@payez/next-mvp 4.4.4 → 4.4.6

package/src/api-handlers/admin/sessions.ts

@@ -13,6 +13,7 @@ import { getSession } from '../../server/auth';
 import { getStartupIDPConfig } from '../../lib/startup-init';
 import { resolveClientKey } from '../../lib/client-key';
 import { ADMIN_ROLES, hasAnyRole } from '../../lib/roles';
+import { randomUUID } from 'crypto';
 
 interface VibeRequestOptions {
   method: 'GET' | 'POST' | 'PUT' | 'DELETE';
@@ -57,7 +58,10 @@ async function checkAdminRole(request: NextRequest): Promise<{ isAdmin: boolean;
 async function vibeServiceRequest<T = unknown>(
   endpoint: string,
   options: VibeRequestOptions
-): Promise<{ ok: boolean; status: number; data: T | null; error?: string }> {
+): Promise<{ ok: boolean; status: number; data: T | null; error?: string; correlationId?: string }> {
+  // PAY-1429: `error` can reach the HTTP caller, so it never carries upstream Vibe text or
+  // exception text. Failures return a fixed message + correlationId; the same id is on the
+  // server log line, which carries status + bodyLength only (PAY-1424).
   const idpUrl = process.env.NEXT_PUBLIC_IDP_URL || process.env.IDP_URL;
   const clientId = process.env.VIBE_CLIENT_ID;
   const signingKey = process.env.VIBE_HMAC_KEY;
@@ -105,13 +109,17 @@ async function vibeServiceRequest<T = unknown>(
 
     if (!res.ok) {
       const errorText = await res.text();
-      return { ok: false, status: res.status, data: null, error: errorText };
+      const correlationId = randomUUID();
+      console.error(`[admin/sessions] Vibe request failed: ${options.method} ${endpoint} - ${res.status}`, { correlationId, bodyLength: errorText.length });
+      return { ok: false, status: res.status, data: null, error: `Vibe request failed (HTTP ${res.status})`, correlationId };
     }
 
     const body = await res.json();
     return { ok: true, status: res.status, data: body };
   } catch (error) {
-    return { ok: false, status: 0, data: null, error: String(error) };
+    const correlationId = randomUUID();
+    console.error(`[admin/sessions] Vibe request exception: ${options.method} ${endpoint}`, { correlationId, error });
+    return { ok: false, status: 0, data: null, error: 'Vibe request could not be completed', correlationId };
   }
 }
 
@@ -171,7 +179,7 @@ export function createSessionsHandler(config: AdminSessionsHandlerConfig) {
       );
 
       if (!result.ok) {
-        return NextResponse.json({ error: result.error }, { status: result.status || 500 });
+        return NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
       }
 
       // Extract sessions from response
@@ -214,7 +222,7 @@ export function createSessionsHandler(config: AdminSessionsHandlerConfig) {
         );
 
         if (!result.ok) {
-          return NextResponse.json({ error: result.error }, { status: result.status || 500 });
+          return NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
         }
 
         const sessions = result.data?.data || result.data?.documents || [];
@@ -262,7 +270,7 @@ export function createSessionsHandler(config: AdminSessionsHandlerConfig) {
         );
 
         if (!result.ok) {
-          return NextResponse.json({ error: result.error }, { status: result.status || 500 });
+          return NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
         }
 
         return NextResponse.json({ success: true });
@@ -287,7 +295,7 @@ export function createSessionsHandler(config: AdminSessionsHandlerConfig) {
         );
 
         if (!queryResult.ok) {
-          return NextResponse.json({ error: queryResult.error }, { status: queryResult.status || 500 });
+          return NextResponse.json({ error: queryResult.error, code: 'UPSTREAM_ERROR', correlationId: queryResult.correlationId }, { status: queryResult.status || 500 });
         }
 
         const sessions = queryResult.data?.data || queryResult.data?.documents || [];

package/src/api-handlers/admin/site-logs.ts

@@ -16,6 +16,7 @@ import { NextRequest, NextResponse } from 'next/server';
 import { getSession } from '../../server/auth';
 import { getRedis } from '../../lib/redis';
 import { ADMIN_ROLES, hasAnyRole } from '../../lib/roles';
+import { randomUUID } from 'crypto';
 const REDIS_SITE_LOG_KEY = 'vibe:site-logs:pending';
 const REDIS_LOG_TTL = 7 * 24 * 60 * 60; // 1 week
 
