@payez/next-mvp 4.4.5 → 4.4.6

package/src/middleware/create-middleware.ts

@@ -23,6 +23,7 @@ import { resolveCallbackDestination } from '../auth/safe-callback';
 import { getInternalApiUrl } from '../edge/internal-api-url';
 import { getSessionCookieName, getSecureSessionCookieName } from '../lib/app-slug';
 import { checkPagePermission, isRBACEnabled } from './rbac-check';
+import { tokenLogId } from '../lib/token-log-id';
 
 // =============================================================================
 // TYPES
@@ -40,7 +41,8 @@ export interface AuthContext {
 
 export interface SessionPointer {
   exists: boolean;
-  sessionToken?: string;
+  /** PAY-1481: tokenLogId of the session token (presence + log correlation), never the token itself. */
+  sessionTokenId?: string | null;
   expired?: boolean;
   hasRefreshToken?: boolean;
   roles: string[];
@@ -208,6 +210,40 @@ function redirectTo(
   return response;
 }
 
+/**
+ * Terminal response for a FAILED token refresh.
+ *
+ * For `/api/` requests a redirect is the wrong terminator: fetch() follows the 307,
+ * receives 200 + an HTML login page, and the caller parses garbage instead of
+ * branching on an error. Those callers get a 401 JSON body they can branch on;
+ * document requests keep the existing redirect exactly as before.
+ *
+ * Cookie-clearing is preserved on BOTH arms. That is load-bearing, not incidental:
+ * on a permanent failure (401/403) stale cookies must be cleared or the next request
+ * refreshes again and loops (see the CRITICAL note in handleRefresh). A JSON arm that
+ * skipped clearing would convert a redirect loop into a silent refresh loop.
+ *
+ * Scoped deliberately to handleRefresh's failure exits. It is NOT folded into
+ * redirectTo(), and NOT hoisted above the refresh decision: an `/api/` hatch placed
+ * higher would intercept 'refresh_needed' and disable middleware token refresh across
+ * the whole API surface (card 340024 C1).
+ */
+function refreshFailureResponse(
+  request: NextRequest,
+  location: string,
+  errorCode: string,
+  clearCookies = false
+): NextResponse {
+  if (request.nextUrl.pathname.startsWith('/api/')) {
+    const response = NextResponse.json({ error: errorCode }, { status: 401 });
+    if (clearCookies) {
+      clearSessionCookies(response, request);
+    }
+    return response;
+  }
+  return redirectTo(request, location, clearCookies);
+}
+
 // =============================================================================
 // AUTH DECISION ENGINE
 // =============================================================================
@@ -423,9 +459,16 @@ export function createMvpMiddleware(options: MvpMiddlewareOptions = {}) {
     // The warning is deliberately KEPT: it is the only operational signal that
     // stale sessions are occurring, and it costs nothing to log before
     // delegating. Do not re-introduce a `return` in this block.
-    if (!isPublic && sessionStatus.exists === false && sessionPointer.sessionToken) {
+    if (!isPublic && sessionStatus.exists === false && sessionPointer.sessionTokenId) {
+      // PAY-1505: the KEY is `sessionTokenId`, not `sessionToken`. The value has
+      // always been a tokenLogId fingerprint (viability.ts builds it as
+      // `tokenLogId(sessionToken)`), but labelling it `sessionToken` told any
+      // operator reading this log that the line carried the token itself. The
+      // credential-in-logs source guard reads the key for exactly that reason:
+      // a field named `sessionToken` must hold a safe value, and proving that
+      // across an API boundary is not possible from the name alone.
       log.warn('Stale session detected (delegating to decision engine)', {
-        sessionToken: sessionPointer.sessionToken?.substring(0, 8) + '...',
+        sessionTokenId: sessionPointer.sessionTokenId,
         pathname
       });
     }
@@ -470,7 +513,7 @@ async function checkViability(
   };
   const sessionPointer: SessionPointer = {
     exists: false,
-    sessionToken: undefined,
+    sessionTokenId: undefined,
     expired: false,
     hasRefreshToken: false,
     roles: [],
@@ -493,11 +536,11 @@ async function checkViability(
     if (response.ok) {
       const data = await response.json();
       // Support both response formats (viability and refresh-viability)
-      sessionStatus.exists = data.authenticated ?? (data.sessionToken && data.reason !== 'session_not_found');
+      sessionStatus.exists = data.authenticated ?? (!!data.sessionTokenId && data.reason !== 'session_not_found');
       sessionStatus.requires2FA = data.requires2FA || false;
       sessionStatus.twoFactorComplete = data.twoFactorComplete || false;
       sessionPointer.exists = sessionStatus.exists ?? false;
-      sessionPointer.sessionToken = data.sessionToken;
+      sessionPointer.sessionTokenId = data.sessionTokenId ?? null;
       sessionPointer.expired = data.accessTokenExpired || false;
       sessionPointer.hasRefreshToken = data.hasRefreshToken ?? data.canRefresh ?? false;
       sessionPointer.roles = data.roles || [];
@@ -630,9 +673,10 @@ async function handleRefresh(
   // Check if circuit breaker allows refresh attempt
   if (!cb.canAttemptRefresh()) {
     log.warn('Circuit breaker preventing refresh attempt');
-    return redirectTo(
+    return refreshFailureResponse(
       request,
       `${LOGIN_PAGE}?callbackUrl=${encodeURIComponent(safeCallback)}&error=ServiceUnavailable`,
+      'ServiceUnavailable',
       true
     );
   }
@@ -677,9 +721,10 @@ async function handleRefresh(
 
