@payez/next-mvp 4.4.1 → 4.4.3

package/dist/api/auth-handler.js

@@ -17,6 +17,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createAuthHandler = createAuthHandler;
 const server_1 = require("next/server");
 const auth_1 = require("../server/auth");
+const acr_1 = require("../lib/acr");
 const nanoid_1 = require("nanoid");
 const session_store_1 = require("../lib/session-store");
 /**
@@ -158,10 +159,18 @@ function createAuthHandler(options = {}) {
                 console.error('[AUTH_HANDLER] No refresh token available');
                 return { success: false, error: 'No refresh token' };
             }
-            // Extract authentication methods from session
-            const authMethods = currentSession.authMethods ||
-                (currentSession.token?.amr ? JSON.parse(currentSession.token.amr) : ['pwd', 'mfa']);
-            const authLevel = String(currentSession.authenticationLevel || currentSession.token?.acr || '2');
+            // Extract authentication methods from session.
+            //
+            // 375639: these two lines used to read
+            //     authMethods = ... : ['pwd', 'mfa']
+            //     authLevel   = String(... || ... || '2')
+            // so a session that knew NOTHING about how the user authenticated told
+            // the IDP that a second factor had happened AND named 'mfa' as the
+            // method. The two fabrications corroborated each other, so a downstream
+            // check cross-validating amr against acr would have accepted the pair.
+            // Absent is not satisfied; both now resolve fail-closed, in one place.
+            const authMethods = (0, acr_1.resolveAuthMethods)(currentSession.authMethods, currentSession.token?.amr);
+            const authLevel = (0, acr_1.resolveAcrLevel)(currentSession.authenticationLevel, currentSession.token?.acr);
             const twoFactorMethod = currentSession.twoFactorMethod || 'authenticator';
             // Build refresh request body
             const refreshRequestBody = {

package/dist/api-handlers/mfa/totp-verify.d.ts

@@ -40,8 +40,10 @@ export declare function POST(req: NextRequest): Promise<NextResponse<{
         attemptedRefresh: boolean;
     };
 }> | NextResponse<{
+    message: any;
+    requiresChallenge?: boolean | undefined;
+    nextStep?: "mfa_verify" | undefined;
     success: boolean;
     verificationSuccessful: boolean;
     twoFactorSessionVerified: boolean;
-    message: any;
 }>>;

package/dist/api-handlers/mfa/totp-verify.js

@@ -68,6 +68,10 @@ async function POST(req) {
         // session. No tokens => no transition: we must not mark 2FA complete on the
         // strength of a 200 alone.
         let sessionTransitioned = false;
+        // R908(e): "we could not establish MFA" is a THIRD outcome, distinct from
+        // both success and failure. It must reach the client as a challenge, not as
+        // a silent success (fail-open) and not as a rejection (fail-closed).
+        let requiresChallenge = false;
         if (unwrappedData.access_token && unwrappedData.refresh_token) {
             const token = await (0, test_aware_get_token_1.getTokenTestAware)(req);
             const sessionToken = (token?.sessionToken || token?.redisSessionId);
@@ -90,15 +94,27 @@ async function POST(req) {
                 catch {
                     // Refresh token may carry no exp claim; default stands.
                 }
-                await (0, session_store_1.transitionTo2FASession)(sessionToken, {
+                // R908(e): the transition can now decline to grant. Read what was
+                // actually written instead of assuming the call granted - the store
+                // withholds mfaVerified when the stepped-up token carries no
+                // mfa_expires, and reports the re-challenge via nextStep.
+                const transitioned = await (0, session_store_1.transitionTo2FASession)(sessionToken, {
                     accessToken: unwrappedData.access_token,
                     refreshToken: unwrappedData.refresh_token,
                     accessTokenExpires,
                     refreshTokenExpires,
                 }, 'totp' // 2FA method, used by the refresh-token flow
                 );
-                sessionTransitioned = true;
-                console.log('[VERIFY_TOTP] Session transitioned to 2FA-verified');
+                sessionTransitioned = transitioned?.mfaVerified === true;
+                requiresChallenge = transitioned?.nextStep === 'mfa_verify';
+                if (sessionTransitioned) {
+                    console.log('[VERIFY_TOTP] Session transitioned to 2FA-verified');
+                }
+                else {
+                    console.warn('[VERIFY_TOTP] R908(e): IDP verified the code but the session was NOT ' +
+                        'marked MFA-verified (no mfa_expires on the returned token). Reporting ' +
+                        'requiresChallenge so the client re-challenges rather than proceeding.');
+                }
             }
             else {
                 console.warn('[VERIFY_TOTP] IDP verified the code but no session token was resolvable — session NOT transitioned');
@@ -120,6 +136,9 @@ async function POST(req) {
             success: true,
             verificationSuccessful: true,
             twoFactorSessionVerified: sessionTransitioned,
+            // R908(e): tells the client to re-challenge. Present only when the code
+            // verified at the IDP but produced no evidence we could record.
+            ...(requiresChallenge ? { requiresChallenge: true, nextStep: 'mfa_verify' } : {}),
             message: unwrappedData.message || 'Authenticator code verified successfully',
         }, { status: 200 });
     }