@@ -106,9 +107,13 @@ export function createSiteLogsHandler(config: SiteLogsHandlerConfig) {
 
         if (!response.ok) {
           const errorText = await response.text();
-          console.error('[admin/site-logs] Vibe error:', response.status, errorText);
+          // PAY-1424: never the raw upstream body in the log sink.
+          // PAY-1425: nor in the response - a fixed message + code, and a correlationId that
+          // matches this log line.
+          const correlationId = randomUUID();
+          console.error('[admin/site-logs] Vibe error:', { correlationId, status: response.status, bodyLength: errorText.length });
           return NextResponse.json(
-            { error: 'Failed to fetch site logs', details: errorText },
+            { error: 'Failed to fetch site logs', code: 'UPSTREAM_ERROR', correlationId },
             { status: response.status }
           );
         }
@@ -116,9 +121,11 @@ export function createSiteLogsHandler(config: SiteLogsHandlerConfig) {
         const data = await response.json();
         return NextResponse.json(data);
       } catch (error: any) {
-        console.error('[admin/site-logs] Error:', error);
+        // PAY-1425: exception text (hosts, URLs, driver messages) stays server-side.
+        const correlationId = randomUUID();
+        console.error('[admin/site-logs] Error:', { correlationId, error });
         return NextResponse.json(
-          { error: error.message || 'Internal error' },
+          { error: 'Internal error', code: 'INTERNAL_ERROR', correlationId },
           { status: 500 }
         );
       }
@@ -192,9 +199,11 @@ export function createSiteLogsHandler(config: SiteLogsHandlerConfig) {
           note: 'Log will appear after drain service processes it (every 5 seconds)',
         }, { status: 201 });
       } catch (error: any) {
-        console.error('[admin/site-logs] POST Error:', error);
+        // PAY-1425: exception text (hosts, URLs, driver messages) stays server-side.
+        const correlationId = randomUUID();
+        console.error('[admin/site-logs] POST Error:', { correlationId, error });
         return NextResponse.json(
-          { error: error.message || 'Internal error' },
+          { error: 'Internal error', code: 'INTERNAL_ERROR', correlationId },
           { status: 500 }
         );
       }
@@ -232,9 +241,13 @@ export function createSiteLogsStatsHandler(config: SiteLogsHandlerConfig) {
 
         if (!response.ok) {
           const errorText = await response.text();
-          console.error('[admin/site-logs/stats] Vibe error:', response.status, errorText);
+          // PAY-1424: never the raw upstream body in the log sink.
+          // PAY-1425: nor in the response - a fixed message + code, and a correlationId that
+          // matches this log line.
+          const correlationId = randomUUID();
+          console.error('[admin/site-logs/stats] Vibe error:', { correlationId, status: response.status, bodyLength: errorText.length });
           return NextResponse.json(
-            { error: 'Failed to fetch stats', details: errorText },
+            { error: 'Failed to fetch stats', code: 'UPSTREAM_ERROR', correlationId },
             { status: response.status }
           );
         }
@@ -243,9 +256,11 @@ export function createSiteLogsStatsHandler(config: SiteLogsHandlerConfig) {
         // Ensure response matches expected format: { total, unique_users, by_level, by_category }
         return NextResponse.json(data);
       } catch (error: any) {
-        console.error('[admin/site-logs/stats] Error:', error);
+        // PAY-1425: exception text (hosts, URLs, driver messages) stays server-side.
+        const correlationId = randomUUID();
+        console.error('[admin/site-logs/stats] Error:', { correlationId, error });
         return NextResponse.json(
-          { error: error.message || 'Internal error' },
+          { error: 'Internal error', code: 'INTERNAL_ERROR', correlationId },
           { status: 500 }
         );
       }
@@ -282,9 +297,13 @@ export function createSiteLogsDrainHandler(config: SiteLogsHandlerConfig) {
 
