@payez/next-mvp 4.10.0 → 4.12.0

package/src/api-handlers/auth/signout.ts

@@ -11,7 +11,15 @@
 
 import { NextRequest, NextResponse } from 'next/server';
 import { cookies } from 'next/headers';
-import { deleteSessionEverywhere } from '../../lib/session-store';
+import { deleteSessionEverywhere, getSession as getStoredSession, getBetterAuthSession as getStoredBetterAuthSession } from '../../lib/session-store';
+import { revokeSessionAtIdp } from '../../lib/idp-logout';
+import { errForLog } from '../../lib/log-safe';
+import {
+  SESSION_NOT_ENDED_CODE,
+  SESSION_NOT_ENDED_IDP_MESSAGE,
+  SESSION_NOT_ENDED_LOCAL_MESSAGE,
+  type SessionNotEndedCause,
+} from '../../routes/auth/logout';
 import { getSession } from '../../server/auth';
 import {
   getSessionCookieName,
@@ -147,23 +155,55 @@ export function createSignoutHandler() {
       }
     }
 
-    // Delete the session from EVERY store (181922): canonical + BA secondary.
-    // Canonical-only deletion let the ba: record resurrect the session.
+    // GOV-023 (BAPert 76687): ending the session ends the IdP GRANT first, the same IdP-first path as routes/auth/logout. Before this, this
+    // handler only deleted the local record, so a consumer who mounted it left the IdP refresh token live until it expired.
+    // A failed or unresolved revoke is the same typed failure as a failed local delete (SESSION_NOT_ENDED + cause); the local delete still
+    // runs and the cookies are cleared either way.
+    let idpRevokeFailed = false;
+    let localDeleteFailed = false;
     if (redisSessionToken) {
+      // Does the stored session hold an IdP refresh token? (revokeSessionAtIdp reads the canonical row, then the Better Auth record.)
+      let heldRefreshToken = false;
+      try {
+        const stored = (await getStoredSession(redisSessionToken)) ?? (await getStoredBetterAuthSession(redisSessionToken));
+        heldRefreshToken = !!stored?.idpRefreshToken;
+      } catch {
+        // unknown: treated as "none held", so an unreadable store does not turn a clean sign-out into a failure on its own
+      }
+      try {
+        const outcome = await revokeSessionAtIdp(req);
+        // 'nothing-to-revoke' while a refresh token IS held means the helper could not resolve this session from the request (this
+        // handler also finds the session by decoding the cookie when Better Auth cannot): the grant is NOT ended, so say so.
+        if (outcome === 'nothing-to-revoke' && heldRefreshToken) {
+          idpRevokeFailed = true;
+          console.error('[SIGNOUT] IdP revoke could not resolve the session - the IdP refresh token is STILL LIVE');
+        }
+      } catch (revokeError) {
+        idpRevokeFailed = true;
+        console.error(
+          (revokeError as { grantLive?: boolean } | null)?.grantLive === true
+            ? '[SIGNOUT] IdP revoke failed - the IdP refresh token is STILL LIVE:'
+            : '[SIGNOUT] IdP revoke could not be confirmed (the grant may already be dead):',
+          errForLog(revokeError),
+        );
+      }
+
+      // Delete the session from EVERY store (181922): canonical + BA secondary.
+      // Canonical-only deletion let the ba: record resurrect the session.
       try {
         await deleteSessionEverywhere(redisSessionToken);
         console.info('[SIGNOUT] Redis session cleanup successful', {
           sessionToken: tokenLogId(redisSessionToken)
         });
       } catch (sessionError) {
-        // Log error but don't fail the signout process
-        console.error('[SIGNOUT] Redis session cleanup failed', { error: sessionError });
+        localDeleteFailed = true;
+        console.error('[SIGNOUT] Redis session cleanup failed - the server session is STILL LIVE:', errForLog(sessionError));
       }
     } else {
       console.warn('[SIGNOUT] No Redis session token (UUID) extracted from cookie; skipping Redis deletion');
     }
 
-    // Build response
+    // Build response. A sign-out that did not end the session must not say it did (same typed answer as routes/auth/logout).
     const responseData: SignoutResponse = {
       success: true,
       message: sessionToken ? 'Session deleted successfully' : 'No active session found',
@@ -171,7 +211,14 @@ export function createSignoutHandler() {
       chunkCookiesDeleted: chunkCookies.length
     };
 
