@payez/next-mvp 4.12.0 → 4.13.0

package/dist/components/mfa/TotpEnrollPanel.js

@@ -0,0 +1,117 @@
+"use strict";
+'use client';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STEP_UP_SENTENCE = void 0;
+exports.TotpEnrollPanel = TotpEnrollPanel;
+const jsx_runtime_1 = require("react/jsx-runtime");
+const react_1 = require("react");
+const QrCode_1 = require("./QrCode");
+const two_factor_verify_failure_1 = require("../../lib/two-factor-verify-failure");
+exports.STEP_UP_SENTENCE = 'This session was signed in with an emailed or texted code only. Sign in with your current authenticator, then try again.';
+async function readJson(res) {
+    return res.json().catch(() => null);
+}
+function TotpEnrollPanel({ fetchImpl, onConfirmed } = {}) {
+    const doFetch = fetchImpl ?? ((...a) => fetch(...a));
+    const [stage, setStage] = (0, react_1.useState)('idle');
+    const [enroll, setEnroll] = (0, react_1.useState)(null);
+    const [code, setCode] = (0, react_1.useState)('');
+    const [error, setError] = (0, react_1.useState)(null);
+    const [busy, setBusy] = (0, react_1.useState)(false);
+    async function begin() {
+        setBusy(true);
+        setError(null);
+        try {
+            const res = await doFetch('/api/mfa/totp/enroll', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ friendly_name: 'This device' }),
+            });
+            if (res.ok) {
+                const body = (await readJson(res));
+                if (!body || !body.secret || !body.otpauth_uri || body.enrollment_id === undefined) {
+                    setError('Something went wrong on our end. Try again.');
+                    return;
+                }
+                setEnroll({ secret: body.secret, otpauth_uri: body.otpauth_uri, enrollment_id: body.enrollment_id });
+                setCode('');
+                setStage('enrolling');
+                return;
+            }
+            if (res.status === 401) {
+                setStage('signed-out');
+                return;
+            }
+            const json = await readJson(res);
+            if ((0, two_factor_verify_failure_1.stepUpRefusal)(res.status, json)) {
+                setError(exports.STEP_UP_SENTENCE);
+                return;
+            }
+            if (res.status === 403) {
+                setError('This account already has a second factor set up, so an authenticator app cannot be added here. Sign in with your existing method.');
+                return;
+            }
+            setError('Something went wrong on our end. Try again.');
+        }
+        finally {
+            setBusy(false);
+        }
+    }
+    async function confirm() {
+        if (!enroll || !/^\d{6}$/.test(code)) {
+            setError('Enter the 6-digit code from your app.');
+            return;
+        }
+        setBusy(true);
+        setError(null);
+        try {
+            const res = await doFetch('/api/mfa/totp/confirm', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ enrollment_id: enroll.enrollment_id, code }),
+            });
+            if (res.ok) {
+                setEnroll(null);
+                setCode('');
+                setStage('done');
+                onConfirmed?.();
+                return;
+            }
+            if (res.status === 401) {
+                setStage('signed-out');
+                return;
+            }
+            const json = await readJson(res);
+            if ((0, two_factor_verify_failure_1.stepUpRefusal)(res.status, json)) {
+                setError(exports.STEP_UP_SENTENCE);
+                return;
+            }
+            setCode('');
+            setError(res.status === 400 || res.status === 422
+                ? 'That code did not match. Check the time on your phone and try the next code.'
+                : 'Setup was not completed. Try again.');
+        }
+        finally {
+            setBusy(false);
+        }
+    }
+    if (stage === 'signed-out') {
+        return ((0, jsx_runtime_1.jsxs)("div", { "data-testid": "totp-signed-out", children: [(0, jsx_runtime_1.jsx)("a", { href: "/account-auth/login", children: "Sign in" }), " to set up an authenticator app."] }));
+    }
+    if (stage === 'done') {
+        return ((0, jsx_runtime_1.jsxs)("div", { "data-testid": "totp-done", role: "status", children: [(0, jsx_runtime_1.jsx)("p", { children: "Authenticator app added." }), (0, jsx_runtime_1.jsx)("p", { children: "The next time you sign in on this app, you will be asked for the 6-digit code from it." })] }));
+    }
+    if (stage === 'enrolling' && enroll) {
+        return ((0, jsx_runtime_1.jsxs)("div", { "data-testid": "totp-enrolling", style: { display: 'flex', flexDirection: 'column', gap: 12, alignItems: 'flex-start' }, children: [(0, jsx_runtime_1.jsx)("p", { children: "Open your authenticator app and scan this code. A phone camera works too." }), (0, jsx_runtime_1.jsx)(QrCode_1.QrCode, { value: enroll.otpauth_uri }), (0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("div", { children: "Can't scan? Enter this code manually:" }), (0, jsx_runtime_1.jsx)("code", { "data-testid": "totp-secret", style: { wordBreak: 'break-all' }, children: enroll.secret })] }), (0, jsx_runtime_1.jsxs)("form", { onSubmit: (e) => {
+                        e.preventDefault();
+                        void confirm();
+                    }, children: [(0, jsx_runtime_1.jsx)("label", { htmlFor: "totp-code", children: "Enter the 6-digit code from your app:" }), (0, jsx_runtime_1.jsx)("br", {}), (0, jsx_runtime_1.jsx)("input", { id: "totp-code", "data-testid": "totp-code", inputMode: "numeric", autoComplete: "one-time-code", maxLength: 6, value: code, disabled: busy, onChange: (e) => setCode(e.target.value.replace(/\D/g, '').slice(0, 6)) }), ' ', (0, jsx_runtime_1.jsx)("button", { type: "submit", "data-testid": "totp-confirm", disabled: busy || code.length !== 6, children: "Confirm" })] }), error ? ((0, jsx_runtime_1.jsx)("p", { role: "alert", "data-testid": "totp-error", children: error })) : null, (0, jsx_runtime_1.jsx)("button", { type: "button", "data-testid": "totp-restart", disabled: busy, onClick: () => {
+                        setEnroll(null);
+                        setCode('');
+                        setError(null);
+                        setStage('idle');
+                    }, children: "Start again" })] }));
+    }
+    return ((0, jsx_runtime_1.jsxs)("div", { "data-testid": "totp-idle", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", "data-testid": "totp-begin", disabled: busy, onClick: () => void begin(), children: busy ? 'Starting…' : 'Add authenticator app' }), error ? ((0, jsx_runtime_1.jsx)("p", { role: "alert", "data-testid": "totp-error", children: error })) : null] }));
+}
+exports.default = TotpEnrollPanel;

