@payez/next-mvp 4.4.5 → 4.4.6

package/README.md

@@ -145,9 +145,16 @@ IDP_URL=https://idp.payez.net            # or http://localhost:32785 for local d
 # NextAuth trusts request headers for OAuth callback URLs
 AUTH_TRUST_HOST=true
 
-# NEXTAUTH_SECRET - DO NOT SET!
-# The MVP broker fetches this securely from IDP at startup.
-# Only set manually if you need to override the IDP-provided secret.
+# Secrets are resolved ENV FIRST, IdP client config second (PAY-1460, 4.4.6+).
+# The IdP is retiring the secrets it serves in client config, so production
+# deployments should set these from a k8s secret:
+#   BETTER_AUTH_SECRET=...        # session signing secret (canonical name)
+#   NEXTAUTH_SECRET=...           # legacy alias, used only if BETTER_AUTH_SECRET is unset
+#   GOOGLE_CLIENT_SECRET=...      # per OAuth provider: <PROVIDER>_CLIENT_SECRET,
+#   APPLE_CLIENT_SECRET=...       # provider name upper-cased, non-alphanumerics as "_"
+# Startup is FATAL only when BOTH the env and the IdP config lack a signing secret.
+# Values are never logged; the log names the source ("authSecret source: env:BETTER_AUTH_SECRET").
+# Env-sourced secrets are never written to the Redis config cache.
 
 # Optional
 REDIS_URL=redis://localhost:6379         # For session storage

package/dist/api/auth-handler.js

@@ -19,6 +19,7 @@ const server_1 = require("next/server");
 const auth_1 = require("../server/auth");
 const nanoid_1 = require("nanoid");
 const session_store_1 = require("../lib/session-store");
+const token_log_id_1 = require("../lib/token-log-id");
 /**
  * Creates an auth-aware handler with automatic token refresh
  *
@@ -179,7 +180,7 @@ function createAuthHandler(options = {}) {
                 refreshRequestBody.two_factor_completed_at = new Date(currentSession.mfaCompletedAt).toISOString();
             }
             console.info('[AUTH_HANDLER] Executing refresh against IDP', {
-                sessionToken: sessionToken.substring(0, 8) + '...',
+                sessionToken: (0, token_log_id_1.tokenLogId)(sessionToken),
                 hasRefreshToken: true
             });
             const response = await fetch(`${idpBaseUrl}/api/ExternalAuth/refresh`, {
@@ -192,7 +193,8 @@ function createAuthHandler(options = {}) {
             });
             if (!response.ok) {
                 const errorText = await response.text().catch(() => 'Unknown error');
-                console.error('[AUTH_HANDLER] Refresh failed:', response.status, errorText);
+                // PAY-1427: never the raw upstream body (the refresh.ts:528 twin PR 139 fixed). Status + length only.
+                console.error('[AUTH_HANDLER] Refresh failed:', { status: response.status, bodyLength: errorText.length });
                 return { success: false, error: `Refresh failed: ${response.status}` };
             }
             const data = await response.json();
@@ -317,7 +319,7 @@ function createAuthHandler(options = {}) {
                     const requestId = generateRequestId();
                     console.info('[AUTH_HANDLER] Token near expiry, initiating coordinated refresh', {
                         requestId,
-                        sessionToken: authContext.sessionToken.substring(0, 8) + '...'
+                        sessionToken: (0, token_log_id_1.tokenLogId)(authContext.sessionToken)
                     });
                     const refreshResult = await performCoordinatedRefresh(authContext.sessionToken, requestId);
                     if (refreshResult.success && refreshResult.accessToken) {