         if (!response.ok) {
           const errorText = await response.text();
-          console.error('[admin/site-logs/drain] Vibe error:', response.status, errorText);
+          // PAY-1424: never the raw upstream body in the log sink.
+          // PAY-1425: nor in the response - a fixed message + code, and a correlationId that
+          // matches this log line.
+          const correlationId = randomUUID();
+          console.error('[admin/site-logs/drain] Vibe error:', { correlationId, status: response.status, bodyLength: errorText.length });
           return NextResponse.json(
-            { error: 'Failed to drain site logs', details: errorText },
+            { error: 'Failed to drain site logs', code: 'UPSTREAM_ERROR', correlationId },
             { status: response.status }
           );
         }
@@ -292,9 +311,11 @@ export function createSiteLogsDrainHandler(config: SiteLogsHandlerConfig) {
         const data = await response.json();
         return NextResponse.json(data);
       } catch (error: any) {
-        console.error('[admin/site-logs/drain] Error:', error);
+        // PAY-1425: exception text (hosts, URLs, driver messages) stays server-side.
+        const correlationId = randomUUID();
+        console.error('[admin/site-logs/drain] Error:', { correlationId, error });
         return NextResponse.json(
-          { error: error.message || 'Internal error' },
+          { error: 'Internal error', code: 'INTERNAL_ERROR', correlationId },
           { status: 500 }
         );
       }
@@ -354,9 +375,11 @@ export function createSiteLogsQueueHandler(config: SiteLogsHandlerConfig) {
           status: queueLength === 0 ? 'empty' : 'pending',
         });
       } catch (error: any) {
-        console.error('[admin/site-logs/queue] Error:', error);
+        // PAY-1425: exception text (hosts, URLs, driver messages) stays server-side.
+        const correlationId = randomUUID();
+        console.error('[admin/site-logs/queue] Error:', { correlationId, error });
         return NextResponse.json(
-          { error: error.message || 'Internal error' },
+          { error: 'Internal error', code: 'INTERNAL_ERROR', correlationId },
           { status: 500 }
         );
       }

package/src/api-handlers/admin/stats.ts

@@ -14,6 +14,7 @@ import { getStartupIDPConfig } from '../../lib/startup-init';
 import { resolveClientKey } from '../../lib/client-key';
 import { getRedis } from '../../lib/redis';
 import { ADMIN_ROLES } from '../../lib/roles';
+import { randomUUID } from 'crypto';
 
 interface VibeRequestOptions {
   method: 'GET' | 'POST' | 'PUT' | 'DELETE';
@@ -46,7 +47,10 @@ async function checkAdminRole(request: NextRequest): Promise<{ isAdmin: boolean;
 async function vibeServiceRequest<T = unknown>(
   endpoint: string,
   options: VibeRequestOptions
-): Promise<{ ok: boolean; status: number; data: T | null; error?: string }> {
+): Promise<{ ok: boolean; status: number; data: T | null; error?: string; correlationId?: string }> {
+  // PAY-1429: `error` can reach the HTTP caller, so it never carries upstream Vibe text or
+  // exception text. Failures return a fixed message + correlationId; the same id is on the
+  // server log line, which carries status + bodyLength only (PAY-1424).
   const idpUrl = process.env.NEXT_PUBLIC_IDP_URL || process.env.IDP_URL;
   const clientId = process.env.VIBE_CLIENT_ID;
   const signingKey = process.env.VIBE_HMAC_KEY;
@@ -90,13 +94,17 @@ async function vibeServiceRequest<T = unknown>(
     if (res.status === 204) return { ok: true, status: 204, data: null };
     if (!res.ok) {
       const errorText = await res.text();
-      return { ok: false, status: res.status, data: null, error: errorText };
+      const correlationId = randomUUID();
+      console.error(`[admin/stats] Vibe request failed: ${options.method} ${endpoint} - ${res.status}`, { correlationId, bodyLength: errorText.length });
+      return { ok: false, status: res.status, data: null, error: `Vibe request failed (HTTP ${res.status})`, correlationId };
     }
 
     const body = await res.json();
     return { ok: true, status: res.status, data: body };
   } catch (error) {
-    return { ok: false, status: 0, data: null, error: String(error) };
+    const correlationId = randomUUID();
+    console.error(`[admin/stats] Vibe request exception: ${options.method} ${endpoint}`, { correlationId, error });
+    return { ok: false, status: 0, data: null, error: 'Vibe request could not be completed', correlationId };
   }
 }
 
