@payez/next-mvp 4.4.4 → 4.4.6

package/dist/api-handlers/admin/vibe-data.js

@@ -54,6 +54,7 @@ const auth_1 = require("../../server/auth");
 const startup_init_1 = require("../../lib/startup-init");
 const client_key_1 = require("../../lib/client-key");
 const roles_1 = require("../../lib/roles");
+const crypto_1 = require("crypto");
 /**
  * Check if the current user has admin role
  */
@@ -79,6 +80,10 @@ async function checkAdminRole(request) {
  * Make a service account request to Vibe (admin mode - no user filtering)
  */
 async function vibeServiceRequest(endpoint, options) {
+    // PAY-1425: `error` is returned to the HTTP caller verbatim by every handler below, so it
+    // must NEVER carry upstream text (raw Vibe/VibeSQL error bodies can hold SQL fragments,
+    // schema names or connection detail) or exception text. Failures return a fixed message
+    // plus a correlationId; the same id is on the server log line for operators.
     const idpUrl = process.env.NEXT_PUBLIC_IDP_URL || process.env.IDP_URL;
     const clientId = process.env.VIBE_CLIENT_ID;
     const signingKey = process.env.VIBE_HMAC_KEY;
@@ -121,15 +126,18 @@ async function vibeServiceRequest(endpoint, options) {
         }
         if (!res.ok) {
             const errorText = await res.text();
-            console.error(`[Admin Vibe] Request failed: ${options.method} ${endpoint} - ${res.status}`, errorText);
-            return { ok: false, status: res.status, data: null, error: errorText };
+            // PAY-1424: never the raw upstream body in the log sink.
+            const correlationId = (0, crypto_1.randomUUID)();
+            console.error(`[Admin Vibe] Request failed: ${options.method} ${endpoint} - ${res.status}`, { correlationId, bodyLength: errorText.length });
+            return { ok: false, status: res.status, data: null, error: `Vibe request failed (HTTP ${res.status})`, correlationId };
         }
         const body = await res.json();
         return { ok: true, status: res.status, data: body };
     }
     catch (error) {
-        console.error(`[Admin Vibe] Request exception: ${options.method} ${endpoint}`, error);
-        return { ok: false, status: 0, data: null, error: String(error) };
+        const correlationId = (0, crypto_1.randomUUID)();
+        console.error(`[Admin Vibe] Request exception: ${options.method} ${endpoint}`, { correlationId, error });
+        return { ok: false, status: 0, data: null, error: 'Vibe request could not be completed', correlationId };
     }
 }
 /**
@@ -143,7 +151,7 @@ function createGetCollectionsHandler(config) {
             return adminCheck.error;
         const result = await vibeServiceRequest('/v1/collections', { method: 'GET' });
         if (!result.ok) {
-            return server_1.NextResponse.json({ success: false, error: { code: 'FETCH_ERROR', message: result.error } }, { status: result.status || 500 });
+            return server_1.NextResponse.json({ success: false, error: { code: 'FETCH_ERROR', message: result.error, correlationId: result.correlationId } }, { status: result.status || 500 });
         }
         return server_1.NextResponse.json(result.data);
     };
@@ -160,7 +168,7 @@ function createGetTablesHandler(config) {
             return adminCheck.error;
         const result = await vibeServiceRequest(`/v1/collections/${collection}/tables`, { method: 'GET' });
         if (!result.ok) {
-            return server_1.NextResponse.json({ success: false, error: { code: 'FETCH_ERROR', message: result.error } }, { status: result.status || 500 });
+            return server_1.NextResponse.json({ success: false, error: { code: 'FETCH_ERROR', message: result.error, correlationId: result.correlationId } }, { status: result.status || 500 });
         }
         return server_1.NextResponse.json(result.data);
     };
@@ -183,7 +191,7 @@ function createGetTableDataHandler(config) {
             return server_1.NextResponse.json({ data: [], meta: { total: 0, limit: 50, offset: 0 } });
         }
         if (!result.ok) {
-            return server_1.NextResponse.json({ success: false, error: { code: 'FETCH_ERROR', message: result.error } }, { status: result.status || 500 });
+            return server_1.NextResponse.json({ success: false, error: { code: 'FETCH_ERROR', message: result.error, correlationId: result.correlationId } }, { status: result.status || 500 });
         }
         return server_1.NextResponse.json(result.data);
     };
@@ -202,7 +210,7 @@ function createGetRecordHandler(config) {
         const result = await vibeServiceRequest(endpoint, { method: 'GET' });
         if (!result.ok) {
             const status = result.status === 404 ? 404 : result.status || 500;
-            return server_1.NextResponse.json({ success: false, error: { code: result.status === 404 ? 'NOT_FOUND' : 'FETCH_ERROR', message: result.error } }, { status });
+            return server_1.NextResponse.json({ success: false, error: { code: result.status === 404 ? 'NOT_FOUND' : 'FETCH_ERROR', message: result.error, correlationId: result.correlationId } }, { status });
         }
         return server_1.NextResponse.json(result.data);
     };
@@ -221,7 +229,7 @@ function createUpdateRecordHandler(config) {
         const endpoint = `/v1/collections/${collection}/tables/${table}/${id}`;
         const result = await vibeServiceRequest(endpoint, { method: 'PUT', body });
         if (!result.ok) {
-            return server_1.NextResponse.json({ success: false, error: { code: 'UPDATE_ERROR', message: result.error } }, { status: result.status || 500 });
+            return server_1.NextResponse.json({ success: false, error: { code: 'UPDATE_ERROR', message: result.error, correlationId: result.correlationId } }, { status: result.status || 500 });
         }
         return server_1.NextResponse.json(result.data);
     };
@@ -239,7 +247,7 @@ function createDeleteRecordHandler(config) {
         const endpoint = `/v1/collections/${collection}/tables/${table}/${id}`;
         const result = await vibeServiceRequest(endpoint, { method: 'DELETE' });
         if (!result.ok) {
-            return server_1.NextResponse.json({ success: false, error: { code: 'DELETE_ERROR', message: result.error } }, { status: result.status || 500 });
+            return server_1.NextResponse.json({ success: false, error: { code: 'DELETE_ERROR', message: result.error, correlationId: result.correlationId } }, { status: result.status || 500 });
         }
         return new server_1.NextResponse(null, { status: 204 });
     };
@@ -261,7 +269,7 @@ function createQueryHandler(config) {
             return server_1.NextResponse.json({ data: [], meta: { total: 0, page: 1, pageSize: 20 } });
         }
         if (!result.ok) {
-            return server_1.NextResponse.json({ success: false, error: { code: 'QUERY_ERROR', message: result.error } }, { status: result.status || 500 });
+            return server_1.NextResponse.json({ success: false, error: { code: 'QUERY_ERROR', message: result.error, correlationId: result.correlationId } }, { status: result.status || 500 });
         }
         return server_1.NextResponse.json(result.data);
     };

