@payez/next-mvp 4.4.1 → 4.4.3

package/scripts/module-reach.mjs

@@ -0,0 +1,280 @@
+#!/usr/bin/env node
+/**
+ * module-reach.mjs - module-graph reachability census over the BUILT dist/.
+ *
+ * WHY THIS EXISTS
+ * ---------------
+ * Cards 372358 / 373665 rest on numbers like "40 consumer-mountable entry points can
+ * reach server/auth". Those numbers were originally produced by a script that was run
+ * inline and never committed, so nobody could reproduce them. A number nobody can
+ * re-derive is a rumour. This file is that script, made durable and self-testing.
+ *
+ * WHAT IT MEASURES
+ * ----------------
+ * Over dist/**\/*.js (the artifact a consumer actually installs, NOT src/):
+ *   - the module graph (nodes + edges)
+ *   - which modules transitively REACH a target module (reverse reachability)
+ *   - which of those are MOUNTABLE - i.e. named in package.json "exports", so a
+ *     consumer can import them directly and thereby pull the target in
+ *
+ * HOW EDGES ARE FOUND - and why this shape was chosen
+ * ---------------------------------------------------
+ * We do NOT pattern-match `require(...)`. Three real defects came from doing that:
+ *   1. QUOTE STYLE - a pattern written with "  misses '  (tsc emits either).
+ *   2. SIBLING PATHS - a pattern anchored on `./lib/` misses a plain `./auth`.
+ *   3. DYNAMIC IMPORT - `await import('x')`, and tsc's downlevel
+ *      `Promise.resolve().then(() => __importStar(require('x')))`, are not `require(` calls
+ *      in the shape a naive pattern expects.
+ * Instead: extract EVERY string literal (', ", and substitution-free `), and keep the ones
+ * that RESOLVE to a real file on disk. Keyword-agnostic and quote-agnostic by construction,
+ * so all three modes above are caught without enumerating them.
+ *
+ * THE HONESTY SIGNAL
+ * ------------------
+ * A relative specifier that does NOT resolve is counted as UNRESOLVED. Unresolved > 0 means
+ * the graph is incomplete and every count derived from it is a lower bound. The tool says so
+ * loudly rather than quietly under-reporting. Counts are reported over CALL SITES where
+ * relevant, never deduplicated to "files that mention it" - that conflation is its own defect.
+ *
+ * BOUND: this is a STATIC graph over emitted JS. It proves a module is REACHABLE, not that it
+ * is EXECUTED at runtime, and not that reaching it has any security consequence. Reachability
+ * is necessary for consequence, never sufficient. Do not quote this tool as proof of impact.
+ *
+ * USAGE
+ *   node scripts/module-reach.mjs --to server/auth
+ *   node scripts/module-reach.mjs --to server/auth --json
+ *   node scripts/module-reach.mjs --graph-only
+ *   node scripts/module-reach.mjs --to server/auth --pkg <dir>   (default: package root)
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+const CANDIDATE_EXTS = ['', '.js', '.mjs', '.cjs', '.json'];
+const INDEX_FILES = ['index.js', 'index.mjs', 'index.cjs'];
+
+/** Extract every string literal. Handles ' " and substitution-free `. Escape-aware. */
+export function extractStringLiterals(src) {
+  const out = [];
+  const n = src.length;
+  let i = 0;
+  while (i < n) {
+    const ch = src[i];
+    // skip line comments
+    if (ch === '/' && src[i + 1] === '/') {
+      while (i < n && src[i] !== '\n') i++;
+      continue;
+    }
+    // skip block comments
+    if (ch === '/' && src[i + 1] === '*') {
+      i += 2;
+      while (i < n && !(src[i] === '*' && src[i + 1] === '/')) i++;
+      i += 2;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === '`') {
+      const quote = ch;
+      let j = i + 1;
+      let buf = '';
+      let sawSubstitution = false;
+      while (j < n) {
+        const c = src[j];
+        if (c === '\\') { buf += src[j + 1] ?? ''; j += 2; continue; }
+        if (c === quote) break;
+        if (quote === '`' && c === '$' && src[j + 1] === '{') sawSubstitution = true;
+        if (quote !== '`' && (c === '\n' || c === '\r')) break; // unterminated
+        buf += c;
+        j++;
+      }
+      // A template literal WITH ${...} is not a static specifier - we cannot resolve it,
