@payez/next-mvp 4.4.1 → 4.4.2

package/dist/middleware/create-middleware.js

@@ -21,6 +21,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createMvpMiddleware = createMvpMiddleware;
 const server_1 = require("next/server");
 const route_config_1 = require("../auth/route-config");
+const safe_callback_1 = require("../auth/safe-callback");
 const internal_api_url_1 = require("../edge/internal-api-url");
 const app_slug_1 = require("../lib/app-slug");
 const rbac_check_1 = require("./rbac-check");
@@ -57,16 +58,23 @@ const VERIFY_CODE_PAGE = '/account-auth/verify-code';
 function isLoginPage(pathname) {
     return pathname === LOGIN_PAGE;
 }
-/** Ensures callback URLs never point to auth pages (prevents redirect loops) */
+/**
+ * Ensures callback URLs never point to auth pages (prevents redirect loops) AND
+ * never point off-origin (prevents open redirect).
+ *
+ * 375656: the previous body tested `pathname` FIRST and returned '/' early, so
+ * the two call sites that pass an attacker-controlled `searchParams` are both
+ * inside `if (onLoginPage)` branches - and `isLoginPage` is exact equality against
+ * `LOGIN_PAGE`, which starts with `/account-auth/`. The early return therefore
+ * fired before the parameter was ever read. That made this function SAFE, but
+ * safe because of which argument the caller happened to pass, not because the
+ * attacker-controlled value was ever checked: `existing` was returned raw on the
+ * strength of a `startsWith` test that `https://evil.example.com` passes.
+ * Nothing named that dependency, and reordering the arguments would have opened
+ * it silently. Both inputs are now validated by the same parser-based guard.
+ */
 function getSafeCallbackUrl(pathname, searchParams) {
-    if (pathname.startsWith('/account-auth/')) {
-        return '/';
-    }
-    const existing = searchParams?.get('callbackUrl');
-    if (existing && !existing.startsWith('/account-auth/')) {
-        return existing;
-    }
-    return pathname;
+    return (0, safe_callback_1.resolveCallbackDestination)(pathname, searchParams);
 }
 /** Clear all session cookies on a response */
 function clearSessionCookies(response, request) {
@@ -276,14 +284,38 @@ function createMvpMiddleware(options = {}) {
         }
         // --- Fetch session viability from internal API ---
         const { sessionStatus, sessionPointer } = await checkViability(request, viabilityEndpoint, log);
-        // --- Handle stale session early (cookie exists but session doesn't) ---
+        // --- Stale session (cookie exists but session doesn't): OBSERVE ONLY, DO NOT DECIDE ---
+        //
+        // *** CARD 349607. THIS BLOCK USED TO `return` HERE, AND THAT RETURN WAS A BYPASS. ***
+        //
+        // makeAuthDecision() below already handles this exact condition at its
+        // `if (!sessionStatus.exists)` branch, and it handles it with TWO guard
+        // clauses that this early return did not have:
+        //
+        //     if (onLoginPage)                 return { type: 'allow' };   // no redirect loop
+        //     if (pathname.startsWith('/api/'))return { type: 'allow' };   // no HTML 307 at fetch()
+        //
+        // Returning here skipped BOTH. The `/api/` case is the reported harm: a
+        // stale-session XHR was answered with a 307 to an HTML login page, so the
+        // failure is invisible to `fetch()` - the caller sees an opaque redirect
+        // instead of an auth error, which is the same "correct logic preempted by
+        // an earlier return" shape recorded on 307290.
+        //
+        // This was NOT a missing feature one level down - the decision engine's
+        // branch is a strict superset of the behaviour this block implemented.
+        // The early return was a DUPLICATE that had drifted from the original.
+        // Adding a single `/api/` exemption here would have re-created the
+        // duplication (and left the onLoginPage divergence in place), so the
+        // duplicate is removed instead and the engine is left as the ONE decider.
+        //
+        // The warning is deliberately KEPT: it is the only operational signal that
+        // stale sessions are occurring, and it costs nothing to log before
+        // delegating. Do not re-introduce a `return` in this block.
         if (!isPublic && sessionStatus.exists === false && sessionPointer.sessionToken) {
-            const safeCallback = getSafeCallbackUrl(pathname);
-            log.warn('Stale session detected', {
+            log.warn('Stale session detected (delegating to decision engine)', {
                 sessionToken: sessionPointer.sessionToken?.substring(0, 8) + '...',
                 pathname
             });
-            return redirectTo(request, `${LOGIN_PAGE}?callbackUrl=${encodeURIComponent(safeCallback)}`, true);
         }
         // --- Run decision engine ---
         const decision = makeAuthDecision({