package/dist/edge/middleware.d.ts

@@ -7,7 +7,7 @@
 export { makeAuthDecision } from '../auth/auth-decision';
 export { isUnauthenticatedRoute, configurePublicRoutes, getRouteConfig, configure2FABypassRoutes, should2FABypass, get2FABypassConfig } from '../auth/route-config';
 export type { UnauthenticatedRouteConfig, ProtectedRouteConfig } from '../auth/route-config';
-export { createMvpMiddleware, isPrefetchRequest } from '../middleware/create-middleware';
+export { createMvpMiddleware, isPrefetchRequest, isKnownNonNavigationRequest } from '../middleware/create-middleware';
 export type { MvpMiddlewareOptions, CircuitBreakerProvider, MiddlewareLogger, AuthContext, AuthAction, SessionPointer, SessionStatus } from '../middleware/create-middleware';
 export { TwoFactorPresets, AMRValues, ACRLevels, validateAMR, validateACR, checkTwoFactorRequirements } from '../middleware/twofa-presets';
 export type { TwoFactorRequirements, RouteConfig } from '../middleware/twofa-presets';

package/dist/edge/middleware.js

@@ -6,7 +6,7 @@
  * Client-side utilities that depend on browser APIs or server-only code are excluded.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getInternalApiUrl = exports.checkTwoFactorRequirements = exports.validateACR = exports.validateAMR = exports.ACRLevels = exports.AMRValues = exports.TwoFactorPresets = exports.isPrefetchRequest = exports.createMvpMiddleware = exports.get2FABypassConfig = exports.should2FABypass = exports.configure2FABypassRoutes = exports.getRouteConfig = exports.configurePublicRoutes = exports.isUnauthenticatedRoute = exports.makeAuthDecision = void 0;
+exports.getInternalApiUrl = exports.checkTwoFactorRequirements = exports.validateACR = exports.validateAMR = exports.ACRLevels = exports.AMRValues = exports.TwoFactorPresets = exports.isKnownNonNavigationRequest = exports.isPrefetchRequest = exports.createMvpMiddleware = exports.get2FABypassConfig = exports.should2FABypass = exports.configure2FABypassRoutes = exports.getRouteConfig = exports.configurePublicRoutes = exports.isUnauthenticatedRoute = exports.makeAuthDecision = void 0;
 // Authentication middleware and configuration (Edge Runtime compatible)
 var auth_decision_1 = require("../auth/auth-decision");
 Object.defineProperty(exports, "makeAuthDecision", { enumerable: true, get: function () { return auth_decision_1.makeAuthDecision; } });
@@ -20,6 +20,7 @@ Object.defineProperty(exports, "get2FABypassConfig", { enumerable: true, get: fu
 var create_middleware_1 = require("../middleware/create-middleware");
 Object.defineProperty(exports, "createMvpMiddleware", { enumerable: true, get: function () { return create_middleware_1.createMvpMiddleware; } });
 Object.defineProperty(exports, "isPrefetchRequest", { enumerable: true, get: function () { return create_middleware_1.isPrefetchRequest; } });
+Object.defineProperty(exports, "isKnownNonNavigationRequest", { enumerable: true, get: function () { return create_middleware_1.isKnownNonNavigationRequest; } });
 // Two-Factor Authentication Presets (Edge Runtime compatible)
 var twofa_presets_1 = require("../middleware/twofa-presets");
 Object.defineProperty(exports, "TwoFactorPresets", { enumerable: true, get: function () { return twofa_presets_1.TwoFactorPresets; } });

