@payez/next-mvp 4.12.1 → 4.13.1

package/dist/auth/better-auth.js

@@ -57,6 +57,7 @@ exports.exchangeOAuthForIdpTokens = exchangeOAuthForIdpTokens;
 exports.storeIdpTokensInSession = storeIdpTokensInSession;
 exports.storePayezIdpSession = storePayezIdpSession;
 exports.expireSetCookies = expireSetCookies;
+exports.authErrorCodeFromLocation = authErrorCodeFromLocation;
 exports.createAuthGetHandler = createAuthGetHandler;
 require("server-only");
 const node_async_hooks_1 = require("node:async_hooks");
@@ -77,6 +78,10 @@ const single_flight_1 = require("../lib/single-flight");
 const session_store_1 = require("../lib/session-store");
 const token_log_id_1 = require("../lib/token-log-id");
 const log_safe_1 = require("../lib/log-safe");
+const better_auth_exposure_1 = require("./better-auth-exposure");
+const no_store_1 = require("../lib/no-store");
+/** PAY-2592: the magic-link advisory warning fires once per process. */
+let magicLinkAdvisoryWarned = false;
 /**
  * 185121: short sha256 fingerprint for secrets/tokens in log lines — enough
  * to tell "same" from "divergent", never enough to reconstruct. 12 hex chars
@@ -488,6 +493,12 @@ function buildBetterAuthProviders(config) {
 function createBetterAuthInstance(idpConfig, opts = {}) {
     (0, app_slug_1.assertAppSlugMatchesIdp)(idpConfig.clientSlug);
     const appSlug = idpConfig.clientSlug || (0, app_slug_1.getAppSlug)();
+    // PAY-2592 (GHSA-965c-763c-88jm): a consumer that enables the magic-link plugin on a better-auth below 1.7.7 is told, once per process. What keeps the
+    // package unexposed is account.storeStateStrategy='cookie' below plus the plugin being opt-in; see better-auth-exposure.ts.
+    if (opts.magicLink && !magicLinkAdvisoryWarned) {
+        magicLinkAdvisoryWarned = true;
+        (0, better_auth_exposure_1.warnIfMagicLinkBelowFix)(true);
+    }
     // 185121 line 1: name the secret this instance PINNED, as a hash, never the
     // secret. 183047's surviving fork is HMAC-fail vs record-miss; an HMAC-fail
     // caused by a divergent secret is only diagnosable if every instance
@@ -1376,6 +1387,20 @@ async function abortOAuthSignIn(callbackResponse, sessionToken, cookieHeader, lo
     console.warn('[BETTER_AUTH] OAuth sign-in ABORTED: the IdP exchange stored no tokens, so no session is kept (PAY-1733)', sessionToken ? (0, token_log_id_1.tokenLogId)(sessionToken) : '(no session)', 'code=' + errorCode);
     return new Response(null, { status: 302, headers });
 }
+/**
+ * PAY-2568: the Better Auth error code of an /api/auth/error redirect (`?error=<code>`), or null when absent or not a plain
+ * token. The value rides a URL, so only a short [A-Za-z0-9_.-] token is ever returned for logging. Location may be relative
+ * or absolute; the base is a placeholder used only for parsing.
+ */
+function authErrorCodeFromLocation(location) {
+    try {
+        const code = new URL(location, 'http://placeholder.invalid').searchParams.get('error');
+        return code && /^[A-Za-z0-9_.-]{1,64}$/.test(code) ? code : null;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Create a production-ready GET handler for the auth catch-all route.
  *
@@ -1395,7 +1420,7 @@ async function abortOAuthSignIn(callbackResponse, sessionToken, cookieHeader, lo
  * ```
  */
 function createAuthGetHandler(loginPath = '/account-auth/login') {
-    return async function GET(request) {
+    const get = async function GET(request) {
         // Card 138635: establish the request-scoped carrier for the provider's raw
         // id_token. It must wrap BOTH ba.GET (which invokes getUserInfo, the only
         // hook that sees the token) and the exchange below (which forwards it).
@@ -1411,7 +1436,16 @@ function createAuthGetHandler(loginPath = '/account-auth/login') {
             if (response.status === 302) {
                 const location = response.headers.get('location') || '';
                 if (location.includes('/api/auth/error') || location.includes('please_restart')) {
-                    console.warn('[BETTER_AUTH] OAuth state error, redirecting to login');
+                    // PAY-2568: log WHICH error. Better Auth routes every callback failure to /api/auth/error?error=<code>
+                    // (signup_disabled, state_mismatch, ...); the old fixed 'OAuth state error' sentence made distinct faults
+                    // look identical. Only the code is logged - never the Location (it can carry other params).
+                    const authErrorCode = authErrorCodeFromLocation(location);
+                    if (authErrorCode) {
+                        console.warn('[BETTER_AUTH] auth error code=' + authErrorCode + ', redirecting to login');
+                    }
+                    else {
+                        console.warn('[BETTER_AUTH] OAuth state error, redirecting to login');
+                    }
                     // *** DO NOT "TIDY" THIS BACK TO Response.redirect(). IT THROWS. (328439) ***
                     // Response.redirect() REQUIRES an absolute URL — measured, on the leg's own
                     // runtime and again on node 24:
@@ -1448,7 +1482,10 @@ function createAuthGetHandler(loginPath = '/account-auth/login') {
                     // Works whether loginPath is relative (package default '/account-auth/login',
                     // and the graft passes '/sign-in') or absolute — an absolute Location is also
                     // legal, so a consumer passing a full URL still behaves.
-                    return new Response(null, { status: 302, headers: { location: loginPath } });
+                    // PAY-2554: the redirect used to carry NO code, so the login page showed nothing and looked like nothing happened.
+                    // It now carries the same neutral OAUTH_SIGN_IN_FAILED the abort path uses (the login page maps it to one sentence;
+                    // no provider text, URL or internal detail goes on the URL).
