@payez/next-mvp 4.4.1 → 4.4.3

package/dist/lib/acr.d.ts

@@ -0,0 +1,64 @@
+/**
+ * CARD 375639 - the one place this package decides what an ABSENT assurance
+ * signal means.
+ *
+ * Card 375276 fixed this question inside `payez_idp_admin_web/src` (commit
+ * d9c6ac0, BAPert R980 remedy (a)) and fenced its own scope explicitly:
+ *
+ *     "fallbacks on the stored `session.authenticationLevel` (refresh lane)
+ *      are deliberately NOT covered ... That gap is 375276's remaining half."
+ *
+ * `src/api/auth-handler.ts` IS that remaining half, and it is in the shared
+ * package rather than in one app, so every consumer of the published
+ * `@payez/next-mvp/api/auth-handler` export inherits it.
+ *
+ * WHY BOTH SIGNALS LIVE IN ONE MODULE
+ * -----------------------------------
+ * `acr` (how strong the authentication was) and `amr` (which methods were
+ * used) are sent to the IDP together in a single refresh body. Defaulting one
+ * without the other produces an INCOHERENT assertion - "no second factor
+ * happened, and the method used was mfa" - so they are resolved side by side
+ * and a change to one is forced to confront the other.
+ *
+ * MEASURED CONVENTION IN THIS PACKAGE (census, 2026-09-11)
+ * -------------------------------------------------------
+ * acr absent-defaults:  '0' x1, '1' x3, '2' x1   <- the '2' was auth-handler
+ * amr absent-defaults:  []  x5, ['pwd','mfa'] x1 <- the list was auth-handler
+ *
+ * Both fail-open values were outliers at a single site, not the convention.
+ * These constants adopt the majority, fail-closed convention.
+ */
+/**
+ * The assurance level used when the session and token say NOTHING about it.
+ *
+ * '1' = a single factor. It does not assert that a second factor happened.
+ * It must never be '2' (or higher): that is the value the IDP reads as
+ * "a second factor was completed", and an absent claim is not evidence of one.
+ */
+export declare const ACR_WHEN_ABSENT = "1";
+/**
+ * The authentication-methods list used when nothing is known.
+ *
+ * Empty asserts nothing. It must never contain 'mfa' (or any second-factor
+ * method): claiming a method that was never exercised is the same fabrication
+ * as ACR '2', and because the two corroborate each other a downstream check
+ * that cross-validates amr against acr would accept the fabricated pair.
+ */
+export declare const AMR_WHEN_ABSENT: readonly string[];
+/**
+ * Resolve an assurance level from any number of candidate sources, in
+ * priority order, falling back to the level that asserts no second factor.
+ *
+ * Accepts the candidates the refresh lane actually has: the stored
+ * `session.authenticationLevel` first, then the `acr` claim on the token.
+ */
+export declare function resolveAcrLevel(...candidates: unknown[]): string;
+/**
+ * Resolve the authentication-methods list.
+ *
+ * `raw` may arrive as a JSON string (the shape stored on the token) or as an
+ * array (the shape held on the session). Anything unparseable resolves to the
+ * empty list rather than to an assumed set of methods - a malformed claim is
+ * not evidence that mfa happened.
+ */
+export declare function resolveAuthMethods(...candidates: unknown[]): string[];

