@payez/next-mvp 4.11.0 → 4.12.1

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog — @payez/next-mvp
 
+## 4.12.1 (to be published under dist-tag `next` only, after 4.12.0; `latest` stays 4.8.9 until Jon says otherwise)
+
+A patch cut from the 4.12.0 tree carrying ONE change: the PAY-2425 hygiene fix below (PR 1500).
+
+- **CHANGE (PAY-2425, hygiene): the refresh no longer invents authentication claims for an OAuth (Google) session.** `lib/ensure-fresh-access-token` answered an OAuth session whose stored authentication methods were empty with `amr ['pwd','mfa']`, `two_factor_method 'oauth'` and an `acr` raised from '1' to '2' ("OAuth IS a form of multi-factor auth"), and echoed a stored `mfaVerified` as `two_factor_verified` whatever the session's methods said. OAuth is federated sign-in, not a second factor (BAPert 77404). The refresh body now carries only what the session records: empty stays empty, `acr` is the session's own level, no method is named from silence, and `two_factor_verified` is sent only when the session's recorded methods contain `mfa`, `sms`, `totp` or `email`. A session that really attests `mfa` still sends it. The IdP ignores these request fields and mints `amr`/`acr` from the stored refresh row, so this removes a false claim from the wire; it does not establish that any bypass existed or is closed. **What changes for a caller:** a Google user on a `require2FA` client is asked for a code, as before, because the IdP decides that; a Google-only client that wants no second factor sets `require2FA = false` explicitly. An earlier version of this fix on `nextpert/375639-amr-fabrication` (e6e3b6c3, e3b3bb12) was never merged; the refresh path has since moved into this helper. Rows: `test/next-mvp-pay-2425-no-fabricated-mfa.test.cjs` (R1/R2/R3, C1, N1 and four mutants).
+
+## 4.12.0 (to be published under dist-tag `next` only, after 4.11.0; `latest` stays 4.8.9 until Jon says otherwise)
+
+A minor: PII-in-logs groups 1, 2, 3a and 3b, the GOV-023 signout BREAKING change, the logout-401 FIX (PAY-2396), and the BREAKING site-logger signatures (3b: callers of `siteEvents.loginFailed` / `siteEvents.error` must change).
+
+
+- **BREAKING: `siteEvents.loginFailed` and `siteEvents.error` (`lib/site-logger`) lose their free-text parameters (PII-in-logs group 3b, BAPert 76553 Q2).** `loginFailed({ reason, url?, user_agent?, ip_address? })` no longer takes `email`; the `reason` is stored only if it is a closed UPPER_SNAKE code, anything else is stored as `UNSPECIFIED`. `error({ code, user_id?, url?, user_agent?, ip_address? })` takes a closed `code` instead of `message`, `error` and `stack`; the stored message is the fixed sentence `Application error` and the code goes in `context.code`. The parameters are removed from the TYPE, so a TypeScript caller that still passes `email`, `message`, `error` or `stack` fails to compile, which is the point. **Migration:** replace `loginFailed({ reason: 'bad password', email })` with `loginFailed({ reason: 'BAD_PASSWORD' })` (look the user up by `user_id` elsewhere if support needs it), and `error({ message: err.message, stack: err.stack })` with `error({ code: 'YOUR_CLOSED_CODE' })`. Callers found: the package itself calls only `siteEvents.logout`; VibeID-Customer-Portal 0; idealvibe.online 0 `siteEvents.*` (it has its own copy of `lib/site-logger.ts`, which keeps the old shapes until its own caller PR); UMI-Website 0 (not verified against its repo). Row: `test/next-mvp-pii-logs-group3b.test.cjs`.
+
+- **BREAKING: `api-handlers/auth/signout` now ends the IdP grant, not only the local session (GOV-023, BAPert 76687).** It used to delete the local record only and make no IdP call, so an app that mounted it left the IdP refresh token live until it expired (`routes/auth/logout` already revoked first). It now runs the same IdP-first path: `revokeSessionAtIdp`, then the local delete, then the cookies. If the IdP revoke fails, or cannot resolve the session while a refresh token is held, or the local delete fails, it answers **HTTP 500** `{ success: false, code: 'SESSION_NOT_ENDED', cause: 'idp_unconfirmed' | 'local_delete_failed', message }` (the same code, causes and sentences as `routes/auth/logout`; both failing: the local cause) instead of `success: true`; the local delete and the cookie clearing still happen. A caller that treated every signout answer as success must now read `success` / `cause`. Ships in the release after 4.11.0 (with the site-logger signature change). Rows: `test/next-mvp-gov023-signout-ends-idp-grant.test.cjs`.