-    const response = NextResponse.json(responseData);
+    const response = (localDeleteFailed || idpRevokeFailed)
+      ? NextResponse.json(
+          localDeleteFailed
+            ? { success: false, code: SESSION_NOT_ENDED_CODE, cause: 'local_delete_failed' as SessionNotEndedCause, message: SESSION_NOT_ENDED_LOCAL_MESSAGE }
+            : { success: false, code: SESSION_NOT_ENDED_CODE, cause: 'idp_unconfirmed' as SessionNotEndedCause, message: SESSION_NOT_ENDED_IDP_MESSAGE },
+          { status: 500 },
+        )
+      : NextResponse.json(responseData);
 
     // Always clear cookies, regardless of success/failure (using app-slug prefixed names)
     try {

package/src/api-handlers/mfa/backup-code-verify.ts

@@ -60,6 +60,7 @@ import { getTokenTestAware } from '../../lib/test-aware-get-token';
 import { transitionTo2FASession } from '../../lib/session-store';
 import { jwtDecode } from '../../lib/jwt-decode';
 import { twoFactorVerifyFailure } from '../../lib/two-factor-verify-failure';
+import { errForLog } from '../../lib/log-safe';
 
 export async function POST(req: NextRequest) {
   try {
@@ -157,7 +158,7 @@ export async function POST(req: NextRequest) {
       { status: 200 }
     );
   } catch (error) {
-    console.error('[VERIFY_BACKUP_CODE] Error:', error);
+    console.error('[VERIFY_BACKUP_CODE] Error:', errForLog(error));
     return NextResponse.json(
       {
         success: false,

package/src/api-handlers/mfa/totp-verify.ts

@@ -35,6 +35,7 @@ import { getTokenTestAware } from '../../lib/test-aware-get-token';
 import { transitionTo2FASession } from '../../lib/session-store';
 import { jwtDecode } from '../../lib/jwt-decode';
 import { twoFactorVerifyFailure } from '../../lib/two-factor-verify-failure';
+import { errForLog } from '../../lib/log-safe';
 
 export async function POST(req: NextRequest) {
   try {
@@ -159,7 +160,7 @@ export async function POST(req: NextRequest) {
       { status: 200 }
     );
   } catch (error) {
-    console.error('[VERIFY_TOTP] Error:', error);
+    console.error('[VERIFY_TOTP] Error:', errForLog(error));
     return NextResponse.json(
       {
         success: false,

package/src/api-handlers/session/refresh-viability.ts

@@ -4,6 +4,7 @@ import { checkRefreshViability } from '../../lib/refresh-token-validator';
 import { getTokenTestAware } from '../../lib/test-aware-get-token';
 import { logger } from '../../config/logger';
 import { tokenLogId } from '../../lib/token-log-id';
+import { errForLog } from '../../lib/log-safe';
 import { resolveSessionState } from '../../server/auth';
 
 export async function GET(req: NextRequest) {
@@ -49,8 +50,8 @@ export async function GET(req: NextRequest) {
     return NextResponse.json({ canRefresh: viabilityCheck.canRefresh, reason: viabilityCheck.reason, timeRemaining: viabilityCheck.timeRemaining, expiresAt: viabilityCheck.expiresAt, accessTokenExpired: viabilityCheck.accessTokenExpired, accessTokenTimeRemaining: viabilityCheck.accessTokenTimeRemaining, sessionTokenId: tokenLogId(finalSessionToken), twoFactorComplete: sessionData.mfaVerified ?? false, userId: sessionData.userId, refreshInProgress: false });
   } catch (error) {
     const correlationId = globalThis.crypto.randomUUID();
-    logger.error('[REFRESH-VIABILITY] Error checking refresh viability', { correlationId, error: error instanceof Error ? error.message : String(error) });
-    // PAY-1438: the exception text stays in the log above; the caller gets the id.
+    logger.error('[REFRESH-VIABILITY] Error checking refresh viability', { correlationId, error: errForLog(error) });
+    // PAY-1438: the caller gets the id; the log line names the error only (errForLog), never its message (PII-in-logs group 1, BAPert 76553).
     return NextResponse.json({ canRefresh: false, reason: 'check_error', error: 'Failed to check refresh viability', code: 'INTERNAL_ERROR', correlationId }, { status: 500 });
   }
 }

