@payez/next-mvp 4.4.4 → 4.4.6

package/src/components/admin/SessionsTab.tsx

@@ -45,6 +45,13 @@ export interface SessionsTabProps {
 // COMPONENT
 // -----------------------------------------------------------------------------
 
+// PAY-1429: admin handlers return a fixed message plus a correlationId (never upstream or
+// exception text). Surface the id so an admin can quote it to an operator.
+function errorWithRef(data: any, fallback: string): string {
+  const msg = typeof data?.error === 'string' ? data.error : fallback;
+  return data?.correlationId ? `${msg} (ref ${data.correlationId})` : msg;
+}
+
 export function SessionsTab({ isDark = true, apiBasePath = '/api/admin/sessions' }: SessionsTabProps) {
   const [sessions, setSessions] = useState<LoginSession[]>([]);
   const [isLoading, setIsLoading] = useState(false);
@@ -80,7 +87,7 @@ export function SessionsTab({ isDark = true, apiBasePath = '/api/admin/sessions'
         setSessions(data.sessions || []);
         setLastRefresh(new Date());
       } else {
-        setError(data.error || 'Failed to fetch sessions');
+        setError(errorWithRef(data, 'Failed to fetch sessions'));
       }
     } catch (err) {
       setError('Network error. Please try again.');
@@ -132,7 +139,7 @@ export function SessionsTab({ isDark = true, apiBasePath = '/api/admin/sessions'
         await fetchSessions();
         await fetchStats();
       } else {
-        alert(data.error || 'Failed to revoke session');
+        alert(errorWithRef(data, 'Failed to revoke session'));
       }
     } catch (err) {
       alert('Network error. Please try again.');
@@ -162,7 +169,7 @@ export function SessionsTab({ isDark = true, apiBasePath = '/api/admin/sessions'
         await fetchSessions();
         await fetchStats();
       } else {
-        alert(data.error || 'Failed to revoke sessions');
+        alert(errorWithRef(data, 'Failed to revoke sessions'));
       }
     } catch (err) {
       alert('Network error. Please try again.');

package/src/components/recovery/RequestedStep.tsx

@@ -0,0 +1,30 @@
+'use client';
+
+import React from 'react';
+
+interface Props {
+  onGoToLogin: () => void;
+}
+
+/**
+ * PAY-1588 (rigpert 60711): what a caller sees when the recovery request produced NO recovery session - an unknown
+ * address, a locked account, a throttled caller. ONE sentence, identical for all of them, so the screen cannot be used
+ * to tell which. It must not claim a reset happened (that is CompleteStep, reached only after a successful reset) and it
+ * must not name a cause.
+ */
+export function RequestedStep({ onGoToLogin }: Props) {
+  return (
+    <div className="bg-white border border-gray-300 rounded p-8 text-center">
+      <h2 className="text-2xl font-semibold text-gray-900 mb-2">Check your email</h2>
+
+      <p className="text-gray-600 mb-6">If an account exists for that email, we've sent instructions to reset your password.</p>
+
+      <button
+        onClick={onGoToLogin}
+        className="w-full py-2 px-4 border border-gray-300 rounded text-gray-900 font-medium hover:bg-gray-50 focus:outline-none focus:ring-2 focus:ring-gray-400"
+      >
+        Back to sign in
+      </button>
+    </div>
+  );
+}

package/src/components/recovery/SetPasswordStep.tsx

@@ -1,6 +1,8 @@
 'use client';
 
-import React, { useState } from 'react';
+import React, { useEffect, useState } from 'react';
+import { usePasswordValidation } from '../../hooks/usePasswordValidation';
+import { passwordRulesText } from '../../lib/password-rules';
 
 interface Props {
   onSubmit: (password: string, confirmPassword: string) => void;
@@ -15,6 +17,14 @@ export function SetPasswordStep({ onSubmit, loading }: Props) {
 
   const passwordsMatch = password === confirmPassword && password !== '';
 