package/dist/api-handlers/auth/jwks.js

@@ -17,7 +17,8 @@ async function GET(_req) {
             return server_1.NextResponse.json(json, { status: res.status });
         }
         catch (e) {
-            logger_1.logger.error('[AUTH_JWKS] Upstream returned non-JSON', { status: res.status, bodyText: bodyText?.slice(0, 200) });
+            // PAY-1427: no body slice - a non-JSON upstream is an error/proxy page of unknown content.
+            logger_1.logger.error('[AUTH_JWKS] Upstream returned non-JSON', { status: res.status, bodyLength: bodyText.length, contentType: res.headers.get('content-type') });
             return server_1.NextResponse.json({ error: 'Invalid JWKS response' }, { status: 502 });
         }
     }

package/dist/api-handlers/auth/login.js

@@ -118,9 +118,12 @@ function createLoginHandler(config) {
                 data = JSON.parse(rawText);
             }
             catch (jsonError) {
+                // PAY-1424: never the raw body - a non-JSON IDP/proxy error page can echo request
+                // context (credentials) back. Status, length and content-type are enough to triage.
                 console.error('[LOGIN] IDP returned non-JSON response', {
-                    response: rawText,
-                    status: backendResponse.status
+                    status: backendResponse.status,
+                    bodyLength: rawText.length,
+                    contentType: backendResponse.headers.get('content-type'),
                 });
                 return server_1.NextResponse.json({ error: 'Invalid response from authentication service' }, { status: 502 });
             }
@@ -137,15 +140,21 @@ function createLoginHandler(config) {
                     }, { status: 429 }));
                 }
                 // Pass through error from IDP
+                // PAY-1424: shape only, never the envelope contents.
                 console.error('[LOGIN] IDP service error', {
                     status: backendResponse.status,
-                    error: data
+                    bodyKeys: data && typeof data === 'object' ? Object.keys(data) : undefined,
+                    errorKeys: data?.error && typeof data?.error === 'object' ? Object.keys(data?.error) : undefined,
                 });
                 return addSecurityHeaders(server_1.NextResponse.json(data, { status: backendResponse.status }));
             }
             if (!data.success) {
                 // IDP returned a canonical error envelope with HTTP 200
-                console.error('[LOGIN] IDP authentication failure', { error: data });
+                // PAY-1424: shape only, never the envelope contents.
+                console.error('[LOGIN] IDP authentication failure', {
+                    bodyKeys: data && typeof data === 'object' ? Object.keys(data) : undefined,
+                    errorKeys: data?.error && typeof data?.error === 'object' ? Object.keys(data?.error) : undefined,
+                });
                 return addSecurityHeaders(server_1.NextResponse.json(data, { status: 200 }));
             }
             // Normalize response shape for NextAuth authorize()

