@payez/next-mvp 4.4.5 → 4.4.6

package/dist/lib/app-slug.js

@@ -12,6 +12,10 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getAppSlug = getAppSlug;
+exports.slugMismatchReason = slugMismatchReason;
+exports.assertIdpSlugKnown = assertIdpSlugKnown;
+exports.slugStateReason = slugStateReason;
+exports.assertAppSlugMatchesIdp = assertAppSlugMatchesIdp;
 exports.clearSlugCache = clearSlugCache;
 exports.getSessionPrefix = getSessionPrefix;
 exports.getAnonPrefix = getAnonPrefix;
@@ -37,6 +41,53 @@ function getAppSlug() {
     cachedSlug = process.env.APP_SLUG || process.env.CLIENT_ID || 'payez';
     return cachedSlug;
 }
+/**
+ * The session cookie name has TWO producers: better-auth mints `${idpConfig.clientSlug || getAppSlug()}.session-token`, while
+ * the gate and every reader use getSessionCookieName() = getAppSlug() = APP_SLUG || CLIENT_ID. When the IdP's slug is known and
+ * differs, the gate looks for a cookie that was never set and every better-auth (Google) session bounces to
+ * /sign-in?error=SessionInvalid straight after a successful 2FA (rigpert 60743, live on :4797 with CLIENT_ID=idp-admin-ui-graft
+ * against clientSlug idp_admin_ui_graft). FAIL CLOSED: refuse rather than run with two names. No IdP slug -> nothing to compare.
+ */
+function slugMismatchReason(idpClientSlug) {
+    if (!idpClientSlug)
+        return null;
+    const gateSlug = getAppSlug();
+    return idpClientSlug !== gateSlug ? `SLUG_MISMATCH: cookie=${idpClientSlug} gate=${gateSlug}` : null;
+}
+/**
+ * rigpert 60813: when the IdP returns NO client slug for this app (an unknown client: the config fetch failed or came back
+ * without one), startup must fail LOUD. Silently defaulting would run with a cookie name nobody verified against the IdP. The
+ * startup path swallows a failed config fetch when BETTER_AUTH_SECRET is supplied by env, so without this an unregistered
+ * CLIENT_ID (e.g. payez_idp_customer_web, absent on dev-93) would boot 'fine'.
+ */
+function assertIdpSlugKnown(idpClientSlug) {
+    if (idpClientSlug)
+        return;
+    throw new Error(`[FATAL] The IdP returned no client slug for this app (gate slug "${getAppSlug()}"). Either CLIENT_ID/APP_SLUG names a client ` +
+        `the IdP does not know, or its config could not be fetched. Refusing to start with an unverified session cookie name.`);
+}
+/**
+ * The health-endpoint view: a mismatch is always reportable; an UNKNOWN slug is reported only once startup has actually been
+ * attempted (before that nothing is known yet and health must not go red on a pod that has not started initialising).
+ */
+function slugStateReason(idpClientSlug, startupAttempted) {
+    const mismatch = slugMismatchReason(idpClientSlug);
+    if (mismatch)
+        return mismatch;
+    if (startupAttempted && !idpClientSlug)
+        return `SLUG_UNKNOWN: the IdP returned no client slug for this app gate=${getAppSlug()}`;
+    return null;
+}
+function assertAppSlugMatchesIdp(idpClientSlug) {
+    if (!idpClientSlug)
+        return;
+    const gateSlug = getAppSlug();
+    if (slugMismatchReason(idpClientSlug) !== null) {
+        throw new Error(`[FATAL] Session cookie name would have two sources: the IdP client slug is "${idpClientSlug}" but this app's slug ` +
+            `(APP_SLUG, else CLIENT_ID) is "${gateSlug}". better-auth would set "${idpClientSlug}.session-token" while the gate reads ` +
+            `"${gateSlug}.session-token", so every better-auth session would be rejected. Set APP_SLUG (or CLIENT_ID) to "${idpClientSlug}".`);
+    }
+}
 /**
  * Clears the cached slug (useful for testing).
  */