+  // PAY-1591: ADVISORY only. It shows the rules and what is missing; it never disables submit, because the validator
+  // may be down and the IdP is the authority (a dead validator must not trap a user who already spent their code).
+  const { setPassword: validateAsYouType, policy, failedRequirements } = usePasswordValidation();
+  // The policy only comes back with a validation, so ask once on mount with a one-character probe (it never leaves the
+  // policy question; the answer is what the rules line is built from). Until it lands the line says the rules are coming.
+  useEffect(() => { validateAsYouType('a'); }, [validateAsYouType]);
+  const missing = failedRequirements.filter((r) => !/^(Unable to validate|Password validation)/i.test(r));
+
   const handleSubmit = (e: React.FormEvent) => {
     e.preventDefault();
     if (passwordsMatch) {
@@ -25,9 +35,12 @@ export function SetPasswordStep({ onSubmit, loading }: Props) {
   return (
     <div className="bg-white border border-gray-300 rounded p-8">
       <h2 className="text-xl font-semibold text-gray-900 mb-2">Set New Password</h2>
-      <p className="text-sm text-gray-600 mb-6">
+      <p className="text-sm text-gray-600 mb-2">
         Choose a strong password for your account.
       </p>
+      <p data-testid="password-rules" className="text-sm text-gray-700 mb-6">
+        {passwordRulesText(policy)}
+      </p>
 
       <form onSubmit={handleSubmit} className="space-y-4">
         <div>
@@ -39,7 +52,7 @@ export function SetPasswordStep({ onSubmit, loading }: Props) {
               type={showPassword ? 'text' : 'password'}
               id="password"
               value={password}
-              onChange={(e) => setPassword(e.target.value)}
+              onChange={(e) => { setPassword(e.target.value); validateAsYouType(e.target.value); }}
               required
               disabled={loading}
               className="w-full px-3 py-2 border border-gray-300 rounded focus:ring-2 focus:ring-gray-900 focus:outline-none disabled:opacity-50 disabled:bg-gray-50 pr-10"
@@ -78,6 +91,14 @@ export function SetPasswordStep({ onSubmit, loading }: Props) {
           </div>
         </div>
 
+        {password && missing.length > 0 && (
+          <ul data-testid="password-missing" className="text-sm text-gray-700 list-disc pl-5">
+            {missing.map((r) => (
+              <li key={r}>{r}</li>
+            ))}
+          </ul>
+        )}
+
         {!passwordsMatch && confirmPassword && (
           <div className="bg-red-50 border border-red-200 rounded p-3">
             <p className="text-red-700 text-sm">Passwords do not match</p>

package/src/hooks/useViabilitySession.ts

@@ -43,7 +43,8 @@ export interface ViabilityState {
 
 interface ViabilityResponse {
   authenticated: boolean;
-  sessionToken?: string;
+  /** PAY-1481: tokenLogId of the session token (correlation only); the token itself is never returned. */
+  sessionTokenId?: string | null;
   requires2FA?: boolean;
   twoFactorComplete?: boolean;
   accessTokenExpired?: boolean;

package/src/lib/app-slug.ts

@@ -27,6 +27,56 @@ export function getAppSlug(): string {
   return cachedSlug;
 }
 
