@payez/next-mvp 4.4.4 → 4.4.6

package/dist/api-handlers/account/verify-email.js

@@ -15,6 +15,7 @@ const env_1 = require("../../config/env");
 const test_aware_get_token_1 = require("../../lib/test-aware-get-token");
 const session_store_1 = require("../../lib/session-store");
 const jwt_decode_1 = require("../../lib/jwt-decode");
+const two_factor_verify_failure_1 = require("../../lib/two-factor-verify-failure");
 async function POST(req) {
     try {
         // Parse request body
@@ -34,12 +35,9 @@ async function POST(req) {
             body: JSON.stringify({ verification_code: verificationCode }),
         });
         if (!result.ok) {
-            return server_1.NextResponse.json({
-                success: false,
-                error: result.json?.message || 'Verification failed',
-                code: result.json?.code || 'IDP_ERROR',
-                meta: { attemptedRefresh: result.attemptedRefresh },
-            }, { status: result.status });
+            // PAY-1443: never relay the IDP's error text - it arrives as a C# anonymous-object
+            // ToString ("{ message = ... }") on the deployed IDP. Classify it, answer a fixed sentence.
+            return (0, two_factor_verify_failure_1.twoFactorVerifyFailure)(result, 'email');
         }
         // Unwrap IDP envelope
         const unwrappedData = result.json?.data || result.json;

package/dist/api-handlers/account/verify-sms.d.ts

@@ -7,20 +7,4 @@
  * @package @payez/next-mvp
  */
 import { NextRequest, NextResponse } from 'next/server';
-export declare function POST(req: NextRequest): Promise<NextResponse<{
-    success: boolean;
-    error: string;
-    code: string;
-}> | NextResponse<{
-    success: boolean;
-    error: any;
-    code: any;
-    meta: {
-        attemptedRefresh: boolean;
-    };
-}> | NextResponse<{
-    success: boolean;
-    verificationSuccessful: boolean;
-    twoFactorSessionVerified: boolean;
-    message: any;
-}>>;
+export declare function POST(req: NextRequest): Promise<NextResponse<unknown>>;

package/dist/api-handlers/account/verify-sms.js

@@ -15,6 +15,7 @@ const env_1 = require("../../config/env");
 const test_aware_get_token_1 = require("../../lib/test-aware-get-token");
 const session_store_1 = require("../../lib/session-store");
 const jwt_decode_1 = require("../../lib/jwt-decode");
+const two_factor_verify_failure_1 = require("../../lib/two-factor-verify-failure");
 async function POST(req) {
     try {
         // Parse request body
@@ -34,12 +35,9 @@ async function POST(req) {
             body: JSON.stringify({ verification_code: verificationCode }),
         });
         if (!result.ok) {
-            return server_1.NextResponse.json({
-                success: false,
-                error: result.json?.message || 'Verification failed',
-                code: result.json?.code || 'IDP_ERROR',
-                meta: { attemptedRefresh: result.attemptedRefresh },
-            }, { status: result.status });
+            // PAY-1443: never relay the IDP's error text - it arrives as a C# anonymous-object
+            // ToString ("{ message = ... }") on the deployed IDP. Classify it, answer a fixed sentence.
+            return (0, two_factor_verify_failure_1.twoFactorVerifyFailure)(result, 'sms');
         }
         // Unwrap IDP envelope
         const unwrappedData = result.json?.data || result.json;

