@payez/next-mvp 4.4.4 → 4.4.6

package/src/api-handlers/account/recovery/send-code.ts

@@ -1,107 +1,21 @@
-import { NextRequest, NextResponse } from 'next/server';
-import { idpFetchJSON } from '../../../lib/idp-fetch';
-import { ENV_CONFIG } from '../../../config/env';
-import { getIDPClientConfig } from '../../../lib/idp-client-config';
-import { resolveClientKey } from '../../../lib/client-key';
+import { NextRequest } from 'next/server';
+import { forwardRecoveryCall } from './forward';
 
 /**
- * Account recovery — send-code
+ * Account recovery - send-code.
  *
- * WHY THIS WAS REWRITTEN (2026-08-02, swept out of QAPert defect #7)
- * This handler read the caller's bearer straight off the inbound request:
- *
- *     const auth  = req.headers.get('authorization') || '';
- *     const token = auth.startsWith('Bearer ') ? auth.slice(7) : '';
- *     ... headers: { 'Authorization': `Bearer ${token}` }
- *
- * Browsers send a session COOKIE and no Authorization header, so `token` was
- * ALWAYS the empty string and this always called the IDP with a literal
- * "Bearer " and nothing after it.
- *
- * THAT IS WORSE THAN THE profile.ts VERSION OF THIS BUG, in two ways:
- *
- *   1. profile.ts at least 401'd when the header was missing. This one has no
- *      check at all — `|| ''` swallows the absence — so it proceeds to call
- *      upstream with an empty credential and returns the IDP's rejection as an
- *      opaque failure. The user sees recovery "not working", not "not
- *      authenticated", and the log shows an upstream error rather than an auth
- *      one. The defect hides itself.
- *   2. It is BOTH HALVES of account recovery — send-code and verify-code — so
- *      the entire recovery path is unreachable, not merely degraded. This is
- *      the flow a locked-out user reaches for, i.e. it fails exactly when it is
- *      the only thing left that could help them.
- *
- * Fixed the same way as profile.ts and masked-info.ts: idpFetchJSON resolves
- * the caller's token from the server-side session, so the cookie works and the
- * token is never handed to browser JavaScript.
+ * PAY-1588: the recovery session token minted by `initiate` is the caller's only credential (they are locked out; there is
+ * no session), so this forwards the inbound `Authorization: Bearer <token>` to the IdP and fails loud (401
+ * `missing_recovery_token`) when it is absent. The whole reasoning, and why the 2026-08-02 idpFetchJSON rewrite killed
+ * this flow, is in ./forward.ts. send-code and verify-code share that ONE forwarder so they cannot drift apart again.
  *
  * @package @payez/next-mvp
  */
-
-/**
- * RECOVERY CLIENT KEY — cards 268012 (S12) and 268410.
- *
- * These four proxies populated NONE of PayEzClientIdResolver's six slots, so
- * RequirePayEzUnAuthorized 404'd the request BEFORE the action ran and no
- * recovery token was ever minted. That is why S12 failed at step 1.
- *
- * NOT `ENV_CONFIG.CLIENT_ID`, which is what card 268012 originally prescribed.
- * That variable is the ENVIRONMENT-SPECIFIC NUMERIC id, and the IDP accepts a
- * numeric with NO existence check (RequirePayEzUnAuthorizedAttribute.cs:31-33)
- * while it VALIDATES a slug (:41-47). Hardcoding the numeric here would have
- * added four more sites to the 268410 family and made a stale id answer for
- * the WRONG TENANT on a password-reset path, silently. Slug-preferring, with
- * the numeric fallback logged, is the same resolver the other nine sites use.
- *
- * SERVER VALUE WINS: client_id is applied AFTER the caller's payload spread.
- * These are unauthenticated recovery endpoints, so a browser-supplied
- * client_id would be a tenant-targeting lever. The caller does not get to
- * choose which tenant their password reset is addressed to.
- */
-async function recoveryClientKey(): Promise<string | null> {
-  try {
-    const config = await getIDPClientConfig();
-    return resolveClientKey(config, 'account/recovery/send-code').key;
-  } catch (e) {
-    console.error('[account/recovery/send-code] could not resolve IDP client config for client_id:', e);
-    return null;
-  }
-}
-
 export async function POST(req: NextRequest) {
-  let payload: unknown = {};
-  try {
-    payload = await req.json();
-  } catch {
-    return NextResponse.json(
-      { success: false, error: 'invalid_request', message: 'A JSON body is required' },
-      { status: 400 }
-    );
-  }
-
-  const clientKey = await recoveryClientKey();
-
-  const result = await idpFetchJSON(
-    req,
-    `${ENV_CONFIG.IDP_URL}/api/Account/recovery/send-code`,
-    {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', ...(clientKey ? { 'X-Client-Id': clientKey } : {}) },
-      body: JSON.stringify({ ...(payload as Record<string, unknown>), ...(clientKey ? { client_id: clientKey } : {}) }),
-    }
-  );
-
-  if (!result.ok) {
-    return NextResponse.json(
-      {
-        success: false,
-        error: 'send_code_failed',
-        message: result.json?.message || 'Upstream error',
-        meta: { status: result.status, attemptedRefresh: result.attemptedRefresh },
-      },
-      { status: result.status }
-    );
-  }
-
-  return NextResponse.json(result.json, { status: 200 });
+  return forwardRecoveryCall(req, {
+    upstreamPath: '/api/Account/recovery/send-code',
+    where: 'account/recovery/send-code',
+    failureCode: 'send_code_failed',
+    fallbackMessage: 'Failed to send the verification code',
+  });
 }

