@payez/next-mvp 4.4.0 → 4.4.2

package/src/auth/better-auth.ts

@@ -34,6 +34,26 @@ export function secretFingerprint(value: string): string {
   return createHash('sha256').update(value).digest('hex').slice(0, 12);
 }
 
+/**
+ * 273183: keys written onto the `ba:{slug}:{token}` record by an author OTHER
+ * than Better Auth, which must survive a Better Auth session write.
+ *
+ * Today this is exactly `idpTokens`, written by `storeIdpTokensInSession`. The
+ * list is a named constant rather than a hardcoded check because the shape of
+ * the bug is "a second author appeared and the adapter did not know" — the next
+ * enrichment key should be added here, not rediscovered as a strip.
+ */
+const PRESERVED_SESSION_KEYS = ['idpTokens'] as const;
+
+/**
+ * True for a JSON object we can safely merge into — not null, not an array.
+ * `typeof null === 'object'` and arrays are objects, and merging into either
+ * would corrupt the record rather than preserve it.
+ */
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
 /**
  * Better Auth social provider config shape.
  */
@@ -498,7 +518,114 @@ export function createBetterAuthInstance(
        */
       set: async (key: string, value: string, ttl?: number) => {
         const redis = getRedis();
-        await redis.setex(`ba:${appSlug}:${key}`, ttl ?? SESSION_TTL, value);
+        const redisKey = `ba:${appSlug}:${key}`;
+
+        /**
+         * 273183 — READ-MODIFY-WRITE, BECAUSE THIS RECORD HAS TWO AUTHORS.
+         * (Found by DotNetPert-Scout; handed over as Cluster-B root-cause
+         * evidence under BAPert's R920(a). Reproduced here before fixing.)
+         *
+         * Better Auth owns `{session, user}` and serialises exactly that. But
+         * `storeIdpTokensInSession` (below, ~:1010) ENRICHES the same key with
+         * `idpTokens` via its own read-modify-write. This setter did a blind
+         * `setex` of Better Auth's payload, so every write it makes — including
+         * each routine `updateAge` session rewrite, not merely an expiry —
+         * STRIPPED `idpTokens` back off the record.
+         *
+         * The consumer then falls back to an identity husk: `mfaVerified:false`,
+         * `roles:[]`. It fails CLOSED, so it is not a 369782-class bypass — but
+         * per BAPert it is a public-test blocker on its own terms, because a
+         * tester who trips the `updateAge` cadence gets a spurious 2FA re-prompt
+         * AND SILENTLY LOSES THEIR ROLES mid-session. That is a visible product
+         * failure regardless of which direction it fails in.
+         *
+         * WHY MERGE HERE RATHER THAN MOVE THE DATA. The enriching writer already
+         * does a read-modify-write; it was correct. The bug is that ONE of the
+         * two authors of this key wrote as though it were the only one. Fixing
+         * the adapter fixes it for every future enrichment key, whereas moving
+         * `idpTokens` elsewhere would leave the next one to rediscover this.
+         *
+         * ONLY keys in PRESERVED_KEYS are carried, and ONLY when the incoming
+         * payload does not set them — so Better Auth still wins on everything it
+         * owns, and an explicit incoming value is never overridden by a stale one.
+         *
+         * NOT ATOMIC, and deliberately not: an enrichment landing between this
+         * read and this write is still lost. Closing that needs a WATCH/MULTI or
+         * a Lua script, which is a larger change than tonight allows. This
+         * narrows the window from "every single write" to "a genuine race", and
+         * the residual is recorded here rather than left to be re-found.
+         */
+        let payload = value;
+        try {
+          const existingRaw = await redis.get(redisKey);
+          if (existingRaw) {
+            const existing = JSON.parse(existingRaw);
