@payez/next-mvp 4.11.0 → 4.12.1

package/src/lib/jwt-decode-client.ts

@@ -3,6 +3,8 @@
  * This is a lightweight version for browser usage
  */
 
+import { errForLog } from './log-safe';
+
 // Decode base64url
 function base64urlDecode(base64url: string): string {
   try {
@@ -39,7 +41,7 @@ export function jwtDecode<T = any>(token: string): T | null {
 
     return parsedPayload;
   } catch (e) {
-    console.error('[JWT] Decode failed:', e instanceof Error ? e.message : 'Unknown error');
+    console.error('[JWT] Decode failed:', errForLog(e));
     return null;
   }
 }

package/src/lib/jwt-decode.ts

@@ -1,4 +1,5 @@
 import { jwtDecode as originalJwtDecode } from 'jwt-decode';
+import { errForLog } from './log-safe';
 
 // Define JwtPayload interface since jwt-decode v4 doesn't export it
 export interface JwtPayload {
@@ -65,7 +66,7 @@ export function decodeJwtHeader(token: string): JwtHeader | null {
 
         return JSON.parse(headerJson) as JwtHeader;
     } catch (error) {
-        console.error('[JWT_DECODE] Failed to decode JWT header:', error);
+        console.error('[JWT_DECODE] Failed to decode JWT header:', errForLog(error));
         return null;
     }
 }

package/src/lib/log-safe.ts

@@ -0,0 +1,30 @@
+/**
+ * log-safe: the ONLY way a caught error or an upstream `code` goes into a server log (PII-in-logs census, BAPert 76553 group 1; ported from the
+ * portal's api-error-response.ts, BAPert 76470).
+ *
+ * Server logs persist and are read beyond the person who made the request. An error's `message`, `stack`, `cause` and `details` can carry an
+ * email, a phone number, a code, a token, a SQL fragment or a host: an IdP error's message is the upstream's own free text, and V8's JSON parse
+ * error quotes its input. So a log line gets the error's NAME and a closed STATUS / CODE, nothing else. Every field is matched against a closed
+ * shape; anything that does not match is dropped, not truncated.
+ *
+ * No imports on purpose: this is a leaf, loaded by modules that must not pull in anything else.
+ */
+
+/** An upstream `code` is loggable only if it is a closed token (UPPER_SNAKE). Anything else, including free text, becomes null. */
+export function closedCodeForLog(code: unknown): string | null {
+  return typeof code === 'string' && /^[A-Z0-9_]{1,64}$/.test(code) ? code : null;
+}
+
+/**
+ * Describe a caught error for a log line: `error=<Name> [status=<n>] [code=<CLOSED_CODE>]`.
+ * It NEVER carries `message`, `stack`, `cause` or `details`. A name that is not a short identifier (a hostile or free-text `name`) becomes
+ * `NonError`; a status outside 100-599 is dropped; a code outside the closed token shape is dropped.
+ */
+export function errForLog(err: unknown): string {
+  const e = (err !== null && typeof err === 'object' ? err : {}) as { name?: unknown; status?: unknown; code?: unknown };
+  const name = typeof e.name === 'string' && /^[A-Za-z0-9_]{1,48}$/.test(e.name) ? e.name : 'NonError';
+  const status = typeof e.status === 'number' && Number.isInteger(e.status) && e.status >= 100 && e.status <= 599 ? ` status=${e.status}` : '';
+  const closed = closedCodeForLog(e.code);
+  const code = closed ? ` code=${closed}` : '';
+  return `error=${name}${status}${code}`;
+}

package/src/lib/redis.ts

@@ -1,5 +1,6 @@
 // E:\Repos\PayEz-Next-MVP\packages\next-mvp\src\lib\redis.ts
 import Redis, { RedisOptions } from 'ioredis';
+import { errForLog } from './log-safe';
 
 let client: Redis | null = null;
 
@@ -76,7 +77,7 @@ function createClient(): Redis {
   // unhandled EventEmitter error, which can take the whole PROCESS down -
   // a Redis blip becoming a dead server is worse than the spinner was.
   instance.on('error', (err) => {
-    console.error(`[redis] PATH FAILURE ${new Date().toISOString()}: ${err instanceof Error ? err.message : String(err)}`);
+    console.error(`[redis] PATH FAILURE ${new Date().toISOString()}: ${errForLog(err)}`);
   });
 
