@payez/next-mvp 4.4.5 → 4.4.6

package/dist/server/auth.js

@@ -49,7 +49,7 @@ require("server-only");
 const better_auth_1 = require("../auth/better-auth");
 const idp_client_config_1 = require("../lib/idp-client-config");
 const session_store_1 = require("../lib/session-store");
-const session_cookie_shape_1 = require("../lib/session-cookie-shape");
+const verified_session_token_1 = require("./verified-session-token");
 const single_flight_1 = require("../lib/single-flight");
 let authInstance = null;
 function buildSessionDataFromAuthSession(session) {
@@ -184,14 +184,18 @@ async function getSession(request) {
             sessionData = buildSessionDataFromAuthSession(betterAuthSession);
         return attachSessionData(betterAuthSession, sessionData, sessionToken);
     }
-    // Path B — Better Auth said null/incomplete. Fall back to manual cookie
+    // Path B — Better Auth said null/incomplete. Fall back to a VERIFIED cookie
     // decode + Redis-canonical liveness check. This catches cases where the
     // canonical app session at `{slug}:{token}` is still alive but Better
     // Auth's `ba:{slug}:{token}` secondary record was evicted or the
-    // in-memory cookie cache returned stale-null. No JWT signature check —
-    // Redis lookup is the validation: an attacker forging a session-token
-    // claim hits NO_SESSION because Redis has no matching entry.
-    const sessionToken = (0, session_cookie_shape_1.extractSessionTokenFromCookie)(request);
+    // in-memory cookie cache returned stale-null.
+    //
+    // PAY-1476: this path used to take the token with NO signature check, on the
+    // theory that "Redis lookup is the validation". It is not: a leaked token has
+    // a live record, so the token string alone authenticated, with any garbage in
+    // the signature position, and a forged JWS too. The token now comes only from
+    // the shared verified resolver (HMAC or JWS signature checked first).
+    const sessionToken = await (0, verified_session_token_1.resolveVerifiedSessionTokenFromRequest)(request);
     if (!sessionToken)
         return null;
     let sessionData = null;