+      // and pretending otherwise would invent an edge. Dropped, and counted by the caller.
+      if (!sawSubstitution) out.push(buf);
+      i = j + 1;
+      continue;
+    }
+    i++;
+  }
+  return out;
+}
+
+/** Resolve a relative specifier from `fromFile` to a real file, or null. */
+export function resolveSpecifier(fromFile, spec, exists) {
+  const base = path.resolve(path.dirname(fromFile), spec);
+  for (const ext of CANDIDATE_EXTS) {
+    const cand = base + ext;
+    if (exists(cand)) return cand;
+  }
+  for (const idx of INDEX_FILES) {
+    const cand = path.join(base, idx);
+    if (exists(cand)) return cand;
+  }
+  return null;
+}
+
+const isRelative = (s) => s === '.' || s === '..' || s.startsWith('./') || s.startsWith('../');
+
+function walkJs(dir, acc = []) {
+  for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+    const p = path.join(dir, e.name);
+    if (e.isDirectory()) walkJs(p, acc);
+    else if (e.isFile() && /\.(js|mjs|cjs)$/.test(e.name)) acc.push(p);
+  }
+  return acc;
+}
+
+export function buildGraph(distDir, opts = {}) {
+  const readFile = opts.readFile || ((f) => fs.readFileSync(f, 'utf8'));
+  const exists = opts.exists || ((f) => { try { return fs.statSync(f).isFile(); } catch { return false; } });
+  const files = (opts.files || walkJs(distDir)).map((f) => path.resolve(f));
+
+  const rel = (f) => path.relative(distDir, f).split(path.sep).join('/');
+  const forward = new Map();   // module -> Set(module)
+  const reverse = new Map();   // module -> Set(module)
+  const unresolved = [];       // {from, spec} - CALL SITES, not deduped
+  let edgeSites = 0;
+  let externalSites = 0;
+  let dotValueSites = 0;
+
+  for (const f of files) { forward.set(rel(f), new Set()); reverse.set(rel(f), new Set()); }
+
+  for (const f of files) {
+    const from = rel(f);
+    for (const spec of extractStringLiterals(readFile(f))) {
+      if (!isRelative(spec)) {
+        // bare specifier: 'next/server', 'jose'. External to this package, not a defect.
+        if (/^[@a-zA-Z]/.test(spec) && !spec.includes(' ') && spec.length < 100) externalSites++;
+        continue;
+      }
+      const target = resolveSpecifier(f, spec, exists);
+      if (!target) {
+        // A LONE "." or ".." that does not resolve is the CHARACTER, not a specifier:
+        // verified in this dist - every occurrence is `token.split('.')`. `require('.')`
+        // is still legal, so we only discount it AFTER resolution has actually failed.
+        if (spec === '.' || spec === '..') { dotValueSites++; continue; }
+        unresolved.push({ from, spec });
+        continue;
+      }
+      const to = rel(target);
+      if (!forward.has(to)) continue; // resolved outside the scanned set
+      edgeSites++;
+      forward.get(from).add(to);
+      reverse.get(to).add(from);
+    }
+  }
+
+  let edgeCount = 0;
+  for (const s of forward.values()) edgeCount += s.size;
+
+  return { distDir, modules: [...forward.keys()].sort(), forward, reverse, unresolved, edgeCount, edgeSites, externalSites, dotValueSites };
+}
+
+/** Reverse-transitive closure: every module that can reach `target`. */
+export function reachers(graph, target) {
+  if (!graph.reverse.has(target)) return null;
+  const depth = new Map([[target, 0]]);
+  const queue = [target];
+  while (queue.length) {
+    const cur = queue.shift();
+    for (const prev of graph.reverse.get(cur) || []) {
+      if (!depth.has(prev)) { depth.set(prev, depth.get(cur) + 1); queue.push(prev); }
+    }
+  }
+  depth.delete(target);
+  return depth;
+}
+
+/** Every dist/*.js named as a target in package.json "exports". */
+export function exportTargets(pkgJson) {
+  const out = new Map(); // distRelPath -> Set(subpath)
+  const visit = (subpath, node) => {
+    if (typeof node === 'string') {
+      if (!node.endsWith('.js')) return;
+      // normalise './dist/lib/x.js' and './lib/x.js' (both appear) to 'lib/x.js'
+      let p = node.replace(/^\.\//, '');
+      p = p.replace(/^dist\//, '');
+      if (!out.has(p)) out.set(p, new Set());
+      out.get(p).add(subpath);
+      return;
+    }
