@payez/next-mvp 4.4.1 → 4.4.2

package/dist/api-handlers/mfa/totp-verify.d.ts

@@ -40,8 +40,10 @@ export declare function POST(req: NextRequest): Promise<NextResponse<{
         attemptedRefresh: boolean;
     };
 }> | NextResponse<{
+    message: any;
+    requiresChallenge?: boolean | undefined;
+    nextStep?: "mfa_verify" | undefined;
     success: boolean;
     verificationSuccessful: boolean;
     twoFactorSessionVerified: boolean;
-    message: any;
 }>>;

package/dist/api-handlers/mfa/totp-verify.js

@@ -68,6 +68,10 @@ async function POST(req) {
         // session. No tokens => no transition: we must not mark 2FA complete on the
         // strength of a 200 alone.
         let sessionTransitioned = false;
+        // R908(e): "we could not establish MFA" is a THIRD outcome, distinct from
+        // both success and failure. It must reach the client as a challenge, not as
+        // a silent success (fail-open) and not as a rejection (fail-closed).
+        let requiresChallenge = false;
         if (unwrappedData.access_token && unwrappedData.refresh_token) {
             const token = await (0, test_aware_get_token_1.getTokenTestAware)(req);
             const sessionToken = (token?.sessionToken || token?.redisSessionId);
@@ -90,15 +94,27 @@ async function POST(req) {
                 catch {
                     // Refresh token may carry no exp claim; default stands.
                 }
-                await (0, session_store_1.transitionTo2FASession)(sessionToken, {
+                // R908(e): the transition can now decline to grant. Read what was
+                // actually written instead of assuming the call granted - the store
+                // withholds mfaVerified when the stepped-up token carries no
+                // mfa_expires, and reports the re-challenge via nextStep.
+                const transitioned = await (0, session_store_1.transitionTo2FASession)(sessionToken, {
                     accessToken: unwrappedData.access_token,
                     refreshToken: unwrappedData.refresh_token,
                     accessTokenExpires,
                     refreshTokenExpires,
                 }, 'totp' // 2FA method, used by the refresh-token flow
                 );
-                sessionTransitioned = true;
-                console.log('[VERIFY_TOTP] Session transitioned to 2FA-verified');
+                sessionTransitioned = transitioned?.mfaVerified === true;
+                requiresChallenge = transitioned?.nextStep === 'mfa_verify';
+                if (sessionTransitioned) {
+                    console.log('[VERIFY_TOTP] Session transitioned to 2FA-verified');
+                }
+                else {
+                    console.warn('[VERIFY_TOTP] R908(e): IDP verified the code but the session was NOT ' +
+                        'marked MFA-verified (no mfa_expires on the returned token). Reporting ' +
+                        'requiresChallenge so the client re-challenges rather than proceeding.');
+                }
             }
             else {
                 console.warn('[VERIFY_TOTP] IDP verified the code but no session token was resolvable — session NOT transitioned');
@@ -120,6 +136,9 @@ async function POST(req) {
             success: true,
             verificationSuccessful: true,
             twoFactorSessionVerified: sessionTransitioned,
+            // R908(e): tells the client to re-challenge. Present only when the code
+            // verified at the IDP but produced no evidence we could record.
+            ...(requiresChallenge ? { requiresChallenge: true, nextStep: 'mfa_verify' } : {}),
             message: unwrappedData.message || 'Authenticator code verified successfully',
         }, { status: 200 });
     }

