@payez/next-mvp 4.4.4 → 4.4.6

package/src/pages/test-env/JwtInspectPage.tsx

@@ -2,6 +2,7 @@
 
 import { authClient } from '../../client/better-auth-client';
 import { useState, useEffect } from 'react';
+import { maskToken, redactCredentials } from './redact-credentials';
 
 // Decode JWT header (contains kid, alg, typ)
 function decodeJwtHeader(token: string): any {
@@ -70,7 +71,6 @@ export function JwtInspectPage() {
   const { data: sessionData, isPending } = authClient.useSession();
   const session = sessionData;
   const status = isPending ? 'loading' : session ? 'authenticated' : 'unauthenticated';
-  const [copied, setCopied] = useState<string | null>(null);
   const [isDarkMode, setIsDarkMode] = useState(false);
   const [jwtHeader, setJwtHeader] = useState<any>(null);
   const [jwtPayload, setJwtPayload] = useState<any>(null);
@@ -109,116 +109,10 @@ export function JwtInspectPage() {
     }
   }, [serverSession, session]);
 
-  // 248991 item 3 (QAPert 35021) - CREDENTIALS ARE REDACTED UNTIL DELIBERATELY
-  // REVEALED.
-  //
-  // Before this, loading the page put a live session token on screen and one
-  // click from the clipboard. That is the precondition the 246007 finding needs
-  // ("a caller who knows a session token can act on a session it does not own"),
-  // so this page was the supply side of the attack the same package was being
-  // hardened against. A screen-share, a screenshot or a support call was enough.
-  //
-  // The fix is deliberately NOT removing the tokens or the copy button: replaying
-  // a bearer in curl is the entire reason this tool exists, and a debug tool that
-  // cannot show you the thing you are debugging just gets replaced by a worse
-  // ad-hoc one. What changes is that exposure now requires an INTENTIONAL ACT per
-  // token, so the default state of a loaded page - the state a bystander, a
-  // screen-share or a screenshot captures - carries no usable credential.
-  //
-  // NOTE: this is a UI affordance, not an access control. Anyone who can load
-  // this page can still click reveal, and the values are in the network response
-  // either way. It shrinks accidental disclosure; it does not gate the route.
-  // The gate is mounting - see this file's docstring and index.ts.
-  const [revealed, setRevealed] = useState<Record<string, boolean>>({});
-
-  const maskToken = (value: string): string => {
-    if (value.length <= 12) return '\u2022'.repeat(Math.max(value.length, 8));
-    return `${value.slice(0, 6)}${'\u2022'.repeat(12)}${value.slice(-4)}  (${value.length} chars, hidden)`;
-  };
-
-  // Keys whose STRING values are live credentials. Anchored at the END of the key
-  // name on purpose: it catches sessionToken / accessToken / refreshToken /
-  // idpRefreshToken, while deliberately NOT catching the metadata beside them -
-  // accessTokenExpires, idpAccessTokenExpires, tokenType - which are safe and are
-  // the fields you actually want when debugging an expiry problem.
-  const CREDENTIAL_KEY = /(token|secret|password|apikey|credential)$/i;
-
-  // VALUE-SHAPE checks, because a key-name sweep has a blind spot that this page
-  // is squarely in: a credential under an innocuous key. Scout hit the same class
-  // elsewhere today (35297) - a postgres URL whose only key-name hit was a
-  // POINTER to the secret, while the actual password sat in the URL value and the
-  // sweep scored the file SAFE. Here the equivalents are a raw JWT parked under
-  // `jwt` / `bearer` / `authorization` / `cookie` - none of which end in `token`.
-  //
-  // JWT: three base64url segments. The length floors matter - without them
-  // "4.1.42" matches the three-segment shape and the package version would render
-  // as a redacted credential, which teaches people the redactor is broken.
-  const looksLikeJwt = (v: string): boolean => {
-    if (v.length < 40) return false;
-    const parts = v.split('.');
-    return parts.length === 3 && parts.every((p) => p.length >= 8 && /^[A-Za-z0-9_-]+$/.test(p));
-  };
-
-  // scheme://user:password@host - redact ONLY the password and keep the rest, so
-  // the URL stays usable for debugging. Masking the whole value would hide which
