@payez/next-mvp 4.4.5 → 4.4.7

package/dist/pages/test-env/JwtInspectPage.js

@@ -5,6 +5,7 @@ exports.JwtInspectPage = JwtInspectPage;
 const jsx_runtime_1 = require("react/jsx-runtime");
 const better_auth_client_1 = require("../../client/better-auth-client");
 const react_1 = require("react");
+const redact_credentials_1 = require("./redact-credentials");
 // Decode JWT header (contains kid, alg, typ)
 function decodeJwtHeader(token) {
     try {
@@ -74,7 +75,6 @@ function JwtInspectPage() {
     const { data: sessionData, isPending } = better_auth_client_1.authClient.useSession();
     const session = sessionData;
     const status = isPending ? 'loading' : session ? 'authenticated' : 'unauthenticated';
-    const [copied, setCopied] = (0, react_1.useState)(null);
     const [isDarkMode, setIsDarkMode] = (0, react_1.useState)(false);
     const [jwtHeader, setJwtHeader] = (0, react_1.useState)(null);
     const [jwtPayload, setJwtPayload] = (0, react_1.useState)(null);
@@ -111,115 +111,10 @@ function JwtInspectPage() {
             setJwtPayload(decodeJwtPayload(token));
         }
     }, [serverSession, session]);
-    // 248991 item 3 (QAPert 35021) - CREDENTIALS ARE REDACTED UNTIL DELIBERATELY
-    // REVEALED.
-    //
-    // Before this, loading the page put a live session token on screen and one
-    // click from the clipboard. That is the precondition the 246007 finding needs
-    // ("a caller who knows a session token can act on a session it does not own"),
-    // so this page was the supply side of the attack the same package was being
-    // hardened against. A screen-share, a screenshot or a support call was enough.
-    //
-    // The fix is deliberately NOT removing the tokens or the copy button: replaying
-    // a bearer in curl is the entire reason this tool exists, and a debug tool that
-    // cannot show you the thing you are debugging just gets replaced by a worse
-    // ad-hoc one. What changes is that exposure now requires an INTENTIONAL ACT per
-    // token, so the default state of a loaded page - the state a bystander, a
-    // screen-share or a screenshot captures - carries no usable credential.
-    //
-    // NOTE: this is a UI affordance, not an access control. Anyone who can load
-    // this page can still click reveal, and the values are in the network response
-    // either way. It shrinks accidental disclosure; it does not gate the route.
-    // The gate is mounting - see this file's docstring and index.ts.
-    const [revealed, setRevealed] = (0, react_1.useState)({});
-    const maskToken = (value) => {
-        if (value.length <= 12)
-            return '\u2022'.repeat(Math.max(value.length, 8));
-        return `${value.slice(0, 6)}${'\u2022'.repeat(12)}${value.slice(-4)}  (${value.length} chars, hidden)`;
-    };
-    // Keys whose STRING values are live credentials. Anchored at the END of the key
-    // name on purpose: it catches sessionToken / accessToken / refreshToken /
-    // idpRefreshToken, while deliberately NOT catching the metadata beside them -
-    // accessTokenExpires, idpAccessTokenExpires, tokenType - which are safe and are
-    // the fields you actually want when debugging an expiry problem.
-    const CREDENTIAL_KEY = /(token|secret|password|apikey|credential)$/i;
-    // VALUE-SHAPE checks, because a key-name sweep has a blind spot that this page
-    // is squarely in: a credential under an innocuous key. Scout hit the same class
-    // elsewhere today (35297) - a postgres URL whose only key-name hit was a
-    // POINTER to the secret, while the actual password sat in the URL value and the
-    // sweep scored the file SAFE. Here the equivalents are a raw JWT parked under
-    // `jwt` / `bearer` / `authorization` / `cookie` - none of which end in `token`.
-    //
-    // JWT: three base64url segments. The length floors matter - without them
-    // "4.1.42" matches the three-segment shape and the package version would render
-    // as a redacted credential, which teaches people the redactor is broken.
-    const looksLikeJwt = (v) => {
-        if (v.length < 40)
-            return false;
-        const parts = v.split('.');
-        return parts.length === 3 && parts.every((p) => p.length >= 8 && /^[A-Za-z0-9_-]+$/.test(p));
-    };
-    // scheme://user:password@host - redact ONLY the password and keep the rest, so
-    // the URL stays usable for debugging. Masking the whole value would hide which
-    // host you are pointed at, which is usually the thing you opened this page for.