package/dist/api-handlers/auth/passkey-signin.js

@@ -7,6 +7,7 @@ const env_1 = require("../../config/env");
 const idp_client_config_1 = require("../../lib/idp-client-config");
 const client_key_1 = require("../../lib/client-key");
 const idp_url_guard_1 = require("../../lib/idp-url-guard");
+const safe_error_response_1 = require("../../lib/safe-error-response");
 /**
  * Passkey SIGN-IN ceremony (ANONYMOUS — no session exists yet):
  *   optionsPOST -> POST /api/ExternalAuth/passwordless/passkey/options
@@ -56,6 +57,9 @@ async function anonCall(req, path) {
 }
 async function optionsPOST(req) {
     const { res, json } = await anonCall(req, '/api/ExternalAuth/passwordless/passkey/options');
+    // PAY-1438: anonymous route - on failure only the whitelisted envelope, never the IDP body.
+    if (!res.ok)
+        return server_1.NextResponse.json((0, safe_error_response_1.idpErrorEnvelope)(json, 'Passkey sign-in failed'), { status: res.status });
     return server_1.NextResponse.json(json ?? { success: false, message: 'Empty upstream response' }, { status: res.status });
 }
 /**
@@ -108,5 +112,7 @@ async function verifyPOST(req) {
         cache: 'no-store',
     });
     const json = await res.json().catch(() => null);
+    if (!res.ok)
+        return server_1.NextResponse.json((0, safe_error_response_1.idpErrorEnvelope)(json, 'Passkey sign-in failed'), { status: res.status });
     return server_1.NextResponse.json(json ?? { success: false, message: 'Empty upstream response' }, { status: res.status });
 }

