@payez/next-mvp 4.4.4 → 4.4.6

package/src/server/decode-session.ts

@@ -7,12 +7,14 @@
 
 import 'server-only';
 import { cookies } from 'next/headers';
-import { jwtVerify, type JWTPayload } from 'jose';
+import { type JWTPayload } from 'jose';
 import { getSession, type SessionData } from '../lib/session-store';
 import { getIDPClientConfig } from '../lib/idp-client-config';
 import { getSessionCookieName, getSecureSessionCookieName } from '../lib/app-slug';
 import { ensureInitialized } from '../lib/startup-init';
 import { extractSessionTokenFromCookieValue } from '../lib/session-cookie-shape';
+import { resolveVerifiedSessionCookie } from './verified-session-token';
+import { tokenLogId } from '../lib/token-log-id';
 
 export interface DecodedSession {
   sessionData: SessionData;
@@ -137,7 +139,7 @@ async function tryBetterAuthSession(
     if (!idpTokens?.roles?.length) {
       console.warn(
         '[DECODE-SESSION] Leg 1 declining: idpTokens unusable (no roles) for session',
-        result.session.token.substring(0, 10),
+        tokenLogId(result.session.token),
         '— falling through to the sess: leg'
       );
       return null;
@@ -252,32 +254,20 @@ export async function decodeSession(
     // death, because the ONLY fallback was structurally blind to the only
     // shape it would ever be handed.
     //
-    // Check the shape FIRST. A BA-hmac cookie skips jose entirely and goes
-    // straight to the Redis-canonical liveness check below — same posture
-    // as the JWS path always had (no signature re-check here either; Redis
-    // presence is the authority). A JWS-shaped cookie (legacy NextAuth-era,
-    // if any still linger) keeps the original jwtVerify path unchanged.
+    // PAY-1476: the shape still decides HOW to verify, but BOTH shapes are now
+    // verified, by the shared resolver. This branch used to take a BA-hmac
+    // cookie's token with no signature check ("Redis presence is the
+    // authority"), so `{leaked token}.{anything}` authenticated here - including
+    // behind the portal's admin API gate. The resolver checks the HMAC with
+    // timingSafeEqual (ba-hmac) or runs jwtVerify (jws) against the same
+    // env-first auth secret, and returns null on any failure.
     const shaped = extractSessionTokenFromCookieValue(cookieValue);
-
-    let sessionToken: string | undefined;
-    let payload: JWTPayload | undefined;
-
-    if (shaped?.shape === 'ba-hmac') {
-      sessionToken = shaped.token;
-    } else {
-      const secretKey = new TextEncoder().encode(secret);
-      try {
-        const result = await jwtVerify(cookieValue, secretKey);
-        payload = result.payload;
-      } catch (jwtError) {
-        console.warn('[DECODE-SESSION] JWT verification failed:', jwtError instanceof Error ? jwtError.message : String(jwtError));
-        return null;
-      }
-      sessionToken = (payload as any).sessionToken || (payload as any).redisSessionId;
-    }
+    const verified = await resolveVerifiedSessionCookie(cookieValue);
+    const sessionToken = verified?.token;
+    const payload: JWTPayload | undefined = verified?.payload;
 
     if (!sessionToken) {
-      console.warn('[DECODE-SESSION] No sessionToken resolved from cookie (shape:', shaped?.shape ?? 'unrecognized', ')');
+      console.warn('[DECODE-SESSION] Session cookie did not verify (shape:', shaped?.shape ?? 'unrecognized', ')');
       return null;
     }
 
@@ -292,7 +282,7 @@ export async function decodeSession(
       // fixing a silent path.
       console.warn(
         '[DECODE-SESSION] No sess: record for token',
-        sessionToken.substring(0, 10),
+        tokenLogId(sessionToken),
         '— no fallback available, session will be signed out'
       );
       return null;