-  // host you are pointed at, which is usually the thing you opened this page for.
-  const URL_WITH_USERINFO = /^([a-z][a-z0-9+.-]*:\/\/)([^/\s:@]+):([^/\s@]+)@/i;
-
-  // Third value-shape check, on DotNetPert-Scout's 251951 rule: "a content-pattern
-  // sweep CANNOT find a credential that has no pattern." A PEM block defeats BOTH
-  // checks above and the key-name check as well - it has no key=value pair, its key
-  // name is usually something innocuous like `cert`, `pem`, `chain` or `data`, it is
-  // not three base64url segments so looksLikeJwt rejects it, and it is not a URL.
-  // He found a live wildcard TLS private key that had sat committed for 215 days for
-  // exactly this reason: it was never in anyone's search space, missed by
-  // construction rather than by carelessness.
-  //
-  // HONEST SCOPE: this is defence-in-depth, not a measured exposure. I have not seen
-  // PEM material in a session object and would not expect to. It is here because this
-  // dump renders WHATEVER the session carries, and the entire lesson of the two
-  // previous hardenings on this function is that the next credential arrives in a
-  // shape the current checks were not written for. Matching the armour band rather
-  // than the payload costs one regex.
-  // Matches the PEM ARMOUR BAND itself rather than enumerating key types. A first
-  // draft listed PRIVATE KEY / CERTIFICATE / RSA / EC / OPENSSH / PGP and a test
-  // caught it missing plain "-----BEGIN CERTIFICATE-----", because that header has
-  // no space before the closing dashes while "-----BEGIN RSA PRIVATE KEY-----" does.
-  // Enumerating the payload types is the same mistake as enumerating credential key
-  // names, one level down: it only ever covers the shapes already thought of.
-  // Requiring an alphanumeric after "BEGIN " keeps prose containing the word, and a
-  // bare "-----BEGIN-----", from matching.
-  const PEM_BLOCK = /-----BEGIN [A-Z0-9][A-Z0-9 ]*-----/;
-
-  // 248991 item 3, SECOND HALF. The masked fields above were only half the fix:
-  // the Raw Session Data block below re-rendered the SAME tokens in plain text via
-  // JSON.stringify, one click away behind a neutral "Click to expand" summary - and
-  // with them idpRefreshToken, which has NO other raw surface on this page (it is
-  // rendered as a boolean at the Refresh Token row precisely because it is the
-  // longest-lived credential of the three). Redacting per-field while dumping the
-  // whole object verbatim is not a partial fix, it is the appearance of one.
-  const redactCredentials = (value: unknown, keyName = ''): unknown => {
-    if (Array.isArray(value)) return value.map((v) => redactCredentials(v));
-    if (value && typeof value === 'object') {
-      return Object.fromEntries(
-        Object.entries(value as Record<string, unknown>).map(([k, v]) => [k, redactCredentials(v, k)]),
-      );
-    }
-    if (typeof value !== 'string' || value.length === 0) return value;
-    if (CREDENTIAL_KEY.test(keyName)) return maskToken(value);
-    // Key-name matching alone is not enough (DotNetPert-Scout 35297): a credential
-    // can sit under a key that is not credential-shaped at all. Two value-shape
-    // checks close the cases that actually reach a session object:
-    if (looksLikeJwt(value)) return maskToken(value);
-    if (PEM_BLOCK.test(value)) return '••• PEM block redacted (' + value.length + ' chars) •••';
-    if (URL_WITH_USERINFO.test(value)) return value.replace(URL_WITH_USERINFO, '$1$2:•••••@');
-    return value;
-  };
-
-  const copyToClipboard = (text: string, label: string) => {
-    navigator.clipboard.writeText(text);
-    setCopied(label);
-    setTimeout(() => setCopied(null), 2000);
-  };
+  // PAY-1470 (BAPert rulings 59022, 59040): credentials are shown as tokenLogId + length ONLY. The Reveal toggles
+  // (per token and for the raw session JSON) and the Copy buttons are gone: "never renders token material"
+  // includes click-to-reveal, because a full bearer one click away on a prod-reachable page is the same defect.
+  // The redaction rules (key names, JWT / PEM / URL-password shapes) live in ./redact-credentials.
 