package/dist/api-handlers/session/refresh-viability.js

@@ -23,14 +23,14 @@ async function GET(req) {
             // Still need to get session data for twoFactorComplete even when refresh is in progress
             const sessionData = await (0, session_store_1.getSession)(finalSessionToken);
             logger_1.logger.info('[REFRESH-VIABILITY] Refresh already in progress, telling middleware to wait', { sessionToken: finalSessionToken.substring(0, 8) + '...' });
-            return server_1.NextResponse.json({ canRefresh: true, reason: 'refresh_in_progress', refreshInProgress: true, sessionToken: finalSessionToken, twoFactorComplete: sessionData?.mfaVerified ?? sessionData?.twoFactorComplete ?? false }, { status: 200 });
+            return server_1.NextResponse.json({ canRefresh: true, reason: 'refresh_in_progress', refreshInProgress: true, sessionToken: finalSessionToken, twoFactorComplete: sessionData?.mfaVerified ?? false }, { status: 200 });
         }
         const sessionData = await (0, session_store_1.getSession)(finalSessionToken);
         if (!sessionData) {
             return server_1.NextResponse.json({ canRefresh: false, reason: 'session_not_found', sessionToken: finalSessionToken }, { status: 200 });
         }
         const viabilityCheck = (0, refresh_token_validator_1.checkRefreshViability)(sessionData);
-        return server_1.NextResponse.json({ canRefresh: viabilityCheck.canRefresh, reason: viabilityCheck.reason, timeRemaining: viabilityCheck.timeRemaining, expiresAt: viabilityCheck.expiresAt, accessTokenExpired: viabilityCheck.accessTokenExpired, accessTokenTimeRemaining: viabilityCheck.accessTokenTimeRemaining, sessionToken: finalSessionToken, twoFactorComplete: sessionData.mfaVerified ?? sessionData.twoFactorComplete ?? false, userId: sessionData.userId, refreshInProgress: false });
+        return server_1.NextResponse.json({ canRefresh: viabilityCheck.canRefresh, reason: viabilityCheck.reason, timeRemaining: viabilityCheck.timeRemaining, expiresAt: viabilityCheck.expiresAt, accessTokenExpired: viabilityCheck.accessTokenExpired, accessTokenTimeRemaining: viabilityCheck.accessTokenTimeRemaining, sessionToken: finalSessionToken, twoFactorComplete: sessionData.mfaVerified ?? false, userId: sessionData.userId, refreshInProgress: false });
     }
     catch (error) {
         logger_1.logger.error('[REFRESH-VIABILITY] Error checking refresh viability', { error: error instanceof Error ? error.message : String(error) });

package/dist/api-handlers/session/viability.js

@@ -106,7 +106,7 @@ async function GET(req) {
                 const mfaExpiresAt = sessionData.mfaExpiresAt || 0;
                 const mfaExpired = mfaExpiresAt > 0 && mfaExpiresAt < Date.now();
                 // Check both field names for compatibility (mfaVerified is the normalized name)
-                const sessionMfaComplete = sessionData.mfaVerified ?? sessionData.twoFactorComplete ?? false;
+                const sessionMfaComplete = sessionData.mfaVerified ?? false;
                 const effectiveTwoFactorComplete = sessionMfaComplete && !mfaExpired;
                 console.log('[VIABILITY] Session 2FA check:', {
                     sessionToken: sessionToken.substring(0, 8) + '...',