package/dist/lib/acr.js

@@ -0,0 +1,109 @@
+"use strict";
+/**
+ * CARD 375639 - the one place this package decides what an ABSENT assurance
+ * signal means.
+ *
+ * Card 375276 fixed this question inside `payez_idp_admin_web/src` (commit
+ * d9c6ac0, BAPert R980 remedy (a)) and fenced its own scope explicitly:
+ *
+ *     "fallbacks on the stored `session.authenticationLevel` (refresh lane)
+ *      are deliberately NOT covered ... That gap is 375276's remaining half."
+ *
+ * `src/api/auth-handler.ts` IS that remaining half, and it is in the shared
+ * package rather than in one app, so every consumer of the published
+ * `@payez/next-mvp/api/auth-handler` export inherits it.
+ *
+ * WHY BOTH SIGNALS LIVE IN ONE MODULE
+ * -----------------------------------
+ * `acr` (how strong the authentication was) and `amr` (which methods were
+ * used) are sent to the IDP together in a single refresh body. Defaulting one
+ * without the other produces an INCOHERENT assertion - "no second factor
+ * happened, and the method used was mfa" - so they are resolved side by side
+ * and a change to one is forced to confront the other.
+ *
+ * MEASURED CONVENTION IN THIS PACKAGE (census, 2026-09-11)
+ * -------------------------------------------------------
+ * acr absent-defaults:  '0' x1, '1' x3, '2' x1   <- the '2' was auth-handler
+ * amr absent-defaults:  []  x5, ['pwd','mfa'] x1 <- the list was auth-handler
+ *
+ * Both fail-open values were outliers at a single site, not the convention.
+ * These constants adopt the majority, fail-closed convention.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AMR_WHEN_ABSENT = exports.ACR_WHEN_ABSENT = void 0;
+exports.resolveAcrLevel = resolveAcrLevel;
+exports.resolveAuthMethods = resolveAuthMethods;
+/**
+ * The assurance level used when the session and token say NOTHING about it.
+ *
+ * '1' = a single factor. It does not assert that a second factor happened.
+ * It must never be '2' (or higher): that is the value the IDP reads as
+ * "a second factor was completed", and an absent claim is not evidence of one.
+ */
+exports.ACR_WHEN_ABSENT = '1';
+/**
+ * The authentication-methods list used when nothing is known.
+ *
+ * Empty asserts nothing. It must never contain 'mfa' (or any second-factor
+ * method): claiming a method that was never exercised is the same fabrication
+ * as ACR '2', and because the two corroborate each other a downstream check
+ * that cross-validates amr against acr would accept the fabricated pair.
+ */
+exports.AMR_WHEN_ABSENT = [];
+/**
+ * True when an assurance signal carries no information.
+ *
+ * Deliberately NOT `!value`. The `||` idiom this replaces cannot tell
+ * "the token said nothing" from "the token said 0", and numeric 0 is a
+ * meaningful assurance level (unauthenticated) that must survive as '0'
+ * rather than being promoted to the fallback.
+ */
+function isAbsent(value) {
+    return value === undefined || value === null || value === '';
+}
+/**
+ * Resolve an assurance level from any number of candidate sources, in
+ * priority order, falling back to the level that asserts no second factor.
+ *
+ * Accepts the candidates the refresh lane actually has: the stored
+ * `session.authenticationLevel` first, then the `acr` claim on the token.
+ */
+function resolveAcrLevel(...candidates) {
+    for (const candidate of candidates) {
+        if (!isAbsent(candidate)) {
+            return String(candidate);
+        }
+    }
+    return exports.ACR_WHEN_ABSENT;
+}
+/**
+ * Resolve the authentication-methods list.
+ *
+ * `raw` may arrive as a JSON string (the shape stored on the token) or as an
+ * array (the shape held on the session). Anything unparseable resolves to the
+ * empty list rather than to an assumed set of methods - a malformed claim is
+ * not evidence that mfa happened.
+ */
+function resolveAuthMethods(...candidates) {
+    for (const candidate of candidates) {
+        if (isAbsent(candidate))
+            continue;
+        if (Array.isArray(candidate)) {
+            return candidate.map(String);
+        }
+        if (typeof candidate === 'string') {
+            try {
+                const parsed = JSON.parse(candidate);
+                if (Array.isArray(parsed)) {
+                    return parsed.map(String);
+                }
+            }
+            catch {
+                // A malformed amr claim asserts nothing. Fall through to the next
+                // candidate rather than inventing methods.
+                continue;
+            }
+        }
+    }
+    return [...exports.AMR_WHEN_ABSENT];
+}