     onRefreshFailure?.(response.status, false);
 
-    return redirectTo(
+    return refreshFailureResponse(
       request,
       `${LOGIN_PAGE}?callbackUrl=${encodeURIComponent(safeCallback)}&error=${errorParam}`,
+      errorParam,
       isPermanentFailure
     );
   } catch (error: any) {
@@ -697,9 +742,10 @@ async function handleRefresh(
     onRefreshFailure?.(0, isNetwork);
 
     // Network error - don't clear cookies, might be transient
-    return redirectTo(
+    return refreshFailureResponse(
       request,
       `${LOGIN_PAGE}?callbackUrl=${encodeURIComponent(safeCallback)}&error=RefreshError`,
+      'RefreshError',
       false
     );
   }

package/src/pages/recovery/page.tsx

@@ -9,6 +9,7 @@ import { SelectMethodStep } from '../../components/recovery/SelectMethodStep';
 import { VerifyCodeStep } from '../../components/recovery/VerifyCodeStep';
 import { SetPasswordStep } from '../../components/recovery/SetPasswordStep';
 import { CompleteStep } from '../../components/recovery/CompleteStep';
+import { RequestedStep } from '../../components/recovery/RequestedStep';
 import { useColors } from '../../theme/useTheme';
 
 function RecoveryContent() {
@@ -24,7 +25,12 @@ function RecoveryContent() {
   const [verificationCode, setVerificationCode] = useState('');
   const [passwordResetToken, setPasswordResetToken] = useState<PasswordResetToken | null>(null);
   const [error, setError] = useState<string | null>(null);
+  // PAY-1591: true when the reset failed because the recovery itself is dead; the error box then offers a way back.
+  const [recoveryExpired, setRecoveryExpired] = useState(false);
   const [loading, setLoading] = useState(false);
+  // PAY-1588: true only after the IdP accepted the new password. The 'complete' step is ALSO reached from initiate()
+  // when no recovery session comes back, and that path must not tell the user a password was set.
+  const [resetSucceeded, setResetSucceeded] = useState(false);
 
   const handleInitiateRecovery = async () => {
     setLoading(true);
@@ -33,7 +39,7 @@ function RecoveryContent() {
     try {
       const response = await accountApi.initiateRecovery(email);
 