package/dist/server/decode-session.js

@@ -42,12 +42,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.decodeSession = decodeSession;
 require("server-only");
 const headers_1 = require("next/headers");
-const jose_1 = require("jose");
 const session_store_1 = require("../lib/session-store");
 const idp_client_config_1 = require("../lib/idp-client-config");
 const app_slug_1 = require("../lib/app-slug");
 const startup_init_1 = require("../lib/startup-init");
 const session_cookie_shape_1 = require("../lib/session-cookie-shape");
+const verified_session_token_1 = require("./verified-session-token");
+const token_log_id_1 = require("../lib/token-log-id");
 /**
  * Try Better Auth's server-side session API.
  * Returns a DecodedSession if Better Auth has an active session, null otherwise.
@@ -161,7 +162,7 @@ async function tryBetterAuthSession(requestCookies) {
         // session. Read the commit message before treating a sign-out here as a
         // bug introduced by this fix.
         if (!idpTokens?.roles?.length) {
-            console.warn('[DECODE-SESSION] Leg 1 declining: idpTokens unusable (no roles) for session', result.session.token.substring(0, 10), '— falling through to the sess: leg');
+            console.warn('[DECODE-SESSION] Leg 1 declining: idpTokens unusable (no roles) for session', (0, token_log_id_1.tokenLogId)(result.session.token), '— falling through to the sess: leg');
             return null;
         }
         // Map Better Auth session + IDP tokens to SessionData
@@ -261,31 +262,19 @@ async function decodeSession(requestCookies) {
         // death, because the ONLY fallback was structurally blind to the only
         // shape it would ever be handed.
         //
-        // Check the shape FIRST. A BA-hmac cookie skips jose entirely and goes
-        // straight to the Redis-canonical liveness check below — same posture
-        // as the JWS path always had (no signature re-check here either; Redis
-        // presence is the authority). A JWS-shaped cookie (legacy NextAuth-era,
-        // if any still linger) keeps the original jwtVerify path unchanged.
+        // PAY-1476: the shape still decides HOW to verify, but BOTH shapes are now
+        // verified, by the shared resolver. This branch used to take a BA-hmac
+        // cookie's token with no signature check ("Redis presence is the
+        // authority"), so `{leaked token}.{anything}` authenticated here - including
+        // behind the portal's admin API gate. The resolver checks the HMAC with
+        // timingSafeEqual (ba-hmac) or runs jwtVerify (jws) against the same
+        // env-first auth secret, and returns null on any failure.
         const shaped = (0, session_cookie_shape_1.extractSessionTokenFromCookieValue)(cookieValue);
-        let sessionToken;
-        let payload;
-        if (shaped?.shape === 'ba-hmac') {
-            sessionToken = shaped.token;
-        }
-        else {
-            const secretKey = new TextEncoder().encode(secret);
-            try {
-                const result = await (0, jose_1.jwtVerify)(cookieValue, secretKey);
-                payload = result.payload;
-            }
-            catch (jwtError) {
-                console.warn('[DECODE-SESSION] JWT verification failed:', jwtError instanceof Error ? jwtError.message : String(jwtError));
-                return null;
-            }
-            sessionToken = payload.sessionToken || payload.redisSessionId;
-        }
+        const verified = await (0, verified_session_token_1.resolveVerifiedSessionCookie)(cookieValue);
+        const sessionToken = verified?.token;
+        const payload = verified?.payload;
         if (!sessionToken) {
-            console.warn('[DECODE-SESSION] No sessionToken resolved from cookie (shape:', shaped?.shape ?? 'unrecognized', ')');
+            console.warn('[DECODE-SESSION] Session cookie did not verify (shape:', shaped?.shape ?? 'unrecognized', ')');
             return null;
         }
         const sessionData = await (0, session_store_1.getSession)(sessionToken);
@@ -297,7 +286,7 @@ async function decodeSession(requestCookies) {
             // either and the caller is about to be signed out. Different meanings,
             // different remediations — do not ship a second silent path while
             // fixing a silent path.
-            console.warn('[DECODE-SESSION] No sess: record for token', sessionToken.substring(0, 10), '— no fallback available, session will be signed out');
+            console.warn('[DECODE-SESSION] No sess: record for token', (0, token_log_id_1.tokenLogId)(sessionToken), '— no fallback available, session will be signed out');
             return null;
         }
         // Backwards compat: session.user.email works alongside session.email

package/dist/server/verified-session-token.d.ts

@@ -0,0 +1,13 @@
+import { type JWTPayload } from 'jose';
+export interface VerifiedSessionCookie {
+    token: string;
+    shape: 'ba-hmac' | 'jws';
+    /** The verified JWS payload (jws shape only). */
+    payload?: JWTPayload;
+}
+/** The verified session cookie (token, shape, JWS payload), or null unless its signature verifies. */
+export declare function resolveVerifiedSessionCookie(rawValue: string | null | undefined): Promise<VerifiedSessionCookie | null>;
+/** The session token carried by a raw session-cookie value, or null unless its signature verifies. */
+export declare function resolveVerifiedSessionToken(rawValue: string | null | undefined): Promise<string | null>;
+/** Same, reading the session cookie (every name it is minted under, chunks joined) from a Request. */
+export declare function resolveVerifiedSessionTokenFromRequest(request: Request): Promise<string | null>;