+/**
+ * The session cookie name has TWO producers: better-auth mints `${idpConfig.clientSlug || getAppSlug()}.session-token`, while
+ * the gate and every reader use getSessionCookieName() = getAppSlug() = APP_SLUG || CLIENT_ID. When the IdP's slug is known and
+ * differs, the gate looks for a cookie that was never set and every better-auth (Google) session bounces to
+ * /sign-in?error=SessionInvalid straight after a successful 2FA (rigpert 60743, live on :4797 with CLIENT_ID=idp-admin-ui-graft
+ * against clientSlug idp_admin_ui_graft). FAIL CLOSED: refuse rather than run with two names. No IdP slug -> nothing to compare.
+ */
+export function slugMismatchReason(idpClientSlug: string | null | undefined): string | null {
+  if (!idpClientSlug) return null;
+  const gateSlug = getAppSlug();
+  return idpClientSlug !== gateSlug ? `SLUG_MISMATCH: cookie=${idpClientSlug} gate=${gateSlug}` : null;
+}
+
+/**
+ * rigpert 60813: when the IdP returns NO client slug for this app (an unknown client: the config fetch failed or came back
+ * without one), startup must fail LOUD. Silently defaulting would run with a cookie name nobody verified against the IdP. The
+ * startup path swallows a failed config fetch when BETTER_AUTH_SECRET is supplied by env, so without this an unregistered
+ * CLIENT_ID (e.g. payez_idp_customer_web, absent on dev-93) would boot 'fine'.
+ */
+export function assertIdpSlugKnown(idpClientSlug: string | null | undefined): void {
+  if (idpClientSlug) return;
+  throw new Error(
+    `[FATAL] The IdP returned no client slug for this app (gate slug "${getAppSlug()}"). Either CLIENT_ID/APP_SLUG names a client ` +
+      `the IdP does not know, or its config could not be fetched. Refusing to start with an unverified session cookie name.`,
+  );
+}
+
+/**
+ * The health-endpoint view: a mismatch is always reportable; an UNKNOWN slug is reported only once startup has actually been
+ * attempted (before that nothing is known yet and health must not go red on a pod that has not started initialising).
+ */
+export function slugStateReason(idpClientSlug: string | null | undefined, startupAttempted: boolean): string | null {
+  const mismatch = slugMismatchReason(idpClientSlug);
+  if (mismatch) return mismatch;
+  if (startupAttempted && !idpClientSlug) return `SLUG_UNKNOWN: the IdP returned no client slug for this app gate=${getAppSlug()}`;
+  return null;
+}
+
+export function assertAppSlugMatchesIdp(idpClientSlug: string | null | undefined): void {
+  if (!idpClientSlug) return;
+  const gateSlug = getAppSlug();
+  if (slugMismatchReason(idpClientSlug) !== null) {
+    throw new Error(
+      `[FATAL] Session cookie name would have two sources: the IdP client slug is "${idpClientSlug}" but this app's slug ` +
+        `(APP_SLUG, else CLIENT_ID) is "${gateSlug}". better-auth would set "${idpClientSlug}.session-token" while the gate reads ` +
+        `"${gateSlug}.session-token", so every better-auth session would be rejected. Set APP_SLUG (or CLIENT_ID) to "${idpClientSlug}".`,
+    );
+  }
+}
+
 /**
  * Clears the cached slug (useful for testing).
  */

package/src/lib/ensure-fresh-access-token.ts

@@ -46,6 +46,32 @@ export type EnsureFreshResult =
       accessTokenExpires: number;
       /** True if we refreshed (or a concurrent refresh completed); false if the stored token was already fresh. */
       refreshed: boolean;
+      /**
+       * CARD 320072. Is the token in THIS result actually in the session store?
+       *
+       * ON THIS BRANCH OF THE UNION IT IS ALWAYS `true`, AND THAT IS THE POINT.
+       * Every `ok: true` return either read the token back from the store or
+       * wrote it and confirmed the write. An unpersisted refresh does not reach
+       * an `ok: true` result at all — it returns `ok:false, SESSION_PERSIST_FAILED`
+       * from the other branch below.
+       *
+       * READ THIS BEFORE YOU DELETE THE FIELD. It is declared `boolean` rather
+       * than the literal `true` on purpose: it is the assertable witness that the
+       * escalation is still wired. If someone later re-weakens the persist site
+       * back to reporting success, this field is where that regression becomes
+       * visible to a test instead of invisible to everyone. Cases 2 and 7 in
+       * test/ensure-fresh-persist-failure.test.cjs assert on it.
+       *
+       * WHAT THIS COMMENT USED TO SAY, AND WHY IT IS GONE. It documented `false`
+       * as a live value on an ok:true result — "we hold a valid token that was
+       * not persisted" — because that WAS the contract before this merge, when
+       * the dropped write was reported as a success with a flag on it. Blending
+       * in the escalation made that sentence describe a state the code can no
+       * longer produce. A docblock asserting an impossible semantic is exactly
+       * the defect f5ac6dc3 was written to fix, one file over; reproducing it
+       * here while merging that fix would be absurd.
+       */
+      persisted: boolean;
     }
   | {
       ok: false;
@@ -113,7 +139,8 @@ export async function ensureFreshAccessToken(
   const msUntilExpiry = effectiveExpires - now;
 
   if (msUntilExpiry > safetyWindowMs) {
-    return { ok: true, accessToken: storedToken, accessTokenExpires: effectiveExpires, refreshed: false };
+    // Durable by construction: this token came OUT of the store and we wrote nothing.
+    return { ok: true, accessToken: storedToken, accessTokenExpires: effectiveExpires, refreshed: false, persisted: true };
   }
 