package/dist/index.d.ts

@@ -6,7 +6,7 @@ export type { AuthConfig } from './types/auth';
 export { makeAuthDecision } from './auth/auth-decision';
 export { isUnauthenticatedRoute, configurePublicRoutes, getRouteConfig } from './auth/route-config';
 export { safeCallbackPath, isSafeCallbackPath, resolveCallbackDestination, DEFAULT_CALLBACK } from './auth/safe-callback';
-export { createMvpMiddleware, isPrefetchRequest } from './middleware/create-middleware';
+export { createMvpMiddleware, isPrefetchRequest, isKnownNonNavigationRequest } from './middleware/create-middleware';
 export { UserAvatarMenu, MobileNavDrawer } from './components/account';
 export type { UserAvatarMenuProps, MobileNavDrawerProps, NavItem, NavSection } from './components/account';
 export { ErrorMetricsCard, HealthMetricsCard, AuditLogViewer, AdminAnalyticsLayout, useErrorMetrics, useHealthMetrics, useAuditLog, useAdminAnalytics, getErrorMetrics, getHealthMetrics, writeAuditLog, queryAuditLog, } from './logging';

package/dist/index.js

@@ -8,7 +8,7 @@
 // - Better Auth: import { createBetterAuthInstance } from '@payez/next-mvp/auth/better-auth'
 // - Server auth: import { getSession } from '@payez/next-mvp/server/auth'
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.queryAuditLog = exports.writeAuditLog = exports.getHealthMetrics = exports.getErrorMetrics = exports.useAdminAnalytics = exports.useAuditLog = exports.useHealthMetrics = exports.useErrorMetrics = exports.AdminAnalyticsLayout = exports.AuditLogViewer = exports.HealthMetricsCard = exports.ErrorMetricsCard = exports.MobileNavDrawer = exports.UserAvatarMenu = exports.isPrefetchRequest = exports.createMvpMiddleware = exports.DEFAULT_CALLBACK = exports.resolveCallbackDestination = exports.isSafeCallbackPath = exports.safeCallbackPath = exports.getRouteConfig = exports.configurePublicRoutes = exports.isUnauthenticatedRoute = exports.makeAuthDecision = exports.useTraditionalAuthEnabled = exports.useFederatedAuthEnabled = exports.useFederatedProviders = exports.useAuthMode = exports.useAuthConfig = exports.AuthProvider = exports.useAnonSession = exports.fetchWithAuth = void 0;
+exports.queryAuditLog = exports.writeAuditLog = exports.getHealthMetrics = exports.getErrorMetrics = exports.useAdminAnalytics = exports.useAuditLog = exports.useHealthMetrics = exports.useErrorMetrics = exports.AdminAnalyticsLayout = exports.AuditLogViewer = exports.HealthMetricsCard = exports.ErrorMetricsCard = exports.MobileNavDrawer = exports.UserAvatarMenu = exports.isKnownNonNavigationRequest = exports.isPrefetchRequest = exports.createMvpMiddleware = exports.DEFAULT_CALLBACK = exports.resolveCallbackDestination = exports.isSafeCallbackPath = exports.safeCallbackPath = exports.getRouteConfig = exports.configurePublicRoutes = exports.isUnauthenticatedRoute = exports.makeAuthDecision = exports.useTraditionalAuthEnabled = exports.useFederatedAuthEnabled = exports.useFederatedProviders = exports.useAuthMode = exports.useAuthConfig = exports.AuthProvider = exports.useAnonSession = exports.fetchWithAuth = void 0;
 // Client-safe exports only
 // Client-side utilities
 var fetch_with_auth_1 = require("./client/fetch-with-auth");
@@ -41,6 +41,7 @@ Object.defineProperty(exports, "DEFAULT_CALLBACK", { enumerable: true, get: func
 var create_middleware_1 = require("./middleware/create-middleware");
 Object.defineProperty(exports, "createMvpMiddleware", { enumerable: true, get: function () { return create_middleware_1.createMvpMiddleware; } });
 Object.defineProperty(exports, "isPrefetchRequest", { enumerable: true, get: function () { return create_middleware_1.isPrefetchRequest; } });
+Object.defineProperty(exports, "isKnownNonNavigationRequest", { enumerable: true, get: function () { return create_middleware_1.isKnownNonNavigationRequest; } });
 // Account Components
 var account_1 = require("./components/account");
 Object.defineProperty(exports, "UserAvatarMenu", { enumerable: true, get: function () { return account_1.UserAvatarMenu; } });