   if (status === 'loading') {
     return (
@@ -371,58 +265,18 @@ export function JwtInspectPage() {
             <div>
               <div className="flex items-center justify-between mb-2">
                 <span className={labelClass}>Session Token (Redis Key):</span>
-                {displayExt.sessionToken && (
-                  <div className="flex items-center gap-2">
-                    <RevealButton
-                      revealed={!!revealed.session}
-                      onClick={() => setRevealed((r) => ({ ...r, session: !r.session }))}
-                      isDarkMode={isDarkMode}
-                    />
-                    {revealed.session && (
-                      <CopyButton
-                        onClick={() => copyToClipboard(displayExt.sessionToken, 'session')}
-                        copied={copied === 'session'}
-                        isDarkMode={isDarkMode}
-                      />
-                    )}
-                  </div>
-                )}
               </div>
               <code className={`block p-2 rounded text-xs break-all ${isDarkMode ? 'bg-slate-800' : 'bg-gray-100'}`}>
-                {displayExt.sessionToken
-                  ? revealed.session
-                    ? displayExt.sessionToken
-                    : maskToken(displayExt.sessionToken)
-                  : 'N/A'}
+                {displayExt.sessionToken ? maskToken(displayExt.sessionToken) : 'N/A'}
               </code>
             </div>
 
             <div>
               <div className="flex items-center justify-between mb-2">
                 <span className={labelClass}>Access Token (IDP):</span>
-                {displayExt.accessToken && (
-                  <div className="flex items-center gap-2">
-                    <RevealButton
-                      revealed={!!revealed.access}
-                      onClick={() => setRevealed((r) => ({ ...r, access: !r.access }))}
-                      isDarkMode={isDarkMode}
-                    />
-                    {revealed.access && (
-                      <CopyButton
-                        onClick={() => copyToClipboard(displayExt.accessToken, 'access')}
-                        copied={copied === 'access'}
-                        isDarkMode={isDarkMode}
-                      />
-                    )}
-                  </div>
-                )}
               </div>
               <code className={`block p-2 rounded text-xs break-all max-h-24 overflow-auto ${isDarkMode ? 'bg-slate-800' : 'bg-gray-100'}`}>
-                {displayExt.accessToken
-                  ? revealed.access
-                    ? displayExt.accessToken
-                    : maskToken(displayExt.accessToken)
-                  : 'N/A'}
+                {displayExt.accessToken ? maskToken(displayExt.accessToken) : 'N/A'}
               </code>
             </div>
 
@@ -465,7 +319,7 @@ export function JwtInspectPage() {
                   <InfoRow
                     key={key}
                     label={key}
-                    value={typeof value === 'object' ? JSON.stringify(value) : String(value)}
+                    value={typeof value === 'object' ? JSON.stringify(redactCredentials(value)) : String(redactCredentials(value, key))}
                     labelClass={labelClass}
                     valueClass={valueClass}
                   />
@@ -531,26 +385,13 @@ export function JwtInspectPage() {
           <summary className="font-semibold cursor-pointer">
             Raw Session Data &mdash; credentials redacted (Click to expand)
           </summary>
-          <div className="mt-3 flex items-center gap-3">
-            <RevealButton
-              revealed={!!revealed.raw}
-              onClick={() => setRevealed((r) => ({ ...r, raw: !r.raw }))}
-              isDarkMode={isDarkMode}
-            />
+          <div className="mt-3">
             <span className={`text-xs ${labelClass}`}>
-              {revealed.raw
-                ? 'Showing LIVE credentials in plain text, including the refresh token.'
-                : 'Token values are masked. Structure, claims and expiry fields are unchanged.'}
+              Token values are masked. Structure, claims and expiry fields are unchanged.
             </span>
           </div>
           <pre className={`mt-4 text-xs overflow-auto p-3 rounded ${isDarkMode ? 'bg-slate-800' : 'bg-gray-100'}`}>
-            {JSON.stringify(
-              revealed.raw
-                ? { clientSession: session, serverSession: serverSession }
-                : redactCredentials({ clientSession: session, serverSession: serverSession }),
-              null,
-              2,
-            )}
+            {JSON.stringify(redactCredentials({ clientSession: session, serverSession: serverSession }), null, 2)}
           </pre>
         </details>
       </div>
@@ -604,68 +445,5 @@ function StatusBadge({
   );
 }
 