package/src/api-handlers/account/recovery/verify-code.ts

@@ -1,107 +1,20 @@
-import { NextRequest, NextResponse } from 'next/server';
-import { idpFetchJSON } from '../../../lib/idp-fetch';
-import { ENV_CONFIG } from '../../../config/env';
-import { getIDPClientConfig } from '../../../lib/idp-client-config';
-import { resolveClientKey } from '../../../lib/client-key';
+import { NextRequest } from 'next/server';
+import { forwardRecoveryCall } from './forward';
 
 /**
- * Account recovery — verify-code
+ * Account recovery - verify-code.
  *
- * WHY THIS WAS REWRITTEN (2026-08-02, swept out of QAPert defect #7)
- * This handler read the caller's bearer straight off the inbound request:
- *
- *     const auth  = req.headers.get('authorization') || '';
- *     const token = auth.startsWith('Bearer ') ? auth.slice(7) : '';
- *     ... headers: { 'Authorization': `Bearer ${token}` }
- *
- * Browsers send a session COOKIE and no Authorization header, so `token` was
- * ALWAYS the empty string and this always called the IDP with a literal
- * "Bearer " and nothing after it.
- *
- * THAT IS WORSE THAN THE profile.ts VERSION OF THIS BUG, in two ways:
- *
- *   1. profile.ts at least 401'd when the header was missing. This one has no
- *      check at all — `|| ''` swallows the absence — so it proceeds to call
- *      upstream with an empty credential and returns the IDP's rejection as an
- *      opaque failure. The user sees recovery "not working", not "not
- *      authenticated", and the log shows an upstream error rather than an auth
- *      one. The defect hides itself.
- *   2. It is BOTH HALVES of account recovery — send-code and verify-code — so
- *      the entire recovery path is unreachable, not merely degraded. This is
- *      the flow a locked-out user reaches for, i.e. it fails exactly when it is
- *      the only thing left that could help them.
- *
- * Fixed the same way as profile.ts and masked-info.ts: idpFetchJSON resolves
- * the caller's token from the server-side session, so the cookie works and the
- * token is never handed to browser JavaScript.
+ * PAY-1588: forwards the inbound recovery `Authorization: Bearer <token>` to the IdP and fails loud (401
+ * `missing_recovery_token`) when it is absent. See ./forward.ts for the full reasoning; send-code and verify-code share
+ * that ONE forwarder so they cannot drift apart again.
  *
  * @package @payez/next-mvp
  */
-
-/**
- * RECOVERY CLIENT KEY — cards 268012 (S12) and 268410.
- *
- * These four proxies populated NONE of PayEzClientIdResolver's six slots, so
- * RequirePayEzUnAuthorized 404'd the request BEFORE the action ran and no
- * recovery token was ever minted. That is why S12 failed at step 1.
- *
- * NOT `ENV_CONFIG.CLIENT_ID`, which is what card 268012 originally prescribed.