package/dist/lib/ensure-fresh-access-token.d.ts

@@ -17,6 +17,32 @@ export type EnsureFreshResult = {
     accessTokenExpires: number;
     /** True if we refreshed (or a concurrent refresh completed); false if the stored token was already fresh. */
     refreshed: boolean;
+    /**
+     * CARD 320072. Is the token in THIS result actually in the session store?
+     *
+     * ON THIS BRANCH OF THE UNION IT IS ALWAYS `true`, AND THAT IS THE POINT.
+     * Every `ok: true` return either read the token back from the store or
+     * wrote it and confirmed the write. An unpersisted refresh does not reach
+     * an `ok: true` result at all — it returns `ok:false, SESSION_PERSIST_FAILED`
+     * from the other branch below.
+     *
+     * READ THIS BEFORE YOU DELETE THE FIELD. It is declared `boolean` rather
+     * than the literal `true` on purpose: it is the assertable witness that the
+     * escalation is still wired. If someone later re-weakens the persist site
+     * back to reporting success, this field is where that regression becomes
+     * visible to a test instead of invisible to everyone. Cases 2 and 7 in
+     * test/ensure-fresh-persist-failure.test.cjs assert on it.
+     *
+     * WHAT THIS COMMENT USED TO SAY, AND WHY IT IS GONE. It documented `false`
+     * as a live value on an ok:true result — "we hold a valid token that was
+     * not persisted" — because that WAS the contract before this merge, when
+     * the dropped write was reported as a success with a flag on it. Blending
+     * in the escalation made that sentence describe a state the code can no
+     * longer produce. A docblock asserting an impossible semantic is exactly
+     * the defect f5ac6dc3 was written to fix, one file over; reproducing it
+     * here while merging that fix would be absurd.
+     */
+    persisted: boolean;
 } | {
     ok: false;
     code: string;