+- **CHANGE: a caught error is logged by its NAME and a closed code/status, never its message (PII-in-logs group 1, BAPert 76553).** New `lib/log-safe` (`errForLog`, `closedCodeForLog`, internal, not in the exports map): `error=<Name> [status=<100-599>] [code=<CLOSED_TOKEN>]`; `message`, `stack`, `cause` and `details` never appear, and a name, status or code that is not a closed shape is dropped. Applied to the shared sites with the widest reach: `logExceptionWithCorrelation` (14 handlers; the line keeps the `correlationId`, the logged `error` is now the string above instead of the raw error object), the four catches in `auth/utils/idp-client` (login, refresh, verify-2FA, send-2FA-code), `api-handlers/session/refresh-viability`'s catch (it logged the exception message next to the correlation id; found by the Mac run of `user-facing-error-not-returned`), and `server/auth`'s `SESSION_READ_SWALLOWED` line (it used to log a redacted, 80-character-truncated message; it now logs `error=<Name>` only). Operators lose the exception text in these log lines on purpose; the correlation id still ties a response to its line. Rows: `test/next-mvp-pii-logs-group1.test.cjs`; `test/pay-2136-no-session-origin.test.cjs` and `test/user-facing-error-not-returned.test.cjs` now assert the opposite of what they did (the message must NOT be in the log).
+- **CHANGE: more caught errors are logged by NAME and closed code/status, not by message (PII-in-logs group 2, BAPert 76767).** The catches in `api-handlers/account/*` (send-code, update-phone, validate-password, verify-email, verify-sms, reset-password, recovery initiate and forward), `api-handlers/mfa/*` (backup-code-verify, totp-verify), `auth/utils/token-utils` (three sites) and `lib/session-store` now log `errForLog(err)` instead of the error object. The response bodies do not change. Row: `test/next-mvp-pii-logs-group2.test.cjs` (a source scan of those 12 files, plus a real-dist token-decode failure whose canary must not reach a log line).
+- **CHANGE: the rest of the server-side caught-error logs use `errForLog` (PII-in-logs group 3a, BAPert 76955).** `api-handlers` (anon preferences, credential-login and its email-code lane, refresh, session viability), `auth` (better-auth, idp-oauth), `lib` (ensure-fresh-access-token, idp-client-config, jwt-decode, redis, site-logger, standardized-client-api, token-lifecycle), `config` (logger, logging-config, vibe-log-transport), `routes/auth` (logout, settings), `server` (auth-guard, decode-session, with-auth) and `middleware` now log the error's name and a closed status/code, not `err`, `err.message` or `String(err)`. `lib/geolocation` no longer logs the IP or the upstream's `data.message` (Q1). The `payez-idp access token refused` line now reads `error=Error code=RESPONSE_ADDRESS_MASKED` or `code=NO_USABLE_EMAIL` (a closed code on the two refusals thrown in `auth/idp-oauth`, BAPert 76998) instead of the reason sentence, so an operator still sees WHY and no message text is logged. Response bodies do not change. Browser code (client, components, hooks, stores) is untouched. Row: `test/next-mvp-pii-logs-group3a.test.cjs`.
+- **FIX: a sign-out whose logout answers 401 now forces one REAL refresh, so a dead grant is no longer reported as "could not confirm the sign-out" (BAPert 77013, QAPert 77012).** After a password change, an admin revoke or a sign-out elsewhere, Core has invalidated the access token while the stored copy still looks fresh. `POST /api/Account/logout` then answered 401, the refresh the 401 triggers answered "already fresh" without asking the IdP, so no discard marker was written and `revokeSessionAtIdp` threw: the route answered `SESSION_NOT_ENDED` / `idp_unconfirmed` and logged "the IdP refresh token is STILL LIVE" for a grant that was already dead. Now `revokeSessionAtIdp` makes the refresh `idpFetchJSON` runs after a 401 a FORCED one, done in-process (`refreshOnAuthFailure` calls `ensureFreshAccessToken` with a window that cannot be "fresh", config from `IDP_URL` / `CLIENT_ID` as `oauth/resume` reads it). Nothing changes on the public `POST /api/auth/refresh`: no header can force a refresh (NightHawk 77021, BAPert 77022). The IdP's answer decides: a refresh 401 with the discard marker is `grant-already-dead` (a successful sign-out); a refresh that succeeds while the logout is still refused means the grant is live and stays `idp_unconfirmed`. The failure is a typed `IdpLogoutUnconfirmedError` (`code` `IDP_LOGOUT_UNCONFIRMED`, `grantLive`); `routes/auth/logout` and `api-handlers/auth/signout` print "STILL LIVE" only when `grantLive` is true and otherwise say the revoke could not be confirmed. `api-handlers/auth/signout` also logs its revoke and session-cleanup errors through `errForLog` now (they passed the raw error). Rows: `test/next-mvp-logout-401-forces-refresh.test.cjs`. A real, unstubbed row (a real password change must land on `notice=password-changed`) is QAPert's walk.
+
 ## 4.11.0 (to be published under dist-tag `next` only, after 4.10.0; `latest` stays 4.8.9 until Jon says otherwise)
 
