@payez/next-mvp 4.11.0 → 4.12.1

package/src/api-handlers/auth/signout.ts

@@ -11,7 +11,15 @@
 
 import { NextRequest, NextResponse } from 'next/server';
 import { cookies } from 'next/headers';
-import { deleteSessionEverywhere } from '../../lib/session-store';
+import { deleteSessionEverywhere, getSession as getStoredSession, getBetterAuthSession as getStoredBetterAuthSession } from '../../lib/session-store';
+import { revokeSessionAtIdp } from '../../lib/idp-logout';
+import { errForLog } from '../../lib/log-safe';
+import {
+  SESSION_NOT_ENDED_CODE,
+  SESSION_NOT_ENDED_IDP_MESSAGE,
+  SESSION_NOT_ENDED_LOCAL_MESSAGE,
+  type SessionNotEndedCause,
+} from '../../routes/auth/logout';
 import { getSession } from '../../server/auth';
 import {
   getSessionCookieName,
@@ -147,23 +155,55 @@ export function createSignoutHandler() {
       }
     }
 
-    // Delete the session from EVERY store (181922): canonical + BA secondary.
-    // Canonical-only deletion let the ba: record resurrect the session.
+    // GOV-023 (BAPert 76687): ending the session ends the IdP GRANT first, the same IdP-first path as routes/auth/logout. Before this, this
+    // handler only deleted the local record, so a consumer who mounted it left the IdP refresh token live until it expired.
+    // A failed or unresolved revoke is the same typed failure as a failed local delete (SESSION_NOT_ENDED + cause); the local delete still
+    // runs and the cookies are cleared either way.
+    let idpRevokeFailed = false;
+    let localDeleteFailed = false;
     if (redisSessionToken) {
+      // Does the stored session hold an IdP refresh token? (revokeSessionAtIdp reads the canonical row, then the Better Auth record.)
+      let heldRefreshToken = false;
+      try {
+        const stored = (await getStoredSession(redisSessionToken)) ?? (await getStoredBetterAuthSession(redisSessionToken));
+        heldRefreshToken = !!stored?.idpRefreshToken;
+      } catch {
+        // unknown: treated as "none held", so an unreadable store does not turn a clean sign-out into a failure on its own
+      }
+      try {
+        const outcome = await revokeSessionAtIdp(req);
+        // 'nothing-to-revoke' while a refresh token IS held means the helper could not resolve this session from the request (this
+        // handler also finds the session by decoding the cookie when Better Auth cannot): the grant is NOT ended, so say so.
+        if (outcome === 'nothing-to-revoke' && heldRefreshToken) {
+          idpRevokeFailed = true;
+          console.error('[SIGNOUT] IdP revoke could not resolve the session - the IdP refresh token is STILL LIVE');
+        }
+      } catch (revokeError) {
+        idpRevokeFailed = true;
+        console.error(
+          (revokeError as { grantLive?: boolean } | null)?.grantLive === true
+            ? '[SIGNOUT] IdP revoke failed - the IdP refresh token is STILL LIVE:'
+            : '[SIGNOUT] IdP revoke could not be confirmed (the grant may already be dead):',
+          errForLog(revokeError),
+        );
+      }
+
+      // Delete the session from EVERY store (181922): canonical + BA secondary.
+      // Canonical-only deletion let the ba: record resurrect the session.
       try {
         await deleteSessionEverywhere(redisSessionToken);
         console.info('[SIGNOUT] Redis session cleanup successful', {
           sessionToken: tokenLogId(redisSessionToken)
         });
       } catch (sessionError) {
-        // Log error but don't fail the signout process
-        console.error('[SIGNOUT] Redis session cleanup failed', { error: sessionError });
+        localDeleteFailed = true;
+        console.error('[SIGNOUT] Redis session cleanup failed - the server session is STILL LIVE:', errForLog(sessionError));
       }
     } else {
       console.warn('[SIGNOUT] No Redis session token (UUID) extracted from cookie; skipping Redis deletion');
     }
 
-    // Build response
+    // Build response. A sign-out that did not end the session must not say it did (same typed answer as routes/auth/logout).
     const responseData: SignoutResponse = {
       success: true,
       message: sessionToken ? 'Session deleted successfully' : 'No active session found',
@@ -171,7 +211,14 @@ export function createSignoutHandler() {
       chunkCookiesDeleted: chunkCookies.length
     };
 