   // 185121 line 3: the 16:05 event left no named trigger because ONLY 'error'

package/src/lib/safe-error-response.ts

@@ -15,6 +15,7 @@
  */
 
 import { knownPasswordRules } from './password-rules';
+import { errForLog } from './log-safe';
 
 export interface IdpErrorProjection {
   code?: string;
@@ -25,10 +26,14 @@ export interface IdpErrorProjection {
 
 const str = (v: unknown): string | undefined => (typeof v === 'string' ? v : undefined);
 
-/** Log an exception with a fresh correlationId and return the id for the response body. */
+/**
+ * Log an exception with a fresh correlationId and return the id for the response body.
+ * The log line carries the error's NAME and closed code/status only (errForLog), never its message, stack or cause: those can hold an
+ * email, a phone number, a token or a quoted request body (PII-in-logs, BAPert 76553 group 1). The correlationId still ties the response to the line.
+ */
 export function logExceptionWithCorrelation(tag: string, err: unknown): string {
   const correlationId = globalThis.crypto.randomUUID();
-  console.error(tag, { correlationId, error: err });
+  console.error(tag, { correlationId, error: errForLog(err) });
   return correlationId;
 }
 

package/src/lib/session-store.ts

@@ -15,6 +15,7 @@ import { getSessionPrefix, getRefreshLockPrefix, getAppSlug } from './app-slug';
 import { extractKidFromToken, decodeIdpAccessToken } from '../auth/utils/token-utils';
 import { tokenLogId } from './token-log-id';
 import { refreshTokenIdentity } from './refresh-in-doubt';
+import { errForLog } from './log-safe';
 
 // Re-export SessionData for consumers
 export type { SessionData } from '../models/SessionModel';
@@ -65,7 +66,7 @@ export async function createSession(data: SessionData): Promise<string> {
       .setex(versionKey, SESSION_TTL, '1')
       .exec();
   } catch (error) {
-    console.error('[SESSION-STORE] Failed to create session:', error);
+    console.error('[SESSION-STORE] Failed to create session:', errForLog(error));
     throw error;
   }
 

package/src/lib/site-logger.ts

@@ -11,6 +11,7 @@
  */
 
 import { getRedis } from './redis';
+import { closedCodeForLog, errForLog } from './log-safe';
 
 // Redis key for site logs (separate from data_logs)
 const REDIS_SITE_LOG_KEY = 'vibe:site-logs:pending';
@@ -74,11 +75,11 @@ export async function logSiteEvent(entry: SiteLogEntry): Promise<void> {
       console.log('[site-logger] Redis push success, queue length:', result);
       redis.expire(REDIS_SITE_LOG_KEY, REDIS_LOG_TTL).catch(() => {});
     }).catch(err => {
-      console.error('[site-logger] Redis push failed:', err.message);
+      console.error('[site-logger] Redis push failed:', errForLog(err));
     });
   } catch (error) {
     // Fail silently - logging should never break the app
-    console.error('[site-logger] Failed to log event:', error);
+    console.error('[site-logger] Failed to log event:', errForLog(error));
   }
 }
 
@@ -120,12 +121,14 @@ export const siteEvents = {
     });
   },
 
-  loginFailed: (opts: { reason: string; email?: string; url?: string; user_agent?: string; ip_address?: string }) => {
+  // BREAKING (PII-in-logs group 3b, BAPert 76553 Q2): no `email` parameter. A failed login is told apart by a CLOSED reason code (UPPER_SNAKE),
+  // never by the address that was tried; anything that is not a closed code is stored as UNSPECIFIED. A caller that still passes `email` fails to compile.
+  loginFailed: (opts: { reason: string; url?: string; user_agent?: string; ip_address?: string }) => {
     logSiteEvent({
       level: 'warn',
       category: 'auth',
       message: 'Login failed',
-      context: { reason: opts.reason, email: opts.email },
+      context: { reason: closedCodeForLog(opts.reason) ?? 'UNSPECIFIED' },
       url: opts.url || '/auth/login',
       user_agent: opts.user_agent,
       ip_address: opts.ip_address,
@@ -214,12 +217,15 @@ export const siteEvents = {
     });
   },
 