-function CopyButton({
-  onClick,
-  copied,
-  isDarkMode,
-}: {
-  onClick: () => void;
-  copied: boolean;
-  isDarkMode: boolean;
-}) {
-  return (
-    <button
-      onClick={onClick}
-      className={`px-2 py-1 rounded text-xs ${
-        copied
-          ? 'bg-green-600 text-white'
-          : isDarkMode
-            ? 'bg-slate-700 hover:bg-slate-600 text-white'
-            : 'bg-gray-200 hover:bg-gray-300 text-gray-700'
-      }`}
-    >
-      {copied ? 'Copied!' : 'Copy'}
-    </button>
-  );
-}
-
-/**
- * Reveal toggle for a redacted credential (248991 item 3).
- *
- * Deliberately labelled "Reveal token" rather than something neutral like
- * "Show": the label is the last chance to tell whoever is about to click it,
- * possibly while screen-sharing, that a live credential is about to appear.
- */
-function RevealButton({
-  revealed,
-  onClick,
-  isDarkMode,
-}: {
-  revealed: boolean;
-  onClick: () => void;
-  isDarkMode: boolean;
-}) {
-  return (
-    <button
-      onClick={onClick}
-      title={
-        revealed
-          ? 'Hide this credential again'
-          : 'Reveals a LIVE credential in plain text. Not while screen-sharing.'
-      }
-      className={`px-2 py-1 rounded text-xs ${
-        revealed
-          ? isDarkMode
-            ? 'bg-amber-700 hover:bg-amber-600 text-white'
-            : 'bg-amber-200 hover:bg-amber-300 text-amber-900'
-          : isDarkMode
-            ? 'bg-slate-700 hover:bg-slate-600 text-white'
-            : 'bg-gray-200 hover:bg-gray-300 text-gray-700'
-      }`}
-    >
-      {revealed ? 'Hide' : 'Reveal token'}
-    </button>
-  );
-}
 
 export default JwtInspectPage;

package/src/pages/test-env/RefreshTokenPage.tsx

@@ -1,6 +1,9 @@
 "use client";
 import React, { useState, useEffect } from "react";
 import { authClient } from '../../client/better-auth-client';
+// PAY-1470 (BAPert 59022): never render characters of a token, whatever the ENABLE_TEST_ROUTES gate says.
+// idealresume production mounted this page on 4.1.14 (pre-gate) showing 40 chars of both tokens.
+import { redactCredentials } from './redact-credentials';
 
 /**
  * ⚠️ DEBUG PAGE THAT DRIVES A DESTRUCTIVE ENDPOINT — DO NOT MOUNT IN
@@ -112,11 +115,12 @@ export function RefreshTokenPage() {
           <div><span className="text-gray-400">2FA Complete:</span> {String((session?.user as any)?.twoFactorSessionVerified ?? "unknown")}</div>
           <div>
             <span className="text-gray-400">Access Token:</span>{" "}
-            {sessionDetails?.accessToken ? `${sessionDetails.accessToken.substring(0, 40)}...` : "N/A"}
+            {/* PAY-1481: the session route returns presence only. */}
+            {sessionDetails ? (sessionDetails.hasAccessToken ? "present (server-side only)" : "absent") : "N/A"}
           </div>
           <div>
             <span className="text-gray-400">Refresh Token:</span>{" "}
-            {sessionDetails?.refreshToken ? `${sessionDetails.refreshToken.substring(0, 40)}...` : "N/A"}
+            {sessionDetails ? (sessionDetails.hasRefreshToken ? "present (server-side only)" : "absent") : "N/A"}
           </div>
           <div>
             <span className="text-gray-400">Access Expires:</span>{" "}
@@ -154,7 +158,7 @@ export function RefreshTokenPage() {
         <div className="rounded border border-gray-600 bg-gray-800 p-4">
           <h3 className="font-semibold mb-2 text-gray-300">Result:</h3>
           <pre className="text-xs overflow-x-auto whitespace-pre-wrap text-green-400">
-            {JSON.stringify(result, null, 2)}
+            {JSON.stringify(redactCredentials(result), null, 2)}
           </pre>
         </div>
       )}
@@ -163,7 +167,8 @@ export function RefreshTokenPage() {
       <details className="mt-4">
         <summary className="cursor-pointer text-gray-400 hover:text-white">Raw Session Details</summary>
         <pre className="mt-2 text-xs bg-gray-800 p-2 rounded overflow-x-auto text-gray-300">
-          {JSON.stringify(sessionDetails, null, 2)}
+          {/* PAY-1470: this dumped the access AND refresh token in full (Nextpert-Scout 59060). */}
+          {JSON.stringify(redactCredentials(sessionDetails), null, 2)}
         </pre>
       </details>
     </div>