@@ -239,9 +247,11 @@ export function createStatsHandler(config: AdminStatsHandlerConfig) {
           recentActivity,
         });
       } catch (error: any) {
-        console.error('[admin/stats] Error:', error);
+        // PAY-1429: exception text (hosts, URLs, driver messages) stays server-side.
+        const correlationId = randomUUID();
+        console.error('[admin/stats] Error:', { correlationId, error });
         return NextResponse.json(
-          { error: error.message || 'Internal error' },
+          { error: 'Internal error', code: 'INTERNAL_ERROR', correlationId },
           { status: 500 }
         );
       }

package/src/api-handlers/admin/users.ts

@@ -12,6 +12,7 @@ import { getSession } from '../../server/auth';
 import { getStartupIDPConfig } from '../../lib/startup-init';
 import { resolveClientKey } from '../../lib/client-key';
 import { ADMIN_ROLES, hasAnyRole } from '../../lib/roles';
+import { randomUUID } from 'crypto';
 
 interface VibeRequestOptions {
   method: 'GET' | 'POST' | 'PUT' | 'DELETE';
@@ -44,7 +45,10 @@ async function checkAdminRole(request: NextRequest): Promise<{ isAdmin: boolean;
 async function vibeServiceRequest<T = unknown>(
   endpoint: string,
   options: VibeRequestOptions
-): Promise<{ ok: boolean; status: number; data: T | null; error?: string }> {
+): Promise<{ ok: boolean; status: number; data: T | null; error?: string; correlationId?: string }> {
+  // PAY-1429: `error` can reach the HTTP caller, so it never carries upstream Vibe text or
+  // exception text. Failures return a fixed message + correlationId; the same id is on the
+  // server log line, which carries status + bodyLength only (PAY-1424).
   const idpUrl = process.env.NEXT_PUBLIC_IDP_URL || process.env.IDP_URL;
   const clientId = process.env.VIBE_CLIENT_ID;
   const signingKey = process.env.VIBE_HMAC_KEY;
@@ -89,13 +93,17 @@ async function vibeServiceRequest<T = unknown>(
     if (res.status === 204) return { ok: true, status: 204, data: null };
     if (!res.ok) {
       const errorText = await res.text();
-      return { ok: false, status: res.status, data: null, error: errorText };
+      const correlationId = randomUUID();
+      console.error(`[admin/users] Vibe request failed: ${options.method} ${endpoint} - ${res.status}`, { correlationId, bodyLength: errorText.length });
+      return { ok: false, status: res.status, data: null, error: `Vibe request failed (HTTP ${res.status})`, correlationId };
     }
 
     const body = await res.json();
     return { ok: true, status: res.status, data: body };
   } catch (error) {
-    return { ok: false, status: 0, data: null, error: String(error) };
+    const correlationId = randomUUID();
+    console.error(`[admin/users] Vibe request exception: ${options.method} ${endpoint}`, { correlationId, error });
+    return { ok: false, status: 0, data: null, error: 'Vibe request could not be completed', correlationId };
   }
 }
 
@@ -151,7 +159,7 @@ export function createUsersHandler(config: AdminUsersHandlerConfig) {
       );
 
       if (!result.ok) {
-        return NextResponse.json({ error: result.error }, { status: result.status || 500 });
+        return NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
       }
 
       const rawUsers = result.data?.data || result.data?.documents || [];
@@ -187,7 +195,7 @@ export function createUsersHandler(config: AdminUsersHandlerConfig) {
         );
 
         if (!result.ok) {
-          return NextResponse.json({ error: result.error }, { status: result.status || 500 });
+          return NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
         }
 
         const users = result.data?.data || result.data?.documents || [];
@@ -218,7 +226,7 @@ export function createUsersHandler(config: AdminUsersHandlerConfig) {
         );
 
         if (!result.ok) {
-          return NextResponse.json({ error: result.error }, { status: result.status || 500 });
+          return NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
         }
 
         return NextResponse.json({ success: true });
@@ -231,7 +239,7 @@ export function createUsersHandler(config: AdminUsersHandlerConfig) {
         );
 
         if (!result.ok) {
-          return NextResponse.json({ error: result.error }, { status: result.status || 500 });
+          return NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
         }
 
         return NextResponse.json({ success: true });

package/src/api-handlers/admin/vibe-data.ts

@@ -13,6 +13,7 @@ import { getSession } from '../../server/auth';
 import { getStartupIDPConfig } from '../../lib/startup-init';
 import { resolveClientKey } from '../../lib/client-key';
 import { ADMIN_ROLES, hasAnyRole } from '../../lib/roles';
+import { randomUUID } from 'crypto';
 