+            const incoming = JSON.parse(value);
+            if (isPlainObject(existing) && isPlainObject(incoming)) {
+              let carried = false;
+              for (const preserved of PRESERVED_SESSION_KEYS) {
+                if (preserved in existing && !(preserved in incoming)) {
+                  incoming[preserved] = existing[preserved];
+                  carried = true;
+                }
+              }
+              if (carried) payload = JSON.stringify(incoming);
+            }
+          }
+        } catch (mergeErr) {
+          /**
+           * This adapter also stores `verification:*` and `active-sessions-*`
+           * records, which are not necessarily session-shaped JSON. A record we
+           * cannot parse is not a session to enrich, so writing through unchanged
+           * is correct rather than merely tolerable.
+           *
+           * WARNED, NOT THROWN, and the asymmetry is the point: this block is an
+           * ENRICHMENT-PRESERVING read. Letting it fail the write would convert a
+           * degraded read into a lost session — the precise inversion 170033 fix 1
+           * above exists to prevent. The `setex` below is outside this try and is
+           * still unswallowed, so a genuine write failure still propagates.
+           */
+          console.warn(
+            `[BETTER_AUTH] secondaryStorage.set: could not preserve enrichment keys on ` +
+            `ba:${appSlug}:sha256:${secretFingerprint(key)} — writing Better Auth's payload ` +
+            `as-is. If this record held idpTokens they are now gone (273183):`,
+            mergeErr instanceof Error ? mergeErr.message : String(mergeErr)
+          );
+        }
+
+        /**
+         * QA 6952 / R913 - CLAMP, DO NOT DEFER.
+         *
+         * This was `ttl ?? SESSION_TTL`, which READS as "SESSION_TTL is the single
+         * source of session TTL" - what session-store.ts claims, and the mechanism
+         * by which the 7d-vs-3d zombie window was supposedly closed for good.
+         *
+         * IT WAS DEAD CODE. Better Auth ALWAYS supplies a ttl: every one of the
+         * eight secondaryStorage.set call sites in
+         * better-auth/dist/db/internal-adapter.mjs passes one explicitly (:36,
+         * :180, :189, :309, :320, :344, :553, :622). `??` fires only on
+         * null/undefined, so the fallback NEVER RAN. Every `ba:` record took Better
+         * Auth's 7d default - `session.expiresIn` is not configured in this file -
+         * while the canonical store stayed at SESSION_TTL (3d). That 4-day drift IS
+         * the zombie window the constant exists to prevent: the guard was bypassed
+         * by the very parameter written to defer to it.
+         *
+         * `Math.min`, NOT a hard SESSION_TTL: this same adapter also stores
+         * `verification:*` (:553, :622) and `active-sessions-*` (:180, :320, :344)
+         * records whose TTLs are legitimately SHORTER than 3d. Overwriting those
+         * would EXTEND them - turning a fix for over-long sessions into a bug that
+         * keeps verification codes alive for three days. Clamp DOWN, never up.
+         *
+         * Clamped down to 3d rather than raising the canonical store to 7d because
+         * SESSION_TTL matches the IDP refresh-token lifetime: a session outliving
+         * the refresh token sustaining it cannot be refreshed, so the extra days are
+         * a husk that reads as authenticated. Fail-closed beats ambiguous.
+         *
+         * DO NOT "fix" this by making storeIdpTokensInSession preserve Better
+         * Auth's 7d. That deletes the last remnant of QA 6952 and makes the drift
+         * universal. See test/ba-session-ttl-clamp.test.cjs.
+         */
+        await redis.setex(redisKey, Math.min(ttl ?? SESSION_TTL, SESSION_TTL), payload);
       },
       delete: async (key: string) => {
         try {