package/dist/api-handlers/admin/analytics.js

@@ -48,6 +48,7 @@ const auth_1 = require("../../server/auth");
 const startup_init_1 = require("../../lib/startup-init");
 const client_key_1 = require("../../lib/client-key");
 const roles_1 = require("../../lib/roles");
+const crypto_1 = require("crypto");
 async function checkAdminRole(request) {
     const session = await (0, auth_1.getSession)(request);
     if (!session?.user) {
@@ -67,6 +68,9 @@ async function checkAdminRole(request) {
     return { isAdmin: true };
 }
 async function vibeServiceRequest(endpoint, options) {
+    // PAY-1429: `error` can reach the HTTP caller, so it never carries upstream Vibe text or
+    // exception text. Failures return a fixed message + correlationId; the same id is on the
+    // server log line, which carries status + bodyLength only (PAY-1424).
     const idpUrl = process.env.NEXT_PUBLIC_IDP_URL || process.env.IDP_URL;
     const clientId = process.env.VIBE_CLIENT_ID;
     const signingKey = process.env.VIBE_HMAC_KEY;
@@ -105,13 +109,17 @@ async function vibeServiceRequest(endpoint, options) {
             return { ok: true, status: 204, data: null };
         if (!res.ok) {
             const errorText = await res.text();
-            return { ok: false, status: res.status, data: null, error: errorText };
+            const correlationId = (0, crypto_1.randomUUID)();
+            console.error(`[admin/analytics] Vibe request failed: ${options.method} ${endpoint} - ${res.status}`, { correlationId, bodyLength: errorText.length });
+            return { ok: false, status: res.status, data: null, error: `Vibe request failed (HTTP ${res.status})`, correlationId };
         }
         const body = await res.json();
         return { ok: true, status: res.status, data: body };
     }
     catch (error) {
-        return { ok: false, status: 0, data: null, error: String(error) };
+        const correlationId = (0, crypto_1.randomUUID)();
+        console.error(`[admin/analytics] Vibe request exception: ${options.method} ${endpoint}`, { correlationId, error });
+        return { ok: false, status: 0, data: null, error: 'Vibe request could not be completed', correlationId };
     }
 }
 function getCountryFlag(countryCode) {
@@ -175,7 +183,7 @@ function createAnalyticsHandler(config) {
 async function getGeoAnalytics(startDate) {
     const result = await vibeServiceRequest('/v1/collections/vibe_app/tables/login_sessions/query', { method: 'POST', body: { page: 1, pageSize: 5000 } });
     if (!result.ok) {
-        return server_1.NextResponse.json({ error: result.error }, { status: result.status || 500 });
+        return server_1.NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
     }
     const sessions = result.data?.data || result.data?.documents || [];
     const recentSessions = sessions.filter((s) => new Date(s.created_at) >= startDate);
@@ -216,7 +224,7 @@ async function getGeoAnalytics(startDate) {
 async function getLoginAnalytics(startDate) {
     const result = await vibeServiceRequest('/v1/collections/vibe_app/tables/login_sessions/query', { method: 'POST', body: { page: 1, pageSize: 5000 } });
     if (!result.ok) {
-        return server_1.NextResponse.json({ error: result.error }, { status: result.status || 500 });
+        return server_1.NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
     }
     const sessions = result.data?.data || result.data?.documents || [];
     const recentSessions = sessions.filter((s) => new Date(s.created_at) >= startDate);

package/dist/api-handlers/admin/audit.js

@@ -47,6 +47,7 @@ const auth_1 = require("../../server/auth");
 const startup_init_1 = require("../../lib/startup-init");
 const client_key_1 = require("../../lib/client-key");
 const roles_1 = require("../../lib/roles");
+const crypto_1 = require("crypto");
 async function checkAdminRole(request) {
     const session = await (0, auth_1.getSession)(request);
     if (!session?.user) {
@@ -66,6 +67,9 @@ async function checkAdminRole(request) {
     return { isAdmin: true };
 }
 async function vibeServiceRequest(endpoint, options) {
+    // PAY-1429: `error` can reach the HTTP caller, so it never carries upstream Vibe text or
+    // exception text. Failures return a fixed message + correlationId; the same id is on the
+    // server log line, which carries status + bodyLength only (PAY-1424).
     const idpUrl = process.env.NEXT_PUBLIC_IDP_URL || process.env.IDP_URL;
     const clientId = process.env.VIBE_CLIENT_ID;
     const signingKey = process.env.VIBE_HMAC_KEY;
@@ -104,13 +108,17 @@ async function vibeServiceRequest(endpoint, options) {
             return { ok: true, status: 204, data: null };
         if (!res.ok) {
             const errorText = await res.text();
-            return { ok: false, status: res.status, data: null, error: errorText };
+            const correlationId = (0, crypto_1.randomUUID)();
+            console.error(`[admin/audit] Vibe request failed: ${options.method} ${endpoint} - ${res.status}`, { correlationId, bodyLength: errorText.length });
+            return { ok: false, status: res.status, data: null, error: `Vibe request failed (HTTP ${res.status})`, correlationId };
         }
         const body = await res.json();
         return { ok: true, status: res.status, data: body };
     }
     catch (error) {
-        return { ok: false, status: 0, data: null, error: String(error) };
+        const correlationId = (0, crypto_1.randomUUID)();
+        console.error(`[admin/audit] Vibe request exception: ${options.method} ${endpoint}`, { correlationId, error });
+        return { ok: false, status: 0, data: null, error: 'Vibe request could not be completed', correlationId };
     }
 }
 /**
@@ -157,7 +165,7 @@ function createAuditHandler(config) {
             }
             const result = await vibeServiceRequest('/v1/collections/vibe_app/tables/audit_logs/query', { method: 'POST', body: queryBody });
             if (!result.ok) {
-                return server_1.NextResponse.json({ error: result.error }, { status: result.status || 500 });
+                return server_1.NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
             }
             const rawLogs = result.data?.data || result.data?.documents || [];
             const logs = rawLogs.map((log) => ({
@@ -186,7 +194,7 @@ function createAuditHandler(config) {
             if (action === 'stats') {
                 const result = await vibeServiceRequest('/v1/collections/vibe_app/tables/audit_logs/query', { method: 'POST', body: { page: 1, pageSize: 10000 } });
                 if (!result.ok) {
-                    return server_1.NextResponse.json({ error: result.error }, { status: result.status || 500 });
+                    return server_1.NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
                 }
                 const logs = result.data?.data || result.data?.documents || [];
                 const now = new Date();