 Carries PRs 1443, 1444, 1445, 1446, 1451, 1452, 1460 and 1461 (and the 1450 design doc): the refresh consolidation (the refresh route is now a thin wrapper over `ensureFreshAccessToken`), the one freshness window, the fetch timeout with the in-doubt marker, and the trace-id cleanup. A minor, because response codes and bodies that callers may match on changed (BREAKING below).

package/dist/api-handlers/account/recovery/forward.js

@@ -7,6 +7,7 @@ const env_1 = require("../../../config/env");
 const idp_client_config_1 = require("../../../lib/idp-client-config");
 const client_key_1 = require("../../../lib/client-key");
 const safe_error_response_1 = require("../../../lib/safe-error-response");
+const log_safe_1 = require("../../../lib/log-safe");
 /**
  * Account recovery - the ONE forwarder behind /recovery/send-code and /recovery/verify-code (PAY-1588).
  *
@@ -61,7 +62,7 @@ async function recoveryClientKey(where) {
         return (0, client_key_1.resolveClientKey)(config, where).key;
     }
     catch (e) {
-        console.error(`[${where}] could not resolve IDP client config for client_id:`, e);
+        console.error(`[${where}] could not resolve IDP client config for client_id:`, (0, log_safe_1.errForLog)(e));
         return null;
     }
 }

package/dist/api-handlers/account/recovery/initiate.js

@@ -5,6 +5,7 @@ const server_1 = require("next/server");
 const idp_client_config_1 = require("../../../lib/idp-client-config");
 const client_key_1 = require("../../../lib/client-key");
 const safe_error_response_1 = require("../../../lib/safe-error-response");
+const log_safe_1 = require("../../../lib/log-safe");
 function getIdpUrl() {
     const url = process.env.IDP_URL;
     if (!url)
@@ -37,7 +38,7 @@ async function recoveryClientKey() {
         return (0, client_key_1.resolveClientKey)(config, 'account/recovery/initiate').key;
     }
     catch (e) {
-        console.error('[account/recovery/initiate] could not resolve IDP client config for client_id:', e);
+        console.error('[account/recovery/initiate] could not resolve IDP client config for client_id:', (0, log_safe_1.errForLog)(e));
         return null;
     }
 }

package/dist/api-handlers/account/reset-password.js

@@ -5,6 +5,7 @@ const server_1 = require("next/server");
 const idp_client_config_1 = require("../../lib/idp-client-config");
 const client_key_1 = require("../../lib/client-key");
 const safe_error_response_1 = require("../../lib/safe-error-response");
+const log_safe_1 = require("../../lib/log-safe");
 function getIdpUrl() {
     const url = process.env.IDP_URL;
     if (!url)
@@ -37,7 +38,7 @@ async function recoveryClientKey() {
         return (0, client_key_1.resolveClientKey)(config, 'account/reset-password').key;
     }
     catch (e) {
-        console.error('[account/reset-password] could not resolve IDP client config for client_id:', e);
+        console.error('[account/reset-password] could not resolve IDP client config for client_id:', (0, log_safe_1.errForLog)(e));
         return null;
     }
 }

package/dist/api-handlers/account/send-code.js

@@ -13,6 +13,7 @@ const server_1 = require("next/server");
 const idp_fetch_1 = require("../../lib/idp-fetch");
 const env_1 = require("../../config/env");
 const two_factor_verify_failure_1 = require("../../lib/two-factor-verify-failure");
+const log_safe_1 = require("../../lib/log-safe");
 async function POST(req) {
     try {
         // Parse request body
@@ -47,7 +48,7 @@ async function POST(req) {
         }, { status: 200 });
     }
     catch (error) {
-        console.error('[SEND_CODE] Error:', error);
+        console.error('[SEND_CODE] Error:', (0, log_safe_1.errForLog)(error));
         return server_1.NextResponse.json({
             success: false,
             error: 'Failed to send verification code',

package/dist/api-handlers/account/update-phone.js

@@ -4,6 +4,7 @@ exports.POST = POST;
 const server_1 = require("next/server");
 const idp_fetch_1 = require("../../lib/idp-fetch");
 const env_1 = require("../../config/env");
+const log_safe_1 = require("../../lib/log-safe");
 /**
  * Update Phone Number API Handler
  *
@@ -63,7 +64,7 @@ async function POST(req) {
         });
     }
     catch (error) {
-        console.error('[UPDATE_PHONE] Error:', error);
+        console.error('[UPDATE_PHONE] Error:', (0, log_safe_1.errForLog)(error));
         return server_1.NextResponse.json({ success: false, error: { code: 'INTERNAL_ERROR', message: 'Failed to update phone number' } }, { status: 500 });
     }
 }

package/dist/api-handlers/account/validate-password.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.POST = POST;
 const server_1 = require("next/server");
+const log_safe_1 = require("../../lib/log-safe");
 async function POST(req) {
     try {
         const body = await req.json();
@@ -88,7 +89,7 @@ async function POST(req) {
         });
     }
     catch (error) {
-        console.error('[VALIDATE_PASSWORD] Error:', error);
+        console.error('[VALIDATE_PASSWORD] Error:', (0, log_safe_1.errForLog)(error));
         return server_1.NextResponse.json({
             is_valid: false,
             score: 0,

package/dist/api-handlers/account/verify-email.js

@@ -16,6 +16,7 @@ const test_aware_get_token_1 = require("../../lib/test-aware-get-token");
 const session_store_1 = require("../../lib/session-store");
 const jwt_decode_1 = require("../../lib/jwt-decode");
 const two_factor_verify_failure_1 = require("../../lib/two-factor-verify-failure");
+const log_safe_1 = require("../../lib/log-safe");
 async function POST(req) {
     try {
         // Parse request body
@@ -108,7 +109,7 @@ async function POST(req) {
         }, { status: 200 });
     }
     catch (error) {
-        console.error('[VERIFY_EMAIL] Error:', error);
+        console.error('[VERIFY_EMAIL] Error:', (0, log_safe_1.errForLog)(error));
         return server_1.NextResponse.json({
             success: false,
             error: 'Failed to verify code',