package/dist/server/verified-session-token.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveVerifiedSessionCookie = resolveVerifiedSessionCookie;
+exports.resolveVerifiedSessionToken = resolveVerifiedSessionToken;
+exports.resolveVerifiedSessionTokenFromRequest = resolveVerifiedSessionTokenFromRequest;
+/**
+ * PAY-1476 / card 372275 (R941 s1b) - THE ONE SHARED VERIFIED RESOLVER for a session token taken from a cookie.
+ *
+ * THE DEFECT (4.4.5, measured at the deployed portal by QAPert-NightHawk, mail 59030):
+ *   Module A  server/decode-session.ts  the ba-hmac branch took `{token}.{anything}` and used segment 0 unread.
+ *   Module B  server/auth.ts  Path B    took the token from ANY recognised shape and never verified anything;
+ *                                       a forged JWS resolved there too.
+ * Both then treated "a Redis record exists" as the validation. So a leaked session token string was a bearer
+ * credential with no signature needed, including on the portal's admin API gate (api-admin-gate -> decodeSession).
+ *
+ * THE RULE THIS MODULE ENFORCES: a cookie yields a session token ONLY after its signature checks out against
+ * the auth secret. Every caller that turns a cookie into a token for the session store awaits this function.
+ * lib/session-cookie-shape.ts stays classification-only and secret-free (it cannot verify, by construction).
+ *
+ *   ba-hmac  `{token}.{sig}` as Better Auth mints it (better-call signCookieValue): sig =
+ *            base64(HMAC-SHA256(secret, token)), standard padding, 44 characters. Compared with
+ *            crypto.timingSafeEqual over equal-length buffers.
+ *   jws      legacy NextAuth-era cookie: jose jwtVerify with the same secret, then the sessionToken
+ *            (or redisSessionId) claim.
+ *   anything else, a missing secret, or a failed check -> null. Never throws.
+ *
+ * THE SECRET is the auth secret from getIDPClientConfig(), which resolves env-first (BETTER_AUTH_SECRET,
+ * NEXTAUTH_SECRET, then IdP config; PAY-1460). The cookie HMAC key IS the auth secret, so the resolver and the
+ * config loader cannot disagree about which secret signs sessions (BAPert 59034).
+ */
+const crypto_1 = require("crypto");
+const jose_1 = require("jose");
+const idp_client_config_1 = require("../lib/idp-client-config");
+const session_cookie_shape_1 = require("../lib/session-cookie-shape");
+/** Better Auth's signature: base64 of a 32-byte HMAC-SHA256, padded = 44 chars ending in '='. */
+const BA_SIGNATURE_LENGTH = 44;
+async function authSecret() {
+    try {
+        const config = await (0, idp_client_config_1.getIDPClientConfig)();
+        return config?.authSecret ? String(config.authSecret) : null;
+    }
+    catch {
+        return null;
+    }
+}
+function verifyBaHmac(rawValue, secret) {
+    const dot = rawValue.lastIndexOf('.');
+    if (dot < 1)
+        return null;
+    const token = rawValue.slice(0, dot);
+    let signature = rawValue.slice(dot + 1);
+    if (signature.includes('%')) {
+        try {
+            signature = decodeURIComponent(signature);
+        }
+        catch {
+            return null;
+        }
+    }
+    if (signature.length !== BA_SIGNATURE_LENGTH || !signature.endsWith('='))
+        return null;
+    const expected = (0, crypto_1.createHmac)('sha256', secret).update(token, 'utf8').digest('base64');
+    const a = Buffer.from(signature, 'utf8');
+    const b = Buffer.from(expected, 'utf8');
+    if (a.length !== b.length)
+        return null;
+    return (0, crypto_1.timingSafeEqual)(a, b) ? token : null;
+}
+async function verifyJws(rawValue, secret) {
+    try {
+        const { payload } = await (0, jose_1.jwtVerify)(rawValue, new TextEncoder().encode(secret));
+        const claim = payload.sessionToken ?? payload.redisSessionId;
+        return typeof claim === 'string' && claim ? { token: claim, shape: 'jws', payload } : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The verified session cookie (token, shape, JWS payload), or null unless its signature verifies. */
+async function resolveVerifiedSessionCookie(rawValue) {
+    if (!rawValue)
+        return null;
+    const shaped = (0, session_cookie_shape_1.extractSessionTokenFromCookieValue)(rawValue);
+    if (!shaped)
+        return null;
+    const secret = await authSecret();
+    if (!secret)
+        return null;
+    if (shaped.shape === 'ba-hmac') {
+        const token = verifyBaHmac(rawValue, secret);
+        return token ? { token, shape: 'ba-hmac' } : null;
+    }
+    return verifyJws(rawValue, secret);
+}
+/** The session token carried by a raw session-cookie value, or null unless its signature verifies. */
+async function resolveVerifiedSessionToken(rawValue) {
+    const verified = await resolveVerifiedSessionCookie(rawValue);
+    return verified ? verified.token : null;
+}
+/** Same, reading the session cookie (every name it is minted under, chunks joined) from a Request. */
+async function resolveVerifiedSessionTokenFromRequest(request) {
+    return resolveVerifiedSessionToken((0, session_cookie_shape_1.extractSessionCookieValue)(request));
+}

