@payez/next-mvp 4.10.0 → 4.11.0

package/src/lib/session-store.ts

@@ -14,6 +14,7 @@ import { SessionData } from '../models/SessionModel';
 import { getSessionPrefix, getRefreshLockPrefix, getAppSlug } from './app-slug';
 import { extractKidFromToken, decodeIdpAccessToken } from '../auth/utils/token-utils';
 import { tokenLogId } from './token-log-id';
+import { refreshTokenIdentity } from './refresh-in-doubt';
 
 // Re-export SessionData for consumers
 export type { SessionData } from '../models/SessionModel';
@@ -293,12 +294,23 @@ export async function deleteSessionEverywhere(sessionToken: string, appSlug?: st
  * today; this is the defence BAPert ruled to keep anyway.
  */
 function dropStaleDiscardMarker<T extends object>(session: T): T {
-  const s = session as any;
+  let s = session as any;
   if (typeof s.idpRefreshToken === 'string' && s.idpRefreshToken.length > 0 && (s.refreshTokenClearedReason !== undefined || s.refreshTokenClearedAt !== undefined)) {
     const { refreshTokenClearedReason: _reason, refreshTokenClearedAt: _at, ...rest } = s;
-    return rest as T;
+    s = rest;
   }
-  return session;
+  // BAPert 76403: the refresh-IN-DOUBT marker (lib/refresh-in-doubt) is cleared by the same write that stores a NEW refresh token, i.e. one
+  // whose identity differs from the one left in doubt. A write that stores the SAME token (any caller spreading the whole row back) does
+  // NOT clear it: that token is still the in-doubt one.
+  if (
+    typeof s.refreshInDoubtTokenHash === 'string' &&
+    typeof s.idpRefreshToken === 'string' && s.idpRefreshToken.length > 0 &&
+    refreshTokenIdentity(s.idpRefreshToken) !== s.refreshInDoubtTokenHash
+  ) {
+    const { refreshInDoubtTokenHash: _hash, refreshInDoubtAt: _doubtAt, ...rest } = s;
+    s = rest;
+  }
+  return s as T;
 }
 
 export async function setSession(sessionToken: string, data: SessionData): Promise<void> {

package/src/lib/token-lifecycle.ts

@@ -26,9 +26,10 @@ import { getSession as getBetterAuthSession } from '../server/auth';
 import { getRedis } from './redis';
 import { getAppSlug } from './app-slug';
 import { tokenLogId } from './token-log-id';
+import { REFRESH_WINDOW_MS } from './refresh-window';
 
-// 5 minute threshold for "needs refresh" - matches refresh handler pattern
-const REFRESH_THRESHOLD_MS = 5 * 60 * 1000;
+// "needs refresh" threshold: THE one freshness window (lib/refresh-window), the same value the refresh route, ensureFreshAccessToken and idp-fetch use.
+const REFRESH_THRESHOLD_MS = REFRESH_WINDOW_MS;
 
 // Concurrent refresh handling configuration
 const CONCURRENT_REFRESH_POLL_INTERVAL_MS = 200; // How often to poll session during concurrent refresh

package/src/models/SessionModel.ts

@@ -59,6 +59,13 @@ export interface SessionData {
 
   /** When the IDP refresh token expires (Unix timestamp ms) */
   idpRefreshTokenExpires?: number;
+  /**
+   * BAPert 76403 (lib/refresh-in-doubt): set when a refresh fetch TIMED OUT. A SHA-256 identity of the refresh token that was sent (never the
+   * token), and when. A later attempt whose token-to-send matches refuses without calling the IdP. Cleared by the write that stores a different
+   * refresh token.
+   */
+  refreshInDoubtTokenHash?: string;
+  refreshInDoubtAt?: number;
 
   /** Decoded IDP access token claims (for quick access without re-decoding) */
   decodedAccessToken?: any;

package/src/server/auth.ts

@@ -407,7 +407,7 @@ export interface FreshIdpTokenConfig {
   idpBaseUrl: string;
   clientId: string;
   refreshEndpoint?: string;
-  /** Refresh if the access token is within this many ms of expiry. Default 60_000. */
+  /** Refresh if the access token is within this many ms of expiry. Default REFRESH_WINDOW_MS (5 min, lib/refresh-window). */
   safetyWindowMs?: number;
 }
 

package/src/stores/authStore.ts

@@ -27,6 +27,7 @@ import {
   getSecureCsrfCookieName
 } from '../lib/app-slug';
 import { tokenLogId } from '../lib/token-log-id';
+import { REFRESH_WINDOW_MS } from '../lib/refresh-window';
 
 // ===============================
 // INTERFACES & TYPES
@@ -752,8 +753,8 @@ export const useAuthStore = create<AuthStore>()(
               const now = Date.now();
               const timeUntilExpiry = tokenExpiry - now;
               
-              // Token should be fresh (not expiring in next 5 minutes)
-              if (timeUntilExpiry < (5 * 60 * 1000)) {
+              // Token should be fresh (not expiring within the one refresh window)
+              if (timeUntilExpiry < REFRESH_WINDOW_MS) {
                 throw new Error(`Fresh token still expires soon: ${timeUntilExpiry}ms`);
               }