package/src/api-handlers/session/viability.ts

@@ -12,6 +12,7 @@ import { isInitializationFailed, ensureInitialized } from '../../lib/startup-ini
 import { getIDPClientConfig } from '../../lib/idp-client-config';
 import { tokenLogId } from '../../lib/token-log-id';
 import { getRevocationStatus, warnNonNumericUserId, resolveNumericIdpUserId, type RevocationStatus } from '../../vibe/sessions';
+import { errForLog } from '../../lib/log-safe';
 
 export async function GET(req: NextRequest) {
   try {
@@ -233,7 +234,7 @@ export async function GET(req: NextRequest) {
     return NextResponse.json({ authenticated: false });
 
   } catch (error) {
-    console.error('[API Viability] Error checking session viability:', error);
+    console.error('[API Viability] Error checking session viability:', errForLog(error));
     return NextResponse.json({ authenticated: false }, { status: 500 });
   }
 }

package/src/auth/better-auth.ts

@@ -33,6 +33,7 @@ import { getRedis } from '../lib/redis';
 import { createSingleFlight, type SingleFlight } from '../lib/single-flight';
 import { SESSION_TTL } from '../lib/session-store';
 import { tokenLogId } from '../lib/token-log-id';
+import { errForLog } from '../lib/log-safe';
 
 /**
  * 185121: short sha256 fingerprint for secrets/tokens in log lines — enough
@@ -855,7 +856,7 @@ export function createBetterAuthInstance(
           const { deleteSession } = await import('../lib/session-store');
           await deleteSession(key);
         } catch (err) {
-          console.warn('[BETTER_AUTH] secondary delete: canonical store cleanup failed:', err);
+          console.warn('[BETTER_AUTH] secondary delete: canonical store cleanup failed:', errForLog(err));
         }
       },
     },
@@ -1356,7 +1357,7 @@ export async function exchangeOAuthForIdpTokens(
     // true = success (tokens stored). false = a non-IdP failure with no specific code (generic abort).
     return stored;
   } catch (err) {
-    console.error('[BETTER_AUTH] IDP token exchange failed:', err instanceof Error ? err.message : String(err));
+    console.error('[BETTER_AUTH] IDP token exchange failed:', errForLog(err));
     return false;
   }
 }
@@ -1446,7 +1447,7 @@ export async function storeIdpTokensInSession(
 
     return true;
   } catch (err) {
-    console.error('[BETTER_AUTH] storeIdpTokensInSession failed:', err instanceof Error ? err.message : String(err));
+    console.error('[BETTER_AUTH] storeIdpTokensInSession failed:', errForLog(err));
     return false;
   }
 }
@@ -1547,13 +1548,13 @@ async function abortOAuthSignIn(
       const out = await auth?.api?.signOut?.({ headers: new Headers({ cookie: cookieHeader }), asResponse: true });
       for (const sc of (out as Response | undefined)?.headers?.getSetCookie?.() ?? []) headers.append('set-cookie', sc);
     } catch (err) {
-      console.warn('[BETTER_AUTH] abort: Better Auth signOut failed, deleting the record directly:', err instanceof Error ? err.message : String(err));
+      console.warn('[BETTER_AUTH] abort: Better Auth signOut failed, deleting the record directly:', errForLog(err));
     }
     try {
       const config = await getIDPClientConfig();
       await getRedis().del(`ba:${config.clientSlug || getAppSlug()}:${sessionToken}`);
     } catch (err) {
-      console.error('[BETTER_AUTH] abort: could not delete the Better Auth session record', tokenLogId(sessionToken), err instanceof Error ? err.message : String(err));
+      console.error('[BETTER_AUTH] abort: could not delete the Better Auth session record', tokenLogId(sessionToken), errForLog(err));
     }
   }
   for (const sc of expireSetCookies(callbackResponse.headers.getSetCookie?.() ?? [])) headers.append('set-cookie', sc);
@@ -1673,7 +1674,7 @@ export function createAuthGetHandler(loginPath: string = '/account-auth/login')
           }
         }
       } catch (err: any) {
-        console.error('[BETTER_AUTH] IDP token exchange failed:', err.message);
+        console.error('[BETTER_AUTH] IDP token exchange failed:', errForLog(err));
       }
       if (exchange !== true) {
         // A specific IdP error code goes on the URL; otherwise the generic OAUTH_SIGN_IN_FAILED.

