@payez/next-mvp 4.4.1 → 4.4.3

package/src/server/auth-guard.ts

@@ -127,7 +127,33 @@ export async function authGuard(options?: AuthGuardOptions): Promise<AuthGuardRe
   }
 
   if (requires2FA) {
-    const mfaVerified = sessionData.mfaVerified ?? (sessionData as any).twoFactorComplete ?? false;
+    // 369858: the legacy `?? (sessionData as any).twoFactorComplete` carry is REMOVED.
+    // This is THE access gate - the only one of the 8 carry sites that grants access
+    // rather than reporting status - so it reads exactly one source of truth.
+    //
+    // Removing it is fail-closed. No current writer emits the legacy field alone:
+    // session-store.ts:444-445 writes both as a pair from a server-derived stepped-up
+    // token, auth/refresh.ts:376 writes it as a MIRROR of mfaVerified, and
+    // routes/auth/session.ts:149-157 refuses both on PRESENCE, so a caller cannot
+    // assert either. The carry therefore only ever served sessions minted before
+    // `mfaVerified` existed, and for those the correct behaviour is re-verify, not
+    // grandfather. Cost is one forced re-challenge for a stale legacy session.
+    //
+    // Severity note, so nobody re-inflates this later: the operator was `??`
+    // (nullish), NOT `||`. `false ?? x` is `false`, so an explicitly DENIED session
+    // could never be upgraded by a stale flag. This was legacy grandfathering, not a
+    // live 2FA bypass. Had it been `||`, it would have been the bypass.
+    const mfaVerified = sessionData.mfaVerified ?? false;
+
+    // 339563 / 369858 §3: THIS IS STILL A FAIL-OPEN AND IS DELIBERATELY LEFT VISIBLE.
+    // An absent mfaExpiresAt collapses to 0, so `mfaExpired` is false and the MFA
+    // verdict NEVER EXPIRES. That needs no legacy-session hypothesis: it fires on a
+    // current `mfaVerified: true` session whose token carried no `mfa_expires` claim -
+    // the passwordless/primary-credential lane, named on the write path in the
+    // source's own voice at session-store.ts:464-467 ("it IS the case the consumers
+    // currently fail OPEN on"). Removing the carry above does NOT touch this.
+    // Tracked separately by BAPert; not fixed here because failing closed on absent
+    // expiry would deny the passwordless lane outright and that is a product call.
     const mfaExpiresAt = sessionData.mfaExpiresAt || 0;
     const mfaExpired = mfaExpiresAt > 0 && mfaExpiresAt < Date.now();
 

package/dist/middleware/auth-decision.d.ts

@@ -1,33 +0,0 @@
-export interface AuthContext {
-    pathname: string;
-    isPublicRoute: boolean;
-    isLoginPage: boolean;
-    searchParams: URLSearchParams;
-    sessionPointer: {
-        exists: boolean;
-        sessionToken?: string;
-        expired?: boolean;
-        hasRefreshToken?: boolean;
-    };
-    sessionStatus: {
-        exists: boolean | null;
-        forceInvalid: boolean | null;
-        requires2FA: boolean;
-        twoFactorComplete: boolean;
-    };
-    circuitBreakerOpen: boolean;
-}
-export type AuthAction = {
-    type: 'allow';
-} | {
-    type: 'redirect';
-    location: string;
-    reason: string;
-    clearCookies?: boolean;
-} | {
-    type: 'service_error';
-    reason: string;
-};
-export declare function makeAuthDecision(context: AuthContext): AuthAction;
-export declare function isLoginPage(pathname: string): boolean;
-export declare function getCallbackUrl(pathname: string, searchParams: URLSearchParams): string;