package/src/auth/safe-callback.ts

@@ -0,0 +1,113 @@
+/**
+ * ONE definition of "is this callback target safe to navigate to", for the
+ * whole package (375656).
+ *
+ * *** THIS DELEGATES PARSING TO THE URL PARSER. DO NOT REPLACE IT WITH
+ * *** startsWith() CHECKS. THAT APPROACH FAILED FOUR TIMES.
+ *
+ * WHY THIS FILE EXISTS: `@payez/next-mvp` shipped THREE bodies named
+ * `makeAuthDecision`, each carrying its own `callbackUrl.startsWith('/account-auth/')`
+ * test. That test is a REDIRECT-LOOP guard sitting in the seat where an ORIGIN
+ * check belongs - its own comment says "prevents infinite loop" - so
+ * `https://evil.example.com` does not start with `/account-auth/`, passes
+ * through untouched, and becomes the redirect target. The exported copy
+ * (`auth/auth-decision.ts`, re-exported from `index.ts` and `edge/middleware.ts`)
+ * is public API, so that is a published open redirect independent of who calls it.
+ *
+ * HISTORY, because it is the whole argument for the current shape (267097 /
+ * 267174 / 267448), carried over verbatim from the portal's `src/lib/safe-callback.ts`
+ * where this guard was proven (0 leaks / 21 hostile inputs):
+ *
+ *   v1  `startsWith('/') && !startsWith('//')`            -> bypassed by  /BACKSLASH host
+ *   v2  + `!startsWith('/' + BACKSLASH)`                  -> bypassed by  /TAB/host
+ *   ...                                                      and /LF/host, /CR/host
+ *
+ * Both bypasses work the same way: the browser NORMALISES the string AFTER the
+ * guard has finished looking at it. The WHATWG URL parser converts backslashes
+ * to forward slashes and STRIPS all ASCII tab, LF and CR before resolving. So a
+ * prefix check can always be defeated by a character that is not there yet when
+ * it runs. Each fix bought one character. The list was never provably complete.
+ *
+ * SO: stop re-implementing the parser and ask it instead. Resolve the input
+ * against a synthetic base and compare ORIGINS. Anything that escapes the
+ * origin - however it is spelled, including spellings nobody has found yet -
+ * fails one comparison. The returned value is the parser's own NORMALISED
+ * output, so an accepted path cannot smuggle a control character onward either.
+ *
+ * A synthetic base is used deliberately so this works identically in a server
+ * component (no window), on the client, and in the edge runtime.
+ */
+
+/** Where we send anyone whose requested target we will not honour. */
+export const DEFAULT_CALLBACK = '/';
+
+/** The auth surface. A callback pointing back into it causes a redirect cycle. */
+const AUTH_PREFIX = '/account-auth/';
+
+/**
+ * Synthetic, unreachable base. Only ever used as the resolution origin for the
+ * comparison below - never emitted, never navigated to. `.invalid` is reserved
+ * by RFC 2606 and can never resolve.
+ */
+const BASE = 'http://safe-callback.invalid';
+
+/**
+ * The value to navigate to: a same-origin relative path, NORMALISED by the URL
+ * parser, or `fallback` for anything that escapes the origin or loops back into
+ * the auth surface. Never throws.
+ */
+export function safeCallbackPath(raw: unknown, fallback: string = DEFAULT_CALLBACK): string {
+  if (typeof raw !== 'string' || raw.length === 0) return fallback;
+
+  let url: URL;
+  try {
+    url = new URL(raw, BASE);
+  } catch {
+    return fallback;
+  }
+
+  // Anything that resolved to a different origin escaped, however it was spelled:
+  // absolute, protocol-relative //host, backslash /\host, tab/LF/CR variants, or
+  // a scheme like javascript: (whose origin is opaque and never equals BASE).
+  if (url.origin !== BASE) return fallback;
+
+  // Loopbacks into the auth surface cause redirect cycles.
+  if (url.pathname.startsWith(AUTH_PREFIX)) return fallback;
+
+  // The parser's normalised output - control characters already stripped.
+  return url.pathname + url.search + url.hash;
+}
+
+/** True when `raw` is a callback target we are willing to honour. */
+export function isSafeCallbackPath(raw: unknown): raw is string {
+  if (typeof raw !== 'string' || raw.length === 0) return false;
+  try {
+    const url = new URL(raw, BASE);
+    return url.origin === BASE && !url.pathname.startsWith(AUTH_PREFIX);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Pick the post-login destination: an explicit `?callbackUrl=` when it is one we
+ * will honour, otherwise the current path, otherwise `/`.
+ *
+ * This replaces the package's three hand-rolled `getSafeCallbackUrl` /
+ * `getCallbackUrl` bodies. Note the ARGUMENT ORDER DEPENDENCY those had: they
+ * tested `pathname` FIRST and returned early, so a caller on the login page
+ * never reached the attacker-controlled parameter at all - safe, but only
+ * because that caller happened to pass a value that tripped the function's own
+ * first guard. Nothing in the code named that dependency, and an argument
+ * reorder would have opened it. Here BOTH inputs are validated, so the
+ * protection no longer depends on which one is passed.
+ */
+export function resolveCallbackDestination(
+  pathname: string,
+  searchParams?: URLSearchParams | null,
+  fallback: string = DEFAULT_CALLBACK
+): string {
+  const requested = searchParams?.get('callbackUrl');
+  if (isSafeCallbackPath(requested)) return safeCallbackPath(requested, fallback);
+  return safeCallbackPath(pathname, fallback);
+}