   if (!session.idpRefreshToken) {
@@ -152,6 +179,8 @@ export async function ensureFreshAccessToken(
                 accessToken: after.idpAccessToken,
                 accessTokenExpires: after.idpAccessTokenExpires,
                 refreshed: true,
+                // Read back from the store after the winner's refresh - durable.
+                persisted: true,
               };
             }
           }
@@ -188,6 +217,8 @@ export async function ensureFreshAccessToken(
           accessToken: latest.idpAccessToken,
           accessTokenExpires: latest.idpAccessTokenExpires,
           refreshed: true,
+          // Post-lock re-read: another caller already refreshed and stored this.
+          persisted: true,
         };
       }
     }
@@ -276,12 +307,37 @@ export async function ensureFreshAccessToken(
         const tokenUnchanged =
           !!sentRefreshToken && postRefresh?.idpRefreshToken === sentRefreshToken;
         if (tokenUnchanged) {
-          await updateSession(sessionToken, {
+          /**
+           * 320072: this is the OTHER updateSession call in this file, and it
+           * does NOT escalate on a null return the way the persist site below
+           * does. Checked, not overlooked: reaching here requires
+           * `tokenUnchanged`, which requires `postRefresh?.idpRefreshToken` to
+           * equal the token we sent — so the CAS read three lines up already
+           * proved the row exists. A missing row makes tokenUnchanged false and
+           * routes to the else branch instead, so the dropped-write path is
+           * very nearly unreachable here.
+           *
+           * "Very nearly" is why the return IS still captured. The residual both
+           * halves of this merge identified is real: the row can expire between
+           * that CAS read and this write, in which case the dead refresh token is
+           * NOT cleared and the "we discarded it" claim in the error below is
+           * false. That costs nothing to observe and cannot be inferred from any
+           * other line, so it is warned rather than assumed — see `if (!cleared)`
+           * immediately below. The RESULT is unchanged either way: the session is
+           * unusable and we return the same non-ok payload.
+           */
+          const cleared = await updateSession(sessionToken, {
             idpRefreshToken: '',
             idpRefreshTokenExpires: undefined,
             refreshTokenClearedAt: Date.now(),
             refreshTokenClearedReason: `IDP_DISCARD_TOKEN:${code}`,
           });
+          if (!cleared) {
+            console.warn('[ENSURE-FRESH] discard-token clear did not persist - no canonical session row', {
+              code,
+              requestId,
+            });
+          }
         } else {
           // Concurrent refresh already rotated the token — our 401 is stale. Return the
           // freshly-rotated token directly so the loser succeeds without a retry round-trip
@@ -293,6 +349,8 @@ export async function ensureFreshAccessToken(
               accessToken: postRefresh.idpAccessToken,
               accessTokenExpires: postRefresh.idpAccessTokenExpires,
               refreshed: true,
+              // `postRefresh` is a store read, so this token is by definition stored.
+              persisted: true,
             };
           }
         }
@@ -351,7 +409,14 @@ export async function ensureFreshAccessToken(
     const hasNewRefresh = typeof newRefresh === 'string' && newRefresh.length > 0;
     const newKid = extractKidFromToken(newAccess);
 
-    await updateSession(sessionToken, {
+    // *** CARD 320072. CAPTURE THIS RETURN. ***
+    // `updateSession` returns null - and writes nothing - when the canonical
+    // session row is missing, which happens whenever the BA fallback above is what
+    // resolved this session. Discarding the return is what let this function
+    // report `ok:true, refreshed:true` for a refresh it had just thrown away.
+    // The full rationale for what we DO about it is at the `if (!persisted)`
+    // block below; this line only makes the answer available.
+    const persisted = await updateSession(sessionToken, {
       ...session,
       idpAccessToken: newAccess,
       idpAccessTokenExpires: accessTokenExpires,
@@ -371,7 +436,71 @@ export async function ensureFreshAccessToken(
       mfaValidityHours: decoded?.mfa_validity_hours ? parseInt(decoded.mfa_validity_hours) : session.mfaValidityHours,
     });
 