-      if (response.success && response.data.recovery_session_token) {
+      if (response.success && response.data?.recovery_session_token) {
         setRecoverySession({
           recoveryToken: response.data.recovery_session_token,
           email: email,
@@ -45,7 +51,8 @@ function RecoveryContent() {
         });
         setCurrentStep('select-method');
       } else {
-        setCurrentStep('complete');
+        // No recovery session (unknown / locked / throttled): the ONE neutral step, never CompleteStep (rigpert 60711).
+        setCurrentStep('requested');
       }
     } catch (err) {
       setError(err instanceof Error ? err.message : 'Failed to initiate recovery. Please try again.');
@@ -110,6 +117,7 @@ function RecoveryContent() {
 
     setLoading(true);
     setError(null);
+    setRecoveryExpired(false);
 
     try {
       const response = await accountApi.resetPasswordWithToken(
@@ -120,12 +128,14 @@ function RecoveryContent() {
       );
 
       if (response.success) {
+        setResetSucceeded(true);
         setCurrentStep('complete');
       } else {
         setError('Failed to reset password. Please try again.');
       }
     } catch (err) {
       setError(err instanceof Error ? err.message : 'Failed to reset password.');
+      setRecoveryExpired(!!err && (err as { code?: string }).code === 'RECOVERY_EXPIRED');
     } finally {
       setLoading(false);
     }
@@ -143,6 +153,11 @@ function RecoveryContent() {
         {error && (
           <div className="mb-4 bg-red-50 border border-red-200 rounded-2xl p-3">
             <p className="text-red-700 text-sm">{error}</p>
+            {recoveryExpired && (
+              <a href="/account-auth/recovery" className="text-sm font-medium underline">
+                Start password recovery again
+              </a>
+            )}
           </div>
         )}
 
@@ -191,13 +206,15 @@ function RecoveryContent() {
           />
         )}
 
+        {currentStep === 'requested' && <RequestedStep onGoToLogin={() => router.push('/account-auth/login')} />}
+
         {currentStep === 'complete' && (
           <CompleteStep
-            onGoToLogin={() => router.push('/account-auth/login')}
+            onGoToLogin={() => router.push(resetSucceeded ? '/account-auth/login?notice=password-set' : '/account-auth/login')}
           />
         )}
 
-        {currentStep !== 'complete' && currentStep !== 'initiate' && !loading && (
+        {currentStep !== 'complete' && currentStep !== 'requested' && currentStep !== 'initiate' && !loading && (
           <div className="mt-6 text-center">
             <button
               type="button"

package/src/pages/test-env/JwtInspectPage.tsx

@@ -2,6 +2,7 @@
 
 import { authClient } from '../../client/better-auth-client';
 import { useState, useEffect } from 'react';
+import { maskToken, redactCredentials } from './redact-credentials';
 
 // Decode JWT header (contains kid, alg, typ)
 function decodeJwtHeader(token: string): any {
@@ -70,7 +71,6 @@ export function JwtInspectPage() {
   const { data: sessionData, isPending } = authClient.useSession();
   const session = sessionData;
   const status = isPending ? 'loading' : session ? 'authenticated' : 'unauthenticated';
-  const [copied, setCopied] = useState<string | null>(null);
   const [isDarkMode, setIsDarkMode] = useState(false);
   const [jwtHeader, setJwtHeader] = useState<any>(null);
   const [jwtPayload, setJwtPayload] = useState<any>(null);
@@ -109,116 +109,10 @@ export function JwtInspectPage() {
     }
   }, [serverSession, session]);
 