package/src/hooks/useProfile.ts

@@ -49,7 +49,14 @@ export type ProfileResponse = {
   phone_confirmed?: boolean;
   two_factor_enabled?: boolean;
   roles?: string[];
-  contact_information?: Record<string, any>;
+  // REMOVED: `contact_information?: Record<string, any>` - the ADMIN DTO's field
+  // name (AdminUserProfileResponse), never emitted by /api/account/profile. This
+  // permissive declaration is WHY the wrong mapper type-checked for so long: the
+  // correct `contact_info` and `address` shapes were already declared right here,
+  // and this `Record<string, any>` sat beside them as an off switch, accepting
+  // `contact_information.addressLine1` on a path that could never carry data.
+  // Found by BAPert (41365) as the residual of my own half-sweep - I deleted the
+  // twin of this line from EnhancedProfilePage and left this one standing.
   [key: string]: any;
 };
 

package/src/lib/session-store.ts

@@ -434,6 +434,28 @@ export async function transitionTo2FASession(
     }
   }
 
+  // 339563: derive the expiry ONCE - it is both a field to write and the
+  // evidence test below. Re-deriving it twice invites the two reads to drift.
+  const mfaLifetime = mfaLifetimeFromAccessToken(newAccessToken);
+
+  // *** R908(e). ABSENCE OF THE EXPIRY IS NOT A COMPLETED CEREMONY. ***
+  //
+  // `mfaExpiresAt` is the only evidence we hold that a real MFA ceremony took
+  // place and when it lapses. When the stepped-up token carries no `mfa_expires`
+  // claim we do NOT know that this session is MFA-verified, and R908(e) binds
+  // the consumer to the third arm:
+  //
+  //   producers degrade  ->  consumers RE-CHALLENGE  ->  nobody infers a
+  //   negative from a silence.
+  //
+  // So: never mint `mfaVerified: true` off a token that carries no expiry (that
+  // is forging evidence of a ceremony we did not observe - 12188/12390), and
+  // never hard-refuse the user either (R486: null is "cannot determine", not
+  // "not 2FA-backed"). Leave the session un-verified and set `nextStep:
+  // 'mfa_verify'`, which is the field the gate already reads to mean "a usable
+  // method exists; challenge them" (SessionModel.ts:136).
+  const mfaEvidencePresent = mfaLifetime.mfaExpiresAt !== undefined;
+
   // Support both old and new field names in input
   // CRITICAL: Set BOTH mfaVerified (new) AND twoFactorComplete (legacy) for compatibility
   // auth.ts session callback reads twoFactorComplete, so we must set it here
@@ -441,16 +463,33 @@ export async function transitionTo2FASession(
     idpAccessToken: newAccessToken,
     idpRefreshToken: tokens.idpRefreshToken || tokens.refreshToken,
     idpAccessTokenExpires: tokens.idpAccessTokenExpires || tokens.accessTokenExpires,
-    mfaVerified: true,
-    twoFactorComplete: true, // Legacy field - required by auth.ts session callback
+    mfaVerified: mfaEvidencePresent,
+    twoFactorComplete: mfaEvidencePresent, // Legacy field - required by auth.ts session callback
     mfaMethod: mfaMethod,
     // Update bearerKeyId if extracted from new token
     ...(bearerKeyId && { bearerKeyId }),
     // 339563: write the expiry in the SAME update that sets the flag. We already
     // hold the stepped-up token here and already decode its header above.
-    ...mfaLifetimeFromAccessToken(newAccessToken),
+    ...mfaLifetime,
+    // R908(e): no evidence -> route to the challenge, do not grant and do not eject.
+    ...(mfaEvidencePresent ? {} : { nextStep: 'mfa_verify' as const }),
   };
 