-  error: (opts: { message: string; error?: string; stack?: string; user_id?: string | number; url?: string; user_agent?: string; ip_address?: string }) => {
+  // BREAKING (PII-in-logs group 3b, BAPert 76553 Q2): takes a CLOSED code, not caller text, an error string or a stack. The stored message is the fixed
+  // sentence 'Application error'; the code (UPPER_SNAKE, else UNSPECIFIED) goes in context. A caller that still passes `message`, `error` or `stack`
+  // fails to compile.
+  error: (opts: { code: string; user_id?: string | number; url?: string; user_agent?: string; ip_address?: string }) => {
     logSiteEvent({
       level: 'error',
       category: 'error',
-      message: opts.message,
-      context: { error: opts.error, stack: opts.stack },
+      message: 'Application error',
+      context: { code: closedCodeForLog(opts.code) ?? 'UNSPECIFIED' },
       user_id: opts.user_id,
       url: opts.url,
       user_agent: opts.user_agent,

package/src/lib/standardized-client-api.ts

@@ -9,6 +9,7 @@
 // ========================================================================================
 
 import { authClient } from '../client/better-auth-client';
+import { errForLog } from './log-safe';
 
 /** Unwrap Better Auth getSession() to a flat session-like object for backward compat */
 async function getSession(): Promise<any> {
@@ -147,7 +148,7 @@ function scheduleLoginRedirect(isImmediate = false) {
       console.warn(`🔄 Redirecting to login with return URL: ${returnUrl}`);
       window.location.href = `/account-auth/login?returnUrl=${returnUrl}`;
     } catch (error) {
-      console.error('❌ Error during login redirect:', error);
+      console.error('❌ Error during login redirect:', errForLog(error));
       // Final fallback
       try {
         window.location.href = '/account-auth/login';
@@ -721,7 +722,7 @@ class StandardizedClientApiService {
       }
       
       // Wrap unknown errors as network errors
-      console.error('❌ API request failed:', error);
+      console.error('❌ API request failed:', errForLog(error));
       throw new ApiNetworkError(
         error instanceof Error ? error.message : 'Network error',
         0,

package/src/lib/token-lifecycle.ts

@@ -27,6 +27,7 @@ import { getRedis } from './redis';
 import { getAppSlug } from './app-slug';
 import { tokenLogId } from './token-log-id';
 import { REFRESH_WINDOW_MS } from './refresh-window';
+import { errForLog } from './log-safe';
 
 // "needs refresh" threshold: THE one freshness window (lib/refresh-window), the same value the refresh route, ensureFreshAccessToken and idp-fetch use.
 const REFRESH_THRESHOLD_MS = REFRESH_WINDOW_MS;
@@ -434,7 +435,7 @@ export async function ensureFreshToken(
         }
       } catch (e) {
         // If we can't decode, proceed with normal logic
-        console.warn('[TOKEN_LIFECYCLE] Could not validate JWT exp claim:', e);
+        console.warn('[TOKEN_LIFECYCLE] Could not validate JWT exp claim:', errForLog(e));
       }
     }
 
@@ -512,7 +513,7 @@ export async function ensureFreshToken(
       sessionData,
     };
   } catch (error) {
-    console.error('[TOKEN_LIFECYCLE] Error:', error);
+    console.error('[TOKEN_LIFECYCLE] Error:', errForLog(error));
     return {
       success: false,
       error: 'NO_SESSION',

package/src/middleware/create-middleware.ts

@@ -32,6 +32,7 @@ import {
   resetSecret,
   signedResetHref,
 } from '../auth/session-reset-link';
+import { errForLog } from '../lib/log-safe';
 
 // =============================================================================
 // TYPES
@@ -1037,7 +1038,7 @@ async function handleAllow(
         );
       }
     } catch (error) {
-      console.error('[MIDDLEWARE] RBAC error:', error);
+      console.error('[MIDDLEWARE] RBAC error:', errForLog(error));
 
       // In development, fail open
       if (process.env.NODE_ENV !== 'production') {

package/src/middleware/rbac-check.ts

@@ -1,3 +1,4 @@
+import { errForLog } from '../lib/log-safe';
 /**
  * Page RBAC Check Module
  *
@@ -262,7 +263,7 @@ export async function checkPagePermission(
       };
     }
 
-    console.error('[RBAC] Proxy error:', error);
+    console.error('[RBAC] Proxy error:', errForLog(error));
     return {
       allowed: false,
       reason: 'rbac_service_unavailable',

package/src/routes/auth/logout.ts

@@ -27,6 +27,7 @@ import {
 } from '../../lib/app-slug';
 import { siteEvents, getClientIp } from '../../lib/site-logger';
 import { logExceptionWithCorrelation } from '../../lib/safe-error-response';
+import { errForLog } from '../../lib/log-safe';
 
