@payez/next-mvp 4.1.9 → 4.1.10

package/src/api-handlers/auth/verify-code.ts

@@ -1,112 +1,112 @@
-/**
- * Authentication Verify Code / Complete 2FA API Handler
- *
- * Handles 2FA verification and token updates after successful verification.
- * This handler is designed to be imported and used by Next.js applications
- * using the @payez/next-mvp package.
- *
- * @version 2.0
- * @requires Authentication (authenticated endpoint)
- */
-
-import { NextRequest, NextResponse } from 'next/server';
-import { getSession } from '../../server/auth';
-import { updateTokens, mark2FAComplete } from '../../lib/session-store';
-
-interface VerifyCodeRequest {
-  accessToken: string;
-  refreshToken: string;
-  accessTokenExpires: number;
-  refreshTokenExpires?: number;
-}
-
-/**
- * Creates a verify-code/complete-2FA handler for Next.js API routes.
- *
- * Better Auth resolves its session from cookies, so this handler takes no
- * configuration. Use the default `POST` export below for typical usage.
- *
- * @example
- * ```typescript
- * // In your app's /app/api/auth/verify-code/route.ts
- * export { POST } from '@payez/next-mvp/api-handlers/auth/verify-code';
- * ```
- */
-export function createVerifyCodeHandler() {
-  return async function POST(req: NextRequest) {
-    try {
-      let body: VerifyCodeRequest;
-
-      try {
-        body = await req.json();
-      } catch (parseError) {
-        return NextResponse.json(
-          { success: false, message: 'Invalid JSON format' },
-          { status: 400 }
-        );
-      }
-
-      const { accessToken, refreshToken, accessTokenExpires, refreshTokenExpires } = body;
-
-      // Get current session from Better Auth
-      const betterAuthSession = await getSession(req);
-
-      const sessionToken = betterAuthSession?.session?.token as string;
-
-      if (!sessionToken) {
-        console.error('[VERIFY-CODE] No session token found', {
-          hasSession: !!betterAuthSession,
-        });
-        return NextResponse.json(
-          { success: false, message: 'No session found' },
-          { status: 401 }
-        );
-      }
-
-      console.info('[VERIFY-CODE] Updating session with new tokens after 2FA', {
-        sessionToken: sessionToken.substring(0, 8) + '...',
-        userId: betterAuthSession?.user?.id,
-        hasAccessToken: !!accessToken,
-        hasRefreshToken: !!refreshToken,
-        accessTokenLength: accessToken?.length,
-        refreshTokenLength: refreshToken?.length
-      });
-
-      // Update tokens in Redis
-      await updateTokens(
-        sessionToken,
-        accessToken,
-        refreshToken,
-        accessTokenExpires,
-        refreshTokenExpires
-      );
-
-      // Mark 2FA as complete
-      await mark2FAComplete(sessionToken);
-
-      console.info('[VERIFY-CODE] 2FA completion successful', {
-        sessionToken: sessionToken.substring(0, 8) + '...',
-        userId: betterAuthSession?.user?.id
-      });
-
-      return NextResponse.json({
-        success: true,
-        message: '2FA verification complete'
-      });
-    } catch (error) {
-      console.error('[VERIFY-CODE] Failed to complete 2FA', {
-        error: error instanceof Error ? error.message : String(error)
-      });
-
-      return NextResponse.json(
-        { success: false, message: 'Failed to complete 2FA' },
-        { status: 500 }
-      );
-    }
-  };
-}
-
-/**
- * Default POST export — drop-in for `app/api/auth/verify-code/route.ts`.
- */
-export const POST = createVerifyCodeHandler();
+/**
+ * Authentication Verify Code / Complete 2FA API Handler
+ *
+ * Handles 2FA verification and token updates after successful verification.
+ * This handler is designed to be imported and used by Next.js applications
+ * using the @payez/next-mvp package.
+ *
+ * @version 2.0
+ * @requires Authentication (authenticated endpoint)
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { getSession } from '../../server/auth';
+import { updateTokens, mark2FAComplete } from '../../lib/session-store';
+
+interface VerifyCodeRequest {
+  accessToken: string;
+  refreshToken: string;
+  accessTokenExpires: number;
+  refreshTokenExpires?: number;
+}
+
+/**
+ * Creates a verify-code/complete-2FA handler for Next.js API routes.
+ *
+ * Better Auth resolves its session from cookies, so this handler takes no
+ * configuration. Use the default `POST` export below for typical usage.