package/dist/pages/profile/EnhancedProfilePage.js

@@ -21,6 +21,12 @@ const jsx_runtime_1 = require("react/jsx-runtime");
 const react_1 = __importDefault(require("react"));
 const useProfile_1 = require("../../hooks/useProfile");
 const useTheme_1 = require("../../theme/useTheme");
+// An all-null object is not data. The member profile DTOs are always instantiated
+// server-side (UserService.GetUserProfileAsync), so `obj ? ... : undefined` cannot
+// tell "has an address" from "has an empty address shell".
+function hasAnyValue(obj) {
+    return !!obj && Object.values(obj).some(v => v !== null && v !== undefined && v !== '');
+}
 function EditableSection({ title, children, onEdit, isEditing, onSave, onCancel, isDarkMode }) {
     const cardBg = isDarkMode ? 'bg-slate-800' : 'bg-white';
     const borderColor = isDarkMode ? 'border-slate-700' : 'border-gray-200';
@@ -105,20 +111,39 @@ function EnhancedProfilePage() {
                 title: undefined,
                 bio: undefined,
             },
-            contact_info: rawProfile.contact_information ? {
-                secondary_email: rawProfile.contact_information.secondary_email,
-                secondary_phone: rawProfile.contact_information.secondary_phone,
-                website: rawProfile.contact_information.website,
+            // Both blocks used to be read off `rawProfile.contact_information`, which the
+            // MEMBER endpoint NEVER emits - that name belongs to AdminUserProfileResponse
+            // (its only 2 occurrences in PayEz-Core are in that admin DTO).
+            // /api/account/profile returns UserProfileResponse: `contact_info` plus a
+            // SEPARATE TOP-LEVEL `address`. Both guards therefore always took the false
+            // branch and both blocks rendered permanently empty for every member.
+            //
+            // NOT a rename: `address` is a SIBLING of contact_info, not nested inside it,
+            // so contact_information -> contact_info alone fixes Contact and leaves ADDRESS
+            // DEAD. Inner names are snake_case on both DTOs; the old camelCase reads were
+            // shaped for the ADMIN payload, which is where those keys really are camelCase.
+            // GUARD ON CONTENT, NOT PRESENCE. UserService.GetUserProfileAsync ALWAYS
+            // instantiates both DTOs (ContactInfo = new ProfileContactInfoDto {...},
+            // Address = new AddressDto {...}), so both arrive NON-NULL with all-null
+            // members when the member has nothing on file. A truthiness guard always
+            // passes and would render a card full of blank fields - the hazard QAPert
+            // named in 41360 for the naive rename, which applies just as much to
+            // reading the CORRECT fields.
+            contact_info: hasAnyValue(rawProfile.contact_info) ? {
+                secondary_email: rawProfile.contact_info?.secondary_email,
+                secondary_phone: rawProfile.contact_info?.secondary_phone,
+                website: rawProfile.contact_info?.website,
+                preferred_contact_method: rawProfile.contact_info?.preferred_contact_method,
             } : undefined,
-            address: rawProfile.contact_information ? {
-                address_line_1: rawProfile.contact_information.addressLine1,
-                address_line_2: rawProfile.contact_information.addressLine2,
-                city: rawProfile.contact_information.city,
-                state_id: rawProfile.contact_information.stateId,
-                state_name: rawProfile.contact_information.stateName,
-                postal_code: rawProfile.contact_information.postalCode,
-                country_code: rawProfile.contact_information.countryCode,
-                country_name: rawProfile.contact_information.countryName,
+            address: hasAnyValue(rawProfile.address) ? {
+                address_line_1: rawProfile.address?.address_line_1,
+                address_line_2: rawProfile.address?.address_line_2,
+                city: rawProfile.address?.city,
+                state_id: rawProfile.address?.state_id,
+                state_name: rawProfile.address?.state_name,
+                postal_code: rawProfile.address?.postal_code,
+                country_code: rawProfile.address?.country_code,
+                country_name: rawProfile.address?.country_name,
             } : undefined,
             two_factor_enabled: rawProfile.two_factor_enabled,
             roles: rawProfile.roles,