- * That variable is the ENVIRONMENT-SPECIFIC NUMERIC id, and the IDP accepts a
- * numeric with NO existence check (RequirePayEzUnAuthorizedAttribute.cs:31-33)
- * while it VALIDATES a slug (:41-47). Hardcoding the numeric here would have
- * added four more sites to the 268410 family and made a stale id answer for
- * the WRONG TENANT on a password-reset path, silently. Slug-preferring, with
- * the numeric fallback logged, is the same resolver the other nine sites use.
- *
- * SERVER VALUE WINS: client_id is applied AFTER the caller's payload spread.
- * These are unauthenticated recovery endpoints, so a browser-supplied
- * client_id would be a tenant-targeting lever. The caller does not get to
- * choose which tenant their password reset is addressed to.
- */
-async function recoveryClientKey(): Promise<string | null> {
-  try {
-    const config = await getIDPClientConfig();
-    return resolveClientKey(config, 'account/recovery/verify-code').key;
-  } catch (e) {
-    console.error('[account/recovery/verify-code] could not resolve IDP client config for client_id:', e);
-    return null;
-  }
-}
-
 export async function POST(req: NextRequest) {
-  let payload: unknown = {};
-  try {
-    payload = await req.json();
-  } catch {
-    return NextResponse.json(
-      { success: false, error: 'invalid_request', message: 'A JSON body is required' },
-      { status: 400 }
-    );
-  }
-
-  const clientKey = await recoveryClientKey();
-
-  const result = await idpFetchJSON(
-    req,
-    `${ENV_CONFIG.IDP_URL}/api/Account/recovery/verify-code`,
-    {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', ...(clientKey ? { 'X-Client-Id': clientKey } : {}) },
-      body: JSON.stringify({ ...(payload as Record<string, unknown>), ...(clientKey ? { client_id: clientKey } : {}) }),
-    }
-  );
-
-  if (!result.ok) {
-    return NextResponse.json(
-      {
-        success: false,
-        error: 'verify_code_failed',
-        message: result.json?.message || 'Upstream error',
-        meta: { status: result.status, attemptedRefresh: result.attemptedRefresh },
-      },
-      { status: result.status }
-    );
-  }
-
-  return NextResponse.json(result.json, { status: 200 });
+  return forwardRecoveryCall(req, {
+    upstreamPath: '/api/Account/recovery/verify-code',
+    where: 'account/recovery/verify-code',
+    failureCode: 'verify_code_failed',
+    fallbackMessage: 'Failed to verify the code',
+  });
 }

package/src/api-handlers/account/reset-password.ts

@@ -1,6 +1,7 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { getIDPClientConfig } from '../../lib/idp-client-config';
 import { resolveClientKey } from '../../lib/client-key';
+import { idpErrorEnvelope, projectPasswordPolicyRules, projectResetTokenInvalid } from '../../lib/safe-error-response';
 