package/dist/lib/credential-sign-in-client.d.ts

@@ -14,6 +14,7 @@
  *     literally true (PAY-2284).
  */
 import { NO_CODE_REQUEST, type CodeRequest } from './code-step-copy';
+import { SIGN_IN_FAILURE_COPY } from './sign-in-failure';
 export declare const CREDENTIAL_LOGIN_URL = "/api/auth/admin-login";
 export declare const CREDENTIAL_EMAIL_CODE_URL = "/api/auth/admin-login/email-code";
 export type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
@@ -23,15 +24,24 @@ export type CredentialSignInResult = {
     kind: 'two_factor';
     codeRequest: CodeRequest;
     devCode: string | null;
+    nextStep: NextStep;
 } | {
     kind: 'rate_limited';
     message: string;
+    code: ErrorCode;
 } | {
     kind: 'error';
     message: string;
+    code: ErrorCode;
     offerEmailCode: boolean;
 };
-export declare const MSG_RATE_LIMITED = "Too many attempts. Please try again later.";
+/**
+ * The stable machine code a rendered error carries (data-error-code). The three from the closed table in lib/sign-in-failure,
+ * plus 'policy_message' (an allowlisted SsoRequired / InvalidRequest refusal, whose detail the server may send) and
+ * 'sign_in_failed' (anything this client could not map: a 400/5xx, an unknown code, a thrown fetch).
+ */
+export type ErrorCode = keyof typeof SIGN_IN_FAILURE_COPY | 'policy_message' | 'sign_in_failed';
+export declare const MSG_RATE_LIMITED: string;
 export declare const MSG_CANNOT_SIGN_IN = "Could not sign in. Check your details and try again.";
 export declare const MSG_UNEXPECTED = "Something went wrong signing you in. Please try again.";
 export declare function isEmailShaped(v: string): boolean;
@@ -40,6 +50,21 @@ export declare function validateCredentials(email: string, password: string): {
     email?: string;
     password?: string;
 } | null;
+/**
+ * PAY-2630: what the IdP says is outstanding for this user ON THIS CLIENT. The door (api-handlers/auth/credential-login)
+ * already relays the IdP's next_step as `nextStep`; this form used to read ZERO of it. 'enroll_mfa' = the user has no usable
+ * second factor on this client, so a code prompt alone is a trap; 'mfa_verify' = a factor exists, the prompt is right.
+ * Anything else (absent, null, an unknown string, wrong case) is null = "not told", never a guess.
+ */
+export type NextStep = 'enroll_mfa' | 'mfa_verify' | null;
+export declare function readNextStep(body: any): NextStep;
+/**
+ * Where the browser goes after the code was accepted. A user the IdP told to enrol, who kept the offer ticked, goes to the
+ * enrolment page; everyone else goes where they were headed. The destination is never decided from anything but the IdP's
+ * answer and the user's own tick. With NO enrolHref (the host mounts no enrolment page) nobody is rerouted: there is no default, because
+ * a default that a host does not serve is a 404 after a successful sign-in (QAPert, PR 1687 read).
+ */
+export declare function postSignInDestination(destination: string, nextStep: NextStep, enrolAfter: boolean, enrolHref?: string): string;
 /** One call to the credential door. `code` is the 2FA code on the second turn; email and password are resubmitted with it. */
 export declare function credentialSignIn(args: {
     email: string;

