@payez/next-mvp 4.11.0 → 4.12.0

package/src/lib/standardized-client-api.ts

@@ -9,6 +9,7 @@
 // ========================================================================================
 
 import { authClient } from '../client/better-auth-client';
+import { errForLog } from './log-safe';
 
 /** Unwrap Better Auth getSession() to a flat session-like object for backward compat */
 async function getSession(): Promise<any> {
@@ -147,7 +148,7 @@ function scheduleLoginRedirect(isImmediate = false) {
       console.warn(`🔄 Redirecting to login with return URL: ${returnUrl}`);
       window.location.href = `/account-auth/login?returnUrl=${returnUrl}`;
     } catch (error) {
-      console.error('❌ Error during login redirect:', error);
+      console.error('❌ Error during login redirect:', errForLog(error));
       // Final fallback
       try {
         window.location.href = '/account-auth/login';
@@ -721,7 +722,7 @@ class StandardizedClientApiService {
       }
       
       // Wrap unknown errors as network errors
-      console.error('❌ API request failed:', error);
+      console.error('❌ API request failed:', errForLog(error));
       throw new ApiNetworkError(
         error instanceof Error ? error.message : 'Network error',
         0,

package/src/lib/token-lifecycle.ts

@@ -27,6 +27,7 @@ import { getRedis } from './redis';
 import { getAppSlug } from './app-slug';
 import { tokenLogId } from './token-log-id';
 import { REFRESH_WINDOW_MS } from './refresh-window';
+import { errForLog } from './log-safe';
 
 // "needs refresh" threshold: THE one freshness window (lib/refresh-window), the same value the refresh route, ensureFreshAccessToken and idp-fetch use.
 const REFRESH_THRESHOLD_MS = REFRESH_WINDOW_MS;
@@ -434,7 +435,7 @@ export async function ensureFreshToken(
         }
       } catch (e) {
         // If we can't decode, proceed with normal logic
-        console.warn('[TOKEN_LIFECYCLE] Could not validate JWT exp claim:', e);
+        console.warn('[TOKEN_LIFECYCLE] Could not validate JWT exp claim:', errForLog(e));
       }
     }
 
@@ -512,7 +513,7 @@ export async function ensureFreshToken(
       sessionData,
     };
   } catch (error) {
-    console.error('[TOKEN_LIFECYCLE] Error:', error);
+    console.error('[TOKEN_LIFECYCLE] Error:', errForLog(error));
     return {
       success: false,
       error: 'NO_SESSION',

package/src/middleware/create-middleware.ts

@@ -32,6 +32,7 @@ import {
   resetSecret,
   signedResetHref,
 } from '../auth/session-reset-link';
+import { errForLog } from '../lib/log-safe';
 
 // =============================================================================
 // TYPES
@@ -1037,7 +1038,7 @@ async function handleAllow(
         );
       }
     } catch (error) {
-      console.error('[MIDDLEWARE] RBAC error:', error);
+      console.error('[MIDDLEWARE] RBAC error:', errForLog(error));
 
       // In development, fail open
       if (process.env.NODE_ENV !== 'production') {

package/src/middleware/rbac-check.ts

@@ -1,3 +1,4 @@
+import { errForLog } from '../lib/log-safe';
 /**
  * Page RBAC Check Module
  *
@@ -262,7 +263,7 @@ export async function checkPagePermission(
       };
     }
 
-    console.error('[RBAC] Proxy error:', error);
+    console.error('[RBAC] Proxy error:', errForLog(error));
     return {
       allowed: false,
       reason: 'rbac_service_unavailable',

package/src/routes/auth/logout.ts

@@ -27,6 +27,7 @@ import {
 } from '../../lib/app-slug';
 import { siteEvents, getClientIp } from '../../lib/site-logger';
 import { logExceptionWithCorrelation } from '../../lib/safe-error-response';
+import { errForLog } from '../../lib/log-safe';
 