+                    return new Response(null, { status: 302, headers: { location: `${loginPath}${loginPath.includes('?') ? '&' : '?'}error=${exports.OAUTH_SIGN_IN_FAILED_ERROR}` } });
                 }
             }
             // After the OAuth callback: exchange the provider identity for IDP tokens. If that does NOT store tokens - the
@@ -1496,4 +1533,6 @@ function createAuthGetHandler(loginPath = '/account-auth/login') {
             return response;
         });
     };
+    // PAY-2994: every Better Auth GET answer (session, OAuth callbacks, redirects) is per-user and may set cookies; never cached.
+    return (0, no_store_1.noStore)(get);
 }

package/dist/auth/route-config.js

@@ -75,6 +75,15 @@ const defaultUnauthenticatedRoutes = [
         allowDuringCircuitBreakerOpen: true,
         requiresRateLimit: false
     },
+    {
+        // PAY-2804: the exact path. '/api/health/*' matches startsWith('/api/health/'), which the bare
+        // '/api/health' (the ALB check) does not, so without this entry it sat behind sign-in.
+        pattern: '/api/health',
+        description: 'Health check endpoint (ALB target; anonymous, state only)',
+        allowDuringCircuitBreakerOpen: true,
+        // An ALB check comes from few IPs: a rate limit here would answer 429 and get tasks pulled (NightHawk 89179).
+        requiresRateLimit: false
+    },
     {
         pattern: '/api/health/*',
         description: 'Health check endpoints',

package/dist/auth/session-reset-link.d.ts

@@ -15,6 +15,26 @@ export interface ResetParams {
 }
 /** The secret the app already signs its session cookie with. Undefined means "cannot sign": callers fall back. */
 export declare function resetSecret(): string | undefined;
+/**
+ * The domain-separation label for the cookie-derived FALLBACK key (PAY-2218, BAPert 83028). It is the only place the session cookie is used as
+ * key material, and it is never the raw SHA-256 of the cookie (that is the binding, a different value for a different purpose).
+ */
+export declare const RESET_COOKIE_KEY_CONTEXT = "payez:session-reset:v1:cookie-derived";
+/**
+ * The secret the reset link is signed and verified with.
+ *
+ *  1. The env secret (BETTER_AUTH_SECRET / NEXTAUTH_SECRET) when the edge can see it. ALWAYS FIRST: where it is present nothing changes.
+ *  2. Otherwise a key derived from the session cookie the link is bound to: HMAC(key = cookie value, message = RESET_COOKIE_KEY_CONTEXT).
+ *     Why that is safe: the cookie is HttpOnly and is the user's credential, so a third-party page that links a victim to the route cannot
+ *     produce a valid signature (the logout-CSRF protection the signature exists for), and anyone who holds the cookie can already act as
+ *     the user, logging out included. The edge holds only a one-way value computed per request from a cookie it already received.
+ *     RESIDUAL RISK, ACCEPTED (BAPert 83028): an attacker who controls a sibling subdomain can plant a cookie value they know under the
+ *     session cookie name and sign a link that clears THAT value. The effect is a forced logout, and an attacker in that position can already
+ *     set or shadow cookies and log the victim out, so the scheme adds no capability.
+ *  3. Neither: undefined ("cannot sign"; callers fall back to the direct clear).
+ * Never log the cookie value or the returned key.
+ */
+export declare function resetSigningSecret(envSecret: string | undefined, sessionCookieValue: string | undefined): Promise<string | undefined>;
 /** The session cookie a reset is bound to: the __Secure- one when present, else the plain one. */
 export declare function boundSessionCookie(get: (name: string) => string | undefined, plainName: string, secureName: string): string | undefined;
 /** Normalise to exactly what the route will honour, so what is signed is what is verified. */
@@ -32,6 +52,18 @@ export declare function loginLocation(p: ResetParams): string;
  * `nowMs` is injectable for tests.
  */
 export declare function signedResetHref(route: string, p: ResetParams, secret: string, sessionCookieValue: string | undefined, nowMs?: number): Promise<string>;
+/**
+ * VERIFY side, ONLY for an app that opted in (sessionResetCookieKey + createSessionResetHandler({ cookieKey: true }); BAPert 83102). PAY-2218, BAPert 83074 option a: the signer and the verifier can see different things. The edge middleware may be BLIND to the env
+ * secret (it signs cookie-derived) while the Node route handler is SIGHTED (the IdP-supplied secret is in its process.env). So the route accepts a link
+ * signed with EITHER sound key: the env secret first (when it has one), then the key derived from THIS request's session cookie. Both are sound: the
+ * cookie-derived link is still bound to the request's own session cookie, carries its expiry inside the MAC, and is compared in constant time. A link
+ * signed with neither key, or with a key derived from a different cookie, is refused.
+ */
+export declare function readResetRequestAnyKey(search: URLSearchParams, envSecret: string | undefined, sessionCookieValue: string | undefined, nowMs?: number): Promise<{
+    params: ResetParams;
+    signed: boolean;
+    via: 'env' | 'cookie' | null;
+}>;
 /**
  * Read a reset request's query. `signed` is true only for a valid, unexpired signature over the normalised params AND
  * this request's own session cookie (`sessionCookieValue`). With no session cookie there is nothing to clear: false.

package/dist/auth/session-reset-link.js

@@ -1,12 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RESET_ERRORS = exports.RESET_REASONS = exports.RESET_KEY_PURPOSE = exports.RESET_LINK_TTL_SECONDS = exports.DEFAULT_SESSION_RESET_ROUTE = exports.LOGIN_PAGE = void 0;
+exports.RESET_COOKIE_KEY_CONTEXT = exports.RESET_ERRORS = exports.RESET_REASONS = exports.RESET_KEY_PURPOSE = exports.RESET_LINK_TTL_SECONDS = exports.DEFAULT_SESSION_RESET_ROUTE = exports.LOGIN_PAGE = void 0;
 exports.resetSecret = resetSecret;
+exports.resetSigningSecret = resetSigningSecret;
 exports.boundSessionCookie = boundSessionCookie;
 exports.normaliseResetParams = normaliseResetParams;
 exports.resetPayload = resetPayload;
 exports.loginLocation = loginLocation;
 exports.signedResetHref = signedResetHref;
+exports.readResetRequestAnyKey = readResetRequestAnyKey;
 exports.readResetRequest = readResetRequest;
 /**
  * PAY-2218 PR 2: the hand-off between the middleware and the session-reset route.
