@payez/next-mvp 4.1.9 → 4.1.10

package/dist/api-handlers/auth/refresh.js

@@ -371,7 +371,7 @@ function createRefreshHandler(config) {
                     const errorMessage = idpError.message || 'Token refresh failed';
                     // CRITICAL: 401 means token is definitively invalid - always discard
                     // This prevents redirect loops where viability check keeps returning canRefresh:true
-                    const discardToken = refreshResponse.status === 401 || idpError.discard_token === true;
+                    let discardToken = refreshResponse.status === 401 || idpError.discard_token === true;
                     const retryable = refreshResponse.status !== 401 && idpError.retryable === true;
                     const resolution = idpError.resolution || null;
                     // ============================================================================
@@ -408,20 +408,43 @@ function createRefreshHandler(config) {
                     console.error('[AUTH_REFRESH] Full IDP error response:', JSON.stringify(responseData, null, 2).substring(0, 1000));
                     // If IDP signals to discard token, clear it from Redis
                     if (discardToken) {
-                        console.error('[AUTH_REFRESH] ⚠️ REFRESH_TOKEN_REMOVAL: IDP signaled discard_token', {
-                            reason: 'IDP_DISCARD_TOKEN',
-                            errorCode,
-                            userId,
-                            sessionToken: sessionToken.substring(0, 8) + '...',
-                            hadRefreshToken: !!currentSession.idpRefreshToken,
-                            stack: new Error().stack
-                        });
-                        await (0, session_store_1.updateSession)(sessionToken, {
-                            idpRefreshToken: '',
-                            idpRefreshTokenExpires: undefined,
-                            refreshTokenClearedAt: Date.now(),
-                            refreshTokenClearedReason: `IDP_DISCARD_TOKEN:${errorCode}`
-                        });
+                        // Race-safe discard (CAS): only clear if the refresh token we sent is STILL
+                        // the current one. A concurrent refresh may have already rotated it — our 401
+                        // is then stale, and wiping here would silently log out a healthy session
+                        // (the rotation-race wipe, QA 6873 site 2). Skip the wipe + drop terminal if changed.
+                        const postRefresh = await (0, session_store_1.getSession)(sessionToken);
+                        const tokenUnchanged = !!originalRefreshToken && postRefresh?.idpRefreshToken === originalRefreshToken;
+                        if (tokenUnchanged) {
+                            console.error('[AUTH_REFRESH] ⚠️ REFRESH_TOKEN_REMOVAL: IDP signaled discard_token', {
+                                reason: 'IDP_DISCARD_TOKEN',
+                                errorCode,
+                                userId,
+                                sessionToken: sessionToken.substring(0, 8) + '...',
+                                hadRefreshToken: !!currentSession.idpRefreshToken,
+                                stack: new Error().stack
+                            });
+                            await (0, session_store_1.updateSession)(sessionToken, {
+                                idpRefreshToken: '',
+                                idpRefreshTokenExpires: undefined,
+                                refreshTokenClearedAt: Date.now(),
+                                refreshTokenClearedReason: `IDP_DISCARD_TOKEN:${errorCode}`
+                            });
+                        }
+                        else {
+                            // Concurrent refresh already rotated the token — our 401 is stale. Return the
+                            // freshly-rotated token directly so the loser succeeds without a retry
+                            // (race-fix follow-up #1).
+                            discardToken = false;
+                            console.warn('[AUTH_REFRESH] Discard suppressed: refresh token already rotated by a concurrent refresh — returning the fresh token (race-safe).');
+                            if (postRefresh?.idpAccessToken && postRefresh.idpAccessTokenExpires) {
+                                return server_1.NextResponse.json({
+                                    refreshed: true,
+                                    reason: 'completed_by_concurrent_request',
+                                    accessTokenExpires: postRefresh.idpAccessTokenExpires,
+                                    hasRefreshToken: !!postRefresh.idpRefreshToken,
+                                });
+                            }
+                        }
                     }
                     return server_1.NextResponse.json({
                         error: errorMessage,

package/dist/auth/better-auth.js

@@ -60,6 +60,7 @@ const magic_link_1 = require("better-auth/plugins/magic-link");
 const idp_client_config_1 = require("../lib/idp-client-config");
 const app_slug_1 = require("../lib/app-slug");
 const redis_1 = require("../lib/redis");
+const session_store_1 = require("../lib/session-store");
 /**
  * Build Better Auth social providers from IDP config.
  */
@@ -139,7 +140,7 @@ function createBetterAuthInstance(idpConfig, opts = {}) {
                         await redis.setex(`ba:${appSlug}:${key}`, ttl, value);
                     }
                     else {
-                        await redis.setex(`ba:${appSlug}:${key}`, 7 * 24 * 60 * 60, value);
+                        await redis.setex(`ba:${appSlug}:${key}`, session_store_1.SESSION_TTL, value);
                     }
                 }
                 catch { /* Redis unavailable — cookie cache still works */ }
@@ -326,20 +327,8 @@ async function exchangeOAuthForIdpTokens(sessionToken, provider = 'google') {
             return false;
         }
         // Build IDP token data
-        // ORIGINAL INTENT: IDP withholds refresh_token until 2FA is complete, so
-        // !hasRefreshToken was a reliable "2FA required" signal.
-        //
-        // BUG [IDP-2FA-BUG]: IDP is currently returning refresh_token on the initial
-        // oauth-callback even for require_2fa tenants that haven't done 2FA yet.
-        // This made !hasRefreshToken=false → requiresTwoFactor=false → mfaVerified=true,
-        // bypassing the 2FA gate entirely.
-        //
-        // FIX: Always set mfaVerified=false on the initial OAuth exchange.
-        // The tenant's require_2fa setting is enforced by the viability endpoint
-        // (tenantRequiresTwoFactor=true), which redirects to verify-code whenever
-        // mfaVerified=false. After real 2FA, transitionTo2FASession() sets it true.
-        // Revert this comment + restore `mfaVerified: !requiresTwoFactor` once the
-        // IDP correctly withholds refresh_token until post-2FA.
+        // CRITICAL: If the IDP withholds refresh_token without setting requiresTwoFactor,
+        // treat missing refresh token as "2FA required" so middleware redirects to verify-code.
         const hasRefreshToken = !!result.refresh_token;
         const requiresTwoFactor = result.user?.requiresTwoFactor ?? result.requiresTwoFactor ?? !hasRefreshToken;
         const idpTokenData = {
@@ -353,19 +342,19 @@ async function exchangeOAuthForIdpTokens(sessionToken, provider = 'google') {
             name: result.user?.full_name || result.user?.name || result.name || name,
             image: image,
             roles: result.user?.roles || result.roles || [],
-            mfaVerified: false, // Always false post-OAuth — see IDP-2FA-BUG note above
+            mfaVerified: !requiresTwoFactor,
             idpClientId: result.client_id ? String(result.client_id) : undefined,
             merchantId: result.merchant_id ? String(result.merchant_id) : undefined,
         };
         // Store in BA Redis session (for decodeSession)
         baData.idpTokens = idpTokenData;
-        await (0, redis_1.getRedis)().setex(baKey, 7 * 24 * 60 * 60, JSON.stringify(baData));
+        await (0, redis_1.getRedis)().setex(baKey, session_store_1.SESSION_TTL, JSON.stringify(baData));
         // Write to canonical session store so refresh handler and token lifecycle can find the tokens.
         // Key format: {sessionPrefix}{token} — same key that getSession() reads from.
         try {
             const { getSessionPrefix } = await Promise.resolve().then(() => __importStar(require('../lib/app-slug')));
             const canonicalKey = `${getSessionPrefix()}${sessionToken}`;
-            await (0, redis_1.getRedis)().setex(canonicalKey, 7 * 24 * 60 * 60, JSON.stringify({
+            await (0, redis_1.getRedis)().setex(canonicalKey, session_store_1.SESSION_TTL, JSON.stringify({
                 ...idpTokenData,
                 oauthProvider: provider,
             }));