-    const response = NextResponse.json(responseData);
+    const response = (localDeleteFailed || idpRevokeFailed)
+      ? NextResponse.json(
+          localDeleteFailed
+            ? { success: false, code: SESSION_NOT_ENDED_CODE, cause: 'local_delete_failed' as SessionNotEndedCause, message: SESSION_NOT_ENDED_LOCAL_MESSAGE }
+            : { success: false, code: SESSION_NOT_ENDED_CODE, cause: 'idp_unconfirmed' as SessionNotEndedCause, message: SESSION_NOT_ENDED_IDP_MESSAGE },
+          { status: 500 },
+        )
+      : NextResponse.json(responseData);
 
     // Always clear cookies, regardless of success/failure (using app-slug prefixed names)
     try {

package/src/api-handlers/mfa/backup-code-verify.ts

@@ -60,6 +60,7 @@ import { getTokenTestAware } from '../../lib/test-aware-get-token';
 import { transitionTo2FASession } from '../../lib/session-store';
 import { jwtDecode } from '../../lib/jwt-decode';
 import { twoFactorVerifyFailure } from '../../lib/two-factor-verify-failure';
+import { errForLog } from '../../lib/log-safe';
 
 export async function POST(req: NextRequest) {
   try {
@@ -157,7 +158,7 @@ export async function POST(req: NextRequest) {
       { status: 200 }
     );
   } catch (error) {
-    console.error('[VERIFY_BACKUP_CODE] Error:', error);
+    console.error('[VERIFY_BACKUP_CODE] Error:', errForLog(error));
     return NextResponse.json(
       {
         success: false,

package/src/api-handlers/mfa/totp-verify.ts

@@ -35,6 +35,7 @@ import { getTokenTestAware } from '../../lib/test-aware-get-token';
 import { transitionTo2FASession } from '../../lib/session-store';
 import { jwtDecode } from '../../lib/jwt-decode';
 import { twoFactorVerifyFailure } from '../../lib/two-factor-verify-failure';
+import { errForLog } from '../../lib/log-safe';
 
 export async function POST(req: NextRequest) {
   try {
@@ -159,7 +160,7 @@ export async function POST(req: NextRequest) {
       { status: 200 }
     );
   } catch (error) {
-    console.error('[VERIFY_TOTP] Error:', error);
+    console.error('[VERIFY_TOTP] Error:', errForLog(error));
     return NextResponse.json(
       {
         success: false,

package/src/api-handlers/session/refresh-viability.ts

@@ -4,6 +4,7 @@ import { checkRefreshViability } from '../../lib/refresh-token-validator';
 import { getTokenTestAware } from '../../lib/test-aware-get-token';
 import { logger } from '../../config/logger';
 import { tokenLogId } from '../../lib/token-log-id';
+import { errForLog } from '../../lib/log-safe';
 import { resolveSessionState } from '../../server/auth';
 
 export async function GET(req: NextRequest) {
@@ -49,8 +50,8 @@ export async function GET(req: NextRequest) {
     return NextResponse.json({ canRefresh: viabilityCheck.canRefresh, reason: viabilityCheck.reason, timeRemaining: viabilityCheck.timeRemaining, expiresAt: viabilityCheck.expiresAt, accessTokenExpired: viabilityCheck.accessTokenExpired, accessTokenTimeRemaining: viabilityCheck.accessTokenTimeRemaining, sessionTokenId: tokenLogId(finalSessionToken), twoFactorComplete: sessionData.mfaVerified ?? false, userId: sessionData.userId, refreshInProgress: false });
   } catch (error) {
     const correlationId = globalThis.crypto.randomUUID();
-    logger.error('[REFRESH-VIABILITY] Error checking refresh viability', { correlationId, error: error instanceof Error ? error.message : String(error) });
-    // PAY-1438: the exception text stays in the log above; the caller gets the id.
+    logger.error('[REFRESH-VIABILITY] Error checking refresh viability', { correlationId, error: errForLog(error) });
+    // PAY-1438: the caller gets the id; the log line names the error only (errForLog), never its message (PII-in-logs group 1, BAPert 76553).
     return NextResponse.json({ canRefresh: false, reason: 'check_error', error: 'Failed to check refresh viability', code: 'INTERNAL_ERROR', correlationId }, { status: 500 });
   }
 }

package/src/api-handlers/session/viability.ts

@@ -12,6 +12,7 @@ import { isInitializationFailed, ensureInitialized } from '../../lib/startup-ini
 import { getIDPClientConfig } from '../../lib/idp-client-config';
 import { tokenLogId } from '../../lib/token-log-id';
 import { getRevocationStatus, warnNonNumericUserId, resolveNumericIdpUserId, type RevocationStatus } from '../../vibe/sessions';
+import { errForLog } from '../../lib/log-safe';
 
 export async function GET(req: NextRequest) {
   try {
@@ -233,7 +234,7 @@ export async function GET(req: NextRequest) {
     return NextResponse.json({ authenticated: false });
 