@@ -85,6 +87,32 @@ function sameString(a, b) {
 function resetSecret() {
     return process.env.BETTER_AUTH_SECRET || process.env.NEXTAUTH_SECRET || undefined;
 }
+/**
+ * The domain-separation label for the cookie-derived FALLBACK key (PAY-2218, BAPert 83028). It is the only place the session cookie is used as
+ * key material, and it is never the raw SHA-256 of the cookie (that is the binding, a different value for a different purpose).
+ */
+exports.RESET_COOKIE_KEY_CONTEXT = 'payez:session-reset:v1:cookie-derived';
+/**
+ * The secret the reset link is signed and verified with.
+ *
+ *  1. The env secret (BETTER_AUTH_SECRET / NEXTAUTH_SECRET) when the edge can see it. ALWAYS FIRST: where it is present nothing changes.
+ *  2. Otherwise a key derived from the session cookie the link is bound to: HMAC(key = cookie value, message = RESET_COOKIE_KEY_CONTEXT).
+ *     Why that is safe: the cookie is HttpOnly and is the user's credential, so a third-party page that links a victim to the route cannot
+ *     produce a valid signature (the logout-CSRF protection the signature exists for), and anyone who holds the cookie can already act as
+ *     the user, logging out included. The edge holds only a one-way value computed per request from a cookie it already received.
+ *     RESIDUAL RISK, ACCEPTED (BAPert 83028): an attacker who controls a sibling subdomain can plant a cookie value they know under the
+ *     session cookie name and sign a link that clears THAT value. The effect is a forced logout, and an attacker in that position can already
+ *     set or shadow cookies and log the victim out, so the scheme adds no capability.
+ *  3. Neither: undefined ("cannot sign"; callers fall back to the direct clear).
+ * Never log the cookie value or the returned key.
+ */
+async function resetSigningSecret(envSecret, sessionCookieValue) {
+    if (envSecret)
+        return envSecret;
+    if (!sessionCookieValue)
+        return undefined;
+    return b64url(await hmacBytes(encoder.encode(sessionCookieValue), exports.RESET_COOKIE_KEY_CONTEXT));
+}
 /** The session cookie a reset is bound to: the __Secure- one when present, else the plain one. */
 function boundSessionCookie(get, plainName, secureName) {
     return get(secureName) || get(plainName) || undefined;
@@ -126,6 +154,22 @@ async function signedResetHref(route, p, secret, sessionCookieValue, nowMs = Dat
     q.set('sig', await sign(secret, resetPayload(p, exp, await sessionBinding(sessionCookieValue))));
     return `${route}?${q.toString()}`;
 }
+/**
+ * VERIFY side, ONLY for an app that opted in (sessionResetCookieKey + createSessionResetHandler({ cookieKey: true }); BAPert 83102). PAY-2218, BAPert 83074 option a: the signer and the verifier can see different things. The edge middleware may be BLIND to the env
+ * secret (it signs cookie-derived) while the Node route handler is SIGHTED (the IdP-supplied secret is in its process.env). So the route accepts a link
+ * signed with EITHER sound key: the env secret first (when it has one), then the key derived from THIS request's session cookie. Both are sound: the
+ * cookie-derived link is still bound to the request's own session cookie, carries its expiry inside the MAC, and is compared in constant time. A link
+ * signed with neither key, or with a key derived from a different cookie, is refused.
+ */
+async function readResetRequestAnyKey(search, envSecret, sessionCookieValue, nowMs = Date.now()) {
+    if (envSecret) {
+        const viaEnv = await readResetRequest(search, envSecret, sessionCookieValue, nowMs);
+        if (viaEnv.signed)
+            return { ...viaEnv, via: 'env' };
+    }
+    const viaCookie = await readResetRequest(search, await resetSigningSecret(undefined, sessionCookieValue), sessionCookieValue, nowMs);
+    return { ...viaCookie, via: viaCookie.signed ? 'cookie' : null };
+}
 /**
  * Read a reset request's query. `signed` is true only for a valid, unexpired signature over the normalised params AND
  * this request's own session cookie (`sessionCookieValue`). With no session cookie there is nothing to clear: false.

package/dist/components/auth/CredentialSignInForm.d.ts

@@ -27,7 +27,13 @@ interface Props {
     /** Test seam: navigation after success. */
     onSignedIn?: (destination: string) => void;
     showForgotPassword?: boolean;
+    /**
+     * PAY-2630: the enrolment page a user the IdP told to enrol is taken to after signing in. NO DEFAULT: the offer renders only when
+     * the host passes this, because the host is the one that serves the page (the CLI scaffold writes no /account/security, so a
+     * default would 404 a generated app's user right after a good sign-in).