package/dist/lib/credential-sign-in-client.js

@@ -3,6 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.NO_CODE_REQUEST = exports.MSG_EMAIL_CODE_FAILED = exports.MSG_UNEXPECTED = exports.MSG_CANNOT_SIGN_IN = exports.MSG_RATE_LIMITED = exports.CREDENTIAL_EMAIL_CODE_URL = exports.CREDENTIAL_LOGIN_URL = void 0;
 exports.isEmailShaped = isEmailShaped;
 exports.validateCredentials = validateCredentials;
+exports.readNextStep = readNextStep;
+exports.postSignInDestination = postSignInDestination;
 exports.credentialSignIn = credentialSignIn;
 exports.requestEmailCode = requestEmailCode;
 /**
@@ -22,9 +24,10 @@ exports.requestEmailCode = requestEmailCode;
  */
 const code_step_copy_1 = require("./code-step-copy");
 Object.defineProperty(exports, "NO_CODE_REQUEST", { enumerable: true, get: function () { return code_step_copy_1.NO_CODE_REQUEST; } });
+const sign_in_failure_1 = require("./sign-in-failure");
 exports.CREDENTIAL_LOGIN_URL = '/api/auth/admin-login';
 exports.CREDENTIAL_EMAIL_CODE_URL = '/api/auth/admin-login/email-code';
-exports.MSG_RATE_LIMITED = 'Too many attempts. Please try again later.';
+exports.MSG_RATE_LIMITED = sign_in_failure_1.SIGN_IN_FAILURE_COPY.too_many_attempts;
 exports.MSG_CANNOT_SIGN_IN = 'Could not sign in. Check your details and try again.';
 exports.MSG_UNEXPECTED = 'Something went wrong signing you in. Please try again.';
 const EMAIL_SHAPE = /^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/;
@@ -43,6 +46,19 @@ function validateCredentials(email, password) {
         errors.password = 'Enter your password.';
     return errors.email || errors.password ? errors : null;
 }
+function readNextStep(body) {
+    const v = body?.nextStep;
+    return v === 'enroll_mfa' || v === 'mfa_verify' ? v : null;
+}
+/**
+ * Where the browser goes after the code was accepted. A user the IdP told to enrol, who kept the offer ticked, goes to the
+ * enrolment page; everyone else goes where they were headed. The destination is never decided from anything but the IdP's
+ * answer and the user's own tick. With NO enrolHref (the host mounts no enrolment page) nobody is rerouted: there is no default, because
+ * a default that a host does not serve is a 404 after a successful sign-in (QAPert, PR 1687 read).
+ */
+function postSignInDestination(destination, nextStep, enrolAfter, enrolHref) {
+    return enrolHref && nextStep === 'enroll_mfa' && enrolAfter ? enrolHref : destination;
+}
 /** The dev echo: the door passes the IdP's DevVerificationCode through as `devVerificationCode`. Nothing else is ever a dev code. */
 function readDevCode(body) {
     return typeof body?.devVerificationCode === 'string' && body.devVerificationCode ? body.devVerificationCode : null;
@@ -59,17 +75,27 @@ async function credentialSignIn(args, fetchImpl = (input, init) => fetch(input,
             body: JSON.stringify({ email: args.email, password: args.password, code: args.code }),
         });
         const body = await res.json().catch(() => null);
-        if (res.status === 429)
-            return { kind: 'rate_limited', message: asString(body?.error) ?? exports.MSG_RATE_LIMITED };
+        // The sentence comes from the closed table, never from the body (BAPert 85415 rule 4).
+        if (res.status === 429) {
+            const code = body?.code === 'second_factor_rate_limited' ? 'second_factor_rate_limited' : 'too_many_attempts';
+            return { kind: 'rate_limited', message: (0, sign_in_failure_1.tooManyAttemptsMessage)(body?.retryAfter, code), code };
+        }
         if (body?.requiresTwoFactor)
-            return { kind: 'two_factor', codeRequest: (0, code_step_copy_1.readCodeRequest)(body), devCode: readDevCode(body) };
+            return { kind: 'two_factor', codeRequest: (0, code_step_copy_1.readCodeRequest)(body), devCode: readDevCode(body), nextStep: readNextStep(body) };
         if (!res.ok || body?.success !== true) {
-            return { kind: 'error', message: asString(body?.error) ?? exports.MSG_CANNOT_SIGN_IN, offerEmailCode: body?.offerEmailCode === true };
+            const offerEmailCode = body?.offerEmailCode === true;
+            if ((0, sign_in_failure_1.isSignInFailureCode)(body?.code))
+                return { kind: 'error', message: (0, sign_in_failure_1.signInFailureMessage)(body.code), code: body.code, offerEmailCode };
+            // The one passthrough: an allowlisted policy refusal (SsoRequired / InvalidRequest), flagged by the server with this exact code.
+            const policy = body?.code === 'policy_message' ? (0, sign_in_failure_1.capPolicyDetail)(body?.error) : null;
+            if (policy)
+                return { kind: 'error', message: policy, code: 'policy_message', offerEmailCode };
+            return { kind: 'error', message: exports.MSG_CANNOT_SIGN_IN, code: 'sign_in_failed', offerEmailCode };
         }
         return { kind: 'success' };
     }
     catch {
-        return { kind: 'error', message: exports.MSG_UNEXPECTED, offerEmailCode: false };
+        return { kind: 'error', message: exports.MSG_UNEXPECTED, code: 'sign_in_failed', offerEmailCode: false };
     }
 }
 exports.MSG_EMAIL_CODE_FAILED = 'We could not ask for an email code just now. Try again shortly.';