package/dist/auth/auth-decision.js

@@ -7,13 +7,18 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.makeAuthDecision = makeAuthDecision;
+const safe_callback_1 = require("./safe-callback");
 /**
  * Main decision function - pure, testable, deterministic
  */
 function makeAuthDecision(context) {
     const { pathname, isPublicRoute, isLoginPage, searchParams, sessionPointer, sessionStatus, circuitBreakerOpen } = context;
-    // SAFEGUARD: Never use auth pages as callback URLs to prevent redirect loops
-    const safeCallbackUrl = pathname.startsWith('/account-auth/') ? '/' : pathname;
+    // SAFEGUARD: Never use auth pages as callback URLs to prevent redirect loops.
+    // 375656: `pathname` is our own request path rather than an attacker-supplied
+    // parameter, so this site was not the open redirect - but it is routed through
+    // the same guard so the package has ONE definition of an acceptable callback,
+    // and so the value is parser-normalised before being carried into a redirect.
+    const safeCallbackUrl = (0, safe_callback_1.safeCallbackPath)(pathname);
     // Public routes are allowed, but we need to check login page separately
     if (isPublicRoute && !isLoginPage) {
         // For non-login public routes, check if authenticated user needs 2FA
@@ -104,8 +109,17 @@ function makeAuthDecision(context) {
         // If user is on the login page, send them to verify-code with the original callback
         if (isLoginPage) {
             const callbackUrl = searchParams.get('callbackUrl') || '/';
-            // CRITICAL FIX: Never use auth pages as callback URLs
-            const safeCallbackUrl = callbackUrl.startsWith('/account-auth/') ? '/' : callbackUrl;
+            // 375656: this previously tested the raw parameter with a prefix check against
+            // the auth path, and returned the parameter itself when it did not match.
+            // (The vulnerable expression is deliberately NOT reproduced verbatim here: a
+            // comment carrying it puts the string into dist, and a reviewer grepping for
+            // that pattern would score this FIXED build as vulnerable - the exact
+            // sink-counting inversion recorded on 375936.)
+            // That is a redirect-LOOP guard in the seat where an ORIGIN check belongs:
+            // `https://evil.example.com` does not start with `/account-auth/`, so it passed
+            // through untouched. safeCallbackPath() asks the URL parser instead, so every
+            // spelling that escapes the origin fails one comparison. See ./safe-callback.
+            const safeCallbackUrl = (0, safe_callback_1.safeCallbackPath)(callbackUrl);
             console.log('[MIDDLEWARE-DECISION] On login page with 2FA incomplete, redirecting to verify-code', {
                 originalCallback: callbackUrl,
                 safeCallback: safeCallbackUrl,
@@ -148,8 +162,8 @@ function makeAuthDecision(context) {
         // For login page, redirect to 2FA with original callback
         if (isLoginPage) {
             const callbackUrl = searchParams.get('callbackUrl') || '/';
-            // CRITICAL FIX: Never use auth pages as callback URLs
-            const safeCallbackUrl = callbackUrl.startsWith('/account-auth/') ? '/' : callbackUrl;
+            // 375656: origin-checked, not prefix-checked. See ./safe-callback.
+            const safeCallbackUrl = (0, safe_callback_1.safeCallbackPath)(callbackUrl);
             return {
                 type: 'redirect',
                 location: `/account-auth/verify-code?callbackUrl=${encodeURIComponent(safeCallbackUrl)}`,
@@ -165,8 +179,13 @@ function makeAuthDecision(context) {
     // Authenticated user on login page - redirect to dashboard or callback
     if (isLoginPage) {
         const callbackUrl = searchParams.get('callbackUrl') || '/';
-        // CRITICAL FIX: Never redirect back to login page (prevents infinite loop)
-        const safeCallbackUrl = callbackUrl.startsWith('/account-auth/') ? '/' : callbackUrl;
+        // 375656 - THE PUBLISHED OPEN REDIRECT. This value becomes `location` VERBATIM
+        // below (not a query parameter on a relative path, as at the two sites above),
+        // so the old `startsWith('/account-auth/')` test sent an authenticated user
+        // straight to any absolute URL an attacker put in `?callbackUrl=`. Its own
+        // comment says "prevents infinite loop", which is what it was written for -
+        // loop prevention, never origin validation. See ./safe-callback.
+        const safeCallbackUrl = (0, safe_callback_1.safeCallbackPath)(callbackUrl);
         console.log('[MIDDLEWARE-DECISION] Authenticated user on login page, redirecting', {
             originalCallback: callbackUrl,
             safeCallback: safeCallbackUrl