package/dist/api-handlers/account/change-password.js

@@ -5,6 +5,7 @@ const server_1 = require("next/server");
 const auth_1 = require("../../server/auth");
 const session_store_1 = require("../../lib/session-store");
 const nanoid_1 = require("nanoid");
+const safe_error_response_1 = require("../../lib/safe-error-response");
 // ...
 async function POST(req) {
     const requestId = (0, nanoid_1.nanoid)();
@@ -88,7 +89,8 @@ async function POST(req) {
                 message: errorMessage,
                 error_code: responseData.error_code || 'CHANGE_PASSWORD_FAILED',
                 request_id: requestId,
-                details: responseData.details,
+                // PAY-1438: only the password-policy messages the security pages display, never the raw envelope.
+                details: (0, safe_error_response_1.projectPasswordPolicyDetails)(responseData.details),
             }, { status: idpResponse.status });
         }
         return server_1.NextResponse.json({
@@ -98,11 +100,12 @@ async function POST(req) {
         });
     }
     catch (error) {
-        console.error('[CHANGE_PASSWORD] Error:', error);
         const requestId = req.headers.get('x-request-id') ?? crypto.randomUUID();
+        // PAY-1438: the exception text stays in the log, keyed by the request_id the caller receives.
+        console.error('[CHANGE_PASSWORD] Error:', { request_id: requestId, error });
         return server_1.NextResponse.json({
             success: false,
-            message: error instanceof Error ? error.message : 'Failed to change password',
+            message: 'Failed to change password',
             error_code: 'INTERNAL_ERROR',
             request_id: requestId,
         }, { status: 500 });

package/dist/api-handlers/account/masked-info.js

@@ -4,6 +4,7 @@ exports.POST = POST;
 const server_1 = require("next/server");
 const idp_fetch_1 = require("../../lib/idp-fetch");
 const env_1 = require("../../config/env");
+const safe_error_response_1 = require("../../lib/safe-error-response");
 // IDP masked-info is POST and uses capital 'A' in /api/Account
 async function POST(req) {
     const url = `${env_1.ENV_CONFIG.IDP_URL}/api/Account/masked-info`;
@@ -24,7 +25,7 @@ async function POST(req) {
         return server_1.NextResponse.json({
             success: false,
             message: 'Upstream error',
-            error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: result.json },
+            error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: (0, safe_error_response_1.projectIdpError)(result.json) },
             meta: { attemptedRefresh: result.attemptedRefresh },
         }, { status: result.status });
     }

package/dist/api-handlers/account/recovery/forward.d.ts

@@ -0,0 +1,14 @@
+import { NextRequest, NextResponse } from 'next/server';
+/** The recovery bearer from the inbound request, or null when absent / malformed. Never throws. */
+export declare function inboundRecoveryBearer(req: Pick<NextRequest, 'headers'>): string | null;
+export interface RecoveryForward {
+    /** IdP path after the host, e.g. /api/Account/recovery/send-code */
+    upstreamPath: string;
+    /** log/route label used for the client-key resolver */
+    where: string;
+    /** stable `error` code for an upstream that could not be reached */
+    failureCode: string;
+    /** user-facing fallback when the IdP gave no message */
+    fallbackMessage: string;
+}
+export declare function forwardRecoveryCall(req: NextRequest, spec: RecoveryForward): Promise<NextResponse>;

