@payez/next-mvp 4.4.5 → 4.4.6

package/src/utils/api.ts

@@ -1,6 +1,7 @@
 import { ENV_CONFIG, API_ENDPOINTS } from '../config/env';
 import { TwoFactorMethod } from '../types/security';
 import { standardizedApi, isApiSuccess, isApiError, extractApiData } from '../lib/standardized-client-api';
+import { knownPasswordRules, passwordRuleSentences } from '../lib/password-rules';
 
 export class ApiError extends Error {
     type: string;
@@ -96,6 +97,35 @@ export async function apiFetch<T>(url: string, options: ApiOptions = {}): Promis
 // DELETED: apiFetchAuth - Use clientApi from @/lib/client-api instead for proper token refresh handling
 
 // Account API for masked info and 2FA
+/**
+ * PAY-1591: what the user reads when the LAST recovery step fails. Four outcomes, told apart only by codes the IdP really sends
+ * (see resetFailureText): a password-policy refusal names the failed rules; an explicit expired/used token says so and links back
+ * to recovery; any other 400/422 gets a neutral 'check the requirements and try again' (the user's recovery session is kept); and
+ * a server or transport failure gets a retry sentence. None of them is the old fixed "Failed to reset password".
+ */
+export const RECOVERY_EXPIRED_TEXT = 'This reset link has expired or was already used. Start password recovery again.';
+
+export const RESET_NEUTRAL_TEXT = "We couldn't set that password. Check it meets the requirements shown and try again.";
+
+/**
+ * Three tiers for a 400/422 from reset (rigpert 60822, QAPert 60820), decided ONLY on codes the IdP actually sends:
+ *   policy        details.code password_policy (projected by the handler as password_policy) -> the rule sentences
+ *   tokenInvalid  an EXPLICIT expired/used signal (token_expired / token_used / Identity InvalidToken, projected as
+ *                 reset_token_invalid) -> 'link expired, start again'
+ *   anything else -> NEUTRAL, which must NOT tell the user their link is dead: the served IdP sends a weak-password refusal with
+ *                 no code, and 'expired' there loops them after they spent their emailed code. The recovery session is kept, so
+ *                 they can retry.
+ */
+export function resetFailureText(status: number, rules: string[] = [], policy = false, tokenInvalid = false): string {
+    if (status === 400 || status === 422) {
+        if (tokenInvalid && !policy) return RECOVERY_EXPIRED_TEXT;
+        if (!policy) return RESET_NEUTRAL_TEXT;
+        const base = "That password wasn't accepted.";
+        return rules.length ? `${base} ${passwordRuleSentences(rules)}` : `${base} Try a different one; the rules are shown above.`;
+    }
+    return "We couldn't reset your password just now. Please try again.";
+}
+
 export class AccountApi {
     /**
      * Get masked user info (email, phone, authenticator status)
@@ -116,18 +146,16 @@ export class AccountApi {
         // Empty body: user info comes from JWT token
         const result = await standardizedApi.post<any>('/api/account/masked-info', {}, accessToken);
 
+        // PAY-1427: masked email/phone are still user data - log the response shape, never its values.
         console.log('[DEBUG] getMaskedInfo result:', {
             success: isApiSuccess(result),
             hasData: isApiSuccess(result) && !!result.data,
-            rawData: isApiSuccess(result) ? result.data : null,
             dataFields: isApiSuccess(result) && result.data ? Object.keys(result.data) : []
         });
 
-        console.log('[DEBUG] getMaskedInfo raw data structure:', JSON.stringify(isApiSuccess(result) ? result.data : result, null, 2));
-
         if (!isApiSuccess(result)) {
             const errorMessage = isApiError(result) ? result.message : 'Failed to get masked info';
-            console.error('[DEBUG] getMaskedInfo failed:', result);
+            console.error('[DEBUG] getMaskedInfo failed:', { keys: result && typeof result === 'object' ? Object.keys(result) : typeof result });
             throw new ApiError(errorMessage, result);
         }
         // Use only snake_case fields from backend response
@@ -149,6 +177,8 @@ export class AccountApi {
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ email }),
         });
+        // PAY-1588: a throttled caller (429) must look exactly like an unknown one - no session, no distinguishing error.
+        if (res.status === 429) return { success: false, data: {} } as any;
         if (!res.ok) throw new Error('Failed to initiate recovery');
         return res.json();
     }
@@ -193,12 +223,21 @@ export class AccountApi {
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({
                 email,
-                password_reset_token: resetToken,
+                token: resetToken,
                 new_password: newPassword,
                 confirm_password: confirmPassword,
             }),
         });
-        if (!res.ok) throw new Error('Failed to reset password');
+        if (!res.ok) {
+            const body = await res.json().catch(() => null);
+            const policy = !!body?.password_policy;
+            const rules = knownPasswordRules(body?.password_policy?.rules);
+            const tokenInvalid = body?.reset_token_invalid === true;
+            const err = new Error(resetFailureText(res.status, rules, policy, tokenInvalid)) as Error & { rules?: string[]; code?: string };
+            if (rules.length) err.rules = rules;
+            if ((res.status === 400 || res.status === 422) && tokenInvalid && !policy) err.code = 'RECOVERY_EXPIRED';
+            throw err;
+        }
         return res.json();
     }
 
@@ -210,8 +249,8 @@ export class AccountApi {
             body: JSON.stringify({
                 email: data.email,
                 token: data.token,
-                password: data.password,
-                password_confirmation: data.password_confirmation
+                new_password: data.password,
+                confirm_password: data.password_confirmation
             })
         })
         const result = await res.json().catch(() => ({}))

package/src/vibe/sessions.ts

@@ -116,7 +116,8 @@ async function vibeProxyRequest<T>(
 
     if (!response.ok) {
       const errorText = await response.text();
-      console.error(`[vibe-sessions] Proxy error ${response.status}:`, errorText);
+      // PAY-1427: never the raw proxy body - the request carried a Bearer token and an error page can echo it.
+      console.error(`[vibe-sessions] Proxy error ${response.status}:`, { bodyLength: errorText.length });
       return null;
     }