-    const URL_WITH_USERINFO = /^([a-z][a-z0-9+.-]*:\/\/)([^/\s:@]+):([^/\s@]+)@/i;
-    // Third value-shape check, on DotNetPert-Scout's 251951 rule: "a content-pattern
-    // sweep CANNOT find a credential that has no pattern." A PEM block defeats BOTH
-    // checks above and the key-name check as well - it has no key=value pair, its key
-    // name is usually something innocuous like `cert`, `pem`, `chain` or `data`, it is
-    // not three base64url segments so looksLikeJwt rejects it, and it is not a URL.
-    // He found a live wildcard TLS private key that had sat committed for 215 days for
-    // exactly this reason: it was never in anyone's search space, missed by
-    // construction rather than by carelessness.
-    //
-    // HONEST SCOPE: this is defence-in-depth, not a measured exposure. I have not seen
-    // PEM material in a session object and would not expect to. It is here because this
-    // dump renders WHATEVER the session carries, and the entire lesson of the two
-    // previous hardenings on this function is that the next credential arrives in a
-    // shape the current checks were not written for. Matching the armour band rather
-    // than the payload costs one regex.
-    // Matches the PEM ARMOUR BAND itself rather than enumerating key types. A first
-    // draft listed PRIVATE KEY / CERTIFICATE / RSA / EC / OPENSSH / PGP and a test
-    // caught it missing plain "-----BEGIN CERTIFICATE-----", because that header has
-    // no space before the closing dashes while "-----BEGIN RSA PRIVATE KEY-----" does.
-    // Enumerating the payload types is the same mistake as enumerating credential key
-    // names, one level down: it only ever covers the shapes already thought of.
-    // Requiring an alphanumeric after "BEGIN " keeps prose containing the word, and a
-    // bare "-----BEGIN-----", from matching.
-    const PEM_BLOCK = /-----BEGIN [A-Z0-9][A-Z0-9 ]*-----/;
-    // 248991 item 3, SECOND HALF. The masked fields above were only half the fix:
-    // the Raw Session Data block below re-rendered the SAME tokens in plain text via
-    // JSON.stringify, one click away behind a neutral "Click to expand" summary - and
-    // with them idpRefreshToken, which has NO other raw surface on this page (it is
-    // rendered as a boolean at the Refresh Token row precisely because it is the
-    // longest-lived credential of the three). Redacting per-field while dumping the
-    // whole object verbatim is not a partial fix, it is the appearance of one.
-    const redactCredentials = (value, keyName = '') => {
-        if (Array.isArray(value))
-            return value.map((v) => redactCredentials(v));
-        if (value && typeof value === 'object') {
-            return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, redactCredentials(v, k)]));
-        }
-        if (typeof value !== 'string' || value.length === 0)
-            return value;
-        if (CREDENTIAL_KEY.test(keyName))
-            return maskToken(value);
-        // Key-name matching alone is not enough (DotNetPert-Scout 35297): a credential
-        // can sit under a key that is not credential-shaped at all. Two value-shape
-        // checks close the cases that actually reach a session object:
-        if (looksLikeJwt(value))
-            return maskToken(value);
-        if (PEM_BLOCK.test(value))
-            return '••• PEM block redacted (' + value.length + ' chars) •••';
-        if (URL_WITH_USERINFO.test(value))
-            return value.replace(URL_WITH_USERINFO, '$1$2:•••••@');
-        return value;
-    };
-    const copyToClipboard = (text, label) => {
-        navigator.clipboard.writeText(text);
-        setCopied(label);
-        setTimeout(() => setCopied(null), 2000);
-    };
+    // PAY-1470 (BAPert rulings 59022, 59040): credentials are shown as tokenLogId + length ONLY. The Reveal toggles
+    // (per token and for the raw session JSON) and the Copy buttons are gone: "never renders token material"
+    // includes click-to-reveal, because a full bearer one click away on a prod-reachable page is the same defect.
+    // The redaction rules (key names, JWT / PEM / URL-password shapes) live in ./redact-credentials.
