@payez/next-mvp 4.4.4 → 4.4.5

package/dist/auth/better-auth.js

@@ -1256,7 +1256,26 @@ function createAuthGetHandler(loginPath = '/account-auth/login') {
                     return new Response(null, { status: 302, headers: { location: loginPath } });
                 }
             }
-            // After successful OAuth callback: exchange Google identity for IDP tokens
+            // After successful OAuth callback: exchange the PROVIDER identity for IDP tokens.
+            //
+            // ⚠ WAS "exchange Google identity" — and it meant it literally. This call
+            // site passed no provider, so it took exchangeOAuthForIdpTokens's
+            // `provider: string = 'google'` default and asserted "google" to
+            // /api/ExternalAuth/oauth-callback for EVERY provider. That was harmless
+            // while Google was the only one wired, and became wrong the moment a second
+            // provider shipped: a GitHub sign-in forwarded a GitHub access_token
+            // labelled `provider: 'google'`, so the IDP tried to verify it as a Google
+            // identity and fail-closed with 401 UNVERIFIED_ASSERTION in
+            // `response_time_ms: 0` — it never had to call anyone to know it was wrong.
+            //
+            // The diagnostics made this maximally confusing: `access_token_forwarded:
+            // true` is correct and the token really did arrive. The FIELD was fine; the
+            // LABEL on it was a lie. Nothing on the client half is broken.
+            //
+            // The provider was never unavailable — it is the path segment this very
+            // `if` matches on (/api/auth/callback/github). Derive it instead of
+            // defaulting, because a default here cannot be right for more than one
+            // provider at a time.
             const url = new URL(request.url);
             if (url.pathname.includes('/callback/') && response.status === 302) {
                 try {
@@ -1270,8 +1289,23 @@ function createAuthGetHandler(loginPath = '/account-auth/login') {
                         headers.set('cookie', cookieHeader);
                         const session = await auth.api.getSession({ headers });
                         if (session?.session?.token) {
-                            console.log('[BETTER_AUTH] Got session token from callback:', session.session.token.substring(0, 10), '| email:', session.user?.email);
-                            await exchangeOAuthForIdpTokens(session.session.token);
+                            // /api/auth/callback/<provider>[?query] -> "<provider>"
+                            const callbackProvider = url.pathname
+                                .split('/callback/')[1]
+                                ?.split('/')[0]
+                                ?.split('?')[0]
+                                ?.trim()
+                                .toLowerCase() || '';
+                            if (!callbackProvider) {
+                                // Do NOT quietly fall back to 'google'. That silent default is the
+                                // exact defect this block fixes, and re-introducing it here would
+                                // reproduce it for whatever unparseable shape got us here.
+                                console.error('[BETTER_AUTH] OAuth callback matched /callback/ but no provider could be derived from', url.pathname, '— refusing to assert a guessed provider to the IDP. No exchange performed.');
+                            }
+                            else {
+                                console.log('[BETTER_AUTH] Got session token from callback:', session.session.token.substring(0, 10), '| provider:', callbackProvider, '| email:', session.user?.email);
+                                await exchangeOAuthForIdpTokens(session.session.token, callbackProvider);
+                            }
                         }
                         else {
                             console.warn('[BETTER_AUTH] Could not get session after OAuth callback');

package/dist/lib/idp-client-config.js

@@ -673,7 +673,37 @@ async function fetchConfigFromIDP(idpUrl, clientIdStr) {
                 'X-Client-Id': clientIdStr,
                 'X-Correlation-Id': (0, crypto_1.randomUUID)().replace(/-/g, ''),
             },
-            body: JSON.stringify({ client_assertion }),
+            // 217917 PHASE 1: explicit opt-in for provider secrets.
+            //
+            // This broker is the ONLY consumer of oauth_providers[].client_secret
+            // (DotNetPert enumerated it: this file feeds auth/providers/oauth.ts,
+            // which performs the server-side code exchange). Every OTHER caller of
+            // ExternalAuth/client-config - notably every fielded acp-desktop - is
+            // pushed the same secrets today and reads none of them: the desktop is
+            // PKCE and dropped clientSecret from OAuthProviderConfig entirely.
+            //
+            // The IDP IGNORES this field today, so shipping it is a no-op and needs
+            // no coordination window. Phase 2 (DotNetPert, IDP side) makes
+            // client-config emit the secrets ONLY when the opt-in is present and
+            // redact otherwise - which is why phase 1 MUST be live first, or the
+            // broker loses the field and tenant OAuth sign-in dies.
+            //
+            // SCOPE, deliberately narrow - do NOT read this as a partial migration:
+            // the sibling path fetchConfigFromInternalIDP() hits a DIFFERENT
+            // endpoint (InternalClientConfig/{id}, GET) that is already
+            // authenticated with CONTAINERS_KEY, is not reachable by a desktop, and
+            // is therefore not part of 217917's exposure. It deliberately sends no
+            // opt-in. If phase 2's redaction is implemented in shared config-
+            // assembly code rather than in ExternalAuthController.GetClientConfig,
+            // it will ALSO strip the internal route and break this broker's other
+            // path with no opt-in to save it. Phase 2 must gate on the request.
+            //
+            // NOT A FIX ON ITS OWN: an attacker can set this flag too. Phase 2 ends
+            // the AUTOMATIC delivery of every tenant's provider secrets to every
+            // user laptop; it does not close disclosure to a determined caller.
+            // That residual is card 175047 (unauthenticated mint, global partner
+            // key) and 217917 does not close until 175047 lands or Jon accepts it.
+            body: JSON.stringify({ client_assertion, include_provider_secrets: true }),
             cache: 'no-store'
         });
         if (!configResp.ok) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "4.4.4",
+  "version": "4.4.5",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/auth/better-auth.ts