   } catch (error) {
-    console.error('[API Viability] Error checking session viability:', error);
+    console.error('[API Viability] Error checking session viability:', errForLog(error));
     return NextResponse.json({ authenticated: false }, { status: 500 });
   }
 }

package/src/auth/better-auth.ts

@@ -33,6 +33,7 @@ import { getRedis } from '../lib/redis';
 import { createSingleFlight, type SingleFlight } from '../lib/single-flight';
 import { SESSION_TTL } from '../lib/session-store';
 import { tokenLogId } from '../lib/token-log-id';
+import { errForLog } from '../lib/log-safe';
 
 /**
  * 185121: short sha256 fingerprint for secrets/tokens in log lines — enough
@@ -855,7 +856,7 @@ export function createBetterAuthInstance(
           const { deleteSession } = await import('../lib/session-store');
           await deleteSession(key);
         } catch (err) {
-          console.warn('[BETTER_AUTH] secondary delete: canonical store cleanup failed:', err);
+          console.warn('[BETTER_AUTH] secondary delete: canonical store cleanup failed:', errForLog(err));
         }
       },
     },
@@ -1356,7 +1357,7 @@ export async function exchangeOAuthForIdpTokens(
     // true = success (tokens stored). false = a non-IdP failure with no specific code (generic abort).
     return stored;
   } catch (err) {
-    console.error('[BETTER_AUTH] IDP token exchange failed:', err instanceof Error ? err.message : String(err));
+    console.error('[BETTER_AUTH] IDP token exchange failed:', errForLog(err));
     return false;
   }
 }
@@ -1446,7 +1447,7 @@ export async function storeIdpTokensInSession(
 
     return true;
   } catch (err) {
-    console.error('[BETTER_AUTH] storeIdpTokensInSession failed:', err instanceof Error ? err.message : String(err));
+    console.error('[BETTER_AUTH] storeIdpTokensInSession failed:', errForLog(err));
     return false;
   }
 }
@@ -1547,13 +1548,13 @@ async function abortOAuthSignIn(
       const out = await auth?.api?.signOut?.({ headers: new Headers({ cookie: cookieHeader }), asResponse: true });
       for (const sc of (out as Response | undefined)?.headers?.getSetCookie?.() ?? []) headers.append('set-cookie', sc);
     } catch (err) {
-      console.warn('[BETTER_AUTH] abort: Better Auth signOut failed, deleting the record directly:', err instanceof Error ? err.message : String(err));
+      console.warn('[BETTER_AUTH] abort: Better Auth signOut failed, deleting the record directly:', errForLog(err));
     }
     try {
       const config = await getIDPClientConfig();
       await getRedis().del(`ba:${config.clientSlug || getAppSlug()}:${sessionToken}`);
     } catch (err) {
-      console.error('[BETTER_AUTH] abort: could not delete the Better Auth session record', tokenLogId(sessionToken), err instanceof Error ? err.message : String(err));
+      console.error('[BETTER_AUTH] abort: could not delete the Better Auth session record', tokenLogId(sessionToken), errForLog(err));
     }
   }
   for (const sc of expireSetCookies(callbackResponse.headers.getSetCookie?.() ?? [])) headers.append('set-cookie', sc);
@@ -1673,7 +1674,7 @@ export function createAuthGetHandler(loginPath: string = '/account-auth/login')
           }
         }
       } catch (err: any) {
-        console.error('[BETTER_AUTH] IDP token exchange failed:', err.message);
+        console.error('[BETTER_AUTH] IDP token exchange failed:', errForLog(err));
       }
       if (exchange !== true) {
         // A specific IdP error code goes on the URL; otherwise the generic OAUTH_SIGN_IN_FAILED.

package/src/auth/idp-oauth.ts

@@ -19,6 +19,7 @@
  * case-insensitively, at the authorize step). Both come from ONE value: the `redirectURI` of the provider config.
  */
 import { createRemoteJWKSet, decodeProtectedHeader, jwtVerify, type JWTVerifyGetKey } from 'jose';
+import { errForLog } from '../lib/log-safe';
 