package/dist/api-handlers/session/refresh-viability.js

@@ -23,14 +23,14 @@ async function GET(req) {
             // Still need to get session data for twoFactorComplete even when refresh is in progress
             const sessionData = await (0, session_store_1.getSession)(finalSessionToken);
             logger_1.logger.info('[REFRESH-VIABILITY] Refresh already in progress, telling middleware to wait', { sessionToken: finalSessionToken.substring(0, 8) + '...' });
-            return server_1.NextResponse.json({ canRefresh: true, reason: 'refresh_in_progress', refreshInProgress: true, sessionToken: finalSessionToken, twoFactorComplete: sessionData?.mfaVerified ?? sessionData?.twoFactorComplete ?? false }, { status: 200 });
+            return server_1.NextResponse.json({ canRefresh: true, reason: 'refresh_in_progress', refreshInProgress: true, sessionToken: finalSessionToken, twoFactorComplete: sessionData?.mfaVerified ?? false }, { status: 200 });
         }
         const sessionData = await (0, session_store_1.getSession)(finalSessionToken);
         if (!sessionData) {
             return server_1.NextResponse.json({ canRefresh: false, reason: 'session_not_found', sessionToken: finalSessionToken }, { status: 200 });
         }
         const viabilityCheck = (0, refresh_token_validator_1.checkRefreshViability)(sessionData);
-        return server_1.NextResponse.json({ canRefresh: viabilityCheck.canRefresh, reason: viabilityCheck.reason, timeRemaining: viabilityCheck.timeRemaining, expiresAt: viabilityCheck.expiresAt, accessTokenExpired: viabilityCheck.accessTokenExpired, accessTokenTimeRemaining: viabilityCheck.accessTokenTimeRemaining, sessionToken: finalSessionToken, twoFactorComplete: sessionData.mfaVerified ?? sessionData.twoFactorComplete ?? false, userId: sessionData.userId, refreshInProgress: false });
+        return server_1.NextResponse.json({ canRefresh: viabilityCheck.canRefresh, reason: viabilityCheck.reason, timeRemaining: viabilityCheck.timeRemaining, expiresAt: viabilityCheck.expiresAt, accessTokenExpired: viabilityCheck.accessTokenExpired, accessTokenTimeRemaining: viabilityCheck.accessTokenTimeRemaining, sessionToken: finalSessionToken, twoFactorComplete: sessionData.mfaVerified ?? false, userId: sessionData.userId, refreshInProgress: false });
     }
     catch (error) {
         logger_1.logger.error('[REFRESH-VIABILITY] Error checking refresh viability', { error: error instanceof Error ? error.message : String(error) });

package/dist/api-handlers/session/viability.js

@@ -106,7 +106,7 @@ async function GET(req) {
                 const mfaExpiresAt = sessionData.mfaExpiresAt || 0;
                 const mfaExpired = mfaExpiresAt > 0 && mfaExpiresAt < Date.now();
                 // Check both field names for compatibility (mfaVerified is the normalized name)
-                const sessionMfaComplete = sessionData.mfaVerified ?? sessionData.twoFactorComplete ?? false;
+                const sessionMfaComplete = sessionData.mfaVerified ?? false;
                 const effectiveTwoFactorComplete = sessionMfaComplete && !mfaExpired;
                 console.log('[VIABILITY] Session 2FA check:', {
                     sessionToken: sessionToken.substring(0, 8) + '...',

