@payez/next-mvp 4.12.1 → 4.13.0

package/src/pages/enroll/page.tsx

@@ -0,0 +1,22 @@
+'use client';
+
+import React from 'react';
+import { TotpEnrollPanel } from '../../components/mfa/TotpEnrollPanel';
+
+/**
+ * PAY-2631: /account-auth/enroll in a generated app. The page SHELL is public (every /account-auth/* path is public by default);
+ * what needs a session is each action: enrol and confirm answer 401 without one and the panel then says to sign in (measured on a
+ * scaffolded app: POST enrol with no cookie -> 401, no secret in the body). The scaffold lists the path on the 2FA bypass list
+ * because public routes still redirect a 2FA-incomplete session to verify-code, which sends enroll_mfa users back here: a loop.
+ */
+export default function EnrollPage() {
+  return (
+    <main style={{ maxWidth: 480, margin: '48px auto', padding: '0 16px' }}>
+      <h1>Set up an authenticator app</h1>
+      <TotpEnrollPanel />
+      <p style={{ marginTop: 24 }}>
+        <a href="/">Continue to the app</a>
+      </p>
+    </main>
+  );
+}

package/src/pages/login/page.tsx

@@ -29,7 +29,7 @@ import { Suspense } from 'react';
 import ReservedStatusBox from '../../components/reserved/ReservedStatusBox';
 import ReservedRecoveryWarning from '../../components/reserved/ReservedRecoveryWarning';
 import { useBranding, useColors, useLayout } from '../../theme/useTheme';
-import { friendlyLoginError, oauthFailureMessage } from '../../lib/login-error-message';
+import { friendlyLoginError, loginErrorCode, oauthFailureMessage } from '../../lib/login-error-message';
 
 function LoginForm({ altAuthSlot }: { altAuthSlot?: React.ReactNode }) {
   const searchParams = useSearchParams();
@@ -226,6 +226,7 @@ function LoginForm({ altAuthSlot }: { altAuthSlot?: React.ReactNode }) {
             <div
               role="alert"
               data-testid="login-error"
+              data-error-code={loginError === undefined ? (loginErrorCode(urlError) ?? undefined) : undefined}
               className="mb-6 rounded-lg border border-red-200 bg-red-50 px-4 py-3 text-sm text-red-700"
             >
               {shownError}

package/src/routes/auth/session-reset.ts

@@ -20,18 +20,53 @@ import { NextRequest, NextResponse } from 'next/server';
 import { isPrefetchRequest } from '../../middleware/create-middleware';
 import { expireSessionCookies } from '../../auth/session-cookie-clear';
 import { getSessionCookieName, getSecureSessionCookieName } from '../../lib/app-slug';
-import { boundSessionCookie, loginLocation, readResetRequest, resetSecret } from '../../auth/session-reset-link';
+import { boundSessionCookie, loginLocation, readResetRequest, readResetRequestAnyKey, resetSecret } from '../../auth/session-reset-link';
 
 export const dynamic = 'force-dynamic';
 