package/dist/stores/authStore.js

@@ -55,6 +55,7 @@ const logger_1 = require("../config/logger");
 const signalr_1 = require("@microsoft/signalr");
 const signalrActivityService_1 = require("../services/signalrActivityService");
 const app_slug_1 = require("../lib/app-slug");
+const token_log_id_1 = require("../lib/token-log-id");
 // ===============================
 // CACHE CONFIGURATION
 // ===============================
@@ -303,17 +304,26 @@ exports.useAuthStore = (0, zustand_1.create)()((0, middleware_1.devtools)((set,
     },
     forceLogoutAndRedirect: async (reason) => {
         const state = get();
+        // Same truncation convention as the server-side session logs (session-store.ts,
+        // refresh.ts): a session token is a bearer credential, and this line goes to the
+        // browser console (and whatever aggregates authLogger client-side) - full value
+        // was leftover debug logging (DotNetPert-Scout, mail 58678).
+        // PAY-1505: the ternary that used to stand here fell back to the RAW token on its false arm.
+        // Safe only by the unenforced property that the arm is reached when the token is falsy -
+        // exactly the shape the source guard exists to refuse. tokenLogId already answers 'none'
+        // for an absent token, so the fallback is not needed.
+        const sessionTokenPrefix = (0, token_log_id_1.tokenLogId)(state.session?.sessionToken);
         // AGGRESSIVE LOGGING TO TRACK EXECUTION
         console.error('🚨 FORCE LOGOUT INITIATED 🚨', {
             reason,
             userId: state.user?.id,
-            sessionToken: state.session?.sessionToken,
+            sessionToken: sessionTokenPrefix,
             timestamp: new Date().toISOString()
         });
         logger_1.authLogger.error('[AuthStore] Force logout initiated', {
             reason,
             userId: state.user?.id,
-            sessionToken: state.session?.sessionToken
+            sessionToken: sessionTokenPrefix
         });
         try {
             // TODO: Step 1: Mark session as force-invalidated in Redis (temp disabled for client build)
@@ -1503,7 +1513,8 @@ exports.useAuthStore = (0, zustand_1.create)()((0, middleware_1.devtools)((set,
         const state = get();
         // If this event is about the current user, update their state
         if (data.userId === state.user?.id && state.session) {
-            logger_1.authLogger.info('[AuthStore] Updating current user state from SignalR:', data);
+            // PAY-1427: the event is user state; log its shape, not its contents.
+            logger_1.authLogger.info('[AuthStore] Updating current user state from SignalR:', { keys: Object.keys(data || {}) });
             // ... user state update logic would go here
         }
     },

package/dist/types/recovery.d.ts

@@ -1,4 +1,4 @@
-export type RecoveryStep = 'initiate' | 'select-method' | 'verify-code' | 'set-password' | 'complete';
+export type RecoveryStep = 'initiate' | 'select-method' | 'verify-code' | 'set-password' | 'requested' | 'complete';
 export interface RecoverySession {
     recoveryToken: string;
     email: string;