package/src/auth/idp-oauth.ts

@@ -19,6 +19,7 @@
  * case-insensitively, at the authorize step). Both come from ONE value: the `redirectURI` of the provider config.
  */
 import { createRemoteJWKSet, decodeProtectedHeader, jwtVerify, type JWTVerifyGetKey } from 'jose';
+import { errForLog } from '../lib/log-safe';
 
 export interface IdpTokenGrant {
   accessToken: string;
@@ -281,7 +282,11 @@ export function createIdpOAuthHooks(opts: IdpOAuthHookOptions) {
       if (responseMasked) console.warn('[BETTER_AUTH] payez-idp token response address is masked or unusable; ignored');
       const email = resolveEmail(payload as Record<string, unknown>, responseEmailUsable ? responseEmailRaw : undefined);
       if (!email) {
-        throw new Error(responseMasked ? 'response address is masked' : 'no usable email (needs data.user.email or an email claim, address-shaped, equal when both are present)');
+        // A closed `code` rides on the error so the refusal log tells an operator WHY (errForLog prints a closed UPPER_SNAKE code) with no value (BAPert 76998 E11).
+        throw Object.assign(
+          new Error(responseMasked ? 'response address is masked' : 'no usable email (needs data.user.email or an email claim, address-shaped, equal when both are present)'),
+          { code: responseMasked ? 'RESPONSE_ADDRESS_MASKED' : 'NO_USABLE_EMAIL' },
+        );
       }
       const name =
         (typeof payload.name === 'string' && payload.name.trim()) ||
@@ -301,7 +306,7 @@ export function createIdpOAuthHooks(opts: IdpOAuthHookOptions) {
       return { id: claims.sub, email: claims.email, name: claims.name, emailVerified: claims.emailVerified };
     } catch (err) {
       // Reason only, never the token.
-      console.warn('[BETTER_AUTH] payez-idp access token refused:', err instanceof Error ? err.message : String(err));
+      console.warn('[BETTER_AUTH] payez-idp access token refused:', errForLog(err));
       return null;
     }
   }

package/src/auth/utils/idp-client.ts

@@ -18,6 +18,7 @@ import type {
   IdpRefreshResponse,
   LoginCredentials,
 } from '../types/auth-types';
+import { errForLog } from '../../lib/log-safe';
 
 // ============================================================================
 // CONFIGURATION
@@ -109,7 +110,7 @@ export async function idpLogin(
       result: responseData.result,
     };
   } catch (error) {
-    console.error('[IDP_CLIENT] Login request failed:', error);
+    console.error('[IDP_CLIENT] Login request failed:', errForLog(error));
     return {
       success: false,
       error: {
@@ -246,7 +247,7 @@ export async function idpRefreshToken(
       },
     };
   } catch (error) {
-    console.error('[IDP_CLIENT] Token refresh request failed:', error);
+    console.error('[IDP_CLIENT] Token refresh request failed:', errForLog(error));
     return {
       success: false,
       error: {
@@ -304,7 +305,7 @@ export async function idpVerify2FA(
 
     return { success: true };
   } catch (error) {
-    console.error('[IDP_CLIENT] 2FA verification failed:', error);
+    console.error('[IDP_CLIENT] 2FA verification failed:', errForLog(error));
     return {
       success: false,
       error: {
@@ -352,7 +353,7 @@ export async function idpSend2FACode(
 
     return { success: true };
   } catch (error) {
-    console.error('[IDP_CLIENT] Send 2FA code failed:', error);
+    console.error('[IDP_CLIENT] Send 2FA code failed:', errForLog(error));
     return {
       success: false,
       error: {

package/src/auth/utils/token-utils.ts

@@ -9,6 +9,8 @@
 
 import { jwtDecode, decodeJwtHeader, extractKidFromToken, JwtHeader } from '../../lib/jwt-decode';
 import type { DecodedIdpAccessToken } from '../types/auth-types';
+import { REFRESH_WINDOW_MS } from '../../lib/refresh-window';
+import { errForLog } from '../../lib/log-safe';
 