package/dist/api-handlers/auth/refresh.js

@@ -43,6 +43,7 @@ const auth_1 = require("../../server/auth");
 const session_store_1 = require("../../lib/session-store");
 const token_expiry_1 = require("../../lib/token-expiry");
 const token_utils_1 = require("../../auth/utils/token-utils");
+const token_log_id_1 = require("../../lib/token-log-id");
 /**
  * Creates a refresh token handler for Next.js API routes
  *
@@ -152,7 +153,7 @@ function createRefreshHandler(config) {
             console.log('║                    REFRESH TOKEN ATTEMPT - PRE-FLIGHT                        ║');
             console.log('╠══════════════════════════════════════════════════════════════════════════════╣');
             console.log(`║ User: ${(userId || 'unknown').substring(0, 50).padEnd(50)}                   ║`);
-            console.log(`║ Session: ${sessionToken.substring(0, 8)}...                                                        ║`);
+            console.log(`║ Session: ${(0, token_log_id_1.tokenLogId)(sessionToken)}                                                        ║`);
             console.log('╠──────────────────────────────────────────────────────────────────────────────╣');
             console.log(`║ Access Token Expires In:  ${String(accessTokenExpiresIn).padEnd(10)} seconds                            ║`);
             console.log(`║ Refresh Token Age:        ${String(refreshTokenAge).padEnd(10)} seconds                            ║`);
@@ -482,11 +483,18 @@ function createRefreshHandler(config) {
                     console.error(`║ ${whyItFailed.substring(0, 76).padEnd(76)} ║`);
                     console.error('╠──────────────────────────────────────────────────────────────────────────────╣');
                     console.error(`║ User:           ${(userId || 'unknown').substring(0, 60).padEnd(60)}║`);
-                    console.error(`║ Session:        ${sessionToken.substring(0, 8)}...                                                     ║`);
+                    console.error(`║ Session:        ${(0, token_log_id_1.tokenLogId)(sessionToken)}                                                     ║`);
                     console.error(`║ Resolution:     ${(resolution || 'Check IDP logs').substring(0, 60).padEnd(60)}║`);
                     console.error('╚══════════════════════════════════════════════════════════════════════════════╝');
-                    // Also log the full response for detailed debugging
-                    console.error('[AUTH_REFRESH] Full IDP error response:', JSON.stringify(responseData, null, 2).substring(0, 1000));
+                    // NEVER the raw envelope (DotNetPert-Scout, PR 139 review / mail 58691): this used to print
+                    // a stringified dump of responseData (first 1000 chars) - the same whole IDP body the :618
+                    // "unsuccessful" branch stopped logging. The box above already carries status, code and
+                    // flags; add envelope SHAPE only (key names), never values.
+                    console.error('[AUTH_REFRESH] IDP error response shape', {
+                        bodyKeys: responseData && typeof responseData === 'object' ? Object.keys(responseData) : undefined,
+                        errorKeys: idpError && typeof idpError === 'object' ? Object.keys(idpError) : undefined,
+                        errorHasMessage: !!idpError.message,
+                    });
                     // If IDP signals to discard token, clear it from Redis
                     if (discardToken) {
                         // Race-safe discard (CAS): only clear if the refresh token we sent is STILL
@@ -500,7 +508,7 @@ function createRefreshHandler(config) {
                                 reason: 'IDP_DISCARD_TOKEN',
                                 errorCode,
                                 userId,
-                                sessionToken: sessionToken.substring(0, 8) + '...',
+                                sessionToken: (0, token_log_id_1.tokenLogId)(sessionToken),
                                 hadRefreshToken: !!currentSession.idpRefreshToken,
                                 stack: new Error().stack
                             });
@@ -542,7 +550,16 @@ function createRefreshHandler(config) {
                     (responseData.success === true ? Object.prototype.hasOwnProperty.call(responseData, 'data') : Object.prototype.hasOwnProperty.call(responseData, 'error')) &&
                     Object.prototype.hasOwnProperty.call(responseData, 'meta');
                 if (!isCompliant) {
-                    console.error('[AUTH_REFRESH] Upstream non-compliant IDP response', { bodySample: responseData });
+                    // NEVER the raw body (DotNetPert-Scout, mail 58678): a non-compliant response has an
+                    // UNKNOWN shape by definition, so there is no basis to assume it is free of tokens or
+                    // other IDP-side secrets. Log shape metadata only - same "kind, never value" reasoning
+                    // as the session-store.ts / refresh.ts REFRESH_TOKEN_REMOVAL fixes in PR 138.
+                    console.error('[AUTH_REFRESH] Upstream non-compliant IDP response', {
+                        bodyType: typeof responseData,
+                        bodyKeys: responseData && typeof responseData === 'object' ? Object.keys(responseData) : undefined,
+                        hasSuccessKey: !!(responseData && typeof responseData === 'object' && Object.prototype.hasOwnProperty.call(responseData, 'success')),
+                        hasMetaKey: !!(responseData && typeof responseData === 'object' && Object.prototype.hasOwnProperty.call(responseData, 'meta')),
+                    });
                     return server_1.NextResponse.json({
                         error: 'Upstream non-compliance',
                         code: 'UPSTREAM_SERVICE_ERROR',
@@ -556,17 +573,24 @@ function createRefreshHandler(config) {
                     const errorCode = idpError.code || 'UPSTREAM_VALIDATION_ERROR';
                     const discardToken = idpError.discard_token === true;
                     const retryable = idpError.retryable === true;
+                    // NEVER the raw envelope (DotNetPert-Scout, mail 58678): `responseData` here is the
+                    // WHOLE IDP response body, and its `error` sub-object's contents are not something this
+                    // handler controls or has audited - printing it wholesale would ship whatever the IDP
+                    // decided to put there straight to the log sink. Log the fields THIS handler already
+                    // extracts and acts on (retryable, plus envelope-shape flags for diagnosis) instead.
                     console.warn('[AUTH_REFRESH] IDP refresh unsuccessful', {
                         code: errorCode,
                         discardToken,
-                        body: responseData
+                        retryable,
+                        errorHasMessage: !!idpError.message,
+                        errorKeys: Object.keys(idpError),
                     });
                     if (discardToken) {
                         console.error('[AUTH_REFRESH] ⚠️ REFRESH_TOKEN_REMOVAL: IDP success:false with discard_token', {
                             reason: 'IDP_SUCCESS_FALSE_DISCARD',
                             errorCode,
                             userId,
-                            sessionToken: sessionToken.substring(0, 8) + '...',
+                            sessionToken: (0, token_log_id_1.tokenLogId)(sessionToken),
                             hadRefreshToken: !!currentSession.idpRefreshToken,
                             stack: new Error().stack
                         });
@@ -646,9 +670,12 @@ function createRefreshHandler(config) {
                     console.error('[AUTH_REFRESH] ⚠️ REFRESH_TOKEN_REMOVAL: No new refresh token in IDP response', {
                         reason: 'NO_NEW_REFRESH_TOKEN_IN_RESPONSE',
                         userId,
-                        sessionToken: sessionToken.substring(0, 8) + '...',
+                        sessionToken: (0, token_log_id_1.tokenLogId)(sessionToken),
                         hadRefreshToken: true,
-                        refreshTokenFromResponse: refreshToken,
+                        // Kind only, never the value (credential). This branch runs when refreshToken is not a
+                        // non-empty string, so the old raw value was almost always empty - but a token-shaped
+                        // non-string would have been printed. refreshTokenType below already carries the kind.
+                        refreshTokenFromResponsePresent: refreshToken !== undefined && refreshToken !== null && refreshToken !== '',
                         refreshTokenType: typeof refreshToken,
                         payloadKeys: Object.keys(payload || {}),
                         stack: new Error().stack
@@ -696,7 +723,7 @@ function createRefreshHandler(config) {
                     expiresAt: new Date(accessTokenExpires).toISOString(),
                     userId,
                     hasNewRefreshToken: hasNewRefresh,
-                    tokenPreview: accessToken ? accessToken.substring(0, 20) + '...' : 'none'
+                    hasAccessToken: !!accessToken // PAY-1427: was tokenPreview (first 20 chars of the new access token)
                 });
             }
             catch (error) {