package/dist/api-handlers/account/verify-sms.js

@@ -16,6 +16,7 @@ const test_aware_get_token_1 = require("../../lib/test-aware-get-token");
 const session_store_1 = require("../../lib/session-store");
 const jwt_decode_1 = require("../../lib/jwt-decode");
 const two_factor_verify_failure_1 = require("../../lib/two-factor-verify-failure");
+const log_safe_1 = require("../../lib/log-safe");
 async function POST(req) {
     try {
         // Parse request body
@@ -108,7 +109,7 @@ async function POST(req) {
         }, { status: 200 });
     }
     catch (error) {
-        console.error('[VERIFY_SMS] Error:', error);
+        console.error('[VERIFY_SMS] Error:', (0, log_safe_1.errForLog)(error));
         return server_1.NextResponse.json({
             success: false,
             error: 'Failed to verify code',

package/dist/api-handlers/anon/preferences.js

@@ -13,6 +13,7 @@ exports.POST = POST;
 const server_1 = require("next/server");
 const headers_1 = require("next/headers");
 const anon_session_1 = require("../../lib/anon-session");
+const log_safe_1 = require("../../lib/log-safe");
 const COOKIE_MAX_AGE = 90 * 24 * 60 * 60; // 90 days in seconds
 /**
  * GET handler - retrieves anonymous session preferences
@@ -45,7 +46,7 @@ async function GET(request) {
         return response;
     }
     catch (error) {
-        console.error('[ANON-PREFERENCES] GET error:', error);
+        console.error('[ANON-PREFERENCES] GET error:', (0, log_safe_1.errForLog)(error));
         return server_1.NextResponse.json({ success: false, error: 'Failed to get preferences' }, { status: 500 });
     }
 }
@@ -90,7 +91,7 @@ async function POST(request) {
         return response;
     }
     catch (error) {
-        console.error('[ANON-PREFERENCES] POST error:', error);
+        console.error('[ANON-PREFERENCES] POST error:', (0, log_safe_1.errForLog)(error));
         return server_1.NextResponse.json({ success: false, error: 'Failed to update preferences' }, { status: 500 });
     }
 }

package/dist/api-handlers/auth/credential-login-email-code.js

@@ -5,6 +5,7 @@ const server_1 = require("next/server");
 const idp_client_config_1 = require("../../lib/idp-client-config");
 const client_key_1 = require("../../lib/client-key");
 const bearer_fetch_1 = require("../../lib/bearer-fetch");
+const log_safe_1 = require("../../lib/log-safe");
 // `export const runtime = 'nodejs'` must be written LITERALLY in the app's route file (Next ignores a re-exported segment config).
 /** One email-code request per this many seconds per browser (the IdP rate-limits too; this stops a double click and a loop). */
 const EMAIL_CODE_COOLDOWN_S = 30;
@@ -39,7 +40,7 @@ async function POST(req) {
         clientKey = (0, client_key_1.resolveClientKey)(config, 'graft/admin-login/email-code').key ?? '';
     }
     catch (err) {
-        console.error('[ADMIN_LOGIN_EMAIL_CODE] IDP client config unavailable:', err instanceof Error ? err.message : String(err));
+        console.error('[ADMIN_LOGIN_EMAIL_CODE] IDP client config unavailable:', (0, log_safe_1.errForLog)(err));
         return server_1.NextResponse.json({ success: false, error: 'Sign-in is temporarily unavailable. This is a problem on our side. Please try again shortly.' }, { status: 503 });
     }
     let sendOk = false;
@@ -70,7 +71,7 @@ async function POST(req) {
         }
     }
     catch (err) {
-        console.error('[ADMIN_LOGIN_EMAIL_CODE] twofa/email/send fetch failed:', err instanceof Error ? err.message : String(err));
+        console.error('[ADMIN_LOGIN_EMAIL_CODE] twofa/email/send fetch failed:', (0, log_safe_1.errForLog)(err));
     }
     if (!sendOk) {
         return server_1.NextResponse.json({ success: false, error: 'We could not ask for an email code just now - this is a problem on our side. Try again shortly.' }, { status: 502 });