+  if (!mfaEvidencePresent) {
+    console.warn(
+      '[transitionTo2FASession] R908(e): the stepped-up token carries NO mfa_expires ' +
+        'claim, so there is no evidence of an MFA ceremony to record. NOT setting ' +
+        'mfaVerified; setting nextStep=mfa_verify so the consumer re-challenges. ' +
+        'If this fires for a lane that DID complete a real ceremony, the defect is ' +
+        'on the emit side (R908(b)) - do not "fix" it by minting the flag here.',
+      {
+        sessionToken: sessionToken?.substring(0, 8) + '...',
+        mfaMethod,
+        hasAccessToken: !!newAccessToken,
+      }
+    );
+  }
+
   const refreshExpires = tokens.idpRefreshTokenExpires || tokens.refreshTokenExpires;
   if (refreshExpires !== undefined) {
     updates.idpRefreshTokenExpires = refreshExpires;
@@ -462,11 +501,13 @@ export async function transitionTo2FASession(
     mfaMethod: updates.mfaMethod,
     hasIdpAccessToken: !!updates.idpAccessToken,
     // 339563: surface the expiry we derived. `mfaExpiresAt: undefined` here is
-    // the passwordless/primary-credential lane (token carried no mfa_expires),
-    // NOT a bug - but it IS the case the consumers currently fail OPEN on, so
-    // it needs to be visible in the log rather than inferred from its absence.
+    // the passwordless/primary-credential lane (token carried no mfa_expires).
+    // Since R908(e) that absence no longer fails OPEN: it withholds mfaVerified
+    // and sets nextStep=mfa_verify instead, so log both together - the pair is
+    // the whole decision.
     mfaExpiresAt: updates.mfaExpiresAt,
     mfaExpiresAtISO: updates.mfaExpiresAt ? new Date(updates.mfaExpiresAt).toISOString() : undefined,
+    nextStep: (updates as any).nextStep,
   });
 
   const result = await updateSession(sessionToken, updates);
@@ -543,9 +584,27 @@ export async function mark2FAComplete(
     );
   }
 
+  // R908(e): identical rule to transitionTo2FASession above - no expiry derived
+  // means no observed ceremony, so we re-challenge rather than mint the flag.
+  // This path matters more than its sibling: `mark2FAComplete(sessionToken)`
+  // with the accessToken omitted used to write a bare `mfaVerified: true` that
+  // NO consumer could ever expire, and it is reachable from route handlers that
+  // take their tokens from the request body.
+  const mfaEvidencePresent = mfaLifetime.mfaExpiresAt !== undefined;
+
+  if (!mfaEvidencePresent) {
+    console.warn(
+      '[mark2FAComplete] R908(e): no mfa_expires could be derived, so mfaVerified ' +
+      'is NOT being set. Writing nextStep=mfa_verify instead so the consumer ' +
+      're-challenges. A caller that needs the grant must pass the stepped-up ' +
+      'access token that carries the claim.'
+    );
+  }
+
   return updateSession(sessionToken, {
-    mfaVerified: true,
+    mfaVerified: mfaEvidencePresent,
     ...mfaLifetime,
+    ...(mfaEvidencePresent ? {} : { nextStep: 'mfa_verify' as const }),
   });
 }
 

package/src/middleware/create-middleware.ts

@@ -19,6 +19,7 @@
 
 import { NextRequest, NextResponse } from 'next/server';
 import { isUnauthenticatedRoute, should2FABypass } from '../auth/route-config';
+import { resolveCallbackDestination } from '../auth/safe-callback';
 import { getInternalApiUrl } from '../edge/internal-api-url';
 import { getSessionCookieName, getSecureSessionCookieName } from '../lib/app-slug';
 import { checkPagePermission, isRBACEnabled } from './rbac-check';
@@ -151,16 +152,23 @@ function isLoginPage(pathname: string): boolean {
   return pathname === LOGIN_PAGE;
 }
 
-/** Ensures callback URLs never point to auth pages (prevents redirect loops) */
+/**
+ * Ensures callback URLs never point to auth pages (prevents redirect loops) AND
+ * never point off-origin (prevents open redirect).
+ *
+ * 375656: the previous body tested `pathname` FIRST and returned '/' early, so
+ * the two call sites that pass an attacker-controlled `searchParams` are both
+ * inside `if (onLoginPage)` branches - and `isLoginPage` is exact equality against
+ * `LOGIN_PAGE`, which starts with `/account-auth/`. The early return therefore
+ * fired before the parameter was ever read. That made this function SAFE, but
+ * safe because of which argument the caller happened to pass, not because the
+ * attacker-controlled value was ever checked: `existing` was returned raw on the
+ * strength of a `startsWith` test that `https://evil.example.com` passes.
+ * Nothing named that dependency, and reordering the arguments would have opened
+ * it silently. Both inputs are now validated by the same parser-based guard.
+ */
 function getSafeCallbackUrl(pathname: string, searchParams?: URLSearchParams): string {
-  if (pathname.startsWith('/account-auth/')) {
-    return '/';
-  }
-  const existing = searchParams?.get('callbackUrl');
-  if (existing && !existing.startsWith('/account-auth/')) {
-    return existing;
-  }
-  return pathname;
+  return resolveCallbackDestination(pathname, searchParams);
 }
 