package/dist/components/account/MobileNavDrawer.js

@@ -58,24 +58,24 @@ function MobileNavDrawer({ isOpen, onClose, navItems, customSections, basePath =
     const userEmail = session?.user?.email;
     const displaySource = userName || userEmail;
     const userInitial = displaySource?.charAt(0).toUpperCase() || '?';
-    return ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsx)("div", { className: `
-          fixed inset-0 bg-black/50 backdrop-blur-sm z-40 lg:hidden
-          transition-opacity duration-300
-          ${isOpen ? 'opacity-100' : 'opacity-0 pointer-events-none'}
-        `, onClick: onClose, "aria-hidden": "true" }), (0, jsx_runtime_1.jsxs)("div", { role: "dialog", "aria-modal": "true", "aria-label": "Navigation menu", "aria-expanded": isOpen, className: `
-          fixed top-0 right-0 bottom-0 w-80 max-w-[85vw]
-          bg-white dark:bg-slate-900
-          shadow-[-8px_0_32px_rgba(0,0,0,0.15)]
-          dark:shadow-[-8px_0_32px_rgba(0,0,0,0.4)]
-          z-50 lg:hidden
-          overflow-y-auto
-          transition-transform duration-300 ease-out
-          ${isOpen ? 'translate-x-0' : 'translate-x-full'}
-        `, children: [(0, jsx_runtime_1.jsxs)("div", { className: "flex items-center justify-between p-4 border-b border-gray-200 dark:border-white/10", children: [(0, jsx_runtime_1.jsx)("span", { className: "text-lg font-semibold text-gray-900 dark:text-white", children: "Menu" }), (0, jsx_runtime_1.jsx)("button", { onClick: onClose, className: "\n              p-2 rounded-xl\n              text-gray-400 hover:text-gray-900\n              dark:hover:text-white\n              hover:bg-gray-100 dark:hover:bg-white/10\n              transition-colors\n            ", "aria-label": "Close menu", children: (0, jsx_runtime_1.jsx)(lucide_react_1.X, { className: "h-5 w-5" }) })] }), isAuthenticated && session?.user && ((0, jsx_runtime_1.jsx)("div", { className: "p-4 border-b border-gray-200 dark:border-white/10", children: (0, jsx_runtime_1.jsxs)("div", { className: "flex items-center gap-3", children: [session.user.image ? ((0, jsx_runtime_1.jsx)(image_1.default, { src: session.user.image, alt: "", width: 48, height: 48, className: "w-12 h-12 rounded-full", unoptimized: true })) : ((0, jsx_runtime_1.jsx)("div", { className: "w-12 h-12 rounded-full bg-blue-500 flex items-center justify-center text-white font-semibold text-lg", children: userInitial })), (0, jsx_runtime_1.jsxs)("div", { className: "flex-1 min-w-0", children: [userName && ((0, jsx_runtime_1.jsx)("p", { className: "text-sm font-semibold text-gray-900 dark:text-white truncate", children: userName })), userEmail && ((0, jsx_runtime_1.jsx)("p", { className: "text-xs text-gray-500 dark:text-slate-400 truncate", children: userEmail }))] })] }) })), (0, jsx_runtime_1.jsx)("div", { className: "p-2", children: navItems.map((item) => ((0, jsx_runtime_1.jsxs)(link_1.default, { href: item.href, onClick: onClose, className: `
-                flex items-center gap-3 px-4 py-3.5 rounded-xl
-                transition-colors duration-200
+    return ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsx)("div", { className: `
+          fixed inset-0 bg-black/50 backdrop-blur-sm z-40 lg:hidden
+          transition-opacity duration-300
+          ${isOpen ? 'opacity-100' : 'opacity-0 pointer-events-none'}
+        `, onClick: onClose, "aria-hidden": "true" }), (0, jsx_runtime_1.jsxs)("div", { role: "dialog", "aria-modal": "true", "aria-label": "Navigation menu", "aria-expanded": isOpen, className: `
+          fixed top-0 right-0 bottom-0 w-80 max-w-[85vw]
+          bg-white dark:bg-slate-900
+          shadow-[-8px_0_32px_rgba(0,0,0,0.15)]
+          dark:shadow-[-8px_0_32px_rgba(0,0,0,0.4)]
+          z-50 lg:hidden
+          overflow-y-auto
+          transition-transform duration-300 ease-out
+          ${isOpen ? 'translate-x-0' : 'translate-x-full'}
+        `, children: [(0, jsx_runtime_1.jsxs)("div", { className: "flex items-center justify-between p-4 border-b border-gray-200 dark:border-white/10", children: [(0, jsx_runtime_1.jsx)("span", { className: "text-lg font-semibold text-gray-900 dark:text-white", children: "Menu" }), (0, jsx_runtime_1.jsx)("button", { onClick: onClose, className: "\r\n              p-2 rounded-xl\r\n              text-gray-400 hover:text-gray-900\r\n              dark:hover:text-white\r\n              hover:bg-gray-100 dark:hover:bg-white/10\r\n              transition-colors\r\n            ", "aria-label": "Close menu", children: (0, jsx_runtime_1.jsx)(lucide_react_1.X, { className: "h-5 w-5" }) })] }), isAuthenticated && session?.user && ((0, jsx_runtime_1.jsx)("div", { className: "p-4 border-b border-gray-200 dark:border-white/10", children: (0, jsx_runtime_1.jsxs)("div", { className: "flex items-center gap-3", children: [session.user.image ? ((0, jsx_runtime_1.jsx)(image_1.default, { src: session.user.image, alt: "", width: 48, height: 48, className: "w-12 h-12 rounded-full", unoptimized: true })) : ((0, jsx_runtime_1.jsx)("div", { className: "w-12 h-12 rounded-full bg-blue-500 flex items-center justify-center text-white font-semibold text-lg", children: userInitial })), (0, jsx_runtime_1.jsxs)("div", { className: "flex-1 min-w-0", children: [userName && ((0, jsx_runtime_1.jsx)("p", { className: "text-sm font-semibold text-gray-900 dark:text-white truncate", children: userName })), userEmail && ((0, jsx_runtime_1.jsx)("p", { className: "text-xs text-gray-500 dark:text-slate-400 truncate", children: userEmail }))] })] }) })), (0, jsx_runtime_1.jsx)("div", { className: "p-2", children: navItems.map((item) => ((0, jsx_runtime_1.jsxs)(link_1.default, { href: item.href, onClick: onClose, className: `
+                flex items-center gap-3 px-4 py-3.5 rounded-xl
+                transition-colors duration-200
                 ${isActiveRoute(item.href)
                                 ? 'bg-blue-500/10 text-blue-500'
-                                : 'text-gray-900 dark:text-white hover:bg-gray-100 dark:hover:bg-white/10'}
-              `, children: [item.icon && (0, jsx_runtime_1.jsx)("span", { className: "text-xl", children: item.icon }), (0, jsx_runtime_1.jsx)("span", { className: "font-medium", children: item.label }), isActiveRoute(item.href) && ((0, jsx_runtime_1.jsx)("span", { className: "ml-auto w-2 h-2 rounded-full bg-blue-500" }))] }, item.href))) }), customSections?.map((section, sectionIndex) => ((0, jsx_runtime_1.jsxs)("div", { className: "p-2 border-t border-gray-200 dark:border-white/10", children: [section.title && ((0, jsx_runtime_1.jsx)("p", { className: "px-4 py-2 text-xs font-semibold text-gray-500 dark:text-slate-400 uppercase tracking-wider", children: section.title })), section.items.map((item, itemIndex) => item.href ? ((0, jsx_runtime_1.jsxs)(link_1.default, { href: item.href, onClick: onClose, className: "\n                    flex items-center gap-3 px-4 py-3 rounded-xl\n                    text-gray-900 dark:text-white\n                    hover:bg-gray-100 dark:hover:bg-white/10\n                    transition-colors\n                  ", children: [item.icon && (0, jsx_runtime_1.jsx)("span", { className: "text-xl", children: item.icon }), (0, jsx_runtime_1.jsx)("span", { className: "font-medium", children: item.label })] }, itemIndex)) : ((0, jsx_runtime_1.jsxs)("button", { onClick: () => handleSectionItemClick(item), className: "\n                    flex items-center gap-3 px-4 py-3 rounded-xl w-full text-left\n                    text-gray-900 dark:text-white\n                    hover:bg-gray-100 dark:hover:bg-white/10\n                    transition-colors\n                  ", children: [item.icon && (0, jsx_runtime_1.jsx)("span", { className: "text-xl", children: item.icon }), (0, jsx_runtime_1.jsx)("span", { className: "font-medium", children: item.label })] }, itemIndex)))] }, sectionIndex))), (0, jsx_runtime_1.jsx)("div", { className: "p-4 mt-auto border-t border-gray-200 dark:border-white/10", children: !isAuthenticated ? (unauthActions ?? ((0, jsx_runtime_1.jsx)("div", { className: "space-y-3", children: (0, jsx_runtime_1.jsx)("button", { onClick: handleSignIn, className: "\n                    w-full px-4 py-3 rounded-xl\n                    text-blue-500 font-semibold\n                    border border-blue-500/30\n                    hover:bg-blue-500/10\n                    transition-colors\n                  ", children: "Login" }) }))) : (authFooter ?? ((0, jsx_runtime_1.jsx)(link_1.default, { href: basePath, onClick: onClose, className: "\n                  flex items-center justify-center gap-2\n                  w-full px-4 py-3 rounded-xl\n                  text-gray-500 dark:text-slate-400 font-medium\n                  hover:bg-gray-100 dark:hover:bg-white/10\n                  transition-colors\n                ", children: "Account Settings" }))) })] })] }));
+                                : 'text-gray-900 dark:text-white hover:bg-gray-100 dark:hover:bg-white/10'}
+              `, children: [item.icon && (0, jsx_runtime_1.jsx)("span", { className: "text-xl", children: item.icon }), (0, jsx_runtime_1.jsx)("span", { className: "font-medium", children: item.label }), isActiveRoute(item.href) && ((0, jsx_runtime_1.jsx)("span", { className: "ml-auto w-2 h-2 rounded-full bg-blue-500" }))] }, item.href))) }), customSections?.map((section, sectionIndex) => ((0, jsx_runtime_1.jsxs)("div", { className: "p-2 border-t border-gray-200 dark:border-white/10", children: [section.title && ((0, jsx_runtime_1.jsx)("p", { className: "px-4 py-2 text-xs font-semibold text-gray-500 dark:text-slate-400 uppercase tracking-wider", children: section.title })), section.items.map((item, itemIndex) => item.href ? ((0, jsx_runtime_1.jsxs)(link_1.default, { href: item.href, onClick: onClose, className: "\r\n                    flex items-center gap-3 px-4 py-3 rounded-xl\r\n                    text-gray-900 dark:text-white\r\n                    hover:bg-gray-100 dark:hover:bg-white/10\r\n                    transition-colors\r\n                  ", children: [item.icon && (0, jsx_runtime_1.jsx)("span", { className: "text-xl", children: item.icon }), (0, jsx_runtime_1.jsx)("span", { className: "font-medium", children: item.label })] }, itemIndex)) : ((0, jsx_runtime_1.jsxs)("button", { onClick: () => handleSectionItemClick(item), className: "\r\n                    flex items-center gap-3 px-4 py-3 rounded-xl w-full text-left\r\n                    text-gray-900 dark:text-white\r\n                    hover:bg-gray-100 dark:hover:bg-white/10\r\n                    transition-colors\r\n                  ", children: [item.icon && (0, jsx_runtime_1.jsx)("span", { className: "text-xl", children: item.icon }), (0, jsx_runtime_1.jsx)("span", { className: "font-medium", children: item.label })] }, itemIndex)))] }, sectionIndex))), (0, jsx_runtime_1.jsx)("div", { className: "p-4 mt-auto border-t border-gray-200 dark:border-white/10", children: !isAuthenticated ? (unauthActions ?? ((0, jsx_runtime_1.jsx)("div", { className: "space-y-3", children: (0, jsx_runtime_1.jsx)("button", { onClick: handleSignIn, className: "\r\n                    w-full px-4 py-3 rounded-xl\r\n                    text-blue-500 font-semibold\r\n                    border border-blue-500/30\r\n                    hover:bg-blue-500/10\r\n                    transition-colors\r\n                  ", children: "Login" }) }))) : (authFooter ?? ((0, jsx_runtime_1.jsx)(link_1.default, { href: basePath, onClick: onClose, className: "\r\n                  flex items-center justify-center gap-2\r\n                  w-full px-4 py-3 rounded-xl\r\n                  text-gray-500 dark:text-slate-400 font-medium\r\n                  hover:bg-gray-100 dark:hover:bg-white/10\r\n                  transition-colors\r\n                ", children: "Account Settings" }))) })] })] }));
 }