     if (status === 'loading') {
         return ((0, jsx_runtime_1.jsx)("div", { className: `min-h-screen p-8 ${isDarkMode ? 'bg-slate-950 text-white' : 'bg-gray-50 text-gray-900'}`, children: "Loading session..." }));
     }
@@ -257,21 +152,9 @@ function JwtInspectPage() {
     const cardClass = isDarkMode ? 'bg-slate-900 border border-slate-700' : 'bg-white border border-gray-200';
     const labelClass = isDarkMode ? 'text-slate-400' : 'text-gray-500';
     const valueClass = isDarkMode ? 'text-white' : 'text-gray-900';
-    return ((0, jsx_runtime_1.jsx)("div", { className: `min-h-screen p-8 ${isDarkMode ? 'bg-slate-950 text-white' : 'bg-gray-50 text-gray-900'}`, children: (0, jsx_runtime_1.jsxs)("div", { className: "max-w-4xl mx-auto space-y-6", children: [(0, jsx_runtime_1.jsx)("h1", { className: "text-2xl font-bold", children: "Session Inspector" }), (0, jsx_runtime_1.jsx)("p", { className: `text-sm ${labelClass}`, children: "Better Auth session + IDP tokens from Redis" }), (0, jsx_runtime_1.jsxs)("div", { className: `p-4 rounded-lg ${cardClass}`, children: [(0, jsx_runtime_1.jsx)("h2", { className: "text-lg font-semibold mb-4", children: "User Identity" }), (0, jsx_runtime_1.jsxs)("div", { className: "grid grid-cols-1 md:grid-cols-2 gap-3 text-sm", children: [(0, jsx_runtime_1.jsx)(InfoRow, { label: "User ID", value: user.id, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "Email", value: user.email, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "Name", value: user.name, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "OAuth Provider", value: user.oauthProvider, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "IDP Client ID", value: user.idpClientId, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "Merchant ID", value: user.merchantId, labelClass: labelClass, valueClass: valueClass })] })] }), (0, jsx_runtime_1.jsxs)("div", { className: `p-4 rounded-lg ${isDarkMode ? 'bg-purple-900/30 border border-purple-700' : 'bg-purple-50 border border-purple-200'}`, children: [(0, jsx_runtime_1.jsx)("h2", { className: "text-lg font-semibold mb-4", children: "Roles" }), user.roles && user.roles.length > 0 ? ((0, jsx_runtime_1.jsx)("div", { className: "flex flex-wrap gap-2", children: user.roles.map((role) => ((0, jsx_runtime_1.jsx)("span", { className: `px-3 py-1 rounded-full text-sm font-medium ${isDarkMode ? 'bg-purple-800 text-purple-100' : 'bg-purple-200 text-purple-800'}`, children: role }, role))) })) : ((0, jsx_runtime_1.jsx)("p", { className: labelClass, children: "No roles assigned" }))] }), (0, jsx_runtime_1.jsxs)("div", { className: `p-4 rounded-lg ${isDarkMode ? 'bg-yellow-900/30 border border-yellow-700' : 'bg-yellow-50 border border-yellow-200'}`, children: [(0, jsx_runtime_1.jsx)("h2", { className: "text-lg font-semibold mb-4", children: "2FA Status" }), (0, jsx_runtime_1.jsxs)("div", { className: "grid grid-cols-1 md:grid-cols-2 gap-3 text-sm", children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("span", { className: labelClass, children: "2FA Verified:" }), ' ', (0, jsx_runtime_1.jsx)(StatusBadge, { value: user.twoFactorSessionVerified, trueText: "Yes", falseText: "No", isDarkMode: isDarkMode })] }), (0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("span", { className: labelClass, children: "Requires 2FA:" }), ' ', (0, jsx_runtime_1.jsx)(StatusBadge, { value: user.requiresTwoFactor, trueText: "Yes", falseText: "No", isDarkMode: isDarkMode, invertColors: true })] }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "Auth Methods (AMR)", value: user.authenticationMethods?.join(', '), labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "Auth Level (ACR)", value: user.authenticationLevel, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "MFA Completed At", value: user.mfaCompletedAt ? new Date(user.mfaCompletedAt).toISOString() : undefined, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "MFA Expires At", value: user.mfaExpiresAt ? new Date(user.mfaExpiresAt).toISOString() : undefined, labelClass: labelClass, valueClass: valueClass })] })] }), (0, jsx_runtime_1.jsxs)("div", { className: `p-4 rounded-lg ${isDarkMode ? 