package/src/server/verified-session-token.ts

@@ -0,0 +1,103 @@
+/**
+ * PAY-1476 / card 372275 (R941 s1b) - THE ONE SHARED VERIFIED RESOLVER for a session token taken from a cookie.
+ *
+ * THE DEFECT (4.4.5, measured at the deployed portal by QAPert-NightHawk, mail 59030):
+ *   Module A  server/decode-session.ts  the ba-hmac branch took `{token}.{anything}` and used segment 0 unread.
+ *   Module B  server/auth.ts  Path B    took the token from ANY recognised shape and never verified anything;
+ *                                       a forged JWS resolved there too.
+ * Both then treated "a Redis record exists" as the validation. So a leaked session token string was a bearer
+ * credential with no signature needed, including on the portal's admin API gate (api-admin-gate -> decodeSession).
+ *
+ * THE RULE THIS MODULE ENFORCES: a cookie yields a session token ONLY after its signature checks out against
+ * the auth secret. Every caller that turns a cookie into a token for the session store awaits this function.
+ * lib/session-cookie-shape.ts stays classification-only and secret-free (it cannot verify, by construction).
+ *
+ *   ba-hmac  `{token}.{sig}` as Better Auth mints it (better-call signCookieValue): sig =
+ *            base64(HMAC-SHA256(secret, token)), standard padding, 44 characters. Compared with
+ *            crypto.timingSafeEqual over equal-length buffers.
+ *   jws      legacy NextAuth-era cookie: jose jwtVerify with the same secret, then the sessionToken
+ *            (or redisSessionId) claim.
+ *   anything else, a missing secret, or a failed check -> null. Never throws.
+ *
+ * THE SECRET is the auth secret from getIDPClientConfig(), which resolves env-first (BETTER_AUTH_SECRET,
+ * NEXTAUTH_SECRET, then IdP config; PAY-1460). The cookie HMAC key IS the auth secret, so the resolver and the
+ * config loader cannot disagree about which secret signs sessions (BAPert 59034).
+ */
+import { createHmac, timingSafeEqual } from 'crypto';
+import { jwtVerify, type JWTPayload } from 'jose';
+import { getIDPClientConfig } from '../lib/idp-client-config';
+import { extractSessionCookieValue, extractSessionTokenFromCookieValue } from '../lib/session-cookie-shape';
+
+/** Better Auth's signature: base64 of a 32-byte HMAC-SHA256, padded = 44 chars ending in '='. */
+const BA_SIGNATURE_LENGTH = 44;
+
+async function authSecret(): Promise<string | null> {
+  try {
+    const config = await getIDPClientConfig();
+    return config?.authSecret ? String(config.authSecret) : null;
+  } catch {
+    return null;
+  }
+}
+
+function verifyBaHmac(rawValue: string, secret: string): string | null {
+  const dot = rawValue.lastIndexOf('.');
+  if (dot < 1) return null;
+  const token = rawValue.slice(0, dot);
+  let signature = rawValue.slice(dot + 1);
+  if (signature.includes('%')) {
+    try {
+      signature = decodeURIComponent(signature);
+    } catch {
+      return null;
+    }
+  }
+  if (signature.length !== BA_SIGNATURE_LENGTH || !signature.endsWith('=')) return null;
+  const expected = createHmac('sha256', secret).update(token, 'utf8').digest('base64');
+  const a = Buffer.from(signature, 'utf8');
+  const b = Buffer.from(expected, 'utf8');
+  if (a.length !== b.length) return null;
+  return timingSafeEqual(a, b) ? token : null;
+}
+
+export interface VerifiedSessionCookie {
+  token: string;
+  shape: 'ba-hmac' | 'jws';
+  /** The verified JWS payload (jws shape only). */
+  payload?: JWTPayload;
+}
+
+async function verifyJws(rawValue: string, secret: string): Promise<VerifiedSessionCookie | null> {
+  try {
+    const { payload } = await jwtVerify(rawValue, new TextEncoder().encode(secret));
+    const claim = (payload as Record<string, unknown>).sessionToken ?? (payload as Record<string, unknown>).redisSessionId;
+    return typeof claim === 'string' && claim ? { token: claim, shape: 'jws', payload } : null;
+  } catch {
+    return null;
+  }
+}
+
+/** The verified session cookie (token, shape, JWS payload), or null unless its signature verifies. */
+export async function resolveVerifiedSessionCookie(rawValue: string | null | undefined): Promise<VerifiedSessionCookie | null> {
+  if (!rawValue) return null;
+  const shaped = extractSessionTokenFromCookieValue(rawValue);
+  if (!shaped) return null;
+  const secret = await authSecret();
+  if (!secret) return null;
+  if (shaped.shape === 'ba-hmac') {
+    const token = verifyBaHmac(rawValue, secret);
+    return token ? { token, shape: 'ba-hmac' } : null;
+  }
+  return verifyJws(rawValue, secret);
+}
+
+/** The session token carried by a raw session-cookie value, or null unless its signature verifies. */
+export async function resolveVerifiedSessionToken(rawValue: string | null | undefined): Promise<string | null> {
+  const verified = await resolveVerifiedSessionCookie(rawValue);
+  return verified ? verified.token : null;
+}
+
+/** Same, reading the session cookie (every name it is minted under, chunks joined) from a Request. */
+export async function resolveVerifiedSessionTokenFromRequest(request: Request): Promise<string | null> {
+  return resolveVerifiedSessionToken(extractSessionCookieValue(request));
+}

package/src/stores/authStore.ts

@@ -26,6 +26,7 @@ import {
   getCsrfCookieName,
   getSecureCsrfCookieName
 } from '../lib/app-slug';
+import { tokenLogId } from '../lib/token-log-id';
 