package/dist/components/account/UserAvatarMenu.js

@@ -80,7 +80,7 @@ function UserAvatarMenu({ basePath = '', showProfile = true, showSettings = true
             router.push(item.href);
         }
     };
-    return ((0, jsx_runtime_1.jsxs)("div", { ref: menuRef, className: "relative", children: [(0, jsx_runtime_1.jsx)("button", { onClick: () => setIsOpen(!isOpen), className: "flex items-center justify-center h-10 w-10 rounded-full overflow-hidden bg-blue-500 text-white font-semibold text-lg hover:opacity-90 transition-opacity focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-offset-2 dark:focus:ring-offset-slate-900", "aria-label": "User menu", "aria-expanded": isOpen, "aria-haspopup": "true", children: session.user.image ? ((0, jsx_runtime_1.jsx)(image_1.default, { src: session.user.image, alt: "", width: 40, height: 40, className: "w-10 h-10 rounded-full object-cover", unoptimized: true })) : (userInitial) }), isOpen && ((0, jsx_runtime_1.jsxs)("div", { className: "absolute right-0 mt-2 w-56 rounded-md shadow-lg z-50\n            bg-white dark:bg-slate-900\n            border border-gray-200 dark:border-slate-700", role: "menu", "aria-orientation": "vertical", children: [(0, jsx_runtime_1.jsx)("div", { className: "px-4 py-3 border-b border-gray-200 dark:border-slate-700", children: (0, jsx_runtime_1.jsxs)("div", { className: "flex items-center gap-3", children: [session.user.image ? ((0, jsx_runtime_1.jsx)(image_1.default, { src: session.user.image, alt: "", width: 32, height: 32, className: "w-8 h-8 rounded-full flex-shrink-0", unoptimized: true })) : ((0, jsx_runtime_1.jsx)("div", { className: "w-8 h-8 rounded-full bg-blue-500 flex items-center justify-center text-white font-semibold text-sm flex-shrink-0", children: userInitial })), (0, jsx_runtime_1.jsxs)("div", { className: "min-w-0", children: [userName && ((0, jsx_runtime_1.jsx)("p", { className: "text-sm font-medium text-gray-700 dark:text-slate-200 truncate", children: userName })), userEmail && ((0, jsx_runtime_1.jsx)("p", { className: "text-sm text-gray-500 dark:text-slate-400 truncate", children: userEmail })), !userName && !userEmail && ((0, jsx_runtime_1.jsx)("p", { className: "text-sm text-gray-500 dark:text-slate-400", children: "Signed in" }))] })] }) }), (0, jsx_runtime_1.jsxs)("div", { className: "py-1", children: [showProfile && ((0, jsx_runtime_1.jsx)(MenuItem, { icon: (0, jsx_runtime_1.jsx)(lucide_react_1.User, { className: "h-4 w-4" }), label: "Profile", onClick: () => handleNavigation(`${basePath}/profile`) })), showSettings && ((0, jsx_runtime_1.jsx)(MenuItem, { icon: (0, jsx_runtime_1.jsx)(lucide_react_1.Settings, { className: "h-4 w-4" }), label: "Settings", onClick: () => handleNavigation(`${basePath}/settings`) })), showSecurity && ((0, jsx_runtime_1.jsx)(MenuItem, { icon: (0, jsx_runtime_1.jsx)(lucide_react_1.Shield, { className: "h-4 w-4" }), label: "Security", onClick: () => handleNavigation(`${basePath}/security`) })), customItems?.map((item, index) => ((0, jsx_runtime_1.jsx)(MenuItem, { icon: item.icon, label: item.label, onClick: () => handleItemClick(item) }, index)))] }), (0, jsx_runtime_1.jsx)("div", { className: "border-t border-gray-200 dark:border-slate-700 py-1", children: (0, jsx_runtime_1.jsx)(MenuItem, { icon: (0, jsx_runtime_1.jsx)(lucide_react_1.LogOut, { className: "h-4 w-4" }), label: "Sign Out", onClick: handleSignOut, variant: "danger" }) })] }))] }));
+    return ((0, jsx_runtime_1.jsxs)("div", { ref: menuRef, className: "relative", children: [(0, jsx_runtime_1.jsx)("button", { onClick: () => setIsOpen(!isOpen), className: "flex items-center justify-center h-10 w-10 rounded-full overflow-hidden bg-blue-500 text-white font-semibold text-lg hover:opacity-90 transition-opacity focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-offset-2 dark:focus:ring-offset-slate-900", "aria-label": "User menu", "aria-expanded": isOpen, "aria-haspopup": "true", children: session.user.image ? ((0, jsx_runtime_1.jsx)(image_1.default, { src: session.user.image, alt: "", width: 40, height: 40, className: "w-10 h-10 rounded-full object-cover", unoptimized: true })) : (userInitial) }), isOpen && ((0, jsx_runtime_1.jsxs)("div", { className: "absolute right-0 mt-2 w-56 rounded-md shadow-lg z-50\r\n            bg-white dark:bg-slate-900\r\n            border border-gray-200 dark:border-slate-700", role: "menu", "aria-orientation": "vertical", children: [(0, jsx_runtime_1.jsx)("div", { className: "px-4 py-3 border-b border-gray-200 dark:border-slate-700", children: (0, jsx_runtime_1.jsxs)("div", { className: "flex items-center gap-3", children: [session.user.image ? ((0, jsx_runtime_1.jsx)(image_1.default, { src: session.user.image, alt: "", width: 32, height: 32, className: "w-8 h-8 rounded-full flex-shrink-0", unoptimized: true })) : ((0, jsx_runtime_1.jsx)("div", { className: "w-8 h-8 rounded-full bg-blue-500 flex items-center justify-center text-white font-semibold text-sm flex-shrink-0", children: userInitial })), (0, jsx_runtime_1.jsxs)("div", { className: "min-w-0", children: [userName && ((0, jsx_runtime_1.jsx)("p", { className: "text-sm font-medium text-gray-700 dark:text-slate-200 truncate", children: userName })), userEmail && ((0, jsx_runtime_1.jsx)("p", { className: "text-sm text-gray-500 dark:text-slate-400 truncate", children: userEmail })), !userName && !userEmail && ((0, jsx_runtime_1.jsx)("p", { className: "text-sm text-gray-500 dark:text-slate-400", children: "Signed in" }))] })] }) }), (0, jsx_runtime_1.jsxs)("div", { className: "py-1", children: [showProfile && ((0, jsx_runtime_1.jsx)(MenuItem, { icon: (0, jsx_runtime_1.jsx)(lucide_react_1.User, { className: "h-4 w-4" }), label: "Profile", onClick: () => handleNavigation(`${basePath}/profile`) })), showSettings && ((0, jsx_runtime_1.jsx)(MenuItem, { icon: (0, jsx_runtime_1.jsx)(lucide_react_1.Settings, { className: "h-4 w-4" }), label: "Settings", onClick: () => handleNavigation(`${basePath}/settings`) })), showSecurity && ((0, jsx_runtime_1.jsx)(MenuItem, { icon: (0, jsx_runtime_1.jsx)(lucide_react_1.Shield, { className: "h-4 w-4" }), label: "Security", onClick: () => handleNavigation(`${basePath}/security`) })), customItems?.map((item, index) => ((0, jsx_runtime_1.jsx)(MenuItem, { icon: item.icon, label: item.label, onClick: () => handleItemClick(item) }, index)))] }), (0, jsx_runtime_1.jsx)("div", { className: "border-t border-gray-200 dark:border-slate-700 py-1", children: (0, jsx_runtime_1.jsx)(MenuItem, { icon: (0, jsx_runtime_1.jsx)(lucide_react_1.LogOut, { className: "h-4 w-4" }), label: "Sign Out", onClick: handleSignOut, variant: "danger" }) })] }))] }));
 }
 function MenuItem({ icon, label, onClick, variant = 'default' }) {
     const baseClasses = "flex items-center w-full px-4 py-2 text-sm cursor-pointer transition-colors";

