error().stack
-            });
-            await updateSession(sessionToken, {
-              idpRefreshToken: '',
-              idpRefreshTokenExpires: undefined,
-              refreshTokenClearedAt: Date.now(),
-              refreshTokenClearedReason: `IDP_DISCARD_TOKEN:${errorCode}`
-            });
+            // Race-safe discard (CAS): only clear if the refresh token we sent is STILL
+            // the current one. A concurrent refresh may have already rotated it — our 401
+            // is then stale, and wiping here would silently log out a healthy session
+            // (the rotation-race wipe, QA 6873 site 2). Skip the wipe + drop terminal if changed.
+            const postRefresh = await getSession(sessionToken);
+            const tokenUnchanged =
+              !!originalRefreshToken && postRefresh?.idpRefreshToken === originalRefreshToken;
+            if (tokenUnchanged) {
+              console.error('[AUTH_REFRESH] ⚠️ REFRESH_TOKEN_REMOVAL: IDP signaled discard_token', {
+                reason: 'IDP_DISCARD_TOKEN',
+                errorCode,
+                userId,
+                sessionToken: sessionToken.substring(0, 8) + '...',
+                hadRefreshToken: !!currentSession.idpRefreshToken,
+                stack: new Error().stack
+              });
+              await updateSession(sessionToken, {
+                idpRefreshToken: '',
+                idpRefreshTokenExpires: undefined,
+                refreshTokenClearedAt: Date.now(),
+                refreshTokenClearedReason: `IDP_DISCARD_TOKEN:${errorCode}`
+              });
+            } else {
+              // Concurrent refresh already rotated the token — our 401 is stale. Return the
+              // freshly-rotated token directly so the loser succeeds without a retry
+              // (race-fix follow-up #1).
+              discardToken = false;
+              console.warn('[AUTH_REFRESH] Discard suppressed: refresh token already rotated by a concurrent refresh — returning the fresh token (race-safe).');
+              if (postRefresh?.idpAccessToken && postRefresh.idpAccessTokenExpires) {
+                return NextResponse.json({
+                  refreshed: true,
+                  reason: 'completed_by_concurrent_request',
+                  accessTokenExpires: postRefresh.idpAccessTokenExpires,
+                  hasRefreshToken: !!postRefresh.idpRefreshToken,
+                });
+              }
+            }
           }
 
           return NextResponse.json({

package/src/auth/better-auth.ts

@@ -18,6 +18,7 @@ import type { IDPClientConfig } from '../lib/idp-client-config';
 import { getIDPClientConfig } from '../lib/idp-client-config';
 import { getAppSlug } from '../lib/app-slug';
 import { getRedis } from '../lib/redis';
+import { SESSION_TTL } from '../lib/session-store';
 
 /**
  * Better Auth social provider config shape.
@@ -133,7 +134,7 @@ export function createBetterAuthInstance(
           if (ttl) {
             await redis.setex(`ba:${appSlug}:${key}`, ttl, value);
           } else {
-            await redis.setex(`ba:${appSlug}:${key}`, 7 * 24 * 60 * 60, value);
+            await redis.setex(`ba:${appSlug}:${key}`, SESSION_TTL, value);
           }
         } catch { /* Redis unavailable — cookie cache still works */ }
       },
@@ -364,14 +365,14 @@ export async function exchangeOAuthForIdpTokens(
 
     // Store in BA Redis session (for decodeSession)
     baData.idpTokens = idpTokenData;
-    await getRedis().setex(baKey, 7 * 24 * 60 * 60, JSON.stringify(baData));
+    await getRedis().setex(baKey, SESSION_TTL, JSON.stringify(baData));
 
     // Write to canonical session store so refresh handler and token lifecycle can find the tokens.
     // Key format: {sessionPrefix}{token} — same key that getSession() reads from.
     try {
       const { getSessionPrefix } = await import('../lib/app-slug');
       const canonicalKey = `${getSessionPrefix()}${sessionToken}`;
-      await getRedis().setex(canonicalKey, 7 * 24 * 60 * 60, JSON.stringify({
+      await getRedis().setex(canonicalKey, SESSION_TTL, JSON.stringify({
         ...idpTokenData,
         oauthProvider: provider,
       }));