package/dist/pages/verify-code/page.js

@@ -37,6 +37,7 @@ const navigation_1 = require("next/navigation");
 const better_auth_client_1 = require("../../client/better-auth-client");
 const react_2 = require("react");
 const useTheme_1 = require("../../theme/useTheme");
+const safe_callback_1 = require("../../auth/safe-callback");
 /**
  * Session storage key to track that user intentionally navigated to verify-code.
  * Prevents auto-redirect back to dashboard when session refreshes in background.
@@ -45,7 +46,31 @@ const VERIFY_IN_PROGRESS_KEY = 'idealvibe_2fa_verify_in_progress';
 function VerifyCodeForm({ enrollHref }) {
     const router = (0, navigation_1.useRouter)();
     const searchParams = (0, navigation_1.useSearchParams)();
-    const callbackUrl = searchParams?.get('callbackUrl') || '/dashboard';
+    /**
+     * 375936 - ORIGIN-GUARDED AT THE READ, NOT AT THE SINK.
+     *
+     * This value ends up in `window.location.href` after a SUCCESSFUL 2FA
+     * ceremony (see the setTimeout further down). That is a full navigation, so
+     * an absolute URL here is a cross-origin redirect - the user completes a
+     * genuine login and is then dropped on an attacker-controlled page at the
+     * exact moment they are most primed to trust what they see.
+     *
+     * This used to be a raw `searchParams?.get('callbackUrl') || '/dashboard'`.
+     * The middleware does NOT protect this page: create-middleware's
+     * `needsTwoFactorRedirect` returns false for VERIFY_CODE_PAGE, so a direct
+     * request arrives here with its query string untouched.
+     *
+     * Do NOT "simplify" this back to a `startsWith('/account-auth/')` test. The
+     * three such tests below are LOOP prevention, not ORIGIN prevention -
+     * `https://evil.example` passes every one of them. safeCallbackPath asks the
+     * URL parser instead, so protocol-relative (`//host`), backslash (`/\host`)
+     * and TAB/LF/CR spellings all fail one origin comparison rather than needing
+     * their own blacklist entry.
+     *
+     * Guarding at the READ rather than at the sink means every later use of
+     * `callbackUrl` on this page inherits the guarantee.
+     */
+    const callbackUrl = (0, safe_callback_1.safeCallbackPath)(searchParams?.get('callbackUrl'), '/dashboard');
     const { data: sessionData, isPending } = better_auth_client_1.authClient.useSession();
     const session = sessionData;
     const status = isPending ? 'loading' : session ? 'authenticated' : 'unauthenticated';

package/dist/routes/auth/viability.d.ts

@@ -35,12 +35,12 @@ export declare function GET(req: NextRequest): Promise<NextResponse<{
     authenticated: boolean;
     sessionToken: any;
     tenantRequiresTwoFactor: boolean;
-    userHasCompletedTenantTwoFactorRequirements: any;
+    userHasCompletedTenantTwoFactorRequirements: boolean;
     userStillNeedsTwoFactor: boolean;
     tenantAllowed2FAMethods: string[] | null;
     nextStep: "enroll_mfa" | "mfa_verify" | null | undefined;
     requires2FA: boolean;
-    twoFactorComplete: any;
+    twoFactorComplete: boolean;
     accessTokenExpired: boolean;
     expiresAt: string;
     roles: string[];