 /**
  * 4.8.9: answered (status 500) when a sign-out did not finish. 4.8.10 (BAPert 76297): TWO sentences, one per cause, each true for its
@@ -79,7 +80,13 @@ export async function POST(req: NextRequest) {
         await revokeSessionAtIdp(req);
       } catch (error) {
         idpRevokeFailed = true;
-        console.error('[LOGOUT_ROUTE] IdP revoke failed - the IdP refresh token is STILL LIVE:', error);
+        // "STILL LIVE" only when the IdP showed it (a forced refresh succeeded); otherwise say what is known: it was not confirmed.
+        console.error(
+          (error as { grantLive?: boolean } | null)?.grantLive === true
+            ? '[LOGOUT_ROUTE] IdP revoke failed - the IdP refresh token is STILL LIVE:'
+            : '[LOGOUT_ROUTE] IdP revoke could not be confirmed (the grant may already be dead):',
+          errForLog(error),
+        );
       }
     }
 
@@ -91,7 +98,7 @@ export async function POST(req: NextRequest) {
         console.info('[LOGOUT_ROUTE] Session deleted from store');
       } catch (error) {
         localDeleteFailed = true;
-        console.error('[LOGOUT_ROUTE] Failed to delete session - the server session is STILL LIVE:', error);
+        console.error('[LOGOUT_ROUTE] Failed to delete session - the server session is STILL LIVE:', errForLog(error));
       }
     }
 

package/src/routes/auth/settings.ts

@@ -30,6 +30,7 @@
 import { NextResponse } from 'next/server';
 import { getIDPClientConfig } from '../../lib/idp-client-config';
 import { secretSafeJson } from '../../lib/never-in-response';
+import { errForLog } from '../../lib/log-safe';
 
 export interface PublicAuthSettings {
     // OAuth providers enabled for this client
@@ -95,7 +96,7 @@ export async function GET() {
         config = await getIDPClientConfig();
     } catch (error) {
         // Keep the loud line - it is what finally unmasked this in production.
-        console.error('[AUTH_SETTINGS] Failed to get settings:', error);
+        console.error('[AUTH_SETTINGS] Failed to get settings:', errForLog(error));
         // The `degraded: true` shape that used to live here (240447) is gone
         // deliberately. It still answered `success: true` with a full invented
         // policy and merely LABELLED the guess - which BAPert v32 rules out:

package/src/server/auth-guard.ts

@@ -14,6 +14,7 @@ import { decodeSession } from './decode-session';
 import { getIDPClientConfig } from '../lib/idp-client-config';
 import { getSessionCookieName, getSecureSessionCookieName } from '../lib/app-slug';
 import type { SessionData } from '../lib/session-store';
+import { errForLog } from '../lib/log-safe';
 
 // =============================================================================
 // TYPES
@@ -89,7 +90,7 @@ export async function authGuard(options?: AuthGuardOptions): Promise<AuthGuardRe
     decoded = await decodeSession();
   } catch (error) {
     // Redis unreachable or startup failure → fail closed
-    console.error('[AUTH-GUARD] Session decode failed (service error):', error instanceof Error ? error.message : String(error));
+    console.error('[AUTH-GUARD] Session decode failed (service error):', errForLog(error));
     redirect(serviceUnavailableUrl);
   }
 
@@ -122,7 +123,7 @@ export async function authGuard(options?: AuthGuardOptions): Promise<AuthGuardRe
     requires2FA = config.authSettings?.require2FA ?? true;
   } catch (error) {
     // If we can't check 2FA config, fail closed
-    console.error('[AUTH-GUARD] 2FA config check failed:', error instanceof Error ? error.message : String(error));
+    console.error('[AUTH-GUARD] 2FA config check failed:', errForLog(error));
     redirect(serviceUnavailableUrl);
   }
 