+ *
+ * @example
+ * ```typescript
+ * // In your app's /app/api/auth/verify-code/route.ts
+ * export { POST } from '@payez/next-mvp/api-handlers/auth/verify-code';
+ * ```
+ */
+export function createVerifyCodeHandler() {
+  return async function POST(req: NextRequest) {
+    try {
+      let body: VerifyCodeRequest;
+
+      try {
+        body = await req.json();
+      } catch (parseError) {
+        return NextResponse.json(
+          { success: false, message: 'Invalid JSON format' },
+          { status: 400 }
+        );
+      }
+
+      const { accessToken, refreshToken, accessTokenExpires, refreshTokenExpires } = body;
+
+      // Get current session from Better Auth
+      const betterAuthSession = await getSession(req);
+
+      const sessionToken = betterAuthSession?.session?.token as string;
+
+      if (!sessionToken) {
+        console.error('[VERIFY-CODE] No session token found', {
+          hasSession: !!betterAuthSession,
+        });
+        return NextResponse.json(
+          { success: false, message: 'No session found' },
+          { status: 401 }
+        );
+      }
+
+      console.info('[VERIFY-CODE] Updating session with new tokens after 2FA', {
+        sessionToken: sessionToken.substring(0, 8) + '...',
+        userId: betterAuthSession?.user?.id,
+        hasAccessToken: !!accessToken,
+        hasRefreshToken: !!refreshToken,
+        accessTokenLength: accessToken?.length,
+        refreshTokenLength: refreshToken?.length
+      });
+
+      // Update tokens in Redis
+      await updateTokens(
+        sessionToken,
+        accessToken,
+        refreshToken,
+        accessTokenExpires,
+        refreshTokenExpires
+      );
+
+      // Mark 2FA as complete
+      await mark2FAComplete(sessionToken);
+
+      console.info('[VERIFY-CODE] 2FA completion successful', {
+        sessionToken: sessionToken.substring(0, 8) + '...',
+        userId: betterAuthSession?.user?.id
+      });
+
+      return NextResponse.json({
+        success: true,
+        message: '2FA verification complete'
+      });
+    } catch (error) {
+      console.error('[VERIFY-CODE] Failed to complete 2FA', {
+        error: error instanceof Error ? error.message : String(error)
+      });
+
+      return NextResponse.json(
+        { success: false, message: 'Failed to complete 2FA' },
+        { status: 500 }
+      );
+    }
+  };
+}
+
+/**
+ * Default POST export — drop-in for `app/api/auth/verify-code/route.ts`.
+ */
+export const POST = createVerifyCodeHandler();

package/src/api-handlers/session/refresh-viability.ts

@@ -1,36 +1,36 @@
-import { NextRequest, NextResponse } from 'next/server';
-import { getSession, isRefreshInProgress } from '../../lib/session-store';
-import { checkRefreshViability } from '../../lib/refresh-token-validator';
-import { getTokenTestAware } from '../../lib/test-aware-get-token';
-import { logger } from '../../config/logger';
-
-export async function GET(req: NextRequest) {
-  try {
-    const sessionToken = req.nextUrl.searchParams.get('token');
-    let finalSessionToken = sessionToken;
-    if (!finalSessionToken) {
-      const token = await getTokenTestAware(req);
-      // Support both field names: sessionToken (auth.ts JWT) and redisSessionId (legacy)
-      finalSessionToken = (token?.sessionToken || token?.redisSessionId) as string;
-    }
-    if (!finalSessionToken) {
-      return NextResponse.json({ canRefresh: false, reason: 'not_logged_in', sessionToken: null }, { status: 200 });
-    }
-    const refreshInProgress = await isRefreshInProgress(finalSessionToken);
-    if (refreshInProgress) {
-      // Still need to get session data for twoFactorComplete even when refresh is in progress
-      const sessionData = await getSession(finalSessionToken);
-      logger.info('[REFRESH-VIABILITY] Refresh already in progress, telling middleware to wait', { sessionToken: finalSessionToken.substring(0, 8) + '...' });
-      return NextResponse.json({ canRefresh: true, reason: 'refresh_in_progress', refreshInProgress: true, sessionToken: finalSessionToken, twoFactorComplete: sessionData?.mfaVerified ?? (sessionData as any)?.twoFactorComplete ?? false }, { status: 200 });