package/dist/routes/auth/viability.js

@@ -280,7 +280,7 @@ async function GET(req) {
             const mfaExpiresAt = session?.mfaExpiresAt || 0;
             const mfaExpired = mfaExpiresAt > 0 && mfaExpiresAt < Date.now();
             // Check mfaVerified (normalized name) with fallback to twoFactorComplete for compatibility
-            const mfaVerifiedInSession = session?.mfaVerified ?? session?.twoFactorComplete ?? false;
+            const mfaVerifiedInSession = session?.mfaVerified ?? false;
             // User has completed 2FA requirements if: they verified AND it hasn't expired
             const userHasCompletedTenantTwoFactorRequirements = mfaVerifiedInSession && !mfaExpired;
             // userStillNeedsTwoFactor = inverse of completed (matches session callback logic)
@@ -322,7 +322,7 @@ async function GET(req) {
         const mfaExpiresAt = session?.mfaExpiresAt || 0;
         const mfaExpired = mfaExpiresAt > 0 && mfaExpiresAt < Date.now();
         // Check mfaVerified (normalized name) with fallback to twoFactorComplete for compatibility
-        const mfaVerifiedInSession = session?.mfaVerified ?? session?.twoFactorComplete ?? false;
+        const mfaVerifiedInSession = session?.mfaVerified ?? false;
         // DEBUG: Log what we're reading from the session
         console.log('[VIABILITY] Session 2FA state:', {
             sessionToken: sessionToken?.substring(0, 8) + '...',

package/dist/server/auth-guard.js

@@ -87,7 +87,32 @@ async function authGuard(options) {
         (0, navigation_1.redirect)(serviceUnavailableUrl);
     }
     if (requires2FA) {
-        const mfaVerified = sessionData.mfaVerified ?? sessionData.twoFactorComplete ?? false;
+        // 369858: the legacy `?? (sessionData as any).twoFactorComplete` carry is REMOVED.
+        // This is THE access gate - the only one of the 8 carry sites that grants access
+        // rather than reporting status - so it reads exactly one source of truth.
+        //
+        // Removing it is fail-closed. No current writer emits the legacy field alone:
+        // session-store.ts:444-445 writes both as a pair from a server-derived stepped-up
+        // token, auth/refresh.ts:376 writes it as a MIRROR of mfaVerified, and
+        // routes/auth/session.ts:149-157 refuses both on PRESENCE, so a caller cannot
+        // assert either. The carry therefore only ever served sessions minted before
+        // `mfaVerified` existed, and for those the correct behaviour is re-verify, not
+        // grandfather. Cost is one forced re-challenge for a stale legacy session.
+        //
+        // Severity note, so nobody re-inflates this later: the operator was `??`
+        // (nullish), NOT `||`. `false ?? x` is `false`, so an explicitly DENIED session
+        // could never be upgraded by a stale flag. This was legacy grandfathering, not a
+        // live 2FA bypass. Had it been `||`, it would have been the bypass.
+        const mfaVerified = sessionData.mfaVerified ?? false;
+        // 339563 / 369858 §3: THIS IS STILL A FAIL-OPEN AND IS DELIBERATELY LEFT VISIBLE.
+        // An absent mfaExpiresAt collapses to 0, so `mfaExpired` is false and the MFA
+        // verdict NEVER EXPIRES. That needs no legacy-session hypothesis: it fires on a
+        // current `mfaVerified: true` session whose token carried no `mfa_expires` claim -
+        // the passwordless/primary-credential lane, named on the write path in the
+        // source's own voice at session-store.ts:464-467 ("it IS the case the consumers
+        // currently fail OPEN on"). Removing the carry above does NOT touch this.
+        // Tracked separately by BAPert; not fixed here because failing closed on absent
+        // expiry would deny the passwordless lane outright and that is a product call.
         const mfaExpiresAt = sessionData.mfaExpiresAt || 0;
         const mfaExpired = mfaExpiresAt > 0 && mfaExpiresAt < Date.now();
         if (!mfaVerified || mfaExpired) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "4.4.1",
+  "version": "4.4.2",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/api-handlers/mfa/totp-verify.ts

@@ -82,6 +82,10 @@ export async function POST(req: NextRequest) {
     // session. No tokens => no transition: we must not mark 2FA complete on the
     // strength of a 200 alone.
     let sessionTransitioned = false;
+    // R908(e): "we could not establish MFA" is a THIRD outcome, distinct from
+    // both success and failure. It must reach the client as a challenge, not as
+    // a silent success (fail-open) and not as a rejection (fail-closed).
+    let requiresChallenge = false;
 
     if (unwrappedData.access_token && unwrappedData.refresh_token) {
       const token = await getTokenTestAware(req);
@@ -104,7 +108,11 @@ export async function POST(req: NextRequest) {
           // Refresh token may carry no exp claim; default stands.
         }
 