package/dist/api-handlers/admin/redis-sessions.js

@@ -18,6 +18,8 @@ const server_1 = require("next/server");
 const auth_1 = require("../../server/auth");
 const redis_1 = require("../../lib/redis");
 const roles_1 = require("../../lib/roles");
+const crypto_1 = require("crypto");
+const token_log_id_1 = require("../../lib/token-log-id");
 /**
  * Check if the current user has admin role
  */
@@ -76,7 +78,7 @@ function createRedisSessionsHandler(config) {
                         const sessionToken = key.replace(sessionPrefix, '');
                         sessions.push({
                             id: sessionToken.substring(0, 16), // Truncated for display
-                            session_token: sessionToken.substring(0, 8) + '...', // Masked
+                            session_token: (0, token_log_id_1.tokenLogId)(sessionToken), // Masked
                             user_id: sessionData.userId,
                             user_name: sessionData.name,
                             user_email: sessionData.email,
@@ -112,8 +114,10 @@ function createRedisSessionsHandler(config) {
                 });
             }
             catch (error) {
-                console.error('[admin/redis-sessions] Error:', error);
-                return server_1.NextResponse.json({ error: error.message || 'Internal error' }, { status: 500 });
+                // PAY-1429: exception text (hosts, URLs, driver messages) stays server-side.
+                const correlationId = (0, crypto_1.randomUUID)();
+                console.error('[admin/redis-sessions] Error:', { correlationId, error });
+                return server_1.NextResponse.json({ error: 'Internal error', code: 'INTERNAL_ERROR', correlationId }, { status: 500 });
             }
         },
         async DELETE(request) {
@@ -137,12 +141,14 @@ function createRedisSessionsHandler(config) {
                 return server_1.NextResponse.json({
                     success: true,
                     message: 'Session revoked',
-                    session_token: sessionToken.substring(0, 8) + '...',
+                    session_token: (0, token_log_id_1.tokenLogId)(sessionToken),
                 });
             }
             catch (error) {
-                console.error('[admin/redis-sessions] DELETE Error:', error);
-                return server_1.NextResponse.json({ error: error.message || 'Internal error' }, { status: 500 });
+                // PAY-1429: exception text (hosts, URLs, driver messages) stays server-side.
+                const correlationId = (0, crypto_1.randomUUID)();
+                console.error('[admin/redis-sessions] DELETE Error:', { correlationId, error });
+                return server_1.NextResponse.json({ error: 'Internal error', code: 'INTERNAL_ERROR', correlationId }, { status: 500 });
             }
         },
     };
@@ -195,8 +201,10 @@ function createRedisSessionRevokeHandler(config) {
                 });
             }
             catch (error) {
-                console.error('[admin/redis-sessions/revoke] Error:', error);
-                return server_1.NextResponse.json({ error: error.message || 'Internal error' }, { status: 500 });
+                // PAY-1429: exception text (hosts, URLs, driver messages) stays server-side.
+                const correlationId = (0, crypto_1.randomUUID)();
+                console.error('[admin/redis-sessions/revoke] Error:', { correlationId, error });
+                return server_1.NextResponse.json({ error: 'Internal error', code: 'INTERNAL_ERROR', correlationId }, { status: 500 });
             }
         },
     };