package/dist/lib/ensure-fresh-access-token.js

@@ -257,17 +257,18 @@ async function ensureFreshAccessToken(sessionToken, config, options = {}) {
             }
             catch { /* fall through */ }
         }
-        const isOAuthSession = !!session.oauthProvider;
-        if (authMethods.length === 0 && isOAuthSession) {
-            authMethods = ['pwd', 'mfa'];
-        }
+        // PAY-2425 (BAPert 77400, NightHawk 77401): THE CLIENT DOES NOT INFER AUTHENTICATION STRENGTH FROM SILENCE. This block used to answer an OAuth
+        // (Google) session whose stored methods were EMPTY with amr ['pwd','mfa'], a two-factor method of 'oauth' and an acr raised from '1' to '2' ("OAuth IS
+        // a form of multi-factor auth"). That is false: OAuth is federated sign-in, one factor typed at the provider. It fired exactly when the session
+        // could tell us nothing and answered with the strongest claim available; on prod (4.10.0) a Google user on a require2FA client was then counted
+        // 2FA-complete with no code (RigPert 77398). What the session does not attest, the refresh body does not assert: empty stays empty, the level stays
+        // the session's own, and no method is named unless one is recorded. The IdP computes the real amr/acr for the minted token (and mfaVerified is
+        // re-derived from THAT token below); a session that really attests 'mfa' still sends it. History: the fix existed on nextpert/375639-amr-fabrication
+        // (e6e3b6c3, e3b3bb12) and was never merged.
         const twoFactorMethod = authMethods.find(m => ['sms', 'totp', 'email'].includes(m)) ||
             session.mfaMethod ||
-            (isOAuthSession ? 'oauth' : null);
-        let acrValue = String(session.authenticationLevel ?? '1');
-        if (isOAuthSession && session.mfaVerified && acrValue === '1') {
-            acrValue = '2';
-        }
+            null;
+        const acrValue = String(session.authenticationLevel ?? '1');
         // WO-2: send the POST-lock current refresh token, not the pre-lock snapshot.
         // `session` was read before we acquired the lock; a concurrent refresh that
         // completed while we waited rotates the token, so the pre-lock value is stale
@@ -300,7 +301,11 @@ async function ensureFreshAccessToken(sessionToken, config, options = {}) {
             amr: authMethods,
             acr: acrValue,
         };
-        if (session.mfaVerified)
+        // PAY-2425 (NightHawk 77414): a STORED mfaVerified flag is only echoed when the session's own recorded methods back it. Sessions created while the
+        // bug was live carry mfaVerified:true that the bug itself wrote, with no 'mfa' (or sms/totp/email) in their methods; echoing that flag would carry the
+        // poison across the upgrade. A genuine second factor leaves 'mfa' and its method in the recorded methods, so it is still sent.
+        const methodsAttestSecondFactor = authMethods.some(m => m === 'mfa' || ['sms', 'totp', 'email'].includes(m));
+        if (session.mfaVerified && methodsAttestSecondFactor)
             body.two_factor_verified = true;
         if (twoFactorMethod)
             body.two_factor_method = twoFactorMethod;

package/dist/lib/idp-client-config.js

@@ -82,6 +82,7 @@ exports.getEnabledProviders = getEnabledProviders;
 require("server-only");
 const crypto_1 = require("crypto");
 const never_in_response_1 = require("./never-in-response");
+const payez_client_secret_1 = require("./payez-client-secret");
 const log_safe_1 = require("./log-safe");
 // REDIS IS IMPORTED LAZILY, AND THAT IS LOAD-BEARING.
 // A module-scope `import redis from './redis'` drags ioredis into EVERY bundle that
@@ -691,6 +692,7 @@ async function fetchConfigFromIDP(idpUrl, clientIdStr) {
             subject: clientIdStr,
             audience: 'urn:payez:externalauth:clientconfig',
             expires_in: 60,
+            ...(0, payez_client_secret_1.clientSecretBody)(),
         };
         const signingResp = await fetch(signingUrl, {
             method: 'POST',
@@ -731,7 +733,7 @@ async function fetchConfigFromIDP(idpUrl, clientIdStr) {
                 'X-Client-Id': clientIdStr,
                 'X-Correlation-Id': (0, crypto_1.randomUUID)().replace(/-/g, ''),
             },
-            body: JSON.stringify({ client_assertion }),
+            body: JSON.stringify({ client_assertion, ...(0, payez_client_secret_1.clientSecretBody)() }),
             cache: 'no-store'
         });
         if (!configResp.ok) {
@@ -839,6 +841,7 @@ async function fetchConfigFromIDP(idpUrl, clientIdStr) {
             // silently substitutes a public constant for an empty secret.
             throw new Error('[IDP_CONFIG] FATAL: authSecret is empty after parsing and neither BETTER_AUTH_SECRET nor NEXTAUTH_SECRET is set');
         }
+        (0, payez_client_secret_1.warnIfProviderSecretRedacted)(configResp.headers?.get?.('X-PayEz-Secrets-Redacted'), config.oauthProviders ?? [], providerSecretEnvVar);
         // Success - reset failure tracking
         consecutiveFailures = 0;
         return config;

package/dist/lib/login-error-message.d.ts

@@ -8,6 +8,7 @@
  * text on the login page (content spoofing / phishing). Known codes get their sentence; anything else gets one generic
  * sentence; nothing from the URL is ever shown verbatim.
  */
+import { type SignInFailureCode } from './sign-in-failure';
 export declare const GENERIC_LOGIN_ERROR = "We could not sign you in. Please try again.";
 /**
  * The sentence for `?error=<code>`, or null when nothing should be shown.
@@ -16,3 +17,5 @@ export declare const GENERIC_LOGIN_ERROR = "We could not sign you in. Please try
 export declare function friendlyLoginError(code: string | null | undefined): string | null;
 /** `?oauth_error=<provider>`: only a plain provider-like slug is echoed (capitalised); anything else is the generic sentence. */
 export declare function oauthFailureMessage(provider: string | null | undefined): string | null;
+/** The machine code (data-error-code) for a `?error=` code, or null when it has none in the closed table. Nothing from the URL is echoed. */
+export declare function loginErrorCode(code: string | null | undefined): SignInFailureCode | null;