package/dist/lib/ensure-fresh-access-token.js

@@ -66,7 +66,8 @@ async function ensureFreshAccessToken(sessionToken, config, options = {}) {
     const effectiveExpires = jwtExpires > 0 ? Math.min(redisExpires || jwtExpires, jwtExpires) : redisExpires;
     const msUntilExpiry = effectiveExpires - now;
     if (msUntilExpiry > safetyWindowMs) {
-        return { ok: true, accessToken: storedToken, accessTokenExpires: effectiveExpires, refreshed: false };
+        // Durable by construction: this token came OUT of the store and we wrote nothing.
+        return { ok: true, accessToken: storedToken, accessTokenExpires: effectiveExpires, refreshed: false, persisted: true };
     }
     if (!session.idpRefreshToken) {
         return {
@@ -103,6 +104,8 @@ async function ensureFreshAccessToken(sessionToken, config, options = {}) {
                                 accessToken: after.idpAccessToken,
                                 accessTokenExpires: after.idpAccessTokenExpires,
                                 refreshed: true,
+                                // Read back from the store after the winner's refresh - durable.
+                                persisted: true,
                             };
                         }
                     }
@@ -140,6 +143,8 @@ async function ensureFreshAccessToken(sessionToken, config, options = {}) {
                     accessToken: latest.idpAccessToken,
                     accessTokenExpires: latest.idpAccessTokenExpires,
                     refreshed: true,
+                    // Post-lock re-read: another caller already refreshed and stored this.
+                    persisted: true,
                 };
             }
         }
@@ -229,12 +234,37 @@ async function ensureFreshAccessToken(sessionToken, config, options = {}) {
                 // between pre-lock read and our send would be misjudged.
                 const tokenUnchanged = !!sentRefreshToken && postRefresh?.idpRefreshToken === sentRefreshToken;
                 if (tokenUnchanged) {
-                    await (0, session_store_1.updateSession)(sessionToken, {
+                    /**
+                     * 320072: this is the OTHER updateSession call in this file, and it
+                     * does NOT escalate on a null return the way the persist site below
+                     * does. Checked, not overlooked: reaching here requires
+                     * `tokenUnchanged`, which requires `postRefresh?.idpRefreshToken` to
+                     * equal the token we sent — so the CAS read three lines up already
+                     * proved the row exists. A missing row makes tokenUnchanged false and
+                     * routes to the else branch instead, so the dropped-write path is
+                     * very nearly unreachable here.
+                     *
+                     * "Very nearly" is why the return IS still captured. The residual both
+                     * halves of this merge identified is real: the row can expire between
+                     * that CAS read and this write, in which case the dead refresh token is
+                     * NOT cleared and the "we discarded it" claim in the error below is
+                     * false. That costs nothing to observe and cannot be inferred from any
+                     * other line, so it is warned rather than assumed — see `if (!cleared)`
+                     * immediately below. The RESULT is unchanged either way: the session is
+                     * unusable and we return the same non-ok payload.
+                     */
+                    const cleared = await (0, session_store_1.updateSession)(sessionToken, {
                         idpRefreshToken: '',
                         idpRefreshTokenExpires: undefined,
                         refreshTokenClearedAt: Date.now(),
                         refreshTokenClearedReason: `IDP_DISCARD_TOKEN:${code}`,
                     });
+                    if (!cleared) {
+                        console.warn('[ENSURE-FRESH] discard-token clear did not persist - no canonical session row', {
+                            code,
+                            requestId,
+                        });
+                    }
                 }
                 else {
                     // Concurrent refresh already rotated the token — our 401 is stale. Return the
@@ -247,6 +277,8 @@ async function ensureFreshAccessToken(sessionToken, config, options = {}) {
                             accessToken: postRefresh.idpAccessToken,
                             accessTokenExpires: postRefresh.idpAccessTokenExpires,
                             refreshed: true,
+                            // `postRefresh` is a store read, so this token is by definition stored.
+                            persisted: true,
                         };
                     }
                 }
@@ -301,7 +333,14 @@ async function ensureFreshAccessToken(sessionToken, config, options = {}) {
         const acrLevel = String(decoded?.acr || session.authenticationLevel || '1');
         const hasNewRefresh = typeof newRefresh === 'string' && newRefresh.length > 0;
         const newKid = (0, token_utils_1.extractKidFromToken)(newAccess);
-        await (0, session_store_1.updateSession)(sessionToken, {
+        // *** CARD 320072. CAPTURE THIS RETURN. ***
+        // `updateSession` returns null - and writes nothing - when the canonical
+        // session row is missing, which happens whenever the BA fallback above is what
+        // resolved this session. Discarding the return is what let this function
+        // report `ok:true, refreshed:true` for a refresh it had just thrown away.
+        // The full rationale for what we DO about it is at the `if (!persisted)`
+        // block below; this line only makes the answer available.
+        const persisted = await (0, session_store_1.updateSession)(sessionToken, {
             ...session,
             idpAccessToken: newAccess,
             idpAccessTokenExpires: accessTokenExpires,
@@ -320,7 +359,69 @@ async function ensureFreshAccessToken(sessionToken, config, options = {}) {
             mfaExpiresAt: decoded?.mfa_expires ? parseInt(decoded.mfa_expires) * 1000 : session.mfaExpiresAt,
             mfaValidityHours: decoded?.mfa_validity_hours ? parseInt(decoded.mfa_validity_hours) : session.mfaValidityHours,
         });
-        return { ok: true, accessToken: newAccess, accessTokenExpires, refreshed: true };
+        /**
+         * 320072: DO NOT REPORT SUCCESS FOR A WRITE THAT WAS DISCARDED.
+         *
+         * `updateSession` returns null when the canonical session row is absent,
+         * which silently throws away EVERYTHING above — the new access token, the
+         * rotated refresh token, decodedAccessToken, authenticationMethods,
+         * mfaVerified, mfaCompletedAt, mfaExpiresAt. This return value was
+         * previously ignored, and the line below then reported
+         * `ok: true, refreshed: true`.
+         *
+         * WHY THAT IS WORSE THAN A PLAIN LOST WRITE. By this point the exchange at
+         * the IDP has ALREADY HAPPENED, so if refresh tokens are single-use the
+         * token we sent is now spent and its replacement is the thing we just
+         * dropped. The stored credential is therefore dead, and every later attempt
+         * re-sends that same dead token and fails. The user is bounced to LOGIN —
+         * not to verify-code — with nothing in the logs naming the cause.
+         *
+         * It did not even surface as a wrong answer to our one caller: server/auth.ts
+         * calls getRedisSession immediately after us, which is this same `getSession`,
+         * so it finds the same missing row and returns a generic NO_SESSION one frame
+         * later. The false `ok: true` was thus invisible AND the real cause — a
+         * dropped persist — was reported as an unrelated missing session.
+         *
+         * Naming it here is the point: the failure is reported at its true cause,
+         * with a code that says the refresh succeeded and the PERSIST is what
+         * failed. Not retryable — retrying burns another refresh token the same way.
+         *
+         * This is the card's option (b), deliberately. Option (a) — teaching
+         * updateSession to write through to whichever store holds the session,
+         * mirroring the read fallback above — is the better end state but changes
+         * write-path storage semantics for every caller, which is not this card.
+         *
+         * AND IT IS ALSO LOGGED, WHICH IS NOT THE SAME THING (BAPert R1134 §7,
+         * re-affirmed in R1145 §2c). Returning a named code tells the CALLER. §7
+         * requires that `persisted:false` reach a log A HUMAN READS, because the one
+         * caller — server/auth.ts — converts every non-ok result into the same
+         * generic 401 and keeps no record of which code produced it. Without this
+         * line the distinction we just bought at the type level is erased one frame
+         * later and no operator ever sees the word PERSIST. The escalation is the
+         * contract; the warn is the evidence.
+         */
+        if (!persisted) {
+            console.warn('[ENSURE-FRESH] refresh succeeded but was NOT persisted - no canonical session row', {
+                requestId,
+                refreshTokenRotated: hasNewRefresh,
+                persisted: false,
+            });
+            return {
+                ok: false,
+                code: 'SESSION_PERSIST_FAILED',
+                message: 'Token refresh succeeded at the IDP but the session could not be persisted; the rotated tokens were discarded.',
+                status: 401,
+                terminal: true,
+                retryable: false,
+                discardToken: true,
+                resolution: 'REAUTHENTICATE',
+            };
+        }
+        // `persisted: true` is not decoration and not a leftover: the `if` above is
+        // the only way out for a dropped write, so by construction anything reaching
+        // this line WAS written. Keeping the field keeps the ok:true branch of
+        // EnsureFreshResult total (Cases 2 and 7 assert on it) — BAPert R1145 §2d.
+        return { ok: true, accessToken: newAccess, accessTokenExpires, refreshed: true, persisted: true };
     }
     finally {
         if (weHoldLock) {