+    if (node && typeof node === 'object') for (const v of Object.values(node)) visit(subpath, v);
+  };
+  for (const [subpath, node] of Object.entries(pkgJson.exports || {})) visit(subpath, node);
+  if (typeof pkgJson.main === 'string') visit('. (main)', './' + pkgJson.main);
+  return out;
+}
+
+function main(argv) {
+  const arg = (k) => { const i = argv.indexOf(k); return i >= 0 ? argv[i + 1] : undefined; };
+  const pkgDir = path.resolve(arg('--pkg') || path.join(path.dirname(new URL(import.meta.url).pathname.replace(/^\/([A-Za-z]:)/, '$1')), '..'));
+  const distDir = path.join(pkgDir, 'dist');
+  const json = argv.includes('--json');
+  const to = arg('--to');
+
+  if (!fs.existsSync(distDir)) {
+    console.error(`[module-reach] FATAL: no dist at ${distDir}. Run \`npm run build\` first.`);
+    console.error('[module-reach] Refusing to report a census over a tree that does not exist.');
+    process.exit(2);
+  }
+
+  const pkgJson = JSON.parse(fs.readFileSync(path.join(pkgDir, 'package.json'), 'utf8'));
+  const graph = buildGraph(distDir);
+  const exports_ = exportTargets(pkgJson);
+
+  const report = {
+    package: pkgJson.name, version: pkgJson.version, distDir,
+    modules: graph.modules.length, edges: graph.edgeCount, edgeSites: graph.edgeSites,
+    externalSites: graph.externalSites,
+    unresolvedSites: graph.unresolved.length,
+    exportSubpaths: Object.keys(pkgJson.exports || {}).length,
+    exportTargetFiles: exports_.size,
+  };
+
+  if (to) {
+    const candidates = [to, `${to}.js`, `${to}/index.js`].map((t) => t.replace(/^\.\//, ''));
+    const target = candidates.find((c) => graph.reverse.has(c));
+    if (!target) {
+      console.error(`[module-reach] FATAL: target not in dist graph: ${to}`);
+      console.error(`[module-reach] tried: ${candidates.join(', ')}`);
+      process.exit(2);
+    }
+    const depth = reachers(graph, target);
+    const all = [...depth.keys()].sort();
+    const direct = all.filter((m) => depth.get(m) === 1);
+    const mountable = all.filter((m) => exports_.has(m));
+    report.target = target;
+    report.directRequirers = direct.length;
+    report.reaching = all.length;
+    report.mountable = mountable.length;
+    report.targetIsItselfMountable = exports_.has(target);
+    report.directRequirerList = direct;
+    report.mountableList = mountable.map((m) => ({ module: m, subpaths: [...exports_.get(m)] }));
+  }
+
+  if (json) { console.log(JSON.stringify(report, null, 2)); return; }
+
+  console.log(`[module-reach] ${report.package}@${report.version}`);
+  console.log(`  dist modules ......... ${report.modules}`);
+  console.log(`  edges (unique) ....... ${report.edges}`);
+  console.log(`  edge call sites ...... ${report.edgeSites}`);
+  console.log(`  external specifiers .. ${report.externalSites}  (bare, outside this package)`);
+  console.log(`  export subpaths ...... ${report.exportSubpaths} -> ${report.exportTargetFiles} distinct dist files`);
+  if (report.unresolvedSites === 0) {
+    console.log(`  unresolved ........... 0  <- graph is complete; counts below are exact`);
+  } else {
+    console.log(`  unresolved ........... ${report.unresolvedSites}  *** GRAPH INCOMPLETE - ALL COUNTS BELOW ARE LOWER BOUNDS ***`);
+    for (const u of graph.unresolved.slice(0, 20)) console.log(`      ${u.from} -> ${u.spec}`);
+  }
+  if (report.target) {
+    console.log('');
+    console.log(`  TARGET: ${report.target}${report.targetIsItselfMountable ? '  (itself a public export)' : ''}`);
+    console.log(`  direct requirers ..... ${report.directRequirers}`);
+    console.log(`  transitively reaching  ${report.reaching}`);
+    console.log(`  ...of which MOUNTABLE  ${report.mountable}  <- consumer-reachable entry points`);
+    console.log('');
+    console.log('  BOUND: static reachability over emitted JS. Proves reachable, NOT executed,');
+    console.log('  and NOT that reaching it has any consequence. Do not quote as proof of impact.');
+  }
+}
+
+const invokedDirectly = process.argv[1] && import.meta.url.endsWith(path.basename(process.argv[1]));
+if (invokedDirectly) main(process.argv.slice(2));