package/dist/auth/better-auth.js

@@ -77,6 +77,24 @@ const session_store_1 = require("../lib/session-store");
 function secretFingerprint(value) {
     return (0, crypto_1.createHash)('sha256').update(value).digest('hex').slice(0, 12);
 }
+/**
+ * 273183: keys written onto the `ba:{slug}:{token}` record by an author OTHER
+ * than Better Auth, which must survive a Better Auth session write.
+ *
+ * Today this is exactly `idpTokens`, written by `storeIdpTokensInSession`. The
+ * list is a named constant rather than a hardcoded check because the shape of
+ * the bug is "a second author appeared and the adapter did not know" — the next
+ * enrichment key should be added here, not rediscovered as a strip.
+ */
+const PRESERVED_SESSION_KEYS = ['idpTokens'];
+/**
+ * True for a JSON object we can safely merge into — not null, not an array.
+ * `typeof null === 'object'` and arrays are objects, and merging into either
+ * would corrupt the record rather than preserve it.
+ */
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
 /**
  * Build Better Auth social providers from IDP config.
  */
@@ -451,7 +469,111 @@ function createBetterAuthInstance(idpConfig, opts = {}) {
              */
             set: async (key, value, ttl) => {
                 const redis = (0, redis_1.getRedis)();
-                await redis.setex(`ba:${appSlug}:${key}`, ttl ?? session_store_1.SESSION_TTL, value);
+                const redisKey = `ba:${appSlug}:${key}`;
+                /**
+                 * 273183 — READ-MODIFY-WRITE, BECAUSE THIS RECORD HAS TWO AUTHORS.
+                 * (Found by DotNetPert-Scout; handed over as Cluster-B root-cause
+                 * evidence under BAPert's R920(a). Reproduced here before fixing.)
+                 *
+                 * Better Auth owns `{session, user}` and serialises exactly that. But
+                 * `storeIdpTokensInSession` (below, ~:1010) ENRICHES the same key with
+                 * `idpTokens` via its own read-modify-write. This setter did a blind
+                 * `setex` of Better Auth's payload, so every write it makes — including
+                 * each routine `updateAge` session rewrite, not merely an expiry —
+                 * STRIPPED `idpTokens` back off the record.
+                 *
+                 * The consumer then falls back to an identity husk: `mfaVerified:false`,
+                 * `roles:[]`. It fails CLOSED, so it is not a 369782-class bypass — but
+                 * per BAPert it is a public-test blocker on its own terms, because a
+                 * tester who trips the `updateAge` cadence gets a spurious 2FA re-prompt
+                 * AND SILENTLY LOSES THEIR ROLES mid-session. That is a visible product
+                 * failure regardless of which direction it fails in.
+                 *
+                 * WHY MERGE HERE RATHER THAN MOVE THE DATA. The enriching writer already
+                 * does a read-modify-write; it was correct. The bug is that ONE of the
+                 * two authors of this key wrote as though it were the only one. Fixing
+                 * the adapter fixes it for every future enrichment key, whereas moving
+                 * `idpTokens` elsewhere would leave the next one to rediscover this.
+                 *
+                 * ONLY keys in PRESERVED_KEYS are carried, and ONLY when the incoming
+                 * payload does not set them — so Better Auth still wins on everything it
+                 * owns, and an explicit incoming value is never overridden by a stale one.
+                 *
+                 * NOT ATOMIC, and deliberately not: an enrichment landing between this
+                 * read and this write is still lost. Closing that needs a WATCH/MULTI or
+                 * a Lua script, which is a larger change than tonight allows. This
+                 * narrows the window from "every single write" to "a genuine race", and
+                 * the residual is recorded here rather than left to be re-found.
+                 */
+                let payload = value;
+                try {
+                    const existingRaw = await redis.get(redisKey);
+                    if (existingRaw) {
+                        const existing = JSON.parse(existingRaw);
+                        const incoming = JSON.parse(value);
+                        if (isPlainObject(existing) && isPlainObject(incoming)) {