package/dist/auth/auth-decision.js

@@ -7,13 +7,18 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.makeAuthDecision = makeAuthDecision;
+const safe_callback_1 = require("./safe-callback");
 /**
  * Main decision function - pure, testable, deterministic
  */
 function makeAuthDecision(context) {
     const { pathname, isPublicRoute, isLoginPage, searchParams, sessionPointer, sessionStatus, circuitBreakerOpen } = context;
-    // SAFEGUARD: Never use auth pages as callback URLs to prevent redirect loops
-    const safeCallbackUrl = pathname.startsWith('/account-auth/') ? '/' : pathname;
+    // SAFEGUARD: Never use auth pages as callback URLs to prevent redirect loops.
+    // 375656: `pathname` is our own request path rather than an attacker-supplied
+    // parameter, so this site was not the open redirect - but it is routed through
+    // the same guard so the package has ONE definition of an acceptable callback,
+    // and so the value is parser-normalised before being carried into a redirect.
+    const safeCallbackUrl = (0, safe_callback_1.safeCallbackPath)(pathname);
     // Public routes are allowed, but we need to check login page separately
     if (isPublicRoute && !isLoginPage) {
         // For non-login public routes, check if authenticated user needs 2FA
@@ -104,8 +109,17 @@ function makeAuthDecision(context) {
         // If user is on the login page, send them to verify-code with the original callback
         if (isLoginPage) {
             const callbackUrl = searchParams.get('callbackUrl') || '/';
-            // CRITICAL FIX: Never use auth pages as callback URLs
-            const safeCallbackUrl = callbackUrl.startsWith('/account-auth/') ? '/' : callbackUrl;
+            // 375656: this previously tested the raw parameter with a prefix check against
+            // the auth path, and returned the parameter itself when it did not match.
+            // (The vulnerable expression is deliberately NOT reproduced verbatim here: a
+            // comment carrying it puts the string into dist, and a reviewer grepping for
+            // that pattern would score this FIXED build as vulnerable - the exact
+            // sink-counting inversion recorded on 375936.)
+            // That is a redirect-LOOP guard in the seat where an ORIGIN check belongs:
+            // `https://evil.example.com` does not start with `/account-auth/`, so it passed
+            // through untouched. safeCallbackPath() asks the URL parser instead, so every
+            // spelling that escapes the origin fails one comparison. See ./safe-callback.
+            const safeCallbackUrl = (0, safe_callback_1.safeCallbackPath)(callbackUrl);
             console.log('[MIDDLEWARE-DECISION] On login page with 2FA incomplete, redirecting to verify-code', {
                 originalCallback: callbackUrl,
                 safeCallback: safeCallbackUrl,
@@ -148,8 +162,8 @@ function makeAuthDecision(context) {
         // For login page, redirect to 2FA with original callback
         if (isLoginPage) {
             const callbackUrl = searchParams.get('callbackUrl') || '/';
-            // CRITICAL FIX: Never use auth pages as callback URLs
-            const safeCallbackUrl = callbackUrl.startsWith('/account-auth/') ? '/' : callbackUrl;
+            // 375656: origin-checked, not prefix-checked. See ./safe-callback.
+            const safeCallbackUrl = (0, safe_callback_1.safeCallbackPath)(callbackUrl);
             return {
                 type: 'redirect',
                 location: `/account-auth/verify-code?callbackUrl=${encodeURIComponent(safeCallbackUrl)}`,
@@ -165,8 +179,13 @@ function makeAuthDecision(context) {
     // Authenticated user on login page - redirect to dashboard or callback
     if (isLoginPage) {
         const callbackUrl = searchParams.get('callbackUrl') || '/';
-        // CRITICAL FIX: Never redirect back to login page (prevents infinite loop)
-        const safeCallbackUrl = callbackUrl.startsWith('/account-auth/') ? '/' : callbackUrl;
+        // 375656 - THE PUBLISHED OPEN REDIRECT. This value becomes `location` VERBATIM
+        // below (not a query parameter on a relative path, as at the two sites above),
+        // so the old `startsWith('/account-auth/')` test sent an authenticated user
+        // straight to any absolute URL an attacker put in `?callbackUrl=`. Its own
+        // comment says "prevents infinite loop", which is what it was written for -
+        // loop prevention, never origin validation. See ./safe-callback.
+        const safeCallbackUrl = (0, safe_callback_1.safeCallbackPath)(callbackUrl);
         console.log('[MIDDLEWARE-DECISION] Authenticated user on login page, redirecting', {
             originalCallback: callbackUrl,
             safeCallback: safeCallbackUrl