package/dist/components/admin/AlertSettingsTab.js

@@ -277,22 +277,22 @@ function AlertSettingsTab({ isDark = true, apiBasePath = '/api/admin/alerts', on
                                                         e.preventDefault();
                                                         addRecipient();
                                                     }
-                                                }, placeholder: "Enter email address", className: `
-                  w-full px-3 py-2 rounded-lg text-sm
-                  ${themeClasses.inputBg} ${themeClasses.textPrimary} border
-                  focus:outline-none focus:ring-2 focus:ring-indigo-500
-                  ${recipientError ? (isDark ? 'border-red-500' : 'border-red-400') : ''}
-                ` }), recipientError && ((0, jsx_runtime_1.jsx)("p", { className: `text-xs mt-1 ${isDark ? 'text-red-400' : 'text-red-500'}`, children: recipientError }))] }), (0, jsx_runtime_1.jsxs)("button", { onClick: addRecipient, className: `
-                px-4 py-2 rounded-lg font-medium text-sm transition-colors
-                ${isDark ? 'bg-indigo-600 hover:bg-indigo-700' : 'bg-indigo-500 hover:bg-indigo-600'}
-                text-white flex items-center gap-2
+                                                }, placeholder: "Enter email address", className: `
+                  w-full px-3 py-2 rounded-lg text-sm
+                  ${themeClasses.inputBg} ${themeClasses.textPrimary} border
+                  focus:outline-none focus:ring-2 focus:ring-indigo-500
+                  ${recipientError ? (isDark ? 'border-red-500' : 'border-red-400') : ''}
+                ` }), recipientError && ((0, jsx_runtime_1.jsx)("p", { className: `text-xs mt-1 ${isDark ? 'text-red-400' : 'text-red-500'}`, children: recipientError }))] }), (0, jsx_runtime_1.jsxs)("button", { onClick: addRecipient, className: `
+                px-4 py-2 rounded-lg font-medium text-sm transition-colors
+                ${isDark ? 'bg-indigo-600 hover:bg-indigo-700' : 'bg-indigo-500 hover:bg-indigo-600'}
+                text-white flex items-center gap-2
               `, children: [(0, jsx_runtime_1.jsx)(lucide_react_1.Plus, { size: 16 }), "Add"] })] })] })] }), (0, jsx_runtime_1.jsxs)("div", { className: `${themeClasses.cardBg} border rounded-xl overflow-hidden`, children: [(0, jsx_runtime_1.jsxs)("div", { className: `px-5 py-4 border-b ${isDark ? 'border-slate-700' : 'border-gray-200'}`, children: [(0, jsx_runtime_1.jsxs)("div", { className: "flex items-center gap-2", children: [(0, jsx_runtime_1.jsx)(lucide_react_1.Clock, { className: isDark ? 'text-cyan-400' : 'text-cyan-500', size: 20 }), (0, jsx_runtime_1.jsx)("h3", { className: `font-semibold ${themeClasses.textPrimary}`, children: "Delivery Mode" })] }), (0, jsx_runtime_1.jsx)("p", { className: `text-sm ${themeClasses.textMuted} mt-1`, children: "How alerts are delivered to recipients" })] }), (0, jsx_runtime_1.jsx)("div", { className: "p-5", children: (0, jsx_runtime_1.jsx)("div", { className: "grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-4 gap-3", children: DELIVERY_MODES.map((mode) => {
                                 const isSelected = editedMode === mode.value;
-                                return ((0, jsx_runtime_1.jsxs)("button", { onClick: () => setEditedMode(mode.value), className: `
-                    p-4 rounded-lg border-2 text-left transition-all
+                                return ((0, jsx_runtime_1.jsxs)("button", { onClick: () => setEditedMode(mode.value), className: `
+                    p-4 rounded-lg border-2 text-left transition-all
                     ${isSelected
                                         ? 'border-indigo-500 ' + (isDark ? 'bg-indigo-500/10' : 'bg-indigo-50')
-                                        : (isDark ? 'border-slate-700 hover:border-slate-600' : 'border-gray-200 hover:border-gray-300')}
+                                        : (isDark ? 'border-slate-700 hover:border-slate-600' : 'border-gray-200 hover:border-gray-300')}
                   `, children: [(0, jsx_runtime_1.jsxs)("div", { className: "flex items-center gap-2 mb-1", children: [(0, jsx_runtime_1.jsx)("div", { className: `w-3 h-3 rounded-full border-2 flex items-center justify-center ${isSelected ? 'border-indigo-500' : (isDark ? 'border-slate-500' : 'border-gray-400')}`, children: isSelected && (0, jsx_runtime_1.jsx)("div", { className: "w-1.5 h-1.5 rounded-full bg-indigo-500" }) }), (0, jsx_runtime_1.jsx)("span", { className: `font-medium ${themeClasses.textPrimary}`, children: mode.label })] }), (0, jsx_runtime_1.jsx)("p", { className: `text-xs ${themeClasses.textMuted} ml-5`, children: mode.description })] }, mode.value));
                             }) }) })] }), (0, jsx_runtime_1.jsxs)("div", { className: `${themeClasses.cardBg} border rounded-xl overflow-hidden`, children: [(0, jsx_runtime_1.jsxs)("div", { className: `px-5 py-4 border-b ${isDark ? 'border-slate-700' : 'border-gray-200'}`, children: [(0, jsx_runtime_1.jsxs)("div", { className: "flex items-center gap-2", children: [(0, jsx_runtime_1.jsx)(lucide_react_1.Bell, { className: isDark ? 'text-amber-400' : 'text-amber-500', size: 20 }), (0, jsx_runtime_1.jsx)("h3", { className: `font-semibold ${themeClasses.textPrimary}`, children: "Alert Types" })] }), (0, jsx_runtime_1.jsx)("p", { className: `text-sm ${themeClasses.textMuted} mt-1`, children: "Configure which alerts to receive and their thresholds" })] }), (0, jsx_runtime_1.jsx)("div", { className: "divide-y divide-slate-700/50", children: ALERT_TYPES.map((alertType) => {
                             const config = editedAlerts[alertType.id];
@@ -305,47 +305,47 @@ function AlertSettingsTab({ isDark = true, apiBasePath = '/api/admin/alerts', on
                                                                 else {
                                                                     updateAlertConfig(alertType.id, { threshold: val });
                                                                 }
-                                                            }, disabled: !config.enabled && !alertType.alwaysSent, className: `
-                            w-16 px-2 py-1.5 rounded text-sm text-center
-                            ${themeClasses.inputBg} ${themeClasses.textPrimary} border
-                            focus:outline-none focus:ring-2 focus:ring-indigo-500
-                            disabled:opacity-50
-                          ` }), (0, jsx_runtime_1.jsx)("span", { className: `text-xs ${themeClasses.textMuted} whitespace-nowrap`, children: alertType.thresholdUnit })] })), !alertType.alwaysSent && ((0, jsx_runtime_1.jsx)("button", { onClick: () => updateAlertConfig(alertType.id, { enabled: !config.enabled }), className: `
-                          relative w-11 h-6 rounded-full transition-colors
+                                                            }, disabled: !config.enabled && !alertType.alwaysSent, className: `
+                            w-16 px-2 py-1.5 rounded text-sm text-center
+                            ${themeClasses.inputBg} ${themeClasses.textPrimary} border
+                            focus:outline-none focus:ring-2 focus:ring-indigo-500
+                            disabled:opacity-50
+                          ` }), (0, jsx_runtime_1.jsx)("span", { className: `text-xs ${themeClasses.textMuted} whitespace-nowrap`, children: alertType.thresholdUnit })] })), !alertType.alwaysSent && ((0, jsx_runtime_1.jsx)("button", { onClick: () => updateAlertConfig(alertType.id, { enabled: !config.enabled }), className: `
+                          relative w-11 h-6 rounded-full transition-colors
                           ${config.enabled
                                                         ? (isDark ? 'bg-indigo-600' : 'bg-indigo-500')
-                                                        : (isDark ? 'bg-slate-600' : 'bg-gray-300')}
-                        `, children: (0, jsx_runtime_1.jsx)("span", { className: `
-                            absolute top-1 left-1 w-4 h-4 rounded-full bg-white transition-transform
-                            ${config.enabled ? 'translate-x-5' : ''}
+                                                        : (isDark ? 'bg-slate-600' : 'bg-gray-300')}
+                        `, children: (0, jsx_runtime_1.jsx)("span", { className: `
+                            absolute top-1 left-1 w-4 h-4 rounded-full bg-white transition-transform
+                            ${config.enabled ? 'translate-x-5' : ''}
                           ` }) }))] })] }) }, alertType.id));