 function getIdpUrl(): string {
   const url = process.env.IDP_URL;
@@ -41,7 +42,26 @@ async function recoveryClientKey(): Promise<string | null> {
 export async function POST(req: NextRequest) {
   const IDP_URL = getIdpUrl();
   try {
-    const payload = await req.json();
+    const raw = await req.json().catch(() => null);
+    const body = (raw && typeof raw === 'object' ? raw : {}) as Record<string, unknown>;
+    // PAY-1588: the IdP's ResetPasswordRequest binds exactly email/token/new_password/confirm_password. The client
+    // used to send password_reset_token / password / password_confirmation, which bind to nothing (400 at the IdP).
+    // Legacy names are accepted as aliases and mapped; only the four IdP fields are forwarded (whitelist).
+    const str = (v: unknown) => (typeof v === 'string' && v.length > 0 ? v : undefined);
+    const fields = {
+      email: str(body.email),
+      token: str(body.token) ?? str(body.password_reset_token),
+      new_password: str(body.new_password) ?? str(body.password),
+      confirm_password: str(body.confirm_password) ?? str(body.password_confirmation),
+    };
+    const missing = Object.entries(fields).filter(([, v]) => v === undefined).map(([k]) => k);
+    if (missing.length) {
+      return NextResponse.json(
+        { success: false, error: 'invalid_request', message: 'Missing required fields: ' + missing.join(', ') },
+        { status: 400 },
+      );
+    }
+    const payload = fields;
     const clientKey = await recoveryClientKey();
     const upstream = await fetch(`${IDP_URL}/api/Account/reset-password`, {
       method: 'POST',
@@ -49,6 +69,15 @@ export async function POST(req: NextRequest) {
       body: JSON.stringify({ ...payload, ...(clientKey ? { client_id: clientKey } : {}) }),
     });
     const data = await upstream.json().catch(() => ({}));
+    // PAY-1438: anonymous route - on failure only the whitelisted envelope (utils/api reads `message`).
+    if (!upstream.ok) {
+      // PAY-1591: a password-policy refusal also carries the KNOWN rule codes so the page can say which rules failed.
+      const rules = projectPasswordPolicyRules(data);
+      return NextResponse.json(
+        { ...idpErrorEnvelope(data, 'Failed to reset password'), ...(rules !== undefined ? { password_policy: { rules } } : {}), ...(projectResetTokenInvalid(data) ? { reset_token_invalid: true } : {}) },
+        { status: upstream.status },
+      );
+    }
     return NextResponse.json(data, { status: upstream.status });
   } catch {
     return NextResponse.json({ success: false, error: 'reset_password_failed' }, { status: 500 });

package/src/api-handlers/account/send-code.ts

@@ -10,6 +10,7 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { idpFetchJSON } from '../../lib/idp-fetch';
 import { ENV_CONFIG } from '../../config/env';
+import { twoFactorSendCodeFailure } from '../../lib/two-factor-verify-failure';
 
 export async function POST(req: NextRequest) {
   try {
@@ -44,15 +45,8 @@ export async function POST(req: NextRequest) {
     });
 
     if (!result.ok) {
-      return NextResponse.json(
-        {
-          success: false,
-          error: result.json?.message || `Failed to send ${method} code`,
-          code: result.json?.code || 'IDP_ERROR',
-          meta: { attemptedRefresh: result.attemptedRefresh },
-        },
-        { status: result.status }
-      );
+      // PAY-1443: never relay the IDP's message/code - fixed sentence + stable code, status kept.
+      return twoFactorSendCodeFailure(result, method);
     }
 
     return NextResponse.json(

package/src/api-handlers/account/update-phone.ts

@@ -39,7 +39,12 @@ export async function POST(req: NextRequest) {
     });
 
     if (!result.ok) {
-      console.error('[UPDATE_PHONE] IDP error:', result.status, result.json);
+      // PAY-1424: shape only, never the IDP body (profile endpoint - PII).
+      console.error('[UPDATE_PHONE] IDP error:', {
+        status: result.status,
+        bodyKeys: (result.json as any) && typeof (result.json as any) === 'object' ? Object.keys((result.json as any)) : undefined,
+        errorKeys: (result.json as any)?.error && typeof (result.json as any)?.error === 'object' ? Object.keys((result.json as any)?.error) : undefined,
+      });
       return NextResponse.json(
         {
           success: false,

package/src/api-handlers/account/validate-password.ts

@@ -79,9 +79,11 @@ export async function POST(req: NextRequest) {
     const responseData = await idpResponse.json().catch(() => ({}));
 