package/src/pages/test-env/redact-credentials.ts

@@ -0,0 +1,96 @@
+/**
+ * redact-credentials - what the test-env debug pages may show of a credential: a stable hash and a length, never
+ * characters of the value (PAY-1470, BAPert rulings 59022 and 59040).
+ *
+ * PAY-1481 item 2 (QAPert, PR 186 review 59083): this was a DENYLIST (keys ending in token/secret/password/...).
+ * Opaque credentials under `tokens.access`, `redisSessionId`, `sid`, `authorization`, `cookie`, `backupCodes[]` and
+ * `code` passed unmasked. It is now an ALLOWLIST: a string is shown only when its key is a known DISPLAYABLE field
+ * (identity, roles, timestamps, provider and flag metadata, standard JWT claims). Every other string - an unknown
+ * key, an array item under an unknown key, a top-level string - becomes maskToken. A new field is hidden until
+ * someone decides it is displayable, which is the safe direction for a page reachable in production builds.
+ *
+ * Kept from the denylist era, and applied EVEN under a displayable key, because a credential can sit under an
+ * innocent name: a JWT (three base64url segments, length floors so "4.1.42" is not one), a PEM armour band, and the
+ * password in scheme://user:password@host. Numbers, booleans and null are never credentials and stay readable.
+ *
+ * There is no Reveal and no copy. "Never renders token material" includes click-to-reveal (59040).
+ */
+import { tokenLogId } from '../../lib/token-log-id';
+
+/** A stable, non-reversible stand-in for a credential: `h:<12 hex>  (<n> chars, hidden)`. */
+export function maskToken(value: string): string {
+  return `${tokenLogId(value)}  (${value.length} chars, hidden)`;
+}
+
+/**
+ * Keys whose string values are displayable. Exact names (case-insensitive), plus timestamp / flag suffix patterns.
+ * An exact listed key wins (tokenType is metadata); otherwise a key naming a credential (CREDENTIAL_NAME) is refused.
+ */
+const DISPLAYABLE_KEYS = new Set(
+  [
+    // identity
+    'id', 'userId', 'user_id', 'sub', 'email', 'name', 'given_name', 'family_name', 'preferred_username', 'image',
+    'picture', 'locale', 'phone_number_verified',
+    // authorisation metadata
+    'role', 'roles', 'scope', 'scopes', 'permissions', 'authenticationMethods', 'authenticationLevel', 'amr', 'acr',
+    'oauthProvider', 'provider', 'providerId', 'tokenType', 'token_type', 'type', 'typ', 'alg', 'kid', 'iss', 'aud',
+    'azp', 'jti',
+    // client / tenant
+    'clientId', 'client_id', 'idpClientId', 'clientSlug', 'slug', 'tenant', 'tenantId', 'merchantId', 'appSlug',
+    // result / status fields of the test-env routes
+    'status', 'statusText', 'success', 'action', 'message', 'error', 'reason', 'outcome', 'source', 'shape', 'mode',
+  ].map((k) => k.toLowerCase()),
+);
+/** Timestamps, durations and booleans-as-strings by suffix: expires, accessTokenExpires, mfaCompletedAt, iat... */
+const DISPLAYABLE_SUFFIX = /(expires|_at|iat|exp|nbf|hours|seconds|verified|required|enabled|count|version)$/i;
+/** camelCase timestamps (createdAt, mfaCompletedAt): tested on the ORIGINAL key so `format` / `chat` do not match. */
+const CAMEL_AT = /[a-z0-9]At$/;
+/** A key that names a credential is never displayable, whatever suffix it has (e.g. refreshTokenCreatedAt stays OK
+ *  because it names a TIME; `authorization`, `cookie`, `sid`, `code` are credentials). */
+const CREDENTIAL_NAME = /(token|secret|password|passwd|apikey|api_key|credential|authorization|cookie|^sid$|session_?id$|^code$|codes?$|otp|pin$|signature|private)/i;
+
+const URL_WITH_USERINFO = /^([a-z][a-z0-9+.-]*:\/\/)([^/\s:@]+):([^/\s@]+)@/i;
+const PEM_BLOCK = /-----BEGIN [A-Z0-9][A-Z0-9 ]*-----/;
+
+function looksLikeJwt(v: string): boolean {
+  if (v.length < 40) return false;
+  const parts = v.split('.');
+  return parts.length === 3 && parts.every((p) => p.length >= 8 && /^[A-Za-z0-9_-]+$/.test(p));
+}
+
+/** Is a string under this key displayable? Credential names lose even when a timestamp suffix matches. */
+export function isDisplayableKey(keyName: string): boolean {
+  if (!keyName) return false;
+  const k = keyName.toLowerCase();
+  // 1. An exact, deliberately listed field (tokenType is metadata even though it says "token").
+  if (DISPLAYABLE_KEYS.has(k)) return true;
+  // 2. A key naming a credential is refused - unless what it names is a TIME about it (accessTokenExpires).
+  const namesTime = /(expires|_at|iat|exp|nbf|hours|seconds)$/i.test(k) || CAMEL_AT.test(keyName);
+  if (CREDENTIAL_NAME.test(k) && !namesTime) return false;
+  // 3. Metadata by suffix: timestamps, durations, flags, counts, versions, URLs (userinfo is still masked).
+  return DISPLAYABLE_SUFFIX.test(k) || CAMEL_AT.test(keyName) || /url$/i.test(k);
+}
+
+/** A deep copy of `value` in which every string not under a displayable key is replaced by maskToken. */
+export function redactCredentials(value: unknown, keyName = ''): unknown {
+  // Array items inherit the array's key: backupCodes[] items are credentials, roles[] items are not.
+  if (Array.isArray(value)) return value.map((v) => redactCredentials(v, keyName));
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(
+      Object.entries(value as Record<string, unknown>).map(([k, v]) => [k, redactCredentials(v, k)]),
+    );
+  }
+  // NightHawk (PR 204 review): a numeric OTP / code under a credential-named key is a credential too.
+  if (typeof value === 'number' && keyName && !isDisplayableKey(keyName) && CREDENTIAL_NAME.test(keyName)) {
+    return maskToken(String(value));
+  }
+  if (typeof value !== 'string' || value.length === 0) return value;
+  if (looksLikeJwt(value)) return maskToken(value);
+  if (PEM_BLOCK.test(value)) return '••• PEM block redacted (' + value.length + ' chars) •••';
+  if (!isDisplayableKey(keyName)) return maskToken(value);
+  let shown = value;
+  if (URL_WITH_USERINFO.test(shown)) shown = shown.replace(URL_WITH_USERINFO, '$1$2:•••••@');
+  // NightHawk (PR 204 review): a URL's query and fragment carry tokens (?token=, #access_token=). Names stay, values go.
+  shown = shown.replace(/([?&#][^=&#\s]+=)[^&#\s]*/g, '$1•••');
+  return shown;
+}