 /** Clear all session cookies on a response */
@@ -388,14 +396,38 @@ export function createMvpMiddleware(options: MvpMiddlewareOptions = {}) {
     // --- Fetch session viability from internal API ---
     const { sessionStatus, sessionPointer } = await checkViability(request, viabilityEndpoint, log);
 
-    // --- Handle stale session early (cookie exists but session doesn't) ---
+    // --- Stale session (cookie exists but session doesn't): OBSERVE ONLY, DO NOT DECIDE ---
+    //
+    // *** CARD 349607. THIS BLOCK USED TO `return` HERE, AND THAT RETURN WAS A BYPASS. ***
+    //
+    // makeAuthDecision() below already handles this exact condition at its
+    // `if (!sessionStatus.exists)` branch, and it handles it with TWO guard
+    // clauses that this early return did not have:
+    //
+    //     if (onLoginPage)                 return { type: 'allow' };   // no redirect loop
+    //     if (pathname.startsWith('/api/'))return { type: 'allow' };   // no HTML 307 at fetch()
+    //
+    // Returning here skipped BOTH. The `/api/` case is the reported harm: a
+    // stale-session XHR was answered with a 307 to an HTML login page, so the
+    // failure is invisible to `fetch()` - the caller sees an opaque redirect
+    // instead of an auth error, which is the same "correct logic preempted by
+    // an earlier return" shape recorded on 307290.
+    //
+    // This was NOT a missing feature one level down - the decision engine's
+    // branch is a strict superset of the behaviour this block implemented.
+    // The early return was a DUPLICATE that had drifted from the original.
+    // Adding a single `/api/` exemption here would have re-created the
+    // duplication (and left the onLoginPage divergence in place), so the
+    // duplicate is removed instead and the engine is left as the ONE decider.
+    //
+    // The warning is deliberately KEPT: it is the only operational signal that
+    // stale sessions are occurring, and it costs nothing to log before
+    // delegating. Do not re-introduce a `return` in this block.
     if (!isPublic && sessionStatus.exists === false && sessionPointer.sessionToken) {
-      const safeCallback = getSafeCallbackUrl(pathname);
-      log.warn('Stale session detected', {
+      log.warn('Stale session detected (delegating to decision engine)', {
         sessionToken: sessionPointer.sessionToken?.substring(0, 8) + '...',
         pathname
       });
-      return redirectTo(request, `${LOGIN_PAGE}?callbackUrl=${encodeURIComponent(safeCallback)}`, true);
     }
 
     // --- Run decision engine ---

package/src/pages/profile/EnhancedProfilePage.tsx

@@ -69,7 +69,17 @@ interface ProfileData {
   full_name?: string;
   two_factor_enabled?: boolean;
   roles?: string[];
-  contact_information?: any;
+  // `contact_information` was declared here and read by the mapper below. The MEMBER
+  // endpoint never emits it - it belongs to AdminUserProfileResponse. The CORRECT
+  // shapes were already declared above (contact_info :44, address :51); only the
+  // mapper was pointed at the wrong field. Removed so nothing can read it again.
+}
+
+// An all-null object is not data. The member profile DTOs are always instantiated
+// server-side (UserService.GetUserProfileAsync), so `obj ? ... : undefined` cannot
+// tell "has an address" from "has an empty address shell".
+function hasAnyValue(obj: Record<string, unknown> | undefined | null): boolean {
+  return !!obj && Object.values(obj).some(v => v !== null && v !== undefined && v !== '');
 }
 