 // ===============================
 // INTERFACES & TYPES
@@ -484,19 +485,28 @@ export const useAuthStore = create<AuthStore>()(
 
       forceLogoutAndRedirect: async (reason: string) => {
         const state = get();
-        
+        // Same truncation convention as the server-side session logs (session-store.ts,
+        // refresh.ts): a session token is a bearer credential, and this line goes to the
+        // browser console (and whatever aggregates authLogger client-side) - full value
+        // was leftover debug logging (DotNetPert-Scout, mail 58678).
+        // PAY-1505: the ternary that used to stand here fell back to the RAW token on its false arm.
+        // Safe only by the unenforced property that the arm is reached when the token is falsy -
+        // exactly the shape the source guard exists to refuse. tokenLogId already answers 'none'
+        // for an absent token, so the fallback is not needed.
+        const sessionTokenPrefix = tokenLogId(state.session?.sessionToken);
+
         // AGGRESSIVE LOGGING TO TRACK EXECUTION
         console.error('🚨 FORCE LOGOUT INITIATED 🚨', {
           reason,
           userId: state.user?.id,
-          sessionToken: state.session?.sessionToken,
+          sessionToken: sessionTokenPrefix,
           timestamp: new Date().toISOString()
         });
-        
+
         authLogger.error('[AuthStore] Force logout initiated', {
           reason,
           userId: state.user?.id,
-          sessionToken: state.session?.sessionToken
+          sessionToken: sessionTokenPrefix
         });
         
         try {
@@ -1870,7 +1880,8 @@ export const useAuthStore = create<AuthStore>()(
         
         // If this event is about the current user, update their state
         if (data.userId === state.user?.id && state.session) {
-          authLogger.info('[AuthStore] Updating current user state from SignalR:', data);
+          // PAY-1427: the event is user state; log its shape, not its contents.
+          authLogger.info('[AuthStore] Updating current user state from SignalR:', { keys: Object.keys(data || {}) });
           // ... user state update logic would go here
         }
       },

package/src/types/recovery.ts

@@ -1,4 +1,4 @@
-export type RecoveryStep = 'initiate' | 'select-method' | 'verify-code' | 'set-password' | 'complete';
+export type RecoveryStep = 'initiate' | 'select-method' | 'verify-code' | 'set-password' | 'requested' | 'complete';
 
 export interface RecoverySession {
   recoveryToken: string;

package/src/utils/api.ts

@@ -1,6 +1,7 @@
 import { ENV_CONFIG, API_ENDPOINTS } from '../config/env';
 import { TwoFactorMethod } from '../types/security';
 import { standardizedApi, isApiSuccess, isApiError, extractApiData } from '../lib/standardized-client-api';
+import { knownPasswordRules, passwordRuleSentences } from '../lib/password-rules';
 
 export class ApiError extends Error {
     type: string;
@@ -96,6 +97,35 @@ export async function apiFetch<T>(url: string, options: ApiOptions = {}): Promis
 // DELETED: apiFetchAuth - Use clientApi from @/lib/client-api instead for proper token refresh handling
 