+                            let carried = false;
+                            for (const preserved of PRESERVED_SESSION_KEYS) {
+                                if (preserved in existing && !(preserved in incoming)) {
+                                    incoming[preserved] = existing[preserved];
+                                    carried = true;
+                                }
+                            }
+                            if (carried)
+                                payload = JSON.stringify(incoming);
+                        }
+                    }
+                }
+                catch (mergeErr) {
+                    /**
+                     * This adapter also stores `verification:*` and `active-sessions-*`
+                     * records, which are not necessarily session-shaped JSON. A record we
+                     * cannot parse is not a session to enrich, so writing through unchanged
+                     * is correct rather than merely tolerable.
+                     *
+                     * WARNED, NOT THROWN, and the asymmetry is the point: this block is an
+                     * ENRICHMENT-PRESERVING read. Letting it fail the write would convert a
+                     * degraded read into a lost session — the precise inversion 170033 fix 1
+                     * above exists to prevent. The `setex` below is outside this try and is
+                     * still unswallowed, so a genuine write failure still propagates.
+                     */
+                    console.warn(`[BETTER_AUTH] secondaryStorage.set: could not preserve enrichment keys on ` +
+                        `ba:${appSlug}:sha256:${secretFingerprint(key)} — writing Better Auth's payload ` +
+                        `as-is. If this record held idpTokens they are now gone (273183):`, mergeErr instanceof Error ? mergeErr.message : String(mergeErr));
+                }
+                /**
+                 * QA 6952 / R913 - CLAMP, DO NOT DEFER.
+                 *
+                 * This was `ttl ?? SESSION_TTL`, which READS as "SESSION_TTL is the single
+                 * source of session TTL" - what session-store.ts claims, and the mechanism
+                 * by which the 7d-vs-3d zombie window was supposedly closed for good.
+                 *
+                 * IT WAS DEAD CODE. Better Auth ALWAYS supplies a ttl: every one of the
+                 * eight secondaryStorage.set call sites in
+                 * better-auth/dist/db/internal-adapter.mjs passes one explicitly (:36,
+                 * :180, :189, :309, :320, :344, :553, :622). `??` fires only on
+                 * null/undefined, so the fallback NEVER RAN. Every `ba:` record took Better
+                 * Auth's 7d default - `session.expiresIn` is not configured in this file -
+                 * while the canonical store stayed at SESSION_TTL (3d). That 4-day drift IS
+                 * the zombie window the constant exists to prevent: the guard was bypassed
+                 * by the very parameter written to defer to it.
+                 *
+                 * `Math.min`, NOT a hard SESSION_TTL: this same adapter also stores
+                 * `verification:*` (:553, :622) and `active-sessions-*` (:180, :320, :344)
+                 * records whose TTLs are legitimately SHORTER than 3d. Overwriting those
+                 * would EXTEND them - turning a fix for over-long sessions into a bug that
+                 * keeps verification codes alive for three days. Clamp DOWN, never up.
+                 *
+                 * Clamped down to 3d rather than raising the canonical store to 7d because
+                 * SESSION_TTL matches the IDP refresh-token lifetime: a session outliving
+                 * the refresh token sustaining it cannot be refreshed, so the extra days are
+                 * a husk that reads as authenticated. Fail-closed beats ambiguous.
+                 *
+                 * DO NOT "fix" this by making storeIdpTokensInSession preserve Better
+                 * Auth's 7d. That deletes the last remnant of QA 6952 and makes the drift
+                 * universal. See test/ba-session-ttl-clamp.test.cjs.
+                 */
+                await redis.setex(redisKey, Math.min(ttl ?? session_store_1.SESSION_TTL, session_store_1.SESSION_TTL), payload);
             },
             delete: async (key) => {
                 try {