-  // 248991 item 3 (QAPert 35021) - CREDENTIALS ARE REDACTED UNTIL DELIBERATELY
-  // REVEALED.
-  //
-  // Before this, loading the page put a live session token on screen and one
-  // click from the clipboard. That is the precondition the 246007 finding needs
-  // ("a caller who knows a session token can act on a session it does not own"),
-  // so this page was the supply side of the attack the same package was being
-  // hardened against. A screen-share, a screenshot or a support call was enough.
-  //
-  // The fix is deliberately NOT removing the tokens or the copy button: replaying
-  // a bearer in curl is the entire reason this tool exists, and a debug tool that
-  // cannot show you the thing you are debugging just gets replaced by a worse
-  // ad-hoc one. What changes is that exposure now requires an INTENTIONAL ACT per
-  // token, so the default state of a loaded page - the state a bystander, a
-  // screen-share or a screenshot captures - carries no usable credential.
-  //
-  // NOTE: this is a UI affordance, not an access control. Anyone who can load
-  // this page can still click reveal, and the values are in the network response
-  // either way. It shrinks accidental disclosure; it does not gate the route.
-  // The gate is mounting - see this file's docstring and index.ts.
-  const [revealed, setRevealed] = useState<Record<string, boolean>>({});
-
-  const maskToken = (value: string): string => {
-    if (value.length <= 12) return '\u2022'.repeat(Math.max(value.length, 8));
-    return `${value.slice(0, 6)}${'\u2022'.repeat(12)}${value.slice(-4)}  (${value.length} chars, hidden)`;
-  };
-
-  // Keys whose STRING values are live credentials. Anchored at the END of the key
-  // name on purpose: it catches sessionToken / accessToken / refreshToken /
-  // idpRefreshToken, while deliberately NOT catching the metadata beside them -
-  // accessTokenExpires, idpAccessTokenExpires, tokenType - which are safe and are
-  // the fields you actually want when debugging an expiry problem.
-  const CREDENTIAL_KEY = /(token|secret|password|apikey|credential)$/i;
-
-  // VALUE-SHAPE checks, because a key-name sweep has a blind spot that this page
-  // is squarely in: a credential under an innocuous key. Scout hit the same class
-  // elsewhere today (35297) - a postgres URL whose only key-name hit was a
-  // POINTER to the secret, while the actual password sat in the URL value and the
-  // sweep scored the file SAFE. Here the equivalents are a raw JWT parked under
-  // `jwt` / `bearer` / `authorization` / `cookie` - none of which end in `token`.
-  //
-  // JWT: three base64url segments. The length floors matter - without them
-  // "4.1.42" matches the three-segment shape and the package version would render
-  // as a redacted credential, which teaches people the redactor is broken.
-  const looksLikeJwt = (v: string): boolean => {
-    if (v.length < 40) return false;
-    const parts = v.split('.');
-    return parts.length === 3 && parts.every((p) => p.length >= 8 && /^[A-Za-z0-9_-]+$/.test(p));
-  };
-
-  // scheme://user:password@host - redact ONLY the password and keep the rest, so
-  // the URL stays usable for debugging. Masking the whole value would hide which
-  // host you are pointed at, which is usually the thing you opened this page for.
-  const URL_WITH_USERINFO = /^([a-z][a-z0-9+.-]*:\/\/)([^/\s:@]+):([^/\s@]+)@/i;
-
-  // Third value-shape check, on DotNetPert-Scout's 251951 rule: "a content-pattern
-  // sweep CANNOT find a credential that has no pattern." A PEM block defeats BOTH
-  // checks above and the key-name check as well - it has no key=value pair, its key
-  // name is usually something innocuous like `cert`, `pem`, `chain` or `data`, it is
-  // not three base64url segments so looksLikeJwt rejects it, and it is not a URL.
-  // He found a live wildcard TLS private key that had sat committed for 215 days for
-  // exactly this reason: it was never in anyone's search space, missed by
-  // construction rather than by carelessness.
-  //
-  // HONEST SCOPE: this is defence-in-depth, not a measured exposure. I have not seen
-  // PEM material in a session object and would not expect to. It is here because this
-  // dump renders WHATEVER the session carries, and the entire lesson of the two
-  // previous hardenings on this function is that the next credential arrives in a
-  // shape the current checks were not written for. Matching the armour band rather
-  // than the payload costs one regex.
-  // Matches the PEM ARMOUR BAND itself rather than enumerating key types. A first
-  // draft listed PRIVATE KEY / CERTIFICATE / RSA / EC / OPENSSH / PGP and a test
-  // caught it missing plain "-----BEGIN CERTIFICATE-----", because that header has
-  // no space before the closing dashes while "-----BEGIN RSA PRIVATE KEY-----" does.
-  // Enumerating the payload types is the same mistake as enumerating credential key
-  // names, one level down: it only ever covers the shapes already thought of.
-  // Requiring an alphanumeric after "BEGIN " keeps prose containing the word, and a
-  // bare "-----BEGIN-----", from matching.
-  const PEM_BLOCK = /-----BEGIN [A-Z0-9][A-Z0-9 ]*-----/;
-
-  // 248991 item 3, SECOND HALF. The masked fields above were only half the fix:
-  // the Raw Session Data block below re-rendered the SAME tokens in plain text via
-  // JSON.stringify, one click away behind a neutral "Click to expand" summary - and
-  // with them idpRefreshToken, which has NO other raw surface on this page (it is
-  // rendered as a boolean at the Refresh Token row precisely because it is the
-  // longest-lived credential of the three). Redacting per-field while dumping the
-  // whole object verbatim is not a partial fix, it is the appearance of one.
-  const redactCredentials = (value: unknown, keyName = ''): unknown => {
-    if (Array.isArray(value)) return value.map((v) => redactCredentials(v));
-    if (value && typeof value === 'object') {
-      return Object.fromEntries(
-        Object.entries(value as Record<string, unknown>).map(([k, v]) => [k, redactCredentials(v, k)]),
-      );
-    }
-    if (typeof value !== 'string' || value.length === 0) return value;
-    if (CREDENTIAL_KEY.test(keyName)) return maskToken(value);
-    // Key-name matching alone is not enough (DotNetPert-Scout 35297): a credential
-    // can sit under a key that is not credential-shaped at all. Two value-shape
-    // checks close the cases that actually reach a session object:
-    if (looksLikeJwt(value)) return maskToken(value);
-    if (PEM_BLOCK.test(value)) return '••• PEM block redacted (' + value.length + ' chars) •••';
-    if (URL_WITH_USERINFO.test(value)) return value.replace(URL_WITH_USERINFO, '$1$2:•••••@');
-    return value;
-  };
-
-  const copyToClipboard = (text: string, label: string) => {
-    navigator.clipboard.writeText(text);
-    setCopied(label);
-    setTimeout(() => setCopied(null), 2000);
-  };
+  // PAY-1470 (BAPert rulings 59022, 59040): credentials are shown as tokenLogId + length ONLY. The Reveal toggles
+  // (per token and for the raw session JSON) and the Copy buttons are gone: "never renders token material"
+  // includes click-to-reveal, because a full bearer one click away on a prod-reachable page is the same defect.
+  // The redaction rules (key names, JWT / PEM / URL-password shapes) live in ./redact-credentials.
 