@@ -1383,7 +1383,26 @@ export function createAuthGetHandler(loginPath: string = '/account-auth/login')
       }
     }
 
-    // After successful OAuth callback: exchange Google identity for IDP tokens
+    // After successful OAuth callback: exchange the PROVIDER identity for IDP tokens.
+    //
+    // ⚠ WAS "exchange Google identity" — and it meant it literally. This call
+    // site passed no provider, so it took exchangeOAuthForIdpTokens's
+    // `provider: string = 'google'` default and asserted "google" to
+    // /api/ExternalAuth/oauth-callback for EVERY provider. That was harmless
+    // while Google was the only one wired, and became wrong the moment a second
+    // provider shipped: a GitHub sign-in forwarded a GitHub access_token
+    // labelled `provider: 'google'`, so the IDP tried to verify it as a Google
+    // identity and fail-closed with 401 UNVERIFIED_ASSERTION in
+    // `response_time_ms: 0` — it never had to call anyone to know it was wrong.
+    //
+    // The diagnostics made this maximally confusing: `access_token_forwarded:
+    // true` is correct and the token really did arrive. The FIELD was fine; the
+    // LABEL on it was a lie. Nothing on the client half is broken.
+    //
+    // The provider was never unavailable — it is the path segment this very
+    // `if` matches on (/api/auth/callback/github). Derive it instead of
+    // defaulting, because a default here cannot be right for more than one
+    // provider at a time.
     const url = new URL(request.url);
     if (url.pathname.includes('/callback/') && response.status === 302) {
       try {
@@ -1399,8 +1418,32 @@ export function createAuthGetHandler(loginPath: string = '/account-auth/login')
 
           const session = await auth.api.getSession({ headers });
           if (session?.session?.token) {
-            console.log('[BETTER_AUTH] Got session token from callback:', session.session.token.substring(0, 10), '| email:', session.user?.email);
-            await exchangeOAuthForIdpTokens(session.session.token);
+            // /api/auth/callback/<provider>[?query] -> "<provider>"
+            const callbackProvider = url.pathname
+              .split('/callback/')[1]
+              ?.split('/')[0]
+              ?.split('?')[0]
+              ?.trim()
+              .toLowerCase() || '';
+
+            if (!callbackProvider) {
+              // Do NOT quietly fall back to 'google'. That silent default is the
+              // exact defect this block fixes, and re-introducing it here would
+              // reproduce it for whatever unparseable shape got us here.
+              console.error(
+                '[BETTER_AUTH] OAuth callback matched /callback/ but no provider could be derived from',
+                url.pathname,
+                '— refusing to assert a guessed provider to the IDP. No exchange performed.'
+              );
+            } else {
+              console.log(
+                '[BETTER_AUTH] Got session token from callback:',
+                session.session.token.substring(0, 10),
+                '| provider:', callbackProvider,
+                '| email:', session.user?.email
+              );
+              await exchangeOAuthForIdpTokens(session.session.token, callbackProvider);
+            }
           } else {
             console.warn('[BETTER_AUTH] Could not get session after OAuth callback');
           }

package/src/lib/idp-client-config.ts

@@ -783,7 +783,37 @@ async function fetchConfigFromIDP(idpUrl: string, clientIdStr: string): Promise<
             'X-Client-Id': clientIdStr,
             'X-Correlation-Id': randomUUID().replace(/-/g, ''),
         },
-        body: JSON.stringify({ client_assertion }),
+        // 217917 PHASE 1: explicit opt-in for provider secrets.
+        //
+        // This broker is the ONLY consumer of oauth_providers[].client_secret
+        // (DotNetPert enumerated it: this file feeds auth/providers/oauth.ts,
+        // which performs the server-side code exchange). Every OTHER caller of
+        // ExternalAuth/client-config - notably every fielded acp-desktop - is
+        // pushed the same secrets today and reads none of them: the desktop is
+        // PKCE and dropped clientSecret from OAuthProviderConfig entirely.
+        //
+        // The IDP IGNORES this field today, so shipping it is a no-op and needs
+        // no coordination window. Phase 2 (DotNetPert, IDP side) makes
+        // client-config emit the secrets ONLY when the opt-in is present and
+        // redact otherwise - which is why phase 1 MUST be live first, or the
+        // broker loses the field and tenant OAuth sign-in dies.
+        //
+        // SCOPE, deliberately narrow - do NOT read this as a partial migration:
+        // the sibling path fetchConfigFromInternalIDP() hits a DIFFERENT
+        // endpoint (InternalClientConfig/{id}, GET) that is already
+        // authenticated with CONTAINERS_KEY, is not reachable by a desktop, and
+        // is therefore not part of 217917's exposure. It deliberately sends no
+        // opt-in. If phase 2's redaction is implemented in shared config-
+        // assembly code rather than in ExternalAuthController.GetClientConfig,
+        // it will ALSO strip the internal route and break this broker's other
+        // path with no opt-in to save it. Phase 2 must gate on the request.
+        //
+        // NOT A FIX ON ITS OWN: an attacker can set this flag too. Phase 2 ends
+        // the AUTOMATIC delivery of every tenant's provider secrets to every
+        // user laptop; it does not close disclosure to a determined caller.
+        // That residual is card 175047 (unauthenticated mint, global partner
+        // key) and 217917 does not close until 175047 lands or Jon accepts it.
+        body: JSON.stringify({ client_assertion, include_provider_secrets: true }),
         cache: 'no-store'
     } as RequestInit);