package/dist/auth/safe-callback.d.ts

@@ -0,0 +1,63 @@
+/**
+ * ONE definition of "is this callback target safe to navigate to", for the
+ * whole package (375656).
+ *
+ * *** THIS DELEGATES PARSING TO THE URL PARSER. DO NOT REPLACE IT WITH
+ * *** startsWith() CHECKS. THAT APPROACH FAILED FOUR TIMES.
+ *
+ * WHY THIS FILE EXISTS: `@payez/next-mvp` shipped THREE bodies named
+ * `makeAuthDecision`, each carrying its own `callbackUrl.startsWith('/account-auth/')`
+ * test. That test is a REDIRECT-LOOP guard sitting in the seat where an ORIGIN
+ * check belongs - its own comment says "prevents infinite loop" - so
+ * `https://evil.example.com` does not start with `/account-auth/`, passes
+ * through untouched, and becomes the redirect target. The exported copy
+ * (`auth/auth-decision.ts`, re-exported from `index.ts` and `edge/middleware.ts`)
+ * is public API, so that is a published open redirect independent of who calls it.
+ *
+ * HISTORY, because it is the whole argument for the current shape (267097 /
+ * 267174 / 267448), carried over verbatim from the portal's `src/lib/safe-callback.ts`
+ * where this guard was proven (0 leaks / 21 hostile inputs):
+ *
+ *   v1  `startsWith('/') && !startsWith('//')`            -> bypassed by  /BACKSLASH host
+ *   v2  + `!startsWith('/' + BACKSLASH)`                  -> bypassed by  /TAB/host
+ *   ...                                                      and /LF/host, /CR/host
+ *
+ * Both bypasses work the same way: the browser NORMALISES the string AFTER the
+ * guard has finished looking at it. The WHATWG URL parser converts backslashes
+ * to forward slashes and STRIPS all ASCII tab, LF and CR before resolving. So a
+ * prefix check can always be defeated by a character that is not there yet when
+ * it runs. Each fix bought one character. The list was never provably complete.
+ *
+ * SO: stop re-implementing the parser and ask it instead. Resolve the input
+ * against a synthetic base and compare ORIGINS. Anything that escapes the
+ * origin - however it is spelled, including spellings nobody has found yet -
+ * fails one comparison. The returned value is the parser's own NORMALISED
+ * output, so an accepted path cannot smuggle a control character onward either.
+ *
+ * A synthetic base is used deliberately so this works identically in a server
+ * component (no window), on the client, and in the edge runtime.
+ */
+/** Where we send anyone whose requested target we will not honour. */
+export declare const DEFAULT_CALLBACK = "/";
+/**
+ * The value to navigate to: a same-origin relative path, NORMALISED by the URL
+ * parser, or `fallback` for anything that escapes the origin or loops back into
+ * the auth surface. Never throws.
+ */
+export declare function safeCallbackPath(raw: unknown, fallback?: string): string;
+/** True when `raw` is a callback target we are willing to honour. */
+export declare function isSafeCallbackPath(raw: unknown): raw is string;
+/**
+ * Pick the post-login destination: an explicit `?callbackUrl=` when it is one we
+ * will honour, otherwise the current path, otherwise `/`.
+ *
+ * This replaces the package's three hand-rolled `getSafeCallbackUrl` /
+ * `getCallbackUrl` bodies. Note the ARGUMENT ORDER DEPENDENCY those had: they
+ * tested `pathname` FIRST and returned early, so a caller on the login page
+ * never reached the attacker-controlled parameter at all - safe, but only
+ * because that caller happened to pass a value that tripped the function's own
+ * first guard. Nothing in the code named that dependency, and an argument
+ * reorder would have opened it. Here BOTH inputs are validated, so the
+ * protection no longer depends on which one is passed.
+ */
+export declare function resolveCallbackDestination(pathname: string, searchParams?: URLSearchParams | null, fallback?: string): string;