package/dist/api-handlers/auth/credential-login.js

@@ -50,6 +50,7 @@ const crypto_1 = require("crypto");
 const device_id_1 = require("../../lib/device-id");
 const twofa_rejection_1 = require("../../lib/twofa-rejection");
 const bearer_fetch_1 = require("../../lib/bearer-fetch");
+const log_safe_1 = require("../../lib/log-safe");
 // `export const runtime = 'nodejs'` must be written LITERALLY in the app's route file (Next ignores a re-exported segment config).
 /**
  * The device id to forward to the IDP for THIS caller — card 240566.
@@ -171,7 +172,7 @@ async function POST(req) {
         config = await (0, idp_client_config_1.getIDPClientConfig)();
     }
     catch (err) {
-        console.error('[ADMIN_LOGIN] IDP client config unavailable — returning 503:', err);
+        console.error('[ADMIN_LOGIN] IDP client config unavailable — returning 503:', (0, log_safe_1.errForLog)(err));
         return server_1.NextResponse.json({
             success: false,
             error: 'Sign-in is temporarily unavailable. This is a problem on our side, not with your details. Please try again shortly.',
@@ -265,7 +266,7 @@ async function POST(req) {
             }
         }
         catch (error) {
-            console.error('[ADMIN-LOGIN] twofa verify fetch failed:', error instanceof Error ? error.message : String(error));
+            console.error('[ADMIN-LOGIN] twofa verify fetch failed:', (0, log_safe_1.errForLog)(error));
             return server_1.NextResponse.json({ success: false, error: 'Unable to reach the authentication service' }, { status: 503 });
         }
         if (!idpResponse.ok) {
@@ -350,7 +351,7 @@ async function POST(req) {
         });
     }
     catch (error) {
-        console.error('[ADMIN-LOGIN] IDP fetch failed:', error instanceof Error ? error.message : String(error));
+        console.error('[ADMIN-LOGIN] IDP fetch failed:', (0, log_safe_1.errForLog)(error));
         return server_1.NextResponse.json({ success: false, error: 'Unable to reach the authentication service' }, { status: 503 });
     }
     const rawText = await idpResponse.text();
@@ -446,7 +447,7 @@ async function POST(req) {
                 }
             }
             catch (err) {
-                console.warn('[ADMIN-LOGIN] mfa/methods fetch failed, defaulting to email lane:', err instanceof Error ? err.message : String(err));
+                console.warn('[ADMIN-LOGIN] mfa/methods fetch failed, defaulting to email lane:', (0, log_safe_1.errForLog)(err));
             }
         }
         // PAY-2314: advertise what this user can actually use, derived from the SAME usableFactors that chose the lane
@@ -523,7 +524,7 @@ async function POST(req) {
                 }
             }
             catch (err) {
-                console.error(`[ADMIN-LOGIN] twofa/${sendLane}/send fetch failed:`, err instanceof Error ? err.message : String(err));
+                console.error(`[ADMIN-LOGIN] twofa/${sendLane}/send fetch failed:`, (0, log_safe_1.errForLog)(err));
             }
         }
         // 267479: `method:'email'` WAS A HARDCODED LITERAL HERE, and it was a lie for

package/dist/api-handlers/auth/refresh.js

@@ -29,6 +29,7 @@ const auth_1 = require("../../server/auth");
 const ensure_fresh_access_token_1 = require("../../lib/ensure-fresh-access-token");
 const refresh_in_doubt_1 = require("../../lib/refresh-in-doubt");
 const safe_trace_id_1 = require("../../lib/safe-trace-id");
+const log_safe_1 = require("../../lib/log-safe");
 /** E's failure -> this route's body and status. Bodies for the cases the route always had are exactly as they were. */
 function failureResponse(r) {
     switch (r.code) {
@@ -128,7 +129,7 @@ function createRefreshHandler(config) {
             });
         }
         catch (err) {
-            console.error('[AUTH_REFRESH] Unexpected error', { error: err?.message || String(err) });
+            console.error('[AUTH_REFRESH] Unexpected error', { error: (0, log_safe_1.errForLog)(err) });
             return server_1.NextResponse.json({
                 error: 'Unexpected error during refresh',
                 code: 'INTERNAL_SERVER_ERROR'