package/dist/lib/login-error-message.js

@@ -13,12 +13,19 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.GENERIC_LOGIN_ERROR = void 0;
 exports.friendlyLoginError = friendlyLoginError;
 exports.oauthFailureMessage = oauthFailureMessage;
+exports.loginErrorCode = loginErrorCode;
+const sign_in_failure_1 = require("./sign-in-failure");
 exports.GENERIC_LOGIN_ERROR = 'We could not sign you in. Please try again.';
 const KNOWN = {
     TwoFactorTimeout: 'Your verification step timed out before the code was confirmed. Please sign in again.',
     AUTHORIZE_RESUME_REFUSED: 'That sign-in request could not be continued. Please sign in again.',
+    // PAY-2279 / PAY-2005(b): the one IdP refusal code the abort path forwards (IDP_ERROR_CODES_TO_FORWARD). Wording is the card's proposal.
+    // (OAUTH_SIGN_IN_FAILED has no sentence in THIS change: PR 1606 (PAY-2554) owns that code's redirect and its sentence; once both land the map carries both.)
+    REGISTRATION_NOT_ALLOWED: 'Registration is not open for this site. Ask your administrator for an invitation.',
     ServiceUnavailable: 'Authentication service is temporarily unavailable. Please try again in a few minutes.',
-    CredentialsSignin: 'Invalid email or password. Please try again.',
+    CredentialsSignin: sign_in_failure_1.SIGN_IN_FAILURE_COPY.invalid_credentials,
+    // PAY-2554: the neutral code the OAuth callback failure / state-error / aborted-exchange redirects carry (better-auth.ts OAUTH_SIGN_IN_FAILED_ERROR).
+    OAUTH_SIGN_IN_FAILED: "Sign-in didn't complete. Please try again, or use email.",
 };
 /**
  * The sentence for `?error=<code>`, or null when nothing should be shown.
@@ -45,3 +52,7 @@ function oauthFailureMessage(provider) {
         return exports.GENERIC_LOGIN_ERROR;
     return `${provider.charAt(0).toUpperCase()}${provider.slice(1)} sign-in did not complete. Please try again.`;
 }
+/** The machine code (data-error-code) for a `?error=` code, or null when it has none in the closed table. Nothing from the URL is echoed. */
+function loginErrorCode(code) {
+    return code === 'CredentialsSignin' ? 'invalid_credentials' : null;
+}

package/dist/lib/mfa-json-guard.d.ts

@@ -0,0 +1,12 @@
+import { NextRequest, NextResponse } from 'next/server';
+/**
+ * PAY-2631: the TOTP enrol/confirm handlers forward the browser body verbatim, so a cross-site form post
+ * (Content-Type text/plain, application/x-www-form-urlencoded) could reach them. A browser cannot send
+ * application/json cross-site without a CORS preflight, so requiring it closes that path.
+ * The responses carry the shared secret and the otpauth URI, so they are never cached.
+ */
+export declare const NO_STORE: {
+    readonly 'Cache-Control': "no-store";
+};
+/** A 415 response when the request is not application/json, otherwise null. */
+export declare function refuseNonJson(req: NextRequest): NextResponse | null;

package/dist/lib/mfa-json-guard.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NO_STORE = void 0;
+exports.refuseNonJson = refuseNonJson;
+const server_1 = require("next/server");
+/**
+ * PAY-2631: the TOTP enrol/confirm handlers forward the browser body verbatim, so a cross-site form post
+ * (Content-Type text/plain, application/x-www-form-urlencoded) could reach them. A browser cannot send
+ * application/json cross-site without a CORS preflight, so requiring it closes that path.
+ * The responses carry the shared secret and the otpauth URI, so they are never cached.
+ */
+exports.NO_STORE = { 'Cache-Control': 'no-store' };
+/** A 415 response when the request is not application/json, otherwise null. */
+function refuseNonJson(req) {
+    const ct = (req.headers.get('content-type') || '').toLowerCase();
+    if (ct.split(';')[0].trim() === 'application/json')
+        return null;
+    return server_1.NextResponse.json({ success: false, message: 'Content-Type must be application/json', error: { code: 'UNSUPPORTED_MEDIA_TYPE' } }, { status: 415, headers: exports.NO_STORE });
+}