 /**
  * 4.8.9: answered (status 500) when a sign-out did not finish. 4.8.10 (BAPert 76297): TWO sentences, one per cause, each true for its
@@ -79,7 +80,13 @@ export async function POST(req: NextRequest) {
         await revokeSessionAtIdp(req);
       } catch (error) {
         idpRevokeFailed = true;
-        console.error('[LOGOUT_ROUTE] IdP revoke failed - the IdP refresh token is STILL LIVE:', error);
+        // "STILL LIVE" only when the IdP showed it (a forced refresh succeeded); otherwise say what is known: it was not confirmed.
+        console.error(
+          (error as { grantLive?: boolean } | null)?.grantLive === true
+            ? '[LOGOUT_ROUTE] IdP revoke failed - the IdP refresh token is STILL LIVE:'
+            : '[LOGOUT_ROUTE] IdP revoke could not be confirmed (the grant may already be dead):',
+          errForLog(error),
+        );
       }
     }
 
@@ -91,7 +98,7 @@ export async function POST(req: NextRequest) {
         console.info('[LOGOUT_ROUTE] Session deleted from store');
       } catch (error) {
         localDeleteFailed = true;
-        console.error('[LOGOUT_ROUTE] Failed to delete session - the server session is STILL LIVE:', error);
+        console.error('[LOGOUT_ROUTE] Failed to delete session - the server session is STILL LIVE:', errForLog(error));
       }
     }
 

package/src/routes/auth/settings.ts

@@ -30,6 +30,7 @@
 import { NextResponse } from 'next/server';
 import { getIDPClientConfig } from '../../lib/idp-client-config';
 import { secretSafeJson } from '../../lib/never-in-response';
+import { errForLog } from '../../lib/log-safe';
 
 export interface PublicAuthSettings {
     // OAuth providers enabled for this client
@@ -95,7 +96,7 @@ export async function GET() {
         config = await getIDPClientConfig();
     } catch (error) {
         // Keep the loud line - it is what finally unmasked this in production.
-        console.error('[AUTH_SETTINGS] Failed to get settings:', error);
+        console.error('[AUTH_SETTINGS] Failed to get settings:', errForLog(error));
         // The `degraded: true` shape that used to live here (240447) is gone
         // deliberately. It still answered `success: true` with a full invented
         // policy and merely LABELLED the guess - which BAPert v32 rules out:

package/src/server/auth-guard.ts

@@ -14,6 +14,7 @@ import { decodeSession } from './decode-session';
 import { getIDPClientConfig } from '../lib/idp-client-config';
 import { getSessionCookieName, getSecureSessionCookieName } from '../lib/app-slug';
 import type { SessionData } from '../lib/session-store';
+import { errForLog } from '../lib/log-safe';
 
 // =============================================================================
 // TYPES
@@ -89,7 +90,7 @@ export async function authGuard(options?: AuthGuardOptions): Promise<AuthGuardRe
     decoded = await decodeSession();
   } catch (error) {
     // Redis unreachable or startup failure → fail closed
-    console.error('[AUTH-GUARD] Session decode failed (service error):', error instanceof Error ? error.message : String(error));
+    console.error('[AUTH-GUARD] Session decode failed (service error):', errForLog(error));
     redirect(serviceUnavailableUrl);
   }
 
@@ -122,7 +123,7 @@ export async function authGuard(options?: AuthGuardOptions): Promise<AuthGuardRe
     requires2FA = config.authSettings?.require2FA ?? true;
   } catch (error) {
     // If we can't check 2FA config, fail closed
-    console.error('[AUTH-GUARD] 2FA config check failed:', error instanceof Error ? error.message : String(error));
+    console.error('[AUTH-GUARD] 2FA config check failed:', errForLog(error));
     redirect(serviceUnavailableUrl);
   }
 