 export interface IdpTokenGrant {
   accessToken: string;
@@ -281,7 +282,11 @@ export function createIdpOAuthHooks(opts: IdpOAuthHookOptions) {
       if (responseMasked) console.warn('[BETTER_AUTH] payez-idp token response address is masked or unusable; ignored');
       const email = resolveEmail(payload as Record<string, unknown>, responseEmailUsable ? responseEmailRaw : undefined);
       if (!email) {
-        throw new Error(responseMasked ? 'response address is masked' : 'no usable email (needs data.user.email or an email claim, address-shaped, equal when both are present)');
+        // A closed `code` rides on the error so the refusal log tells an operator WHY (errForLog prints a closed UPPER_SNAKE code) with no value (BAPert 76998 E11).
+        throw Object.assign(
+          new Error(responseMasked ? 'response address is masked' : 'no usable email (needs data.user.email or an email claim, address-shaped, equal when both are present)'),
+          { code: responseMasked ? 'RESPONSE_ADDRESS_MASKED' : 'NO_USABLE_EMAIL' },
+        );
       }
       const name =
         (typeof payload.name === 'string' && payload.name.trim()) ||
@@ -301,7 +306,7 @@ export function createIdpOAuthHooks(opts: IdpOAuthHookOptions) {
       return { id: claims.sub, email: claims.email, name: claims.name, emailVerified: claims.emailVerified };
     } catch (err) {
       // Reason only, never the token.
-      console.warn('[BETTER_AUTH] payez-idp access token refused:', err instanceof Error ? err.message : String(err));
+      console.warn('[BETTER_AUTH] payez-idp access token refused:', errForLog(err));
       return null;
     }
   }

package/src/auth/utils/idp-client.ts

@@ -18,6 +18,7 @@ import type {
   IdpRefreshResponse,
   LoginCredentials,
 } from '../types/auth-types';
+import { errForLog } from '../../lib/log-safe';
 
 // ============================================================================
 // CONFIGURATION
@@ -109,7 +110,7 @@ export async function idpLogin(
       result: responseData.result,
     };
   } catch (error) {
-    console.error('[IDP_CLIENT] Login request failed:', error);
+    console.error('[IDP_CLIENT] Login request failed:', errForLog(error));
     return {
       success: false,
       error: {
@@ -246,7 +247,7 @@ export async function idpRefreshToken(
       },
     };
   } catch (error) {
-    console.error('[IDP_CLIENT] Token refresh request failed:', error);
+    console.error('[IDP_CLIENT] Token refresh request failed:', errForLog(error));
     return {
       success: false,
       error: {
@@ -304,7 +305,7 @@ export async function idpVerify2FA(
 
     return { success: true };
   } catch (error) {
-    console.error('[IDP_CLIENT] 2FA verification failed:', error);
+    console.error('[IDP_CLIENT] 2FA verification failed:', errForLog(error));
     return {
       success: false,
       error: {
@@ -352,7 +353,7 @@ export async function idpSend2FACode(
 
     return { success: true };
   } catch (error) {
-    console.error('[IDP_CLIENT] Send 2FA code failed:', error);
+    console.error('[IDP_CLIENT] Send 2FA code failed:', errForLog(error));
     return {
       success: false,
       error: {

package/src/auth/utils/token-utils.ts

@@ -10,6 +10,7 @@
 import { jwtDecode, decodeJwtHeader, extractKidFromToken, JwtHeader } from '../../lib/jwt-decode';
 import type { DecodedIdpAccessToken } from '../types/auth-types';
 import { REFRESH_WINDOW_MS } from '../../lib/refresh-window';
+import { errForLog } from '../../lib/log-safe';
 
 // Re-export header utilities for consumers
 export { decodeJwtHeader, extractKidFromToken, type JwtHeader } from '../../lib/jwt-decode';
@@ -28,7 +29,7 @@ export function decodeIdpAccessToken(token: string): DecodedIdpAccessToken | nul
   try {
     return jwtDecode<DecodedIdpAccessToken>(token);
   } catch (error) {
-    console.error('[TOKEN_UTILS] Failed to decode access token:', error);
+    console.error('[TOKEN_UTILS] Failed to decode access token:', errForLog(error));
     return null;
   }
 }
@@ -59,7 +60,7 @@ export function decodeIdpAccessTokenFull(token: string): {
       bearerKeyId: header.kid,
     };
   } catch (error) {
-    console.error('[TOKEN_UTILS] Failed to decode access token (full):', error);
+    console.error('[TOKEN_UTILS] Failed to decode access token (full):', errForLog(error));
     return null;
   }
 }
@@ -238,7 +239,7 @@ export function validateTokenExpiry(
       mismatch,
     };
   } catch (error) {
-    console.error('[TOKEN_UTILS] Failed to validate token expiry:', error);
+    console.error('[TOKEN_UTILS] Failed to validate token expiry:', errForLog(error));
     return { valid: false, actualExpiresAt: null, mismatch: false };
   }
 }

package/src/config/logger.ts

@@ -1,6 +1,7 @@
 import { getLoggingConfigSync, startConfigWatching, addConfigWatcher } from './logging-config';
 import { LoggingConfig } from '../types/logging';
 import { createVibeLogTransport } from './vibe-log-transport';
+import { errForLog } from '../lib/log-safe';
 