     if (!idpResponse.ok) {
+      // PAY-1424: shape only, never the envelope contents (this endpoint carries a password).
       console.error('[VALIDATE_PASSWORD] IDP error:', {
         status: idpResponse.status,
-        response: responseData,
+        bodyKeys: responseData && typeof responseData === 'object' ? Object.keys(responseData) : undefined,
+        errorKeys: (responseData as any)?.error && typeof (responseData as any)?.error === 'object' ? Object.keys((responseData as any)?.error) : undefined,
       });
       return NextResponse.json(
         {

package/src/api-handlers/account/verify-email.ts

@@ -13,6 +13,7 @@ import { ENV_CONFIG } from '../../config/env';
 import { getTokenTestAware } from '../../lib/test-aware-get-token';
 import { transitionTo2FASession } from '../../lib/session-store';
 import { jwtDecode } from '../../lib/jwt-decode';
+import { twoFactorVerifyFailure } from '../../lib/two-factor-verify-failure';
 
 export async function POST(req: NextRequest) {
   try {
@@ -39,15 +40,9 @@ export async function POST(req: NextRequest) {
     });
 
     if (!result.ok) {
-      return NextResponse.json(
-        {
-          success: false,
-          error: result.json?.message || 'Verification failed',
-          code: result.json?.code || 'IDP_ERROR',
-          meta: { attemptedRefresh: result.attemptedRefresh },
-        },
-        { status: result.status }
-      );
+      // PAY-1443: never relay the IDP's error text - it arrives as a C# anonymous-object
+      // ToString ("{ message = ... }") on the deployed IDP. Classify it, answer a fixed sentence.
+      return twoFactorVerifyFailure(result, 'email');
     }
 
     // Unwrap IDP envelope

package/src/api-handlers/account/verify-sms.ts

@@ -13,6 +13,7 @@ import { ENV_CONFIG } from '../../config/env';
 import { getTokenTestAware } from '../../lib/test-aware-get-token';
 import { transitionTo2FASession } from '../../lib/session-store';
 import { jwtDecode } from '../../lib/jwt-decode';
+import { twoFactorVerifyFailure } from '../../lib/two-factor-verify-failure';
 
 export async function POST(req: NextRequest) {
   try {
@@ -39,15 +40,9 @@ export async function POST(req: NextRequest) {
     });
 
     if (!result.ok) {
-      return NextResponse.json(
-        {
-          success: false,
-          error: result.json?.message || 'Verification failed',
-          code: result.json?.code || 'IDP_ERROR',
-          meta: { attemptedRefresh: result.attemptedRefresh },
-        },
-        { status: result.status }
-      );
+      // PAY-1443: never relay the IDP's error text - it arrives as a C# anonymous-object
+      // ToString ("{ message = ... }") on the deployed IDP. Classify it, answer a fixed sentence.
+      return twoFactorVerifyFailure(result, 'sms');
     }
 
     // Unwrap IDP envelope

package/src/api-handlers/admin/analytics.ts

@@ -13,6 +13,7 @@ import { getSession } from '../../server/auth';
 import { getStartupIDPConfig } from '../../lib/startup-init';
 import { resolveClientKey } from '../../lib/client-key';
 import { ADMIN_ROLES, hasAnyRole } from '../../lib/roles';
+import { randomUUID } from 'crypto';
 