package/dist/api-handlers/auth/signout.js

@@ -15,6 +15,9 @@ exports.createSignoutHandler = createSignoutHandler;
 const server_1 = require("next/server");
 const headers_1 = require("next/headers");
 const session_store_1 = require("../../lib/session-store");
+const idp_logout_1 = require("../../lib/idp-logout");
+const log_safe_1 = require("../../lib/log-safe");
+const logout_1 = require("../../routes/auth/logout");
 const auth_1 = require("../../server/auth");
 const app_slug_1 = require("../../lib/app-slug");
 const token_log_id_1 = require("../../lib/token-log-id");
@@ -130,9 +133,39 @@ function createSignoutHandler() {
                 console.warn('[SIGNOUT] Manual JWT decode failed to extract session token');
             }
         }
-        // Delete the session from EVERY store (181922): canonical + BA secondary.
-        // Canonical-only deletion let the ba: record resurrect the session.
+        // GOV-023 (BAPert 76687): ending the session ends the IdP GRANT first, the same IdP-first path as routes/auth/logout. Before this, this
+        // handler only deleted the local record, so a consumer who mounted it left the IdP refresh token live until it expired.
+        // A failed or unresolved revoke is the same typed failure as a failed local delete (SESSION_NOT_ENDED + cause); the local delete still
+        // runs and the cookies are cleared either way.
+        let idpRevokeFailed = false;
+        let localDeleteFailed = false;
         if (redisSessionToken) {
+            // Does the stored session hold an IdP refresh token? (revokeSessionAtIdp reads the canonical row, then the Better Auth record.)
+            let heldRefreshToken = false;
+            try {
+                const stored = (await (0, session_store_1.getSession)(redisSessionToken)) ?? (await (0, session_store_1.getBetterAuthSession)(redisSessionToken));
+                heldRefreshToken = !!stored?.idpRefreshToken;
+            }
+            catch {
+                // unknown: treated as "none held", so an unreadable store does not turn a clean sign-out into a failure on its own
+            }
+            try {
+                const outcome = await (0, idp_logout_1.revokeSessionAtIdp)(req);
+                // 'nothing-to-revoke' while a refresh token IS held means the helper could not resolve this session from the request (this
+                // handler also finds the session by decoding the cookie when Better Auth cannot): the grant is NOT ended, so say so.
+                if (outcome === 'nothing-to-revoke' && heldRefreshToken) {
+                    idpRevokeFailed = true;
+                    console.error('[SIGNOUT] IdP revoke could not resolve the session - the IdP refresh token is STILL LIVE');
+                }
+            }
+            catch (revokeError) {
+                idpRevokeFailed = true;
+                console.error(revokeError?.grantLive === true
+                    ? '[SIGNOUT] IdP revoke failed - the IdP refresh token is STILL LIVE:'
+                    : '[SIGNOUT] IdP revoke could not be confirmed (the grant may already be dead):', (0, log_safe_1.errForLog)(revokeError));
+            }
+            // Delete the session from EVERY store (181922): canonical + BA secondary.
+            // Canonical-only deletion let the ba: record resurrect the session.
             try {
                 await (0, session_store_1.deleteSessionEverywhere)(redisSessionToken);
                 console.info('[SIGNOUT] Redis session cleanup successful', {
@@ -140,21 +173,25 @@ function createSignoutHandler() {
                 });
             }
             catch (sessionError) {
-                // Log error but don't fail the signout process
-                console.error('[SIGNOUT] Redis session cleanup failed', { error: sessionError });
+                localDeleteFailed = true;
+                console.error('[SIGNOUT] Redis session cleanup failed - the server session is STILL LIVE:', (0, log_safe_1.errForLog)(sessionError));
             }
         }
         else {
             console.warn('[SIGNOUT] No Redis session token (UUID) extracted from cookie; skipping Redis deletion');
         }
-        // Build response
+        // Build response. A sign-out that did not end the session must not say it did (same typed answer as routes/auth/logout).
         const responseData = {
             success: true,
             message: sessionToken ? 'Session deleted successfully' : 'No active session found',
             sessionDeleted: !!sessionToken,
             chunkCookiesDeleted: chunkCookies.length
         };
-        const response = server_1.NextResponse.json(responseData);
+        const response = (localDeleteFailed || idpRevokeFailed)
+            ? server_1.NextResponse.json(localDeleteFailed
+                ? { success: false, code: logout_1.SESSION_NOT_ENDED_CODE, cause: 'local_delete_failed', message: logout_1.SESSION_NOT_ENDED_LOCAL_MESSAGE }
+                : { success: false, code: logout_1.SESSION_NOT_ENDED_CODE, cause: 'idp_unconfirmed', message: logout_1.SESSION_NOT_ENDED_IDP_MESSAGE }, { status: 500 })
+            : server_1.NextResponse.json(responseData);
         // Always clear cookies, regardless of success/failure (using app-slug prefixed names)
         try {
             response.cookies.delete(sessionCookieName);

package/dist/api-handlers/mfa/backup-code-verify.js

@@ -62,6 +62,7 @@ const test_aware_get_token_1 = require("../../lib/test-aware-get-token");
 const session_store_1 = require("../../lib/session-store");
 const jwt_decode_1 = require("../../lib/jwt-decode");
 const two_factor_verify_failure_1 = require("../../lib/two-factor-verify-failure");
+const log_safe_1 = require("../../lib/log-safe");
 async function POST(req) {
     try {
         const body = await req.json();
@@ -141,7 +142,7 @@ async function POST(req) {
         }, { status: 200 });
     }
     catch (error) {
-        console.error('[VERIFY_BACKUP_CODE] Error:', error);
+        console.error('[VERIFY_BACKUP_CODE] Error:', (0, log_safe_1.errForLog)(error));
         return server_1.NextResponse.json({
             success: false,
             error: 'Failed to verify backup code',

package/dist/api-handlers/mfa/totp-verify.js

@@ -37,6 +37,7 @@ const test_aware_get_token_1 = require("../../lib/test-aware-get-token");
 const session_store_1 = require("../../lib/session-store");
 const jwt_decode_1 = require("../../lib/jwt-decode");
 const two_factor_verify_failure_1 = require("../../lib/two-factor-verify-failure");
+const log_safe_1 = require("../../lib/log-safe");
 async function POST(req) {
     try {
         const body = await req.json();
@@ -141,7 +142,7 @@ async function POST(req) {
         }, { status: 200 });
     }
     catch (error) {
-        console.error('[VERIFY_TOTP] Error:', error);
+        console.error('[VERIFY_TOTP] Error:', (0, log_safe_1.errForLog)(error));
         return server_1.NextResponse.json({
             success: false,
             error: 'Failed to verify code',

package/dist/api-handlers/session/refresh-viability.js

@@ -7,6 +7,7 @@ const refresh_token_validator_1 = require("../../lib/refresh-token-validator");
 const test_aware_get_token_1 = require("../../lib/test-aware-get-token");
 const logger_1 = require("../../config/logger");
 const token_log_id_1 = require("../../lib/token-log-id");
+const log_safe_1 = require("../../lib/log-safe");
 const auth_1 = require("../../server/auth");
 async function GET(req) {
     try {
@@ -53,8 +54,8 @@ async function GET(req) {
     }
     catch (error) {
         const correlationId = globalThis.crypto.randomUUID();
-        logger_1.logger.error('[REFRESH-VIABILITY] Error checking refresh viability', { correlationId, error: error instanceof Error ? error.message : String(error) });
-        // PAY-1438: the exception text stays in the log above; the caller gets the id.
+        logger_1.logger.error('[REFRESH-VIABILITY] Error checking refresh viability', { correlationId, error: (0, log_safe_1.errForLog)(error) });
+        // PAY-1438: the caller gets the id; the log line names the error only (errForLog), never its message (PII-in-logs group 1, BAPert 76553).
         return server_1.NextResponse.json({ canRefresh: false, reason: 'check_error', error: 'Failed to check refresh viability', code: 'INTERNAL_ERROR', correlationId }, { status: 500 });
     }
 }