+     */
+    enrollHref?: string;
 }
 export declare function resolveDestination(explicit?: string): string;
-export declare function CredentialSignInForm({ callbackUrl, fetchImpl, onSignedIn, showForgotPassword }: Props): import("react/jsx-runtime").JSX.Element;
+export declare function CredentialSignInForm({ callbackUrl, fetchImpl, onSignedIn, showForgotPassword, enrollHref }: Props): import("react/jsx-runtime").JSX.Element;
 export default CredentialSignInForm;

package/dist/components/auth/CredentialSignInForm.js

@@ -10,6 +10,7 @@ const safe_callback_1 = require("../../auth/safe-callback");
 const authorize_resume_1 = require("../../lib/authorize-resume");
 const code_step_copy_1 = require("../../lib/code-step-copy");
 const DevCodeNotice_1 = require("./DevCodeNotice");
+const EnrollAuthenticatorOffer_1 = require("./EnrollAuthenticatorOffer");
 const credential_sign_in_client_1 = require("../../lib/credential-sign-in-client");
 const inputStyle = {
     borderColor: 'var(--border-default, #e5e7eb)',
@@ -30,26 +31,31 @@ function resolveDestination(explicit) {
     }
     return (0, safe_callback_1.safeCallbackPath)((0, authorize_resume_1.authorizeResumeHref)(returnUrl), (0, safe_callback_1.safeCallbackPath)(raw, '/dashboard'));
 }
-function CredentialSignInForm({ callbackUrl, fetchImpl, onSignedIn, showForgotPassword = false }) {
+function CredentialSignInForm({ callbackUrl, fetchImpl, onSignedIn, showForgotPassword = false, enrollHref }) {
     const [step, setStep] = (0, react_1.useState)('credentials');
     const [email, setEmail] = (0, react_1.useState)('');
     const [password, setPassword] = (0, react_1.useState)('');
     const [code, setCode] = (0, react_1.useState)('');
     const [busy, setBusy] = (0, react_1.useState)(false);
     const [error, setError] = (0, react_1.useState)(null);
+    const [errorCode, setErrorCode] = (0, react_1.useState)(null);
     const [fieldError, setFieldError] = (0, react_1.useState)(null);
     const [codeRequest, setCodeRequest] = (0, react_1.useState)(code_step_copy_1.NO_CODE_REQUEST);
     const [offerEmailCode, setOfferEmailCode] = (0, react_1.useState)(false);
     const [devCode, setDevCode] = (0, react_1.useState)(null);
     const [emailCodeMsg, setEmailCodeMsg] = (0, react_1.useState)(null);
+    // PAY-2630: what the IdP said is outstanding on this client, and whether the user kept the 'take me to enrol' offer ticked.
+    const [nextStep, setNextStep] = (0, react_1.useState)(null);
+    const [enrolAfter, setEnrolAfter] = (0, react_1.useState)(true);
     async function submit(withCode) {
         setBusy(true);
         setError(null);
+        setErrorCode(null);
         setOfferEmailCode(false);
         try {
             const r = await (0, credential_sign_in_client_1.credentialSignIn)({ email, password, code: withCode }, fetchImpl);
             if (r.kind === 'success') {
-                const destination = resolveDestination(callbackUrl);
+                const destination = (0, credential_sign_in_client_1.postSignInDestination)(resolveDestination(callbackUrl), nextStep, enrolAfter, enrollHref);
                 if (onSignedIn)
                     onSignedIn(destination);
                 else
@@ -59,10 +65,12 @@ function CredentialSignInForm({ callbackUrl, fetchImpl, onSignedIn, showForgotPa
             if (r.kind === 'two_factor') {
                 setCodeRequest(r.codeRequest);
                 setDevCode(r.devCode);
+                setNextStep(r.nextStep);
                 setStep('code');
                 return;
             }
             setError(r.message);
+            setErrorCode(r.code);
             if (r.kind === 'error')
                 setOfferEmailCode(r.offerEmailCode);
         }
@@ -94,6 +102,7 @@ function CredentialSignInForm({ callbackUrl, fetchImpl, onSignedIn, showForgotPa
         setStep('credentials');
         setCodeRequest(code_step_copy_1.NO_CODE_REQUEST);
         setDevCode(null);
+        setNextStep(null);
         setCode('');
         setFieldError(null);
         setError(null);
@@ -121,12 +130,12 @@ function CredentialSignInForm({ callbackUrl, fetchImpl, onSignedIn, showForgotPa
         }
     }
     const problem = fieldError ?? error;
-    const problemLine = problem && ((0, jsx_runtime_1.jsx)("p", { role: "alert", "data-testid": "credential-sign-in-error", className: "text-sm mt-3", style: { color: 'var(--color-error, #ef4444)' }, children: problem }));
+    const problemLine = problem && ((0, jsx_runtime_1.jsx)("p", { role: "alert", "data-testid": "credential-sign-in-error", "data-error-code": fieldError ? 'invalid_input' : (errorCode ?? undefined), className: "text-sm mt-3", style: { color: 'var(--color-error, #ef4444)' }, children: problem }));
     if (step === 'code') {
         return ((0, jsx_runtime_1.jsxs)("div", { "data-testid": "credential-sign-in-code-step", className: "text-left", children: [(0, jsx_runtime_1.jsx)("p", { className: "text-sm mb-4", style: { color: 'var(--text-primary, #111827)' }, children: (0, code_step_copy_1.codeStepInstruction)(email, codeRequest) }), (0, jsx_runtime_1.jsxs)("form", { onSubmit: onCodeSubmit, noValidate: true, className: "space-y-4", children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("label", { htmlFor: "credential-code", className: "block text-sm font-medium mb-2", style: { color: 'var(--text-primary, #111827)' }, children: "Authentication code" }), (0, jsx_runtime_1.jsx)("input", { id: "credential-code", name: "code", type: "text", inputMode: "numeric", autoComplete: "one-time-code", required: true, placeholder: "000000", value: code, disabled: busy, onChange: (e) => {
                                         setCode(e.target.value);
                                         setFieldError(null);