package/dist/api-handlers/account/recovery/forward.js

@@ -0,0 +1,105 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.inboundRecoveryBearer = inboundRecoveryBearer;
+exports.forwardRecoveryCall = forwardRecoveryCall;
+const server_1 = require("next/server");
+const env_1 = require("../../../config/env");
+const idp_client_config_1 = require("../../../lib/idp-client-config");
+const client_key_1 = require("../../../lib/client-key");
+const safe_error_response_1 = require("../../../lib/safe-error-response");
+/**
+ * Account recovery - the ONE forwarder behind /recovery/send-code and /recovery/verify-code (PAY-1588).
+ *
+ * THE DEFECT (QAPert, W1 walk on :4797 -> dev-93 IdP 90f766bd0, 2026-09-19): portal /account-auth/recovery,
+ * initiate -> 200, send-code -> 401 "Upstream error". The browser sends `Authorization: Bearer <recovery session
+ * token>` (the token `initiate` minted); these handlers went through idpFetchJSON, which sets Authorization ONLY from
+ * the server-side SESSION and never forwards the inbound header, so the IdP got no Bearer at all
+ * (AccountController.cs:872-885 = 401 MISSING_TOKEN). Positive control direct to the IdP: without Authorization 401,
+ * with it 200 and the email is sent.
+ *
+ * WHY THE 2026-08-02 REWRITE GOT IT WRONG. It reasoned "browsers send a session COOKIE and no Authorization header"
+ * and moved both handlers onto idpFetchJSON. That is true of every OTHER authenticated route. It is false of this
+ * flow: the caller is LOCKED OUT, so there is no session to resolve - the recovery session token IS the credential,
+ * and the browser is the only party that holds it. Resolving a token from a session that does not exist is why the
+ * entire recovery path, both halves, has been dead: it fails exactly when it is the only thing left that could help.
+ *
+ * WHAT THIS DOES INSTEAD
+ *   - Forwards the inbound `Authorization: Bearer <token>` to the IdP and nothing else from the caller's headers.
+ *   - Uses a direct fetch, NOT idpFetchJSON: a stray session belonging to someone else on the same browser must not
+ *     be able to override the recovery credential with its own bearer (idpFetchJSON's session bearer wins over any
+ *     caller-supplied Authorization).
+ *   - FAILS LOUD when there is no usable bearer: 401 `missing_recovery_token`, without calling upstream. The old
+ *     behaviour returned the IdP's opaque rejection, so the user saw recovery "not working" and the log showed an
+ *     upstream error rather than the auth fault it was.
+ *   - Shape-checks the token (a bearer scheme, one opaque token, sane length) before forwarding, so the header cannot
+ *     be used to smuggle anything but a credential to the IdP. It is never logged.
+ *   - Anonymous route (PAY-1438): on failure only the whitelisted envelope, never the IdP body.
+ *
+ * SERVER VALUE WINS for client_id (cards 268012 / 268410): applied AFTER the caller's payload spread, because these are
+ * unauthenticated endpoints and a browser-supplied client_id would be a tenant-targeting lever on a password-reset path.
+ *
+ * @package @payez/next-mvp
+ */
+/** One opaque token: JWT / base64url / opaque-hex alphabet, no whitespace or control characters, bounded length. */
+const TOKEN_SHAPE = /^[A-Za-z0-9\-._~+/]+=*$/;
+/** The recovery bearer from the inbound request, or null when absent / malformed. Never throws. */
+function inboundRecoveryBearer(req) {
+    const raw = req.headers.get('authorization');
+    if (!raw)
+        return null;
+    const m = /^Bearer[ ]+(\S+)$/i.exec(raw.trim());
+    if (!m)
+        return null;
+    const token = m[1];
+    if (token.length < 16 || token.length > 4096)
+        return null;
+    return TOKEN_SHAPE.test(token) ? token : null;
+}
+async function recoveryClientKey(where) {
+    try {
+        const config = await (0, idp_client_config_1.getIDPClientConfig)();
+        return (0, client_key_1.resolveClientKey)(config, where).key;
+    }
+    catch (e) {
+        console.error(`[${where}] could not resolve IDP client config for client_id:`, e);
+        return null;
+    }
+}
+async function forwardRecoveryCall(req, spec) {
+    let payload = {};
+    try {
+        payload = await req.json();
+    }
+    catch {
+        return server_1.NextResponse.json({ success: false, error: 'invalid_request', message: 'A JSON body is required' }, { status: 400 });
+    }
+    const bearer = inboundRecoveryBearer(req);
+    if (!bearer) {
+        return server_1.NextResponse.json({
+            success: false,
+            error: 'missing_recovery_token',
+            message: 'Your recovery session could not be found. Start the recovery again from the beginning.',
+        }, { status: 401 });
+    }
+    const clientKey = await recoveryClientKey(spec.where);
+    let upstream;
+    try {
+        upstream = await fetch(`${env_1.ENV_CONFIG.IDP_URL}${spec.upstreamPath}`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Accept: 'application/json',
+                Authorization: `Bearer ${bearer}`,
+                ...(clientKey ? { 'X-Client-Id': clientKey } : {}),
+            },
+            body: JSON.stringify({ ...payload, ...(clientKey ? { client_id: clientKey } : {}) }),
+        });
+    }
+    catch {
+        return server_1.NextResponse.json({ success: false, error: spec.failureCode }, { status: 502 });
+    }
+    const data = await upstream.json().catch(() => ({}));
+    if (!upstream.ok)
+        return server_1.NextResponse.json((0, safe_error_response_1.idpErrorEnvelope)(data, spec.fallbackMessage), { status: upstream.status });
+    return server_1.NextResponse.json(data, { status: 200 });
+}