-    return { ok: true, accessToken: newAccess, accessTokenExpires, refreshed: true };
+    /**
+     * 320072: DO NOT REPORT SUCCESS FOR A WRITE THAT WAS DISCARDED.
+     *
+     * `updateSession` returns null when the canonical session row is absent,
+     * which silently throws away EVERYTHING above — the new access token, the
+     * rotated refresh token, decodedAccessToken, authenticationMethods,
+     * mfaVerified, mfaCompletedAt, mfaExpiresAt. This return value was
+     * previously ignored, and the line below then reported
+     * `ok: true, refreshed: true`.
+     *
+     * WHY THAT IS WORSE THAN A PLAIN LOST WRITE. By this point the exchange at
+     * the IDP has ALREADY HAPPENED, so if refresh tokens are single-use the
+     * token we sent is now spent and its replacement is the thing we just
+     * dropped. The stored credential is therefore dead, and every later attempt
+     * re-sends that same dead token and fails. The user is bounced to LOGIN —
+     * not to verify-code — with nothing in the logs naming the cause.
+     *
+     * It did not even surface as a wrong answer to our one caller: server/auth.ts
+     * calls getRedisSession immediately after us, which is this same `getSession`,
+     * so it finds the same missing row and returns a generic NO_SESSION one frame
+     * later. The false `ok: true` was thus invisible AND the real cause — a
+     * dropped persist — was reported as an unrelated missing session.
+     *
+     * Naming it here is the point: the failure is reported at its true cause,
+     * with a code that says the refresh succeeded and the PERSIST is what
+     * failed. Not retryable — retrying burns another refresh token the same way.
+     *
+     * This is the card's option (b), deliberately. Option (a) — teaching
+     * updateSession to write through to whichever store holds the session,
+     * mirroring the read fallback above — is the better end state but changes
+     * write-path storage semantics for every caller, which is not this card.
+     *
+     * AND IT IS ALSO LOGGED, WHICH IS NOT THE SAME THING (BAPert R1134 §7,
+     * re-affirmed in R1145 §2c). Returning a named code tells the CALLER. §7
+     * requires that `persisted:false` reach a log A HUMAN READS, because the one
+     * caller — server/auth.ts — converts every non-ok result into the same
+     * generic 401 and keeps no record of which code produced it. Without this
+     * line the distinction we just bought at the type level is erased one frame
+     * later and no operator ever sees the word PERSIST. The escalation is the
+     * contract; the warn is the evidence.
+     */
+    if (!persisted) {
+      console.warn('[ENSURE-FRESH] refresh succeeded but was NOT persisted - no canonical session row', {
+        requestId,
+        refreshTokenRotated: hasNewRefresh,
+        persisted: false,
+      });
+      return {
+        ok: false,
+        code: 'SESSION_PERSIST_FAILED',
+        message:
+          'Token refresh succeeded at the IDP but the session could not be persisted; the rotated tokens were discarded.',
+        status: 401,
+        terminal: true,
+        retryable: false,
+        discardToken: true,
+        resolution: 'REAUTHENTICATE',
+      };
+    }
+
+    // `persisted: true` is not decoration and not a leftover: the `if` above is
+    // the only way out for a dropped write, so by construction anything reaching
+    // this line WAS written. Keeping the field keeps the ok:true branch of
+    // EnsureFreshResult total (Cases 2 and 7 assert on it) — BAPert R1145 §2d.
+    return { ok: true, accessToken: newAccess, accessTokenExpires, refreshed: true, persisted: true };
   } finally {
     if (weHoldLock) {
       await releaseRefreshLock(sessionToken, requestId, releaseVersion);

package/src/lib/idp-client-config.ts

@@ -166,6 +166,75 @@ const OPERATOR_AUTH_SECRET = process.env.BETTER_AUTH_SECRET;
 const OPERATOR_NEXTAUTH_SECRET = process.env.NEXTAUTH_SECRET;
 let operatorOverrideLogged = false;
 