 interface EditableSectionProps {
@@ -233,20 +243,39 @@ export default function EnhancedProfilePage() {
         title: undefined,
         bio: undefined,
       },
-      contact_info: rawProfile.contact_information ? {
-        secondary_email: rawProfile.contact_information.secondary_email,
-        secondary_phone: rawProfile.contact_information.secondary_phone,
-        website: rawProfile.contact_information.website,
+      // Both blocks used to be read off `rawProfile.contact_information`, which the
+      // MEMBER endpoint NEVER emits - that name belongs to AdminUserProfileResponse
+      // (its only 2 occurrences in PayEz-Core are in that admin DTO).
+      // /api/account/profile returns UserProfileResponse: `contact_info` plus a
+      // SEPARATE TOP-LEVEL `address`. Both guards therefore always took the false
+      // branch and both blocks rendered permanently empty for every member.
+      //
+      // NOT a rename: `address` is a SIBLING of contact_info, not nested inside it,
+      // so contact_information -> contact_info alone fixes Contact and leaves ADDRESS
+      // DEAD. Inner names are snake_case on both DTOs; the old camelCase reads were
+      // shaped for the ADMIN payload, which is where those keys really are camelCase.
+      // GUARD ON CONTENT, NOT PRESENCE. UserService.GetUserProfileAsync ALWAYS
+      // instantiates both DTOs (ContactInfo = new ProfileContactInfoDto {...},
+      // Address = new AddressDto {...}), so both arrive NON-NULL with all-null
+      // members when the member has nothing on file. A truthiness guard always
+      // passes and would render a card full of blank fields - the hazard QAPert
+      // named in 41360 for the naive rename, which applies just as much to
+      // reading the CORRECT fields.
+      contact_info: hasAnyValue(rawProfile.contact_info) ? {
+        secondary_email: rawProfile.contact_info?.secondary_email,
+        secondary_phone: rawProfile.contact_info?.secondary_phone,
+        website: rawProfile.contact_info?.website,
+        preferred_contact_method: rawProfile.contact_info?.preferred_contact_method,
       } : undefined,
-      address: rawProfile.contact_information ? {
-        address_line_1: rawProfile.contact_information.addressLine1,
-        address_line_2: rawProfile.contact_information.addressLine2,
-        city: rawProfile.contact_information.city,
-        state_id: rawProfile.contact_information.stateId,
-        state_name: rawProfile.contact_information.stateName,
-        postal_code: rawProfile.contact_information.postalCode,
-        country_code: rawProfile.contact_information.countryCode,
-        country_name: rawProfile.contact_information.countryName,
+      address: hasAnyValue(rawProfile.address) ? {
+        address_line_1: rawProfile.address?.address_line_1,
+        address_line_2: rawProfile.address?.address_line_2,
+        city: rawProfile.address?.city,
+        state_id: rawProfile.address?.state_id,
+        state_name: rawProfile.address?.state_name,
+        postal_code: rawProfile.address?.postal_code,
+        country_code: rawProfile.address?.country_code,
+        country_name: rawProfile.address?.country_name,
       } : undefined,
       two_factor_enabled: rawProfile.two_factor_enabled,
       roles: rawProfile.roles,

package/src/pages/verify-code/page.tsx

@@ -35,6 +35,7 @@ import { useRouter, useSearchParams } from 'next/navigation';
 import { authClient } from '../../client/better-auth-client';
 import { Suspense } from 'react';
 import { useColors } from '../../theme/useTheme';
+import { safeCallbackPath } from '../../auth/safe-callback';
 
 /**
  * Session storage key to track that user intentionally navigated to verify-code.
@@ -52,7 +53,31 @@ interface MaskedInfo {
 function VerifyCodeForm({ enrollHref }: { enrollHref: string }) {
   const router = useRouter();
   const searchParams = useSearchParams();
-  const callbackUrl = searchParams?.get('callbackUrl') || '/dashboard';
+  /**
+   * 375936 - ORIGIN-GUARDED AT THE READ, NOT AT THE SINK.
+   *
+   * This value ends up in `window.location.href` after a SUCCESSFUL 2FA
+   * ceremony (see the setTimeout further down). That is a full navigation, so
+   * an absolute URL here is a cross-origin redirect - the user completes a
+   * genuine login and is then dropped on an attacker-controlled page at the
+   * exact moment they are most primed to trust what they see.
+   *
+   * This used to be a raw `searchParams?.get('callbackUrl') || '/dashboard'`.
+   * The middleware does NOT protect this page: create-middleware's
+   * `needsTwoFactorRedirect` returns false for VERIFY_CODE_PAGE, so a direct
+   * request arrives here with its query string untouched.
+   *
+   * Do NOT "simplify" this back to a `startsWith('/account-auth/')` test. The
+   * three such tests below are LOOP prevention, not ORIGIN prevention -
+   * `https://evil.example` passes every one of them. safeCallbackPath asks the
+   * URL parser instead, so protocol-relative (`//host`), backslash (`/\host`)
+   * and TAB/LF/CR spellings all fail one origin comparison rather than needing
+   * their own blacklist entry.
+   *
+   * Guarding at the READ rather than at the sink means every later use of
+   * `callbackUrl` on this page inherits the guarantee.
+   */
+  const callbackUrl = safeCallbackPath(searchParams?.get('callbackUrl'), '/dashboard');
 
