@payez/next-mvp 4.10.0 → 4.12.0

package/src/lib/log-safe.ts

@@ -0,0 +1,30 @@
+/**
+ * log-safe: the ONLY way a caught error or an upstream `code` goes into a server log (PII-in-logs census, BAPert 76553 group 1; ported from the
+ * portal's api-error-response.ts, BAPert 76470).
+ *
+ * Server logs persist and are read beyond the person who made the request. An error's `message`, `stack`, `cause` and `details` can carry an
+ * email, a phone number, a code, a token, a SQL fragment or a host: an IdP error's message is the upstream's own free text, and V8's JSON parse
+ * error quotes its input. So a log line gets the error's NAME and a closed STATUS / CODE, nothing else. Every field is matched against a closed
+ * shape; anything that does not match is dropped, not truncated.
+ *
+ * No imports on purpose: this is a leaf, loaded by modules that must not pull in anything else.
+ */
+
+/** An upstream `code` is loggable only if it is a closed token (UPPER_SNAKE). Anything else, including free text, becomes null. */
+export function closedCodeForLog(code: unknown): string | null {
+  return typeof code === 'string' && /^[A-Z0-9_]{1,64}$/.test(code) ? code : null;
+}
+
+/**
+ * Describe a caught error for a log line: `error=<Name> [status=<n>] [code=<CLOSED_CODE>]`.
+ * It NEVER carries `message`, `stack`, `cause` or `details`. A name that is not a short identifier (a hostile or free-text `name`) becomes
+ * `NonError`; a status outside 100-599 is dropped; a code outside the closed token shape is dropped.
+ */
+export function errForLog(err: unknown): string {
+  const e = (err !== null && typeof err === 'object' ? err : {}) as { name?: unknown; status?: unknown; code?: unknown };
+  const name = typeof e.name === 'string' && /^[A-Za-z0-9_]{1,48}$/.test(e.name) ? e.name : 'NonError';
+  const status = typeof e.status === 'number' && Number.isInteger(e.status) && e.status >= 100 && e.status <= 599 ? ` status=${e.status}` : '';
+  const closed = closedCodeForLog(e.code);
+  const code = closed ? ` code=${closed}` : '';
+  return `error=${name}${status}${code}`;
+}

package/src/lib/redis.ts

@@ -1,5 +1,6 @@
 // E:\Repos\PayEz-Next-MVP\packages\next-mvp\src\lib\redis.ts
 import Redis, { RedisOptions } from 'ioredis';
+import { errForLog } from './log-safe';
 
 let client: Redis | null = null;
 
@@ -76,7 +77,7 @@ function createClient(): Redis {
   // unhandled EventEmitter error, which can take the whole PROCESS down -
   // a Redis blip becoming a dead server is worse than the spinner was.
   instance.on('error', (err) => {
-    console.error(`[redis] PATH FAILURE ${new Date().toISOString()}: ${err instanceof Error ? err.message : String(err)}`);
+    console.error(`[redis] PATH FAILURE ${new Date().toISOString()}: ${errForLog(err)}`);
   });
 
   // 185121 line 3: the 16:05 event left no named trigger because ONLY 'error'