 interface VibeRequestOptions {
   method: 'GET' | 'POST' | 'PUT' | 'DELETE';
@@ -57,7 +58,11 @@ async function checkAdminRole(request: NextRequest): Promise<{ isAdmin: boolean;
 async function vibeServiceRequest<T = unknown>(
   endpoint: string,
   options: VibeRequestOptions
-): Promise<{ ok: boolean; status: number; data: T | null; error?: string }> {
+): Promise<{ ok: boolean; status: number; data: T | null; error?: string; correlationId?: string }> {
+  // PAY-1425: `error` is returned to the HTTP caller verbatim by every handler below, so it
+  // must NEVER carry upstream text (raw Vibe/VibeSQL error bodies can hold SQL fragments,
+  // schema names or connection detail) or exception text. Failures return a fixed message
+  // plus a correlationId; the same id is on the server log line for operators.
   const idpUrl = process.env.NEXT_PUBLIC_IDP_URL || process.env.IDP_URL;
   const clientId = process.env.VIBE_CLIENT_ID;
   const signingKey = process.env.VIBE_HMAC_KEY;
@@ -108,15 +113,18 @@ async function vibeServiceRequest<T = unknown>(
 
     if (!res.ok) {
       const errorText = await res.text();
-      console.error(`[Admin Vibe] Request failed: ${options.method} ${endpoint} - ${res.status}`, errorText);
-      return { ok: false, status: res.status, data: null, error: errorText };
+      // PAY-1424: never the raw upstream body in the log sink.
+      const correlationId = randomUUID();
+      console.error(`[Admin Vibe] Request failed: ${options.method} ${endpoint} - ${res.status}`, { correlationId, bodyLength: errorText.length });
+      return { ok: false, status: res.status, data: null, error: `Vibe request failed (HTTP ${res.status})`, correlationId };
     }
 
     const body = await res.json();
     return { ok: true, status: res.status, data: body };
   } catch (error) {
-    console.error(`[Admin Vibe] Request exception: ${options.method} ${endpoint}`, error);
-    return { ok: false, status: 0, data: null, error: String(error) };
+    const correlationId = randomUUID();
+    console.error(`[Admin Vibe] Request exception: ${options.method} ${endpoint}`, { correlationId, error });
+    return { ok: false, status: 0, data: null, error: 'Vibe request could not be completed', correlationId };
   }
 }
 
@@ -140,7 +148,7 @@ export function createGetCollectionsHandler(config: AdminVibeHandlerConfig) {
 
     if (!result.ok) {
       return NextResponse.json(
-        { success: false, error: { code: 'FETCH_ERROR', message: result.error } },
+        { success: false, error: { code: 'FETCH_ERROR', message: result.error, correlationId: result.correlationId } },
         { status: result.status || 500 }
       );
     }
@@ -166,7 +174,7 @@ export function createGetTablesHandler(config: AdminVibeHandlerConfig) {
 
     if (!result.ok) {
       return NextResponse.json(
-        { success: false, error: { code: 'FETCH_ERROR', message: result.error } },
+        { success: false, error: { code: 'FETCH_ERROR', message: result.error, correlationId: result.correlationId } },
         { status: result.status || 500 }
       );
     }
@@ -200,7 +208,7 @@ export function createGetTableDataHandler(config: AdminVibeHandlerConfig) {
 
     if (!result.ok) {
       return NextResponse.json(
-        { success: false, error: { code: 'FETCH_ERROR', message: result.error } },
+        { success: false, error: { code: 'FETCH_ERROR', message: result.error, correlationId: result.correlationId } },
         { status: result.status || 500 }
       );
     }
@@ -228,7 +236,7 @@ export function createGetRecordHandler(config: AdminVibeHandlerConfig) {
     if (!result.ok) {
       const status = result.status === 404 ? 404 : result.status || 500;
       return NextResponse.json(
-        { success: false, error: { code: result.status === 404 ? 'NOT_FOUND' : 'FETCH_ERROR', message: result.error } },
+        { success: false, error: { code: result.status === 404 ? 'NOT_FOUND' : 'FETCH_ERROR', message: result.error, correlationId: result.correlationId } },
         { status }
       );
     }
@@ -256,7 +264,7 @@ export function createUpdateRecordHandler(config: AdminVibeHandlerConfig) {
 