-    }
-    const sessionData = await getSession(finalSessionToken);
-    if (!sessionData) {
-      return NextResponse.json({ canRefresh: false, reason: 'session_not_found', sessionToken: finalSessionToken }, { status: 200 });
-    }
-    const viabilityCheck = checkRefreshViability(sessionData);
-    return NextResponse.json({ canRefresh: viabilityCheck.canRefresh, reason: viabilityCheck.reason, timeRemaining: viabilityCheck.timeRemaining, expiresAt: viabilityCheck.expiresAt, accessTokenExpired: viabilityCheck.accessTokenExpired, accessTokenTimeRemaining: viabilityCheck.accessTokenTimeRemaining, sessionToken: finalSessionToken, twoFactorComplete: sessionData.mfaVerified ?? (sessionData as any).twoFactorComplete ?? false, userId: sessionData.userId, refreshInProgress: false });
-  } catch (error) {
-    logger.error('[REFRESH-VIABILITY] Error checking refresh viability', { error: error instanceof Error ? error.message : String(error) });
-    return NextResponse.json({ canRefresh: false, reason: 'check_error', error: error instanceof Error ? error.message : String(error) }, { status: 500 });
-  }
-}
+import { NextRequest, NextResponse } from 'next/server';
+import { getSession, isRefreshInProgress } from '../../lib/session-store';
+import { checkRefreshViability } from '../../lib/refresh-token-validator';
+import { getTokenTestAware } from '../../lib/test-aware-get-token';
+import { logger } from '../../config/logger';
+
+export async function GET(req: NextRequest) {
+  try {
+    const sessionToken = req.nextUrl.searchParams.get('token');
+    let finalSessionToken = sessionToken;
+    if (!finalSessionToken) {
+      const token = await getTokenTestAware(req);
+      // Support both field names: sessionToken (auth.ts JWT) and redisSessionId (legacy)
+      finalSessionToken = (token?.sessionToken || token?.redisSessionId) as string;
+    }
+    if (!finalSessionToken) {
+      return NextResponse.json({ canRefresh: false, reason: 'not_logged_in', sessionToken: null }, { status: 200 });
+    }
+    const refreshInProgress = await isRefreshInProgress(finalSessionToken);
+    if (refreshInProgress) {
+      // Still need to get session data for twoFactorComplete even when refresh is in progress
+      const sessionData = await getSession(finalSessionToken);
+      logger.info('[REFRESH-VIABILITY] Refresh already in progress, telling middleware to wait', { sessionToken: finalSessionToken.substring(0, 8) + '...' });
+      return NextResponse.json({ canRefresh: true, reason: 'refresh_in_progress', refreshInProgress: true, sessionToken: finalSessionToken, twoFactorComplete: sessionData?.mfaVerified ?? (sessionData as any)?.twoFactorComplete ?? false }, { status: 200 });
+    }
+    const sessionData = await getSession(finalSessionToken);
+    if (!sessionData) {
+      return NextResponse.json({ canRefresh: false, reason: 'session_not_found', sessionToken: finalSessionToken }, { status: 200 });
+    }
+    const viabilityCheck = checkRefreshViability(sessionData);
+    return NextResponse.json({ canRefresh: viabilityCheck.canRefresh, reason: viabilityCheck.reason, timeRemaining: viabilityCheck.timeRemaining, expiresAt: viabilityCheck.expiresAt, accessTokenExpired: viabilityCheck.accessTokenExpired, accessTokenTimeRemaining: viabilityCheck.accessTokenTimeRemaining, sessionToken: finalSessionToken, twoFactorComplete: sessionData.mfaVerified ?? (sessionData as any).twoFactorComplete ?? false, userId: sessionData.userId, refreshInProgress: false });
+  } catch (error) {
+    logger.error('[REFRESH-VIABILITY] Error checking refresh viability', { error: error instanceof Error ? error.message : String(error) });
+    return NextResponse.json({ canRefresh: false, reason: 'check_error', error: error instanceof Error ? error.message : String(error) }, { status: 500 });
+  }
+}

package/src/api-handlers/test/force-expire.ts

@@ -1,60 +1,60 @@
-import { NextRequest, NextResponse } from 'next/server';
-import { getSession as getBetterAuthSession } from '../../server/auth';
-import { getSession, updateSession } from '../../lib/session-store';
-
-/**
- * Force-expire access token for testing refresh flow.