package/src/pages/verify-code/page.tsx

@@ -458,7 +458,8 @@ function VerifyCodeForm({ enrollHref }: { enrollHref: string }) {
           if (!updateRes.ok) {
             console.warn('[2FA] update-session returned non-OK status:', updateRes.status);
             const errorData = await updateRes.json();
-            console.warn('[2FA] update-session error:', errorData);
+            // PAY-1427: the request carried access_token/refresh_token; log the error envelope's shape, never its contents.
+            console.warn('[2FA] update-session error:', { keys: errorData && typeof errorData === 'object' ? Object.keys(errorData) : typeof errorData, code: errorData?.error?.code ?? errorData?.code });
           } else {
             console.log('[2FA] Session updated successfully with MFA tokens');
           }

package/src/routes/auth/logout.ts

@@ -25,6 +25,7 @@ import {
   getCallbackUrlCookieName,
 } from '../../lib/app-slug';
 import { siteEvents, getClientIp } from '../../lib/site-logger';
+import { logExceptionWithCorrelation } from '../../lib/safe-error-response';
 
 /**
  * POST /api/auth/logout - Sign out and clean up session
@@ -101,10 +102,11 @@ export async function POST(req: NextRequest) {
 
     return response;
   } catch (error) {
-    console.error('[LOGOUT_ROUTE] Error during logout:', error);
+    const correlationId = logExceptionWithCorrelation('[LOGOUT_ROUTE] Error during logout:', error);
     return NextResponse.json({
       error: 'Failed to logout',
-      details: error instanceof Error ? error.message : 'Unknown error'
+      code: 'INTERNAL_ERROR',
+      correlationId,
     }, { status: 500 });
   }
 }

package/src/routes/auth/session.ts

@@ -16,6 +16,8 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { getSession as getBetterAuthSession } from '../../server/auth';
 import { getSession as getRedisSession, updateSession } from '../../lib/session-store';
+import { logExceptionWithCorrelation } from '../../lib/safe-error-response';
+import { tokenLogId } from '../../lib/token-log-id';
 