package/dist/auth/safe-callback.js

@@ -0,0 +1,112 @@
+"use strict";
+/**
+ * ONE definition of "is this callback target safe to navigate to", for the
+ * whole package (375656).
+ *
+ * *** THIS DELEGATES PARSING TO THE URL PARSER. DO NOT REPLACE IT WITH
+ * *** startsWith() CHECKS. THAT APPROACH FAILED FOUR TIMES.
+ *
+ * WHY THIS FILE EXISTS: `@payez/next-mvp` shipped THREE bodies named
+ * `makeAuthDecision`, each carrying its own `callbackUrl.startsWith('/account-auth/')`
+ * test. That test is a REDIRECT-LOOP guard sitting in the seat where an ORIGIN
+ * check belongs - its own comment says "prevents infinite loop" - so
+ * `https://evil.example.com` does not start with `/account-auth/`, passes
+ * through untouched, and becomes the redirect target. The exported copy
+ * (`auth/auth-decision.ts`, re-exported from `index.ts` and `edge/middleware.ts`)
+ * is public API, so that is a published open redirect independent of who calls it.
+ *
+ * HISTORY, because it is the whole argument for the current shape (267097 /
+ * 267174 / 267448), carried over verbatim from the portal's `src/lib/safe-callback.ts`
+ * where this guard was proven (0 leaks / 21 hostile inputs):
+ *
+ *   v1  `startsWith('/') && !startsWith('//')`            -> bypassed by  /BACKSLASH host
+ *   v2  + `!startsWith('/' + BACKSLASH)`                  -> bypassed by  /TAB/host
+ *   ...                                                      and /LF/host, /CR/host
+ *
+ * Both bypasses work the same way: the browser NORMALISES the string AFTER the
+ * guard has finished looking at it. The WHATWG URL parser converts backslashes
+ * to forward slashes and STRIPS all ASCII tab, LF and CR before resolving. So a
+ * prefix check can always be defeated by a character that is not there yet when
+ * it runs. Each fix bought one character. The list was never provably complete.
+ *
+ * SO: stop re-implementing the parser and ask it instead. Resolve the input
+ * against a synthetic base and compare ORIGINS. Anything that escapes the
+ * origin - however it is spelled, including spellings nobody has found yet -
+ * fails one comparison. The returned value is the parser's own NORMALISED
+ * output, so an accepted path cannot smuggle a control character onward either.
+ *
+ * A synthetic base is used deliberately so this works identically in a server
+ * component (no window), on the client, and in the edge runtime.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_CALLBACK = void 0;
+exports.safeCallbackPath = safeCallbackPath;
+exports.isSafeCallbackPath = isSafeCallbackPath;
+exports.resolveCallbackDestination = resolveCallbackDestination;
+/** Where we send anyone whose requested target we will not honour. */
+exports.DEFAULT_CALLBACK = '/';
+/** The auth surface. A callback pointing back into it causes a redirect cycle. */
+const AUTH_PREFIX = '/account-auth/';
+/**
+ * Synthetic, unreachable base. Only ever used as the resolution origin for the
+ * comparison below - never emitted, never navigated to. `.invalid` is reserved
+ * by RFC 2606 and can never resolve.
+ */
+const BASE = 'http://safe-callback.invalid';
+/**
+ * The value to navigate to: a same-origin relative path, NORMALISED by the URL
+ * parser, or `fallback` for anything that escapes the origin or loops back into
+ * the auth surface. Never throws.
+ */
+function safeCallbackPath(raw, fallback = exports.DEFAULT_CALLBACK) {
+    if (typeof raw !== 'string' || raw.length === 0)
+        return fallback;
+    let url;
+    try {
+        url = new URL(raw, BASE);
+    }
+    catch {
+        return fallback;
+    }
+    // Anything that resolved to a different origin escaped, however it was spelled:
+    // absolute, protocol-relative //host, backslash /\host, tab/LF/CR variants, or
+    // a scheme like javascript: (whose origin is opaque and never equals BASE).
+    if (url.origin !== BASE)
+        return fallback;
+    // Loopbacks into the auth surface cause redirect cycles.
+    if (url.pathname.startsWith(AUTH_PREFIX))
+        return fallback;
+    // The parser's normalised output - control characters already stripped.
+    return url.pathname + url.search + url.hash;
+}
+/** True when `raw` is a callback target we are willing to honour. */
+function isSafeCallbackPath(raw) {
+    if (typeof raw !== 'string' || raw.length === 0)
+        return false;
+    try {
+        const url = new URL(raw, BASE);
+        return url.origin === BASE && !url.pathname.startsWith(AUTH_PREFIX);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Pick the post-login destination: an explicit `?callbackUrl=` when it is one we
+ * will honour, otherwise the current path, otherwise `/`.
+ *
+ * This replaces the package's three hand-rolled `getSafeCallbackUrl` /
+ * `getCallbackUrl` bodies. Note the ARGUMENT ORDER DEPENDENCY those had: they
+ * tested `pathname` FIRST and returned early, so a caller on the login page
+ * never reached the attacker-controlled parameter at all - safe, but only
+ * because that caller happened to pass a value that tripped the function's own
+ * first guard. Nothing in the code named that dependency, and an argument
+ * reorder would have opened it. Here BOTH inputs are validated, so the
+ * protection no longer depends on which one is passed.
+ */
+function resolveCallbackDestination(pathname, searchParams, fallback = exports.DEFAULT_CALLBACK) {
+    const requested = searchParams?.get('callbackUrl');
+    if (isSafeCallbackPath(requested))
+        return safeCallbackPath(requested, fallback);
+    return safeCallbackPath(pathname, fallback);
+}