package/src/api/auth-handler.ts

@@ -15,6 +15,7 @@
 
 import { NextRequest, NextResponse } from 'next/server';
 import { getSession as getBetterAuthSession } from '../server/auth';
+import { resolveAcrLevel, resolveAuthMethods } from '../lib/acr';
 import { nanoid } from 'nanoid';
 import {
   getSession,
@@ -244,10 +245,24 @@ export function createAuthHandler(options: AuthHandlerOptions = {}) {
         return { success: false, error: 'No refresh token' };
       }
 
-      // Extract authentication methods from session
-      const authMethods = (currentSession as any).authMethods ||
-                         ((currentSession as any).token?.amr ? JSON.parse((currentSession as any).token.amr) : ['pwd', 'mfa']);
-      const authLevel = String((currentSession as any).authenticationLevel || (currentSession as any).token?.acr || '2');
+      // Extract authentication methods from session.
+      //
+      // 375639: these two lines used to read
+      //     authMethods = ... : ['pwd', 'mfa']
+      //     authLevel   = String(... || ... || '2')
+      // so a session that knew NOTHING about how the user authenticated told
+      // the IDP that a second factor had happened AND named 'mfa' as the
+      // method. The two fabrications corroborated each other, so a downstream
+      // check cross-validating amr against acr would have accepted the pair.
+      // Absent is not satisfied; both now resolve fail-closed, in one place.
+      const authMethods = resolveAuthMethods(
+        (currentSession as any).authMethods,
+        (currentSession as any).token?.amr
+      );
+      const authLevel = resolveAcrLevel(
+        (currentSession as any).authenticationLevel,
+        (currentSession as any).token?.acr
+      );
       const twoFactorMethod = (currentSession as any).twoFactorMethod || 'authenticator';
 
       // Build refresh request body

package/src/api-handlers/mfa/totp-verify.ts

@@ -82,6 +82,10 @@ export async function POST(req: NextRequest) {
     // session. No tokens => no transition: we must not mark 2FA complete on the
     // strength of a 200 alone.
     let sessionTransitioned = false;
+    // R908(e): "we could not establish MFA" is a THIRD outcome, distinct from
+    // both success and failure. It must reach the client as a challenge, not as
+    // a silent success (fail-open) and not as a rejection (fail-closed).
+    let requiresChallenge = false;
 
     if (unwrappedData.access_token && unwrappedData.refresh_token) {
       const token = await getTokenTestAware(req);
@@ -104,7 +108,11 @@ export async function POST(req: NextRequest) {
           // Refresh token may carry no exp claim; default stands.
         }
 
-        await transitionTo2FASession(
+        // R908(e): the transition can now decline to grant. Read what was
+        // actually written instead of assuming the call granted - the store
+        // withholds mfaVerified when the stepped-up token carries no
+        // mfa_expires, and reports the re-challenge via nextStep.
+        const transitioned = await transitionTo2FASession(
           sessionToken,
           {
             accessToken: unwrappedData.access_token,
@@ -115,8 +123,18 @@ export async function POST(req: NextRequest) {
           'totp' // 2FA method, used by the refresh-token flow
         );
 