   if (status === 'loading') {
     return (
@@ -371,58 +265,18 @@ export function JwtInspectPage() {
             <div>
               <div className="flex items-center justify-between mb-2">
                 <span className={labelClass}>Session Token (Redis Key):</span>
-                {displayExt.sessionToken && (
-                  <div className="flex items-center gap-2">
-                    <RevealButton
-                      revealed={!!revealed.session}
-                      onClick={() => setRevealed((r) => ({ ...r, session: !r.session }))}
-                      isDarkMode={isDarkMode}
-                    />
-                    {revealed.session && (
-                      <CopyButton
-                        onClick={() => copyToClipboard(displayExt.sessionToken, 'session')}
-                        copied={copied === 'session'}
-                        isDarkMode={isDarkMode}
-                      />
-                    )}
-                  </div>
-                )}
               </div>
               <code className={`block p-2 rounded text-xs break-all ${isDarkMode ? 'bg-slate-800' : 'bg-gray-100'}`}>
-                {displayExt.sessionToken
-                  ? revealed.session
-                    ? displayExt.sessionToken
-                    : maskToken(displayExt.sessionToken)
-                  : 'N/A'}
+                {displayExt.sessionToken ? maskToken(displayExt.sessionToken) : 'N/A'}
               </code>
             </div>
 