package/dist/utils/api.d.ts

@@ -25,6 +25,24 @@ export interface ApiResponse<T> {
     message?: string;
 }
 export declare function apiFetch<T>(url: string, options?: ApiOptions): Promise<ApiResponse<T>>;
+/**
+ * PAY-1591: what the user reads when the LAST recovery step fails. Four outcomes, told apart only by codes the IdP really sends
+ * (see resetFailureText): a password-policy refusal names the failed rules; an explicit expired/used token says so and links back
+ * to recovery; any other 400/422 gets a neutral 'check the requirements and try again' (the user's recovery session is kept); and
+ * a server or transport failure gets a retry sentence. None of them is the old fixed "Failed to reset password".
+ */
+export declare const RECOVERY_EXPIRED_TEXT = "This reset link has expired or was already used. Start password recovery again.";
+export declare const RESET_NEUTRAL_TEXT = "We couldn't set that password. Check it meets the requirements shown and try again.";
+/**
+ * Three tiers for a 400/422 from reset (rigpert 60822, QAPert 60820), decided ONLY on codes the IdP actually sends:
+ *   policy        details.code password_policy (projected by the handler as password_policy) -> the rule sentences
+ *   tokenInvalid  an EXPLICIT expired/used signal (token_expired / token_used / Identity InvalidToken, projected as
+ *                 reset_token_invalid) -> 'link expired, start again'
+ *   anything else -> NEUTRAL, which must NOT tell the user their link is dead: the served IdP sends a weak-password refusal with
+ *                 no code, and 'expired' there loops them after they spent their emailed code. The recovery session is kept, so
+ *                 they can retry.
+ */
+export declare function resetFailureText(status: number, rules?: string[], policy?: boolean, tokenInvalid?: boolean): string;
 export declare class AccountApi {
     /**
      * Get masked user info (email, phone, authenticator status)

package/dist/utils/api.js

@@ -1,8 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.accountApi = exports.AccountApi = exports.ApiError = void 0;
+exports.accountApi = exports.AccountApi = exports.RESET_NEUTRAL_TEXT = exports.RECOVERY_EXPIRED_TEXT = exports.ApiError = void 0;
 exports.apiFetch = apiFetch;
+exports.resetFailureText = resetFailureText;
 const standardized_client_api_1 = require("../lib/standardized-client-api");
+const password_rules_1 = require("../lib/password-rules");
 class ApiError extends Error {
     type;
     title;
@@ -74,6 +76,34 @@ async function apiFetch(url, options = {}) {
 }
 // DELETED: apiFetchAuth - Use clientApi from @/lib/client-api instead for proper token refresh handling
 // Account API for masked info and 2FA
+/**
+ * PAY-1591: what the user reads when the LAST recovery step fails. Four outcomes, told apart only by codes the IdP really sends
+ * (see resetFailureText): a password-policy refusal names the failed rules; an explicit expired/used token says so and links back
+ * to recovery; any other 400/422 gets a neutral 'check the requirements and try again' (the user's recovery session is kept); and
+ * a server or transport failure gets a retry sentence. None of them is the old fixed "Failed to reset password".
+ */
+exports.RECOVERY_EXPIRED_TEXT = 'This reset link has expired or was already used. Start password recovery again.';
+exports.RESET_NEUTRAL_TEXT = "We couldn't set that password. Check it meets the requirements shown and try again.";
+/**
+ * Three tiers for a 400/422 from reset (rigpert 60822, QAPert 60820), decided ONLY on codes the IdP actually sends:
+ *   policy        details.code password_policy (projected by the handler as password_policy) -> the rule sentences
+ *   tokenInvalid  an EXPLICIT expired/used signal (token_expired / token_used / Identity InvalidToken, projected as
+ *                 reset_token_invalid) -> 'link expired, start again'
+ *   anything else -> NEUTRAL, which must NOT tell the user their link is dead: the served IdP sends a weak-password refusal with
+ *                 no code, and 'expired' there loops them after they spent their emailed code. The recovery session is kept, so
+ *                 they can retry.
+ */
+function resetFailureText(status, rules = [], policy = false, tokenInvalid = false) {
+    if (status === 400 || status === 422) {
+        if (tokenInvalid && !policy)
+            return exports.RECOVERY_EXPIRED_TEXT;
+        if (!policy)
+            return exports.RESET_NEUTRAL_TEXT;
+        const base = "That password wasn't accepted.";
+        return rules.length ? `${base} ${(0, password_rules_1.passwordRuleSentences)(rules)}` : `${base} Try a different one; the rules are shown above.`;
+    }
+    return "We couldn't reset your password just now. Please try again.";
+}
 class AccountApi {
     /**