package/dist/api-handlers/admin/sessions.js

@@ -48,6 +48,7 @@ const auth_1 = require("../../server/auth");
 const startup_init_1 = require("../../lib/startup-init");
 const client_key_1 = require("../../lib/client-key");
 const roles_1 = require("../../lib/roles");
+const crypto_1 = require("crypto");
 /**
  * Check if the current user has admin role
  */
@@ -73,6 +74,9 @@ async function checkAdminRole(request) {
  * Make a service account request to Vibe (admin mode)
  */
 async function vibeServiceRequest(endpoint, options) {
+    // PAY-1429: `error` can reach the HTTP caller, so it never carries upstream Vibe text or
+    // exception text. Failures return a fixed message + correlationId; the same id is on the
+    // server log line, which carries status + bodyLength only (PAY-1424).
     const idpUrl = process.env.NEXT_PUBLIC_IDP_URL || process.env.IDP_URL;
     const clientId = process.env.VIBE_CLIENT_ID;
     const signingKey = process.env.VIBE_HMAC_KEY;
@@ -112,13 +116,17 @@ async function vibeServiceRequest(endpoint, options) {
         }
         if (!res.ok) {
             const errorText = await res.text();
-            return { ok: false, status: res.status, data: null, error: errorText };
+            const correlationId = (0, crypto_1.randomUUID)();
+            console.error(`[admin/sessions] Vibe request failed: ${options.method} ${endpoint} - ${res.status}`, { correlationId, bodyLength: errorText.length });
+            return { ok: false, status: res.status, data: null, error: `Vibe request failed (HTTP ${res.status})`, correlationId };
         }
         const body = await res.json();
         return { ok: true, status: res.status, data: body };
     }
     catch (error) {
-        return { ok: false, status: 0, data: null, error: String(error) };
+        const correlationId = (0, crypto_1.randomUUID)();
+        console.error(`[admin/sessions] Vibe request exception: ${options.method} ${endpoint}`, { correlationId, error });
+        return { ok: false, status: 0, data: null, error: 'Vibe request could not be completed', correlationId };
     }
 }
 // Country code to flag emoji mapping
@@ -167,7 +175,7 @@ function createSessionsHandler(config) {
             }
             const result = await vibeServiceRequest('/v1/collections/vibe_app/tables/login_sessions/query', { method: 'POST', body: queryBody });
             if (!result.ok) {
-                return server_1.NextResponse.json({ error: result.error }, { status: result.status || 500 });
+                return server_1.NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
             }
             // Extract sessions from response
             const rawSessions = result.data?.data || result.data?.documents || [];
@@ -202,7 +210,7 @@ function createSessionsHandler(config) {
                 // Get all sessions for stats calculation
                 const result = await vibeServiceRequest('/v1/collections/vibe_app/tables/login_sessions/query', { method: 'POST', body: { page: 1, pageSize: 1000 } });
                 if (!result.ok) {
-                    return server_1.NextResponse.json({ error: result.error }, { status: result.status || 500 });
+                    return server_1.NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
                 }
                 const sessions = result.data?.data || result.data?.documents || [];
                 // Calculate stats
@@ -239,7 +247,7 @@ function createSessionsHandler(config) {
                     },
                 });
                 if (!result.ok) {
-                    return server_1.NextResponse.json({ error: result.error }, { status: result.status || 500 });
+                    return server_1.NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
                 }
                 return server_1.NextResponse.json({ success: true });
             }
@@ -258,7 +266,7 @@ function createSessionsHandler(config) {
                     },
                 });
                 if (!queryResult.ok) {
-                    return server_1.NextResponse.json({ error: queryResult.error }, { status: queryResult.status || 500 });
+                    return server_1.NextResponse.json({ error: queryResult.error, code: 'UPSTREAM_ERROR', correlationId: queryResult.correlationId }, { status: queryResult.status || 500 });
                 }
                 const sessions = queryResult.data?.data || queryResult.data?.documents || [];
                 let revokedCount = 0;