 interface VibeRequestOptions {
   method: 'GET' | 'POST' | 'PUT' | 'DELETE';
@@ -45,7 +46,10 @@ async function checkAdminRole(request: NextRequest): Promise<{ isAdmin: boolean;
 async function vibeServiceRequest<T = unknown>(
   endpoint: string,
   options: VibeRequestOptions
-): Promise<{ ok: boolean; status: number; data: T | null; error?: string }> {
+): Promise<{ ok: boolean; status: number; data: T | null; error?: string; correlationId?: string }> {
+  // PAY-1429: `error` can reach the HTTP caller, so it never carries upstream Vibe text or
+  // exception text. Failures return a fixed message + correlationId; the same id is on the
+  // server log line, which carries status + bodyLength only (PAY-1424).
   const idpUrl = process.env.NEXT_PUBLIC_IDP_URL || process.env.IDP_URL;
   const clientId = process.env.VIBE_CLIENT_ID;
   const signingKey = process.env.VIBE_HMAC_KEY;
@@ -90,13 +94,17 @@ async function vibeServiceRequest<T = unknown>(
     if (res.status === 204) return { ok: true, status: 204, data: null };
     if (!res.ok) {
       const errorText = await res.text();
-      return { ok: false, status: res.status, data: null, error: errorText };
+      const correlationId = randomUUID();
+      console.error(`[admin/analytics] Vibe request failed: ${options.method} ${endpoint} - ${res.status}`, { correlationId, bodyLength: errorText.length });
+      return { ok: false, status: res.status, data: null, error: `Vibe request failed (HTTP ${res.status})`, correlationId };
     }
 
     const body = await res.json();
     return { ok: true, status: res.status, data: body };
   } catch (error) {
-    return { ok: false, status: 0, data: null, error: String(error) };
+    const correlationId = randomUUID();
+    console.error(`[admin/analytics] Vibe request exception: ${options.method} ${endpoint}`, { correlationId, error });
+    return { ok: false, status: 0, data: null, error: 'Vibe request could not be completed', correlationId };
   }
 }
 
@@ -176,7 +184,7 @@ async function getGeoAnalytics(startDate: Date) {
   );
 
   if (!result.ok) {
-    return NextResponse.json({ error: result.error }, { status: result.status || 500 });
+    return NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
   }
 
   const sessions = result.data?.data || result.data?.documents || [];
@@ -230,7 +238,7 @@ async function getLoginAnalytics(startDate: Date) {
   );
 
   if (!result.ok) {
-    return NextResponse.json({ error: result.error }, { status: result.status || 500 });
+    return NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
   }
 
   const sessions = result.data?.data || result.data?.documents || [];

package/src/api-handlers/admin/audit.ts

@@ -12,6 +12,7 @@ import { getSession } from '../../server/auth';
 import { getStartupIDPConfig } from '../../lib/startup-init';
 import { resolveClientKey } from '../../lib/client-key';
 import { ADMIN_ROLES, hasAnyRole } from '../../lib/roles';
+import { randomUUID } from 'crypto';
 
 interface VibeRequestOptions {
   method: 'GET' | 'POST' | 'PUT' | 'DELETE';
@@ -44,7 +45,10 @@ async function checkAdminRole(request: NextRequest): Promise<{ isAdmin: boolean;
 async function vibeServiceRequest<T = unknown>(
   endpoint: string,
   options: VibeRequestOptions
-): Promise<{ ok: boolean; status: number; data: T | null; error?: string }> {
+): Promise<{ ok: boolean; status: number; data: T | null; error?: string; correlationId?: string }> {
+  // PAY-1429: `error` can reach the HTTP caller, so it never carries upstream Vibe text or
+  // exception text. Failures return a fixed message + correlationId; the same id is on the
+  // server log line, which carries status + bodyLength only (PAY-1424).
   const idpUrl = process.env.NEXT_PUBLIC_IDP_URL || process.env.IDP_URL;
   const clientId = process.env.VIBE_CLIENT_ID;
   const signingKey = process.env.VIBE_HMAC_KEY;
@@ -89,13 +93,17 @@ async function vibeServiceRequest<T = unknown>(
     if (res.status === 204) return { ok: true, status: 204, data: null };
     if (!res.ok) {
       const errorText = await res.text();
-      return { ok: false, status: res.status, data: null, error: errorText };
+      const correlationId = randomUUID();
+      console.error(`[admin/audit] Vibe request failed: ${options.method} ${endpoint} - ${res.status}`, { correlationId, bodyLength: errorText.length });
+      return { ok: false, status: res.status, data: null, error: `Vibe request failed (HTTP ${res.status})`, correlationId };
     }
 
     const body = await res.json();
     return { ok: true, status: res.status, data: body };
   } catch (error) {
-    return { ok: false, status: 0, data: null, error: String(error) };
+    const correlationId = randomUUID();
+    console.error(`[admin/audit] Vibe request exception: ${options.method} ${endpoint}`, { correlationId, error });
+    return { ok: false, status: 0, data: null, error: 'Vibe request could not be completed', correlationId };
   }
 }
 