-        await transitionTo2FASession(
+        // R908(e): the transition can now decline to grant. Read what was
+        // actually written instead of assuming the call granted - the store
+        // withholds mfaVerified when the stepped-up token carries no
+        // mfa_expires, and reports the re-challenge via nextStep.
+        const transitioned = await transitionTo2FASession(
           sessionToken,
           {
             accessToken: unwrappedData.access_token,
@@ -115,8 +123,18 @@ export async function POST(req: NextRequest) {
           'totp' // 2FA method, used by the refresh-token flow
         );
 
-        sessionTransitioned = true;
-        console.log('[VERIFY_TOTP] Session transitioned to 2FA-verified');
+        sessionTransitioned = transitioned?.mfaVerified === true;
+        requiresChallenge = transitioned?.nextStep === 'mfa_verify';
+
+        if (sessionTransitioned) {
+          console.log('[VERIFY_TOTP] Session transitioned to 2FA-verified');
+        } else {
+          console.warn(
+            '[VERIFY_TOTP] R908(e): IDP verified the code but the session was NOT ' +
+              'marked MFA-verified (no mfa_expires on the returned token). Reporting ' +
+              'requiresChallenge so the client re-challenges rather than proceeding.'
+          );
+        }
       } else {
         console.warn('[VERIFY_TOTP] IDP verified the code but no session token was resolvable — session NOT transitioned');
       }
@@ -138,6 +156,9 @@ export async function POST(req: NextRequest) {
         success: true,
         verificationSuccessful: true,
         twoFactorSessionVerified: sessionTransitioned,
+        // R908(e): tells the client to re-challenge. Present only when the code
+        // verified at the IDP but produced no evidence we could record.
+        ...(requiresChallenge ? { requiresChallenge: true, nextStep: 'mfa_verify' as const } : {}),
         message: unwrappedData.message || 'Authenticator code verified successfully',
       },
       { status: 200 }

package/src/api-handlers/session/refresh-viability.ts

@@ -21,14 +21,14 @@ export async function GET(req: NextRequest) {
       // Still need to get session data for twoFactorComplete even when refresh is in progress
       const sessionData = await getSession(finalSessionToken);
       logger.info('[REFRESH-VIABILITY] Refresh already in progress, telling middleware to wait', { sessionToken: finalSessionToken.substring(0, 8) + '...' });
-      return NextResponse.json({ canRefresh: true, reason: 'refresh_in_progress', refreshInProgress: true, sessionToken: finalSessionToken, twoFactorComplete: sessionData?.mfaVerified ?? (sessionData as any)?.twoFactorComplete ?? false }, { status: 200 });
+      return NextResponse.json({ canRefresh: true, reason: 'refresh_in_progress', refreshInProgress: true, sessionToken: finalSessionToken, twoFactorComplete: sessionData?.mfaVerified ?? false }, { status: 200 });
     }
     const sessionData = await getSession(finalSessionToken);
     if (!sessionData) {
       return NextResponse.json({ canRefresh: false, reason: 'session_not_found', sessionToken: finalSessionToken }, { status: 200 });
     }
     const viabilityCheck = checkRefreshViability(sessionData);
-    return NextResponse.json({ canRefresh: viabilityCheck.canRefresh, reason: viabilityCheck.reason, timeRemaining: viabilityCheck.timeRemaining, expiresAt: viabilityCheck.expiresAt, accessTokenExpired: viabilityCheck.accessTokenExpired, accessTokenTimeRemaining: viabilityCheck.accessTokenTimeRemaining, sessionToken: finalSessionToken, twoFactorComplete: sessionData.mfaVerified ?? (sessionData as any).twoFactorComplete ?? false, userId: sessionData.userId, refreshInProgress: false });
+    return NextResponse.json({ canRefresh: viabilityCheck.canRefresh, reason: viabilityCheck.reason, timeRemaining: viabilityCheck.timeRemaining, expiresAt: viabilityCheck.expiresAt, accessTokenExpired: viabilityCheck.accessTokenExpired, accessTokenTimeRemaining: viabilityCheck.accessTokenTimeRemaining, sessionToken: finalSessionToken, twoFactorComplete: sessionData.mfaVerified ?? false, userId: sessionData.userId, refreshInProgress: false });
   } catch (error) {
     logger.error('[REFRESH-VIABILITY] Error checking refresh viability', { error: error instanceof Error ? error.message : String(error) });
     return NextResponse.json({ canRefresh: false, reason: 'check_error', error: error instanceof Error ? error.message : String(error) }, { status: 500 });