package/dist/api-handlers/account/recovery/initiate.js

@@ -4,6 +4,7 @@ exports.POST = POST;
 const server_1 = require("next/server");
 const idp_client_config_1 = require("../../../lib/idp-client-config");
 const client_key_1 = require("../../../lib/client-key");
+const safe_error_response_1 = require("../../../lib/safe-error-response");
 function getIdpUrl() {
     const url = process.env.IDP_URL;
     if (!url)
@@ -51,6 +52,9 @@ async function POST(req) {
             body: JSON.stringify({ email, ...(clientKey ? { client_id: clientKey } : {}) }),
         });
         const data = await upstream.json().catch(() => ({}));
+        // PAY-1438: anonymous route - on failure only the whitelisted envelope, never the IDP body.
+        if (!upstream.ok)
+            return server_1.NextResponse.json((0, safe_error_response_1.idpErrorEnvelope)(data, 'Failed to initiate recovery'), { status: upstream.status });
         return server_1.NextResponse.json(data, { status: upstream.status });
     }
     catch (e) {

package/dist/api-handlers/account/recovery/send-code.d.ts

@@ -1,2 +1,12 @@
-import { NextRequest, NextResponse } from 'next/server';
-export declare function POST(req: NextRequest): Promise<NextResponse<any>>;
+import { NextRequest } from 'next/server';
+/**
+ * Account recovery - send-code.
+ *
+ * PAY-1588: the recovery session token minted by `initiate` is the caller's only credential (they are locked out; there is
+ * no session), so this forwards the inbound `Authorization: Bearer <token>` to the IdP and fails loud (401
+ * `missing_recovery_token`) when it is absent. The whole reasoning, and why the 2026-08-02 idpFetchJSON rewrite killed
+ * this flow, is in ./forward.ts. send-code and verify-code share that ONE forwarder so they cannot drift apart again.
+ *
+ * @package @payez/next-mvp
+ */
+export declare function POST(req: NextRequest): Promise<import("next/server").NextResponse<unknown>>;