package/dist/auth/better-auth.js

@@ -77,6 +77,24 @@ const session_store_1 = require("../lib/session-store");
 function secretFingerprint(value) {
     return (0, crypto_1.createHash)('sha256').update(value).digest('hex').slice(0, 12);
 }
+/**
+ * 273183: keys written onto the `ba:{slug}:{token}` record by an author OTHER
+ * than Better Auth, which must survive a Better Auth session write.
+ *
+ * Today this is exactly `idpTokens`, written by `storeIdpTokensInSession`. The
+ * list is a named constant rather than a hardcoded check because the shape of
+ * the bug is "a second author appeared and the adapter did not know" — the next
+ * enrichment key should be added here, not rediscovered as a strip.
+ */
+const PRESERVED_SESSION_KEYS = ['idpTokens'];
+/**
+ * True for a JSON object we can safely merge into — not null, not an array.
+ * `typeof null === 'object'` and arrays are objects, and merging into either
+ * would corrupt the record rather than preserve it.
+ */
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
 /**
  * Build Better Auth social providers from IDP config.
  */
@@ -451,7 +469,111 @@ function createBetterAuthInstance(idpConfig, opts = {}) {
              */
             set: async (key, value, ttl) => {
                 const redis = (0, redis_1.getRedis)();
-                await redis.setex(`ba:${appSlug}:${key}`, ttl ?? session_store_1.SESSION_TTL, value);
+                const redisKey = `ba:${appSlug}:${key}`;
+                /**
+                 * 273183 — READ-MODIFY-WRITE, BECAUSE THIS RECORD HAS TWO AUTHORS.
+                 * (Found by DotNetPert-Scout; handed over as Cluster-B root-cause
+                 * evidence under BAPert's R920(a). Reproduced here before fixing.)
+                 *
+                 * Better Auth owns `{session, user}` and serialises exactly that. But
+                 * `storeIdpTokensInSession` (below, ~:1010) ENRICHES the same key with
+                 * `idpTokens` via its own read-modify-write. This setter did a blind
+                 * `setex` of Better Auth's payload, so every write it makes — including
+                 * each routine `updateAge` session rewrite, not merely an expiry —
+                 * STRIPPED `idpTokens` back off the record.
+                 *
+                 * The consumer then falls back to an identity husk: `mfaVerified:false`,
+                 * `roles:[]`. It fails CLOSED, so it is not a 369782-class bypass — but
+                 * per BAPert it is a public-test blocker on its own terms, because a
+                 * tester who trips the `updateAge` cadence gets a spurious 2FA re-prompt
+                 * AND SILENTLY LOSES THEIR ROLES mid-session. That is a visible product
+                 * failure regardless of which direction it fails in.
+                 *
+                 * WHY MERGE HERE RATHER THAN MOVE THE DATA. The enriching writer already
+                 * does a read-modify-write; it was correct. The bug is that ONE of the
+                 * two authors of this key wrote as though it were the only one. Fixing
+                 * the adapter fixes it for every future enrichment key, whereas moving
+                 * `idpTokens` elsewhere would leave the next one to rediscover this.
+                 *
+                 * ONLY keys in PRESERVED_KEYS are carried, and ONLY when the incoming
+                 * payload does not set them — so Better Auth still wins on everything it
+                 * owns, and an explicit incoming value is never overridden by a stale one.
+                 *
+                 * NOT ATOMIC, and deliberately not: an enrichment landing between this
+                 * read and this write is still lost. Closing that needs a WATCH/MULTI or
+                 * a Lua script, which is a larger change than tonight allows. This
+                 * narrows the window from "every single write" to "a genuine race", and
+                 * the residual is recorded here rather than left to be re-found.
+                 */
+                let payload = value;
+                try {
+                    const existingRaw = await redis.get(redisKey);
+                    if (existingRaw) {
+                        const existing = JSON.parse(existingRaw);
+                        const incoming = JSON.parse(value);
+                        if (isPlainObject(existing) && isPlainObject(incoming)) {