-        sessionTransitioned = true;
-        console.log('[VERIFY_TOTP] Session transitioned to 2FA-verified');
+        sessionTransitioned = transitioned?.mfaVerified === true;
+        requiresChallenge = transitioned?.nextStep === 'mfa_verify';
+
+        if (sessionTransitioned) {
+          console.log('[VERIFY_TOTP] Session transitioned to 2FA-verified');
+        } else {
+          console.warn(
+            '[VERIFY_TOTP] R908(e): IDP verified the code but the session was NOT ' +
+              'marked MFA-verified (no mfa_expires on the returned token). Reporting ' +
+              'requiresChallenge so the client re-challenges rather than proceeding.'
+          );
+        }
       } else {
         console.warn('[VERIFY_TOTP] IDP verified the code but no session token was resolvable — session NOT transitioned');
       }
@@ -138,6 +156,9 @@ export async function POST(req: NextRequest) {
         success: true,
         verificationSuccessful: true,
         twoFactorSessionVerified: sessionTransitioned,
+        // R908(e): tells the client to re-challenge. Present only when the code
+        // verified at the IDP but produced no evidence we could record.
+        ...(requiresChallenge ? { requiresChallenge: true, nextStep: 'mfa_verify' as const } : {}),
         message: unwrappedData.message || 'Authenticator code verified successfully',
       },
       { status: 200 }

package/src/api-handlers/session/refresh-viability.ts

@@ -21,14 +21,14 @@ export async function GET(req: NextRequest) {
       // Still need to get session data for twoFactorComplete even when refresh is in progress
       const sessionData = await getSession(finalSessionToken);
       logger.info('[REFRESH-VIABILITY] Refresh already in progress, telling middleware to wait', { sessionToken: finalSessionToken.substring(0, 8) + '...' });
-      return NextResponse.json({ canRefresh: true, reason: 'refresh_in_progress', refreshInProgress: true, sessionToken: finalSessionToken, twoFactorComplete: sessionData?.mfaVerified ?? (sessionData as any)?.twoFactorComplete ?? false }, { status: 200 });
+      return NextResponse.json({ canRefresh: true, reason: 'refresh_in_progress', refreshInProgress: true, sessionToken: finalSessionToken, twoFactorComplete: sessionData?.mfaVerified ?? false }, { status: 200 });
     }
     const sessionData = await getSession(finalSessionToken);
     if (!sessionData) {
       return NextResponse.json({ canRefresh: false, reason: 'session_not_found', sessionToken: finalSessionToken }, { status: 200 });
     }
     const viabilityCheck = checkRefreshViability(sessionData);
-    return NextResponse.json({ canRefresh: viabilityCheck.canRefresh, reason: viabilityCheck.reason, timeRemaining: viabilityCheck.timeRemaining, expiresAt: viabilityCheck.expiresAt, accessTokenExpired: viabilityCheck.accessTokenExpired, accessTokenTimeRemaining: viabilityCheck.accessTokenTimeRemaining, sessionToken: finalSessionToken, twoFactorComplete: sessionData.mfaVerified ?? (sessionData as any).twoFactorComplete ?? false, userId: sessionData.userId, refreshInProgress: false });
+    return NextResponse.json({ canRefresh: viabilityCheck.canRefresh, reason: viabilityCheck.reason, timeRemaining: viabilityCheck.timeRemaining, expiresAt: viabilityCheck.expiresAt, accessTokenExpired: viabilityCheck.accessTokenExpired, accessTokenTimeRemaining: viabilityCheck.accessTokenTimeRemaining, sessionToken: finalSessionToken, twoFactorComplete: sessionData.mfaVerified ?? false, userId: sessionData.userId, refreshInProgress: false });
   } catch (error) {
     logger.error('[REFRESH-VIABILITY] Error checking refresh viability', { error: error instanceof Error ? error.message : String(error) });
     return NextResponse.json({ canRefresh: false, reason: 'check_error', error: error instanceof Error ? error.message : String(error) }, { status: 500 });