+// ============================================================================
+// PAY-1460 - SECRETS ARE ENV-FIRST
+// ============================================================================
+/**
+ * The IdP serves the signing secret and every OAuth provider client secret in the client config, to any
+ * caller holding a client assertion (PAY-1460). It cannot stop serving them while this package depends on
+ * them: every earlier version throws FATAL on an empty config authSecret, whatever the environment says.
+ *
+ * So both are now resolved ENV FIRST, config second:
+ *   signing secret   BETTER_AUTH_SECRET (canonical), NEXTAUTH_SECRET (legacy alias), then config authSecret.
+ *                    Uses the module-load snapshot above: this module publishes the config value into
+ *                    process.env, so a live read would mistake the IdP's value for the operator's.
+ *   provider secret  <PROVIDER>_CLIENT_SECRET, provider name upper-cased with non-alphanumerics as '_'
+ *                    (GOOGLE_CLIENT_SECRET, APPLE_CLIENT_SECRET, MICROSOFT_CLIENT_SECRET), then config.
+ *
+ * The FATAL on an empty signing secret is unchanged and still load-bearing: it now fires only when BOTH the
+ * environment and the config are empty.
+ *
+ * Values are never logged. The SOURCE of each is logged once per change. An env-sourced value is never
+ * written to the Redis config cache (stripEnvSecrets); a cache read re-applies the environment.
+ */
+export type SecretSource = string; // 'env:<VAR>' | 'idp-config' | 'none'
+
+export function providerSecretEnvVar(provider: string): string {
+    return `${String(provider).trim().toUpperCase().replace(/[^A-Z0-9]+/g, '_')}_CLIENT_SECRET`;
+}
+
+const loggedSecretSources = new Map<string, SecretSource>();
+function logSecretSource(what: string, source: SecretSource): void {
+    if (loggedSecretSources.get(what) === source) return;
+    loggedSecretSources.set(what, source);
+    console.log(`[IDP_CONFIG] ${what} source: ${source}`);
+}
+
+function resolveAuthSecret(fromConfig: string | undefined): { value: string; source: SecretSource } {
+    if (OPERATOR_AUTH_SECRET) return { value: OPERATOR_AUTH_SECRET, source: 'env:BETTER_AUTH_SECRET' };
+    if (OPERATOR_NEXTAUTH_SECRET) return { value: OPERATOR_NEXTAUTH_SECRET, source: 'env:NEXTAUTH_SECRET' };
+    if (fromConfig) return { value: fromConfig, source: 'idp-config' };
+    return { value: '', source: 'none' };
+}
+
+/** A copy of `config` with every secret resolved env-first. Never mutates (the argument may be cached). */
+function applyEnvSecrets(config: IDPClientConfig): IDPClientConfig {
+    const auth = resolveAuthSecret(config.authSecret);
+    logSecretSource('authSecret', auth.source);
+    return {
+        ...config,
+        authSecret: auth.value,
+        oauthProviders: (config.oauthProviders ?? []).map((p) => {
+            const envVar = providerSecretEnvVar(p.provider);
+            const fromEnv = process.env[envVar];
+            const source: SecretSource = fromEnv ? `env:${envVar}` : p.clientSecret ? 'idp-config' : 'none';
+            logSecretSource(`${p.provider} clientSecret`, source);
+            return { ...p, clientSecret: fromEnv || p.clientSecret };
+        }),
+    };
+}
+
+/** What may be persisted to Redis: env-sourced secrets are blanked (the environment re-supplies them on read). */
+function stripEnvSecrets(config: IDPClientConfig): IDPClientConfig {
+    return {
+        ...config,
+        authSecret: OPERATOR_AUTH_SECRET || OPERATOR_NEXTAUTH_SECRET ? '' : config.authSecret,
+        oauthProviders: (config.oauthProviders ?? []).map((p) =>
+            process.env[providerSecretEnvVar(p.provider)] ? { ...p, clientSecret: '' } : p
+        ),
+    };
+}
+
 /** Publish the resolved auth secret WITHOUT ever overwriting an operator-set value. */
 function publishAuthSecret(value: string, source: string): void {
     if (OPERATOR_AUTH_SECRET) {
@@ -294,7 +363,8 @@ async function setConfigInRedis(config: IDPClientConfig): Promise<void> {
         const key = getRedisConfigKey();
         const ttlSeconds = config.configCacheTtlSeconds || 300;
         const data: RedisCachedConfig = {
-            config,
+            // PAY-1460: never persist a secret the environment supplied.
+            config: stripEnvSecrets(config),
             expiresAt: Date.now() + (ttlSeconds * 1000)
         };
         // Store with TTL slightly longer than the logical expiry to allow for clock skew
@@ -355,7 +425,10 @@ export async function getIDPClientConfig(forceRefresh: boolean = false): Promise
 