+                            let carried = false;
+                            for (const preserved of PRESERVED_SESSION_KEYS) {
+                                if (preserved in existing && !(preserved in incoming)) {
+                                    incoming[preserved] = existing[preserved];
+                                    carried = true;
+                                }
+                            }
+                            if (carried)
+                                payload = JSON.stringify(incoming);
+                        }
+                    }
+                }
+                catch (mergeErr) {
+                    /**
+                     * This adapter also stores `verification:*` and `active-sessions-*`
+                     * records, which are not necessarily session-shaped JSON. A record we
+                     * cannot parse is not a session to enrich, so writing through unchanged
+                     * is correct rather than merely tolerable.
+                     *
+                     * WARNED, NOT THROWN, and the asymmetry is the point: this block is an
+                     * ENRICHMENT-PRESERVING read. Letting it fail the write would convert a
+                     * degraded read into a lost session — the precise inversion 170033 fix 1
+                     * above exists to prevent. The `setex` below is outside this try and is
+                     * still unswallowed, so a genuine write failure still propagates.
+                     */
+                    console.warn(`[BETTER_AUTH] secondaryStorage.set: could not preserve enrichment keys on ` +
+                        `ba:${appSlug}:sha256:${secretFingerprint(key)} — writing Better Auth's payload ` +
+                        `as-is. If this record held idpTokens they are now gone (273183):`, mergeErr instanceof Error ? mergeErr.message : String(mergeErr));
+                }
+                /**
+                 * QA 6952 / R913 - CLAMP, DO NOT DEFER.
+                 *
+                 * This was `ttl ?? SESSION_TTL`, which READS as "SESSION_TTL is the single
+                 * source of session TTL" - what session-store.ts claims, and the mechanism
+                 * by which the 7d-vs-3d zombie window was supposedly closed for good.
+                 *
+                 * IT WAS DEAD CODE. Better Auth ALWAYS supplies a ttl: every one of the
+                 * eight secondaryStorage.set call sites in
+                 * better-auth/dist/db/internal-adapter.mjs passes one explicitly (:36,
+                 * :180, :189, :309, :320, :344, :553, :622). `??` fires only on
+                 * null/undefined, so the fallback NEVER RAN. Every `ba:` record took Better
+                 * Auth's 7d default - `session.expiresIn` is not configured in this file -
+                 * while the canonical store stayed at SESSION_TTL (3d). That 4-day drift IS
+                 * the zombie window the constant exists to prevent: the guard was bypassed
+                 * by the very parameter written to defer to it.
+                 *
+                 * `Math.min`, NOT a hard SESSION_TTL: this same adapter also stores
+                 * `verification:*` (:553, :622) and `active-sessions-*` (:180, :320, :344)
+                 * records whose TTLs are legitimately SHORTER than 3d. Overwriting those
+                 * would EXTEND them - turning a fix for over-long sessions into a bug that
+                 * keeps verification codes alive for three days. Clamp DOWN, never up.
+                 *
+                 * Clamped down to 3d rather than raising the canonical store to 7d because
+                 * SESSION_TTL matches the IDP refresh-token lifetime: a session outliving
+                 * the refresh token sustaining it cannot be refreshed, so the extra days are
+                 * a husk that reads as authenticated. Fail-closed beats ambiguous.
+                 *
+                 * DO NOT "fix" this by making storeIdpTokensInSession preserve Better
+                 * Auth's 7d. That deletes the last remnant of QA 6952 and makes the drift
+                 * universal. See test/ba-session-ttl-clamp.test.cjs.
+                 */
+                await redis.setex(redisKey, Math.min(ttl ?? session_store_1.SESSION_TTL, session_store_1.SESSION_TTL), payload);
             },
             delete: async (key) => {
                 try {