package/dist/api-handlers/auth/signout.js

@@ -17,6 +17,7 @@ const headers_1 = require("next/headers");
 const session_store_1 = require("../../lib/session-store");
 const auth_1 = require("../../server/auth");
 const app_slug_1 = require("../../lib/app-slug");
+const token_log_id_1 = require("../../lib/token-log-id");
 // JWT decode helper - simple base64 decode without verification
 function jwtDecode(token) {
     try {
@@ -135,7 +136,7 @@ function createSignoutHandler() {
             try {
                 await (0, session_store_1.deleteSessionEverywhere)(redisSessionToken);
                 console.info('[SIGNOUT] Redis session cleanup successful', {
-                    sessionToken: redisSessionToken.substring(0, 8) + '...'
+                    sessionToken: (0, token_log_id_1.tokenLogId)(redisSessionToken)
                 });
             }
             catch (sessionError) {

package/dist/api-handlers/auth/status.js

@@ -4,6 +4,7 @@ exports.GET = GET;
 const server_1 = require("next/server");
 const auth_1 = require("../../server/auth");
 const session_store_1 = require("../../lib/session-store");
+const safe_error_response_1 = require("../../lib/safe-error-response");
 async function GET(req) {
     try {
         const betterAuthSession = await (0, auth_1.getSession)(req);
@@ -18,6 +19,8 @@ async function GET(req) {
         return server_1.NextResponse.json({ success: true, userId: betterAuthSession?.user?.id || sessionModel.userId || null });
     }
     catch (err) {
-        return server_1.NextResponse.json({ success: false, error: err instanceof Error ? err.message : 'Unknown error' }, { status: 500 });
+        // PAY-1438: this catch wraps both session reads (Better Auth + Redis), before any auth decision.
+        const correlationId = (0, safe_error_response_1.logExceptionWithCorrelation)('[AUTH_STATUS] Error reading session:', err);
+        return server_1.NextResponse.json({ success: false, error: 'Failed to read session status', code: 'INTERNAL_ERROR', correlationId }, { status: 500 });
     }
 }

package/dist/api-handlers/auth/update-session.d.ts

@@ -1,17 +1,38 @@
 /**
  * Authentication Update Session API Handler
  *
- * Handles session updates, particularly for 2FA status changes.
- * This handler is designed to be imported and used by Next.js applications
- * using the @payez/next-mvp package.
+ * *** THIS HANDLER DOES NOT PERSIST ANYTHING. IT IS AN ECHO. ***
  *
- * @version 2.0
+ * It authenticates the caller, reads `twoFactorSessionVerified` from the REQUEST
+ * BODY, and echoes that caller-asserted value straight back. There is no redis
+ * write, no cookie write, no JWT mint and no session-store call anywhere in this
+ * module - the only `.set(` calls are the security headers below. The 2FA state
+ * does NOT survive the request.
+ *
+ * Do not wire this expecting it to record a second factor. It is kept because
+ * live callers POST to it on the 2FA completion path and a 404/501 would break
+ * that flow; it is deliberately inert, NOT a session writer. Callers can detect
+ * this programmatically via `persisted: false` in the response.
+ *
+ * Card 391621 measured the consequence: because nothing is stored, downstream
+ * 2FA gates read no verified state and FAIL CLOSED. That is why this is an
+ * honesty/diagnosability defect rather than an auth bypass - but a future
+ * consumer that trusts `success: true` here would be trusting nothing.
+ *
+ * If you need to actually record 2FA completion, write to the session store
+ * (see `../../server/session-store`); do not extend this handler in place.
+ *
+ * @version 2.1
  * @requires Authentication (authenticated endpoint)
  */
 import { NextRequest, NextResponse } from 'next/server';
 /**
  * Creates an update-session handler for Next.js API routes.
  *
+ * *** NO-OP: this handler PERSISTS NOTHING. *** It requires a valid session,
+ * then echoes the caller-asserted `twoFactorSessionVerified` back with
+ * `persisted: false`. See the module header before wiring it.
+ *
  * Better Auth resolves its session from cookies, so this handler takes no
  * configuration. Use the default `POST` export below for typical usage.
  *