-                        }) })] }), (0, jsx_runtime_1.jsxs)("div", { className: `${themeClasses.cardBg} border rounded-xl overflow-hidden`, children: [(0, jsx_runtime_1.jsx)("div", { className: `px-5 py-4 border-b ${isDark ? 'border-slate-700' : 'border-gray-200'}`, children: (0, jsx_runtime_1.jsxs)("div", { className: "flex items-center gap-2", children: [(0, jsx_runtime_1.jsx)(lucide_react_1.Zap, { className: isDark ? 'text-emerald-400' : 'text-emerald-500', size: 20 }), (0, jsx_runtime_1.jsx)("h3", { className: `font-semibold ${themeClasses.textPrimary}`, children: "Rate Limiting" })] }) }), (0, jsx_runtime_1.jsxs)("div", { className: "p-5", children: [(0, jsx_runtime_1.jsxs)("div", { className: "flex items-center gap-4", children: [(0, jsx_runtime_1.jsx)("label", { className: `text-sm ${themeClasses.textSecondary}`, children: "Maximum alerts:" }), (0, jsx_runtime_1.jsx)("input", { type: "number", min: "1", max: "100", value: editedRateLimit, onChange: (e) => setEditedRateLimit(parseInt(e.target.value) || 10), className: `
-                w-20 px-3 py-2 rounded-lg text-sm
-                ${themeClasses.inputBg} ${themeClasses.textPrimary} border
-                focus:outline-none focus:ring-2 focus:ring-indigo-500
+                        }) })] }), (0, jsx_runtime_1.jsxs)("div", { className: `${themeClasses.cardBg} border rounded-xl overflow-hidden`, children: [(0, jsx_runtime_1.jsx)("div", { className: `px-5 py-4 border-b ${isDark ? 'border-slate-700' : 'border-gray-200'}`, children: (0, jsx_runtime_1.jsxs)("div", { className: "flex items-center gap-2", children: [(0, jsx_runtime_1.jsx)(lucide_react_1.Zap, { className: isDark ? 'text-emerald-400' : 'text-emerald-500', size: 20 }), (0, jsx_runtime_1.jsx)("h3", { className: `font-semibold ${themeClasses.textPrimary}`, children: "Rate Limiting" })] }) }), (0, jsx_runtime_1.jsxs)("div", { className: "p-5", children: [(0, jsx_runtime_1.jsxs)("div", { className: "flex items-center gap-4", children: [(0, jsx_runtime_1.jsx)("label", { className: `text-sm ${themeClasses.textSecondary}`, children: "Maximum alerts:" }), (0, jsx_runtime_1.jsx)("input", { type: "number", min: "1", max: "100", value: editedRateLimit, onChange: (e) => setEditedRateLimit(parseInt(e.target.value) || 10), className: `
+                w-20 px-3 py-2 rounded-lg text-sm
+                ${themeClasses.inputBg} ${themeClasses.textPrimary} border
+                focus:outline-none focus:ring-2 focus:ring-indigo-500
               ` }), (0, jsx_runtime_1.jsx)("span", { className: `text-sm ${themeClasses.textMuted}`, children: "per hour" })] }), (0, jsx_runtime_1.jsxs)("div", { className: `flex items-start gap-2 mt-3 text-xs ${themeClasses.textMuted}`, children: [(0, jsx_runtime_1.jsx)(lucide_react_1.Info, { size: 14, className: "flex-shrink-0 mt-0.5" }), (0, jsx_runtime_1.jsx)("span", { children: "Critical alerts (Storage Critical, Agent Expired) are always sent regardless of this limit." })] })] })] }), (0, jsx_runtime_1.jsxs)("div", { className: `${themeClasses.cardBg} border rounded-xl overflow-hidden`, children: [(0, jsx_runtime_1.jsx)("div", { className: `px-5 py-4 border-b ${isDark ? 'border-slate-700' : 'border-gray-200'}`, children: (0, jsx_runtime_1.jsxs)("div", { className: "flex items-center gap-2", children: [(0, jsx_runtime_1.jsx)(lucide_react_1.Send, { className: isDark ? 'text-blue-400' : 'text-blue-500', size: 20 }), (0, jsx_runtime_1.jsx)("h3", { className: `font-semibold ${themeClasses.textPrimary}`, children: "Test & History" })] }) }), (0, jsx_runtime_1.jsxs)("div", { className: "p-5", children: [(0, jsx_runtime_1.jsxs)("div", { className: "flex flex-wrap gap-3", children: [(0, jsx_runtime_1.jsxs)("div", { className: "relative", children: [(0, jsx_runtime_1.jsxs)("select", { disabled: sendingTest || editedRecipients.length === 0, onChange: (e) => {
                                                     if (e.target.value) {
                                                         sendTestAlert(e.target.value);
                                                         e.target.value = '';
                                                     }
-                                                }, className: `
-                  px-4 py-2.5 pr-10 rounded-lg text-sm font-medium cursor-pointer appearance-none
-                  ${isDark ? 'bg-blue-900/30 text-blue-300 border-blue-700 hover:bg-blue-900/50' : 'bg-blue-50 text-blue-700 border-blue-300 hover:bg-blue-100'}
-                  border focus:outline-none focus:ring-2 focus:ring-blue-500
-                  disabled:opacity-50 disabled:cursor-not-allowed
+                                                }, className: `
+                  px-4 py-2.5 pr-10 rounded-lg text-sm font-medium cursor-pointer appearance-none
+                  ${isDark ? 'bg-blue-900/30 text-blue-300 border-blue-700 hover:bg-blue-900/50' : 'bg-blue-50 text-blue-700 border-blue-300 hover:bg-blue-100'}
+                  border focus:outline-none focus:ring-2 focus:ring-blue-500
+                  disabled:opacity-50 disabled:cursor-not-allowed
                 `, children: [(0, jsx_runtime_1.jsx)("option", { value: "", children: "Send Test Alert..." }), TEST_ALERT_OPTIONS.map((opt) => ((0, jsx_runtime_1.jsx)("option", { value: opt.value, children: opt.label }, opt.value)))] }), (0, jsx_runtime_1.jsx)(lucide_react_1.ChevronDown, { className: `absolute right-3 top-1/2 -translate-y-1/2 w-4 h-4 pointer-events-none ${isDark ? 'text-blue-400' : 'text-blue-500'}` })] }), (0, jsx_runtime_1.jsxs)("button", { onClick: () => {
                                             // TODO: Open history modal or navigate to history page
                                             window.open(`${apiBasePath}/history`, '_blank');
-                                        }, className: `
-                px-4 py-2.5 rounded-lg text-sm font-medium flex items-center gap-2
-                ${isDark ? 'bg-slate-700 text-white hover:bg-slate-600' : 'bg-gray-100 text-gray-700 hover:bg-gray-200'}
-                border ${isDark ? 'border-slate-600' : 'border-gray-300'}
-              `, children: [(0, jsx_runtime_1.jsx)(lucide_react_1.History, { size: 16 }), "View Alert History"] })] }), editedRecipients.length === 0 && ((0, jsx_runtime_1.jsx)("p", { className: `text-xs mt-3 ${themeClasses.textMuted}`, children: "Add at least one recipient to send test alerts." }))] })] }), (0, jsx_runtime_1.jsxs)("div", { className: "flex items-center justify-end gap-4", children: [hasChanges && ((0, jsx_runtime_1.jsx)("span", { className: `text-sm ${themeClasses.textMuted}`, children: "You have unsaved changes" })), (0, jsx_runtime_1.jsx)("button", { onClick: saveSettings, disabled: !hasChanges || saving, className: `
-            px-6 py-2.5 rounded-lg font-medium text-sm transition-all
+                                        }, className: `
+                px-4 py-2.5 rounded-lg text-sm font-medium flex items-center gap-2
+                ${isDark ? 'bg-slate-700 text-white hover:bg-slate-600' : 'bg-gray-100 text-gray-700 hover:bg-gray-200'}
+                border ${isDark ? 'border-slate-600' : 'border-gray-300'}
+              `, children: [(0, jsx_runtime_1.jsx)(lucide_react_1.History, { size: 16 }), "View Alert History"] })] }), editedRecipients.length === 0 && ((0, jsx_runtime_1.jsx)("p", { className: `text-xs mt-3 ${themeClasses.textMuted}`, children: "Add at least one recipient to send test alerts." }))] })] }), (0, jsx_runtime_1.jsxs)("div", { className: "flex items-center justify-end gap-4", children: [hasChanges && ((0, jsx_runtime_1.jsx)("span", { className: `text-sm ${themeClasses.textMuted}`, children: "You have unsaved changes" })), (0, jsx_runtime_1.jsx)("button", { onClick: saveSettings, disabled: !hasChanges || saving, className: `
+            px-6 py-2.5 rounded-lg font-medium text-sm transition-all
             ${hasChanges
                             ? 'bg-indigo-600 text-white hover:bg-indigo-700'
-                            : (isDark ? 'bg-slate-700 text-slate-400' : 'bg-gray-200 text-gray-400')}
-            disabled:cursor-not-allowed
+                            : (isDark ? 'bg-slate-700 text-slate-400' : 'bg-gray-200 text-gray-400')}
+            disabled:cursor-not-allowed
           `, children: saving ? ((0, jsx_runtime_1.jsxs)("span", { className: "flex items-center gap-2", children: [(0, jsx_runtime_1.jsx)(lucide_react_1.RefreshCw, { className: "w-4 h-4 animate-spin" }), "Saving..."] })) : ('Save Settings') })] })] }));
 }
 exports.default = AlertSettingsTab;