'bg-blue-900/30 border border-blue-700' : 'bg-blue-50 border border-blue-200'}`, children: [(0, jsx_runtime_1.jsx)("h2", { className: "text-lg font-semibold mb-4", children: "Tokens" }), (0, jsx_runtime_1.jsxs)("div", { className: "space-y-4", children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsxs)("div", { className: "flex items-center justify-between mb-2", children: [(0, jsx_runtime_1.jsx)("span", { className: labelClass, children: "Session Token (Redis Key):" }), displayExt.sessionToken && ((0, jsx_runtime_1.jsxs)("div", { className: "flex items-center gap-2", children: [(0, jsx_runtime_1.jsx)(RevealButton, { revealed: !!revealed.session, onClick: () => setRevealed((r) => ({ ...r, session: !r.session })), isDarkMode: isDarkMode }), revealed.session && ((0, jsx_runtime_1.jsx)(CopyButton, { onClick: () => copyToClipboard(displayExt.sessionToken, 'session'), copied: copied === 'session', isDarkMode: isDarkMode }))] }))] }), (0, jsx_runtime_1.jsx)("code", { className: `block p-2 rounded text-xs break-all ${isDarkMode ? 'bg-slate-800' : 'bg-gray-100'}`, children: displayExt.sessionToken
-                                                ? revealed.session
-                                                    ? displayExt.sessionToken
-                                                    : maskToken(displayExt.sessionToken)
-                                                : 'N/A' })] }), (0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsxs)("div", { className: "flex items-center justify-between mb-2", children: [(0, jsx_runtime_1.jsx)("span", { className: labelClass, children: "Access Token (IDP):" }), displayExt.accessToken && ((0, jsx_runtime_1.jsxs)("div", { className: "flex items-center gap-2", children: [(0, jsx_runtime_1.jsx)(RevealButton, { revealed: !!revealed.access, onClick: () => setRevealed((r) => ({ ...r, access: !r.access })), isDarkMode: isDarkMode }), revealed.access && ((0, jsx_runtime_1.jsx)(CopyButton, { onClick: () => copyToClipboard(displayExt.accessToken, 'access'), copied: copied === 'access', isDarkMode: isDarkMode }))] }))] }), (0, jsx_runtime_1.jsx)("code", { className: `block p-2 rounded text-xs break-all max-h-24 overflow-auto ${isDarkMode ? 'bg-slate-800' : 'bg-gray-100'}`, children: displayExt.accessToken
-                                                ? revealed.access
-                                                    ? displayExt.accessToken
-                                                    : maskToken(displayExt.accessToken)
-                                                : 'N/A' })] }), (0, jsx_runtime_1.jsxs)("div", { className: "grid grid-cols-1 md:grid-cols-2 gap-3 text-sm", children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("span", { className: labelClass, children: "Has Refresh Token:" }), ' ', (0, jsx_runtime_1.jsx)(StatusBadge, { value: !!displayExt.refreshToken, trueText: "Yes", falseText: "No", isDarkMode: isDarkMode })] }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "Access Token Expires", value: displayExt.accessTokenExpires ? new Date(displayExt.accessTokenExpires).toISOString() : undefined, labelClass: labelClass, valueClass: valueClass })] })] })] }), jwtHeader && ((0, jsx_runtime_1.jsxs)("div", { className: `p-4 rounded-lg ${isDarkMode ? 'bg-orange-900/30 border border-orange-700' : 'bg-orange-50 border border-orange-200'}`, children: [(0, jsx_runtime_1.jsx)("h2", { className: "text-lg font-semibold mb-4", children: "JWT Header" }), (0, jsx_runtime_1.jsxs)("div", { className: "grid grid-cols-1 md:grid-cols-2 gap-3 text-sm", children: [(0, jsx_runtime_1.jsx)(InfoRow, { label: "Algorithm (alg)", value: jwtHeader.alg, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "Type (typ)", value: jwtHeader.typ, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("span", { className: labelClass, children: "Key ID (kid):" }), ' ', (0, jsx_runtime_1.jsx)("span", { className: `font-mono ${jwtHeader.kid ? (isDarkMode ? 'text-green-400' : 'text-green-600') : (isDarkMode ? 'text-red-400' : 'text-red-600')}`, children: jwtHeader.kid || 'NOT PRESENT' })] }), Object.entries(jwtHeader)