package/dist/api-handlers/auth/update-session.js

@@ -2,11 +2,28 @@
 /**
  * Authentication Update Session API Handler
  *
- * Handles session updates, particularly for 2FA status changes.
- * This handler is designed to be imported and used by Next.js applications
- * using the @payez/next-mvp package.
+ * *** THIS HANDLER DOES NOT PERSIST ANYTHING. IT IS AN ECHO. ***
  *
- * @version 2.0
+ * It authenticates the caller, reads `twoFactorSessionVerified` from the REQUEST
+ * BODY, and echoes that caller-asserted value straight back. There is no redis
+ * write, no cookie write, no JWT mint and no session-store call anywhere in this
+ * module - the only `.set(` calls are the security headers below. The 2FA state
+ * does NOT survive the request.
+ *
+ * Do not wire this expecting it to record a second factor. It is kept because
+ * live callers POST to it on the 2FA completion path and a 404/501 would break
+ * that flow; it is deliberately inert, NOT a session writer. Callers can detect
+ * this programmatically via `persisted: false` in the response.
+ *
+ * Card 391621 measured the consequence: because nothing is stored, downstream
+ * 2FA gates read no verified state and FAIL CLOSED. That is why this is an
+ * honesty/diagnosability defect rather than an auth bypass - but a future
+ * consumer that trusts `success: true` here would be trusting nothing.
+ *
+ * If you need to actually record 2FA completion, write to the session store
+ * (see `../../server/session-store`); do not extend this handler in place.
+ *
+ * @version 2.1
  * @requires Authentication (authenticated endpoint)
  */
 Object.defineProperty(exports, "__esModule", { value: true });
@@ -31,6 +48,10 @@ function addSecurityHeaders(response) {
 /**
  * Creates an update-session handler for Next.js API routes.
  *
+ * *** NO-OP: this handler PERSISTS NOTHING. *** It requires a valid session,
+ * then echoes the caller-asserted `twoFactorSessionVerified` back with
+ * `persisted: false`. See the module header before wiring it.
+ *
  * Better Auth resolves its session from cookies, so this handler takes no
  * configuration. Use the default `POST` export below for typical usage.
  *
@@ -56,20 +77,26 @@ function createUpdateSessionHandler() {
             if (!session) {
                 return addSecurityHeaders(server_1.NextResponse.json({ error: 'No session token available' }, { status: 401 }));
             }
-            // Update the session with 2FA challenge completion status
-            const updatedSession = {
+            // NOT a session update. This object is local, is never written anywhere,
+            // and is discarded when the request ends. Named for what it is so the
+            // next reader cannot mistake it for persisted state.
+            const echoedRequest = {
                 twoFactorSessionVerified: !!twoFactorSessionVerified,
                 twoFactorMethod: twoFactorMethod || session.twoFactorMethod
             };
-            console.info('[UPDATE-SESSION] Session updated successfully', {
+            // Previously logged "Session updated successfully", which asserted a write
+            // that never happened and made the no-op invisible in production logs.
+            console.warn('[UPDATE-SESSION] NO-OP: nothing persisted; echoing caller-asserted 2FA state', {
                 userId: session.user?.id,
-                twoFactorSessionVerified: updatedSession.twoFactorSessionVerified,
-                twoFactorMethod: updatedSession.twoFactorMethod
+                twoFactorSessionVerified: echoedRequest.twoFactorSessionVerified,
+                twoFactorMethod: echoedRequest.twoFactorMethod,
+                persisted: false
             });
             const responseData = {
                 success: true,
-                twoFactorSessionVerified: updatedSession.twoFactorSessionVerified,
-                twoFactorMethod: updatedSession.twoFactorMethod
+                twoFactorSessionVerified: echoedRequest.twoFactorSessionVerified,
+                twoFactorMethod: echoedRequest.twoFactorMethod,
+                persisted: false
             };
             return addSecurityHeaders(server_1.NextResponse.json(responseData));
         }