package/dist/api-handlers/admin/site-logs.js

@@ -21,6 +21,7 @@ const server_1 = require("next/server");
 const auth_1 = require("../../server/auth");
 const redis_1 = require("../../lib/redis");
 const roles_1 = require("../../lib/roles");
+const crypto_1 = require("crypto");
 const REDIS_SITE_LOG_KEY = 'vibe:site-logs:pending';
 const REDIS_LOG_TTL = 7 * 24 * 60 * 60; // 1 week
 /**
@@ -99,15 +100,21 @@ function createSiteLogsHandler(config) {
                 const response = await fetch(`${vibeUrl}/v1/admin/site-logs?${params}`, { headers });
                 if (!response.ok) {
                     const errorText = await response.text();
-                    console.error('[admin/site-logs] Vibe error:', response.status, errorText);
-                    return server_1.NextResponse.json({ error: 'Failed to fetch site logs', details: errorText }, { status: response.status });
+                    // PAY-1424: never the raw upstream body in the log sink.
+                    // PAY-1425: nor in the response - a fixed message + code, and a correlationId that
+                    // matches this log line.
+                    const correlationId = (0, crypto_1.randomUUID)();
+                    console.error('[admin/site-logs] Vibe error:', { correlationId, status: response.status, bodyLength: errorText.length });
+                    return server_1.NextResponse.json({ error: 'Failed to fetch site logs', code: 'UPSTREAM_ERROR', correlationId }, { status: response.status });
                 }
                 const data = await response.json();
                 return server_1.NextResponse.json(data);
             }
             catch (error) {
-                console.error('[admin/site-logs] Error:', error);
-                return server_1.NextResponse.json({ error: error.message || 'Internal error' }, { status: 500 });
+                // PAY-1425: exception text (hosts, URLs, driver messages) stays server-side.
+                const correlationId = (0, crypto_1.randomUUID)();
+                console.error('[admin/site-logs] Error:', { correlationId, error });
+                return server_1.NextResponse.json({ error: 'Internal error', code: 'INTERNAL_ERROR', correlationId }, { status: 500 });
             }
         },
         async POST(request) {
@@ -172,8 +179,10 @@ function createSiteLogsHandler(config) {
                 }, { status: 201 });
             }
             catch (error) {
-                console.error('[admin/site-logs] POST Error:', error);
-                return server_1.NextResponse.json({ error: error.message || 'Internal error' }, { status: 500 });
+                // PAY-1425: exception text (hosts, URLs, driver messages) stays server-side.
+                const correlationId = (0, crypto_1.randomUUID)();
+                console.error('[admin/site-logs] POST Error:', { correlationId, error });
+                return server_1.NextResponse.json({ error: 'Internal error', code: 'INTERNAL_ERROR', correlationId }, { status: 500 });
             }
         },
     };
@@ -206,16 +215,22 @@ function createSiteLogsStatsHandler(config) {
                 const response = await fetch(`${vibeUrl}/v1/admin/site-logs/stats?${params}`, { headers });
                 if (!response.ok) {
                     const errorText = await response.text();
-                    console.error('[admin/site-logs/stats] Vibe error:', response.status, errorText);
-                    return server_1.NextResponse.json({ error: 'Failed to fetch stats', details: errorText }, { status: response.status });
+                    // PAY-1424: never the raw upstream body in the log sink.
+                    // PAY-1425: nor in the response - a fixed message + code, and a correlationId that
+                    // matches this log line.
+                    const correlationId = (0, crypto_1.randomUUID)();
+                    console.error('[admin/site-logs/stats] Vibe error:', { correlationId, status: response.status, bodyLength: errorText.length });
+                    return server_1.NextResponse.json({ error: 'Failed to fetch stats', code: 'UPSTREAM_ERROR', correlationId }, { status: response.status });
                 }
                 const data = await response.json();
                 // Ensure response matches expected format: { total, unique_users, by_level, by_category }
                 return server_1.NextResponse.json(data);
             }
             catch (error) {
-                console.error('[admin/site-logs/stats] Error:', error);
-                return server_1.NextResponse.json({ error: error.message || 'Internal error' }, { status: 500 });
+                // PAY-1425: exception text (hosts, URLs, driver messages) stays server-side.
+                const correlationId = (0, crypto_1.randomUUID)();
+                console.error('[admin/site-logs/stats] Error:', { correlationId, error });
+                return server_1.NextResponse.json({ error: 'Internal error', code: 'INTERNAL_ERROR', correlationId }, { status: 500 });
             }
         },
     };
@@ -246,15 +261,21 @@ function createSiteLogsDrainHandler(config) {
                 });
                 if (!response.ok) {
                     const errorText = await response.text();
-                    console.error('[admin/site-logs/drain] Vibe error:', response.status, errorText);
-                    return server_1.NextResponse.json({ error: 'Failed to drain site logs', details: errorText }, { status: response.status });
+                    // PAY-1424: never the raw upstream body in the log sink.
+                    // PAY-1425: nor in the response - a fixed message + code, and a correlationId that
+                    // matches this log line.
+                    const correlationId = (0, crypto_1.randomUUID)();
+                    console.error('[admin/site-logs/drain] Vibe error:', { correlationId, status: response.status, bodyLength: errorText.length });
+                    return server_1.NextResponse.json({ error: 'Failed to drain site logs', code: 'UPSTREAM_ERROR', correlationId }, { status: response.status });
                 }
                 const data = await response.json();
                 return server_1.NextResponse.json(data);
             }
             catch (error) {
-                console.error('[admin/site-logs/drain] Error:', error);
-                return server_1.NextResponse.json({ error: error.message || 'Internal error' }, { status: 500 });
+                // PAY-1425: exception text (hosts, URLs, driver messages) stays server-side.
+                const correlationId = (0, crypto_1.randomUUID)();
+                console.error('[admin/site-logs/drain] Error:', { correlationId, error });
+                return server_1.NextResponse.json({ error: 'Internal error', code: 'INTERNAL_ERROR', correlationId }, { status: 500 });
             }
         },
     };
@@ -309,8 +330,10 @@ function createSiteLogsQueueHandler(config) {
                 });
             }
             catch (error) {
-                console.error('[admin/site-logs/queue] Error:', error);
-                return server_1.NextResponse.json({ error: error.message || 'Internal error' }, { status: 500 });
+                // PAY-1425: exception text (hosts, URLs, driver messages) stays server-side.
+                const correlationId = (0, crypto_1.randomUUID)();
+                console.error('[admin/site-logs/queue] Error:', { correlationId, error });
+                return server_1.NextResponse.json({ error: 'Internal error', code: 'INTERNAL_ERROR', correlationId }, { status: 500 });
             }
         },
     };