 let loggingConfig: LoggingConfig = getLoggingConfigSync();
 startConfigWatching();
@@ -41,7 +42,7 @@ const createLogger = (): any => {
       console.log('[LOGGER] Vibe Redis transport DISABLED - no REDIS_URL configured');
     }
     return winston.createLogger({ level: loggingConfig.logLevel, levels: loggingConfig.levels, format: winston.format.combine(winston.format.timestamp(), winston.format.errors({ stack: true }), winston.format.json()), transports, exitOnError: false });
-  } catch (error) { console.warn('Failed to initialize Winston logger, falling back to EdgeLogger:', error); return new EdgeLogger(); }
+  } catch (error) { console.warn('Failed to initialize Winston logger, falling back to EdgeLogger:', errForLog(error)); return new EdgeLogger(); }
 };
 
 let logger: any;

package/src/config/logging-config.ts

@@ -1,6 +1,7 @@
 import { promises as fs } from 'fs';
 import { watch, existsSync } from 'fs';
 import { LoggingConfig, LogLevel } from '../types/logging';
+import { errForLog } from '../lib/log-safe';
 
 const isEdgeRuntime = typeof (globalThis as any).EdgeRuntime !== 'undefined' || process.env.NEXT_RUNTIME === 'edge';
 
@@ -35,7 +36,7 @@ class LoggingConfigManager {
       const config = this.validateAndMergeConfig(rawConfig);
       this.config = config; this.notifyWatchers(config); return config;
     } catch (error) {
-      console.warn(`Failed to load logging config from ${this.configPath}:`, error);
+      console.warn(`Failed to load logging config from ${this.configPath}:`, errForLog(error));
       return this.getDefaultConfig();
     }
   }
@@ -43,11 +44,11 @@ class LoggingConfigManager {
   async getConfig(): Promise<LoggingConfig> { if (!this.config) { return await this.loadConfig(); } return this.config; }
   getConfigSync(): LoggingConfig { return this.config || this.getDefaultConfig(); }
 
-  startWatching(): void { if (this.isEdgeRuntime || this.isBrowser) { return; } if (this.fileWatcher) { return; } try { if (!existsSync(this.configPath)) { console.warn(`Logging config file not found at ${this.configPath} — watch disabled`); return; } this.fileWatcher = watch(this.configPath, { persistent: false }, (eventType) => { if (eventType === 'change') { this.loadConfig().catch(console.error); } }); } catch (error) { console.warn('Failed to start watching logging config file:', error); } }
+  startWatching(): void { if (this.isEdgeRuntime || this.isBrowser) { return; } if (this.fileWatcher) { return; } try { if (!existsSync(this.configPath)) { console.warn(`Logging config file not found at ${this.configPath} — watch disabled`); return; } this.fileWatcher = watch(this.configPath, { persistent: false }, (eventType) => { if (eventType === 'change') { this.loadConfig().catch(console.error); } }); } catch (error) { console.warn('Failed to start watching logging config file:', errForLog(error)); } }
   stopWatching(): void { if (this.isEdgeRuntime || this.isBrowser) { return; } if (this.fileWatcher) { this.fileWatcher.close(); this.fileWatcher = null; } }
   addWatcher(callback: (config: LoggingConfig) => void): void { this.watchers.add(callback); }
   removeWatcher(callback: (config: LoggingConfig) => void): void { this.watchers.delete(callback); }
-  private notifyWatchers(config: LoggingConfig): void { this.watchers.forEach(cb => { try { cb(config); } catch (error) { console.error('Error in logging config watcher:', error); } }); }
+  private notifyWatchers(config: LoggingConfig): void { this.watchers.forEach(cb => { try { cb(config); } catch (error) { console.error('Error in logging config watcher:', errForLog(error)); } }); }
 
   private validateAndMergeConfig(rawConfig: any): LoggingConfig {
     const defaults = this.getDefaultConfig();

package/src/config/vibe-log-transport.ts

@@ -12,6 +12,7 @@
  */
 
 import { getRedis } from '../lib/redis';
+import { errForLog } from '../lib/log-safe';
 