   const { data: sessionData, isPending } = authClient.useSession();
   const session = sessionData;

package/src/routes/auth/viability.ts

@@ -297,7 +297,7 @@ export async function GET(req: NextRequest) {
       const mfaExpiresAt = session?.mfaExpiresAt || 0;
       const mfaExpired = mfaExpiresAt > 0 && mfaExpiresAt < Date.now();
       // Check mfaVerified (normalized name) with fallback to twoFactorComplete for compatibility
-      const mfaVerifiedInSession = session?.mfaVerified ?? (session as any)?.twoFactorComplete ?? false;
+      const mfaVerifiedInSession = session?.mfaVerified ?? false;
 
       // User has completed 2FA requirements if: they verified AND it hasn't expired
       const userHasCompletedTenantTwoFactorRequirements = mfaVerifiedInSession && !mfaExpired;
@@ -347,7 +347,7 @@ export async function GET(req: NextRequest) {
     const mfaExpiresAt = session?.mfaExpiresAt || 0;
     const mfaExpired = mfaExpiresAt > 0 && mfaExpiresAt < Date.now();
     // Check mfaVerified (normalized name) with fallback to twoFactorComplete for compatibility
-    const mfaVerifiedInSession = session?.mfaVerified ?? (session as any)?.twoFactorComplete ?? false;
+    const mfaVerifiedInSession = session?.mfaVerified ?? false;
 
     // DEBUG: Log what we're reading from the session
     console.log('[VIABILITY] Session 2FA state:', {

package/src/server/auth-guard.ts

@@ -127,7 +127,33 @@ export async function authGuard(options?: AuthGuardOptions): Promise<AuthGuardRe
   }
 
   if (requires2FA) {
-    const mfaVerified = sessionData.mfaVerified ?? (sessionData as any).twoFactorComplete ?? false;
+    // 369858: the legacy `?? (sessionData as any).twoFactorComplete` carry is REMOVED.
+    // This is THE access gate - the only one of the 8 carry sites that grants access
+    // rather than reporting status - so it reads exactly one source of truth.
+    //
+    // Removing it is fail-closed. No current writer emits the legacy field alone:
+    // session-store.ts:444-445 writes both as a pair from a server-derived stepped-up
+    // token, auth/refresh.ts:376 writes it as a MIRROR of mfaVerified, and
+    // routes/auth/session.ts:149-157 refuses both on PRESENCE, so a caller cannot
+    // assert either. The carry therefore only ever served sessions minted before
+    // `mfaVerified` existed, and for those the correct behaviour is re-verify, not
+    // grandfather. Cost is one forced re-challenge for a stale legacy session.
+    //
+    // Severity note, so nobody re-inflates this later: the operator was `??`
+    // (nullish), NOT `||`. `false ?? x` is `false`, so an explicitly DENIED session
+    // could never be upgraded by a stale flag. This was legacy grandfathering, not a
+    // live 2FA bypass. Had it been `||`, it would have been the bypass.
+    const mfaVerified = sessionData.mfaVerified ?? false;
+
+    // 339563 / 369858 §3: THIS IS STILL A FAIL-OPEN AND IS DELIBERATELY LEFT VISIBLE.
+    // An absent mfaExpiresAt collapses to 0, so `mfaExpired` is false and the MFA
+    // verdict NEVER EXPIRES. That needs no legacy-session hypothesis: it fires on a
+    // current `mfaVerified: true` session whose token carried no `mfa_expires` claim -
+    // the passwordless/primary-credential lane, named on the write path in the
+    // source's own voice at session-store.ts:464-467 ("it IS the case the consumers
+    // currently fail OPEN on"). Removing the carry above does NOT touch this.
+    // Tracked separately by BAPert; not fixed here because failing closed on absent
+    // expiry would deny the passwordless lane outright and that is a product call.
     const mfaExpiresAt = sessionData.mfaExpiresAt || 0;
     const mfaExpired = mfaExpiresAt > 0 && mfaExpiresAt < Date.now();