package/dist/hooks/useProfile.d.ts

@@ -9,7 +9,6 @@ export type ProfileResponse = {
     phone_confirmed?: boolean;
     two_factor_enabled?: boolean;
     roles?: string[];
-    contact_information?: Record<string, any>;
     [key: string]: any;
 };
 export declare function useProfile(): import("@tanstack/react-query").UseQueryResult<ProfileResponse, Error>;

package/dist/lib/session-store.js

@@ -389,6 +389,26 @@ async function transitionTo2FASession(sessionToken, tokens, mfaMethod) {
             console.log('[transitionTo2FASession] Extracted bearerKeyId (kid) from new JWT header:', bearerKeyId);
         }
     }
+    // 339563: derive the expiry ONCE - it is both a field to write and the
+    // evidence test below. Re-deriving it twice invites the two reads to drift.
+    const mfaLifetime = mfaLifetimeFromAccessToken(newAccessToken);
+    // *** R908(e). ABSENCE OF THE EXPIRY IS NOT A COMPLETED CEREMONY. ***
+    //
+    // `mfaExpiresAt` is the only evidence we hold that a real MFA ceremony took
+    // place and when it lapses. When the stepped-up token carries no `mfa_expires`
+    // claim we do NOT know that this session is MFA-verified, and R908(e) binds
+    // the consumer to the third arm:
+    //
+    //   producers degrade  ->  consumers RE-CHALLENGE  ->  nobody infers a
+    //   negative from a silence.
+    //
+    // So: never mint `mfaVerified: true` off a token that carries no expiry (that
+    // is forging evidence of a ceremony we did not observe - 12188/12390), and
+    // never hard-refuse the user either (R486: null is "cannot determine", not
+    // "not 2FA-backed"). Leave the session un-verified and set `nextStep:
+    // 'mfa_verify'`, which is the field the gate already reads to mean "a usable
+    // method exists; challenge them" (SessionModel.ts:136).
+    const mfaEvidencePresent = mfaLifetime.mfaExpiresAt !== undefined;
     // Support both old and new field names in input
     // CRITICAL: Set BOTH mfaVerified (new) AND twoFactorComplete (legacy) for compatibility
     // auth.ts session callback reads twoFactorComplete, so we must set it here
@@ -396,15 +416,28 @@ async function transitionTo2FASession(sessionToken, tokens, mfaMethod) {
         idpAccessToken: newAccessToken,
         idpRefreshToken: tokens.idpRefreshToken || tokens.refreshToken,
         idpAccessTokenExpires: tokens.idpAccessTokenExpires || tokens.accessTokenExpires,
-        mfaVerified: true,
-        twoFactorComplete: true, // Legacy field - required by auth.ts session callback
+        mfaVerified: mfaEvidencePresent,
+        twoFactorComplete: mfaEvidencePresent, // Legacy field - required by auth.ts session callback
         mfaMethod: mfaMethod,
         // Update bearerKeyId if extracted from new token
         ...(bearerKeyId && { bearerKeyId }),
         // 339563: write the expiry in the SAME update that sets the flag. We already
         // hold the stepped-up token here and already decode its header above.
-        ...mfaLifetimeFromAccessToken(newAccessToken),
+        ...mfaLifetime,
+        // R908(e): no evidence -> route to the challenge, do not grant and do not eject.
+        ...(mfaEvidencePresent ? {} : { nextStep: 'mfa_verify' }),
     };
+    if (!mfaEvidencePresent) {
+        console.warn('[transitionTo2FASession] R908(e): the stepped-up token carries NO mfa_expires ' +
+            'claim, so there is no evidence of an MFA ceremony to record. NOT setting ' +
+            'mfaVerified; setting nextStep=mfa_verify so the consumer re-challenges. ' +
+            'If this fires for a lane that DID complete a real ceremony, the defect is ' +
+            'on the emit side (R908(b)) - do not "fix" it by minting the flag here.', {
+            sessionToken: sessionToken?.substring(0, 8) + '...',
+            mfaMethod,
+            hasAccessToken: !!newAccessToken,
+        });
+    }
     const refreshExpires = tokens.idpRefreshTokenExpires || tokens.refreshTokenExpires;
     if (refreshExpires !== undefined) {
         updates.idpRefreshTokenExpires = refreshExpires;
@@ -415,11 +448,13 @@ async function transitionTo2FASession(sessionToken, tokens, mfaMethod) {
         mfaMethod: updates.mfaMethod,
         hasIdpAccessToken: !!updates.idpAccessToken,
         // 339563: surface the expiry we derived. `mfaExpiresAt: undefined` here is
-        // the passwordless/primary-credential lane (token carried no mfa_expires),
-        // NOT a bug - but it IS the case the consumers currently fail OPEN on, so
-        // it needs to be visible in the log rather than inferred from its absence.
+        // the passwordless/primary-credential lane (token carried no mfa_expires).
+        // Since R908(e) that absence no longer fails OPEN: it withholds mfaVerified
+        // and sets nextStep=mfa_verify instead, so log both together - the pair is
+        // the whole decision.
         mfaExpiresAt: updates.mfaExpiresAt,
         mfaExpiresAtISO: updates.mfaExpiresAt ? new Date(updates.mfaExpiresAt).toISOString() : undefined,
+        nextStep: updates.nextStep,
     });
     const result = await updateSession(sessionToken, updates);
     console.log('[transitionTo2FASession] Result:', {
@@ -477,9 +512,23 @@ async function mark2FAComplete(sessionToken, accessToken) {
             'this session has no MFA expiry. Expected on a primary-credential lane ' +
             '(e.g. passwordless email); unexpected on an ordinary 2FA completion.');
     }
+    // R908(e): identical rule to transitionTo2FASession above - no expiry derived
+    // means no observed ceremony, so we re-challenge rather than mint the flag.
+    // This path matters more than its sibling: `mark2FAComplete(sessionToken)`
+    // with the accessToken omitted used to write a bare `mfaVerified: true` that
+    // NO consumer could ever expire, and it is reachable from route handlers that
+    // take their tokens from the request body.
+    const mfaEvidencePresent = mfaLifetime.mfaExpiresAt !== undefined;
+    if (!mfaEvidencePresent) {
+        console.warn('[mark2FAComplete] R908(e): no mfa_expires could be derived, so mfaVerified ' +
+            'is NOT being set. Writing nextStep=mfa_verify instead so the consumer ' +
+            're-challenges. A caller that needs the grant must pass the stepped-up ' +
+            'access token that carries the claim.');
+    }
     return updateSession(sessionToken, {
-        mfaVerified: true,
+        mfaVerified: mfaEvidencePresent,
         ...mfaLifetime,
+        ...(mfaEvidencePresent ? {} : { nextStep: 'mfa_verify' }),
     });
 }
 /**