 // Dynamic import — winston is a peerDependency and may not be installed.
 // We resolve the base class lazily so builds don't break without it.
@@ -188,7 +189,7 @@ export class VibeLogTransport extends TransportBase {
         this.batch = [...entries, ...this.batch].slice(0, 100);
       }
       // Log to console as fallback
-      console.error('[VibeLogTransport] Failed to flush logs:', err);
+      console.error('[VibeLogTransport] Failed to flush logs:', errForLog(err));
     } finally {
       this.isFlushing = false;
     }

package/src/lib/ensure-fresh-access-token.ts

@@ -35,6 +35,7 @@ import {
   isRefreshInDoubt,
   requestNeverLeft,
 } from './refresh-in-doubt';
+import { errForLog } from './log-safe';
 
 export interface EnsureFreshConfig {
   idpBaseUrl: string;
@@ -348,19 +349,20 @@ export async function ensureFreshAccessToken(
     } else if (typeof session.authenticationMethods === 'string') {
       try { authMethods = JSON.parse(session.authenticationMethods); } catch { /* fall through */ }
     }
-    const isOAuthSession = !!session.oauthProvider;
-    if (authMethods.length === 0 && isOAuthSession) {
-      authMethods = ['pwd', 'mfa'];
-    }
+    // PAY-2425 (BAPert 77400, NightHawk 77401): THE CLIENT DOES NOT INFER AUTHENTICATION STRENGTH FROM SILENCE. This block used to answer an OAuth
+    // (Google) session whose stored methods were EMPTY with amr ['pwd','mfa'], a two-factor method of 'oauth' and an acr raised from '1' to '2' ("OAuth IS
+    // a form of multi-factor auth"). That is false: OAuth is federated sign-in, one factor typed at the provider. It fired exactly when the session
+    // could tell us nothing and answered with the strongest claim available; on prod (4.10.0) a Google user on a require2FA client was then counted
+    // 2FA-complete with no code (RigPert 77398). What the session does not attest, the refresh body does not assert: empty stays empty, the level stays
+    // the session's own, and no method is named unless one is recorded. The IdP computes the real amr/acr for the minted token (and mfaVerified is
+    // re-derived from THAT token below); a session that really attests 'mfa' still sends it. History: the fix existed on nextpert/375639-amr-fabrication
+    // (e6e3b6c3, e3b3bb12) and was never merged.
     const twoFactorMethod =
       authMethods.find(m => ['sms', 'totp', 'email'].includes(m)) ||
       session.mfaMethod ||
-      (isOAuthSession ? 'oauth' : null);
+      null;
 
-    let acrValue = String(session.authenticationLevel ?? '1');
-    if (isOAuthSession && session.mfaVerified && acrValue === '1') {
-      acrValue = '2';
-    }
+    const acrValue = String(session.authenticationLevel ?? '1');
 
     // WO-2: send the POST-lock current refresh token, not the pre-lock snapshot.
     // `session` was read before we acquired the lock; a concurrent refresh that
@@ -396,7 +398,11 @@ export async function ensureFreshAccessToken(
       amr: authMethods,
       acr: acrValue,
     };
-    if (session.mfaVerified) body.two_factor_verified = true;
+    // PAY-2425 (NightHawk 77414): a STORED mfaVerified flag is only echoed when the session's own recorded methods back it. Sessions created while the
+    // bug was live carry mfaVerified:true that the bug itself wrote, with no 'mfa' (or sms/totp/email) in their methods; echoing that flag would carry the
+    // poison across the upgrade. A genuine second factor leaves 'mfa' and its method in the recorded methods, so it is still sent.
+    const methodsAttestSecondFactor = authMethods.some(m => m === 'mfa' || ['sms', 'totp', 'email'].includes(m));
+    if (session.mfaVerified && methodsAttestSecondFactor) body.two_factor_verified = true;
     if (twoFactorMethod) body.two_factor_method = twoFactorMethod;
     if (session.mfaCompletedAt) body.two_factor_completed_at = new Date(session.mfaCompletedAt).toISOString();
 
@@ -412,7 +418,7 @@ export async function ensureFreshAccessToken(
       try {
         await updateSession(sessionToken, inDoubtPatch(sentRefreshToken as string));
       } catch (markError) {
-        console.error('[ENSURE-FRESH] could not record the in-doubt marker', { error: markError instanceof Error ? markError.message : String(markError) });
+        console.error('[ENSURE-FRESH] could not record the in-doubt marker', { error: errForLog(markError) });
       }
       return {
         ok: false,