 // Re-export header utilities for consumers
 export { decodeJwtHeader, extractKidFromToken, type JwtHeader } from '../../lib/jwt-decode';
@@ -27,7 +29,7 @@ export function decodeIdpAccessToken(token: string): DecodedIdpAccessToken | nul
   try {
     return jwtDecode<DecodedIdpAccessToken>(token);
   } catch (error) {
-    console.error('[TOKEN_UTILS] Failed to decode access token:', error);
+    console.error('[TOKEN_UTILS] Failed to decode access token:', errForLog(error));
     return null;
   }
 }
@@ -58,7 +60,7 @@ export function decodeIdpAccessTokenFull(token: string): {
       bearerKeyId: header.kid,
     };
   } catch (error) {
-    console.error('[TOKEN_UTILS] Failed to decode access token (full):', error);
+    console.error('[TOKEN_UTILS] Failed to decode access token (full):', errForLog(error));
     return null;
   }
 }
@@ -137,12 +139,12 @@ export function extractAmrFromToken(decoded: DecodedIdpAccessToken): string[] {
  * Check if a token expiry timestamp indicates the token needs refresh.
  *
  * @param expiresAt - Token expiry timestamp (Unix milliseconds)
- * @param bufferMs - How early to trigger refresh (default 5 minutes)
+ * @param bufferMs - How early to trigger refresh (default: the one refresh window, `REFRESH_WINDOW_MS`, 5 minutes)
  * @returns true if token is expired or will expire within buffer period
  */
 export function tokenNeedsRefresh(
   expiresAt: number | undefined,
-  bufferMs: number = 5 * 60 * 1000
+  bufferMs: number = REFRESH_WINDOW_MS
 ): boolean {
   if (!expiresAt) {
     return true; // No expiry info = assume needs refresh
@@ -237,7 +239,7 @@ export function validateTokenExpiry(
       mismatch,
     };
   } catch (error) {
-    console.error('[TOKEN_UTILS] Failed to validate token expiry:', error);
+    console.error('[TOKEN_UTILS] Failed to validate token expiry:', errForLog(error));
     return { valid: false, actualExpiresAt: null, mismatch: false };
   }
 }

package/src/config/logger.ts

@@ -1,6 +1,7 @@
 import { getLoggingConfigSync, startConfigWatching, addConfigWatcher } from './logging-config';
 import { LoggingConfig } from '../types/logging';
 import { createVibeLogTransport } from './vibe-log-transport';
+import { errForLog } from '../lib/log-safe';
 
 let loggingConfig: LoggingConfig = getLoggingConfigSync();
 startConfigWatching();
@@ -41,7 +42,7 @@ const createLogger = (): any => {
       console.log('[LOGGER] Vibe Redis transport DISABLED - no REDIS_URL configured');
     }
     return winston.createLogger({ level: loggingConfig.logLevel, levels: loggingConfig.levels, format: winston.format.combine(winston.format.timestamp(), winston.format.errors({ stack: true }), winston.format.json()), transports, exitOnError: false });
-  } catch (error) { console.warn('Failed to initialize Winston logger, falling back to EdgeLogger:', error); return new EdgeLogger(); }
+  } catch (error) { console.warn('Failed to initialize Winston logger, falling back to EdgeLogger:', errForLog(error)); return new EdgeLogger(); }
 };
 
 let logger: any;

package/src/config/logging-config.ts

@@ -1,6 +1,7 @@
 import { promises as fs } from 'fs';
 import { watch, existsSync } from 'fs';
 import { LoggingConfig, LogLevel } from '../types/logging';
+import { errForLog } from '../lib/log-safe';
 
 const isEdgeRuntime = typeof (globalThis as any).EdgeRuntime !== 'undefined' || process.env.NEXT_RUNTIME === 'edge';
 
@@ -35,7 +36,7 @@ class LoggingConfigManager {
       const config = this.validateAndMergeConfig(rawConfig);
       this.config = config; this.notifyWatchers(config); return config;
     } catch (error) {
-      console.warn(`Failed to load logging config from ${this.configPath}:`, error);
+      console.warn(`Failed to load logging config from ${this.configPath}:`, errForLog(error));
       return this.getDefaultConfig();
     }
   }
@@ -43,11 +44,11 @@ class LoggingConfigManager {
   async getConfig(): Promise<LoggingConfig> { if (!this.config) { return await this.loadConfig(); } return this.config; }
   getConfigSync(): LoggingConfig { return this.config || this.getDefaultConfig(); }
 