package/dist/lib/nextauth-secret.js

@@ -45,6 +45,7 @@ exports.resolveNextAuthSecret = resolveNextAuthSecret;
 require("server-only");
 const node_crypto_1 = require("node:crypto");
 const secret_validation_1 = require("./secret-validation");
+const payez_client_secret_1 = require("./payez-client-secret");
 let cachedSecret = null;
 let lastFetchedAt = 0;
 const CACHE_TTL_MS = 5 * 60 * 1000;
@@ -88,6 +89,7 @@ async function resolveNextAuthSecret() {
             subject: clientIdStr,
             audience: 'urn:payez:externalauth:nextauthsecret',
             expires_in: 60,
+            ...(0, payez_client_secret_1.clientSecretBody)(),
         }),
         cache: 'no-store',
     });
@@ -115,7 +117,7 @@ async function resolveNextAuthSecret() {
             'X-Client-Id': clientIdStr,
             'X-Correlation-Id': (0, node_crypto_1.randomUUID)().replace(/-/g, ''),
         },
-        body: JSON.stringify({ client_assertion: clientAssertion }),
+        body: JSON.stringify({ client_assertion: clientAssertion, ...(0, payez_client_secret_1.clientSecretBody)() }),
         cache: 'no-store',
     });
     if (!proxyResp.ok) {

package/dist/lib/payez-client-secret.d.ts

@@ -0,0 +1,14 @@
+export declare const CLIENT_SECRET_ENV = "PAYEZ_CLIENT_SECRET";
+/** `{ client_secret }` when the env var is set to a non-blank value, else `{}`. Spread it into a JSON body. */
+export declare function clientSecretBody(): {
+    client_secret?: string;
+};
+/**
+ * The IdP marks a view whose secrets it withheld with the response header X-PayEz-Secrets-Redacted: true. An app with no
+ * <PROVIDER>_CLIENT_SECRET in env then boots and the provider fails at the code exchange. Say so, once per provider per
+ * process, naming the provider only.
+ */
+export declare function warnIfProviderSecretRedacted(redactedHeader: string | null | undefined, providers: ReadonlyArray<{
+    provider: string;
+    enabled?: boolean;
+}>, envVarFor: (provider: string) => string): void;

package/dist/lib/payez-client-secret.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CLIENT_SECRET_ENV = void 0;
+exports.clientSecretBody = clientSecretBody;
+exports.warnIfProviderSecretRedacted = warnIfProviderSecretRedacted;
+/**
+ * PAY-1460 (BAPert 86061): the app's own client secret, so the IdP can tell this app from a caller that merely knows its
+ * client id. One env var per app, PAYEZ_CLIENT_SECRET, read at CALL time (not a module-load snapshot: the deployment may
+ * inject it late). Unset or blank: NOTHING is added to any request body, so an app that has no secret yet sends exactly
+ * what it sent before. The value is never logged and never leaves in a response (markNeverInResponse).
+ */
+const never_in_response_1 = require("./never-in-response");
+exports.CLIENT_SECRET_ENV = 'PAYEZ_CLIENT_SECRET';
+/** `{ client_secret }` when the env var is set to a non-blank value, else `{}`. Spread it into a JSON body. */
+function clientSecretBody() {
+    const v = process.env[exports.CLIENT_SECRET_ENV];
+    if (typeof v !== 'string' || v.trim() === '')
+        return {};
+    (0, never_in_response_1.markNeverInResponse)(v);
+    return { client_secret: v };
+}
+const warnedProviders = new Set();
+/**
+ * The IdP marks a view whose secrets it withheld with the response header X-PayEz-Secrets-Redacted: true. An app with no
+ * <PROVIDER>_CLIENT_SECRET in env then boots and the provider fails at the code exchange. Say so, once per provider per
+ * process, naming the provider only.
+ */
+function warnIfProviderSecretRedacted(redactedHeader, providers, envVarFor) {
+    if (String(redactedHeader ?? '').trim().toLowerCase() !== 'true')
+        return;
+    for (const p of providers) {
+        if (!p.enabled || !p.provider)
+            continue;
+        if (process.env[envVarFor(p.provider)])
+            continue;
+        if (warnedProviders.has(p.provider))
+            continue;
+        warnedProviders.add(p.provider);
+        console.warn(`[IDP_CONFIG] PAYEZ_PROVIDER_SECRET_MISSING_REDACTED provider=${p.provider}`);
+    }
+}

package/dist/lib/qrcode.d.ts

@@ -0,0 +1,22 @@
+/**
+ * qrcode.ts — minimal QR Code generator (byte mode, ECC level M), a
+ * TypeScript port of Nayuki's qrcodegen (MIT) trimmed to what TOTP
+ * otpauth:// URIs need. Renders to an SVG path string (no library, no
+ * canvas) — D3 MFA page generates the QR client-side per contract
+ * (fe-be-contract §D3.1: "no BE QR image needed").
+ *
+ * Cross-checked bit-exact against python `qrcode` (see D3 day-end report).
+ * PAY-2631: copied verbatim from VibeID-Customer-Portal src/lib/qrcode.ts so the generated app draws the QR itself:
+ * the TOTP secret is never sent to a third-party QR service.
+ */
+export interface QrMatrix {
+    size: number;
+    modules: boolean[][];
+}
+export declare function debugFinalBytes(text: string): {
+    version: number;
+    bytes: number[];
+};
+export declare function encodeQr(text: string, maskOverride?: number): QrMatrix;
+/** Render to an SVG path (dark modules as 1x1 squares). */
+export declare function qrToSvgPath(qr: QrMatrix): string;