package/dist/lib/session-store.js

@@ -389,6 +389,26 @@ async function transitionTo2FASession(sessionToken, tokens, mfaMethod) {
             console.log('[transitionTo2FASession] Extracted bearerKeyId (kid) from new JWT header:', bearerKeyId);
         }
     }
+    // 339563: derive the expiry ONCE - it is both a field to write and the
+    // evidence test below. Re-deriving it twice invites the two reads to drift.
+    const mfaLifetime = mfaLifetimeFromAccessToken(newAccessToken);
+    // *** R908(e). ABSENCE OF THE EXPIRY IS NOT A COMPLETED CEREMONY. ***
+    //
+    // `mfaExpiresAt` is the only evidence we hold that a real MFA ceremony took
+    // place and when it lapses. When the stepped-up token carries no `mfa_expires`
+    // claim we do NOT know that this session is MFA-verified, and R908(e) binds
+    // the consumer to the third arm:
+    //
+    //   producers degrade  ->  consumers RE-CHALLENGE  ->  nobody infers a
+    //   negative from a silence.
+    //
+    // So: never mint `mfaVerified: true` off a token that carries no expiry (that
+    // is forging evidence of a ceremony we did not observe - 12188/12390), and
+    // never hard-refuse the user either (R486: null is "cannot determine", not
+    // "not 2FA-backed"). Leave the session un-verified and set `nextStep:
+    // 'mfa_verify'`, which is the field the gate already reads to mean "a usable
+    // method exists; challenge them" (SessionModel.ts:136).
+    const mfaEvidencePresent = mfaLifetime.mfaExpiresAt !== undefined;
     // Support both old and new field names in input
     // CRITICAL: Set BOTH mfaVerified (new) AND twoFactorComplete (legacy) for compatibility
     // auth.ts session callback reads twoFactorComplete, so we must set it here
@@ -396,15 +416,28 @@ async function transitionTo2FASession(sessionToken, tokens, mfaMethod) {
         idpAccessToken: newAccessToken,
         idpRefreshToken: tokens.idpRefreshToken || tokens.refreshToken,
         idpAccessTokenExpires: tokens.idpAccessTokenExpires || tokens.accessTokenExpires,
-        mfaVerified: true,
-        twoFactorComplete: true, // Legacy field - required by auth.ts session callback
+        mfaVerified: mfaEvidencePresent,
+        twoFactorComplete: mfaEvidencePresent, // Legacy field - required by auth.ts session callback
         mfaMethod: mfaMethod,
         // Update bearerKeyId if extracted from new token
         ...(bearerKeyId && { bearerKeyId }),
         // 339563: write the expiry in the SAME update that sets the flag. We already
         // hold the stepped-up token here and already decode its header above.
-        ...mfaLifetimeFromAccessToken(newAccessToken),
+        ...mfaLifetime,
+        // R908(e): no evidence -> route to the challenge, do not grant and do not eject.
+        ...(mfaEvidencePresent ? {} : { nextStep: 'mfa_verify' }),
     };
+    if (!mfaEvidencePresent) {
+        console.warn('[transitionTo2FASession] R908(e): the stepped-up token carries NO mfa_expires ' +
+            'claim, so there is no evidence of an MFA ceremony to record. NOT setting ' +