-  startWatching(): void { if (this.isEdgeRuntime || this.isBrowser) { return; } if (this.fileWatcher) { return; } try { if (!existsSync(this.configPath)) { console.warn(`Logging config file not found at ${this.configPath} — watch disabled`); return; } this.fileWatcher = watch(this.configPath, { persistent: false }, (eventType) => { if (eventType === 'change') { this.loadConfig().catch(console.error); } }); } catch (error) { console.warn('Failed to start watching logging config file:', error); } }
+  startWatching(): void { if (this.isEdgeRuntime || this.isBrowser) { return; } if (this.fileWatcher) { return; } try { if (!existsSync(this.configPath)) { console.warn(`Logging config file not found at ${this.configPath} — watch disabled`); return; } this.fileWatcher = watch(this.configPath, { persistent: false }, (eventType) => { if (eventType === 'change') { this.loadConfig().catch(console.error); } }); } catch (error) { console.warn('Failed to start watching logging config file:', errForLog(error)); } }
   stopWatching(): void { if (this.isEdgeRuntime || this.isBrowser) { return; } if (this.fileWatcher) { this.fileWatcher.close(); this.fileWatcher = null; } }
   addWatcher(callback: (config: LoggingConfig) => void): void { this.watchers.add(callback); }
   removeWatcher(callback: (config: LoggingConfig) => void): void { this.watchers.delete(callback); }
-  private notifyWatchers(config: LoggingConfig): void { this.watchers.forEach(cb => { try { cb(config); } catch (error) { console.error('Error in logging config watcher:', error); } }); }
+  private notifyWatchers(config: LoggingConfig): void { this.watchers.forEach(cb => { try { cb(config); } catch (error) { console.error('Error in logging config watcher:', errForLog(error)); } }); }
 
   private validateAndMergeConfig(rawConfig: any): LoggingConfig {
     const defaults = this.getDefaultConfig();

package/src/config/vibe-log-transport.ts

@@ -12,6 +12,7 @@
  */
 
 import { getRedis } from '../lib/redis';
+import { errForLog } from '../lib/log-safe';
 
 // Dynamic import — winston is a peerDependency and may not be installed.
 // We resolve the base class lazily so builds don't break without it.
@@ -188,7 +189,7 @@ export class VibeLogTransport extends TransportBase {
         this.batch = [...entries, ...this.batch].slice(0, 100);
       }
       // Log to console as fallback
-      console.error('[VibeLogTransport] Failed to flush logs:', err);
+      console.error('[VibeLogTransport] Failed to flush logs:', errForLog(err));
     } finally {
       this.isFlushing = false;
     }

package/src/lib/api-handler.ts

@@ -26,6 +26,7 @@ import {
 import { getJwtCookieName } from './app-slug';
 import { getTokenTestAware } from './test-aware-get-token';
 import { internalRefresh } from './internal-api';
+import { REFRESH_WINDOW_MS } from './refresh-window';
 
 // ============================================================================
 // Types
@@ -284,7 +285,7 @@ export class ApiHandler {
       // Skip the optimization (hasRefreshToken check) when access token is missing —
       // some session shapes store the refresh token under different field names,
       // and we still want a refresh attempt to populate the access token.
-      const thresholdMs = 5 * 60 * 1000;
+      const thresholdMs = REFRESH_WINDOW_MS;
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       const expires = sessionData.idpAccessTokenExpires || (sessionData as any).accessTokenExpires || 0;
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -426,7 +427,7 @@ export class ApiHandler {
     try {
       // Double-check if still needs refresh
       const latest = await getSession(sessionToken);
-      const thresholdMs = 5 * 60 * 1000;
+      const thresholdMs = REFRESH_WINDOW_MS;
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       const latestAny = latest as any;
       // Sessions may store the access token under either `accessToken` or `idpAccessToken`,
@@ -481,7 +482,7 @@ export class ApiHandler {
         const session = await getSession(sessionToken);
         if (session?.accessToken) {
           const expires = session.accessTokenExpires || 0;
-          if ((expires - Date.now()) > (5 * 60 * 1000)) {
+          if ((expires - Date.now()) > REFRESH_WINDOW_MS) {
             return { success: true };
           }
         }