package/dist/api-handlers/session/viability.js

@@ -14,6 +14,7 @@ const startup_init_1 = require("../../lib/startup-init");
 const idp_client_config_1 = require("../../lib/idp-client-config");
 const token_log_id_1 = require("../../lib/token-log-id");
 const sessions_1 = require("../../vibe/sessions");
+const log_safe_1 = require("../../lib/log-safe");
 async function GET(req) {
     try {
         // Ensure initialization is complete (auth signing secret resolved from IDP)
@@ -213,7 +214,7 @@ async function GET(req) {
         return server_1.NextResponse.json({ authenticated: false });
     }
     catch (error) {
-        console.error('[API Viability] Error checking session viability:', error);
+        console.error('[API Viability] Error checking session viability:', (0, log_safe_1.errForLog)(error));
         return server_1.NextResponse.json({ authenticated: false }, { status: 500 });
     }
 }

package/dist/auth/better-auth.js

@@ -76,6 +76,7 @@ const redis_1 = require("../lib/redis");
 const single_flight_1 = require("../lib/single-flight");
 const session_store_1 = require("../lib/session-store");
 const token_log_id_1 = require("../lib/token-log-id");
+const log_safe_1 = require("../lib/log-safe");
 /**
  * 185121: short sha256 fingerprint for secrets/tokens in log lines — enough
  * to tell "same" from "divergent", never enough to reconstruct. 12 hex chars
@@ -740,7 +741,7 @@ function createBetterAuthInstance(idpConfig, opts = {}) {
                     await deleteSession(key);
                 }
                 catch (err) {
-                    console.warn('[BETTER_AUTH] secondary delete: canonical store cleanup failed:', err);
+                    console.warn('[BETTER_AUTH] secondary delete: canonical store cleanup failed:', (0, log_safe_1.errForLog)(err));
                 }
             },
         },
@@ -1188,7 +1189,7 @@ async function exchangeOAuthForIdpTokens(sessionToken, provider = 'google') {
         return stored;
     }
     catch (err) {
-        console.error('[BETTER_AUTH] IDP token exchange failed:', err instanceof Error ? err.message : String(err));
+        console.error('[BETTER_AUTH] IDP token exchange failed:', (0, log_safe_1.errForLog)(err));
         return false;
     }
 }
@@ -1270,7 +1271,7 @@ async function storeIdpTokensInSession(sessionToken, idpTokenData, authProvider)
         return true;
     }
     catch (err) {
-        console.error('[BETTER_AUTH] storeIdpTokensInSession failed:', err instanceof Error ? err.message : String(err));
+        console.error('[BETTER_AUTH] storeIdpTokensInSession failed:', (0, log_safe_1.errForLog)(err));
         return false;
     }
 }
@@ -1359,14 +1360,14 @@ async function abortOAuthSignIn(callbackResponse, sessionToken, cookieHeader, lo
                 headers.append('set-cookie', sc);
         }
         catch (err) {
-            console.warn('[BETTER_AUTH] abort: Better Auth signOut failed, deleting the record directly:', err instanceof Error ? err.message : String(err));
+            console.warn('[BETTER_AUTH] abort: Better Auth signOut failed, deleting the record directly:', (0, log_safe_1.errForLog)(err));
         }
         try {
             const config = await (0, idp_client_config_1.getIDPClientConfig)();
             await (0, redis_1.getRedis)().del(`ba:${config.clientSlug || (0, app_slug_1.getAppSlug)()}:${sessionToken}`);
         }
         catch (err) {
-            console.error('[BETTER_AUTH] abort: could not delete the Better Auth session record', (0, token_log_id_1.tokenLogId)(sessionToken), err instanceof Error ? err.message : String(err));
+            console.error('[BETTER_AUTH] abort: could not delete the Better Auth session record', (0, token_log_id_1.tokenLogId)(sessionToken), (0, log_safe_1.errForLog)(err));
         }
     }
     for (const sc of expireSetCookies(callbackResponse.headers.getSetCookie?.() ?? []))
@@ -1484,7 +1485,7 @@ function createAuthGetHandler(loginPath = '/account-auth/login') {
                     }
                 }
                 catch (err) {
-                    console.error('[BETTER_AUTH] IDP token exchange failed:', err.message);
+                    console.error('[BETTER_AUTH] IDP token exchange failed:', (0, log_safe_1.errForLog)(err));
                 }
                 if (exchange !== true) {
                     // A specific IdP error code goes on the URL; otherwise the generic OAUTH_SIGN_IN_FAILED.