package/src/lib/refresh-in-doubt.ts

@@ -0,0 +1,79 @@
+/**
+ * The IdP fetch timeout and the "refresh in doubt" marker (BAPert 76397 decision 3, corrected by 76403; Core facts DotNetPert 76400).
+ *
+ * THE PROBLEM. Core consumes a refresh token with one atomic UPDATE and has NO reuse grace: re-presenting a used token revokes every newer
+ * refresh token the USER holds, on every device (RevokeDescendantTokens). So when OUR fetch to the IdP times out, we do not know whether Core
+ * consumed the token and minted a replacement whose answer we never saw. The store still holds the token we SENT (nothing was persisted).
+ * Holding the refresh lock only delays the next request by its 60 s TTL; after that the next request re-reads the same token and replays it.
+ *
+ * THE RULE. A timed-out refresh answers 504 UPSTREAM_TIMEOUT and records, on the session row, an IDENTITY (a SHA-256, never the token and
+ * never a prefix of it) of the token that was sent. Any later attempt whose token-to-send matches that identity refuses WITHOUT calling the
+ * IdP: terminal REFRESH_OUTCOME_UNKNOWN / REAUTHENTICATE. One login on one session is better than a user-wide revocation. The marker is
+ * dropped by the same write that stores a DIFFERENT refresh token (session-store `dropStaleDiscardMarker`); nothing tries to resolve the doubt
+ * without a login.
+ *
+ * Leaf module: no imports from the rest of the package, so session-store can use it without a cycle.
+ */
+import { createHash } from 'crypto';
+
+/** How long a refresh fetch (connect, response and body) may take. 5 s lock wait + this + the persist stays well inside the 60 s lock TTL. */
+export const REFRESH_FETCH_TIMEOUT_MS = 10_000;
+
+/** The typed terminal answer for an attempt that would re-send an in-doubt token. */
+export const REFRESH_OUTCOME_UNKNOWN_CODE = 'REFRESH_OUTCOME_UNKNOWN';
+
+/** The typed answer for the timed-out call itself. */
+export const UPSTREAM_TIMEOUT_CODE = 'UPSTREAM_TIMEOUT';
+
+/** A one-way identity for a refresh token. Not reversible and not a prefix. */
+export function refreshTokenIdentity(token: string): string {
+  return createHash('sha256').update(token, 'utf8').digest('hex');
+}
+
+/** The row fields recorded at a timeout. */
+export function inDoubtPatch(sentToken: string): { refreshInDoubtTokenHash: string; refreshInDoubtAt: number } {
+  return { refreshInDoubtTokenHash: refreshTokenIdentity(sentToken), refreshInDoubtAt: Date.now() };
+}
+
+/** True when the token we are about to send is the one a previous attempt left in doubt. */
+export function isRefreshInDoubt(
+  session: { refreshInDoubtTokenHash?: string | null } | null | undefined,
+  tokenToSend: string | null | undefined,
+): boolean {
+  if (!session || typeof session.refreshInDoubtTokenHash !== 'string' || !session.refreshInDoubtTokenHash) return false;
+  if (typeof tokenToSend !== 'string' || tokenToSend.length === 0) return false;
+  return refreshTokenIdentity(tokenToSend) === session.refreshInDoubtTokenHash;
+}
+
+/** True for the error `AbortSignal.timeout` produces (a DOMException named TimeoutError); AbortError is treated the same. */
+export function isTimeoutError(err: unknown): boolean {
+  const name = (err as { name?: string } | null | undefined)?.name;
+  return name === 'TimeoutError' || name === 'AbortError';
+}
+
+/**
+ * The ONLY transport error codes that PROVE the request never left this process (BAPert 76433 item 4): the connection was refused, or the
+ * name did not resolve. Anything else (ECONNRESET, UND_ERR_SOCKET, a timeout, an error with no code) may have happened AFTER the request was
+ * written, so the IdP may have consumed the token: outcome unknown. The cost is lopsided on purpose: a false in-doubt costs one re-login, a
+ * missed one costs a user-wide revocation. Do NOT add a code here without proof it can only occur before the request is sent.
+ */
+export const REQUEST_NEVER_LEFT_CODES: ReadonlySet<string> = new Set(['ECONNREFUSED', 'ENOTFOUND', 'EAI_AGAIN']);
+
+/** Every `code` on the error, its `cause`, and the members of an AggregateError (undici wraps the socket error in `cause`). */
+function transportCodes(err: unknown, depth = 0, out: string[] = []): string[] {
+  if (!err || typeof err !== 'object' || depth > 4) return out;
+  const e = err as { code?: unknown; cause?: unknown; errors?: unknown };
+  if (typeof e.code === 'string' && e.code) out.push(e.code);
+  if (e.cause) transportCodes(e.cause, depth + 1, out);
+  if (Array.isArray(e.errors)) for (const inner of e.errors) transportCodes(inner, depth + 1, out);
+  return out;
+}
+
+/**
+ * True only when the error carries at least one cause code and EVERY code it carries is in the never-left allowlist. An error with no code
+ * is NOT proof, so it is in-doubt.
+ */
+export function requestNeverLeft(err: unknown): boolean {
+  const codes = transportCodes(err);
+  return codes.length > 0 && codes.every((c) => REQUEST_NEVER_LEFT_CODES.has(c));
+}

package/src/lib/refresh-token-validator.ts

@@ -1,5 +1,6 @@
 import { jwtDecode } from './jwt-decode';
 import { tokenRefreshLogger } from '../config/logger';
+import { REFRESH_WINDOW_MS } from './refresh-window';
 
 interface RefreshTokenPayload { exp: number; iat: number; jti: string; user_id: string; token_type: string; binding: string; }
 