+            'mfaVerified; setting nextStep=mfa_verify so the consumer re-challenges. ' +
+            'If this fires for a lane that DID complete a real ceremony, the defect is ' +
+            'on the emit side (R908(b)) - do not "fix" it by minting the flag here.', {
+            sessionToken: sessionToken?.substring(0, 8) + '...',
+            mfaMethod,
+            hasAccessToken: !!newAccessToken,
+        });
+    }
     const refreshExpires = tokens.idpRefreshTokenExpires || tokens.refreshTokenExpires;
     if (refreshExpires !== undefined) {
         updates.idpRefreshTokenExpires = refreshExpires;
@@ -415,11 +448,13 @@ async function transitionTo2FASession(sessionToken, tokens, mfaMethod) {
         mfaMethod: updates.mfaMethod,
         hasIdpAccessToken: !!updates.idpAccessToken,
         // 339563: surface the expiry we derived. `mfaExpiresAt: undefined` here is
-        // the passwordless/primary-credential lane (token carried no mfa_expires),
-        // NOT a bug - but it IS the case the consumers currently fail OPEN on, so
-        // it needs to be visible in the log rather than inferred from its absence.
+        // the passwordless/primary-credential lane (token carried no mfa_expires).
+        // Since R908(e) that absence no longer fails OPEN: it withholds mfaVerified
+        // and sets nextStep=mfa_verify instead, so log both together - the pair is
+        // the whole decision.
         mfaExpiresAt: updates.mfaExpiresAt,
         mfaExpiresAtISO: updates.mfaExpiresAt ? new Date(updates.mfaExpiresAt).toISOString() : undefined,
+        nextStep: updates.nextStep,
     });
     const result = await updateSession(sessionToken, updates);
     console.log('[transitionTo2FASession] Result:', {
@@ -477,9 +512,23 @@ async function mark2FAComplete(sessionToken, accessToken) {
             'this session has no MFA expiry. Expected on a primary-credential lane ' +
             '(e.g. passwordless email); unexpected on an ordinary 2FA completion.');
     }
+    // R908(e): identical rule to transitionTo2FASession above - no expiry derived
+    // means no observed ceremony, so we re-challenge rather than mint the flag.
+    // This path matters more than its sibling: `mark2FAComplete(sessionToken)`
+    // with the accessToken omitted used to write a bare `mfaVerified: true` that
+    // NO consumer could ever expire, and it is reachable from route handlers that
+    // take their tokens from the request body.
+    const mfaEvidencePresent = mfaLifetime.mfaExpiresAt !== undefined;
+    if (!mfaEvidencePresent) {
+        console.warn('[mark2FAComplete] R908(e): no mfa_expires could be derived, so mfaVerified ' +
+            'is NOT being set. Writing nextStep=mfa_verify instead so the consumer ' +
+            're-challenges. A caller that needs the grant must pass the stepped-up ' +
+            'access token that carries the claim.');
+    }
     return updateSession(sessionToken, {
-        mfaVerified: true,
+        mfaVerified: mfaEvidencePresent,
         ...mfaLifetime,
+        ...(mfaEvidencePresent ? {} : { nextStep: 'mfa_verify' }),
     });
 }
 /**