     if (!result.ok) {
       return NextResponse.json(
-        { success: false, error: { code: 'UPDATE_ERROR', message: result.error } },
+        { success: false, error: { code: 'UPDATE_ERROR', message: result.error, correlationId: result.correlationId } },
         { status: result.status || 500 }
       );
     }
@@ -283,7 +291,7 @@ export function createDeleteRecordHandler(config: AdminVibeHandlerConfig) {
 
     if (!result.ok) {
       return NextResponse.json(
-        { success: false, error: { code: 'DELETE_ERROR', message: result.error } },
+        { success: false, error: { code: 'DELETE_ERROR', message: result.error, correlationId: result.correlationId } },
         { status: result.status || 500 }
       );
     }
@@ -315,7 +323,7 @@ export function createQueryHandler(config: AdminVibeHandlerConfig) {
 
     if (!result.ok) {
       return NextResponse.json(
-        { success: false, error: { code: 'QUERY_ERROR', message: result.error } },
+        { success: false, error: { code: 'QUERY_ERROR', message: result.error, correlationId: result.correlationId } },
         { status: result.status || 500 }
       );
     }

package/src/api-handlers/auth/jwks.ts

@@ -14,7 +14,8 @@ export async function GET(_req: NextRequest) {
       const json = JSON.parse(bodyText);
       return NextResponse.json(json, { status: res.status });
     } catch (e) {
-      logger.error('[AUTH_JWKS] Upstream returned non-JSON', { status: res.status, bodyText: bodyText?.slice(0, 200) });
+      // PAY-1427: no body slice - a non-JSON upstream is an error/proxy page of unknown content.
+      logger.error('[AUTH_JWKS] Upstream returned non-JSON', { status: res.status, bodyLength: bodyText.length, contentType: res.headers.get('content-type') });
       return NextResponse.json({ error: 'Invalid JWKS response' }, { status: 502 });
     }
   } catch (error) {

package/src/api-handlers/auth/login.ts

@@ -162,9 +162,12 @@ export function createLoginHandler(config: LoginConfig) {
       try {
         data = JSON.parse(rawText);
       } catch (jsonError) {
+        // PAY-1424: never the raw body - a non-JSON IDP/proxy error page can echo request
+        // context (credentials) back. Status, length and content-type are enough to triage.
         console.error('[LOGIN] IDP returned non-JSON response', {
-          response: rawText,
-          status: backendResponse.status
+          status: backendResponse.status,
+          bodyLength: rawText.length,
+          contentType: backendResponse.headers.get('content-type'),
         });
         return NextResponse.json(
           { error: 'Invalid response from authentication service' },
@@ -187,16 +190,22 @@ export function createLoginHandler(config: LoginConfig) {
         }
 
         // Pass through error from IDP
+        // PAY-1424: shape only, never the envelope contents.
         console.error('[LOGIN] IDP service error', {
           status: backendResponse.status,
-          error: data
+          bodyKeys: data && typeof data === 'object' ? Object.keys(data) : undefined,
+          errorKeys: data?.error && typeof data?.error === 'object' ? Object.keys(data?.error) : undefined,
         });
         return addSecurityHeaders(NextResponse.json(data, { status: backendResponse.status }));
       }
 
       if (!data.success) {
         // IDP returned a canonical error envelope with HTTP 200
-        console.error('[LOGIN] IDP authentication failure', { error: data });
+        // PAY-1424: shape only, never the envelope contents.
+        console.error('[LOGIN] IDP authentication failure', {
+          bodyKeys: data && typeof data === 'object' ? Object.keys(data) : undefined,
+          errorKeys: data?.error && typeof data?.error === 'object' ? Object.keys(data?.error) : undefined,
+        });
         return addSecurityHeaders(NextResponse.json(data, { status: 200 }));
       }
 

package/src/api-handlers/auth/passkey-signin.ts

@@ -3,6 +3,7 @@ import { ENV_CONFIG } from '../../config/env';
 import { getIDPClientConfig } from '../../lib/idp-client-config';
 import { resolveClientKey } from '../../lib/client-key';
 import { assertAbsoluteIdpUrl } from '../../lib/idp-url-guard';
+import { idpErrorEnvelope } from '../../lib/safe-error-response';
 