package/dist/auth/safe-callback.d.ts

@@ -0,0 +1,92 @@
+/**
+ * ONE definition of "is this callback target safe to navigate to", for the
+ * whole package (375656).
+ *
+ * *** THIS DELEGATES PARSING TO THE URL PARSER. DO NOT REPLACE IT WITH
+ * *** startsWith() CHECKS. THAT APPROACH FAILED FOUR TIMES.
+ *
+ * WHY THIS FILE EXISTS: `@payez/next-mvp` shipped THREE bodies named
+ * `makeAuthDecision`, each carrying its own `callbackUrl.startsWith('/account-auth/')`
+ * test. That test is a REDIRECT-LOOP guard sitting in the seat where an ORIGIN
+ * check belongs - its own comment says "prevents infinite loop" - so
+ * `https://evil.example.com` does not start with `/account-auth/`, passes
+ * through untouched, and becomes the redirect target. The exported copy
+ * (`auth/auth-decision.ts`, re-exported from `index.ts` and `edge/middleware.ts`)
+ * is public API, so that is a published open redirect independent of who calls it.
+ *
+ * HISTORY, because it is the whole argument for the current shape (267097 /
+ * 267174 / 267448), carried over verbatim from the portal's `src/lib/safe-callback.ts`
+ * where this guard was proven (0 leaks / 21 hostile inputs):
+ *
+ *   v1  `startsWith('/') && !startsWith('//')`            -> bypassed by  /BACKSLASH host
+ *   v2  + `!startsWith('/' + BACKSLASH)`                  -> bypassed by  /TAB/host
+ *   ...                                                      and /LF/host, /CR/host
+ *   v3  resolve once + compare ORIGIN                     -> bypassed by  /..//host
+ *                                                            and /.//host, /%2e%2e//host
+ *   v4  + require the RESULT to be a FIXED POINT          <- current
+ *
+ * *** DRIFT, 2026-09-11 (325543). THIS FILE WAS v3 WHILE THE PORTAL'S COPY WAS
+ * *** v4, AND THE PACKAGE COPY IS THE ONE THAT SHIPPED. The portal fixed its own
+ * *** src/lib/safe-callback.ts (e1f08fea) and deployed; the served bundle STILL
+ * *** escaped 5/5 in a real browser, because `src/contexts/ThemeContext.tsx`
+ * *** imports the BARE BARREL `@payez/next-mvp`, which pulls dist/index.js ->
+ * *** auth/auth-decision -> THIS FILE into the client graph, and because the
+ * *** portal's `src/middleware.ts` imports `@payez/next-mvp/edge`, which requires
+ * *** THIS FILE server-side on every request. It was read as a stale build
+ * *** artifact of the portal's file for most of a day. It was not. It was a
+ * *** SECOND DEFINITION, and no rebuild of the portal could have removed it.
+ * *** The header below says "ONE definition ... for the whole package" and that
+ * *** was true INSIDE this package boundary the entire time. The defect lived in
+ * *** the gap BETWEEN two boundaries that each enforced one-definition correctly.
+ * *** A guard that exists in N copies is only as strong as its weakest copy, and
+ * *** a per-repo grep gate cannot see N. IF YOU CHANGE THE PREDICATE HERE, CHANGE
+ * *** IT IN THE PORTAL'S src/lib/safe-callback.ts IN THE SAME HOUR, OR DELETE ONE
+ * *** OF THEM.
+ *
+ * Both bypasses work the same way: the browser NORMALISES the string AFTER the
+ * guard has finished looking at it. The WHATWG URL parser converts backslashes
+ * to forward slashes and STRIPS all ASCII tab, LF and CR before resolving. So a
+ * prefix check can always be defeated by a character that is not there yet when
+ * it runs. Each fix bought one character. The list was never provably complete.
+ *
+ * SO: stop re-implementing the parser and ask it instead. Resolve the input
+ * against a synthetic base and compare ORIGINS. Anything that escapes the
+ * origin - however it is spelled, including spellings nobody has found yet -
+ * fails one comparison. The returned value is the parser's own NORMALISED
+ * output, so an accepted path cannot smuggle a control character onward either.
+ *
+ * A synthetic base is used deliberately so this works identically in a server
+ * component (no window), on the client, and in the edge runtime.
+ */
+/** Where we send anyone whose requested target we will not honour. */
+export declare const DEFAULT_CALLBACK = "/";
+/**
+ * The value to navigate to: a same-origin relative path, NORMALISED by the URL
+ * parser, or `fallback` for anything that escapes the origin or loops back into
+ * the auth surface. Never throws.
+ */
+export declare function safeCallbackPath(raw: unknown, fallback?: string): string;
+/**
+ * True when `raw` is a callback target we are willing to honour.
+ *
+ * DEFINED IN TERMS OF `safeCallbackPath` ON PURPOSE - it used to carry its own
+ * copy of the predicate, and that copy was missing the second resolution above
+ * while the two were maintained separately. This file's whole history is
+ * duplicated predicates drifting apart (see the header). One definition, one
+ * place to fix.
+ */
+export declare function isSafeCallbackPath(raw: unknown): raw is string;
+/**
+ * Pick the post-login destination: an explicit `?callbackUrl=` when it is one we
+ * will honour, otherwise the current path, otherwise `/`.
+ *
+ * This replaces the package's three hand-rolled `getSafeCallbackUrl` /
+ * `getCallbackUrl` bodies. Note the ARGUMENT ORDER DEPENDENCY those had: they
+ * tested `pathname` FIRST and returned early, so a caller on the login page
+ * never reached the attacker-controlled parameter at all - safe, but only
+ * because that caller happened to pass a value that tripped the function's own
+ * first guard. Nothing in the code named that dependency, and an argument
+ * reorder would have opened it. Here BOTH inputs are validated, so the
+ * protection no longer depends on which one is passed.
+ */
+export declare function resolveCallbackDestination(pathname: string, searchParams?: URLSearchParams | null, fallback?: string): string;