@@ -38,7 +39,7 @@ export function checkRefreshViability(sessionData: any): RefreshViabilityCheck {
     if (typeof expiresAtMs === 'string') expiresAtMs = parseInt(expiresAtMs, 10);
     if (expiresAtMs < 1000000000000) expiresAtMs = expiresAtMs * 1000;
     accessTokenTimeRemaining = Math.floor((expiresAtMs - now) / 1000);
-    const bufferSec = 5 * 60; // 5 minutes pre-expiry buffer
+    const bufferSec = REFRESH_WINDOW_MS / 1000; // the one refresh window (lib/refresh-window), in seconds
     accessTokenExpired = accessTokenTimeRemaining <= bufferSec;
     tokenRefreshLogger.debug('[REFRESH_VIABILITY] Access token expiration check', { now, expiresAtMs, accessTokenTimeRemaining, bufferSec, accessTokenExpired });
   }

package/src/lib/refresh-window.ts

@@ -0,0 +1,16 @@
+/**
+ * THE freshness window for an IdP access token (BAPert 76397 decision 1; Core facts DotNetPert 76400).
+ *
+ * An access token with this much life left or less is treated as stale and refreshed; with more, it is served as it is. One value for
+ * every path that decides: the mounted refresh route (`api-handlers/auth/refresh`), `ensureFreshAccessToken`, and `lib/idp-fetch`'s own
+ * pre-check. They used to disagree (5 min, 60 s, 5 min), so the same session was "stale" to one path and "fresh" to another, which is how
+ * two callers each rotated a token the other had just rotated.
+ *
+ * WHY 5 MINUTES: Core mints access tokens with a fixed 15-minute lifetime (a code constant, not configuration: Core
+ * `TokenConstants.ACCESS_TOKEN_LIFETIME_MINUTES = 15`, read-only in `TokenSettings`). The ruling is 5 minutes when the lifetime is at least 15
+ * minutes, and lifetime / 3 otherwise. If Core ever shortens the lifetime, this value MUST be revisited: a window at or above the lifetime
+ * makes every request refresh.
+ *
+ * A caller that needs another value passes it explicitly (`ensureFreshAccessToken`'s `safetyWindowMs` option still exists and still wins).
+ */
+export const REFRESH_WINDOW_MS = 5 * 60 * 1000;

package/src/lib/safe-error-response.ts

@@ -15,6 +15,7 @@
  */
 
 import { knownPasswordRules } from './password-rules';
+import { errForLog } from './log-safe';
 
 export interface IdpErrorProjection {
   code?: string;
@@ -25,10 +26,14 @@ export interface IdpErrorProjection {
 
 const str = (v: unknown): string | undefined => (typeof v === 'string' ? v : undefined);
 
-/** Log an exception with a fresh correlationId and return the id for the response body. */
+/**
+ * Log an exception with a fresh correlationId and return the id for the response body.
+ * The log line carries the error's NAME and closed code/status only (errForLog), never its message, stack or cause: those can hold an
+ * email, a phone number, a token or a quoted request body (PII-in-logs, BAPert 76553 group 1). The correlationId still ties the response to the line.
+ */
 export function logExceptionWithCorrelation(tag: string, err: unknown): string {
   const correlationId = globalThis.crypto.randomUUID();
-  console.error(tag, { correlationId, error: err });
+  console.error(tag, { correlationId, error: errForLog(err) });
   return correlationId;
 }
 