+    return ((0, jsx_runtime_1.jsx)("div", { className: `min-h-screen p-8 ${isDarkMode ? 'bg-slate-950 text-white' : 'bg-gray-50 text-gray-900'}`, children: (0, jsx_runtime_1.jsxs)("div", { className: "max-w-4xl mx-auto space-y-6", children: [(0, jsx_runtime_1.jsx)("h1", { className: "text-2xl font-bold", children: "Session Inspector" }), (0, jsx_runtime_1.jsx)("p", { className: `text-sm ${labelClass}`, children: "Better Auth session + IDP tokens from Redis" }), (0, jsx_runtime_1.jsxs)("div", { className: `p-4 rounded-lg ${cardClass}`, children: [(0, jsx_runtime_1.jsx)("h2", { className: "text-lg font-semibold mb-4", children: "User Identity" }), (0, jsx_runtime_1.jsxs)("div", { className: "grid grid-cols-1 md:grid-cols-2 gap-3 text-sm", children: [(0, jsx_runtime_1.jsx)(InfoRow, { label: "User ID", value: user.id, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "Email", value: user.email, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "Name", value: user.name, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "OAuth Provider", value: user.oauthProvider, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "IDP Client ID", value: user.idpClientId, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "Merchant ID", value: user.merchantId, labelClass: labelClass, valueClass: valueClass })] })] }), (0, jsx_runtime_1.jsxs)("div", { className: `p-4 rounded-lg ${isDarkMode ? 'bg-purple-900/30 border border-purple-700' : 'bg-purple-50 border border-purple-200'}`, children: [(0, jsx_runtime_1.jsx)("h2", { className: "text-lg font-semibold mb-4", children: "Roles" }), user.roles && user.roles.length > 0 ? ((0, jsx_runtime_1.jsx)("div", { className: "flex flex-wrap gap-2", children: user.roles.map((role) => ((0, jsx_runtime_1.jsx)("span", { className: `px-3 py-1 rounded-full text-sm font-medium ${isDarkMode ? 'bg-purple-800 text-purple-100' : 'bg-purple-200 text-purple-800'}`, children: role }, role))) })) : ((0, jsx_runtime_1.jsx)("p", { className: labelClass, children: "No roles assigned" }))] }), (0, jsx_runtime_1.jsxs)("div", { className: `p-4 rounded-lg ${isDarkMode ? 'bg-yellow-900/30 border border-yellow-700' : 'bg-yellow-50 border border-yellow-200'}`, children: [(0, jsx_runtime_1.jsx)("h2", { className: "text-lg font-semibold mb-4", children: "2FA Status" }), (0, jsx_runtime_1.jsxs)("div", { className: "grid grid-cols-1 md:grid-cols-2 gap-3 text-sm", children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("span", { className: labelClass, children: "2FA Verified:" }), ' ', (0, jsx_runtime_1.jsx)(StatusBadge, { value: user.twoFactorSessionVerified, trueText: "Yes", falseText: "No", isDarkMode: isDarkMode })] }), (0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("span", { className: labelClass, children: "Requires 2FA:" }), ' ', (0, jsx_runtime_1.jsx)(StatusBadge, { value: user.requiresTwoFactor, trueText: "Yes", falseText: "No", isDarkMode: isDarkMode, invertColors: true })] }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "Auth Methods (AMR)", value: user.authenticationMethods?.join(', '), labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "Auth Level (ACR)", value: user.authenticationLevel, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "MFA Completed At", value: user.mfaCompletedAt ? new Date(user.mfaCompletedAt).toISOString() : undefined, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "MFA Expires At", value: user.mfaExpiresAt ? new Date(user.mfaExpiresAt).toISOString() : undefined, labelClass: labelClass, valueClass: valueClass })] })] }), (0, jsx_runtime_1.jsxs)("div", { className: `p-4 rounded-lg ${isDarkMode ? 'bg-blue-900/30 border border-blue-700' : 'bg-blue-50 border border-blue-200'}`, children: [(0, jsx_runtime_1.jsx)("h2", { className: "text-lg font-semibold mb-4", children: "Tokens" }), (0, jsx_runtime_1.jsxs)("div", { className: "space-y-4", children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("div", { className: "flex items-center justify-between mb-2", children: (0, jsx_runtime_1.jsx)("span", { className: labelClass, children: "Session Token (Redis Key):" }) }), (0, jsx_runtime_1.jsx)("code", { className: `block p-2 rounded text-xs break-all ${isDarkMode ? 'bg-slate-800' : 'bg-gray-100'}`, children: displayExt.sessionToken ? (0, redact_credentials_1.maskToken)(displayExt.sessionToken) : 'N/A' })] }), (0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("div", { className: "flex items-center justify-between mb-2", children: (0, jsx_runtime_1.jsx)("span", { className: labelClass, children: "Access Token (IDP):" }) }), (0, jsx_runtime_1.jsx)("code", { className: `block p-2 rounded text-xs break-all max-h-24 overflow-auto ${isDarkMode ? 