      * Get masked user info (email, phone, authenticator status)
@@ -87,16 +117,15 @@ class AccountApi {
         // Authenticated request - proxy through Next API to IDP
         // Empty body: user info comes from JWT token
         const result = await standardized_client_api_1.standardizedApi.post('/api/account/masked-info', {}, accessToken);
+        // PAY-1427: masked email/phone are still user data - log the response shape, never its values.
         console.log('[DEBUG] getMaskedInfo result:', {
             success: (0, standardized_client_api_1.isApiSuccess)(result),
             hasData: (0, standardized_client_api_1.isApiSuccess)(result) && !!result.data,
-            rawData: (0, standardized_client_api_1.isApiSuccess)(result) ? result.data : null,
             dataFields: (0, standardized_client_api_1.isApiSuccess)(result) && result.data ? Object.keys(result.data) : []
         });
-        console.log('[DEBUG] getMaskedInfo raw data structure:', JSON.stringify((0, standardized_client_api_1.isApiSuccess)(result) ? result.data : result, null, 2));
         if (!(0, standardized_client_api_1.isApiSuccess)(result)) {
             const errorMessage = (0, standardized_client_api_1.isApiError)(result) ? result.message : 'Failed to get masked info';
-            console.error('[DEBUG] getMaskedInfo failed:', result);
+            console.error('[DEBUG] getMaskedInfo failed:', { keys: result && typeof result === 'object' ? Object.keys(result) : typeof result });
             throw new ApiError(errorMessage, result);
         }
         // Use only snake_case fields from backend response
@@ -116,6 +145,9 @@ class AccountApi {
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ email }),
         });
+        // PAY-1588: a throttled caller (429) must look exactly like an unknown one - no session, no distinguishing error.
+        if (res.status === 429)
+            return { success: false, data: {} };
         if (!res.ok)
             throw new Error('Failed to initiate recovery');
         return res.json();
@@ -154,13 +186,23 @@ class AccountApi {
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({
                 email,
-                password_reset_token: resetToken,
+                token: resetToken,
                 new_password: newPassword,
                 confirm_password: confirmPassword,
             }),
         });
-        if (!res.ok)
-            throw new Error('Failed to reset password');
+        if (!res.ok) {
+            const body = await res.json().catch(() => null);
+            const policy = !!body?.password_policy;
+            const rules = (0, password_rules_1.knownPasswordRules)(body?.password_policy?.rules);
+            const tokenInvalid = body?.reset_token_invalid === true;
+            const err = new Error(resetFailureText(res.status, rules, policy, tokenInvalid));
+            if (rules.length)
+                err.rules = rules;
+            if ((res.status === 400 || res.status === 422) && tokenInvalid && !policy)
+                err.code = 'RECOVERY_EXPIRED';
+            throw err;
+        }
         return res.json();
     }
     async resetPassword(data) {
@@ -171,8 +213,8 @@ class AccountApi {
             body: JSON.stringify({
                 email: data.email,
                 token: data.token,
-                password: data.password,
-                password_confirmation: data.password_confirmation
+                new_password: data.password,
+                confirm_password: data.password_confirmation
             })
         });
         const result = await res.json().catch(() => ({}));

package/dist/vibe/sessions.js

@@ -105,7 +105,8 @@ async function vibeProxyRequest(endpoint, method, accessToken, body) {
         }
         if (!response.ok) {
             const errorText = await response.text();
-            console.error(`[vibe-sessions] Proxy error ${response.status}:`, errorText);
+            // PAY-1427: never the raw proxy body - the request carried a Bearer token and an error page can echo it.
+            console.error(`[vibe-sessions] Proxy error ${response.status}:`, { bodyLength: errorText.length });
             return null;
         }
         const data = await response.json();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "4.4.5",
+  "version": "4.4.6",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -24,6 +24,7 @@
     "dev:local": "pwsh -NoProfile -ExecutionPolicy Bypass -File scripts/dev-local.ps1",
     "dev:broker": "pwsh -NoProfile -ExecutionPolicy Bypass -File scripts/dev-broker.ps1",
     "check:publish-health": "node scripts/check-publish-health.mjs",
+    "check:provenance": "node scripts/verify-release-provenance.mjs",
     "census:reach": "node scripts/module-reach.mjs",
     "build:incremental": "npx tsc --project tsconfig.json"
   },