- *
- * Sets the access token expiry to 2 minutes in the past,
- * which will trigger a refresh on the next API call.
- *
- * Usage in consuming app:
- * ```typescript
- * // app/api/test/force-expire/route.ts
- * export { POST } from '@payez/next-mvp/api-handlers/test/force-expire';
- * ```
- */
-export const POST = async (req: NextRequest) => {
-  try {
-    const betterAuthSession = await getBetterAuthSession(req);
-
-    let sessionToken = betterAuthSession?.session?.token as string | undefined;
-    if (!sessionToken) {
-      const headerSessionToken = req.headers.get('x-session-token') || req.headers.get('X-Session-Token');
-      if (headerSessionToken) {
-        sessionToken = headerSessionToken;
-      } else {
-        console.warn('[TEST_EXPIRE] No session token or X-Session-Token header');
-        return NextResponse.json({ success: false, error: 'No session token' }, { status: 401 });
-      }
-    }
-
-    const session = await getSession(sessionToken);
-    if (!session) {
-      return NextResponse.json({ success: false, error: 'Session not found' }, { status: 404 });
-    }
-
-    const now = Date.now();
-    const forced = now - (2 * 60 * 1000); // two minutes ago
-    const prev = session.idpAccessTokenExpires || null;
-
-    await updateSession(sessionToken, { idpAccessTokenExpires: forced });
-
-    console.log('[TEST_EXPIRE] Forced access token expiry for session', {
-      sessionToken: sessionToken.substring(0, 8) + '...',
-      previous: prev ? new Date(prev).toISOString() : null,
-      newExpiry: new Date(forced).toISOString()
-    });
-
-    return NextResponse.json({
-      success: true,
-      previous: prev,
-      previousIso: prev ? new Date(prev).toISOString() : null,
-      newExpiry: forced,
-      newExpiryIso: new Date(forced).toISOString()
-    });
-  } catch (e) {
-    console.error('[TEST_EXPIRE] Error:', e);
-    return NextResponse.json({ success: false, error: e instanceof Error ? e.message : String(e) }, { status: 500 });
-  }
-};
+import { NextRequest, NextResponse } from 'next/server';
+import { getSession as getBetterAuthSession } from '../../server/auth';
+import { getSession, updateSession } from '../../lib/session-store';
+
+/**
+ * Force-expire access token for testing refresh flow.
+ *
+ * Sets the access token expiry to 2 minutes in the past,
+ * which will trigger a refresh on the next API call.
+ *
+ * Usage in consuming app:
+ * ```typescript
+ * // app/api/test/force-expire/route.ts
+ * export { POST } from '@payez/next-mvp/api-handlers/test/force-expire';
+ * ```
+ */
+export const POST = async (req: NextRequest) => {
+  try {
+    const betterAuthSession = await getBetterAuthSession(req);
+
+    let sessionToken = betterAuthSession?.session?.token as string | undefined;
+    if (!sessionToken) {
+      const headerSessionToken = req.headers.get('x-session-token') || req.headers.get('X-Session-Token');
+      if (headerSessionToken) {
+        sessionToken = headerSessionToken;
+      } else {
+        console.warn('[TEST_EXPIRE] No session token or X-Session-Token header');
+        return NextResponse.json({ success: false, error: 'No session token' }, { status: 401 });
+      }
+    }
+
+    const session = await getSession(sessionToken);
+    if (!session) {
+      return NextResponse.json({ success: false, error: 'Session not found' }, { status: 404 });
+    }
+
+    const now = Date.now();
+    const forced = now - (2 * 60 * 1000); // two minutes ago
+    const prev = session.idpAccessTokenExpires || null;
+
+    await updateSession(sessionToken, { idpAccessTokenExpires: forced });
+
+    console.log('[TEST_EXPIRE] Forced access token expiry for session', {
+      sessionToken: sessionToken.substring(0, 8) + '...',
+      previous: prev ? new Date(prev).toISOString() : null,
+      newExpiry: new Date(forced).toISOString()
+    });
+
+    return NextResponse.json({
+      success: true,
+      previous: prev,
+      previousIso: prev ? new Date(prev).toISOString() : null,
+      newExpiry: forced,
+      newExpiryIso: new Date(forced).toISOString()
+    });
+  } catch (e) {
+    console.error('[TEST_EXPIRE] Error:', e);
+    return NextResponse.json({ success: false, error: e instanceof Error ? e.message : String(e) }, { status: 500 });
+  }
+};