package/dist/api-handlers/account/recovery/send-code.js

@@ -1,95 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.POST = POST;
-const server_1 = require("next/server");
-const idp_fetch_1 = require("../../../lib/idp-fetch");
-const env_1 = require("../../../config/env");
-const idp_client_config_1 = require("../../../lib/idp-client-config");
-const client_key_1 = require("../../../lib/client-key");
+const forward_1 = require("./forward");
 /**
- * Account recovery — send-code
+ * Account recovery - send-code.
  *
- * WHY THIS WAS REWRITTEN (2026-08-02, swept out of QAPert defect #7)
- * This handler read the caller's bearer straight off the inbound request:
- *
- *     const auth  = req.headers.get('authorization') || '';
- *     const token = auth.startsWith('Bearer ') ? auth.slice(7) : '';
- *     ... headers: { 'Authorization': `Bearer ${token}` }
- *
- * Browsers send a session COOKIE and no Authorization header, so `token` was
- * ALWAYS the empty string and this always called the IDP with a literal
- * "Bearer " and nothing after it.
- *
- * THAT IS WORSE THAN THE profile.ts VERSION OF THIS BUG, in two ways:
- *
- *   1. profile.ts at least 401'd when the header was missing. This one has no
- *      check at all — `|| ''` swallows the absence — so it proceeds to call
- *      upstream with an empty credential and returns the IDP's rejection as an
- *      opaque failure. The user sees recovery "not working", not "not
- *      authenticated", and the log shows an upstream error rather than an auth
- *      one. The defect hides itself.
- *   2. It is BOTH HALVES of account recovery — send-code and verify-code — so
- *      the entire recovery path is unreachable, not merely degraded. This is
- *      the flow a locked-out user reaches for, i.e. it fails exactly when it is
- *      the only thing left that could help them.
- *
- * Fixed the same way as profile.ts and masked-info.ts: idpFetchJSON resolves
- * the caller's token from the server-side session, so the cookie works and the
- * token is never handed to browser JavaScript.
+ * PAY-1588: the recovery session token minted by `initiate` is the caller's only credential (they are locked out; there is
+ * no session), so this forwards the inbound `Authorization: Bearer <token>` to the IdP and fails loud (401
+ * `missing_recovery_token`) when it is absent. The whole reasoning, and why the 2026-08-02 idpFetchJSON rewrite killed
+ * this flow, is in ./forward.ts. send-code and verify-code share that ONE forwarder so they cannot drift apart again.
  *
  * @package @payez/next-mvp
  */
-/**
- * RECOVERY CLIENT KEY — cards 268012 (S12) and 268410.
- *
- * These four proxies populated NONE of PayEzClientIdResolver's six slots, so
- * RequirePayEzUnAuthorized 404'd the request BEFORE the action ran and no
- * recovery token was ever minted. That is why S12 failed at step 1.
- *
- * NOT `ENV_CONFIG.CLIENT_ID`, which is what card 268012 originally prescribed.
- * That variable is the ENVIRONMENT-SPECIFIC NUMERIC id, and the IDP accepts a
- * numeric with NO existence check (RequirePayEzUnAuthorizedAttribute.cs:31-33)
- * while it VALIDATES a slug (:41-47). Hardcoding the numeric here would have
- * added four more sites to the 268410 family and made a stale id answer for
- * the WRONG TENANT on a password-reset path, silently. Slug-preferring, with
- * the numeric fallback logged, is the same resolver the other nine sites use.
- *
- * SERVER VALUE WINS: client_id is applied AFTER the caller's payload spread.
- * These are unauthenticated recovery endpoints, so a browser-supplied
- * client_id would be a tenant-targeting lever. The caller does not get to
- * choose which tenant their password reset is addressed to.
- */
-async function recoveryClientKey() {
-    try {
-        const config = await (0, idp_client_config_1.getIDPClientConfig)();
-        return (0, client_key_1.resolveClientKey)(config, 'account/recovery/send-code').key;
-    }
-    catch (e) {
-        console.error('[account/recovery/send-code] could not resolve IDP client config for client_id:', e);
-        return null;
-    }
-}
 async function POST(req) {
-    let payload = {};
-    try {
-        payload = await req.json();
-    }
-    catch {
-        return server_1.NextResponse.json({ success: false, error: 'invalid_request', message: 'A JSON body is required' }, { status: 400 });
-    }
-    const clientKey = await recoveryClientKey();
-    const result = await (0, idp_fetch_1.idpFetchJSON)(req, `${env_1.ENV_CONFIG.IDP_URL}/api/Account/recovery/send-code`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', ...(clientKey ? { 'X-Client-Id': clientKey } : {}) },
-        body: JSON.stringify({ ...payload, ...(clientKey ? { client_id: clientKey } : {}) }),
+    return (0, forward_1.forwardRecoveryCall)(req, {
+        upstreamPath: '/api/Account/recovery/send-code',
+        where: 'account/recovery/send-code',
+        failureCode: 'send_code_failed',
+        fallbackMessage: 'Failed to send the verification code',
     });
-    if (!result.ok) {
-        return server_1.NextResponse.json({
-            success: false,
-            error: 'send_code_failed',
-            message: result.json?.message || 'Upstream error',
-            meta: { status: result.status, attemptedRefresh: result.attemptedRefresh },
-        }, { status: result.status });
-    }
-    return server_1.NextResponse.json(result.json, { status: 200 });
 }

package/dist/api-handlers/account/recovery/verify-code.d.ts

@@ -1,2 +1,11 @@
-import { NextRequest, NextResponse } from 'next/server';
-export declare function POST(req: NextRequest): Promise<NextResponse<any>>;
+import { NextRequest } from 'next/server';
+/**
+ * Account recovery - verify-code.
+ *
+ * PAY-1588: forwards the inbound recovery `Authorization: Bearer <token>` to the IdP and fails loud (401
+ * `missing_recovery_token`) when it is absent. See ./forward.ts for the full reasoning; send-code and verify-code share
+ * that ONE forwarder so they cannot drift apart again.
+ *
+ * @package @payez/next-mvp
+ */
+export declare function POST(req: NextRequest): Promise<import("next/server").NextResponse<unknown>>;