package/dist/middleware/auth-decision.js

@@ -1,65 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.makeAuthDecision = makeAuthDecision;
-exports.isLoginPage = isLoginPage;
-exports.getCallbackUrl = getCallbackUrl;
-function makeAuthDecision(context) {
-    const { pathname, isPublicRoute, isLoginPage, searchParams, sessionPointer, sessionStatus, circuitBreakerOpen } = context;
-    // SAFEGUARD: Never use auth pages as callback URLs to prevent redirect loops
-    const safeCallbackUrl = pathname.startsWith('/account-auth/') ? '/' : pathname;
-    if (isPublicRoute && !isLoginPage)
-        return { type: 'allow' };
-    if (circuitBreakerOpen) {
-        if (isLoginPage)
-            return { type: 'allow' };
-        return { type: 'redirect', location: '/account-auth/login?error=ServiceUnavailable&reason=CircuitBreakerOpen', reason: 'CircuitBreakerOpen', clearCookies: true };
-    }
-    if (!sessionPointer.exists) {
-        if (isLoginPage)
-            return { type: 'allow' };
-        if (pathname === '/') {
-            const unauthUrl = process.env.UNAUTHENTICATED_REDIRECT_URL || '/account-auth/login';
-            return { type: 'redirect', location: unauthUrl, reason: 'unauthenticated_root_redirect' };
-        }
-        return { type: 'redirect', location: `/account-auth/login?callbackUrl=${encodeURIComponent(safeCallbackUrl)}`, reason: 'no_session_pointer' };
-    }
-    if (sessionStatus.exists === null || sessionStatus.forceInvalid === null)
-        return { type: 'service_error', reason: 'redis_unavailable' };
-    if (sessionStatus.forceInvalid) {
-        if (isLoginPage)
-            return { type: 'allow' };
-        return { type: 'redirect', location: `/account-auth/login?callbackUrl=${encodeURIComponent(safeCallbackUrl)}&reason=force_invalidated`, reason: 'force_invalidated' };
-    }
-    if (!sessionStatus.exists) {
-        if (isLoginPage)
-            return { type: 'allow' };
-        return { type: 'redirect', location: `/account-auth/login?callbackUrl=${encodeURIComponent(safeCallbackUrl)}&reason=stale_session`, reason: 'stale_session' };
-    }
-    if (sessionStatus.requires2FA && !sessionStatus.twoFactorComplete) {
-        if (pathname === '/account-auth/verify-code')
-            return { type: 'allow' };
-        if (isLoginPage) {
-            const callbackUrl = searchParams.get('callbackUrl') || '/';
-            const safeCallbackUrl2 = callbackUrl.startsWith('/account-auth/') ? '/' : callbackUrl;
-            return { type: 'redirect', location: `/account-auth/verify-code?callbackUrl=${encodeURIComponent(safeCallbackUrl2)}`, reason: '2fa_required_login_redirect' };
-        }
-        return { type: 'redirect', location: `/account-auth/verify-code?callbackUrl=${encodeURIComponent(safeCallbackUrl)}`, reason: '2fa_required' };
-    }
-    if (sessionPointer.expired) {
-        if (isLoginPage)
-            return { type: 'allow' };
-        return { type: 'redirect', location: `/account-auth/login?callbackUrl=${encodeURIComponent(safeCallbackUrl)}&error=SessionExpired`, reason: 'token_expired' };
-    }
-    if (pathname === '/')
-        return { type: 'redirect', location: '/', reason: 'authenticated_root_redirect' };
-    if (isLoginPage) {
-        const callbackUrl = searchParams.get('callbackUrl') || '/';
-        const safeCallbackUrl = callbackUrl.startsWith('/account-auth/') ? '/' : callbackUrl;
-        return { type: 'redirect', location: safeCallbackUrl, reason: 'already_authenticated' };
-    }
-    return { type: 'allow' };
-}
-function isLoginPage(pathname) { return pathname === '/account-auth/login'; }
-function getCallbackUrl(pathname, searchParams) { if (pathname.startsWith('/account-auth/'))
-    return '/'; const existingCallback = searchParams.get('callbackUrl'); if (existingCallback && !existingCallback.startsWith('/account-auth/'))
-    return existingCallback; return pathname; }