package/dist/api-handlers/auth/validate.js

@@ -6,6 +6,7 @@ const idp_fetch_1 = require("../../lib/idp-fetch");
 const env_1 = require("../../config/env");
 const test_aware_get_token_1 = require("../../lib/test-aware-get-token");
 const session_store_1 = require("../../lib/session-store");
+const safe_error_response_1 = require("../../lib/safe-error-response");
 /**
  * Validates current access token with the IDP and returns normalized info.
  * Sources access token from Authorization header or Redis session via cookie.
@@ -32,12 +33,13 @@ async function GET(req) {
         const url = `${env_1.ENV_CONFIG.IDP_URL}${env_1.API_ENDPOINTS.externalAuth.validate}`;
         const result = await (0, idp_fetch_1.idpFetchJSON)(req, url, { method: 'GET', headers: { Authorization: `Bearer ${bearer}` } });
         if (!result.ok) {
-            return server_1.NextResponse.json({ success: false, error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status }, data: result.json }, { status: result.status });
+            return server_1.NextResponse.json({ success: false, error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: (0, safe_error_response_1.projectIdpError)(result.json) } }, { status: result.status });
         }
         // Passthrough normalized
         return server_1.NextResponse.json(result.json ?? { success: true }, { status: 200 });
     }
     catch (e) {
-        return server_1.NextResponse.json({ success: false, error: { code: 'INTERNAL_SERVER_ERROR', message: e?.message || 'validate error' } }, { status: 500 });
+        const correlationId = (0, safe_error_response_1.logExceptionWithCorrelation)('[AUTH_VALIDATE] Error:', e);
+        return server_1.NextResponse.json({ success: false, error: { code: 'INTERNAL_SERVER_ERROR', message: 'validate error', correlationId } }, { status: 500 });
     }
 }

package/dist/api-handlers/auth/verify-code.js

@@ -15,6 +15,7 @@ exports.createVerifyCodeHandler = createVerifyCodeHandler;
 const server_1 = require("next/server");
 const auth_1 = require("../../server/auth");
 const session_store_1 = require("../../lib/session-store");
+const token_log_id_1 = require("../../lib/token-log-id");
 /**
  * Creates a verify-code/complete-2FA handler for Next.js API routes.
  *
@@ -48,7 +49,7 @@ function createVerifyCodeHandler() {
                 return server_1.NextResponse.json({ success: false, message: 'No session found' }, { status: 401 });
             }
             console.info('[VERIFY-CODE] Updating session with new tokens after 2FA', {
-                sessionToken: sessionToken.substring(0, 8) + '...',
+                sessionToken: (0, token_log_id_1.tokenLogId)(sessionToken),
                 userId: betterAuthSession?.user?.id,
                 hasAccessToken: !!accessToken,
                 hasRefreshToken: !!refreshToken,
@@ -63,7 +64,7 @@ function createVerifyCodeHandler() {
             // treats the missing expiry as "never expires".
             await (0, session_store_1.mark2FAComplete)(sessionToken, accessToken);
             console.info('[VERIFY-CODE] 2FA completion successful', {
-                sessionToken: sessionToken.substring(0, 8) + '...',
+                sessionToken: (0, token_log_id_1.tokenLogId)(sessionToken),
                 userId: betterAuthSession?.user?.id
             });
             return server_1.NextResponse.json({

package/dist/api-handlers/mfa/backup-code-verify.d.ts

@@ -53,21 +53,4 @@
  * @package @payez/next-mvp
  */
 import { NextRequest, NextResponse } from 'next/server';
-export declare function POST(req: NextRequest): Promise<NextResponse<{
-    success: boolean;
-    error: string;
-    code: string;
-}> | NextResponse<{
-    success: boolean;
-    error: any;
-    code: any;
-    meta: {
-        attemptedRefresh: boolean;
-    };
-}> | NextResponse<{
-    success: boolean;
-    verificationSuccessful: boolean;
-    twoFactorSessionVerified: boolean;
-    codeConsumed: boolean;
-    message: any;
-}>>;
+export declare function POST(req: NextRequest): Promise<NextResponse<unknown>>;

