@payez/next-mvp 4.12.0 → 4.12.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog — @payez/next-mvp
 
+## 4.12.1 (to be published under dist-tag `next` only, after 4.12.0; `latest` stays 4.8.9 until Jon says otherwise)
+
+A patch cut from the 4.12.0 tree carrying ONE change: the PAY-2425 hygiene fix below (PR 1500).
+
+- **CHANGE (PAY-2425, hygiene): the refresh no longer invents authentication claims for an OAuth (Google) session.** `lib/ensure-fresh-access-token` answered an OAuth session whose stored authentication methods were empty with `amr ['pwd','mfa']`, `two_factor_method 'oauth'` and an `acr` raised from '1' to '2' ("OAuth IS a form of multi-factor auth"), and echoed a stored `mfaVerified` as `two_factor_verified` whatever the session's methods said. OAuth is federated sign-in, not a second factor (BAPert 77404). The refresh body now carries only what the session records: empty stays empty, `acr` is the session's own level, no method is named from silence, and `two_factor_verified` is sent only when the session's recorded methods contain `mfa`, `sms`, `totp` or `email`. A session that really attests `mfa` still sends it. The IdP ignores these request fields and mints `amr`/`acr` from the stored refresh row, so this removes a false claim from the wire; it does not establish that any bypass existed or is closed. **What changes for a caller:** a Google user on a `require2FA` client is asked for a code, as before, because the IdP decides that; a Google-only client that wants no second factor sets `require2FA = false` explicitly. An earlier version of this fix on `nextpert/375639-amr-fabrication` (e6e3b6c3, e3b3bb12) was never merged; the refresh path has since moved into this helper. Rows: `test/next-mvp-pay-2425-no-fabricated-mfa.test.cjs` (R1/R2/R3, C1, N1 and four mutants).
+
 ## 4.12.0 (to be published under dist-tag `next` only, after 4.11.0; `latest` stays 4.8.9 until Jon says otherwise)
 
 A minor: PII-in-logs groups 1, 2, 3a and 3b, the GOV-023 signout BREAKING change, the logout-401 FIX (PAY-2396), and the BREAKING site-logger signatures (3b: callers of `siteEvents.loginFailed` / `siteEvents.error` must change).

package/dist/lib/ensure-fresh-access-token.js

@@ -257,17 +257,18 @@ async function ensureFreshAccessToken(sessionToken, config, options = {}) {
             }
             catch { /* fall through */ }
         }
-        const isOAuthSession = !!session.oauthProvider;
-        if (authMethods.length === 0 && isOAuthSession) {
-            authMethods = ['pwd', 'mfa'];
-        }
+        // PAY-2425 (BAPert 77400, NightHawk 77401): THE CLIENT DOES NOT INFER AUTHENTICATION STRENGTH FROM SILENCE. This block used to answer an OAuth
+        // (Google) session whose stored methods were EMPTY with amr ['pwd','mfa'], a two-factor method of 'oauth' and an acr raised from '1' to '2' ("OAuth IS
+        // a form of multi-factor auth"). That is false: OAuth is federated sign-in, one factor typed at the provider. It fired exactly when the session
+        // could tell us nothing and answered with the strongest claim available; on prod (4.10.0) a Google user on a require2FA client was then counted
+        // 2FA-complete with no code (RigPert 77398). What the session does not attest, the refresh body does not assert: empty stays empty, the level stays
+        // the session's own, and no method is named unless one is recorded. The IdP computes the real amr/acr for the minted token (and mfaVerified is
+        // re-derived from THAT token below); a session that really attests 'mfa' still sends it. History: the fix existed on nextpert/375639-amr-fabrication
+        // (e6e3b6c3, e3b3bb12) and was never merged.
         const twoFactorMethod = authMethods.find(m => ['sms', 'totp', 'email'].includes(m)) ||
             session.mfaMethod ||
-            (isOAuthSession ? 'oauth' : null);
-        let acrValue = String(session.authenticationLevel ?? '1');
-        if (isOAuthSession && session.mfaVerified && acrValue === '1') {
-            acrValue = '2';
-        }
+            null;
+        const acrValue = String(session.authenticationLevel ?? '1');
         // WO-2: send the POST-lock current refresh token, not the pre-lock snapshot.
         // `session` was read before we acquired the lock; a concurrent refresh that
         // completed while we waited rotates the token, so the pre-lock value is stale
@@ -300,7 +301,11 @@ async function ensureFreshAccessToken(sessionToken, config, options = {}) {
             amr: authMethods,
             acr: acrValue,
         };
-        if (session.mfaVerified)
+        // PAY-2425 (NightHawk 77414): a STORED mfaVerified flag is only echoed when the session's own recorded methods back it. Sessions created while the
+        // bug was live carry mfaVerified:true that the bug itself wrote, with no 'mfa' (or sms/totp/email) in their methods; echoing that flag would carry the
+        // poison across the upgrade. A genuine second factor leaves 'mfa' and its method in the recorded methods, so it is still sent.
+        const methodsAttestSecondFactor = authMethods.some(m => m === 'mfa' || ['sms', 'totp', 'email'].includes(m));
+        if (session.mfaVerified && methodsAttestSecondFactor)
             body.two_factor_verified = true;
         if (twoFactorMethod)
             body.two_factor_method = twoFactorMethod;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "4.12.0",
+  "version": "4.12.1",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/lib/ensure-fresh-access-token.ts