package/dist/lib/idp-client-config.d.ts

@@ -81,6 +81,26 @@ export interface IDPClientConfig {
     branding: BrandingConfig;
     baseClientUrl?: string;
 }
+/**
+ * The IdP serves the signing secret and every OAuth provider client secret in the client config, to any
+ * caller holding a client assertion (PAY-1460). It cannot stop serving them while this package depends on
+ * them: every earlier version throws FATAL on an empty config authSecret, whatever the environment says.
+ *
+ * So both are now resolved ENV FIRST, config second:
+ *   signing secret   BETTER_AUTH_SECRET (canonical), NEXTAUTH_SECRET (legacy alias), then config authSecret.
+ *                    Uses the module-load snapshot above: this module publishes the config value into
+ *                    process.env, so a live read would mistake the IdP's value for the operator's.
+ *   provider secret  <PROVIDER>_CLIENT_SECRET, provider name upper-cased with non-alphanumerics as '_'
+ *                    (GOOGLE_CLIENT_SECRET, APPLE_CLIENT_SECRET, MICROSOFT_CLIENT_SECRET), then config.
+ *
+ * The FATAL on an empty signing secret is unchanged and still load-bearing: it now fires only when BOTH the
+ * environment and the config are empty.
+ *
+ * Values are never logged. The SOURCE of each is logged once per change. An env-sourced value is never
+ * written to the Redis config cache (stripEnvSecrets); a cache read re-applies the environment.
+ */
+export type SecretSource = string;
+export declare function providerSecretEnvVar(provider: string): string;
 /**
  * Get IDP client configuration with multi-tier caching.
  *