 /**
  * Passkey SIGN-IN ceremony (ANONYMOUS — no session exists yet):
@@ -54,6 +55,8 @@ async function anonCall(req: NextRequest, path: string) {
 
 export async function optionsPOST(req: NextRequest) {
   const { res, json } = await anonCall(req, '/api/ExternalAuth/passwordless/passkey/options');
+  // PAY-1438: anonymous route - on failure only the whitelisted envelope, never the IDP body.
+  if (!res.ok) return NextResponse.json(idpErrorEnvelope(json, 'Passkey sign-in failed'), { status: res.status });
   return NextResponse.json(json ?? { success: false, message: 'Empty upstream response' }, { status: res.status });
 }
 
@@ -108,5 +111,6 @@ export async function verifyPOST(req: NextRequest) {
     cache: 'no-store',
   });
   const json = await res.json().catch(() => null);
+  if (!res.ok) return NextResponse.json(idpErrorEnvelope(json, 'Passkey sign-in failed'), { status: res.status });
   return NextResponse.json(json ?? { success: false, message: 'Empty upstream response' }, { status: res.status });
 }

package/src/api-handlers/auth/refresh.ts

@@ -40,6 +40,7 @@ import { getSession as getBetterAuthSession } from '../../server/auth';
 import { getSession, updateSession, acquireRefreshLock, releaseRefreshLock, checkRefreshLock } from '../../lib/session-store';
 import { computeTokenExpiries } from '../../lib/token-expiry';
 import { extractKidFromToken } from '../../auth/utils/token-utils';
+import { tokenLogId } from '../../lib/token-log-id';
 
 interface RefreshConfig {
   idpBaseUrl: string;
@@ -168,7 +169,7 @@ export function createRefreshHandler(config: RefreshConfig) {
       console.log('║                    REFRESH TOKEN ATTEMPT - PRE-FLIGHT                        ║');
       console.log('╠══════════════════════════════════════════════════════════════════════════════╣');
       console.log(`║ User: ${(userId || 'unknown').substring(0, 50).padEnd(50)}                   ║`);
-      console.log(`║ Session: ${sessionToken.substring(0, 8)}...                                                        ║`);
+      console.log(`║ Session: ${tokenLogId(sessionToken)}                                                        ║`);
       console.log('╠──────────────────────────────────────────────────────────────────────────────╣');
       console.log(`║ Access Token Expires In:  ${String(accessTokenExpiresIn).padEnd(10)} seconds                            ║`);
       console.log(`║ Refresh Token Age:        ${String(refreshTokenAge).padEnd(10)} seconds                            ║`);
@@ -520,12 +521,19 @@ export function createRefreshHandler(config: RefreshConfig) {
           console.error(`║ ${whyItFailed.substring(0, 76).padEnd(76)} ║`);
           console.error('╠──────────────────────────────────────────────────────────────────────────────╣');
           console.error(`║ User:           ${(userId || 'unknown').substring(0, 60).padEnd(60)}║`);
-          console.error(`║ Session:        ${sessionToken.substring(0, 8)}...                                                     ║`);
+          console.error(`║ Session:        ${tokenLogId(sessionToken)}                                                     ║`);
           console.error(`║ Resolution:     ${(resolution || 'Check IDP logs').substring(0, 60).padEnd(60)}║`);
           console.error('╚══════════════════════════════════════════════════════════════════════════════╝');
 
-          // Also log the full response for detailed debugging
-          console.error('[AUTH_REFRESH] Full IDP error response:', JSON.stringify(responseData, null, 2).substring(0, 1000));
+          // NEVER the raw envelope (DotNetPert-Scout, PR 139 review / mail 58691): this used to print
+          // a stringified dump of responseData (first 1000 chars) - the same whole IDP body the :618
+          // "unsuccessful" branch stopped logging. The box above already carries status, code and
+          // flags; add envelope SHAPE only (key names), never values.
+          console.error('[AUTH_REFRESH] IDP error response shape', {
+            bodyKeys: responseData && typeof responseData === 'object' ? Object.keys(responseData) : undefined,
+            errorKeys: idpError && typeof idpError === 'object' ? Object.keys(idpError) : undefined,
+            errorHasMessage: !!idpError.message,
+          });
 