 // Account API for masked info and 2FA
+/**
+ * PAY-1591: what the user reads when the LAST recovery step fails. Four outcomes, told apart only by codes the IdP really sends
+ * (see resetFailureText): a password-policy refusal names the failed rules; an explicit expired/used token says so and links back
+ * to recovery; any other 400/422 gets a neutral 'check the requirements and try again' (the user's recovery session is kept); and
+ * a server or transport failure gets a retry sentence. None of them is the old fixed "Failed to reset password".
+ */
+export const RECOVERY_EXPIRED_TEXT = 'This reset link has expired or was already used. Start password recovery again.';
+
+export const RESET_NEUTRAL_TEXT = "We couldn't set that password. Check it meets the requirements shown and try again.";
+
+/**
+ * Three tiers for a 400/422 from reset (rigpert 60822, QAPert 60820), decided ONLY on codes the IdP actually sends:
+ *   policy        details.code password_policy (projected by the handler as password_policy) -> the rule sentences
+ *   tokenInvalid  an EXPLICIT expired/used signal (token_expired / token_used / Identity InvalidToken, projected as
+ *                 reset_token_invalid) -> 'link expired, start again'
+ *   anything else -> NEUTRAL, which must NOT tell the user their link is dead: the served IdP sends a weak-password refusal with
+ *                 no code, and 'expired' there loops them after they spent their emailed code. The recovery session is kept, so
+ *                 they can retry.
+ */
+export function resetFailureText(status: number, rules: string[] = [], policy = false, tokenInvalid = false): string {
+    if (status === 400 || status === 422) {
+        if (tokenInvalid && !policy) return RECOVERY_EXPIRED_TEXT;
+        if (!policy) return RESET_NEUTRAL_TEXT;
+        const base = "That password wasn't accepted.";
+        return rules.length ? `${base} ${passwordRuleSentences(rules)}` : `${base} Try a different one; the rules are shown above.`;
+    }
+    return "We couldn't reset your password just now. Please try again.";
+}
+
 export class AccountApi {
     /**
      * Get masked user info (email, phone, authenticator status)
@@ -116,18 +146,16 @@ export class AccountApi {
         // Empty body: user info comes from JWT token
         const result = await standardizedApi.post<any>('/api/account/masked-info', {}, accessToken);
 
+        // PAY-1427: masked email/phone are still user data - log the response shape, never its values.
         console.log('[DEBUG] getMaskedInfo result:', {
             success: isApiSuccess(result),
             hasData: isApiSuccess(result) && !!result.data,
-            rawData: isApiSuccess(result) ? result.data : null,
             dataFields: isApiSuccess(result) && result.data ? Object.keys(result.data) : []
         });
 
-        console.log('[DEBUG] getMaskedInfo raw data structure:', JSON.stringify(isApiSuccess(result) ? result.data : result, null, 2));
-
         if (!isApiSuccess(result)) {
             const errorMessage = isApiError(result) ? result.message : 'Failed to get masked info';
-            console.error('[DEBUG] getMaskedInfo failed:', result);
+            console.error('[DEBUG] getMaskedInfo failed:', { keys: result && typeof result === 'object' ? Object.keys(result) : typeof result });
             throw new ApiError(errorMessage, result);
         }
         // Use only snake_case fields from backend response
@@ -149,6 +177,8 @@ export class AccountApi {
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ email }),
         });
+        // PAY-1588: a throttled caller (429) must look exactly like an unknown one - no session, no distinguishing error.
+        if (res.status === 429) return { success: false, data: {} } as any;
         if (!res.ok) throw new Error('Failed to initiate recovery');
         return res.json();
     }
@@ -193,12 +223,21 @@ export class AccountApi {
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({
                 email,
-                password_reset_token: resetToken,
+                token: resetToken,
                 new_password: newPassword,
                 confirm_password: confirmPassword,
             }),
         });
-        if (!res.ok) throw new Error('Failed to reset password');
+        if (!res.ok) {
+            const body = await res.json().catch(() => null);
+            const policy = !!body?.password_policy;
+            const rules = knownPasswordRules(body?.password_policy?.rules);
+            const tokenInvalid = body?.reset_token_invalid === true;
+            const err = new Error(resetFailureText(res.status, rules, policy, tokenInvalid)) as Error & { rules?: string[]; code?: string };
+            if (rules.length) err.rules = rules;
+            if ((res.status === 400 || res.status === 422) && tokenInvalid && !policy) err.code = 'RECOVERY_EXPIRED';
+            throw err;
+        }
         return res.json();
     }
 
@@ -210,8 +249,8 @@ export class AccountApi {
             body: JSON.stringify({
                 email: data.email,
                 token: data.token,
-                password: data.password,
-                password_confirmation: data.password_confirmation
+                new_password: data.password,
+                confirm_password: data.password_confirmation
             })
         })
         const result = await res.json().catch(() => ({}))

package/src/vibe/sessions.ts

@@ -116,7 +116,8 @@ async function vibeProxyRequest<T>(
 
     if (!response.ok) {
       const errorText = await response.text();
-      console.error(`[vibe-sessions] Proxy error ${response.status}:`, errorText);
+      // PAY-1427: never the raw proxy body - the request carried a Bearer token and an error page can echo it.
+      console.error(`[vibe-sessions] Proxy error ${response.status}:`, { bodyLength: errorText.length });
       return null;
     }