package/src/api-handlers/session/viability.ts

@@ -119,7 +119,7 @@ export async function GET(req: NextRequest) {
         const mfaExpiresAt = sessionData.mfaExpiresAt || 0;
         const mfaExpired = mfaExpiresAt > 0 && mfaExpiresAt < Date.now();
         // Check both field names for compatibility (mfaVerified is the normalized name)
-        const sessionMfaComplete = sessionData.mfaVerified ?? (sessionData as any).twoFactorComplete ?? false;
+        const sessionMfaComplete = sessionData.mfaVerified ?? false;
         const effectiveTwoFactorComplete = sessionMfaComplete && !mfaExpired;
 
         console.log('[VIABILITY] Session 2FA check:', {

package/src/auth/auth-decision.ts

@@ -5,6 +5,8 @@
  * All auth flow logic is centralized here for testability and maintainability.
  */
 
+import { safeCallbackPath } from './safe-callback';
+
 // Input types for the decision engine
 export interface AuthContext {
   pathname: string;
@@ -45,8 +47,12 @@ export function makeAuthDecision(context: AuthContext): AuthAction {
     circuitBreakerOpen
   } = context;
 
-  // SAFEGUARD: Never use auth pages as callback URLs to prevent redirect loops
-  const safeCallbackUrl = pathname.startsWith('/account-auth/') ? '/' : pathname;
+  // SAFEGUARD: Never use auth pages as callback URLs to prevent redirect loops.
+  // 375656: `pathname` is our own request path rather than an attacker-supplied
+  // parameter, so this site was not the open redirect - but it is routed through
+  // the same guard so the package has ONE definition of an acceptable callback,
+  // and so the value is parser-normalised before being carried into a redirect.
+  const safeCallbackUrl = safeCallbackPath(pathname);
 
   // Public routes are allowed, but we need to check login page separately
   if (isPublicRoute && !isLoginPage) {
@@ -145,8 +151,17 @@ export function makeAuthDecision(context: AuthContext): AuthAction {
     // If user is on the login page, send them to verify-code with the original callback
     if (isLoginPage) {
       const callbackUrl = searchParams.get('callbackUrl') || '/';
-      // CRITICAL FIX: Never use auth pages as callback URLs
-      const safeCallbackUrl = callbackUrl.startsWith('/account-auth/') ? '/' : callbackUrl;
+      // 375656: this previously tested the raw parameter with a prefix check against
+      // the auth path, and returned the parameter itself when it did not match.
+      // (The vulnerable expression is deliberately NOT reproduced verbatim here: a
+      // comment carrying it puts the string into dist, and a reviewer grepping for
+      // that pattern would score this FIXED build as vulnerable - the exact
+      // sink-counting inversion recorded on 375936.)
+      // That is a redirect-LOOP guard in the seat where an ORIGIN check belongs:
+      // `https://evil.example.com` does not start with `/account-auth/`, so it passed
+      // through untouched. safeCallbackPath() asks the URL parser instead, so every
+      // spelling that escapes the origin fails one comparison. See ./safe-callback.
+      const safeCallbackUrl = safeCallbackPath(callbackUrl);
       console.log('[MIDDLEWARE-DECISION] On login page with 2FA incomplete, redirecting to verify-code', {
         originalCallback: callbackUrl,
         safeCallback: safeCallbackUrl,
@@ -193,8 +208,8 @@ export function makeAuthDecision(context: AuthContext): AuthAction {
     // For login page, redirect to 2FA with original callback
     if (isLoginPage) {
       const callbackUrl = searchParams.get('callbackUrl') || '/';
-      // CRITICAL FIX: Never use auth pages as callback URLs
-      const safeCallbackUrl = callbackUrl.startsWith('/account-auth/') ? '/' : callbackUrl;
+      // 375656: origin-checked, not prefix-checked. See ./safe-callback.
+      const safeCallbackUrl = safeCallbackPath(callbackUrl);
       return {
         type: 'redirect',
         location: `/account-auth/verify-code?callbackUrl=${encodeURIComponent(safeCallbackUrl)}`,
@@ -212,8 +227,13 @@ export function makeAuthDecision(context: AuthContext): AuthAction {
   // Authenticated user on login page - redirect to dashboard or callback
   if (isLoginPage) {
     const callbackUrl = searchParams.get('callbackUrl') || '/';
-    // CRITICAL FIX: Never redirect back to login page (prevents infinite loop)
-    const safeCallbackUrl = callbackUrl.startsWith('/account-auth/') ? '/' : callbackUrl;
+    // 375656 - THE PUBLISHED OPEN REDIRECT. This value becomes `location` VERBATIM
+    // below (not a query parameter on a relative path, as at the two sites above),
+    // so the old `startsWith('/account-auth/')` test sent an authenticated user
+    // straight to any absolute URL an attacker put in `?callbackUrl=`. Its own
+    // comment says "prevents infinite loop", which is what it was written for -
+    // loop prevention, never origin validation. See ./safe-callback.
+    const safeCallbackUrl = safeCallbackPath(callbackUrl);
     console.log('[MIDDLEWARE-DECISION] Authenticated user on login page, redirecting', {
       originalCallback: callbackUrl,
       safeCallback: safeCallbackUrl