package/dist/middleware/create-middleware.js

@@ -21,6 +21,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createMvpMiddleware = createMvpMiddleware;
 const server_1 = require("next/server");
 const route_config_1 = require("../auth/route-config");
+const safe_callback_1 = require("../auth/safe-callback");
 const internal_api_url_1 = require("../edge/internal-api-url");
 const app_slug_1 = require("../lib/app-slug");
 const rbac_check_1 = require("./rbac-check");
@@ -57,16 +58,23 @@ const VERIFY_CODE_PAGE = '/account-auth/verify-code';
 function isLoginPage(pathname) {
     return pathname === LOGIN_PAGE;
 }
-/** Ensures callback URLs never point to auth pages (prevents redirect loops) */
+/**
+ * Ensures callback URLs never point to auth pages (prevents redirect loops) AND
+ * never point off-origin (prevents open redirect).
+ *
+ * 375656: the previous body tested `pathname` FIRST and returned '/' early, so
+ * the two call sites that pass an attacker-controlled `searchParams` are both
+ * inside `if (onLoginPage)` branches - and `isLoginPage` is exact equality against
+ * `LOGIN_PAGE`, which starts with `/account-auth/`. The early return therefore
+ * fired before the parameter was ever read. That made this function SAFE, but
+ * safe because of which argument the caller happened to pass, not because the
+ * attacker-controlled value was ever checked: `existing` was returned raw on the
+ * strength of a `startsWith` test that `https://evil.example.com` passes.
+ * Nothing named that dependency, and reordering the arguments would have opened
+ * it silently. Both inputs are now validated by the same parser-based guard.
+ */
 function getSafeCallbackUrl(pathname, searchParams) {
-    if (pathname.startsWith('/account-auth/')) {
-        return '/';
-    }
-    const existing = searchParams?.get('callbackUrl');
-    if (existing && !existing.startsWith('/account-auth/')) {
-        return existing;
-    }
-    return pathname;
+    return (0, safe_callback_1.resolveCallbackDestination)(pathname, searchParams);
 }
 /** Clear all session cookies on a response */
 function clearSessionCookies(response, request) {
@@ -276,14 +284,38 @@ function createMvpMiddleware(options = {}) {
         }
         // --- Fetch session viability from internal API ---
         const { sessionStatus, sessionPointer } = await checkViability(request, viabilityEndpoint, log);
-        // --- Handle stale session early (cookie exists but session doesn't) ---
+        // --- Stale session (cookie exists but session doesn't): OBSERVE ONLY, DO NOT DECIDE ---
+        //
+        // *** CARD 349607. THIS BLOCK USED TO `return` HERE, AND THAT RETURN WAS A BYPASS. ***
+        //
+        // makeAuthDecision() below already handles this exact condition at its
+        // `if (!sessionStatus.exists)` branch, and it handles it with TWO guard
+        // clauses that this early return did not have:
+        //
+        //     if (onLoginPage)                 return { type: 'allow' };   // no redirect loop
+        //     if (pathname.startsWith('/api/'))return { type: 'allow' };   // no HTML 307 at fetch()
+        //
+        // Returning here skipped BOTH. The `/api/` case is the reported harm: a
+        // stale-session XHR was answered with a 307 to an HTML login page, so the
+        // failure is invisible to `fetch()` - the caller sees an opaque redirect
+        // instead of an auth error, which is the same "correct logic preempted by
+        // an earlier return" shape recorded on 307290.
+        //
+        // This was NOT a missing feature one level down - the decision engine's
+        // branch is a strict superset of the behaviour this block implemented.
+        // The early return was a DUPLICATE that had drifted from the original.
+        // Adding a single `/api/` exemption here would have re-created the
+        // duplication (and left the onLoginPage divergence in place), so the
+        // duplicate is removed instead and the engine is left as the ONE decider.
+        //
+        // The warning is deliberately KEPT: it is the only operational signal that
+        // stale sessions are occurring, and it costs nothing to log before
+        // delegating. Do not re-introduce a `return` in this block.
         if (!isPublic && sessionStatus.exists === false && sessionPointer.sessionToken) {
-            const safeCallback = getSafeCallbackUrl(pathname);
-            log.warn('Stale session detected', {
+            log.warn('Stale session detected (delegating to decision engine)', {
                 sessionToken: sessionPointer.sessionToken?.substring(0, 8) + '...',
                 pathname
             });
-            return redirectTo(request, `${LOGIN_PAGE}?callbackUrl=${encodeURIComponent(safeCallback)}`, true);
         }
         // --- Run decision engine ---
         const decision = makeAuthDecision({