-                                    }, className: "w-full px-4 py-3 rounded-lg border transition-colors focus:outline-none focus:ring-2 disabled:opacity-50", style: inputStyle }), (0, jsx_runtime_1.jsx)(DevCodeNotice_1.DevCodeNotice, { code: devCode })] }), (0, jsx_runtime_1.jsx)("button", { type: "submit", disabled: busy, className: "w-full py-3 px-4 rounded-lg font-semibold focus:outline-none focus:ring-2 disabled:opacity-50 disabled:cursor-not-allowed transition-colors", style: { background: 'var(--btn-primary-bg, #11B588)', color: 'var(--btn-primary-text, white)' }, children: busy ? 'Verifying…' : 'Verify' })] }), (0, jsx_runtime_1.jsx)("button", { type: "button", onClick: onBack, disabled: busy, className: "text-sm underline mt-4", style: { background: 'none', border: 'none', padding: 0, color: 'var(--text-muted, #6b7280)' }, children: "Back" }), problemLine, (offerEmailCode || emailCodeMsg) && ((0, jsx_runtime_1.jsxs)("div", { "data-testid": "email-code-offer", className: "mt-4", children: [offerEmailCode && ((0, jsx_runtime_1.jsx)("button", { type: "button", onClick: () => void askForEmailCode(), disabled: busy, className: "text-sm font-semibold underline", style: { background: 'none', border: 'none', padding: 0, color: 'var(--text-primary, #111827)' }, children: "Email me a code instead" })), emailCodeMsg && ((0, jsx_runtime_1.jsx)("p", { role: "status", "data-testid": "email-code-offer-msg", className: "text-sm mt-2", style: { color: 'var(--text-primary, #111827)' }, children: emailCodeMsg }))] }))] }));
+                                    }, className: "w-full px-4 py-3 rounded-lg border transition-colors focus:outline-none focus:ring-2 disabled:opacity-50", style: inputStyle }), (0, jsx_runtime_1.jsx)(DevCodeNotice_1.DevCodeNotice, { code: devCode })] }), (0, jsx_runtime_1.jsx)("button", { type: "submit", disabled: busy, className: "w-full py-3 px-4 rounded-lg font-semibold focus:outline-none focus:ring-2 disabled:opacity-50 disabled:cursor-not-allowed transition-colors", style: { background: 'var(--btn-primary-bg, #11B588)', color: 'var(--btn-primary-text, white)' }, children: busy ? 'Verifying…' : 'Verify' })] }), (0, jsx_runtime_1.jsx)(EnrollAuthenticatorOffer_1.EnrollAuthenticatorOffer, { nextStep: enrollHref ? nextStep : null, checked: enrolAfter, onChange: setEnrolAfter, disabled: busy }), (0, jsx_runtime_1.jsx)("button", { type: "button", onClick: onBack, disabled: busy, className: "text-sm underline mt-4", style: { background: 'none', border: 'none', padding: 0, color: 'var(--text-muted, #6b7280)' }, children: "Back" }), problemLine, (offerEmailCode || emailCodeMsg) && ((0, jsx_runtime_1.jsxs)("div", { "data-testid": "email-code-offer", className: "mt-4", children: [offerEmailCode && ((0, jsx_runtime_1.jsx)("button", { type: "button", onClick: () => void askForEmailCode(), disabled: busy, className: "text-sm font-semibold underline", style: { background: 'none', border: 'none', padding: 0, color: 'var(--text-primary, #111827)' }, children: "Email me a code instead" })), emailCodeMsg && ((0, jsx_runtime_1.jsx)("p", { role: "status", "data-testid": "email-code-offer-msg", className: "text-sm mt-2", style: { color: 'var(--text-primary, #111827)' }, children: emailCodeMsg }))] }))] }));
     }
     return ((0, jsx_runtime_1.jsxs)("div", { "data-testid": "credential-sign-in", className: "text-left", children: [(0, jsx_runtime_1.jsx)(TraditionalAuthSection_1.TraditionalAuthSection, { email: email, password: password, onEmailChange: (v) => {
                     setEmail(v);

package/dist/components/auth/EnrollAuthenticatorOffer.d.ts

@@ -0,0 +1,21 @@
+import type { NextStep } from '../../lib/credential-sign-in-client';
+/**
+ * PAY-2630: the code step's offer to set up an authenticator.
+ *
+ * WHY. The IdP answers the first sign-in turn with next_step 'enroll_mfa' when the user has NO usable second factor on this
+ * client (factors are per client). The step used to ignore that and show only "enter the code we emailed you", so a user of a
+ * generated app could never enrol a factor on that client. Measured on the PAY-2305 walk (client 90662, user with a TOTP on
+ * client 12 only): requiresTwoFactor true, sentVia 'email', nextStep 'enroll_mfa', and a page with Verify / Back and nothing else.
+ *
+ * WHAT IT IS, AND IS NOT. It renders ONLY for 'enroll_mfa'. It names the lane the user is on (the emailed code) and offers to take
+ * them to the enrolment page right after they sign in with it. It does NOT enrol in place: the enrolment endpoints need a signed-in
+ * session and this step has none yet (the provisional bearer is parked server-side). For 'mfa_verify', null or anything else it
+ * renders nothing: a user who HAS a factor must not be told to set one up.
+ */
+export declare function EnrollAuthenticatorOffer({ nextStep, checked, onChange, disabled, }: {
+    nextStep: NextStep;
+    checked: boolean;
+    onChange: (next: boolean) => void;
+    disabled?: boolean;
+}): import("react/jsx-runtime").JSX.Element | null;
+export default EnrollAuthenticatorOffer;

package/dist/components/auth/EnrollAuthenticatorOffer.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EnrollAuthenticatorOffer = EnrollAuthenticatorOffer;
+const jsx_runtime_1 = require("react/jsx-runtime");
+/**
+ * PAY-2630: the code step's offer to set up an authenticator.
+ *
+ * WHY. The IdP answers the first sign-in turn with next_step 'enroll_mfa' when the user has NO usable second factor on this
+ * client (factors are per client). The step used to ignore that and show only "enter the code we emailed you", so a user of a
+ * generated app could never enrol a factor on that client. Measured on the PAY-2305 walk (client 90662, user with a TOTP on
+ * client 12 only): requiresTwoFactor true, sentVia 'email', nextStep 'enroll_mfa', and a page with Verify / Back and nothing else.
+ *
+ * WHAT IT IS, AND IS NOT. It renders ONLY for 'enroll_mfa'. It names the lane the user is on (the emailed code) and offers to take
+ * them to the enrolment page right after they sign in with it. It does NOT enrol in place: the enrolment endpoints need a signed-in
+ * session and this step has none yet (the provisional bearer is parked server-side). For 'mfa_verify', null or anything else it
+ * renders nothing: a user who HAS a factor must not be told to set one up.