package/src/auth/better-auth.ts

@@ -34,6 +34,26 @@ export function secretFingerprint(value: string): string {
   return createHash('sha256').update(value).digest('hex').slice(0, 12);
 }
 
+/**
+ * 273183: keys written onto the `ba:{slug}:{token}` record by an author OTHER
+ * than Better Auth, which must survive a Better Auth session write.
+ *
+ * Today this is exactly `idpTokens`, written by `storeIdpTokensInSession`. The
+ * list is a named constant rather than a hardcoded check because the shape of
+ * the bug is "a second author appeared and the adapter did not know" — the next
+ * enrichment key should be added here, not rediscovered as a strip.
+ */
+const PRESERVED_SESSION_KEYS = ['idpTokens'] as const;
+
+/**
+ * True for a JSON object we can safely merge into — not null, not an array.
+ * `typeof null === 'object'` and arrays are objects, and merging into either
+ * would corrupt the record rather than preserve it.
+ */
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
 /**
  * Better Auth social provider config shape.
  */
@@ -498,7 +518,114 @@ export function createBetterAuthInstance(
        */
       set: async (key: string, value: string, ttl?: number) => {
         const redis = getRedis();
-        await redis.setex(`ba:${appSlug}:${key}`, ttl ?? SESSION_TTL, value);
+        const redisKey = `ba:${appSlug}:${key}`;
+
+        /**
+         * 273183 — READ-MODIFY-WRITE, BECAUSE THIS RECORD HAS TWO AUTHORS.
+         * (Found by DotNetPert-Scout; handed over as Cluster-B root-cause
+         * evidence under BAPert's R920(a). Reproduced here before fixing.)
+         *
+         * Better Auth owns `{session, user}` and serialises exactly that. But
+         * `storeIdpTokensInSession` (below, ~:1010) ENRICHES the same key with
+         * `idpTokens` via its own read-modify-write. This setter did a blind
+         * `setex` of Better Auth's payload, so every write it makes — including
+         * each routine `updateAge` session rewrite, not merely an expiry —
+         * STRIPPED `idpTokens` back off the record.
+         *
+         * The consumer then falls back to an identity husk: `mfaVerified:false`,
+         * `roles:[]`. It fails CLOSED, so it is not a 369782-class bypass — but
+         * per BAPert it is a public-test blocker on its own terms, because a
+         * tester who trips the `updateAge` cadence gets a spurious 2FA re-prompt
+         * AND SILENTLY LOSES THEIR ROLES mid-session. That is a visible product
+         * failure regardless of which direction it fails in.
+         *
+         * WHY MERGE HERE RATHER THAN MOVE THE DATA. The enriching writer already
+         * does a read-modify-write; it was correct. The bug is that ONE of the
+         * two authors of this key wrote as though it were the only one. Fixing
+         * the adapter fixes it for every future enrichment key, whereas moving
+         * `idpTokens` elsewhere would leave the next one to rediscover this.
+         *
+         * ONLY keys in PRESERVED_KEYS are carried, and ONLY when the incoming
+         * payload does not set them — so Better Auth still wins on everything it
+         * owns, and an explicit incoming value is never overridden by a stale one.
+         *
+         * NOT ATOMIC, and deliberately not: an enrichment landing between this
+         * read and this write is still lost. Closing that needs a WATCH/MULTI or
+         * a Lua script, which is a larger change than tonight allows. This
+         * narrows the window from "every single write" to "a genuine race", and
+         * the residual is recorded here rather than left to be re-found.
+         */
+        let payload = value;
+        try {
+          const existingRaw = await redis.get(redisKey);
+          if (existingRaw) {
+            const existing = JSON.parse(existingRaw);
+            const incoming = JSON.parse(value);