package/dist/lib/idp-client-config.js

@@ -74,6 +74,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.providerSecretEnvVar = providerSecretEnvVar;
 exports.getIDPClientConfig = getIDPClientConfig;
 exports.clearConfigCache = clearConfigCache;
 exports.clearConfigRedisCache = clearConfigRedisCache;
@@ -124,6 +125,49 @@ async function getRedis() {
 const OPERATOR_AUTH_SECRET = process.env.BETTER_AUTH_SECRET;
 const OPERATOR_NEXTAUTH_SECRET = process.env.NEXTAUTH_SECRET;
 let operatorOverrideLogged = false;
+function providerSecretEnvVar(provider) {
+    return `${String(provider).trim().toUpperCase().replace(/[^A-Z0-9]+/g, '_')}_CLIENT_SECRET`;
+}
+const loggedSecretSources = new Map();
+function logSecretSource(what, source) {
+    if (loggedSecretSources.get(what) === source)
+        return;
+    loggedSecretSources.set(what, source);
+    console.log(`[IDP_CONFIG] ${what} source: ${source}`);
+}
+function resolveAuthSecret(fromConfig) {
+    if (OPERATOR_AUTH_SECRET)
+        return { value: OPERATOR_AUTH_SECRET, source: 'env:BETTER_AUTH_SECRET' };
+    if (OPERATOR_NEXTAUTH_SECRET)
+        return { value: OPERATOR_NEXTAUTH_SECRET, source: 'env:NEXTAUTH_SECRET' };
+    if (fromConfig)
+        return { value: fromConfig, source: 'idp-config' };
+    return { value: '', source: 'none' };
+}
+/** A copy of `config` with every secret resolved env-first. Never mutates (the argument may be cached). */
+function applyEnvSecrets(config) {
+    const auth = resolveAuthSecret(config.authSecret);
+    logSecretSource('authSecret', auth.source);
+    return {
+        ...config,
+        authSecret: auth.value,
+        oauthProviders: (config.oauthProviders ?? []).map((p) => {
+            const envVar = providerSecretEnvVar(p.provider);
+            const fromEnv = process.env[envVar];
+            const source = fromEnv ? `env:${envVar}` : p.clientSecret ? 'idp-config' : 'none';
+            logSecretSource(`${p.provider} clientSecret`, source);
+            return { ...p, clientSecret: fromEnv || p.clientSecret };
+        }),
+    };
+}
+/** What may be persisted to Redis: env-sourced secrets are blanked (the environment re-supplies them on read). */
+function stripEnvSecrets(config) {
+    return {
+        ...config,
+        authSecret: OPERATOR_AUTH_SECRET || OPERATOR_NEXTAUTH_SECRET ? '' : config.authSecret,
+        oauthProviders: (config.oauthProviders ?? []).map((p) => process.env[providerSecretEnvVar(p.provider)] ? { ...p, clientSecret: '' } : p),
+    };
+}
 /** Publish the resolved auth secret WITHOUT ever overwriting an operator-set value. */
 function publishAuthSecret(value, source) {
     if (OPERATOR_AUTH_SECRET) {
@@ -234,7 +278,8 @@ async function setConfigInRedis(config) {
         const key = getRedisConfigKey();
         const ttlSeconds = config.configCacheTtlSeconds || 300;
         const data = {
-            config,
+            // PAY-1460: never persist a secret the environment supplied.
+            config: stripEnvSecrets(config),
             expiresAt: Date.now() + (ttlSeconds * 1000)
         };
         // Store with TTL slightly longer than the logical expiry to allow for clock skew
@@ -289,7 +334,10 @@ async function getIDPClientConfig(forceRefresh = false) {
     }
     // Layer 2: Check Redis cache (skip if forceRefresh - startup should always get fresh data)
     if (!forceRefresh) {
-        const redisConfig = await getConfigFromRedis();
+        // PAY-1460: a cached entry never carries env-sourced secrets (stripEnvSecrets), so the
+        // environment is re-applied on read, BEFORE the emptiness test below.
+        const cachedRaw = await getConfigFromRedis();
+        const redisConfig = cachedRaw ? applyEnvSecrets(cachedRaw) : null;
         // A cached entry is only USABLE if it carries a secret — see the note
         // below. `redisConfig && !authSecret` must behave like a cache MISS, so
         // the emptiness test belongs here, in the condition that gates the
@@ -433,7 +481,7 @@ async function getIDPClientConfig(forceRefresh = false) {
             // This throw is what stops that. It is also what turned the
             // 2026-08-05 nextauth_secret spelling bug into a loud FATAL instead
             // of a silently forgeable app.
-            throw new Error('[IDP_CONFIG] FATAL: IDP did not return authSecret');
+            throw new Error('[IDP_CONFIG] FATAL: IDP did not return authSecret and neither BETTER_AUTH_SECRET nor NEXTAUTH_SECRET is set');
         }
         // Validated above — only now is it safe to cache or publish.
         publishAuthSecret(config.authSecret, 'freshly-fetched IDP config');
@@ -503,7 +551,7 @@ async function fetchConfigFromInternalIDP(internalIdpUrl, clientIdStr) {
     });
     if (!resp.ok) {
         const txt = await resp.text().catch(() => 'Unknown error');
-        throw new Error(`[IDP_CONFIG] FATAL: Internal IDP returned ${resp.status} - ${txt}`);
+        throw new Error(`[IDP_CONFIG] FATAL: Internal IDP returned ${resp.status} (body ${txt.length} chars)`); // PAY-1427
     }
     const body = await resp.json().catch(() => null);
     if (!body) {
@@ -514,7 +562,7 @@ async function fetchConfigFromInternalIDP(internalIdpUrl, clientIdStr) {
     if (rawClientId === undefined || rawClientId === null) {
         throw new Error(`[IDP_CONFIG] FATAL: Internal IDP response missing clientId. Got: ${JSON.stringify(Object.keys(configData))}`);
     }
-    const config = {
+    const config = applyEnvSecrets({
         clientId: String(rawClientId),
         clientSlug: configData.clientSlug ?? configData.client_slug ?? configData.slug ?? '',
         // Wire compatibility: accept new authSecret first, fall back to legacy
@@ -575,12 +623,12 @@ async function fetchConfigFromInternalIDP(internalIdpUrl, clientIdStr) {
             logoUrl: configData.branding?.logoUrl ?? configData.branding?.logo_url
         },
         baseClientUrl: configData.baseClientUrl ?? configData.base_client_url ?? configData.BaseClientUrl
-    };
+    });
     if (!config.authSecret) {
         // LOAD-BEARING — see the note on the external path's equivalent throw.
         // An empty secret reaching betterAuth() becomes the PUBLIC default, not an
         // error. Never replace this with a fallback.
-        throw new Error('[IDP_CONFIG] FATAL: Internal IDP did not return authSecret');
+        throw new Error('[IDP_CONFIG] FATAL: Internal IDP did not return authSecret and neither BETTER_AUTH_SECRET nor NEXTAUTH_SECRET is set');
     }
     console.log(`[IDP_CONFIG] Internal IDP config loaded for ${clientIdStr}`);
     consecutiveFailures = 0;
@@ -649,7 +697,8 @@ async function fetchConfigFromIDP(idpUrl, clientIdStr) {
         });
         if (!signingResp.ok) {
             const txt = await signingResp.text().catch(() => 'Unknown error');
-            throw new Error(`[IDP_CONFIG] FATAL: Failed to sign client assertion: ${signingResp.status} - ${txt}`);