package/src/lib/geolocation.ts

@@ -1,3 +1,4 @@
+import { errForLog } from './log-safe';
 /**
  * =============================================================================
  * GEOLOCATION UTILITY
@@ -103,7 +104,7 @@ export async function getPublicIP(): Promise<string | null> {
         // Validate it looks like an IP
         if (ip && /^[\d.]+$/.test(ip) || /^[a-f0-9:]+$/i.test(ip)) {
           cachedPublicIP = { ip, timestamp: Date.now() };
-          console.log(`[geolocation] Public IP resolved: ${ip}`);
+          console.log("[geolocation] Public IP resolved");
           return ip;
         }
       }
@@ -163,7 +164,7 @@ export async function getLocationFromIP(ip: string, resolvePublicIP: boolean = t
     if (resolvePublicIP) {
       const publicIP = await getPublicIP();
       if (publicIP && !isPrivateIP(publicIP)) {
-        console.log(`[geolocation] Private IP ${ip} -> using public IP ${publicIP}`);
+        console.log("[geolocation] Private IP -> using the resolved public IP");
         // Recursively call with public IP (but don't resolve again to prevent loops)
         return getLocationFromIP(publicIP, false);
       }
@@ -201,7 +202,7 @@ export async function getLocationFromIP(ip: string, resolvePublicIP: boolean = t
     const data = await response.json();
 
     if (data.status !== 'success') {
-      console.warn(`[geolocation] Lookup failed for ${ip}: ${data.message}`);
+      console.warn("[geolocation] Lookup failed (upstream refused)");
       // Cache the failure to avoid repeated lookups
       geoCache.set(ip, { location: null, timestamp: Date.now() });
       return null;
@@ -224,7 +225,7 @@ export async function getLocationFromIP(ip: string, resolvePublicIP: boolean = t
     return location;
 
   } catch (error) {
-    console.error(`[geolocation] Error looking up ${ip}:`, error);
+    console.error("[geolocation] lookup failed:", errForLog(error)); // no IP on a routine line (BAPert 76553 Q1)
     return null;
   }
 }

package/src/lib/idp-client-config.ts

@@ -43,6 +43,7 @@
 import 'server-only';
 import { createHash, randomUUID } from 'crypto';
 import { markNeverInResponse } from './never-in-response';
+import { errForLog } from './log-safe';
 // REDIS IS IMPORTED LAZILY, AND THAT IS LOAD-BEARING.
 // A module-scope `import redis from './redis'` drags ioredis into EVERY bundle that
 // touches this file - including instrumentation.ts. Next compiles the instrumentation
@@ -360,7 +361,7 @@ async function getConfigFromRedis(): Promise<IDPClientConfig | null> {
 
         return parsed.config;
     } catch (error) {
-        console.warn('[IDP_CONFIG] Failed to read from Redis cache:', error);
+        console.warn('[IDP_CONFIG] Failed to read from Redis cache:', errForLog(error));
         return null;
     }
 }
@@ -377,7 +378,7 @@ async function setConfigInRedis(config: IDPClientConfig): Promise<void> {
         // Store with TTL slightly longer than the logical expiry to allow for clock skew
         await (await getRedis()).set(key, JSON.stringify(data), 'EX', ttlSeconds + 10);
     } catch (error) {
-        console.warn('[IDP_CONFIG] Failed to write to Redis cache:', error);
+        console.warn('[IDP_CONFIG] Failed to write to Redis cache:', errForLog(error));
     }
 }
 
@@ -633,7 +634,7 @@ export async function clearConfigRedisCache(): Promise<void> {
         await (await getRedis()).del(key);
         console.log('[IDP_CONFIG] Redis cache cleared:', key);
     } catch (error) {
-        console.warn('[IDP_CONFIG] Failed to clear Redis cache:', error);
+        console.warn('[IDP_CONFIG] Failed to clear Redis cache:', errForLog(error));
     }
 }
 

package/src/lib/idp-fetch.ts

@@ -46,6 +46,14 @@ export interface IdpFetchOptions {
    * `skipped: true` without a request; null on the retry leaves the first answer standing. Absent: `init` is used as before.
    */
   initFor?: (sessionToken: string) => Promise<RequestInit | null>;
+  /**
+   * 4.12: the refresh that follows a 401/403 is done by THIS function instead of the HTTP self-call to /api/auth/refresh. Sign-out supplies one that
+   * calls `ensureFreshAccessToken` in-process with a window that cannot be "fresh": a logout 401 with a locally-fresh token usually means Core
+   * invalidated the token (password change), and only the IdP's answer to a real refresh (401 + the discard marker = the grant is dead; success =
+   * the grant is live) can say which. No header on the public refresh route, so nothing a browser sends can force a refresh (BAPert 77022).
+   * Returns the status the refresh route would have answered. Absent: `internalRefresh` as before.
+   */
+  refreshOnAuthFailure?: (sessionToken: string) => Promise<{ ok: boolean; status: number }>;
 }
 