 /**
  * GET /api/auth/session - Check current session status
@@ -42,7 +44,7 @@ export async function GET(req: NextRequest) {
       userId: authSession.user?.id,
       email: authSession.user?.email,
       name: authSession.user?.name,
-      redisSessionId: redisSessionId ? redisSessionId.substring(0, 8) + '...' : 'MISSING',
+      redisSessionId: redisSessionId ? tokenLogId(redisSessionId) : 'MISSING',
     });
 
     // Fetch full session data from Redis
@@ -70,7 +72,7 @@ export async function GET(req: NextRequest) {
     if (!session) {
       console.error('[SESSION_ROUTE] Redis session MISS — refusing to report authenticated', {
         userId: authSession.user?.id,
-        redisSessionId: redisSessionId ? redisSessionId.substring(0, 8) + '...' : 'MISSING',
+        redisSessionId: redisSessionId ? tokenLogId(redisSessionId) : 'MISSING',
         reason: redisSessionId ? 'session expired or evicted' : 'no session token on auth session',
       });
       return NextResponse.json({});
@@ -98,20 +100,23 @@ export async function GET(req: NextRequest) {
         idpClientId: session?.idpClientId,
         merchantId: session?.merchantId,
       },
-      // Session tokens
-      sessionToken: redisSessionId,
-      accessToken: session?.idpAccessToken,
-      refreshToken: session?.idpRefreshToken,
+      // PAY-1481 item 1: NO token material. This body is read by browser JS, so returning the session token and the
+      // IdP access/refresh tokens handed them to any script on the page (the refresh token outlives the session).
+      // Server routes read tokens from the session store; the UI only needs presence and expiry.
+      hasAccessToken: !!session?.idpAccessToken,
+      hasRefreshToken: !!session?.idpRefreshToken,
       accessTokenExpires: session?.idpAccessTokenExpires,
       expires: authSession.session?.expiresAt
         ? new Date(authSession.session.expiresAt).toISOString()
         : new Date(Date.now() + 30 * 24 * 60 * 60 * 1000).toISOString(),
     });
   } catch (error) {
-    console.error('[SESSION_ROUTE] Error checking session:', error);
+    // PAY-1438: pre-auth route - the exception text stays in the log, keyed by correlationId.
+    const correlationId = logExceptionWithCorrelation('[SESSION_ROUTE] Error checking session:', error);
     return NextResponse.json({
       error: 'Failed to check session',
-      details: error instanceof Error ? error.message : 'Unknown error'
+      code: 'INTERNAL_ERROR',
+      correlationId,
     }, { status: 500 });
   }
 }
@@ -247,10 +252,11 @@ export async function POST(req: NextRequest) {
       message: 'Session updated successfully'
     });
   } catch (error) {
-    console.error('[SESSION_ROUTE] Error updating session:', error);
+    const correlationId = logExceptionWithCorrelation('[SESSION_ROUTE] Error updating session:', error);
     return NextResponse.json({
       error: 'Failed to update session',
-      details: error instanceof Error ? error.message : 'Unknown error'
+      code: 'INTERNAL_ERROR',
+      correlationId,
     }, { status: 500 });
   }
 }

package/src/routes/auth/viability.ts

@@ -21,6 +21,8 @@ import {
   getBetterAuthSession as getBetterAuthRedisSession,
 } from '../../lib/session-store';
 import { getIDPClientConfig } from '../../lib/idp-client-config';
+import { logExceptionWithCorrelation } from '../../lib/safe-error-response';
+import { tokenLogId } from '../../lib/token-log-id';
 