package/src/api-handlers/session/viability.ts

@@ -119,7 +119,7 @@ export async function GET(req: NextRequest) {
         const mfaExpiresAt = sessionData.mfaExpiresAt || 0;
         const mfaExpired = mfaExpiresAt > 0 && mfaExpiresAt < Date.now();
         // Check both field names for compatibility (mfaVerified is the normalized name)
-        const sessionMfaComplete = sessionData.mfaVerified ?? (sessionData as any).twoFactorComplete ?? false;
+        const sessionMfaComplete = sessionData.mfaVerified ?? false;
         const effectiveTwoFactorComplete = sessionMfaComplete && !mfaExpired;
 
         console.log('[VIABILITY] Session 2FA check:', {

package/src/auth/auth-decision.ts

@@ -5,6 +5,8 @@
  * All auth flow logic is centralized here for testability and maintainability.
  */
 
+import { safeCallbackPath } from './safe-callback';
+
 // Input types for the decision engine
 export interface AuthContext {
   pathname: string;
@@ -45,8 +47,12 @@ export function makeAuthDecision(context: AuthContext): AuthAction {
     circuitBreakerOpen
   } = context;
 
-  // SAFEGUARD: Never use auth pages as callback URLs to prevent redirect loops
-  const safeCallbackUrl = pathname.startsWith('/account-auth/') ? '/' : pathname;
+  // SAFEGUARD: Never use auth pages as callback URLs to prevent redirect loops.
+  // 375656: `pathname` is our own request path rather than an attacker-supplied
+  // parameter, so this site was not the open redirect - but it is routed through
+  // the same guard so the package has ONE definition of an acceptable callback,
+  // and so the value is parser-normalised before being carried into a redirect.
+  const safeCallbackUrl = safeCallbackPath(pathname);
 
   // Public routes are allowed, but we need to check login page separately
   if (isPublicRoute && !isLoginPage) {
@@ -145,8 +151,17 @@ export function makeAuthDecision(context: AuthContext): AuthAction {
     // If user is on the login page, send them to verify-code with the original callback
     if (isLoginPage) {
       const callbackUrl = searchParams.get('callbackUrl') || '/';
-      // CRITICAL FIX: Never use auth pages as callback URLs
-      const safeCallbackUrl = callbackUrl.startsWith('/account-auth/') ? '/' : callbackUrl;
+      // 375656: this previously tested the raw parameter with a prefix check against
+      // the auth path, and returned the parameter itself when it did not match.
+      // (The vulnerable expression is deliberately NOT reproduced verbatim here: a
+      // comment carrying it puts the string into dist, and a reviewer grepping for
+      // that pattern would score this FIXED build as vulnerable - the exact
+      // sink-counting inversion recorded on 375936.)
+      // That is a redirect-LOOP guard in the seat where an ORIGIN check belongs:
+      // `https://evil.example.com` does not start with `/account-auth/`, so it passed
+      // through untouched. safeCallbackPath() asks the URL parser instead, so every
+      // spelling that escapes the origin fails one comparison. See ./safe-callback.
+      const safeCallbackUrl = safeCallbackPath(callbackUrl);
       console.log('[MIDDLEWARE-DECISION] On login page with 2FA incomplete, redirecting to verify-code', {
         originalCallback: callbackUrl,
         safeCallback: safeCallbackUrl,
@@ -193,8 +208,8 @@ export function makeAuthDecision(context: AuthContext): AuthAction {
     // For login page, redirect to 2FA with original callback
     if (isLoginPage) {
       const callbackUrl = searchParams.get('callbackUrl') || '/';
-      // CRITICAL FIX: Never use auth pages as callback URLs
-      const safeCallbackUrl = callbackUrl.startsWith('/account-auth/') ? '/' : callbackUrl;
+      // 375656: origin-checked, not prefix-checked. See ./safe-callback.
+      const safeCallbackUrl = safeCallbackPath(callbackUrl);
       return {
         type: 'redirect',
         location: `/account-auth/verify-code?callbackUrl=${encodeURIComponent(safeCallbackUrl)}`,
@@ -212,8 +227,13 @@ export function makeAuthDecision(context: AuthContext): AuthAction {
   // Authenticated user on login page - redirect to dashboard or callback
   if (isLoginPage) {
     const callbackUrl = searchParams.get('callbackUrl') || '/';
-    // CRITICAL FIX: Never redirect back to login page (prevents infinite loop)
-    const safeCallbackUrl = callbackUrl.startsWith('/account-auth/') ? '/' : callbackUrl;
+    // 375656 - THE PUBLISHED OPEN REDIRECT. This value becomes `location` VERBATIM
+    // below (not a query parameter on a relative path, as at the two sites above),
+    // so the old `startsWith('/account-auth/')` test sent an authenticated user
+    // straight to any absolute URL an attacker put in `?callbackUrl=`. Its own
+    // comment says "prevents infinite loop", which is what it was written for -
+    // loop prevention, never origin validation. See ./safe-callback.
+    const safeCallbackUrl = safeCallbackPath(callbackUrl);
     console.log('[MIDDLEWARE-DECISION] Authenticated user on login page, redirecting', {
       originalCallback: callbackUrl,
       safeCallback: safeCallbackUrl