package/src/lib/safe-trace-id.ts

@@ -0,0 +1,21 @@
+/**
+ * A caller-supplied trace id (the `x-request-id` header) is attacker-chosen text, and it goes to the log sink (PAY-2376; BAPert 76321 item 4,
+ * NightHawk 76316). Two problems if it is logged as it arrives: a value with a newline forges a log line, and an unbounded value is a log
+ * flood. This is the one place that makes it safe to log: control characters are removed, the length is capped, and anything that is not a
+ * non-empty string becomes `undefined` (so the log carries no trace id rather than a forged one).
+ *
+ * It is for LOG CORRELATION ONLY. It is never a lock identity and never a security decision (the lock id is minted server-side).
+ */
+
+/** Longest trace id that is logged. 64 covers a UUID (36) and common trace formats; longer input is cut, not rejected. */
+export const MAX_TRACE_ID_LENGTH = 64;
+
+// C0 controls (incl. CR, LF, TAB, ESC), DEL, C1 controls (incl. NEL U+0085), and the Unicode line/paragraph separators U+2028 / U+2029.
+// eslint-disable-next-line no-control-regex
+const CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/g;
+
+export function sanitizeTraceId(value: unknown): string | undefined {
+  if (typeof value !== 'string') return undefined;
+  const cleaned = value.replace(CONTROL_CHARS, '').slice(0, MAX_TRACE_ID_LENGTH);
+  return cleaned.length > 0 ? cleaned : undefined;
+}

package/src/lib/session-store.ts

@@ -14,6 +14,8 @@ import { SessionData } from '../models/SessionModel';
 import { getSessionPrefix, getRefreshLockPrefix, getAppSlug } from './app-slug';
 import { extractKidFromToken, decodeIdpAccessToken } from '../auth/utils/token-utils';
 import { tokenLogId } from './token-log-id';
+import { refreshTokenIdentity } from './refresh-in-doubt';
+import { errForLog } from './log-safe';
 
 // Re-export SessionData for consumers
 export type { SessionData } from '../models/SessionModel';
@@ -64,7 +66,7 @@ export async function createSession(data: SessionData): Promise<string> {
       .setex(versionKey, SESSION_TTL, '1')
       .exec();
   } catch (error) {
-    console.error('[SESSION-STORE] Failed to create session:', error);
+    console.error('[SESSION-STORE] Failed to create session:', errForLog(error));
     throw error;
   }
 
@@ -293,12 +295,23 @@ export async function deleteSessionEverywhere(sessionToken: string, appSlug?: st
  * today; this is the defence BAPert ruled to keep anyway.
  */
 function dropStaleDiscardMarker<T extends object>(session: T): T {
-  const s = session as any;
+  let s = session as any;
   if (typeof s.idpRefreshToken === 'string' && s.idpRefreshToken.length > 0 && (s.refreshTokenClearedReason !== undefined || s.refreshTokenClearedAt !== undefined)) {
     const { refreshTokenClearedReason: _reason, refreshTokenClearedAt: _at, ...rest } = s;
-    return rest as T;
+    s = rest;
   }
-  return session;
+  // BAPert 76403: the refresh-IN-DOUBT marker (lib/refresh-in-doubt) is cleared by the same write that stores a NEW refresh token, i.e. one
+  // whose identity differs from the one left in doubt. A write that stores the SAME token (any caller spreading the whole row back) does
+  // NOT clear it: that token is still the in-doubt one.
+  if (
+    typeof s.refreshInDoubtTokenHash === 'string' &&
+    typeof s.idpRefreshToken === 'string' && s.idpRefreshToken.length > 0 &&
+    refreshTokenIdentity(s.idpRefreshToken) !== s.refreshInDoubtTokenHash
+  ) {
+    const { refreshInDoubtTokenHash: _hash, refreshInDoubtAt: _doubtAt, ...rest } = s;
+    s = rest;
+  }
+  return s as T;
 }
 
 export async function setSession(sessionToken: string, data: SessionData): Promise<void> {

package/src/lib/site-logger.ts

@@ -11,6 +11,7 @@
  */
 
 import { getRedis } from './redis';
+import { closedCodeForLog, errForLog } from './log-safe';
 
 // Redis key for site logs (separate from data_logs)
 const REDIS_SITE_LOG_KEY = 'vibe:site-logs:pending';
@@ -74,11 +75,11 @@ export async function logSiteEvent(entry: SiteLogEntry): Promise<void> {
       console.log('[site-logger] Redis push success, queue length:', result);
       redis.expire(REDIS_SITE_LOG_KEY, REDIS_LOG_TTL).catch(() => {});
     }).catch(err => {
-      console.error('[site-logger] Redis push failed:', err.message);
+      console.error('[site-logger] Redis push failed:', errForLog(err));
     });
   } catch (error) {
     // Fail silently - logging should never break the app
-    console.error('[site-logger] Failed to log event:', error);
+    console.error('[site-logger] Failed to log event:', errForLog(error));
   }
 }
 