package/dist/api-handlers/admin/stats.js

@@ -49,6 +49,7 @@ const startup_init_1 = require("../../lib/startup-init");
 const client_key_1 = require("../../lib/client-key");
 const redis_1 = require("../../lib/redis");
 const roles_1 = require("../../lib/roles");
+const crypto_1 = require("crypto");
 async function checkAdminRole(request) {
     const session = await (0, auth_1.getSession)(request);
     if (!session?.user) {
@@ -68,6 +69,9 @@ async function checkAdminRole(request) {
     return { isAdmin: true };
 }
 async function vibeServiceRequest(endpoint, options) {
+    // PAY-1429: `error` can reach the HTTP caller, so it never carries upstream Vibe text or
+    // exception text. Failures return a fixed message + correlationId; the same id is on the
+    // server log line, which carries status + bodyLength only (PAY-1424).
     const idpUrl = process.env.NEXT_PUBLIC_IDP_URL || process.env.IDP_URL;
     const clientId = process.env.VIBE_CLIENT_ID;
     const signingKey = process.env.VIBE_HMAC_KEY;
@@ -105,13 +109,17 @@ async function vibeServiceRequest(endpoint, options) {
             return { ok: true, status: 204, data: null };
         if (!res.ok) {
             const errorText = await res.text();
-            return { ok: false, status: res.status, data: null, error: errorText };
+            const correlationId = (0, crypto_1.randomUUID)();
+            console.error(`[admin/stats] Vibe request failed: ${options.method} ${endpoint} - ${res.status}`, { correlationId, bodyLength: errorText.length });
+            return { ok: false, status: res.status, data: null, error: `Vibe request failed (HTTP ${res.status})`, correlationId };
         }
         const body = await res.json();
         return { ok: true, status: res.status, data: body };
     }
     catch (error) {
-        return { ok: false, status: 0, data: null, error: String(error) };
+        const correlationId = (0, crypto_1.randomUUID)();
+        console.error(`[admin/stats] Vibe request exception: ${options.method} ${endpoint}`, { correlationId, error });
+        return { ok: false, status: 0, data: null, error: 'Vibe request could not be completed', correlationId };
     }
 }
 /**
@@ -242,8 +250,10 @@ function createStatsHandler(config) {
                 });
             }
             catch (error) {
-                console.error('[admin/stats] Error:', error);
-                return server_1.NextResponse.json({ error: error.message || 'Internal error' }, { status: 500 });
+                // PAY-1429: exception text (hosts, URLs, driver messages) stays server-side.
+                const correlationId = (0, crypto_1.randomUUID)();
+                console.error('[admin/stats] Error:', { correlationId, error });
+                return server_1.NextResponse.json({ error: 'Internal error', code: 'INTERNAL_ERROR', correlationId }, { status: 500 });
             }
         },
     };