 /**
  * Get tenant-wide 2FA requirement from cached client config (from broker handshake)
@@ -175,7 +177,7 @@ export async function GET(req: NextRequest) {
         viable: false,
         needsRefresh: false,
         authenticated: false,
-        sessionToken, // Return sessionToken so middleware can detect and clear stale cookie
+        sessionTokenId: tokenLogId(sessionToken), // PAY-1481: a correlation id, never the token; middleware only needs presence to clear the stale cookie
         reason: 'Stale session - cookie exists but session not found in Redis'
       });
     }
@@ -309,7 +311,7 @@ export async function GET(req: NextRequest) {
         viable: true,
         needsRefresh: true,
         authenticated: true,
-        sessionToken,
+        sessionTokenId: sessionToken ? tokenLogId(sessionToken) : null,
         // Clear names for middleware decision-making
         tenantRequiresTwoFactor,
         userHasCompletedTenantTwoFactorRequirements,
@@ -351,7 +353,7 @@ export async function GET(req: NextRequest) {
 
     // DEBUG: Log what we're reading from the session
     console.log('[VIABILITY] Session 2FA state:', {
-      sessionToken: sessionToken?.substring(0, 8) + '...',
+      sessionToken: tokenLogId(sessionToken),
       'session.mfaVerified': session?.mfaVerified,
       'session.twoFactorComplete': (session as any)?.twoFactorComplete,
       mfaVerifiedInSession,
@@ -379,7 +381,7 @@ export async function GET(req: NextRequest) {
         expiresIn: 0,
         hasRefreshToken,
         authenticated: true,
-        sessionToken,
+        sessionTokenId: sessionToken ? tokenLogId(sessionToken) : null,
         // Clear names
         tenantRequiresTwoFactor,
         userHasCompletedTenantTwoFactorRequirements,
@@ -403,7 +405,7 @@ export async function GET(req: NextRequest) {
       expiresIn,
       hasRefreshToken,
       authenticated: true,
-      sessionToken,
+      sessionTokenId: sessionToken ? tokenLogId(sessionToken) : null,
       // Clear names
       tenantRequiresTwoFactor,
       userHasCompletedTenantTwoFactorRequirements,
@@ -420,13 +422,15 @@ export async function GET(req: NextRequest) {
       clientId: resolveClientId(session?.idpClientId),
     });
   } catch (error) {
-    console.error('[VIABILITY_ROUTE] Error checking session viability:', error);
+    // PAY-1438: pre-auth probe - the exception text stays in the log, keyed by correlationId.
+    const correlationId = logExceptionWithCorrelation('[VIABILITY_ROUTE] Error checking session viability:', error);
     return NextResponse.json({
       viable: false,
       needsRefresh: false,
       authenticated: false,
       error: 'Failed to check session',
-      details: error instanceof Error ? error.message : 'Unknown error'
+      code: 'INTERNAL_ERROR',
+      correlationId
     }, { status: 500 });
   }
 }

package/src/server/auth.ts

@@ -13,7 +13,7 @@ import {
   getBetterAuthSession as getBetterAuthRedisSession,
   type SessionData,
 } from '../lib/session-store';
-import { extractSessionTokenFromCookie } from '../lib/session-cookie-shape';
+import { resolveVerifiedSessionTokenFromRequest } from './verified-session-token';
 import { createSingleFlight } from '../lib/single-flight';
 
 let authInstance: ReturnType<typeof createBetterAuthInstance> | null = null;
@@ -172,14 +172,18 @@ export async function getSession(request?: Request): Promise<any> {
     return attachSessionData(betterAuthSession, sessionData, sessionToken);
   }
 
-  // Path B — Better Auth said null/incomplete. Fall back to manual cookie
+  // Path B — Better Auth said null/incomplete. Fall back to a VERIFIED cookie
   // decode + Redis-canonical liveness check. This catches cases where the
   // canonical app session at `{slug}:{token}` is still alive but Better
   // Auth's `ba:{slug}:{token}` secondary record was evicted or the
-  // in-memory cookie cache returned stale-null. No JWT signature check —
-  // Redis lookup is the validation: an attacker forging a session-token
-  // claim hits NO_SESSION because Redis has no matching entry.
-  const sessionToken = extractSessionTokenFromCookie(request);
+  // in-memory cookie cache returned stale-null.
+  //
+  // PAY-1476: this path used to take the token with NO signature check, on the
+  // theory that "Redis lookup is the validation". It is not: a leaked token has
+  // a live record, so the token string alone authenticated, with any garbage in
+  // the signature position, and a forged JWS too. The token now comes only from
+  // the shared verified resolver (HMAC or JWS signature checked first).
+  const sessionToken = await resolveVerifiedSessionTokenFromRequest(request);
   if (!sessionToken) return null;
 
   let sessionData: SessionData | null = null;