package/dist/components/admin/LoggingSettingsTab.js

@@ -280,18 +280,18 @@ function LoggingSettingsTab({ isDark = true, apiBasePath = '/api/admin/logging',
     }
     return ((0, jsx_runtime_1.jsxs)("div", { className: "space-y-6", children: [error && ((0, jsx_runtime_1.jsxs)("div", { className: `flex items-center gap-3 p-4 rounded-lg ${isDark ? 'bg-red-900/30 border-red-700' : 'bg-red-50 border-red-300'} border`, children: [(0, jsx_runtime_1.jsx)(lucide_react_1.AlertCircle, { className: isDark ? 'text-red-400' : 'text-red-500', size: 20 }), (0, jsx_runtime_1.jsx)("span", { className: isDark ? 'text-red-300' : 'text-red-700', children: error })] })), successMessage && ((0, jsx_runtime_1.jsxs)("div", { className: `flex items-center gap-3 p-4 rounded-lg ${isDark ? 'bg-green-900/30 border-green-700' : 'bg-green-50 border-green-300'} border`, children: [(0, jsx_runtime_1.jsx)(lucide_react_1.Check, { className: isDark ? 'text-green-400' : 'text-green-500', size: 20 }), (0, jsx_runtime_1.jsx)("span", { className: isDark ? 'text-green-300' : 'text-green-700', children: successMessage })] })), (0, jsx_runtime_1.jsxs)("div", { className: `${themeClasses.cardBg} border rounded-xl overflow-hidden`, children: [(0, jsx_runtime_1.jsxs)("div", { className: `px-5 py-4 border-b ${isDark ? 'border-slate-700' : 'border-gray-200'}`, children: [(0, jsx_runtime_1.jsxs)("div", { className: "flex items-center gap-2", children: [(0, jsx_runtime_1.jsx)(lucide_react_1.Zap, { className: isDark ? 'text-amber-400' : 'text-amber-500', size: 20 }), (0, jsx_runtime_1.jsx)("h3", { className: `font-semibold ${themeClasses.textPrimary}`, children: "Quick Setup" })] }), (0, jsx_runtime_1.jsx)("p", { className: `text-sm ${themeClasses.textMuted} mt-1`, children: "Choose a preset to quickly configure log levels" })] }), (0, jsx_runtime_1.jsx)("div", { className: "p-5", children: (0, jsx_runtime_1.jsx)("div", { className: "flex flex-wrap gap-3", children: PRESETS.map((preset) => {
                                 const isActive = getActivePreset() === preset.id;
-                                return ((0, jsx_runtime_1.jsx)("button", { onClick: () => applyPreset(preset.id), className: `
-                    px-4 py-2.5 rounded-lg font-medium text-sm transition-all
+                                return ((0, jsx_runtime_1.jsx)("button", { onClick: () => applyPreset(preset.id), className: `
+                    px-4 py-2.5 rounded-lg font-medium text-sm transition-all
                     ${isActive
                                         ? 'bg-indigo-600 text-white ring-2 ring-indigo-500 ring-offset-2 ' + (isDark ? 'ring-offset-slate-800' : 'ring-offset-white')
-                                        : (isDark ? 'bg-slate-700 text-white hover:bg-slate-600' : 'bg-gray-100 text-gray-700 hover:bg-gray-200')}
+                                        : (isDark ? 'bg-slate-700 text-white hover:bg-slate-600' : 'bg-gray-100 text-gray-700 hover:bg-gray-200')}
                   `, children: preset.label }, preset.id));
                             }) }) })] }), (0, jsx_runtime_1.jsxs)("div", { className: `${themeClasses.cardBg} border rounded-xl overflow-hidden`, children: [(0, jsx_runtime_1.jsxs)("div", { className: `px-5 py-4 border-b ${isDark ? 'border-slate-700' : 'border-gray-200'}`, children: [(0, jsx_runtime_1.jsxs)("div", { className: "flex items-center gap-2", children: [(0, jsx_runtime_1.jsx)(lucide_react_1.Bug, { className: isDark ? 'text-violet-400' : 'text-violet-500', size: 20 }), (0, jsx_runtime_1.jsx)("h3", { className: `font-semibold ${themeClasses.textPrimary}`, children: "Log Levels" })] }), (0, jsx_runtime_1.jsx)("p", { className: `text-sm ${themeClasses.textMuted} mt-1`, children: "Set verbosity per category" })] }), (0, jsx_runtime_1.jsx)("div", { className: "p-5", children: (0, jsx_runtime_1.jsx)("div", { className: "space-y-4", children: CATEGORIES.map((category) => ((0, jsx_runtime_1.jsxs)("div", { className: "flex items-center justify-between", children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("p", { className: `font-medium ${themeClasses.textPrimary}`, children: category.label }), (0, jsx_runtime_1.jsx)("p", { className: `text-xs ${themeClasses.textMuted}`, children: category.description })] }), (0, jsx_runtime_1.jsx)("select", { value: editedLevels?.[category.id] || 'info', onChange: (e) => {
                                             setEditedLevels(prev => prev ? { ...prev, [category.id]: e.target.value } : null);
-                                        }, className: `
-                    px-3 py-2 rounded-lg text-sm font-medium cursor-pointer
-                    ${themeClasses.inputBg} ${themeClasses.textPrimary} border
-                    focus:outline-none focus:ring-2 focus:ring-indigo-500
+                                        }, className: `
+                    px-3 py-2 rounded-lg text-sm font-medium cursor-pointer
+                    ${themeClasses.inputBg} ${themeClasses.textPrimary} border
+                    focus:outline-none focus:ring-2 focus:ring-indigo-500
                   `, children: LOG_LEVELS.map((level) => ((0, jsx_runtime_1.jsx)("option", { value: level.value, children: level.label }, level.value))) })] }, category.id))) }) })] }), (0, jsx_runtime_1.jsxs)("div", { className: `${themeClasses.cardBg} border rounded-xl overflow-hidden`, children: [(0, jsx_runtime_1.jsxs)("div", { className: `px-5 py-4 border-b ${isDark ? 'border-slate-700' : 'border-gray-200'}`, children: [(0, jsx_runtime_1.jsxs)("div", { className: "flex items-center gap-2", children: [(0, jsx_runtime_1.jsx)(lucide_react_1.Clock, { className: isDark ? 'text-cyan-400' : 'text-cyan-500', size: 20 }), (0, jsx_runtime_1.jsx)("h3", { className: `font-semibold ${themeClasses.textPrimary}`, children: "Retention Settings" })] }), (0, jsx_runtime_1.jsx)("p", { className: `text-sm ${themeClasses.textMuted} mt-1`, children: "How long to keep logs by severity level" })] }), (0, jsx_runtime_1.jsx)("div", { className: "p-5", children: (0, jsx_runtime_1.jsx)("div", { className: "grid grid-cols-2 sm:grid-cols-3 lg:grid-cols-5 gap-4", children: [
                                 { key: 'debug_days', label: 'Debug' },
                                 { key: 'info_days', label: 'Info' },
@@ -300,22 +300,22 @@ function LoggingSettingsTab({ isDark = true, apiBasePath = '/api/admin/logging',
                                 { key: 'critical_days', label: 'Critical' },
                             ].map((item) => ((0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("label", { className: `block text-sm ${themeClasses.textSecondary} mb-1`, children: item.label }), (0, jsx_runtime_1.jsxs)("div", { className: "flex items-center gap-2", children: [(0, jsx_runtime_1.jsx)("input", { type: "number", min: "1", max: "365", value: editedRetention?.[item.key] || 7, onChange: (e) => {
                                                     setEditedRetention(prev => prev ? { ...prev, [item.key]: parseInt(e.target.value) || 7 } : null);
-                                                }, className: `
-                      w-20 px-3 py-2 rounded-lg text-sm
-                      ${themeClasses.inputBg} ${themeClasses.textPrimary} border
-                      focus:outline-none focus:ring-2 focus:ring-indigo-500
+                                                }, className: `
+                      w-20 px-3 py-2 rounded-lg text-sm
+                      ${themeClasses.inputBg} ${themeClasses.textPrimary} border
+                      focus:outline-none focus:ring-2 focus:ring-indigo-500
                     ` }), (0, jsx_runtime_1.jsx)("span", { className: `text-sm ${themeClasses.textMuted}`, children: "days" })] })] }, item.key))) }) })] }), (0, jsx_runtime_1.jsxs)("div", { className: `${themeClasses.cardBg} border rounded-xl overflow-hidden`, children: [(0, jsx_runtime_1.jsx)("div", { className: `px-5 py-4 border-b ${isDark ? 'border-slate-700' : 'border-gray-200'}`, children: (0, jsx_runtime_1.jsxs)("div", { className: "flex items-center gap-2", children: [(0, jsx_runtime_1.jsx)(lucide_react_1.HardDrive, { className: isDark ? 'text-emerald-400' : 'text-emerald-500', size: 20 }), (0, jsx_runtime_1.jsx)("h3", { className: `font-semibold ${themeClasses.textPrimary}`, children: "Storage Limits" })] }) }), (0, jsx_runtime_1.jsxs)("div", { className: "p-5 space-y-6", children: [(0, jsx_runtime_1.jsxs)("div", { className: "flex flex-wrap items-center gap-6", children: [(0, jsx_runtime_1.jsxs)("div", { className: "flex items-center gap-2", children: [(0, jsx_runtime_1.jsx)("label", { className: `text-sm ${themeClasses.textSecondary}`, children: "Max size:" }), (0, jsx_runtime_1.jsx)("input", { type: "number", min: "1", max: "1000", value: editedLimits?.max_size_mb || 10, onChange: (e) => {