           // If IDP signals to discard token, clear it from Redis
           if (discardToken) {
@@ -541,7 +549,7 @@ export function createRefreshHandler(config: RefreshConfig) {
                 reason: 'IDP_DISCARD_TOKEN',
                 errorCode,
                 userId,
-                sessionToken: sessionToken.substring(0, 8) + '...',
+                sessionToken: tokenLogId(sessionToken),
                 hadRefreshToken: !!currentSession.idpRefreshToken,
                 stack: new Error().stack
               });
@@ -585,7 +593,16 @@ export function createRefreshHandler(config: RefreshConfig) {
                             Object.prototype.hasOwnProperty.call(responseData, 'meta');
 
         if (!isCompliant) {
-          console.error('[AUTH_REFRESH] Upstream non-compliant IDP response', { bodySample: responseData });
+          // NEVER the raw body (DotNetPert-Scout, mail 58678): a non-compliant response has an
+          // UNKNOWN shape by definition, so there is no basis to assume it is free of tokens or
+          // other IDP-side secrets. Log shape metadata only - same "kind, never value" reasoning
+          // as the session-store.ts / refresh.ts REFRESH_TOKEN_REMOVAL fixes in PR 138.
+          console.error('[AUTH_REFRESH] Upstream non-compliant IDP response', {
+            bodyType: typeof responseData,
+            bodyKeys: responseData && typeof responseData === 'object' ? Object.keys(responseData) : undefined,
+            hasSuccessKey: !!(responseData && typeof responseData === 'object' && Object.prototype.hasOwnProperty.call(responseData, 'success')),
+            hasMetaKey: !!(responseData && typeof responseData === 'object' && Object.prototype.hasOwnProperty.call(responseData, 'meta')),
+          });
           return NextResponse.json({
             error: 'Upstream non-compliance',
             code: 'UPSTREAM_SERVICE_ERROR',
@@ -601,10 +618,17 @@ export function createRefreshHandler(config: RefreshConfig) {
           const discardToken = idpError.discard_token === true;
           const retryable = idpError.retryable === true;
 
+          // NEVER the raw envelope (DotNetPert-Scout, mail 58678): `responseData` here is the
+          // WHOLE IDP response body, and its `error` sub-object's contents are not something this
+          // handler controls or has audited - printing it wholesale would ship whatever the IDP
+          // decided to put there straight to the log sink. Log the fields THIS handler already
+          // extracts and acts on (retryable, plus envelope-shape flags for diagnosis) instead.
           console.warn('[AUTH_REFRESH] IDP refresh unsuccessful', {
             code: errorCode,
             discardToken,
-            body: responseData
+            retryable,
+            errorHasMessage: !!idpError.message,
+            errorKeys: Object.keys(idpError),
           });
 
           if (discardToken) {
@@ -612,7 +636,7 @@ export function createRefreshHandler(config: RefreshConfig) {
               reason: 'IDP_SUCCESS_FALSE_DISCARD',
               errorCode,
               userId,
-              sessionToken: sessionToken.substring(0, 8) + '...',
+              sessionToken: tokenLogId(sessionToken),
               hadRefreshToken: !!currentSession.idpRefreshToken,
               stack: new Error().stack
             });
@@ -698,9 +722,12 @@ export function createRefreshHandler(config: RefreshConfig) {
           console.error('[AUTH_REFRESH] ⚠️ REFRESH_TOKEN_REMOVAL: No new refresh token in IDP response', {
             reason: 'NO_NEW_REFRESH_TOKEN_IN_RESPONSE',
             userId,
-            sessionToken: sessionToken.substring(0, 8) + '...',
+            sessionToken: tokenLogId(sessionToken),
             hadRefreshToken: true,
-            refreshTokenFromResponse: refreshToken,
+            // Kind only, never the value (credential). This branch runs when refreshToken is not a
+            // non-empty string, so the old raw value was almost always empty - but a token-shaped
+            // non-string would have been printed. refreshTokenType below already carries the kind.
+            refreshTokenFromResponsePresent: refreshToken !== undefined && refreshToken !== null && refreshToken !== '',
             refreshTokenType: typeof refreshToken,
             payloadKeys: Object.keys(payload || {}),
             stack: new Error().stack
@@ -752,7 +779,7 @@ export function createRefreshHandler(config: RefreshConfig) {
           expiresAt: new Date(accessTokenExpires).toISOString(),
           userId,
           hasNewRefreshToken: hasNewRefresh,
-          tokenPreview: accessToken ? accessToken.substring(0, 20) + '...' : 'none'
+          hasAccessToken: !!accessToken // PAY-1427: was tokenPreview (first 20 chars of the new access token)
         });
 
       } catch (error) {