             <div>
               <div className="flex items-center justify-between mb-2">
                 <span className={labelClass}>Access Token (IDP):</span>
-                {displayExt.accessToken && (
-                  <div className="flex items-center gap-2">
-                    <RevealButton
-                      revealed={!!revealed.access}
-                      onClick={() => setRevealed((r) => ({ ...r, access: !r.access }))}
-                      isDarkMode={isDarkMode}
-                    />
-                    {revealed.access && (
-                      <CopyButton
-                        onClick={() => copyToClipboard(displayExt.accessToken, 'access')}
-                        copied={copied === 'access'}
-                        isDarkMode={isDarkMode}
-                      />
-                    )}
-                  </div>
-                )}
               </div>
               <code className={`block p-2 rounded text-xs break-all max-h-24 overflow-auto ${isDarkMode ? 'bg-slate-800' : 'bg-gray-100'}`}>
-                {displayExt.accessToken
-                  ? revealed.access
-                    ? displayExt.accessToken
-                    : maskToken(displayExt.accessToken)
-                  : 'N/A'}
+                {displayExt.accessToken ? maskToken(displayExt.accessToken) : 'N/A'}
               </code>
             </div>
 
@@ -465,7 +319,7 @@ export function JwtInspectPage() {
                   <InfoRow
                     key={key}
                     label={key}
-                    value={typeof value === 'object' ? JSON.stringify(value) : String(value)}
+                    value={typeof value === 'object' ? JSON.stringify(redactCredentials(value)) : String(redactCredentials(value, key))}
                     labelClass={labelClass}
                     valueClass={valueClass}
                   />
@@ -531,26 +385,13 @@ export function JwtInspectPage() {
           <summary className="font-semibold cursor-pointer">
             Raw Session Data &mdash; credentials redacted (Click to expand)
           </summary>
-          <div className="mt-3 flex items-center gap-3">
-            <RevealButton
-              revealed={!!revealed.raw}
-              onClick={() => setRevealed((r) => ({ ...r, raw: !r.raw }))}
-              isDarkMode={isDarkMode}
-            />
+          <div className="mt-3">
             <span className={`text-xs ${labelClass}`}>
-              {revealed.raw
-                ? 'Showing LIVE credentials in plain text, including the refresh token.'
-                : 'Token values are masked. Structure, claims and expiry fields are unchanged.'}
+              Token values are masked. Structure, claims and expiry fields are unchanged.
             </span>
           </div>
           <pre className={`mt-4 text-xs overflow-auto p-3 rounded ${isDarkMode ? 'bg-slate-800' : 'bg-gray-100'}`}>
-            {JSON.stringify(
-              revealed.raw
-                ? { clientSession: session, serverSession: serverSession }
-                : redactCredentials({ clientSession: session, serverSession: serverSession }),
-              null,
-              2,
-            )}
+            {JSON.stringify(redactCredentials({ clientSession: session, serverSession: serverSession }), null, 2)}
           </pre>
         </details>
       </div>
@@ -604,68 +445,5 @@ function StatusBadge({
   );
 }
 