package/dist/api-handlers/account/recovery/verify-code.js

@@ -1,95 +1,21 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.POST = POST;
-const server_1 = require("next/server");
-const idp_fetch_1 = require("../../../lib/idp-fetch");
-const env_1 = require("../../../config/env");
-const idp_client_config_1 = require("../../../lib/idp-client-config");
-const client_key_1 = require("../../../lib/client-key");
+const forward_1 = require("./forward");
 /**
- * Account recovery — verify-code
+ * Account recovery - verify-code.
  *
- * WHY THIS WAS REWRITTEN (2026-08-02, swept out of QAPert defect #7)
- * This handler read the caller's bearer straight off the inbound request:
- *
- *     const auth  = req.headers.get('authorization') || '';
- *     const token = auth.startsWith('Bearer ') ? auth.slice(7) : '';
- *     ... headers: { 'Authorization': `Bearer ${token}` }
- *
- * Browsers send a session COOKIE and no Authorization header, so `token` was
- * ALWAYS the empty string and this always called the IDP with a literal
- * "Bearer " and nothing after it.
- *
- * THAT IS WORSE THAN THE profile.ts VERSION OF THIS BUG, in two ways:
- *
- *   1. profile.ts at least 401'd when the header was missing. This one has no
- *      check at all — `|| ''` swallows the absence — so it proceeds to call
- *      upstream with an empty credential and returns the IDP's rejection as an
- *      opaque failure. The user sees recovery "not working", not "not
- *      authenticated", and the log shows an upstream error rather than an auth
- *      one. The defect hides itself.
- *   2. It is BOTH HALVES of account recovery — send-code and verify-code — so
- *      the entire recovery path is unreachable, not merely degraded. This is
- *      the flow a locked-out user reaches for, i.e. it fails exactly when it is
- *      the only thing left that could help them.
- *
- * Fixed the same way as profile.ts and masked-info.ts: idpFetchJSON resolves
- * the caller's token from the server-side session, so the cookie works and the
- * token is never handed to browser JavaScript.
+ * PAY-1588: forwards the inbound recovery `Authorization: Bearer <token>` to the IdP and fails loud (401
+ * `missing_recovery_token`) when it is absent. See ./forward.ts for the full reasoning; send-code and verify-code share
+ * that ONE forwarder so they cannot drift apart again.
  *
  * @package @payez/next-mvp
  */
-/**
- * RECOVERY CLIENT KEY — cards 268012 (S12) and 268410.
- *
- * These four proxies populated NONE of PayEzClientIdResolver's six slots, so
- * RequirePayEzUnAuthorized 404'd the request BEFORE the action ran and no
- * recovery token was ever minted. That is why S12 failed at step 1.
- *
- * NOT `ENV_CONFIG.CLIENT_ID`, which is what card 268012 originally prescribed.
- * That variable is the ENVIRONMENT-SPECIFIC NUMERIC id, and the IDP accepts a
- * numeric with NO existence check (RequirePayEzUnAuthorizedAttribute.cs:31-33)
- * while it VALIDATES a slug (:41-47). Hardcoding the numeric here would have
- * added four more sites to the 268410 family and made a stale id answer for
- * the WRONG TENANT on a password-reset path, silently. Slug-preferring, with
- * the numeric fallback logged, is the same resolver the other nine sites use.
- *
- * SERVER VALUE WINS: client_id is applied AFTER the caller's payload spread.
- * These are unauthenticated recovery endpoints, so a browser-supplied
- * client_id would be a tenant-targeting lever. The caller does not get to
- * choose which tenant their password reset is addressed to.
- */
-async function recoveryClientKey() {
-    try {
-        const config = await (0, idp_client_config_1.getIDPClientConfig)();
-        return (0, client_key_1.resolveClientKey)(config, 'account/recovery/verify-code').key;
-    }
-    catch (e) {
-        console.error('[account/recovery/verify-code] could not resolve IDP client config for client_id:', e);
-        return null;
-    }
-}
 async function POST(req) {
-    let payload = {};
-    try {
-        payload = await req.json();
-    }
-    catch {
-        return server_1.NextResponse.json({ success: false, error: 'invalid_request', message: 'A JSON body is required' }, { status: 400 });
-    }
-    const clientKey = await recoveryClientKey();
-    const result = await (0, idp_fetch_1.idpFetchJSON)(req, `${env_1.ENV_CONFIG.IDP_URL}/api/Account/recovery/verify-code`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', ...(clientKey ? { 'X-Client-Id': clientKey } : {}) },
-        body: JSON.stringify({ ...payload, ...(clientKey ? { client_id: clientKey } : {}) }),
+    return (0, forward_1.forwardRecoveryCall)(req, {
+        upstreamPath: '/api/Account/recovery/verify-code',
+        where: 'account/recovery/verify-code',
+        failureCode: 'verify_code_failed',
+        fallbackMessage: 'Failed to verify the code',
     });
-    if (!result.ok) {
-        return server_1.NextResponse.json({
-            success: false,
-            error: 'verify_code_failed',
-            message: result.json?.message || 'Upstream error',
-            meta: { status: result.status, attemptedRefresh: result.attemptedRefresh },
-        }, { status: result.status });
-    }
-    return server_1.NextResponse.json(result.json, { status: 200 });
 }