@@ -120,12 +121,14 @@ export const siteEvents = {
     });
   },
 
-  loginFailed: (opts: { reason: string; email?: string; url?: string; user_agent?: string; ip_address?: string }) => {
+  // BREAKING (PII-in-logs group 3b, BAPert 76553 Q2): no `email` parameter. A failed login is told apart by a CLOSED reason code (UPPER_SNAKE),
+  // never by the address that was tried; anything that is not a closed code is stored as UNSPECIFIED. A caller that still passes `email` fails to compile.
+  loginFailed: (opts: { reason: string; url?: string; user_agent?: string; ip_address?: string }) => {
     logSiteEvent({
       level: 'warn',
       category: 'auth',
       message: 'Login failed',
-      context: { reason: opts.reason, email: opts.email },
+      context: { reason: closedCodeForLog(opts.reason) ?? 'UNSPECIFIED' },
       url: opts.url || '/auth/login',
       user_agent: opts.user_agent,
       ip_address: opts.ip_address,
@@ -214,12 +217,15 @@ export const siteEvents = {
     });
   },
 
-  error: (opts: { message: string; error?: string; stack?: string; user_id?: string | number; url?: string; user_agent?: string; ip_address?: string }) => {
+  // BREAKING (PII-in-logs group 3b, BAPert 76553 Q2): takes a CLOSED code, not caller text, an error string or a stack. The stored message is the fixed
+  // sentence 'Application error'; the code (UPPER_SNAKE, else UNSPECIFIED) goes in context. A caller that still passes `message`, `error` or `stack`
+  // fails to compile.
+  error: (opts: { code: string; user_id?: string | number; url?: string; user_agent?: string; ip_address?: string }) => {
     logSiteEvent({
       level: 'error',
       category: 'error',
-      message: opts.message,
-      context: { error: opts.error, stack: opts.stack },
+      message: 'Application error',
+      context: { code: closedCodeForLog(opts.code) ?? 'UNSPECIFIED' },
       user_id: opts.user_id,
       url: opts.url,
       user_agent: opts.user_agent,

package/src/lib/standardized-client-api.ts

@@ -9,6 +9,7 @@
 // ========================================================================================
 
 import { authClient } from '../client/better-auth-client';
+import { errForLog } from './log-safe';
 
 /** Unwrap Better Auth getSession() to a flat session-like object for backward compat */
 async function getSession(): Promise<any> {
@@ -147,7 +148,7 @@ function scheduleLoginRedirect(isImmediate = false) {
       console.warn(`🔄 Redirecting to login with return URL: ${returnUrl}`);
       window.location.href = `/account-auth/login?returnUrl=${returnUrl}`;
     } catch (error) {
-      console.error('❌ Error during login redirect:', error);
+      console.error('❌ Error during login redirect:', errForLog(error));
       // Final fallback
       try {
         window.location.href = '/account-auth/login';
@@ -721,7 +722,7 @@ class StandardizedClientApiService {
       }
       
       // Wrap unknown errors as network errors
-      console.error('❌ API request failed:', error);
+      console.error('❌ API request failed:', errForLog(error));
       throw new ApiNetworkError(
         error instanceof Error ? error.message : 'Network error',
         0,

package/src/lib/token-lifecycle.ts

@@ -26,9 +26,11 @@ import { getSession as getBetterAuthSession } from '../server/auth';
 import { getRedis } from './redis';
 import { getAppSlug } from './app-slug';
 import { tokenLogId } from './token-log-id';
+import { REFRESH_WINDOW_MS } from './refresh-window';
+import { errForLog } from './log-safe';
 
-// 5 minute threshold for "needs refresh" - matches refresh handler pattern
-const REFRESH_THRESHOLD_MS = 5 * 60 * 1000;
+// "needs refresh" threshold: THE one freshness window (lib/refresh-window), the same value the refresh route, ensureFreshAccessToken and idp-fetch use.
+const REFRESH_THRESHOLD_MS = REFRESH_WINDOW_MS;
 