package/dist/pages/profile/EnhancedProfilePage.js

@@ -21,6 +21,12 @@ const jsx_runtime_1 = require("react/jsx-runtime");
 const react_1 = __importDefault(require("react"));
 const useProfile_1 = require("../../hooks/useProfile");
 const useTheme_1 = require("../../theme/useTheme");
+// An all-null object is not data. The member profile DTOs are always instantiated
+// server-side (UserService.GetUserProfileAsync), so `obj ? ... : undefined` cannot
+// tell "has an address" from "has an empty address shell".
+function hasAnyValue(obj) {
+    return !!obj && Object.values(obj).some(v => v !== null && v !== undefined && v !== '');
+}
 function EditableSection({ title, children, onEdit, isEditing, onSave, onCancel, isDarkMode }) {
     const cardBg = isDarkMode ? 'bg-slate-800' : 'bg-white';
     const borderColor = isDarkMode ? 'border-slate-700' : 'border-gray-200';
@@ -105,20 +111,39 @@ function EnhancedProfilePage() {
                 title: undefined,
                 bio: undefined,
             },
-            contact_info: rawProfile.contact_information ? {
-                secondary_email: rawProfile.contact_information.secondary_email,
-                secondary_phone: rawProfile.contact_information.secondary_phone,
-                website: rawProfile.contact_information.website,
+            // Both blocks used to be read off `rawProfile.contact_information`, which the
+            // MEMBER endpoint NEVER emits - that name belongs to AdminUserProfileResponse
+            // (its only 2 occurrences in PayEz-Core are in that admin DTO).
+            // /api/account/profile returns UserProfileResponse: `contact_info` plus a
+            // SEPARATE TOP-LEVEL `address`. Both guards therefore always took the false
+            // branch and both blocks rendered permanently empty for every member.
+            //
+            // NOT a rename: `address` is a SIBLING of contact_info, not nested inside it,
+            // so contact_information -> contact_info alone fixes Contact and leaves ADDRESS
+            // DEAD. Inner names are snake_case on both DTOs; the old camelCase reads were
+            // shaped for the ADMIN payload, which is where those keys really are camelCase.
+            // GUARD ON CONTENT, NOT PRESENCE. UserService.GetUserProfileAsync ALWAYS
+            // instantiates both DTOs (ContactInfo = new ProfileContactInfoDto {...},
+            // Address = new AddressDto {...}), so both arrive NON-NULL with all-null
+            // members when the member has nothing on file. A truthiness guard always
+            // passes and would render a card full of blank fields - the hazard QAPert
+            // named in 41360 for the naive rename, which applies just as much to
+            // reading the CORRECT fields.
+            contact_info: hasAnyValue(rawProfile.contact_info) ? {
+                secondary_email: rawProfile.contact_info?.secondary_email,
+                secondary_phone: rawProfile.contact_info?.secondary_phone,
+                website: rawProfile.contact_info?.website,
+                preferred_contact_method: rawProfile.contact_info?.preferred_contact_method,
             } : undefined,
-            address: rawProfile.contact_information ? {
-                address_line_1: rawProfile.contact_information.addressLine1,
-                address_line_2: rawProfile.contact_information.addressLine2,
-                city: rawProfile.contact_information.city,
-                state_id: rawProfile.contact_information.stateId,
-                state_name: rawProfile.contact_information.stateName,
-                postal_code: rawProfile.contact_information.postalCode,
-                country_code: rawProfile.contact_information.countryCode,
-                country_name: rawProfile.contact_information.countryName,
+            address: hasAnyValue(rawProfile.address) ? {
+                address_line_1: rawProfile.address?.address_line_1,
+                address_line_2: rawProfile.address?.address_line_2,
+                city: rawProfile.address?.city,
+                state_id: rawProfile.address?.state_id,
+                state_name: rawProfile.address?.state_name,
+                postal_code: rawProfile.address?.postal_code,
+                country_code: rawProfile.address?.country_code,
+                country_name: rawProfile.address?.country_name,
             } : undefined,
             two_factor_enabled: rawProfile.two_factor_enabled,
             roles: rawProfile.roles,