'bg-slate-800' : 'bg-gray-100'}`, children: displayExt.accessToken ? (0, redact_credentials_1.maskToken)(displayExt.accessToken) : 'N/A' })] }), (0, jsx_runtime_1.jsxs)("div", { className: "grid grid-cols-1 md:grid-cols-2 gap-3 text-sm", children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("span", { className: labelClass, children: "Has Refresh Token:" }), ' ', (0, jsx_runtime_1.jsx)(StatusBadge, { value: !!displayExt.refreshToken, trueText: "Yes", falseText: "No", isDarkMode: isDarkMode })] }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "Access Token Expires", value: displayExt.accessTokenExpires ? new Date(displayExt.accessTokenExpires).toISOString() : undefined, labelClass: labelClass, valueClass: valueClass })] })] })] }), jwtHeader && ((0, jsx_runtime_1.jsxs)("div", { className: `p-4 rounded-lg ${isDarkMode ? 'bg-orange-900/30 border border-orange-700' : 'bg-orange-50 border border-orange-200'}`, children: [(0, jsx_runtime_1.jsx)("h2", { className: "text-lg font-semibold mb-4", children: "JWT Header" }), (0, jsx_runtime_1.jsxs)("div", { className: "grid grid-cols-1 md:grid-cols-2 gap-3 text-sm", children: [(0, jsx_runtime_1.jsx)(InfoRow, { label: "Algorithm (alg)", value: jwtHeader.alg, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "Type (typ)", value: jwtHeader.typ, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("span", { className: labelClass, children: "Key ID (kid):" }), ' ', (0, jsx_runtime_1.jsx)("span", { className: `font-mono ${jwtHeader.kid ? (isDarkMode ? 'text-green-400' : 'text-green-600') : (isDarkMode ? 'text-red-400' : 'text-red-600')}`, children: jwtHeader.kid || 'NOT PRESENT' })] }), Object.entries(jwtHeader)
                                     .filter(([key]) => !['alg', 'typ', 'kid'].includes(key))
-                                    .map(([key, value]) => ((0, jsx_runtime_1.jsx)(InfoRow, { label: key, value: typeof value === 'object' ? JSON.stringify(value) : String(value), labelClass: labelClass, valueClass: valueClass }, key)))] })] })), jwtPayload && ((0, jsx_runtime_1.jsxs)("div", { className: `p-4 rounded-lg ${isDarkMode ? 'bg-green-900/30 border border-green-700' : 'bg-green-50 border border-green-200'}`, children: [(0, jsx_runtime_1.jsx)("h2", { className: "text-lg font-semibold mb-4", children: "JWT Payload Claims" }), (0, jsx_runtime_1.jsxs)("div", { className: "grid grid-cols-1 md:grid-cols-2 gap-3 text-sm", children: [(0, jsx_runtime_1.jsx)(InfoRow, { label: "Subject (sub)", value: jwtPayload.sub, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "Issuer (iss)", value: jwtPayload.iss, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "Audience (aud)", value: Array.isArray(jwtPayload.aud) ? jwtPayload.aud.join(', ') : jwtPayload.aud, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "Client ID", value: jwtPayload.client_id, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "Expires (exp)", value: jwtPayload.exp ? new Date(jwtPayload.exp * 1000).toISOString() : undefined, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "Issued At (iat)", value: jwtPayload.iat ? new Date(jwtPayload.iat * 1000).toISOString() : undefined, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "AMR (Auth Methods)", value: Array.isArray(jwtPayload.amr) ? jwtPayload.amr.join(', ') : jwtPayload.amr, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "ACR (Auth Context)", value: jwtPayload.acr, labelClass: labelClass, valueClass: valueClass })] })] })), (0, jsx_runtime_1.jsxs)("div", { className: `p-4 rounded-lg ${cardClass}`, children: [(0, jsx_runtime_1.jsx)("h2", { className: "text-lg font-semibold mb-4", children: "Session Metadata" }), (0, jsx_runtime_1.jsxs)("div", { className: "grid grid-cols-1 md:grid-cols-2 gap-3 text-sm", children: [(0, jsx_runtime_1.jsx)(InfoRow, { label: "Session Expires", value: session?.expires ? new Date(session.expires).toISOString() : undefined, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "Error", value: ext.error, labelClass: labelClass, valueClass: ext.error ? 'text-red-500' : valueClass })] })] }), (0, jsx_runtime_1.jsxs)("details", { className: `p-4 rounded-lg ${cardClass}`, children: [(0, jsx_runtime_1.jsx)("summary", { className: "font-semibold cursor-pointer", children: "Raw Session Data \u2014 credentials redacted (Click to expand)" }), (0, jsx_runtime_1.jsxs)("div", { className: "mt-3 flex items-center gap-3", children: [(0, jsx_runtime_1.jsx)(RevealButton, { revealed: !!revealed.raw, onClick: () => setRevealed((r) => ({ ...r, raw: !r.raw })), isDarkMode: isDarkMode }), (0, jsx_runtime_1.jsx)("span", { className: `text-xs ${labelClass}`, children: revealed.raw
-                                        ? 'Showing LIVE credentials in plain text, including the refresh token.'