                                                     setEditedLimits(prev => prev ? { ...prev, max_size_mb: parseInt(e.target.value) || 10 } : null);
-                                                }, className: `
-                  w-20 px-3 py-2 rounded-lg text-sm
-                  ${themeClasses.inputBg} ${themeClasses.textPrimary} border
-                  focus:outline-none focus:ring-2 focus:ring-indigo-500
+                                                }, className: `
+                  w-20 px-3 py-2 rounded-lg text-sm
+                  ${themeClasses.inputBg} ${themeClasses.textPrimary} border
+                  focus:outline-none focus:ring-2 focus:ring-indigo-500
                 ` }), (0, jsx_runtime_1.jsx)("span", { className: `text-sm ${themeClasses.textMuted}`, children: "MB" })] }), (0, jsx_runtime_1.jsx)("span", { className: themeClasses.textMuted, children: "or" }), (0, jsx_runtime_1.jsxs)("div", { className: "flex items-center gap-2", children: [(0, jsx_runtime_1.jsx)("input", { type: "number", min: "100", max: "1000000", step: "1000", value: editedLimits?.max_rows || 20000, onChange: (e) => {
                                                     setEditedLimits(prev => prev ? { ...prev, max_rows: parseInt(e.target.value) || 20000 } : null);
-                                                }, className: `
-                  w-28 px-3 py-2 rounded-lg text-sm
-                  ${themeClasses.inputBg} ${themeClasses.textPrimary} border
-                  focus:outline-none focus:ring-2 focus:ring-indigo-500
+                                                }, className: `
+                  w-28 px-3 py-2 rounded-lg text-sm
+                  ${themeClasses.inputBg} ${themeClasses.textPrimary} border
+                  focus:outline-none focus:ring-2 focus:ring-indigo-500
                 ` }), (0, jsx_runtime_1.jsx)("span", { className: `text-sm ${themeClasses.textMuted}`, children: "rows" })] })] }), usage && ((0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsxs)("div", { className: "flex items-center justify-between mb-2", children: [(0, jsx_runtime_1.jsx)("span", { className: `text-sm ${themeClasses.textSecondary}`, children: "Current usage" }), (0, jsx_runtime_1.jsxs)("span", { className: `text-sm font-medium ${themeClasses.textPrimary}`, children: [usage.total_size_mb?.toFixed(1) || 0, " MB of ", usage.limits.max_size_mb, " MB (", usage.percent_used || 0, "%)"] })] }), (0, jsx_runtime_1.jsx)("div", { className: `h-3 rounded-full overflow-hidden ${isDark ? 'bg-slate-700' : 'bg-gray-200'}`, children: (0, jsx_runtime_1.jsx)("div", { className: `h-full rounded-full transition-all ${(usage.percent_used || 0) > 90 ? 'bg-red-500' :
                                                 (usage.percent_used || 0) > 70 ? 'bg-amber-500' :
                                                     'bg-emerald-500'}`, style: { width: `${Math.min(usage.percent_used || 0, 100)}%` } }) }), (0, jsx_runtime_1.jsxs)("div", { className: `flex items-center justify-between mt-2 text-xs ${themeClasses.textMuted}`, children: [(0, jsx_runtime_1.jsxs)("span", { children: [(usage.total_rows || 0).toLocaleString(), " rows"] }), usage.oldest_entry && ((0, jsx_runtime_1.jsxs)("span", { children: ["Oldest: ", new Date(usage.oldest_entry).toLocaleDateString()] }))] })] })), (0, jsx_runtime_1.jsxs)("div", { className: "flex items-center gap-4", children: [(0, jsx_runtime_1.jsxs)("div", { className: "relative", children: [(0, jsx_runtime_1.jsxs)("select", { disabled: pruning, onChange: (e) => {
@@ -323,17 +323,17 @@ function LoggingSettingsTab({ isDark = true, apiBasePath = '/api/admin/logging',
                                                         handlePrune(e.target.value);
                                                         e.target.value = '';
                                                     }
-                                                }, className: `
-                  px-4 py-2.5 pr-10 rounded-lg text-sm font-medium cursor-pointer appearance-none
-                  ${isDark ? 'bg-red-900/30 text-red-300 border-red-700 hover:bg-red-900/50' : 'bg-red-50 text-red-700 border-red-300 hover:bg-red-100'}
-                  border focus:outline-none focus:ring-2 focus:ring-red-500
-                  disabled:opacity-50 disabled:cursor-not-allowed
-                `, children: [(0, jsx_runtime_1.jsx)("option", { value: "", children: "Prune Now..." }), PRUNE_OPTIONS.map((opt) => ((0, jsx_runtime_1.jsx)("option", { value: opt.value, children: opt.label }, opt.value)))] }), (0, jsx_runtime_1.jsx)(lucide_react_1.ChevronDown, { className: `absolute right-3 top-1/2 -translate-y-1/2 w-4 h-4 pointer-events-none ${isDark ? 'text-red-400' : 'text-red-500'}` })] }), pruning && ((0, jsx_runtime_1.jsxs)("span", { className: `flex items-center gap-2 text-sm ${themeClasses.textMuted}`, children: [(0, jsx_runtime_1.jsx)(lucide_react_1.RefreshCw, { className: "w-4 h-4 animate-spin" }), "Pruning..."] }))] })] })] }), (0, jsx_runtime_1.jsxs)("div", { className: "flex items-center justify-end gap-4", children: [hasChanges && ((0, jsx_runtime_1.jsx)("span", { className: `text-sm ${themeClasses.textMuted}`, children: "You have unsaved changes" })), (0, jsx_runtime_1.jsx)("button", { onClick: saveSettings, disabled: !hasChanges || saving, className: `
-            px-6 py-2.5 rounded-lg font-medium text-sm transition-all
+                                                }, className: `
+                  px-4 py-2.5 pr-10 rounded-lg text-sm font-medium cursor-pointer appearance-none
+                  ${isDark ? 'bg-red-900/30 text-red-300 border-red-700 hover:bg-red-900/50' : 'bg-red-50 text-red-700 border-red-300 hover:bg-red-100'}
+                  border focus:outline-none focus:ring-2 focus:ring-red-500
+                  disabled:opacity-50 disabled:cursor-not-allowed
+                `, children: [(0, jsx_runtime_1.jsx)("option", { value: "", children: "Prune Now..." }), PRUNE_OPTIONS.map((opt) => ((0, jsx_runtime_1.jsx)("option", { value: opt.value, children: opt.label }, opt.value)))] }), (0, jsx_runtime_1.jsx)(lucide_react_1.ChevronDown, { className: `absolute right-3 top-1/2 -translate-y-1/2 w-4 h-4 pointer-events-none ${isDark ? 'text-red-400' : 'text-red-500'}` })] }), pruning && ((0, jsx_runtime_1.jsxs)("span", { className: `flex items-center gap-2 text-sm ${themeClasses.textMuted}`, children: [(0, jsx_runtime_1.jsx)(lucide_react_1.RefreshCw, { className: "w-4 h-4 animate-spin" }), "Pruning..."] }))] })] })] }), (0, jsx_runtime_1.jsxs)("div", { className: "flex items-center justify-end gap-4", children: [hasChanges && ((0, jsx_runtime_1.jsx)("span", { className: `text-sm ${themeClasses.textMuted}`, children: "You have unsaved changes" })), (0, jsx_runtime_1.jsx)("button", { onClick: saveSettings, disabled: !hasChanges || saving, className: `
+            px-6 py-2.5 rounded-lg font-medium text-sm transition-all
             ${hasChanges
                             ? 'bg-indigo-600 text-white hover:bg-indigo-700'
-                            : (isDark ? 'bg-slate-700 text-slate-400' : 'bg-gray-200 text-gray-400')}
-            disabled:cursor-not-allowed
+                            : (isDark ? 'bg-slate-700 text-slate-400' : 'bg-gray-200 text-gray-400')}
+            disabled:cursor-not-allowed
           `, children: saving ? ((0, jsx_runtime_1.jsxs)("span", { className: "flex items-center gap-2", children: [(0, jsx_runtime_1.jsx)(lucide_react_1.RefreshCw, { className: "w-4 h-4 animate-spin" }), "Saving..."] })) : ('Save Settings') })] })] }));
 }
 exports.default = LoggingSettingsTab;