package/dist/pages/verify-code/page.js

@@ -37,6 +37,7 @@ const navigation_1 = require("next/navigation");
 const better_auth_client_1 = require("../../client/better-auth-client");
 const react_2 = require("react");
 const useTheme_1 = require("../../theme/useTheme");
+const safe_callback_1 = require("../../auth/safe-callback");
 /**
  * Session storage key to track that user intentionally navigated to verify-code.
  * Prevents auto-redirect back to dashboard when session refreshes in background.
@@ -45,7 +46,31 @@ const VERIFY_IN_PROGRESS_KEY = 'idealvibe_2fa_verify_in_progress';
 function VerifyCodeForm({ enrollHref }) {
     const router = (0, navigation_1.useRouter)();
     const searchParams = (0, navigation_1.useSearchParams)();
-    const callbackUrl = searchParams?.get('callbackUrl') || '/dashboard';
+    /**
+     * 375936 - ORIGIN-GUARDED AT THE READ, NOT AT THE SINK.
+     *
+     * This value ends up in `window.location.href` after a SUCCESSFUL 2FA
+     * ceremony (see the setTimeout further down). That is a full navigation, so
+     * an absolute URL here is a cross-origin redirect - the user completes a
+     * genuine login and is then dropped on an attacker-controlled page at the
+     * exact moment they are most primed to trust what they see.
+     *
+     * This used to be a raw `searchParams?.get('callbackUrl') || '/dashboard'`.
+     * The middleware does NOT protect this page: create-middleware's
+     * `needsTwoFactorRedirect` returns false for VERIFY_CODE_PAGE, so a direct
+     * request arrives here with its query string untouched.
+     *
+     * Do NOT "simplify" this back to a `startsWith('/account-auth/')` test. The
+     * three such tests below are LOOP prevention, not ORIGIN prevention -
+     * `https://evil.example` passes every one of them. safeCallbackPath asks the
+     * URL parser instead, so protocol-relative (`//host`), backslash (`/\host`)
+     * and TAB/LF/CR spellings all fail one origin comparison rather than needing
+     * their own blacklist entry.
+     *
+     * Guarding at the READ rather than at the sink means every later use of
+     * `callbackUrl` on this page inherits the guarantee.
+     */
+    const callbackUrl = (0, safe_callback_1.safeCallbackPath)(searchParams?.get('callbackUrl'), '/dashboard');
     const { data: sessionData, isPending } = better_auth_client_1.authClient.useSession();
     const session = sessionData;
     const status = isPending ? 'loading' : session ? 'authenticated' : 'unauthenticated';

package/dist/routes/auth/viability.d.ts

@@ -35,12 +35,12 @@ export declare function GET(req: NextRequest): Promise<NextResponse<{
     authenticated: boolean;
     sessionToken: any;
     tenantRequiresTwoFactor: boolean;
-    userHasCompletedTenantTwoFactorRequirements: any;
+    userHasCompletedTenantTwoFactorRequirements: boolean;
     userStillNeedsTwoFactor: boolean;
     tenantAllowed2FAMethods: string[] | null;
     nextStep: "enroll_mfa" | "mfa_verify" | null | undefined;
     requires2FA: boolean;
-    twoFactorComplete: any;
+    twoFactorComplete: boolean;
     accessTokenExpired: boolean;
     expiresAt: string;
     roles: string[];