-function CopyButton({
-  onClick,
-  copied,
-  isDarkMode,
-}: {
-  onClick: () => void;
-  copied: boolean;
-  isDarkMode: boolean;
-}) {
-  return (
-    <button
-      onClick={onClick}
-      className={`px-2 py-1 rounded text-xs ${
-        copied
-          ? 'bg-green-600 text-white'
-          : isDarkMode
-            ? 'bg-slate-700 hover:bg-slate-600 text-white'
-            : 'bg-gray-200 hover:bg-gray-300 text-gray-700'
-      }`}
-    >
-      {copied ? 'Copied!' : 'Copy'}
-    </button>
-  );
-}
-
-/**
- * Reveal toggle for a redacted credential (248991 item 3).
- *
- * Deliberately labelled "Reveal token" rather than something neutral like
- * "Show": the label is the last chance to tell whoever is about to click it,
- * possibly while screen-sharing, that a live credential is about to appear.
- */
-function RevealButton({
-  revealed,
-  onClick,
-  isDarkMode,
-}: {
-  revealed: boolean;
-  onClick: () => void;
-  isDarkMode: boolean;
-}) {
-  return (
-    <button
-      onClick={onClick}
-      title={
-        revealed
-          ? 'Hide this credential again'
-          : 'Reveals a LIVE credential in plain text. Not while screen-sharing.'
-      }
-      className={`px-2 py-1 rounded text-xs ${
-        revealed
-          ? isDarkMode
-            ? 'bg-amber-700 hover:bg-amber-600 text-white'
-            : 'bg-amber-200 hover:bg-amber-300 text-amber-900'
-          : isDarkMode
-            ? 'bg-slate-700 hover:bg-slate-600 text-white'
-            : 'bg-gray-200 hover:bg-gray-300 text-gray-700'
-      }`}
-    >
-      {revealed ? 'Hide' : 'Reveal token'}
-    </button>
-  );
-}
 
 export default JwtInspectPage;

package/src/pages/test-env/RefreshTokenPage.tsx

@@ -1,6 +1,9 @@
 "use client";
 import React, { useState, useEffect } from "react";
 import { authClient } from '../../client/better-auth-client';
+// PAY-1470 (BAPert 59022): never render characters of a token, whatever the ENABLE_TEST_ROUTES gate says.
+// idealresume production mounted this page on 4.1.14 (pre-gate) showing 40 chars of both tokens.
+import { redactCredentials } from './redact-credentials';
 
 /**
  * ⚠️ DEBUG PAGE THAT DRIVES A DESTRUCTIVE ENDPOINT — DO NOT MOUNT IN
@@ -112,11 +115,12 @@ export function RefreshTokenPage() {
           <div><span className="text-gray-400">2FA Complete:</span> {String((session?.user as any)?.twoFactorSessionVerified ?? "unknown")}</div>
           <div>
             <span className="text-gray-400">Access Token:</span>{" "}
-            {sessionDetails?.accessToken ? `${sessionDetails.accessToken.substring(0, 40)}...` : "N/A"}
+            {/* PAY-1481: the session route returns presence only. */}
+            {sessionDetails ? (sessionDetails.hasAccessToken ? "present (server-side only)" : "absent") : "N/A"}
           </div>
           <div>
             <span className="text-gray-400">Refresh Token:</span>{" "}
-            {sessionDetails?.refreshToken ? `${sessionDetails.refreshToken.substring(0, 40)}...` : "N/A"}
+            {sessionDetails ? (sessionDetails.hasRefreshToken ? "present (server-side only)" : "absent") : "N/A"}
           </div>
           <div>
             <span className="text-gray-400">Access Expires:</span>{" "}
@@ -154,7 +158,7 @@ export function RefreshTokenPage() {
         <div className="rounded border border-gray-600 bg-gray-800 p-4">
           <h3 className="font-semibold mb-2 text-gray-300">Result:</h3>
           <pre className="text-xs overflow-x-auto whitespace-pre-wrap text-green-400">
-            {JSON.stringify(result, null, 2)}
+            {JSON.stringify(redactCredentials(result), null, 2)}
           </pre>
         </div>
       )}
@@ -163,7 +167,8 @@ export function RefreshTokenPage() {
       <details className="mt-4">
         <summary className="cursor-pointer text-gray-400 hover:text-white">Raw Session Details</summary>
         <pre className="mt-2 text-xs bg-gray-800 p-2 rounded overflow-x-auto text-gray-300">
-          {JSON.stringify(sessionDetails, null, 2)}
+          {/* PAY-1470: this dumped the access AND refresh token in full (Nextpert-Scout 59060). */}
+          {JSON.stringify(redactCredentials(sessionDetails), null, 2)}
         </pre>
       </details>
     </div>