package/dist/api-handlers/account/reset-password.js

@@ -4,6 +4,7 @@ exports.POST = POST;
 const server_1 = require("next/server");
 const idp_client_config_1 = require("../../lib/idp-client-config");
 const client_key_1 = require("../../lib/client-key");
+const safe_error_response_1 = require("../../lib/safe-error-response");
 function getIdpUrl() {
     const url = process.env.IDP_URL;
     if (!url)
@@ -43,7 +44,23 @@ async function recoveryClientKey() {
 async function POST(req) {
     const IDP_URL = getIdpUrl();
     try {
-        const payload = await req.json();
+        const raw = await req.json().catch(() => null);
+        const body = (raw && typeof raw === 'object' ? raw : {});
+        // PAY-1588: the IdP's ResetPasswordRequest binds exactly email/token/new_password/confirm_password. The client
+        // used to send password_reset_token / password / password_confirmation, which bind to nothing (400 at the IdP).
+        // Legacy names are accepted as aliases and mapped; only the four IdP fields are forwarded (whitelist).
+        const str = (v) => (typeof v === 'string' && v.length > 0 ? v : undefined);
+        const fields = {
+            email: str(body.email),
+            token: str(body.token) ?? str(body.password_reset_token),
+            new_password: str(body.new_password) ?? str(body.password),
+            confirm_password: str(body.confirm_password) ?? str(body.password_confirmation),
+        };
+        const missing = Object.entries(fields).filter(([, v]) => v === undefined).map(([k]) => k);
+        if (missing.length) {
+            return server_1.NextResponse.json({ success: false, error: 'invalid_request', message: 'Missing required fields: ' + missing.join(', ') }, { status: 400 });
+        }
+        const payload = fields;
         const clientKey = await recoveryClientKey();
         const upstream = await fetch(`${IDP_URL}/api/Account/reset-password`, {
             method: 'POST',
@@ -51,6 +68,12 @@ async function POST(req) {
             body: JSON.stringify({ ...payload, ...(clientKey ? { client_id: clientKey } : {}) }),
         });
         const data = await upstream.json().catch(() => ({}));
+        // PAY-1438: anonymous route - on failure only the whitelisted envelope (utils/api reads `message`).
+        if (!upstream.ok) {
+            // PAY-1591: a password-policy refusal also carries the KNOWN rule codes so the page can say which rules failed.
+            const rules = (0, safe_error_response_1.projectPasswordPolicyRules)(data);
+            return server_1.NextResponse.json({ ...(0, safe_error_response_1.idpErrorEnvelope)(data, 'Failed to reset password'), ...(rules !== undefined ? { password_policy: { rules } } : {}), ...((0, safe_error_response_1.projectResetTokenInvalid)(data) ? { reset_token_invalid: true } : {}) }, { status: upstream.status });
+        }
         return server_1.NextResponse.json(data, { status: upstream.status });
     }
     catch {