+            // PAY-1427: the thrown message is logged by callers - body length only, never the upstream text.
+            throw new Error(`[IDP_CONFIG] FATAL: Failed to sign client assertion: ${signingResp.status} (body ${txt.length} chars)`);
         }
         const signingBody = await signingResp.json().catch(() => null);
         if (!signingBody) {
@@ -660,7 +709,8 @@ async function fetchConfigFromIDP(idpUrl, clientIdStr) {
         const client_assertion = (signingBody?.data?.client_assertion ??
             signingBody?.data?.clientAssertion);
         if (!client_assertion) {
-            console.error('[IDP_CONFIG] FATAL: Full response body:', JSON.stringify(signingBody, null, 2));
+            // PAY-1427: never the full sign-client-assertion body (assertion material). Key names only.
+            console.error('[IDP_CONFIG] FATAL: sign-client-assertion response shape:', { keys: Object.keys(signingBody || {}), dataKeys: Object.keys(signingBody?.data || {}) });
             throw new Error(`[IDP_CONFIG] FATAL: IDP response missing client_assertion. Got keys: ${JSON.stringify(Object.keys(signingBody?.data || signingBody || {}))}`);
         }
         // Step 2: Fetch client config using the assertion
@@ -673,42 +723,12 @@ async function fetchConfigFromIDP(idpUrl, clientIdStr) {
                 'X-Client-Id': clientIdStr,
                 'X-Correlation-Id': (0, crypto_1.randomUUID)().replace(/-/g, ''),
             },
-            // 217917 PHASE 1: explicit opt-in for provider secrets.
-            //
-            // This broker is the ONLY consumer of oauth_providers[].client_secret
-            // (DotNetPert enumerated it: this file feeds auth/providers/oauth.ts,
-            // which performs the server-side code exchange). Every OTHER caller of
-            // ExternalAuth/client-config - notably every fielded acp-desktop - is
-            // pushed the same secrets today and reads none of them: the desktop is
-            // PKCE and dropped clientSecret from OAuthProviderConfig entirely.
-            //
-            // The IDP IGNORES this field today, so shipping it is a no-op and needs
-            // no coordination window. Phase 2 (DotNetPert, IDP side) makes
-            // client-config emit the secrets ONLY when the opt-in is present and
-            // redact otherwise - which is why phase 1 MUST be live first, or the
-            // broker loses the field and tenant OAuth sign-in dies.
-            //
-            // SCOPE, deliberately narrow - do NOT read this as a partial migration:
-            // the sibling path fetchConfigFromInternalIDP() hits a DIFFERENT
-            // endpoint (InternalClientConfig/{id}, GET) that is already
-            // authenticated with CONTAINERS_KEY, is not reachable by a desktop, and
-            // is therefore not part of 217917's exposure. It deliberately sends no
-            // opt-in. If phase 2's redaction is implemented in shared config-
-            // assembly code rather than in ExternalAuthController.GetClientConfig,
-            // it will ALSO strip the internal route and break this broker's other
-            // path with no opt-in to save it. Phase 2 must gate on the request.
-            //
-            // NOT A FIX ON ITS OWN: an attacker can set this flag too. Phase 2 ends
-            // the AUTOMATIC delivery of every tenant's provider secrets to every
-            // user laptop; it does not close disclosure to a determined caller.
-            // That residual is card 175047 (unauthenticated mint, global partner
-            // key) and 217917 does not close until 175047 lands or Jon accepts it.
-            body: JSON.stringify({ client_assertion, include_provider_secrets: true }),
+            body: JSON.stringify({ client_assertion }),
             cache: 'no-store'
         });
         if (!configResp.ok) {
             const txt = await configResp.text().catch(() => 'Unknown error');
-            throw new Error(`[IDP_CONFIG] FATAL: Failed to fetch client config: ${configResp.status} - ${txt}`);
+            throw new Error(`[IDP_CONFIG] FATAL: Failed to fetch client config: ${configResp.status} (body ${txt.length} chars)`);
         }
         const configBody = await configResp.json().catch(() => null);
         if (!configBody) {
@@ -717,7 +737,8 @@ async function fetchConfigFromIDP(idpUrl, clientIdStr) {
         // Per PayEz API standard: response is wrapped in { success, data: {...} }
         const configData = configBody?.data;
         if (!configData || typeof configData !== 'object') {
-            console.error('[IDP_CONFIG] FATAL: Full config response body:', JSON.stringify(configBody, null, 2));
+            // PAY-1427: never the full client-config body (client configuration / provider secrets). Key names only.
+            console.error('[IDP_CONFIG] FATAL: client-config response shape:', { keys: Object.keys(configBody || {}) });
             throw new Error('[IDP_CONFIG] FATAL: IDP client-config response missing data envelope');
         }
         // Validate required fields - handle both number and string client_id
@@ -728,7 +749,7 @@ async function fetchConfigFromIDP(idpUrl, clientIdStr) {
         // Map response to our interface (IDP returns camelCase or snake_case).
         // Wire compatibility: accept new authSecret first, fall back to legacy
         // nextAuthSecret/next_auth_secret while IDP rename rolls out.
-        const config = {
+        const config = applyEnvSecrets({
             clientId: String(rawClientId),
             clientSlug: configData.clientSlug ?? configData.client_slug ?? configData.slug ?? '',
             authSecret: configData.authSecret ??
@@ -798,7 +819,7 @@ async function fetchConfigFromIDP(idpUrl, clientIdStr) {
                 logoUrl: configData.branding?.logoUrl ?? configData.branding?.logo_url
             },
             baseClientUrl: configData.baseClientUrl ?? configData.base_client_url ?? configData.BaseClientUrl
-        };
+        });
         // Debug: log what we got for baseClientUrl
         console.log(`[IDP_CONFIG] Parsed baseClientUrl:`, config.baseClientUrl, `| raw keys:`, Object.keys(configData).filter(k => k.toLowerCase().includes('client')));
         // Validate we got what we need
@@ -808,7 +829,7 @@ async function fetchConfigFromIDP(idpUrl, clientIdStr) {
         if (!config.authSecret) {
             // LOAD-BEARING — empty must fail here, never downstream. betterAuth()
             // silently substitutes a public constant for an empty secret.
-            throw new Error('[IDP_CONFIG] FATAL: authSecret is empty after parsing');
+            throw new Error('[IDP_CONFIG] FATAL: authSecret is empty after parsing and neither BETTER_AUTH_SECRET nor NEXTAUTH_SECRET is set');
         }
         // Success - reset failure tracking
         consecutiveFailures = 0;