+ */
+function EnrollAuthenticatorOffer({ nextStep, checked, onChange, disabled, }) {
+    if (nextStep !== 'enroll_mfa')
+        return null;
+    return ((0, jsx_runtime_1.jsxs)("div", { "data-testid": "enroll-authenticator-offer", className: "mt-4 text-sm", style: { color: 'var(--text-primary, #111827)' }, children: [(0, jsx_runtime_1.jsx)("p", { "data-testid": "enroll-authenticator-lane", children: "You have no authenticator set up for this app yet, so this time you sign in with the emailed code." }), (0, jsx_runtime_1.jsxs)("label", { className: "flex items-center gap-2 mt-2", children: [(0, jsx_runtime_1.jsx)("input", { type: "checkbox", "data-testid": "enroll-authenticator-checkbox", checked: checked, disabled: disabled, onChange: (e) => onChange(e.target.checked) }), (0, jsx_runtime_1.jsx)("span", { children: "Take me to set up an authenticator right after I sign in" })] })] }));
+}
+exports.default = EnrollAuthenticatorOffer;

package/dist/components/mfa/QrCode.d.ts

@@ -0,0 +1,6 @@
+/** PAY-2631: client-side QR from an otpauth:// URI. Inline SVG, quiet zone of 4 modules; no network, no library. */
+export declare function QrCode({ value, size }: {
+    value: string;
+    size?: number;
+}): import("react/jsx-runtime").JSX.Element;
+export default QrCode;

package/dist/components/mfa/QrCode.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.QrCode = QrCode;
+const jsx_runtime_1 = require("react/jsx-runtime");
+const react_1 = require("react");
+const qrcode_1 = require("../../lib/qrcode");
+/** PAY-2631: client-side QR from an otpauth:// URI. Inline SVG, quiet zone of 4 modules; no network, no library. */
+function QrCode({ value, size = 168 }) {
+    const qr = (0, react_1.useMemo)(() => (0, qrcode_1.encodeQr)(value), [value]);
+    const path = (0, react_1.useMemo)(() => (0, qrcode_1.qrToSvgPath)(qr), [qr]);
+    const modules = qr.size;
+    return ((0, jsx_runtime_1.jsxs)("svg", { width: size, height: size, viewBox: `-4 -4 ${modules + 8} ${modules + 8}`, role: "img", "aria-label": "QR code for authenticator setup", "data-testid": "totp-qr", children: [(0, jsx_runtime_1.jsx)("rect", { x: -4, y: -4, width: modules + 8, height: modules + 8, fill: "#ffffff" }), (0, jsx_runtime_1.jsx)("path", { d: path, fill: "#212126" })] }));
+}
+exports.default = QrCode;

package/dist/components/mfa/TotpEnrollPanel.d.ts

@@ -0,0 +1,6 @@
+export declare const STEP_UP_SENTENCE = "This session was signed in with an emailed or texted code only. Sign in with your current authenticator, then try again.";
+export declare function TotpEnrollPanel({ fetchImpl, onConfirmed }?: {
+    fetchImpl?: typeof fetch;
+    onConfirmed?: () => void;
+}): import("react/jsx-runtime").JSX.Element;
+export default TotpEnrollPanel;

package/dist/components/mfa/TotpEnrollPanel.js

@@ -0,0 +1,117 @@
+"use strict";
+'use client';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STEP_UP_SENTENCE = void 0;
+exports.TotpEnrollPanel = TotpEnrollPanel;
+const jsx_runtime_1 = require("react/jsx-runtime");
+const react_1 = require("react");
+const QrCode_1 = require("./QrCode");
+const two_factor_verify_failure_1 = require("../../lib/two-factor-verify-failure");
+exports.STEP_UP_SENTENCE = 'This session was signed in with an emailed or texted code only. Sign in with your current authenticator, then try again.';
+async function readJson(res) {
+    return res.json().catch(() => null);
+}
+function TotpEnrollPanel({ fetchImpl, onConfirmed } = {}) {
+    const doFetch = fetchImpl ?? ((...a) => fetch(...a));
+    const [stage, setStage] = (0, react_1.useState)('idle');
+    const [enroll, setEnroll] = (0, react_1.useState)(null);
+    const [code, setCode] = (0, react_1.useState)('');
+    const [error, setError] = (0, react_1.useState)(null);
+    const [busy, setBusy] = (0, react_1.useState)(false);
+    async function begin() {
+        setBusy(true);
+        setError(null);
+        try {
+            const res = await doFetch('/api/mfa/totp/enroll', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ friendly_name: 'This device' }),
+            });
+            if (res.ok) {
+                const body = (await readJson(res));
+                if (!body || !body.secret || !body.otpauth_uri || body.enrollment_id === undefined) {
+                    setError('Something went wrong on our end. Try again.');
+                    return;
+                }
+                setEnroll({ secret: body.secret, otpauth_uri: body.otpauth_uri, enrollment_id: body.enrollment_id });
+                setCode('');
+                setStage('enrolling');
+                return;
+            }
+            if (res.status === 401) {
+                setStage('signed-out');
+                return;
+            }
+            const json = await readJson(res);
+            if ((0, two_factor_verify_failure_1.stepUpRefusal)(res.status, json)) {
+                setError(exports.STEP_UP_SENTENCE);
+                return;
+            }
+            if (res.status === 403) {
+                setError('This account already has a second factor set up, so an authenticator app cannot be added here. Sign in with your existing method.');
+                return;
+            }
+            setError('Something went wrong on our end. Try again.');
+        }
+        finally {
+            setBusy(false);
+        }
+    }
+    async function confirm() {
+        if (!enroll || !/^\d{6}$/.test(code)) {
+            setError('Enter the 6-digit code from your app.');
+            return;
+        }
+        setBusy(true);
+        setError(null);
+        try {
+            const res = await doFetch('/api/mfa/totp/confirm', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ enrollment_id: enroll.enrollment_id, code }),
+            });
+            if (res.ok) {
+                setEnroll(null);
+                setCode('');
+                setStage('done');
+                onConfirmed?.();
+                return;
+            }
+            if (res.status === 401) {
+                setStage('signed-out');
+                return;
+            }
+            const json = await readJson(res);
+            if ((0, two_factor_verify_failure_1.stepUpRefusal)(res.status, json)) {
+                setError(exports.STEP_UP_SENTENCE);
+                return;
+            }
+            setCode('');
+            setError(res.status === 400 || res.status === 422
+                ? 'That code did not match. Check the time on your phone and try the next code.'