package/dist/api-handlers/account/send-code.d.ts

@@ -7,18 +7,4 @@
  * @package @payez/next-mvp
  */
 import { NextRequest, NextResponse } from 'next/server';
-export declare function POST(req: NextRequest): Promise<NextResponse<{
-    success: boolean;
-    error: string;
-    code: string;
-}> | NextResponse<{
-    success: boolean;
-    error: any;
-    code: any;
-    meta: {
-        attemptedRefresh: boolean;
-    };
-}> | NextResponse<{
-    success: boolean;
-    message: string;
-}>>;
+export declare function POST(req: NextRequest): Promise<NextResponse<unknown>>;

package/dist/api-handlers/account/send-code.js

@@ -12,6 +12,7 @@ exports.POST = POST;
 const server_1 = require("next/server");
 const idp_fetch_1 = require("../../lib/idp-fetch");
 const env_1 = require("../../config/env");
+const two_factor_verify_failure_1 = require("../../lib/two-factor-verify-failure");
 async function POST(req) {
     try {
         // Parse request body
@@ -37,12 +38,8 @@ async function POST(req) {
             body: idpBody,
         });
         if (!result.ok) {
-            return server_1.NextResponse.json({
-                success: false,
-                error: result.json?.message || `Failed to send ${method} code`,
-                code: result.json?.code || 'IDP_ERROR',
-                meta: { attemptedRefresh: result.attemptedRefresh },
-            }, { status: result.status });
+            // PAY-1443: never relay the IDP's message/code - fixed sentence + stable code, status kept.
+            return (0, two_factor_verify_failure_1.twoFactorSendCodeFailure)(result, method);
         }
         return server_1.NextResponse.json({
             success: true,

package/dist/api-handlers/account/update-phone.js

@@ -32,7 +32,12 @@ async function POST(req) {
             body: JSON.stringify({ phone_number: phoneNumber }),
         });
         if (!result.ok) {
-            console.error('[UPDATE_PHONE] IDP error:', result.status, result.json);
+            // PAY-1424: shape only, never the IDP body (profile endpoint - PII).
+            console.error('[UPDATE_PHONE] IDP error:', {
+                status: result.status,
+                bodyKeys: result.json && typeof result.json === 'object' ? Object.keys(result.json) : undefined,
+                errorKeys: result.json?.error && typeof result.json?.error === 'object' ? Object.keys(result.json?.error) : undefined,
+            });
             return server_1.NextResponse.json({
                 success: false,
                 error: {

package/dist/api-handlers/account/validate-password.js

@@ -48,9 +48,11 @@ async function POST(req) {
         });
         const responseData = await idpResponse.json().catch(() => ({}));
         if (!idpResponse.ok) {
+            // PAY-1424: shape only, never the envelope contents (this endpoint carries a password).
             console.error('[VALIDATE_PASSWORD] IDP error:', {
                 status: idpResponse.status,
-                response: responseData,
+                bodyKeys: responseData && typeof responseData === 'object' ? Object.keys(responseData) : undefined,
+                errorKeys: responseData?.error && typeof responseData?.error === 'object' ? Object.keys(responseData?.error) : undefined,
             });
             return server_1.NextResponse.json({
                 is_valid: false,

package/dist/api-handlers/account/verify-email.d.ts

@@ -7,20 +7,4 @@
  * @package @payez/next-mvp
  */
 import { NextRequest, NextResponse } from 'next/server';
-export declare function POST(req: NextRequest): Promise<NextResponse<{
-    success: boolean;
-    error: string;
-    code: string;
-}> | NextResponse<{
-    success: boolean;
-    error: any;
-    code: any;
-    meta: {
-        attemptedRefresh: boolean;
-    };
-}> | NextResponse<{
-    success: boolean;
-    verificationSuccessful: boolean;
-    twoFactorSessionVerified: boolean;
-    message: any;
-}>>;
+export declare function POST(req: NextRequest): Promise<NextResponse<unknown>>;