-                                        : 'Token values are masked. Structure, claims and expiry fields are unchanged.' })] }), (0, jsx_runtime_1.jsx)("pre", { className: `mt-4 text-xs overflow-auto p-3 rounded ${isDarkMode ? 'bg-slate-800' : 'bg-gray-100'}`, children: JSON.stringify(revealed.raw
-                                ? { clientSession: session, serverSession: serverSession }
-                                : redactCredentials({ clientSession: session, serverSession: serverSession }), null, 2) })] })] }) }));
+                                    .map(([key, value]) => ((0, jsx_runtime_1.jsx)(InfoRow, { label: key, value: typeof value === 'object' ? JSON.stringify((0, redact_credentials_1.redactCredentials)(value)) : String((0, redact_credentials_1.redactCredentials)(value, key)), labelClass: labelClass, valueClass: valueClass }, key)))] })] })), jwtPayload && ((0, jsx_runtime_1.jsxs)("div", { className: `p-4 rounded-lg ${isDarkMode ? 'bg-green-900/30 border border-green-700' : 'bg-green-50 border border-green-200'}`, children: [(0, jsx_runtime_1.jsx)("h2", { className: "text-lg font-semibold mb-4", children: "JWT Payload Claims" }), (0, jsx_runtime_1.jsxs)("div", { className: "grid grid-cols-1 md:grid-cols-2 gap-3 text-sm", children: [(0, jsx_runtime_1.jsx)(InfoRow, { label: "Subject (sub)", value: jwtPayload.sub, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "Issuer (iss)", value: jwtPayload.iss, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "Audience (aud)", value: Array.isArray(jwtPayload.aud) ? jwtPayload.aud.join(', ') : jwtPayload.aud, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "Client ID", value: jwtPayload.client_id, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "Expires (exp)", value: jwtPayload.exp ? new Date(jwtPayload.exp * 1000).toISOString() : undefined, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "Issued At (iat)", value: jwtPayload.iat ? new Date(jwtPayload.iat * 1000).toISOString() : undefined, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "AMR (Auth Methods)", value: Array.isArray(jwtPayload.amr) ? jwtPayload.amr.join(', ') : jwtPayload.amr, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "ACR (Auth Context)", value: jwtPayload.acr, labelClass: labelClass, valueClass: valueClass })] })] })), (0, jsx_runtime_1.jsxs)("div", { className: `p-4 rounded-lg ${cardClass}`, children: [(0, jsx_runtime_1.jsx)("h2", { className: "text-lg font-semibold mb-4", children: "Session Metadata" }), (0, jsx_runtime_1.jsxs)("div", { className: "grid grid-cols-1 md:grid-cols-2 gap-3 text-sm", children: [(0, jsx_runtime_1.jsx)(InfoRow, { label: "Session Expires", value: session?.expires ? new Date(session.expires).toISOString() : undefined, labelClass: labelClass, valueClass: valueClass }), (0, jsx_runtime_1.jsx)(InfoRow, { label: "Error", value: ext.error, labelClass: labelClass, valueClass: ext.error ? 'text-red-500' : valueClass })] })] }), (0, jsx_runtime_1.jsxs)("details", { className: `p-4 rounded-lg ${cardClass}`, children: [(0, jsx_runtime_1.jsx)("summary", { className: "font-semibold cursor-pointer", children: "Raw Session Data \u2014 credentials redacted (Click to expand)" }), (0, jsx_runtime_1.jsx)("div", { className: "mt-3", children: (0, jsx_runtime_1.jsx)("span", { className: `text-xs ${labelClass}`, children: "Token values are masked. Structure, claims and expiry fields are unchanged." }) }), (0, jsx_runtime_1.jsx)("pre", { className: `mt-4 text-xs overflow-auto p-3 rounded ${isDarkMode ? 'bg-slate-800' : 'bg-gray-100'}`, children: JSON.stringify((0, redact_credentials_1.redactCredentials)({ clientSession: session, serverSession: serverSession }), null, 2) })] })] }) }));
 }
 // Helper Components
 function InfoRow({ label, value, labelClass, valueClass, }) {
@@ -284,29 +167,4 @@ function StatusBadge({ value, trueText, falseText, isDarkMode, invertColors = fa
         : isDarkMode ? 'bg-red-800 text-red-100' : 'bg-red-200 text-red-800';
     return ((0, jsx_runtime_1.jsx)("span", { className: `px-2 py-0.5 rounded text-xs font-medium ${colorClass}`, children: value ? trueText : falseText }));
 }
-function CopyButton({ onClick, copied, isDarkMode, }) {
-    return ((0, jsx_runtime_1.jsx)("button", { onClick: onClick, className: `px-2 py-1 rounded text-xs ${copied
-            ? 'bg-green-600 text-white'
-            : isDarkMode
-                ? 'bg-slate-700 hover:bg-slate-600 text-white'
-                : 'bg-gray-200 hover:bg-gray-300 text-gray-700'}`, children: copied ? 'Copied!' : 'Copy' }));
-}
-/**
- * Reveal toggle for a redacted credential (248991 item 3).