+                : 'Setup was not completed. Try again.');
+        }
+        finally {
+            setBusy(false);
+        }
+    }
+    if (stage === 'signed-out') {
+        return ((0, jsx_runtime_1.jsxs)("div", { "data-testid": "totp-signed-out", children: [(0, jsx_runtime_1.jsx)("a", { href: "/account-auth/login", children: "Sign in" }), " to set up an authenticator app."] }));
+    }
+    if (stage === 'done') {
+        return ((0, jsx_runtime_1.jsxs)("div", { "data-testid": "totp-done", role: "status", children: [(0, jsx_runtime_1.jsx)("p", { children: "Authenticator app added." }), (0, jsx_runtime_1.jsx)("p", { children: "The next time you sign in on this app, you will be asked for the 6-digit code from it." })] }));
+    }
+    if (stage === 'enrolling' && enroll) {
+        return ((0, jsx_runtime_1.jsxs)("div", { "data-testid": "totp-enrolling", style: { display: 'flex', flexDirection: 'column', gap: 12, alignItems: 'flex-start' }, children: [(0, jsx_runtime_1.jsx)("p", { children: "Open your authenticator app and scan this code. A phone camera works too." }), (0, jsx_runtime_1.jsx)(QrCode_1.QrCode, { value: enroll.otpauth_uri }), (0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("div", { children: "Can't scan? Enter this code manually:" }), (0, jsx_runtime_1.jsx)("code", { "data-testid": "totp-secret", style: { wordBreak: 'break-all' }, children: enroll.secret })] }), (0, jsx_runtime_1.jsxs)("form", { onSubmit: (e) => {
+                        e.preventDefault();
+                        void confirm();
+                    }, children: [(0, jsx_runtime_1.jsx)("label", { htmlFor: "totp-code", children: "Enter the 6-digit code from your app:" }), (0, jsx_runtime_1.jsx)("br", {}), (0, jsx_runtime_1.jsx)("input", { id: "totp-code", "data-testid": "totp-code", inputMode: "numeric", autoComplete: "one-time-code", maxLength: 6, value: code, disabled: busy, onChange: (e) => setCode(e.target.value.replace(/\D/g, '').slice(0, 6)) }), ' ', (0, jsx_runtime_1.jsx)("button", { type: "submit", "data-testid": "totp-confirm", disabled: busy || code.length !== 6, children: "Confirm" })] }), error ? ((0, jsx_runtime_1.jsx)("p", { role: "alert", "data-testid": "totp-error", children: error })) : null, (0, jsx_runtime_1.jsx)("button", { type: "button", "data-testid": "totp-restart", disabled: busy, onClick: () => {
+                        setEnroll(null);
+                        setCode('');
+                        setError(null);
+                        setStage('idle');
+                    }, children: "Start again" })] }));
+    }
+    return ((0, jsx_runtime_1.jsxs)("div", { "data-testid": "totp-idle", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", "data-testid": "totp-begin", disabled: busy, onClick: () => void begin(), children: busy ? 'Starting…' : 'Add authenticator app' }), error ? ((0, jsx_runtime_1.jsx)("p", { role: "alert", "data-testid": "totp-error", children: error })) : null] }));
+}
+exports.default = TotpEnrollPanel;

package/dist/edge/middleware.d.ts

@@ -7,7 +7,7 @@
 export { makeAuthDecision } from '../auth/auth-decision';
 export { isUnauthenticatedRoute, configurePublicRoutes, getRouteConfig, configure2FABypassRoutes, should2FABypass, get2FABypassConfig } from '../auth/route-config';
 export type { UnauthenticatedRouteConfig, ProtectedRouteConfig } from '../auth/route-config';
-export { createMvpMiddleware, isPrefetchRequest } from '../middleware/create-middleware';
+export { createMvpMiddleware, isPrefetchRequest, isKnownNonNavigationRequest } from '../middleware/create-middleware';
 export type { MvpMiddlewareOptions, CircuitBreakerProvider, MiddlewareLogger, AuthContext, AuthAction, SessionPointer, SessionStatus } from '../middleware/create-middleware';
 export { TwoFactorPresets, AMRValues, ACRLevels, validateAMR, validateACR, checkTwoFactorRequirements } from '../middleware/twofa-presets';
 export type { TwoFactorRequirements, RouteConfig } from '../middleware/twofa-presets';

package/dist/edge/middleware.js

@@ -6,7 +6,7 @@
  * Client-side utilities that depend on browser APIs or server-only code are excluded.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getInternalApiUrl = exports.checkTwoFactorRequirements = exports.validateACR = exports.validateAMR = exports.ACRLevels = exports.AMRValues = exports.TwoFactorPresets = exports.isPrefetchRequest = exports.createMvpMiddleware = exports.get2FABypassConfig = exports.should2FABypass = exports.configure2FABypassRoutes = exports.getRouteConfig = exports.configurePublicRoutes = exports.isUnauthenticatedRoute = exports.makeAuthDecision = void 0;
+exports.getInternalApiUrl = exports.checkTwoFactorRequirements = exports.validateACR = exports.validateAMR = exports.ACRLevels = exports.AMRValues = exports.TwoFactorPresets = exports.isKnownNonNavigationRequest = exports.isPrefetchRequest = exports.createMvpMiddleware = exports.get2FABypassConfig = exports.should2FABypass = exports.configure2FABypassRoutes = exports.getRouteConfig = exports.configurePublicRoutes = exports.isUnauthenticatedRoute = exports.makeAuthDecision = void 0;