package/dist/lib/ensure-fresh-access-token.js

@@ -200,15 +200,38 @@ async function ensureFreshAccessToken(sessionToken, config, options = {}) {
         if (!idpResponse.ok) {
             const idpError = responseData?.error || {};
             const code = idpError.code || 'UNKNOWN_ERROR';
-            const discardToken = idpResponse.status === 401 || idpError.discard_token === true;
+            let discardToken = idpResponse.status === 401 || idpError.discard_token === true;
             const retryable = idpResponse.status !== 401 && idpError.retryable === true;
             if (discardToken) {
-                await (0, session_store_1.updateSession)(sessionToken, {
-                    idpRefreshToken: '',
-                    idpRefreshTokenExpires: undefined,
-                    refreshTokenClearedAt: Date.now(),
-                    refreshTokenClearedReason: `IDP_DISCARD_TOKEN:${code}`,
-                });
+                // Race-safe discard (CAS): only clear if the refresh token we used is STILL
+                // current. A concurrent refresh may have already rotated it — our 401 is then
+                // stale/expected, and wiping here would silently log out a healthy session
+                // (the rotation-race wipe, QA 6873 site 1/2). Compare-and-skip if it changed;
+                // a concurrent rotation is NOT a terminal condition.
+                const postRefresh = await (0, session_store_1.getSession)(sessionToken);
+                const tokenUnchanged = !!session.idpRefreshToken && postRefresh?.idpRefreshToken === session.idpRefreshToken;
+                if (tokenUnchanged) {
+                    await (0, session_store_1.updateSession)(sessionToken, {
+                        idpRefreshToken: '',
+                        idpRefreshTokenExpires: undefined,
+                        refreshTokenClearedAt: Date.now(),
+                        refreshTokenClearedReason: `IDP_DISCARD_TOKEN:${code}`,
+                    });
+                }
+                else {
+                    // Concurrent refresh already rotated the token — our 401 is stale. Return the
+                    // freshly-rotated token directly so the loser succeeds without a retry round-trip
+                    // (race-fix follow-up #1).
+                    discardToken = false;
+                    if (postRefresh?.idpAccessToken && postRefresh.idpAccessTokenExpires) {
+                        return {
+                            ok: true,
+                            accessToken: postRefresh.idpAccessToken,
+                            accessTokenExpires: postRefresh.idpAccessTokenExpires,
+                            refreshed: true,
+                        };
+                    }
+                }
             }
             return {
                 ok: false,

package/dist/lib/idp-fetch.js

@@ -67,6 +67,14 @@ async function ensureFreshAccessToken(req) {
         return {};
     }
     let session = await (0, session_store_1.getSession)(sessionToken);
+    // Fall back to Better Auth Redis key when app session is missing/stale
+    if (!session || !session.idpAccessToken) {
+        const { getBetterAuthSession } = await Promise.resolve().then(() => __importStar(require('./session-store')));
+        const baSession = await getBetterAuthSession(sessionToken);
+        if (baSession?.idpAccessToken) {
+            session = baSession;
+        }
+    }
     // Fall back to Better Auth: decode session from cookies to get IDP tokens
     if (!session?.idpAccessToken) {
         try {
@@ -81,28 +89,34 @@ async function ensureFreshAccessToken(req) {
     console.log('[IDP_FETCH] Redis session lookup:', {
         hasSession: !!session,
         hasAccessToken: !!session?.idpAccessToken,
+        hasRefreshToken: !!session?.idpRefreshToken,
         bearerKeyId: session?.bearerKeyId || 'NOT_SET',
         idpClientId: session?.idpClientId || 'NOT_SET',
     });
     if (!session?.idpAccessToken)
         return { sessionToken };
+    const hasRefreshToken = !!session.idpRefreshToken;
     const now = Date.now();
     const timeLeft = (session.idpAccessTokenExpires ?? now) - now;
     // Treat tokens as effectively expired if within 5 minutes of expiry
     if (timeLeft > 5 * 60 * 1000) {
-        return { sessionToken, accessToken: session.idpAccessToken };
+        return { sessionToken, accessToken: session.idpAccessToken, hasRefreshToken };
     }
-    // attempt refresh once via centralized internal API helper
-    try {
-        await (0, internal_api_1.internalRefresh)(req.headers.get('cookie') || '', sessionToken);
+    // Only attempt refresh when we actually have a refresh token to use.
+    // Provisional tokens (issued before 2FA completion) have no refresh token.
+    if (hasRefreshToken) {
+        try {
+            await (0, internal_api_1.internalRefresh)(req.headers.get('cookie') || '', sessionToken);
+        }
+        catch { }
+        session = await (0, session_store_1.getSession)(sessionToken);
+        return { sessionToken, accessToken: session?.idpAccessToken, hasRefreshToken: !!session?.idpRefreshToken };
     }
-    catch { }
-    session = await (0, session_store_1.getSession)(sessionToken);
-    return { sessionToken, accessToken: session?.idpAccessToken };
+    return { sessionToken, accessToken: session.idpAccessToken, hasRefreshToken };
 }
 async function idpFetchJSON(req, targetUrl, init = {}) {
     let attemptedRefresh = false;
-    let { accessToken, sessionToken } = await ensureFreshAccessToken(req);
+    let { accessToken, sessionToken, hasRefreshToken } = await ensureFreshAccessToken(req);
     const makeCall = async (bearer) => {
         const res = await fetch(targetUrl, {
             ...init,
@@ -119,7 +133,9 @@ async function idpFetchJSON(req, targetUrl, init = {}) {
     };
     // First attempt
     let { res, json } = await makeCall(accessToken);
-    if ((res.status === 401 || res.status === 403) && sessionToken && !attemptedRefresh) {
+    // Only attempt refresh on 401/403 if we actually have a refresh token.
+    // Provisional tokens (pre-2FA) have no refresh token — refreshing is futile.
+    if ((res.status === 401 || res.status === 403) && sessionToken && hasRefreshToken && !attemptedRefresh) {
         attemptedRefresh = true;
         try {
             // Use centralized internal API helper for server-to-server calls

package/dist/lib/session-store.d.ts

@@ -9,6 +9,7 @@
  */
 import { SessionData } from '../models/SessionModel';
 export type { SessionData } from '../models/SessionModel';
+export declare const SESSION_TTL: number;
 export interface RefreshLockInfo {
     sessionToken: string;
     acquiredAt: number;