 // Concurrent refresh handling configuration
 const CONCURRENT_REFRESH_POLL_INTERVAL_MS = 200; // How often to poll session during concurrent refresh
@@ -433,7 +435,7 @@ export async function ensureFreshToken(
         }
       } catch (e) {
         // If we can't decode, proceed with normal logic
-        console.warn('[TOKEN_LIFECYCLE] Could not validate JWT exp claim:', e);
+        console.warn('[TOKEN_LIFECYCLE] Could not validate JWT exp claim:', errForLog(e));
       }
     }
 
@@ -511,7 +513,7 @@ export async function ensureFreshToken(
       sessionData,
     };
   } catch (error) {
-    console.error('[TOKEN_LIFECYCLE] Error:', error);
+    console.error('[TOKEN_LIFECYCLE] Error:', errForLog(error));
     return {
       success: false,
       error: 'NO_SESSION',

package/src/middleware/create-middleware.ts

@@ -32,6 +32,7 @@ import {
   resetSecret,
   signedResetHref,
 } from '../auth/session-reset-link';
+import { errForLog } from '../lib/log-safe';
 
 // =============================================================================
 // TYPES
@@ -1037,7 +1038,7 @@ async function handleAllow(
         );
       }
     } catch (error) {
-      console.error('[MIDDLEWARE] RBAC error:', error);
+      console.error('[MIDDLEWARE] RBAC error:', errForLog(error));
 
       // In development, fail open
       if (process.env.NODE_ENV !== 'production') {

package/src/middleware/rbac-check.ts

@@ -1,3 +1,4 @@
+import { errForLog } from '../lib/log-safe';
 /**
  * Page RBAC Check Module
  *
@@ -262,7 +263,7 @@ export async function checkPagePermission(
       };
     }
 
-    console.error('[RBAC] Proxy error:', error);
+    console.error('[RBAC] Proxy error:', errForLog(error));
     return {
       allowed: false,
       reason: 'rbac_service_unavailable',

package/src/models/SessionModel.ts

@@ -59,6 +59,13 @@ export interface SessionData {
 
   /** When the IDP refresh token expires (Unix timestamp ms) */
   idpRefreshTokenExpires?: number;
+  /**
+   * BAPert 76403 (lib/refresh-in-doubt): set when a refresh fetch TIMED OUT. A SHA-256 identity of the refresh token that was sent (never the
+   * token), and when. A later attempt whose token-to-send matches refuses without calling the IdP. Cleared by the write that stores a different
+   * refresh token.
+   */
+  refreshInDoubtTokenHash?: string;
+  refreshInDoubtAt?: number;
 
   /** Decoded IDP access token claims (for quick access without re-decoding) */
   decodedAccessToken?: any;

package/src/routes/auth/logout.ts

@@ -27,6 +27,7 @@ import {
 } from '../../lib/app-slug';
 import { siteEvents, getClientIp } from '../../lib/site-logger';
 import { logExceptionWithCorrelation } from '../../lib/safe-error-response';
+import { errForLog } from '../../lib/log-safe';
 
 /**
  * 4.8.9: answered (status 500) when a sign-out did not finish. 4.8.10 (BAPert 76297): TWO sentences, one per cause, each true for its
@@ -79,7 +80,13 @@ export async function POST(req: NextRequest) {
         await revokeSessionAtIdp(req);
       } catch (error) {
         idpRevokeFailed = true;
-        console.error('[LOGOUT_ROUTE] IdP revoke failed - the IdP refresh token is STILL LIVE:', error);
+        // "STILL LIVE" only when the IdP showed it (a forced refresh succeeded); otherwise say what is known: it was not confirmed.
+        console.error(
+          (error as { grantLive?: boolean } | null)?.grantLive === true
+            ? '[LOGOUT_ROUTE] IdP revoke failed - the IdP refresh token is STILL LIVE:'
+            : '[LOGOUT_ROUTE] IdP revoke could not be confirmed (the grant may already be dead):',
+          errForLog(error),
+        );
       }
     }
 