package/dist/routes/auth/viability.js

@@ -280,7 +280,7 @@ async function GET(req) {
             const mfaExpiresAt = session?.mfaExpiresAt || 0;
             const mfaExpired = mfaExpiresAt > 0 && mfaExpiresAt < Date.now();
             // Check mfaVerified (normalized name) with fallback to twoFactorComplete for compatibility
-            const mfaVerifiedInSession = session?.mfaVerified ?? session?.twoFactorComplete ?? false;
+            const mfaVerifiedInSession = session?.mfaVerified ?? false;
             // User has completed 2FA requirements if: they verified AND it hasn't expired
             const userHasCompletedTenantTwoFactorRequirements = mfaVerifiedInSession && !mfaExpired;
             // userStillNeedsTwoFactor = inverse of completed (matches session callback logic)
@@ -322,7 +322,7 @@ async function GET(req) {
         const mfaExpiresAt = session?.mfaExpiresAt || 0;
         const mfaExpired = mfaExpiresAt > 0 && mfaExpiresAt < Date.now();
         // Check mfaVerified (normalized name) with fallback to twoFactorComplete for compatibility
-        const mfaVerifiedInSession = session?.mfaVerified ?? session?.twoFactorComplete ?? false;
+        const mfaVerifiedInSession = session?.mfaVerified ?? false;
         // DEBUG: Log what we're reading from the session
         console.log('[VIABILITY] Session 2FA state:', {
             sessionToken: sessionToken?.substring(0, 8) + '...',

package/dist/server/auth-guard.js

@@ -87,7 +87,32 @@ async function authGuard(options) {
         (0, navigation_1.redirect)(serviceUnavailableUrl);
     }
     if (requires2FA) {
-        const mfaVerified = sessionData.mfaVerified ?? sessionData.twoFactorComplete ?? false;
+        // 369858: the legacy `?? (sessionData as any).twoFactorComplete` carry is REMOVED.
+        // This is THE access gate - the only one of the 8 carry sites that grants access
+        // rather than reporting status - so it reads exactly one source of truth.
+        //
+        // Removing it is fail-closed. No current writer emits the legacy field alone:
+        // session-store.ts:444-445 writes both as a pair from a server-derived stepped-up
+        // token, auth/refresh.ts:376 writes it as a MIRROR of mfaVerified, and
+        // routes/auth/session.ts:149-157 refuses both on PRESENCE, so a caller cannot
+        // assert either. The carry therefore only ever served sessions minted before
+        // `mfaVerified` existed, and for those the correct behaviour is re-verify, not
+        // grandfather. Cost is one forced re-challenge for a stale legacy session.
+        //
+        // Severity note, so nobody re-inflates this later: the operator was `??`
+        // (nullish), NOT `||`. `false ?? x` is `false`, so an explicitly DENIED session
+        // could never be upgraded by a stale flag. This was legacy grandfathering, not a
+        // live 2FA bypass. Had it been `||`, it would have been the bypass.
+        const mfaVerified = sessionData.mfaVerified ?? false;
+        // 339563 / 369858 §3: THIS IS STILL A FAIL-OPEN AND IS DELIBERATELY LEFT VISIBLE.
+        // An absent mfaExpiresAt collapses to 0, so `mfaExpired` is false and the MFA
+        // verdict NEVER EXPIRES. That needs no legacy-session hypothesis: it fires on a
+        // current `mfaVerified: true` session whose token carried no `mfa_expires` claim -
+        // the passwordless/primary-credential lane, named on the write path in the
+        // source's own voice at session-store.ts:464-467 ("it IS the case the consumers
+        // currently fail OPEN on"). Removing the carry above does NOT touch this.
+        // Tracked separately by BAPert; not fixed here because failing closed on absent
+        // expiry would deny the passwordless lane outright and that is a product call.
         const mfaExpiresAt = sessionData.mfaExpiresAt || 0;
         const mfaExpired = mfaExpiresAt > 0 && mfaExpiresAt < Date.now();
         if (!mfaVerified || mfaExpired) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "4.4.1",
+  "version": "4.4.3",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -24,6 +24,7 @@
     "dev:local": "pwsh -NoProfile -ExecutionPolicy Bypass -File scripts/dev-local.ps1",
     "dev:broker": "pwsh -NoProfile -ExecutionPolicy Bypass -File scripts/dev-broker.ps1",
     "check:publish-health": "node scripts/check-publish-health.mjs",
+    "census:reach": "node scripts/module-reach.mjs",
     "build:incremental": "npx tsc --project tsconfig.json"
   },
   "exports": {