@@ -186,7 +187,7 @@ export async function authGuard(options?: AuthGuardOptions): Promise<AuthGuardRe
         if (error && typeof error === 'object' && 'digest' in error) {
           throw error;
         }
-        console.error(`[AUTH-GUARD] Custom check "${check.name}" error:`, error instanceof Error ? error.message : String(error));
+        console.error(`[AUTH-GUARD] Custom check "${check.name}" error:`, errForLog(error));
         redirect(serviceUnavailableUrl);
       }
     }

package/src/server/auth.ts

@@ -14,6 +14,7 @@ import {
   type SessionData,
 } from '../lib/session-store';
 import { tokenLogId } from '../lib/token-log-id';
+import { errForLog } from '../lib/log-safe';
 import { resolveVerifiedSessionTokenFromRequest } from './verified-session-token';
 
 export type IdpTokenResult =
@@ -134,20 +135,14 @@ export async function getAuthInstance() {
  * `{error:'NO_SESSION'}`, and getSession() swallowed every Redis error into a bare `catch {}`. These helpers name
  * the origin and make a swallowed read audible. Hard rules: every helper is wrapped so it can NEVER throw or change
  * a return value; nothing here ever logs a token, a cookie VALUE or a Redis value - only a tokenLogId() fingerprint,
- * cookie NAMES, booleans, and an error name/message with any long opaque run redacted.
+ * cookie NAMES, booleans, and an error NAME with its closed code/status (errForLog; never the message).
  * -------------------------------------------------------------------------------------------------------------- */
 
-/** An error name/message, first 80 chars, with any 24+ char opaque run (a token, a key) replaced. */
-function scrubForLog(v: unknown): string {
-  const raw = v instanceof Error ? v.message : String(v ?? '');
-  return raw.replace(/[A-Za-z0-9_\-.+/=]{24,}/g, '[redacted]').slice(0, 80);
-}
-
-/** `catch {}` sites on the session read path: still swallowed, now audible. */
+/** `catch {}` sites on the session read path: still swallowed, now audible. The line names the error and its closed code/status only: the
+ *  message is dropped (BAPert 76553: a redacted-and-truncated message still leaked host names, ports and quoted input). */
 function logSessionReadSwallowed(path: 'primary' | 'A' | 'B', err: unknown): void {
   try {
-    const name = scrubForLog(err instanceof Error ? err.name : typeof err);
-    console.warn(`[server-auth] SESSION_READ_SWALLOWED path=${path} err=${name} msg=${scrubForLog(err)}`);
+    console.warn(`[server-auth] SESSION_READ_SWALLOWED path=${path} ${errForLog(err)}`);
   } catch {
     /* a diagnostic must never change the outcome */
   }

package/src/server/decode-session.ts

@@ -15,6 +15,7 @@ import { ensureInitialized } from '../lib/startup-init';
 import { extractSessionTokenFromCookieValue } from '../lib/session-cookie-shape';
 import { resolveVerifiedSessionCookie } from './verified-session-token';
 import { tokenLogId } from '../lib/token-log-id';
+import { errForLog } from '../lib/log-safe';
 
 export interface DecodedSession {
   sessionData: SessionData;
@@ -197,7 +198,7 @@ async function tryBetterAuthSession(
 
     return { sessionData, jwtPayload };
   } catch (error) {
-    console.warn('[DECODE-SESSION] Better Auth session check failed:', error instanceof Error ? error.message : String(error));
+    console.warn('[DECODE-SESSION] Better Auth session check failed:', errForLog(error));
     return null;
   }
 }
@@ -303,7 +304,7 @@ export async function decodeSession(
       jwtPayload: (payload ?? { sessionToken }) as DecodedSession['jwtPayload'],
     };
   } catch (error) {
-    console.error('[DECODE-SESSION] Error:', error instanceof Error ? error.message : String(error));
+    console.error('[DECODE-SESSION] Error:', errForLog(error));
     return null;
   }
 }

package/src/server/with-auth.ts

@@ -17,6 +17,7 @@ import 'server-only';
 import { NextRequest, NextResponse } from 'next/server';
 import { decodeSession } from './decode-session';
 import type { SessionData } from '../lib/session-store';
+import { errForLog } from '../lib/log-safe';
 
 // =============================================================================
 // TYPES
@@ -83,7 +84,7 @@ export function withAuth(
 
       return handler(req, auth);
     } catch (error) {
-      console.error('[WITH-AUTH] Error:', error instanceof Error ? error.message : String(error));
+      console.error('[WITH-AUTH] Error:', errForLog(error));
       return NextResponse.json(
         { error: 'Internal Server Error', message: 'Auth check failed' },
         { status: 500 }