@@ -91,7 +98,7 @@ export async function POST(req: NextRequest) {
         console.info('[LOGOUT_ROUTE] Session deleted from store');
       } catch (error) {
         localDeleteFailed = true;
-        console.error('[LOGOUT_ROUTE] Failed to delete session - the server session is STILL LIVE:', error);
+        console.error('[LOGOUT_ROUTE] Failed to delete session - the server session is STILL LIVE:', errForLog(error));
       }
     }
 

package/src/routes/auth/settings.ts

@@ -30,6 +30,7 @@
 import { NextResponse } from 'next/server';
 import { getIDPClientConfig } from '../../lib/idp-client-config';
 import { secretSafeJson } from '../../lib/never-in-response';
+import { errForLog } from '../../lib/log-safe';
 
 export interface PublicAuthSettings {
     // OAuth providers enabled for this client
@@ -95,7 +96,7 @@ export async function GET() {
         config = await getIDPClientConfig();
     } catch (error) {
         // Keep the loud line - it is what finally unmasked this in production.
-        console.error('[AUTH_SETTINGS] Failed to get settings:', error);
+        console.error('[AUTH_SETTINGS] Failed to get settings:', errForLog(error));
         // The `degraded: true` shape that used to live here (240447) is gone
         // deliberately. It still answered `success: true` with a full invented
         // policy and merely LABELLED the guess - which BAPert v32 rules out:

package/src/server/auth-guard.ts

@@ -14,6 +14,7 @@ import { decodeSession } from './decode-session';
 import { getIDPClientConfig } from '../lib/idp-client-config';
 import { getSessionCookieName, getSecureSessionCookieName } from '../lib/app-slug';
 import type { SessionData } from '../lib/session-store';
+import { errForLog } from '../lib/log-safe';
 
 // =============================================================================
 // TYPES
@@ -89,7 +90,7 @@ export async function authGuard(options?: AuthGuardOptions): Promise<AuthGuardRe
     decoded = await decodeSession();
   } catch (error) {
     // Redis unreachable or startup failure → fail closed
-    console.error('[AUTH-GUARD] Session decode failed (service error):', error instanceof Error ? error.message : String(error));
+    console.error('[AUTH-GUARD] Session decode failed (service error):', errForLog(error));
     redirect(serviceUnavailableUrl);
   }
 
@@ -122,7 +123,7 @@ export async function authGuard(options?: AuthGuardOptions): Promise<AuthGuardRe
     requires2FA = config.authSettings?.require2FA ?? true;
   } catch (error) {
     // If we can't check 2FA config, fail closed
-    console.error('[AUTH-GUARD] 2FA config check failed:', error instanceof Error ? error.message : String(error));
+    console.error('[AUTH-GUARD] 2FA config check failed:', errForLog(error));
     redirect(serviceUnavailableUrl);
   }
 
@@ -186,7 +187,7 @@ export async function authGuard(options?: AuthGuardOptions): Promise<AuthGuardRe
         if (error && typeof error === 'object' && 'digest' in error) {
           throw error;
         }
-        console.error(`[AUTH-GUARD] Custom check "${check.name}" error:`, error instanceof Error ? error.message : String(error));
+        console.error(`[AUTH-GUARD] Custom check "${check.name}" error:`, errForLog(error));
         redirect(serviceUnavailableUrl);
       }
     }

package/src/server/auth.ts

@@ -14,6 +14,7 @@ import {
   type SessionData,
 } from '../lib/session-store';
 import { tokenLogId } from '../lib/token-log-id';
+import { errForLog } from '../lib/log-safe';
 import { resolveVerifiedSessionTokenFromRequest } from './verified-session-token';
 
 export type IdpTokenResult =
@@ -134,20 +135,14 @@ export async function getAuthInstance() {
  * `{error:'NO_SESSION'}`, and getSession() swallowed every Redis error into a bare `catch {}`. These helpers name
  * the origin and make a swallowed read audible. Hard rules: every helper is wrapped so it can NEVER throw or change
  * a return value; nothing here ever logs a token, a cookie VALUE or a Redis value - only a tokenLogId() fingerprint,
- * cookie NAMES, booleans, and an error name/message with any long opaque run redacted.
+ * cookie NAMES, booleans, and an error NAME with its closed code/status (errForLog; never the message).
  * -------------------------------------------------------------------------------------------------------------- */
 