package/src/middleware/auth-decision.ts

@@ -1,43 +0,0 @@
-/**
- * Auth Decision Engine (lifted)
- */
-import { NextRequest } from 'next/server';
-
-export interface AuthContext {
-  pathname: string;
-  isPublicRoute: boolean;
-  isLoginPage: boolean;
-  searchParams: URLSearchParams;
-  sessionPointer: { exists: boolean; sessionToken?: string; expired?: boolean; hasRefreshToken?: boolean; };
-  sessionStatus: { exists: boolean | null; forceInvalid: boolean | null; requires2FA: boolean; twoFactorComplete: boolean; };
-  circuitBreakerOpen: boolean;
-}
-
-export type AuthAction = 
-  | { type: 'allow' }
-  | { type: 'redirect'; location: string; reason: string; clearCookies?: boolean }
-  | { type: 'service_error'; reason: string };
-
-export function makeAuthDecision(context: AuthContext): AuthAction {
-  const { pathname, isPublicRoute, isLoginPage, searchParams, sessionPointer, sessionStatus, circuitBreakerOpen } = context;
-  // SAFEGUARD: Never use auth pages as callback URLs to prevent redirect loops
-  const safeCallbackUrl = pathname.startsWith('/account-auth/') ? '/' : pathname;
-  if (isPublicRoute && !isLoginPage) return { type: 'allow' };
-  if (circuitBreakerOpen) { if (isLoginPage) return { type: 'allow' }; return { type: 'redirect', location: '/account-auth/login?error=ServiceUnavailable&reason=CircuitBreakerOpen', reason: 'CircuitBreakerOpen', clearCookies: true }; }
-  if (!sessionPointer.exists) { if (isLoginPage) return { type: 'allow' }; if (pathname === '/') { const unauthUrl = process.env.UNAUTHENTICATED_REDIRECT_URL || '/account-auth/login'; return { type: 'redirect', location: unauthUrl, reason: 'unauthenticated_root_redirect' }; } return { type: 'redirect', location: `/account-auth/login?callbackUrl=${encodeURIComponent(safeCallbackUrl)}`, reason: 'no_session_pointer' }; }
-  if (sessionStatus.exists === null || sessionStatus.forceInvalid === null) return { type: 'service_error', reason: 'redis_unavailable' };
-  if (sessionStatus.forceInvalid) { if (isLoginPage) return { type: 'allow' }; return { type: 'redirect', location: `/account-auth/login?callbackUrl=${encodeURIComponent(safeCallbackUrl)}&reason=force_invalidated`, reason: 'force_invalidated' }; }
-  if (!sessionStatus.exists) { if (isLoginPage) return { type: 'allow' }; return { type: 'redirect', location: `/account-auth/login?callbackUrl=${encodeURIComponent(safeCallbackUrl)}&reason=stale_session`, reason: 'stale_session' }; }
-  if (sessionStatus.requires2FA && !sessionStatus.twoFactorComplete) {
-    if (pathname === '/account-auth/verify-code') return { type: 'allow' };
-    if (isLoginPage) { const callbackUrl = searchParams.get('callbackUrl') || '/'; const safeCallbackUrl2 = callbackUrl.startsWith('/account-auth/') ? '/' : callbackUrl; return { type: 'redirect', location: `/account-auth/verify-code?callbackUrl=${encodeURIComponent(safeCallbackUrl2)}`, reason: '2fa_required_login_redirect' }; }
-    return { type: 'redirect', location: `/account-auth/verify-code?callbackUrl=${encodeURIComponent(safeCallbackUrl)}`, reason: '2fa_required' };
-  }
-  if (sessionPointer.expired) { if (isLoginPage) return { type: 'allow' }; return { type: 'redirect', location: `/account-auth/login?callbackUrl=${encodeURIComponent(safeCallbackUrl)}&error=SessionExpired`, reason: 'token_expired' }; }
-  if (pathname === '/') return { type: 'redirect', location: '/', reason: 'authenticated_root_redirect' };
-  if (isLoginPage) { const callbackUrl = searchParams.get('callbackUrl') || '/'; const safeCallbackUrl = callbackUrl.startsWith('/account-auth/') ? '/' : callbackUrl; return { type: 'redirect', location: safeCallbackUrl, reason: 'already_authenticated' }; }
-  return { type: 'allow' };
-}
-
-export function isLoginPage(pathname: string): boolean { return pathname === '/account-auth/login'; }
-export function getCallbackUrl(pathname: string, searchParams: URLSearchParams): string { if (pathname.startsWith('/account-auth/')) return '/'; const existingCallback = searchParams.get('callbackUrl'); if (existingCallback && !existingCallback.startsWith('/account-auth/')) return existingCallback; return pathname; }