 // Authentication middleware and configuration (Edge Runtime compatible)
 var auth_decision_1 = require("../auth/auth-decision");
 Object.defineProperty(exports, "makeAuthDecision", { enumerable: true, get: function () { return auth_decision_1.makeAuthDecision; } });
@@ -20,6 +20,7 @@ Object.defineProperty(exports, "get2FABypassConfig", { enumerable: true, get: fu
 var create_middleware_1 = require("../middleware/create-middleware");
 Object.defineProperty(exports, "createMvpMiddleware", { enumerable: true, get: function () { return create_middleware_1.createMvpMiddleware; } });
 Object.defineProperty(exports, "isPrefetchRequest", { enumerable: true, get: function () { return create_middleware_1.isPrefetchRequest; } });
+Object.defineProperty(exports, "isKnownNonNavigationRequest", { enumerable: true, get: function () { return create_middleware_1.isKnownNonNavigationRequest; } });
 // Two-Factor Authentication Presets (Edge Runtime compatible)
 var twofa_presets_1 = require("../middleware/twofa-presets");
 Object.defineProperty(exports, "TwoFactorPresets", { enumerable: true, get: function () { return twofa_presets_1.TwoFactorPresets; } });

package/dist/index.d.ts

@@ -6,7 +6,7 @@ export type { AuthConfig } from './types/auth';
 export { makeAuthDecision } from './auth/auth-decision';
 export { isUnauthenticatedRoute, configurePublicRoutes, getRouteConfig } from './auth/route-config';
 export { safeCallbackPath, isSafeCallbackPath, resolveCallbackDestination, DEFAULT_CALLBACK } from './auth/safe-callback';
-export { createMvpMiddleware, isPrefetchRequest } from './middleware/create-middleware';
+export { createMvpMiddleware, isPrefetchRequest, isKnownNonNavigationRequest } from './middleware/create-middleware';
 export { UserAvatarMenu, MobileNavDrawer } from './components/account';
 export type { UserAvatarMenuProps, MobileNavDrawerProps, NavItem, NavSection } from './components/account';
 export { ErrorMetricsCard, HealthMetricsCard, AuditLogViewer, AdminAnalyticsLayout, useErrorMetrics, useHealthMetrics, useAuditLog, useAdminAnalytics, getErrorMetrics, getHealthMetrics, writeAuditLog, queryAuditLog, } from './logging';

package/dist/index.js

@@ -8,7 +8,7 @@
 // - Better Auth: import { createBetterAuthInstance } from '@payez/next-mvp/auth/better-auth'
 // - Server auth: import { getSession } from '@payez/next-mvp/server/auth'
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.queryAuditLog = exports.writeAuditLog = exports.getHealthMetrics = exports.getErrorMetrics = exports.useAdminAnalytics = exports.useAuditLog = exports.useHealthMetrics = exports.useErrorMetrics = exports.AdminAnalyticsLayout = exports.AuditLogViewer = exports.HealthMetricsCard = exports.ErrorMetricsCard = exports.MobileNavDrawer = exports.UserAvatarMenu = exports.isPrefetchRequest = exports.createMvpMiddleware = exports.DEFAULT_CALLBACK = exports.resolveCallbackDestination = exports.isSafeCallbackPath = exports.safeCallbackPath = exports.getRouteConfig = exports.configurePublicRoutes = exports.isUnauthenticatedRoute = exports.makeAuthDecision = exports.useTraditionalAuthEnabled = exports.useFederatedAuthEnabled = exports.useFederatedProviders = exports.useAuthMode = exports.useAuthConfig = exports.AuthProvider = exports.useAnonSession = exports.fetchWithAuth = void 0;
+exports.queryAuditLog = exports.writeAuditLog = exports.getHealthMetrics = exports.getErrorMetrics = exports.useAdminAnalytics = exports.useAuditLog = exports.useHealthMetrics = exports.useErrorMetrics = exports.AdminAnalyticsLayout = exports.AuditLogViewer = exports.HealthMetricsCard = exports.ErrorMetricsCard = exports.MobileNavDrawer = exports.UserAvatarMenu = exports.isKnownNonNavigationRequest = exports.isPrefetchRequest = exports.createMvpMiddleware = exports.DEFAULT_CALLBACK = exports.resolveCallbackDestination = exports.isSafeCallbackPath = exports.safeCallbackPath = exports.getRouteConfig = exports.configurePublicRoutes = exports.isUnauthenticatedRoute = exports.makeAuthDecision = exports.useTraditionalAuthEnabled = exports.useFederatedAuthEnabled = exports.useFederatedProviders = exports.useAuthMode = exports.useAuthConfig = exports.AuthProvider = exports.useAnonSession = exports.fetchWithAuth = void 0;
 // Client-safe exports only
 // Client-side utilities
 var fetch_with_auth_1 = require("./client/fetch-with-auth");
@@ -41,6 +41,7 @@ Object.defineProperty(exports, "DEFAULT_CALLBACK", { enumerable: true, get: func
 var create_middleware_1 = require("./middleware/create-middleware");
 Object.defineProperty(exports, "createMvpMiddleware", { enumerable: true, get: function () { return create_middleware_1.createMvpMiddleware; } });
 Object.defineProperty(exports, "isPrefetchRequest", { enumerable: true, get: function () { return create_middleware_1.isPrefetchRequest; } });
+Object.defineProperty(exports, "isKnownNonNavigationRequest", { enumerable: true, get: function () { return create_middleware_1.isKnownNonNavigationRequest; } });
 // Account Components
 var account_1 = require("./components/account");
 Object.defineProperty(exports, "UserAvatarMenu", { enumerable: true, get: function () { return account_1.UserAvatarMenu; } });