package/dist/auth/idp-oauth.js

@@ -27,6 +27,7 @@ exports.createIdpOAuthHooks = createIdpOAuthHooks;
  * case-insensitively, at the authorize step). Both come from ONE value: the `redirectURI` of the provider config.
  */
 const jose_1 = require("jose");
+const log_safe_1 = require("../lib/log-safe");
 const DISCOVERY_TTL_MS = 10 * 60 * 1000;
 const HTTP_TIMEOUT_MS = 10_000;
 /** The URI sent at authorize AND token time. Explicit env wins; else the registered {app}/api/auth/callback form. */
@@ -252,7 +253,8 @@ function createIdpOAuthHooks(opts) {
                 console.warn('[BETTER_AUTH] payez-idp token response address is masked or unusable; ignored');
             const email = resolveEmail(payload, responseEmailUsable ? responseEmailRaw : undefined);
             if (!email) {
-                throw new Error(responseMasked ? 'response address is masked' : 'no usable email (needs data.user.email or an email claim, address-shaped, equal when both are present)');
+                // A closed `code` rides on the error so the refusal log tells an operator WHY (errForLog prints a closed UPPER_SNAKE code) with no value (BAPert 76998 E11).
+                throw Object.assign(new Error(responseMasked ? 'response address is masked' : 'no usable email (needs data.user.email or an email claim, address-shaped, equal when both are present)'), { code: responseMasked ? 'RESPONSE_ADDRESS_MASKED' : 'NO_USABLE_EMAIL' });
             }
             const name = (typeof payload.name === 'string' && payload.name.trim()) ||
                 (typeof payload.full_name === 'string' && payload.full_name.trim()) ||
@@ -272,7 +274,7 @@ function createIdpOAuthHooks(opts) {
         }
         catch (err) {
             // Reason only, never the token.
-            console.warn('[BETTER_AUTH] payez-idp access token refused:', err instanceof Error ? err.message : String(err));
+            console.warn('[BETTER_AUTH] payez-idp access token refused:', (0, log_safe_1.errForLog)(err));
             return null;
         }
     }

package/dist/auth/utils/idp-client.js

@@ -19,6 +19,7 @@ exports.idpLogin = idpLogin;
 exports.idpRefreshToken = idpRefreshToken;
 exports.idpVerify2FA = idpVerify2FA;
 exports.idpSend2FACode = idpSend2FACode;
+const log_safe_1 = require("../../lib/log-safe");
 // ============================================================================
 // CONFIGURATION
 // ============================================================================
@@ -95,7 +96,7 @@ async function idpLogin(credentials, clientHeaders) {
         };
     }
     catch (error) {
-        console.error('[IDP_CLIENT] Login request failed:', error);
+        console.error('[IDP_CLIENT] Login request failed:', (0, log_safe_1.errForLog)(error));
         return {
             success: false,
             error: {
@@ -211,7 +212,7 @@ async function idpRefreshToken(refreshToken, mfaContext) {
         };
     }
     catch (error) {
-        console.error('[IDP_CLIENT] Token refresh request failed:', error);
+        console.error('[IDP_CLIENT] Token refresh request failed:', (0, log_safe_1.errForLog)(error));
         return {
             success: false,
             error: {
@@ -261,7 +262,7 @@ async function idpVerify2FA(accessToken, code, method) {
         return { success: true };
     }
     catch (error) {
-        console.error('[IDP_CLIENT] 2FA verification failed:', error);
+        console.error('[IDP_CLIENT] 2FA verification failed:', (0, log_safe_1.errForLog)(error));
         return {
             success: false,
             error: {
@@ -303,7 +304,7 @@ async function idpSend2FACode(accessToken, method) {
         return { success: true };
     }
     catch (error) {
-        console.error('[IDP_CLIENT] Send 2FA code failed:', error);
+        console.error('[IDP_CLIENT] Send 2FA code failed:', (0, log_safe_1.errForLog)(error));
         return {
             success: false,
             error: {

package/dist/auth/utils/token-utils.js

@@ -21,6 +21,7 @@ exports.expClaimToMs = expClaimToMs;
 exports.validateTokenExpiry = validateTokenExpiry;
 const jwt_decode_1 = require("../../lib/jwt-decode");
 const refresh_window_1 = require("../../lib/refresh-window");
+const log_safe_1 = require("../../lib/log-safe");
 // Re-export header utilities for consumers
 var jwt_decode_2 = require("../../lib/jwt-decode");
 Object.defineProperty(exports, "decodeJwtHeader", { enumerable: true, get: function () { return jwt_decode_2.decodeJwtHeader; } });
@@ -39,7 +40,7 @@ function decodeIdpAccessToken(token) {
         return (0, jwt_decode_1.jwtDecode)(token);
     }
     catch (error) {
-        console.error('[TOKEN_UTILS] Failed to decode access token:', error);
+        console.error('[TOKEN_UTILS] Failed to decode access token:', (0, log_safe_1.errForLog)(error));
         return null;
     }
 }
@@ -64,7 +65,7 @@ function decodeIdpAccessTokenFull(token) {
         };
     }
     catch (error) {
-        console.error('[TOKEN_UTILS] Failed to decode access token (full):', error);
+        console.error('[TOKEN_UTILS] Failed to decode access token (full):', (0, log_safe_1.errForLog)(error));
         return null;
     }
 }
@@ -213,7 +214,7 @@ function validateTokenExpiry(accessToken, cachedExpiresAt) {
         };
     }
     catch (error) {
-        console.error('[TOKEN_UTILS] Failed to validate token expiry:', error);
+        console.error('[TOKEN_UTILS] Failed to validate token expiry:', (0, log_safe_1.errForLog)(error));
         return { valid: false, actualExpiresAt: null, mismatch: false };
     }
 }