+            if (isPlainObject(existing) && isPlainObject(incoming)) {
+              let carried = false;
+              for (const preserved of PRESERVED_SESSION_KEYS) {
+                if (preserved in existing && !(preserved in incoming)) {
+                  incoming[preserved] = existing[preserved];
+                  carried = true;
+                }
+              }
+              if (carried) payload = JSON.stringify(incoming);
+            }
+          }
+        } catch (mergeErr) {
+          /**
+           * This adapter also stores `verification:*` and `active-sessions-*`
+           * records, which are not necessarily session-shaped JSON. A record we
+           * cannot parse is not a session to enrich, so writing through unchanged
+           * is correct rather than merely tolerable.
+           *
+           * WARNED, NOT THROWN, and the asymmetry is the point: this block is an
+           * ENRICHMENT-PRESERVING read. Letting it fail the write would convert a
+           * degraded read into a lost session — the precise inversion 170033 fix 1
+           * above exists to prevent. The `setex` below is outside this try and is
+           * still unswallowed, so a genuine write failure still propagates.
+           */
+          console.warn(
+            `[BETTER_AUTH] secondaryStorage.set: could not preserve enrichment keys on ` +
+            `ba:${appSlug}:sha256:${secretFingerprint(key)} — writing Better Auth's payload ` +
+            `as-is. If this record held idpTokens they are now gone (273183):`,
+            mergeErr instanceof Error ? mergeErr.message : String(mergeErr)
+          );
+        }
+
+        /**
+         * QA 6952 / R913 - CLAMP, DO NOT DEFER.
+         *
+         * This was `ttl ?? SESSION_TTL`, which READS as "SESSION_TTL is the single
+         * source of session TTL" - what session-store.ts claims, and the mechanism
+         * by which the 7d-vs-3d zombie window was supposedly closed for good.
+         *
+         * IT WAS DEAD CODE. Better Auth ALWAYS supplies a ttl: every one of the
+         * eight secondaryStorage.set call sites in
+         * better-auth/dist/db/internal-adapter.mjs passes one explicitly (:36,
+         * :180, :189, :309, :320, :344, :553, :622). `??` fires only on
+         * null/undefined, so the fallback NEVER RAN. Every `ba:` record took Better
+         * Auth's 7d default - `session.expiresIn` is not configured in this file -
+         * while the canonical store stayed at SESSION_TTL (3d). That 4-day drift IS
+         * the zombie window the constant exists to prevent: the guard was bypassed
+         * by the very parameter written to defer to it.
+         *
+         * `Math.min`, NOT a hard SESSION_TTL: this same adapter also stores
+         * `verification:*` (:553, :622) and `active-sessions-*` (:180, :320, :344)
+         * records whose TTLs are legitimately SHORTER than 3d. Overwriting those
+         * would EXTEND them - turning a fix for over-long sessions into a bug that
+         * keeps verification codes alive for three days. Clamp DOWN, never up.
+         *
+         * Clamped down to 3d rather than raising the canonical store to 7d because
+         * SESSION_TTL matches the IDP refresh-token lifetime: a session outliving
+         * the refresh token sustaining it cannot be refreshed, so the extra days are
+         * a husk that reads as authenticated. Fail-closed beats ambiguous.
+         *
+         * DO NOT "fix" this by making storeIdpTokensInSession preserve Better
+         * Auth's 7d. That deletes the last remnant of QA 6952 and makes the drift
+         * universal. See test/ba-session-ttl-clamp.test.cjs.
+         */
+        await redis.setex(redisKey, Math.min(ttl ?? SESSION_TTL, SESSION_TTL), payload);
       },
       delete: async (key: string) => {
         try {