 function buildHeaders(req: NextRequest, bearer?: string, extra?: Record<string, string>) {
@@ -184,7 +192,9 @@ export async function idpFetchJSON<T = any>(
     attemptedRefresh = true;
     try {
       // Use centralized internal API helper for server-to-server calls
-      const rf = await internalRefresh(req.headers.get('cookie') || '', sessionToken);
+      const rf = opts.refreshOnAuthFailure
+        ? await opts.refreshOnAuthFailure(sessionToken)
+        : await internalRefresh(req.headers.get('cookie') || '', sessionToken);
       refreshStatus = rf.status;
       if (rf.ok) {
         const fresh = await getSession(sessionToken);

package/src/lib/idp-logout.ts

@@ -26,6 +26,19 @@ import { ENV_CONFIG } from '../config/env';
  */
 export type IdpLogoutOutcome = 'revoked' | 'nothing-to-revoke' | 'grant-already-dead';
 
+/**
+ * The revoke could not be confirmed. `grantLive` is true ONLY when the IdP itself showed the grant is alive: the forced refresh SUCCEEDED (it issued
+ * new tokens) and the logout still did not end it. Every other unknown (a transport error, a 5xx, a refresh that threw or answered something
+ * else) leaves it false: the grant may be live or dead, and the log must not claim either (BAPert 77013). The closed `code` is what errForLog prints.
+ */
+export class IdpLogoutUnconfirmedError extends Error {
+  readonly code = 'IDP_LOGOUT_UNCONFIRMED';
+  constructor(status: number, readonly grantLive: boolean) {
+    super(`IdP logout answered ${status}`);
+    this.name = 'IdpLogoutUnconfirmedError';
+  }
+}
+
 export async function revokeSessionAtIdp(req: NextRequest): Promise<IdpLogoutOutcome> {
   let resolvedSession: string | undefined;
   const result = await idpFetchJSON(
@@ -33,6 +46,9 @@ export async function revokeSessionAtIdp(req: NextRequest): Promise<IdpLogoutOut
     `${ENV_CONFIG.IDP_URL}/api/Account/logout`,
     {},
     {
+      // A logout 401 with a locally-fresh token must reach a REAL refresh, so the IdP's answer can prove the grant dead (BAPert 77013). Done
+      // in-process, not through the public refresh route, so no request header can force it (NightHawk 77021, BAPert 77022).
+      refreshOnAuthFailure: forceRefreshAtIdp,
       initFor: async (token) => {
         resolvedSession = token;
         let session = await getSession(token);
@@ -50,7 +66,26 @@ export async function revokeSessionAtIdp(req: NextRequest): Promise<IdpLogoutOut
   if (result.skipped) return 'nothing-to-revoke';
   if (result.ok) return 'revoked';
   if (result.attemptedRefresh && result.refreshStatus === 401 && resolvedSession && (await grantWasDiscarded(resolvedSession))) return 'grant-already-dead';
-  throw new Error(`IdP logout answered ${result.status}`);
+  const refreshSucceeded = result.attemptedRefresh && typeof result.refreshStatus === 'number' && result.refreshStatus >= 200 && result.refreshStatus < 300;
+  throw new IdpLogoutUnconfirmedError(result.status, refreshSucceeded);
+}
+
+/**
+ * Refresh the session NOW, ignoring "the stored access token looks fresh", by calling `ensureFreshAccessToken` in this process (the one
+ * implementation that talks to the IdP, holds the lock and writes the discard marker). Config is read the way `oauth/resume` reads it
+ * (IDP_URL, CLIENT_ID, the default refresh endpoint). It answers with the status the refresh route would have: 200 on success, 401 for
+ * NO_SESSION / NO_REFRESH_TOKEN, 409 for a lost lock, otherwise E's own status (a discarded IdP 401 is 401 with the marker written).
+ * Missing config or a throw is an UNKNOWN outcome: the caller treats a thrown refresh as `refreshStatus: null`.
+ */
+async function forceRefreshAtIdp(sessionToken: string): Promise<{ ok: boolean; status: number }> {
+  const idpBaseUrl = process.env.IDP_URL;
+  const clientId = process.env.CLIENT_ID;
+  if (!idpBaseUrl || !clientId) throw new Error('IDP_URL and CLIENT_ID are required to prove a grant dead');
+  const { ensureFreshAccessToken } = await import('./ensure-fresh-access-token');
+  const r = await ensureFreshAccessToken(sessionToken, { idpBaseUrl, clientId }, { requireRefreshToken: true, safetyWindowMs: Number.MAX_SAFE_INTEGER });
+  if (r.ok) return { ok: true, status: 200 };
+  const status = r.code === 'NO_SESSION' || r.code === 'NO_REFRESH_TOKEN' ? 401 : r.code === 'CONFLICT' ? 409 : r.status;
+  return { ok: false, status };
 }
 
 /**