package/dist/api-handlers/mfa/backup-code-verify.js

@@ -61,6 +61,7 @@ const env_1 = require("../../config/env");
 const test_aware_get_token_1 = require("../../lib/test-aware-get-token");
 const session_store_1 = require("../../lib/session-store");
 const jwt_decode_1 = require("../../lib/jwt-decode");
+const two_factor_verify_failure_1 = require("../../lib/two-factor-verify-failure");
 async function POST(req) {
     try {
         const body = await req.json();
@@ -78,12 +79,9 @@ async function POST(req) {
             body: JSON.stringify({ code }),
         });
         if (!result.ok) {
-            return server_1.NextResponse.json({
-                success: false,
-                error: result.json?.message || 'Verification failed',
-                code: result.json?.code || 'IDP_ERROR',
-                meta: { attemptedRefresh: result.attemptedRefresh },
-            }, { status: result.status });
+            // PAY-1443: never relay the IDP's error text - it arrives as a C# anonymous-object
+            // ToString ("{ message = ... }") on the deployed IDP. Classify it, answer a fixed sentence.
+            return (0, two_factor_verify_failure_1.twoFactorVerifyFailure)(result, 'backup_code');
         }
         const unwrappedData = result.json?.data || result.json;
         // Only a challenge that returns fresh tokens may transition the session.

package/dist/api-handlers/mfa/backup-codes.js

@@ -4,6 +4,7 @@ exports.POST = POST;
 const server_1 = require("next/server");
 const idp_fetch_1 = require("../../lib/idp-fetch");
 const env_1 = require("../../config/env");
+const safe_error_response_1 = require("../../lib/safe-error-response");
 /**
  * Generate MFA backup codes (POST /api/Account/mfa/backup-codes, user JWT).
  * Regeneration REPLACES the prior set — the response carries the new codes
@@ -26,7 +27,7 @@ async function POST(req) {
         return server_1.NextResponse.json({
             success: false,
             message: 'Upstream error',
-            error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: result.json },
+            error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: (0, safe_error_response_1.projectIdpError)(result.json) },
             meta: { attemptedRefresh: result.attemptedRefresh },
         }, { status: result.status });
     }

package/dist/api-handlers/mfa/methods.js

@@ -5,6 +5,7 @@ exports.DELETE = DELETE;
 const server_1 = require("next/server");
 const idp_fetch_1 = require("../../lib/idp-fetch");
 const env_1 = require("../../config/env");
+const safe_error_response_1 = require("../../lib/safe-error-response");
 /**
  * MFA methods (GET list / DELETE one, /api/Account/mfa/methods[/{id}],
  * user JWT). Drives the method picker: an EMPTY list must route the user to
@@ -14,7 +15,7 @@ function upstreamError(result) {
     return server_1.NextResponse.json({
         success: false,
         message: 'Upstream error',
-        error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: result.json },
+        error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: (0, safe_error_response_1.projectIdpError)(result.json) },
         meta: { attemptedRefresh: result.attemptedRefresh },
     }, { status: result.status });
 }

package/dist/api-handlers/mfa/totp-confirm.js

@@ -4,6 +4,7 @@ exports.POST = POST;
 const server_1 = require("next/server");
 const idp_fetch_1 = require("../../lib/idp-fetch");
 const env_1 = require("../../config/env");
+const safe_error_response_1 = require("../../lib/safe-error-response");
 /**
  * Confirm TOTP enrolment with the first authenticator code
  * (POST /api/Account/mfa/totp/confirm, user JWT). Body forwarded verbatim —
@@ -27,7 +28,7 @@ async function POST(req) {
         return server_1.NextResponse.json({
             success: false,
             message: 'Upstream error',
-            error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: result.json },
+            error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: (0, safe_error_response_1.projectIdpError)(result.json) },
             meta: { attemptedRefresh: result.attemptedRefresh },
         }, { status: result.status });
     }

package/dist/api-handlers/mfa/totp-enroll.js

@@ -4,6 +4,7 @@ exports.POST = POST;
 const server_1 = require("next/server");
 const idp_fetch_1 = require("../../lib/idp-fetch");
 const env_1 = require("../../config/env");
+const safe_error_response_1 = require("../../lib/safe-error-response");
 /**
  * Begin TOTP enrolment (POST /api/Account/mfa/totp/enroll, user JWT).
  * Returns the shared secret / otpauth URI for the QR. An enrolment left
@@ -27,7 +28,7 @@ async function POST(req) {
         return server_1.NextResponse.json({
             success: false,
             message: 'Upstream error',
-            error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: result.json },
+            error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: (0, safe_error_response_1.projectIdpError)(result.json) },
             meta: { attemptedRefresh: result.attemptedRefresh },
         }, { status: result.status });
     }