@@ -349,19 +349,20 @@ export async function ensureFreshAccessToken(
     } else if (typeof session.authenticationMethods === 'string') {
       try { authMethods = JSON.parse(session.authenticationMethods); } catch { /* fall through */ }
     }
-    const isOAuthSession = !!session.oauthProvider;
-    if (authMethods.length === 0 && isOAuthSession) {
-      authMethods = ['pwd', 'mfa'];
-    }
+    // PAY-2425 (BAPert 77400, NightHawk 77401): THE CLIENT DOES NOT INFER AUTHENTICATION STRENGTH FROM SILENCE. This block used to answer an OAuth
+    // (Google) session whose stored methods were EMPTY with amr ['pwd','mfa'], a two-factor method of 'oauth' and an acr raised from '1' to '2' ("OAuth IS
+    // a form of multi-factor auth"). That is false: OAuth is federated sign-in, one factor typed at the provider. It fired exactly when the session
+    // could tell us nothing and answered with the strongest claim available; on prod (4.10.0) a Google user on a require2FA client was then counted
+    // 2FA-complete with no code (RigPert 77398). What the session does not attest, the refresh body does not assert: empty stays empty, the level stays
+    // the session's own, and no method is named unless one is recorded. The IdP computes the real amr/acr for the minted token (and mfaVerified is
+    // re-derived from THAT token below); a session that really attests 'mfa' still sends it. History: the fix existed on nextpert/375639-amr-fabrication
+    // (e6e3b6c3, e3b3bb12) and was never merged.
     const twoFactorMethod =
       authMethods.find(m => ['sms', 'totp', 'email'].includes(m)) ||
       session.mfaMethod ||
-      (isOAuthSession ? 'oauth' : null);
+      null;
 
-    let acrValue = String(session.authenticationLevel ?? '1');
-    if (isOAuthSession && session.mfaVerified && acrValue === '1') {
-      acrValue = '2';
-    }
+    const acrValue = String(session.authenticationLevel ?? '1');
 
     // WO-2: send the POST-lock current refresh token, not the pre-lock snapshot.
     // `session` was read before we acquired the lock; a concurrent refresh that
@@ -397,7 +398,11 @@ export async function ensureFreshAccessToken(
       amr: authMethods,
       acr: acrValue,
     };
-    if (session.mfaVerified) body.two_factor_verified = true;
+    // PAY-2425 (NightHawk 77414): a STORED mfaVerified flag is only echoed when the session's own recorded methods back it. Sessions created while the
+    // bug was live carry mfaVerified:true that the bug itself wrote, with no 'mfa' (or sms/totp/email) in their methods; echoing that flag would carry the
+    // poison across the upgrade. A genuine second factor leaves 'mfa' and its method in the recorded methods, so it is still sent.
+    const methodsAttestSecondFactor = authMethods.some(m => m === 'mfa' || ['sms', 'totp', 'email'].includes(m));
+    if (session.mfaVerified && methodsAttestSecondFactor) body.two_factor_verified = true;
     if (twoFactorMethod) body.two_factor_method = twoFactorMethod;
     if (session.mfaCompletedAt) body.two_factor_completed_at = new Date(session.mfaCompletedAt).toISOString();