package/src/auth/better-auth.ts

@@ -34,6 +34,26 @@ export function secretFingerprint(value: string): string {
   return createHash('sha256').update(value).digest('hex').slice(0, 12);
 }
 
+/**
+ * 273183: keys written onto the `ba:{slug}:{token}` record by an author OTHER
+ * than Better Auth, which must survive a Better Auth session write.
+ *
+ * Today this is exactly `idpTokens`, written by `storeIdpTokensInSession`. The
+ * list is a named constant rather than a hardcoded check because the shape of
+ * the bug is "a second author appeared and the adapter did not know" — the next
+ * enrichment key should be added here, not rediscovered as a strip.
+ */
+const PRESERVED_SESSION_KEYS = ['idpTokens'] as const;
+
+/**
+ * True for a JSON object we can safely merge into — not null, not an array.
+ * `typeof null === 'object'` and arrays are objects, and merging into either
+ * would corrupt the record rather than preserve it.
+ */
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
 /**
  * Better Auth social provider config shape.
  */
@@ -498,7 +518,114 @@ export function createBetterAuthInstance(
        */
       set: async (key: string, value: string, ttl?: number) => {
         const redis = getRedis();
-        await redis.setex(`ba:${appSlug}:${key}`, ttl ?? SESSION_TTL, value);
+        const redisKey = `ba:${appSlug}:${key}`;
+
+        /**
+         * 273183 — READ-MODIFY-WRITE, BECAUSE THIS RECORD HAS TWO AUTHORS.
+         * (Found by DotNetPert-Scout; handed over as Cluster-B root-cause
+         * evidence under BAPert's R920(a). Reproduced here before fixing.)
+         *
+         * Better Auth owns `{session, user}` and serialises exactly that. But
+         * `storeIdpTokensInSession` (below, ~:1010) ENRICHES the same key with
+         * `idpTokens` via its own read-modify-write. This setter did a blind
+         * `setex` of Better Auth's payload, so every write it makes — including
+         * each routine `updateAge` session rewrite, not merely an expiry —
+         * STRIPPED `idpTokens` back off the record.
+         *
+         * The consumer then falls back to an identity husk: `mfaVerified:false`,
+         * `roles:[]`. It fails CLOSED, so it is not a 369782-class bypass — but
+         * per BAPert it is a public-test blocker on its own terms, because a
+         * tester who trips the `updateAge` cadence gets a spurious 2FA re-prompt
+         * AND SILENTLY LOSES THEIR ROLES mid-session. That is a visible product
+         * failure regardless of which direction it fails in.
+         *
+         * WHY MERGE HERE RATHER THAN MOVE THE DATA. The enriching writer already
+         * does a read-modify-write; it was correct. The bug is that ONE of the
+         * two authors of this key wrote as though it were the only one. Fixing
+         * the adapter fixes it for every future enrichment key, whereas moving
+         * `idpTokens` elsewhere would leave the next one to rediscover this.
+         *
+         * ONLY keys in PRESERVED_KEYS are carried, and ONLY when the incoming
+         * payload does not set them — so Better Auth still wins on everything it
+         * owns, and an explicit incoming value is never overridden by a stale one.
+         *
+         * NOT ATOMIC, and deliberately not: an enrichment landing between this
+         * read and this write is still lost. Closing that needs a WATCH/MULTI or
+         * a Lua script, which is a larger change than tonight allows. This
+         * narrows the window from "every single write" to "a genuine race", and
+         * the residual is recorded here rather than left to be re-found.
+         */
+        let payload = value;
+        try {
+          const existingRaw = await redis.get(redisKey);
+          if (existingRaw) {
+            const existing = JSON.parse(existingRaw);
+            const incoming = JSON.parse(value);