     // Layer 2: Check Redis cache (skip if forceRefresh - startup should always get fresh data)
     if (!forceRefresh) {
-        const redisConfig = await getConfigFromRedis();
+        // PAY-1460: a cached entry never carries env-sourced secrets (stripEnvSecrets), so the
+        // environment is re-applied on read, BEFORE the emptiness test below.
+        const cachedRaw = await getConfigFromRedis();
+        const redisConfig = cachedRaw ? applyEnvSecrets(cachedRaw) : null;
         // A cached entry is only USABLE if it carries a secret — see the note
         // below. `redisConfig && !authSecret` must behave like a cache MISS, so
         // the emptiness test belongs here, in the condition that gates the
@@ -505,7 +578,7 @@ export async function getIDPClientConfig(forceRefresh: boolean = false): Promise
                 // This throw is what stops that. It is also what turned the
                 // 2026-08-05 nextauth_secret spelling bug into a loud FATAL instead
                 // of a silently forgeable app.
-                throw new Error('[IDP_CONFIG] FATAL: IDP did not return authSecret');
+                throw new Error('[IDP_CONFIG] FATAL: IDP did not return authSecret and neither BETTER_AUTH_SECRET nor NEXTAUTH_SECRET is set');
             }
 
             // Validated above — only now is it safe to cache or publish.
@@ -588,7 +661,7 @@ async function fetchConfigFromInternalIDP(internalIdpUrl: string, clientIdStr: s
 
     if (!resp.ok) {
         const txt = await resp.text().catch(() => 'Unknown error');
-        throw new Error(`[IDP_CONFIG] FATAL: Internal IDP returned ${resp.status} - ${txt}`);
+        throw new Error(`[IDP_CONFIG] FATAL: Internal IDP returned ${resp.status} (body ${txt.length} chars)`); // PAY-1427
     }
 
     const body: any = await resp.json().catch(() => null);
@@ -603,7 +676,7 @@ async function fetchConfigFromInternalIDP(internalIdpUrl: string, clientIdStr: s
         throw new Error(`[IDP_CONFIG] FATAL: Internal IDP response missing clientId. Got: ${JSON.stringify(Object.keys(configData))}`);
     }
 
-    const config: IDPClientConfig = {
+    const config: IDPClientConfig = applyEnvSecrets({
         clientId: String(rawClientId),
         clientSlug: configData.clientSlug ?? configData.client_slug ?? configData.slug ?? '',
         // Wire compatibility: accept new authSecret first, fall back to legacy
@@ -669,13 +742,13 @@ async function fetchConfigFromInternalIDP(internalIdpUrl: string, clientIdStr: s
             logoUrl: configData.branding?.logoUrl ?? configData.branding?.logo_url
         },
         baseClientUrl: configData.baseClientUrl ?? configData.base_client_url ?? configData.BaseClientUrl
-    };
+    });
 
     if (!config.authSecret) {
         // LOAD-BEARING — see the note on the external path's equivalent throw.
         // An empty secret reaching betterAuth() becomes the PUBLIC default, not an
         // error. Never replace this with a fallback.
-        throw new Error('[IDP_CONFIG] FATAL: Internal IDP did not return authSecret');
+        throw new Error('[IDP_CONFIG] FATAL: Internal IDP did not return authSecret and neither BETTER_AUTH_SECRET nor NEXTAUTH_SECRET is set');
     }
 
     console.log(`[IDP_CONFIG] Internal IDP config loaded for ${clientIdStr}`);
@@ -751,7 +824,8 @@ async function fetchConfigFromIDP(idpUrl: string, clientIdStr: string): Promise<
 
     if (!signingResp.ok) {
         const txt = await signingResp.text().catch(() => 'Unknown error');
-        throw new Error(`[IDP_CONFIG] FATAL: Failed to sign client assertion: ${signingResp.status} - ${txt}`);
+        // PAY-1427: the thrown message is logged by callers - body length only, never the upstream text.
+        throw new Error(`[IDP_CONFIG] FATAL: Failed to sign client assertion: ${signingResp.status} (body ${txt.length} chars)`);
     }
 
     const signingBody: any = await signingResp.json().catch(() => null);
@@ -768,7 +842,8 @@ async function fetchConfigFromIDP(idpUrl: string, clientIdStr: string): Promise<
     ) as string | undefined;
 
     if (!client_assertion) {
-        console.error('[IDP_CONFIG] FATAL: Full response body:', JSON.stringify(signingBody, null, 2));
+        // PAY-1427: never the full sign-client-assertion body (assertion material). Key names only.
+        console.error('[IDP_CONFIG] FATAL: sign-client-assertion response shape:', { keys: Object.keys(signingBody || {}), dataKeys: Object.keys(signingBody?.data || {}) });
         throw new Error(`[IDP_CONFIG] FATAL: IDP response missing client_assertion. Got keys: ${JSON.stringify(Object.keys(signingBody?.data || signingBody || {}))}`);
     }
 