-export async function GET(request: NextRequest): Promise<NextResponse> {
-  if (isPrefetchRequest(request)) {
-    return new NextResponse(null, { status: 204, headers: { 'cache-control': 'no-store' } });
-  }
-  const bound = boundSessionCookie((n) => request.cookies.get(n)?.value, getSessionCookieName(), getSecureSessionCookieName());
-  const { params, signed } = await readResetRequest(request.nextUrl.searchParams, resetSecret(), bound);
-  const response = NextResponse.redirect(new URL(loginLocation(params), request.url), 307);
-  response.headers.set('cache-control', 'no-store');
-  if (signed) expireSessionCookies(response, Array.from(request.cookies, ([name]) => name));
-  return response;
+export interface SessionResetOptions {
+  /**
+   * PAY-2218 opt-in, OFF by default (BAPert 83102). OFF: only a link signed with the env secret (BETTER_AUTH_SECRET / NEXTAUTH_SECRET) clears, so every app that can
+   * see the secret stays strict. ON: a link signed with the key derived from this request's own session cookie also clears. Turn it on only where the EDGE middleware
+   * cannot see the env secret, and set `sessionResetCookieKey: true` on createMvpMiddleware too, or the route refuses the link the middleware signed.
+   */
+  cookieKey?: boolean;
 }
+
+export function createSessionResetHandler(options: SessionResetOptions = {}) {
+  const cookieKey = options.cookieKey === true;
+  let splitLogged = false;
+  let halfSetLogged = false;
+  return async function GET(request: NextRequest): Promise<NextResponse> {
+    if (isPrefetchRequest(request)) {
+      return new NextResponse(null, { status: 204, headers: { 'cache-control': 'no-store' } });
+    }
+    const bound = boundSessionCookie((n) => request.cookies.get(n)?.value, getSessionCookieName(), getSecureSessionCookieName());
+    const env = resetSecret();
+    const { params, signed, via } = cookieKey
+      ? await readResetRequestAnyKey(request.nextUrl.searchParams, env, bound)
+      : { ...(await readResetRequest(request.nextUrl.searchParams, env, bound)), via: null as 'env' | 'cookie' | null };
+    // The dev-93 prefetch walk reads this line: a link that verified ONLY with the cookie-derived key while this route sees the env secret is the
+    // edge-blind / route-sighted split deployment. Once per process, no values.
+    if (cookieKey && signed && via === 'cookie' && env && !splitLogged) {
+      splitLogged = true;
+      console.info('[next-mvp] session-reset: a link verified with the cookie-derived key while the env secret is visible to this route (the edge middleware signed without it: split deployment)');
+    }
+    // HALF-SET (NightHawk 83161): this route is strict (cookieKey OFF) but the middleware signed with the cookie-derived key (sessionResetCookieKey ON). The link is refused
+    // and the stale cookie survives. Probe ONLY refused links, for the cookie-derived key alone, and say so once per process. No values.
+    if (!cookieKey && !signed && !halfSetLogged) {
+      const probe = await readResetRequestAnyKey(request.nextUrl.searchParams, undefined, bound);
+      if (probe.signed) {
+        halfSetLogged = true;
+        console.warn('[next-mvp] session-reset: refused a link signed with the cookie-derived key because this route has cookieKey OFF; the middleware has sessionResetCookieKey ON. Set createSessionResetHandler({ cookieKey: true }) or turn the middleware option off');
+      }
+    }
+    const response = NextResponse.redirect(new URL(loginLocation(params), request.url), 307);
+    response.headers.set('cache-control', 'no-store');
+    if (signed) expireSessionCookies(response, Array.from(request.cookies, ([name]) => name));
+    return response;
+  };
+}
+
+/** The strict default: env-signed links only. An app that opted in uses createSessionResetHandler({ cookieKey: true }). */
+export const GET = createSessionResetHandler();

package/src/routes/auth/viability.ts

@@ -199,6 +199,9 @@ export async function GET(req: NextRequest) {
     // stack just resolved the cookie cleanly. Keeps the two viability impls
     // (this route + `api-handlers/session/viability.ts`) in lockstep.
     let session = sessionToken ? await getRedisSession(sessionToken) : null;
+    // PAY-2467: a row read from the CANONICAL store is the raw JSON the callback wrote, so an `mfaVerified` boolean on it is a
+    // MEASUREMENT (an absent key is a legacy row). Only the BA-record fallback collapses absent to false and needs mfaSignalPresent.
+    const fromCanonicalStore = !!session;
     if (sessionToken && !session) {
       session = await getBetterAuthRedisSession(sessionToken);
       if (session) {
@@ -294,9 +297,14 @@ export async function GET(req: NextRequest) {
      * it names TENANT policy, and this override is not tenant state.
      */
     const oauthSessionNeedsTwoFactor =
-      session?.mfaSignalPresent === true &&
+      // PAY-2467: the signal is present on the BA-fallback path (mfaSignalPresent) OR when the canonical row itself carries a boolean.
+      // Before this, the override was dead on the canonical path every consumer mounts, so gating rested on tenant config alone.
+      (session?.mfaSignalPresent === true || (fromCanonicalStore && typeof session?.mfaVerified === 'boolean')) &&
       session?.mfaVerified === false &&
-      !(session.idpRefreshToken || (session as any)?.refreshToken);
+      !(session.idpRefreshToken || (session as any)?.refreshToken) &&
+      // An IdP DISCARD (refresh.ts / ensure-fresh-access-token.ts write idpRefreshToken '' with refreshTokenClearedReason 'IDP_DISCARD_TOKEN:<code>') leaves
+      // mfaVerified false and no refresh token too, but that is a DEAD session, not a pending second factor: it must not be sent to verify-code (QAPert 84816).
+      !String((session as any)?.refreshTokenClearedReason ?? '').startsWith('IDP_DISCARD_TOKEN');
 
     // --- Session revocation status (PAY-1882 step 4 producer half) ---
     /*