@@ -153,7 +161,7 @@ export function createAuditHandler(config: AdminAuditHandlerConfig) {
       );
 
       if (!result.ok) {
-        return NextResponse.json({ error: result.error }, { status: result.status || 500 });
+        return NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
       }
 
       const rawLogs = result.data?.data || result.data?.documents || [];
@@ -190,7 +198,7 @@ export function createAuditHandler(config: AdminAuditHandlerConfig) {
         );
 
         if (!result.ok) {
-          return NextResponse.json({ error: result.error }, { status: result.status || 500 });
+          return NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
         }
 
         const logs = result.data?.data || result.data?.documents || [];

package/src/api-handlers/admin/redis-sessions.ts

@@ -15,6 +15,8 @@ import { NextRequest, NextResponse } from 'next/server';
 import { getSession } from '../../server/auth';
 import { getRedis } from '../../lib/redis';
 import { ADMIN_ROLES, hasAnyRole } from '../../lib/roles';
+import { randomUUID } from 'crypto';
+import { tokenLogId } from '../../lib/token-log-id';
 
 export interface RedisSessionsHandlerConfig {
   appSlug?: string;
@@ -93,7 +95,7 @@ export function createRedisSessionsHandler(config: RedisSessionsHandlerConfig) {
 
             sessions.push({
               id: sessionToken.substring(0, 16), // Truncated for display
-              session_token: sessionToken.substring(0, 8) + '...', // Masked
+              session_token: tokenLogId(sessionToken), // Masked
               user_id: sessionData.userId,
               user_name: sessionData.name,
               user_email: sessionData.email,
@@ -129,9 +131,11 @@ export function createRedisSessionsHandler(config: RedisSessionsHandlerConfig) {
           redis_prefix: sessionPrefix,
         });
       } catch (error: any) {
-        console.error('[admin/redis-sessions] Error:', error);
+        // PAY-1429: exception text (hosts, URLs, driver messages) stays server-side.
+        const correlationId = randomUUID();
+        console.error('[admin/redis-sessions] Error:', { correlationId, error });
         return NextResponse.json(
-          { error: error.message || 'Internal error' },
+          { error: 'Internal error', code: 'INTERNAL_ERROR', correlationId },
           { status: 500 }
         );
       }
@@ -169,12 +173,14 @@ export function createRedisSessionsHandler(config: RedisSessionsHandlerConfig) {
         return NextResponse.json({
           success: true,
           message: 'Session revoked',
-          session_token: sessionToken.substring(0, 8) + '...',
+          session_token: tokenLogId(sessionToken),
         });
       } catch (error: any) {
-        console.error('[admin/redis-sessions] DELETE Error:', error);
+        // PAY-1429: exception text (hosts, URLs, driver messages) stays server-side.
+        const correlationId = randomUUID();
+        console.error('[admin/redis-sessions] DELETE Error:', { correlationId, error });
         return NextResponse.json(
-          { error: error.message || 'Internal error' },
+          { error: 'Internal error', code: 'INTERNAL_ERROR', correlationId },
           { status: 500 }
         );
       }
@@ -240,9 +246,11 @@ export function createRedisSessionRevokeHandler(config: RedisSessionsHandlerConf
           message: 'Session revoked',
         });
       } catch (error: any) {
-        console.error('[admin/redis-sessions/revoke] Error:', error);
+        // PAY-1429: exception text (hosts, URLs, driver messages) stays server-side.
+        const correlationId = randomUUID();
+        console.error('[admin/redis-sessions/revoke] Error:', { correlationId, error });
         return NextResponse.json(
-          { error: error.message || 'Internal error' },
+          { error: 'Internal error', code: 'INTERNAL_ERROR', correlationId },
           { status: 500 }
         );
       }