package/dist/lib/idp-fetch.js

@@ -77,7 +77,7 @@ async function ensureFreshAccessToken(req) {
     const sessionToken = (token?.sessionToken || token?.redisSessionId);
     console.log('[IDP_FETCH] ensureFreshAccessToken:', {
         hasToken: !!token,
-        sessionToken: sessionToken?.substring(0, 20) + '...',
+        hasSessionToken: !!sessionToken, // PAY-1427 / BAPert 58829: no token material in logs, not even a stub (was a 20-char prefix)
         pathname: req.nextUrl.pathname
     });
     if (!sessionToken) {

package/dist/lib/password-rules.d.ts

@@ -0,0 +1,22 @@
+/**
+ * PAY-1591: the one sentence that states the password rules on the recovery set-password step.
+ *
+ * Built ONLY from the policy the IdP reported (usePasswordValidation.policy). A rule that is off is not stated, and with
+ * no policy at all we state no number: telling a user "at least 8 characters" when the client is configured for 12 is
+ * the same defect as saying nothing, one step later.
+ */
+export interface PasswordPolicyLike {
+    min_length?: number;
+    require_uppercase?: boolean;
+    require_lowercase?: boolean;
+    require_digit?: boolean;
+    require_special?: boolean;
+}
+export declare function passwordRulesText(policy: PasswordPolicyLike | undefined | null): string;
+/**
+ * PAY-1591: the IdP's reset refusal names WHICH rules failed as codes (error.details.rules). This is the closed set the
+ * portal accepts and the one plain sentence for each. Anything outside it is dropped, never displayed or forwarded.
+ */
+export declare const PASSWORD_RULE_SENTENCES: Readonly<Record<string, string>>;
+export declare function knownPasswordRules(rules: unknown): string[];
+export declare function passwordRuleSentences(rules: string[]): string;