+            if (isPlainObject(existing) && isPlainObject(incoming)) {
+              let carried = false;
+              for (const preserved of PRESERVED_SESSION_KEYS) {
+                if (preserved in existing && !(preserved in incoming)) {
+                  incoming[preserved] = existing[preserved];
+                  carried = true;
+                }
+              }
+              if (carried) payload = JSON.stringify(incoming);
+            }
+          }
+        } catch (mergeErr) {
+          /**
+           * This adapter also stores `verification:*` and `active-sessions-*`
+           * records, which are not necessarily session-shaped JSON. A record we
+           * cannot parse is not a session to enrich, so writing through unchanged
+           * is correct rather than merely tolerable.
+           *
+           * WARNED, NOT THROWN, and the asymmetry is the point: this block is an
+           * ENRICHMENT-PRESERVING read. Letting it fail the write would convert a
+           * degraded read into a lost session — the precise inversion 170033 fix 1
+           * above exists to prevent. The `setex` below is outside this try and is
+           * still unswallowed, so a genuine write failure still propagates.
+           */
+          console.warn(
+            `[BETTER_AUTH] secondaryStorage.set: could not preserve enrichment keys on ` +
+            `ba:${appSlug}:sha256:${secretFingerprint(key)} — writing Better Auth's payload ` +
+            `as-is. If this record held idpTokens they are now gone (273183):`,
+            mergeErr instanceof Error ? mergeErr.message : String(mergeErr)
+          );
+        }
+
+        /**
+         * QA 6952 / R913 - CLAMP, DO NOT DEFER.
+         *
+         * This was `ttl ?? SESSION_TTL`, which READS as "SESSION_TTL is the single
+         * source of session TTL" - what session-store.ts claims, and the mechanism
+         * by which the 7d-vs-3d zombie window was supposedly closed for good.
+         *
+         * IT WAS DEAD CODE. Better Auth ALWAYS supplies a ttl: every one of the
+         * eight secondaryStorage.set call sites in
+         * better-auth/dist/db/internal-adapter.mjs passes one explicitly (:36,
+         * :180, :189, :309, :320, :344, :553, :622). `??` fires only on
+         * null/undefined, so the fallback NEVER RAN. Every `ba:` record took Better
+         * Auth's 7d default - `session.expiresIn` is not configured in this file -
+         * while the canonical store stayed at SESSION_TTL (3d). That 4-day drift IS
+         * the zombie window the constant exists to prevent: the guard was bypassed
+         * by the very parameter written to defer to it.
+         *
+         * `Math.min`, NOT a hard SESSION_TTL: this same adapter also stores
+         * `verification:*` (:553, :622) and `active-sessions-*` (:180, :320, :344)
+         * records whose TTLs are legitimately SHORTER than 3d. Overwriting those
+         * would EXTEND them - turning a fix for over-long sessions into a bug that
+         * keeps verification codes alive for three days. Clamp DOWN, never up.
+         *
+         * Clamped down to 3d rather than raising the canonical store to 7d because
+         * SESSION_TTL matches the IDP refresh-token lifetime: a session outliving
+         * the refresh token sustaining it cannot be refreshed, so the extra days are
+         * a husk that reads as authenticated. Fail-closed beats ambiguous.
+         *
+         * DO NOT "fix" this by making storeIdpTokensInSession preserve Better
+         * Auth's 7d. That deletes the last remnant of QA 6952 and makes the drift
+         * universal. See test/ba-session-ttl-clamp.test.cjs.
+         */
+        await redis.setex(redisKey, Math.min(ttl ?? SESSION_TTL, SESSION_TTL), payload);
       },
       delete: async (key: string) => {
         try {