-/** An error name/message, first 80 chars, with any 24+ char opaque run (a token, a key) replaced. */
-function scrubForLog(v: unknown): string {
-  const raw = v instanceof Error ? v.message : String(v ?? '');
-  return raw.replace(/[A-Za-z0-9_\-.+/=]{24,}/g, '[redacted]').slice(0, 80);
-}
-
-/** `catch {}` sites on the session read path: still swallowed, now audible. */
+/** `catch {}` sites on the session read path: still swallowed, now audible. The line names the error and its closed code/status only: the
+ *  message is dropped (BAPert 76553: a redacted-and-truncated message still leaked host names, ports and quoted input). */
 function logSessionReadSwallowed(path: 'primary' | 'A' | 'B', err: unknown): void {
   try {
-    const name = scrubForLog(err instanceof Error ? err.name : typeof err);
-    console.warn(`[server-auth] SESSION_READ_SWALLOWED path=${path} err=${name} msg=${scrubForLog(err)}`);
+    console.warn(`[server-auth] SESSION_READ_SWALLOWED path=${path} ${errForLog(err)}`);
   } catch {
     /* a diagnostic must never change the outcome */
   }
@@ -407,7 +402,7 @@ export interface FreshIdpTokenConfig {
   idpBaseUrl: string;
   clientId: string;
   refreshEndpoint?: string;
-  /** Refresh if the access token is within this many ms of expiry. Default 60_000. */
+  /** Refresh if the access token is within this many ms of expiry. Default REFRESH_WINDOW_MS (5 min, lib/refresh-window). */
   safetyWindowMs?: number;
 }
 

package/src/server/decode-session.ts

@@ -15,6 +15,7 @@ import { ensureInitialized } from '../lib/startup-init';
 import { extractSessionTokenFromCookieValue } from '../lib/session-cookie-shape';
 import { resolveVerifiedSessionCookie } from './verified-session-token';
 import { tokenLogId } from '../lib/token-log-id';
+import { errForLog } from '../lib/log-safe';
 
 export interface DecodedSession {
   sessionData: SessionData;
@@ -197,7 +198,7 @@ async function tryBetterAuthSession(
 
     return { sessionData, jwtPayload };
   } catch (error) {
-    console.warn('[DECODE-SESSION] Better Auth session check failed:', error instanceof Error ? error.message : String(error));
+    console.warn('[DECODE-SESSION] Better Auth session check failed:', errForLog(error));
     return null;
   }
 }
@@ -303,7 +304,7 @@ export async function decodeSession(
       jwtPayload: (payload ?? { sessionToken }) as DecodedSession['jwtPayload'],
     };
   } catch (error) {
-    console.error('[DECODE-SESSION] Error:', error instanceof Error ? error.message : String(error));
+    console.error('[DECODE-SESSION] Error:', errForLog(error));
     return null;
   }
 }

package/src/server/with-auth.ts

@@ -17,6 +17,7 @@ import 'server-only';
 import { NextRequest, NextResponse } from 'next/server';
 import { decodeSession } from './decode-session';
 import type { SessionData } from '../lib/session-store';
+import { errForLog } from '../lib/log-safe';
 
 // =============================================================================
 // TYPES
@@ -83,7 +84,7 @@ export function withAuth(
 
       return handler(req, auth);
     } catch (error) {
-      console.error('[WITH-AUTH] Error:', error instanceof Error ? error.message : String(error));
+      console.error('[WITH-AUTH] Error:', errForLog(error));
       return NextResponse.json(
         { error: 'Internal Server Error', message: 'Auth check failed' },
         { status: 500 }

package/src/stores/authStore.ts

@@ -27,6 +27,7 @@ import {
   getSecureCsrfCookieName
 } from '../lib/app-slug';
 import { tokenLogId } from '../lib/token-log-id';
+import { REFRESH_WINDOW_MS } from '../lib/refresh-window';
 
 // ===============================
 // INTERFACES & TYPES
@@ -752,8 +753,8 @@ export const useAuthStore = create<AuthStore>()(
               const now = Date.now();
               const timeUntilExpiry = tokenExpiry - now;
               
-              // Token should be fresh (not expiring in next 5 minutes)
-              if (timeUntilExpiry < (5 * 60 * 1000)) {
+              // Token should be fresh (not expiring within the one refresh window)
+              if (timeUntilExpiry < REFRESH_WINDOW_MS) {
                 throw new Error(`Fresh token still expires soon: ${timeUntilExpiry}ms`);
               }