package/dist/lib/password-rules.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PASSWORD_RULE_SENTENCES = void 0;
+exports.passwordRulesText = passwordRulesText;
+exports.knownPasswordRules = knownPasswordRules;
+exports.passwordRuleSentences = passwordRuleSentences;
+function passwordRulesText(policy) {
+    if (!policy || typeof policy.min_length !== 'number') {
+        return "Use a password that meets this site's rules. We'll show what is missing as you type.";
+    }
+    const parts = [`at least ${policy.min_length} characters`];
+    if (policy.require_uppercase)
+        parts.push('an upper-case letter');
+    if (policy.require_lowercase)
+        parts.push('a lower-case letter');
+    if (policy.require_digit)
+        parts.push('a number');
+    if (policy.require_special)
+        parts.push('a symbol');
+    const [first, ...rest] = parts;
+    return rest.length ? `Your password needs ${first}, with ${rest.join(', ')}.` : `Your password needs ${first}.`;
+}
+/**
+ * PAY-1591: the IdP's reset refusal names WHICH rules failed as codes (error.details.rules). This is the closed set the
+ * portal accepts and the one plain sentence for each. Anything outside it is dropped, never displayed or forwarded.
+ */
+exports.PASSWORD_RULE_SENTENCES = {
+    min_length: 'Use a longer password.',
+    uppercase: 'Add an upper-case letter.',
+    lowercase: 'Add a lower-case letter.',
+    digit: 'Add a number.',
+    special: 'Add a symbol.',
+    unique_chars: 'Use more different characters.',
+    recent_password: "Choose a password you haven't used recently.",
+};
+function knownPasswordRules(rules) {
+    if (!Array.isArray(rules))
+        return [];
+    return rules.filter((r) => typeof r === 'string' && Object.prototype.hasOwnProperty.call(exports.PASSWORD_RULE_SENTENCES, r));
+}
+function passwordRuleSentences(rules) {
+    return rules.map((r) => exports.PASSWORD_RULE_SENTENCES[r]).join(' ');
+}

package/dist/lib/safe-error-response.d.ts

@@ -0,0 +1,67 @@
+/**
+ * PAY-1438: what a USER-FACING handler may put in an error response.
+ *
+ * Several of these routes are reachable before authentication (session check, viability probe,
+ * logout, auth status, refresh-viability), so whatever lands in the body reaches an anonymous caller.
+ *
+ * Class A - an EXCEPTION: its text (ioredis `connect ECONNREFUSED host:port`, undici `fetch failed`,
+ * JSON parse errors quoting payload bytes) stays server-side. The response carries a fixed message,
+ * a code and a correlationId; the log line carries the exception and the same id.
+ *
+ * Class B - an IDP ERROR ENVELOPE ({ success, message, error: { code, message, details, support } }):
+ * never passed through whole. Only the display contract is projected: code, message, resolution,
+ * request_id - each only when it is a string. `details` (free-form, may carry validation internals
+ * or exception data) is dropped, except for the password-policy messages change-password's UI reads.
+ */
+export interface IdpErrorProjection {
+    code?: string;
+    message?: string;
+    resolution?: string;
+    request_id?: string;
+}
+/** Log an exception with a fresh correlationId and return the id for the response body. */
+export declare function logExceptionWithCorrelation(tag: string, err: unknown): string;
+/** Whitelisted projection of an IDP error envelope: code / message / resolution / request_id only. */
+export declare function projectIdpError(json: unknown): IdpErrorProjection;
+/**
+ * change-password's `details`: the security pages show `details.value[0].message` (else
+ * `details.message`) as the password-policy error (QAPert census on PAY-1438). Keep exactly those
+ * strings; drop everything else.
+ */
+export declare function projectPasswordPolicyDetails(details: unknown): {
+    message?: string;
+    value?: Array<{
+        message: string;
+    }>;
+} | undefined;
+/**
+ * For proxies that used to pass the IDP response through WHOLE on every status (account recovery,
+ * reset-password, passkey sign-in - all anonymous): on a non-OK status, return the same envelope
+ * SHAPE callers already read (`message`, `error.code`, `error.message`) built only from the
+ * whitelisted projection. The success path keeps its passthrough.
+ */
+export declare function idpErrorEnvelope(json: unknown, fallbackMessage?: string): {
+    success: false;
+    message: string;
+    error: {
+        code?: string;
+        message: string;
+        resolution?: string;
+    };
+    request_id?: string;
+};
+/**
+ * PAY-1591: the IdP refuses a reset password with error.details = { code: 'password_policy', rules: [codes], requirements:
+ * [English] }. This route is anonymous, so only the CODES cross, and only the known ones: never `requirements`, never an
+ * unknown string. Returns undefined when this is NOT a password-policy refusal, and [] when it is one but names no rule we know
+ * (the caller must be able to tell a refused password from a dead recovery session).
+ */
+/**
+ * True only when the IdP EXPLICITLY says the recovery token itself is unusable: details.code token_expired / token_used, or an
+ * ASP.NET Identity `InvalidToken` error in details.value (what the served IdP sends when ResetPasswordAsync refuses a used or
+ * expired token, AccountController.ResetPassword line ~699 at b5c56e6c0). Only this boolean crosses the anonymous route, never the
+ * Identity error text. Anything else is NOT a dead-link signal (rigpert 60822): an older IdP sends a weak-password refusal with
+ * no code at all, and calling that 'link expired' loops the user.
+ */
+export declare function projectResetTokenInvalid(json: unknown): boolean;
+export declare function projectPasswordPolicyRules(json: unknown): string[] | undefined;