package/dist/auth/safe-callback.js

@@ -0,0 +1,183 @@
+"use strict";
+/**
+ * ONE definition of "is this callback target safe to navigate to", for the
+ * whole package (375656).
+ *
+ * *** THIS DELEGATES PARSING TO THE URL PARSER. DO NOT REPLACE IT WITH
+ * *** startsWith() CHECKS. THAT APPROACH FAILED FOUR TIMES.
+ *
+ * WHY THIS FILE EXISTS: `@payez/next-mvp` shipped THREE bodies named
+ * `makeAuthDecision`, each carrying its own `callbackUrl.startsWith('/account-auth/')`
+ * test. That test is a REDIRECT-LOOP guard sitting in the seat where an ORIGIN
+ * check belongs - its own comment says "prevents infinite loop" - so
+ * `https://evil.example.com` does not start with `/account-auth/`, passes
+ * through untouched, and becomes the redirect target. The exported copy
+ * (`auth/auth-decision.ts`, re-exported from `index.ts` and `edge/middleware.ts`)
+ * is public API, so that is a published open redirect independent of who calls it.
+ *
+ * HISTORY, because it is the whole argument for the current shape (267097 /
+ * 267174 / 267448), carried over verbatim from the portal's `src/lib/safe-callback.ts`
+ * where this guard was proven (0 leaks / 21 hostile inputs):
+ *
+ *   v1  `startsWith('/') && !startsWith('//')`            -> bypassed by  /BACKSLASH host
+ *   v2  + `!startsWith('/' + BACKSLASH)`                  -> bypassed by  /TAB/host
+ *   ...                                                      and /LF/host, /CR/host
+ *   v3  resolve once + compare ORIGIN                     -> bypassed by  /..//host
+ *                                                            and /.//host, /%2e%2e//host
+ *   v4  + require the RESULT to be a FIXED POINT          <- current
+ *
+ * *** DRIFT, 2026-09-11 (325543). THIS FILE WAS v3 WHILE THE PORTAL'S COPY WAS
+ * *** v4, AND THE PACKAGE COPY IS THE ONE THAT SHIPPED. The portal fixed its own
+ * *** src/lib/safe-callback.ts (e1f08fea) and deployed; the served bundle STILL
+ * *** escaped 5/5 in a real browser, because `src/contexts/ThemeContext.tsx`
+ * *** imports the BARE BARREL `@payez/next-mvp`, which pulls dist/index.js ->
+ * *** auth/auth-decision -> THIS FILE into the client graph, and because the
+ * *** portal's `src/middleware.ts` imports `@payez/next-mvp/edge`, which requires
+ * *** THIS FILE server-side on every request. It was read as a stale build
+ * *** artifact of the portal's file for most of a day. It was not. It was a
+ * *** SECOND DEFINITION, and no rebuild of the portal could have removed it.
+ * *** The header below says "ONE definition ... for the whole package" and that
+ * *** was true INSIDE this package boundary the entire time. The defect lived in
+ * *** the gap BETWEEN two boundaries that each enforced one-definition correctly.
+ * *** A guard that exists in N copies is only as strong as its weakest copy, and
+ * *** a per-repo grep gate cannot see N. IF YOU CHANGE THE PREDICATE HERE, CHANGE
+ * *** IT IN THE PORTAL'S src/lib/safe-callback.ts IN THE SAME HOUR, OR DELETE ONE
+ * *** OF THEM.
+ *
+ * Both bypasses work the same way: the browser NORMALISES the string AFTER the
+ * guard has finished looking at it. The WHATWG URL parser converts backslashes
+ * to forward slashes and STRIPS all ASCII tab, LF and CR before resolving. So a
+ * prefix check can always be defeated by a character that is not there yet when
+ * it runs. Each fix bought one character. The list was never provably complete.
+ *
+ * SO: stop re-implementing the parser and ask it instead. Resolve the input
+ * against a synthetic base and compare ORIGINS. Anything that escapes the
+ * origin - however it is spelled, including spellings nobody has found yet -
+ * fails one comparison. The returned value is the parser's own NORMALISED
+ * output, so an accepted path cannot smuggle a control character onward either.
+ *
+ * A synthetic base is used deliberately so this works identically in a server
+ * component (no window), on the client, and in the edge runtime.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_CALLBACK = void 0;
+exports.safeCallbackPath = safeCallbackPath;
+exports.isSafeCallbackPath = isSafeCallbackPath;
+exports.resolveCallbackDestination = resolveCallbackDestination;
+/** Where we send anyone whose requested target we will not honour. */
+exports.DEFAULT_CALLBACK = '/';
+/** The auth surface. A callback pointing back into it causes a redirect cycle. */
+const AUTH_PREFIX = '/account-auth/';
+/**
+ * Synthetic, unreachable base. Only ever used as the resolution origin for the
+ * comparison below - never emitted, never navigated to. `.invalid` is reserved
+ * by RFC 2606 and can never resolve.
+ */
+const BASE = 'http://safe-callback.invalid';
+/**
+ * The value to navigate to: a same-origin relative path, NORMALISED by the URL
+ * parser, or `fallback` for anything that escapes the origin or loops back into
+ * the auth surface. Never throws.
+ */
+function safeCallbackPath(raw, fallback = exports.DEFAULT_CALLBACK) {
+    if (typeof raw !== 'string' || raw.length === 0)
+        return fallback;
+    let url;
+    try {
+        url = new URL(raw, BASE);
+    }
+    catch {
+        return fallback;
+    }