@@ -186,7 +187,7 @@ export async function authGuard(options?: AuthGuardOptions): Promise<AuthGuardRe
         if (error && typeof error === 'object' && 'digest' in error) {
           throw error;
         }
-        console.error(`[AUTH-GUARD] Custom check "${check.name}" error:`, error instanceof Error ? error.message : String(error));
+        console.error(`[AUTH-GUARD] Custom check "${check.name}" error:`, errForLog(error));
         redirect(serviceUnavailableUrl);
       }
     }

package/src/server/auth.ts

@@ -14,6 +14,7 @@ import {
   type SessionData,
 } from '../lib/session-store';
 import { tokenLogId } from '../lib/token-log-id';
+import { errForLog } from '../lib/log-safe';
 import { resolveVerifiedSessionTokenFromRequest } from './verified-session-token';
 
 export type IdpTokenResult =
@@ -134,20 +135,14 @@ export async function getAuthInstance() {
  * `{error:'NO_SESSION'}`, and getSession() swallowed every Redis error into a bare `catch {}`. These helpers name
  * the origin and make a swallowed read audible. Hard rules: every helper is wrapped so it can NEVER throw or change
  * a return value; nothing here ever logs a token, a cookie VALUE or a Redis value - only a tokenLogId() fingerprint,
- * cookie NAMES, booleans, and an error name/message with any long opaque run redacted.
+ * cookie NAMES, booleans, and an error NAME with its closed code/status (errForLog; never the message).
  * -------------------------------------------------------------------------------------------------------------- */
 
-/** An error name/message, first 80 chars, with any 24+ char opaque run (a token, a key) replaced. */
-function scrubForLog(v: unknown): string {
-  const raw = v instanceof Error ? v.message : String(v ?? '');
-  return raw.replace(/[A-Za-z0-9_\-.+/=]{24,}/g, '[redacted]').slice(0, 80);
-}
-
-/** `catch {}` sites on the session read path: still swallowed, now audible. */
+/** `catch {}` sites on the session read path: still swallowed, now audible. The line names the error and its closed code/status only: the
+ *  message is dropped (BAPert 76553: a redacted-and-truncated message still leaked host names, ports and quoted input). */
 function logSessionReadSwallowed(path: 'primary' | 'A' | 'B', err: unknown): void {
   try {
-    const name = scrubForLog(err instanceof Error ? err.name : typeof err);
-    console.warn(`[server-auth] SESSION_READ_SWALLOWED path=${path} err=${name} msg=${scrubForLog(err)}`);
+    console.warn(`[server-auth] SESSION_READ_SWALLOWED path=${path} ${errForLog(err)}`);
   } catch {
     /* a diagnostic must never change the outcome */
   }

package/src/server/decode-session.ts

@@ -15,6 +15,7 @@ import { ensureInitialized } from '../lib/startup-init';
 import { extractSessionTokenFromCookieValue } from '../lib/session-cookie-shape';
 import { resolveVerifiedSessionCookie } from './verified-session-token';
 import { tokenLogId } from '../lib/token-log-id';
+import { errForLog } from '../lib/log-safe';
 
 export interface DecodedSession {
   sessionData: SessionData;
@@ -197,7 +198,7 @@ async function tryBetterAuthSession(
 
     return { sessionData, jwtPayload };
   } catch (error) {
-    console.warn('[DECODE-SESSION] Better Auth session check failed:', error instanceof Error ? error.message : String(error));
+    console.warn('[DECODE-SESSION] Better Auth session check failed:', errForLog(error));
     return null;
   }
 }
@@ -303,7 +304,7 @@ export async function decodeSession(
       jwtPayload: (payload ?? { sessionToken }) as DecodedSession['jwtPayload'],
     };
   } catch (error) {
-    console.error('[DECODE-SESSION] Error:', error instanceof Error ? error.message : String(error));
+    console.error('[DECODE-SESSION] Error:', errForLog(error));
     return null;
   }
 }

package/src/server/with-auth.ts

@@ -17,6 +17,7 @@ import 'server-only';
 import { NextRequest, NextResponse } from 'next/server';
 import { decodeSession } from './decode-session';
 import type { SessionData } from '../lib/session-store';
+import { errForLog } from '../lib/log-safe';
 
 // =============================================================================
 // TYPES
@@ -83,7 +84,7 @@ export function withAuth(
 
       return handler(req, auth);
     } catch (error) {
-      console.error('[WITH-AUTH] Error:', error instanceof Error ? error.message : String(error));
+      console.error('[WITH-AUTH] Error:', errForLog(error));
       return NextResponse.json(
         { error: 'Internal Server Error', message: 'Auth check failed' },
         { status: 500 }