@@ -789,7 +864,7 @@ async function fetchConfigFromIDP(idpUrl: string, clientIdStr: string): Promise<
 
     if (!configResp.ok) {
         const txt = await configResp.text().catch(() => 'Unknown error');
-        throw new Error(`[IDP_CONFIG] FATAL: Failed to fetch client config: ${configResp.status} - ${txt}`);
+        throw new Error(`[IDP_CONFIG] FATAL: Failed to fetch client config: ${configResp.status} (body ${txt.length} chars)`);
     }
 
     const configBody: any = await configResp.json().catch(() => null);
@@ -802,7 +877,8 @@ async function fetchConfigFromIDP(idpUrl: string, clientIdStr: string): Promise<
     const configData = configBody?.data;
 
     if (!configData || typeof configData !== 'object') {
-        console.error('[IDP_CONFIG] FATAL: Full config response body:', JSON.stringify(configBody, null, 2));
+        // PAY-1427: never the full client-config body (client configuration / provider secrets). Key names only.
+        console.error('[IDP_CONFIG] FATAL: client-config response shape:', { keys: Object.keys(configBody || {}) });
         throw new Error('[IDP_CONFIG] FATAL: IDP client-config response missing data envelope');
     }
 
@@ -815,7 +891,7 @@ async function fetchConfigFromIDP(idpUrl: string, clientIdStr: string): Promise<
     // Map response to our interface (IDP returns camelCase or snake_case).
     // Wire compatibility: accept new authSecret first, fall back to legacy
     // nextAuthSecret/next_auth_secret while IDP rename rolls out.
-    const config: IDPClientConfig = {
+    const config: IDPClientConfig = applyEnvSecrets({
         clientId: String(rawClientId),
         clientSlug: configData.clientSlug ?? configData.client_slug ?? configData.slug ?? '',
         authSecret:
@@ -889,7 +965,7 @@ async function fetchConfigFromIDP(idpUrl: string, clientIdStr: string): Promise<
             logoUrl: configData.branding?.logoUrl ?? configData.branding?.logo_url
         },
         baseClientUrl: configData.baseClientUrl ?? configData.base_client_url ?? configData.BaseClientUrl
-    };
+    });
 
     // Debug: log what we got for baseClientUrl
     console.log(`[IDP_CONFIG] Parsed baseClientUrl:`, config.baseClientUrl, `| raw keys:`, Object.keys(configData).filter(k => k.toLowerCase().includes('client')));
@@ -901,7 +977,7 @@ async function fetchConfigFromIDP(idpUrl: string, clientIdStr: string): Promise<
     if (!config.authSecret) {
         // LOAD-BEARING — empty must fail here, never downstream. betterAuth()
         // silently substitutes a public constant for an empty secret.
-        throw new Error('[IDP_CONFIG] FATAL: authSecret is empty after parsing');
+        throw new Error('[IDP_CONFIG] FATAL: authSecret is empty after parsing and neither BETTER_AUTH_SECRET nor NEXTAUTH_SECRET is set');
     }
 
     // Success - reset failure tracking

package/src/lib/idp-fetch.ts

@@ -58,7 +58,7 @@ async function ensureFreshAccessToken(req: NextRequest): Promise<{ sessionToken?
   const sessionToken = (token?.sessionToken || token?.redisSessionId) as string | undefined;
   console.log('[IDP_FETCH] ensureFreshAccessToken:', {
     hasToken: !!token,
-    sessionToken: sessionToken?.substring(0, 20) + '...',
+    hasSessionToken: !!sessionToken, // PAY-1427 / BAPert 58829: no token material in logs, not even a stub (was a 20-char prefix)
     pathname: req.nextUrl.pathname
   });
   if (!sessionToken) {