+    // Anything that resolved to a different origin escaped, however it was spelled:
+    // absolute, protocol-relative //host, backslash /\host, tab/LF/CR variants, or
+    // a scheme like javascript: (whose origin is opaque and never equals BASE).
+    if (url.origin !== BASE)
+        return fallback;
+    // Loopbacks into the auth surface cause redirect cycles.
+    if (url.pathname.startsWith(AUTH_PREFIX))
+        return fallback;
+    // The parser's normalised output - control characters already stripped.
+    const candidate = url.pathname + url.search + url.hash;
+    // *** SECOND RESOLUTION. DO NOT DELETE THIS AS REDUNDANT - IT IS NOT. ***
+    //
+    // v3 (the origin comparison above) was bypassed too, and differently from v1/v2.
+    // The origin check constrains where `raw` RESOLVED TO. It does not constrain how
+    // the RESULT IS SPELLED - and the result is resolved a SECOND time, by whoever
+    // navigates to it. A returned path that begins with `//` is a PROTOCOL-RELATIVE
+    // URL at that second resolution, so it lands off-origin having passed every
+    // check here:
+    //
+    //     '/..//evil.example.com'     -> pathname '//evil.example.com'  -> evil.example.com
+    //     '/.//evil.example.com'      -> pathname '//evil.example.com'  -> evil.example.com
+    //     '/%2e%2e//evil.example.com' -> pathname '//evil.example.com'  -> evil.example.com
+    //
+    // The parser resolves `..` against the synthetic base and, at the root, leaves
+    // behind the EMPTY SEGMENT rather than collapsing it. Origin stayed BASE the
+    // whole time, so nothing upstream fired.
+    //
+    // MEASURED, not reasoned: in a real headless Chromium on the live origin
+    // https://portal.keelauth.com, 5 spellings resolved to https://evil.example.com
+    // (QAPert-NightHawk, 2026-09-11, card 325543), and on 2026-09-11 the SERVED
+    // BUNDLE was measured escaping 5/5 through THIS PACKAGE'S copy while the
+    // portal's own src/lib/safe-callback.ts was already fixed - the two copies had
+    // drifted. See the DRIFT note in this file's header.
+    //
+    // THE FIX FOLLOWS THIS FILE'S OWN DOCTRINE: do not pattern-match the spellings
+    // (that is the startsWith() trap that failed four times, and this would be the
+    // fifth). Ask the parser AGAIN about the exact value we are about to hand out,
+    // and require it to be a FIXED POINT. Anything whose meaning changes when it is
+    // resolved a second time is by definition not a stable same-origin path, however
+    // it is spelled - including spellings nobody has found yet.
+    let echo;
+    try {
+        echo = new URL(candidate, BASE);
+    }
+    catch {
+        return fallback;
+    }
+    if (echo.origin !== BASE)
+        return fallback;
+    if (echo.pathname.startsWith(AUTH_PREFIX))
+        return fallback;
+    if (echo.pathname + echo.search + echo.hash !== candidate)
+        return fallback;
+    return candidate;
+}
+/**
+ * Sentinel that `safeCallbackPath` can never legitimately return: it is not a
+ * fixed point of the URL parser (the parser would percent-encode the space), so
+ * it cannot collide with a genuine accepted value.
+ */
+const REJECTED = '\u0000rejected';
+/**
+ * True when `raw` is a callback target we are willing to honour.
+ *
+ * DEFINED IN TERMS OF `safeCallbackPath` ON PURPOSE - it used to carry its own
+ * copy of the predicate, and that copy was missing the second resolution above
+ * while the two were maintained separately. This file's whole history is
+ * duplicated predicates drifting apart (see the header). One definition, one
+ * place to fix.
+ */
+function isSafeCallbackPath(raw) {
+    return typeof raw === 'string' && raw.length > 0 && safeCallbackPath(raw, REJECTED) !== REJECTED;
+}
+/**
+ * Pick the post-login destination: an explicit `?callbackUrl=` when it is one we
+ * will honour, otherwise the current path, otherwise `/`.
+ *
+ * This replaces the package's three hand-rolled `getSafeCallbackUrl` /
+ * `getCallbackUrl` bodies. Note the ARGUMENT ORDER DEPENDENCY those had: they
+ * tested `pathname` FIRST and returned early, so a caller on the login page
+ * never reached the attacker-controlled parameter at all - safe, but only
+ * because that caller happened to pass a value that tripped the function's own
+ * first guard. Nothing in the code named that dependency, and an argument
+ * reorder would have opened it. Here BOTH inputs are validated, so the
+ * protection no longer depends on which one is passed.
+ */
+function resolveCallbackDestination(pathname, searchParams, fallback = exports.DEFAULT_CALLBACK) {
+    const requested = searchParams?.get('callbackUrl');
+    if (isSafeCallbackPath(requested))
+        return safeCallbackPath(requested, fallback);
+    return safeCallbackPath(pathname, fallback);
+}

package/dist/hooks/useProfile.d.ts

@@ -9,7 +9,6 @@ export type ProfileResponse = {
     phone_confirmed?: boolean;
     two_factor_enabled?: boolean;
     roles?: string[];
-    contact_information?: Record<string, any>;
     [key: string]: any;
 };
 export declare function useProfile(): import("@tanstack/react-query").UseQueryResult<ProfileResponse, Error>;