package/dist/api-handlers/admin/users.js

@@ -47,6 +47,7 @@ const auth_1 = require("../../server/auth");
 const startup_init_1 = require("../../lib/startup-init");
 const client_key_1 = require("../../lib/client-key");
 const roles_1 = require("../../lib/roles");
+const crypto_1 = require("crypto");
 async function checkAdminRole(request) {
     const session = await (0, auth_1.getSession)(request);
     if (!session?.user) {
@@ -66,6 +67,9 @@ async function checkAdminRole(request) {
     return { isAdmin: true };
 }
 async function vibeServiceRequest(endpoint, options) {
+    // PAY-1429: `error` can reach the HTTP caller, so it never carries upstream Vibe text or
+    // exception text. Failures return a fixed message + correlationId; the same id is on the
+    // server log line, which carries status + bodyLength only (PAY-1424).
     const idpUrl = process.env.NEXT_PUBLIC_IDP_URL || process.env.IDP_URL;
     const clientId = process.env.VIBE_CLIENT_ID;
     const signingKey = process.env.VIBE_HMAC_KEY;
@@ -104,13 +108,17 @@ async function vibeServiceRequest(endpoint, options) {
             return { ok: true, status: 204, data: null };
         if (!res.ok) {
             const errorText = await res.text();
-            return { ok: false, status: res.status, data: null, error: errorText };
+            const correlationId = (0, crypto_1.randomUUID)();
+            console.error(`[admin/users] Vibe request failed: ${options.method} ${endpoint} - ${res.status}`, { correlationId, bodyLength: errorText.length });
+            return { ok: false, status: res.status, data: null, error: `Vibe request failed (HTTP ${res.status})`, correlationId };
         }
         const body = await res.json();
         return { ok: true, status: res.status, data: body };
     }
     catch (error) {
-        return { ok: false, status: 0, data: null, error: String(error) };
+        const correlationId = (0, crypto_1.randomUUID)();
+        console.error(`[admin/users] Vibe request exception: ${options.method} ${endpoint}`, { correlationId, error });
+        return { ok: false, status: 0, data: null, error: 'Vibe request could not be completed', correlationId };
     }
 }
 /**
@@ -155,7 +163,7 @@ function createUsersHandler(config) {
             }
             const result = await vibeServiceRequest('/v1/collections/vibe_app/tables/users/query', { method: 'POST', body: queryBody });
             if (!result.ok) {
-                return server_1.NextResponse.json({ error: result.error }, { status: result.status || 500 });
+                return server_1.NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
             }
             const rawUsers = result.data?.data || result.data?.documents || [];
             const users = rawUsers.map((u) => ({
@@ -183,7 +191,7 @@ function createUsersHandler(config) {
             if (action === 'stats') {
                 const result = await vibeServiceRequest('/v1/collections/vibe_app/tables/users/query', { method: 'POST', body: { page: 1, pageSize: 10000 } });
                 if (!result.ok) {
-                    return server_1.NextResponse.json({ error: result.error }, { status: result.status || 500 });
+                    return server_1.NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
                 }
                 const users = result.data?.data || result.data?.documents || [];
                 const now = new Date();
@@ -205,14 +213,14 @@ function createUsersHandler(config) {
             if (action === 'update_tier' && userId && tier) {
                 const result = await vibeServiceRequest(`/v1/collections/vibe_app/tables/users/${userId}`, { method: 'PUT', body: { tier } });
                 if (!result.ok) {
-                    return server_1.NextResponse.json({ error: result.error }, { status: result.status || 500 });
+                    return server_1.NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
                 }
                 return server_1.NextResponse.json({ success: true });
             }
             if (action === 'update_credits' && userId && credits !== undefined) {
                 const result = await vibeServiceRequest(`/v1/collections/vibe_app/tables/users/${userId}`, { method: 'PUT', body: { credits } });
                 if (!result.ok) {
-                    return server_1.NextResponse.json({ error: result.error }, { status: result.status || 500 });
+                    return server_1.NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
                 }
                 return server_1.NextResponse.json({ success: true });
             }