- *
- * Deliberately labelled "Reveal token" rather than something neutral like
- * "Show": the label is the last chance to tell whoever is about to click it,
- * possibly while screen-sharing, that a live credential is about to appear.
- */
-function RevealButton({ revealed, onClick, isDarkMode, }) {
-    return ((0, jsx_runtime_1.jsx)("button", { onClick: onClick, title: revealed
-            ? 'Hide this credential again'
-            : 'Reveals a LIVE credential in plain text. Not while screen-sharing.', className: `px-2 py-1 rounded text-xs ${revealed
-            ? isDarkMode
-                ? 'bg-amber-700 hover:bg-amber-600 text-white'
-                : 'bg-amber-200 hover:bg-amber-300 text-amber-900'
-            : isDarkMode
-                ? 'bg-slate-700 hover:bg-slate-600 text-white'
-                : 'bg-gray-200 hover:bg-gray-300 text-gray-700'}`, children: revealed ? 'Hide' : 'Reveal token' }));
-}
 exports.default = JwtInspectPage;

package/dist/pages/test-env/RefreshTokenPage.js

@@ -5,6 +5,9 @@ exports.RefreshTokenPage = RefreshTokenPage;
 const jsx_runtime_1 = require("react/jsx-runtime");
 const react_1 = require("react");
 const better_auth_client_1 = require("../../client/better-auth-client");
+// PAY-1470 (BAPert 59022): never render characters of a token, whatever the ENABLE_TEST_ROUTES gate says.
+// idealresume production mounted this page on 4.1.14 (pre-gate) showing 40 chars of both tokens.
+const redact_credentials_1 = require("./redact-credentials");
 /**
  * ⚠️ DEBUG PAGE THAT DRIVES A DESTRUCTIVE ENDPOINT — DO NOT MOUNT IN
  * PRODUCTION. ⚠️
@@ -104,6 +107,6 @@ function RefreshTokenPage() {
         const diffSecs = Math.floor((diffMs % 60000) / 1000);
         return `${date.toLocaleTimeString()} (${diffMins}m ${diffSecs}s remaining)`;
     };
-    return ((0, jsx_runtime_1.jsxs)("div", { className: "p-8 max-w-2xl mx-auto bg-gray-900 min-h-screen text-white", children: [(0, jsx_runtime_1.jsx)("h1", { className: "text-2xl font-bold mb-4", children: "Refresh Token Test" }), (0, jsx_runtime_1.jsxs)("div", { className: "mb-6 rounded border border-blue-500 bg-blue-900/30 p-4", children: [(0, jsx_runtime_1.jsx)("h2", { className: "font-semibold mb-2 text-blue-300", children: "Current Session" }), (0, jsx_runtime_1.jsxs)("div", { className: "text-sm space-y-1 font-mono", children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("span", { className: "text-gray-400", children: "User:" }), " ", session?.user?.email || "Not logged in"] }), (0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("span", { className: "text-gray-400", children: "2FA Complete:" }), " ", String(session?.user?.twoFactorSessionVerified ?? "unknown")] }), (0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("span", { className: "text-gray-400", children: "Access Token:" }), " ", sessionDetails?.accessToken ? `${sessionDetails.accessToken.substring(0, 40)}...` : "N/A"] }), (0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("span", { className: "text-gray-400", children: "Refresh Token:" }), " ", sessionDetails?.refreshToken ? `${sessionDetails.refreshToken.substring(0, 40)}...` : "N/A"] }), (0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("span", { className: "text-gray-400", children: "Access Expires:" }), " ", formatExpiry(sessionDetails?.accessTokenExpires)] })] })] }), (0, jsx_runtime_1.jsxs)("div", { className: "flex gap-2 mb-4", children: [(0, jsx_runtime_1.jsx)("button", { className: "bg-blue-600 hover:bg-blue-700 text-white px-4 py-2 rounded disabled:opacity-50", onClick: handleRefresh, disabled: loading, children: loading ? "Refreshing..." : "Test Refresh Token" }), (0, jsx_runtime_1.jsx)("button", { className: "bg-red-600 hover:bg-red-700 text-white px-4 py-2 rounded disabled:opacity-50", onClick: handleForceExpire, disabled: loading, children: "Force Expire Token" }), (0, jsx_runtime_1.jsx)("button", { className: "bg-gray-600 hover:bg-gray-700 text-white px-4 py-2 rounded", onClick: () => window.location.reload(), children: "Reload Page" })] }), result && ((0, jsx_runtime_1.jsxs)("div", { className: "rounded border border-gray-600 bg-gray-800 p-4", children: [(0, jsx_runtime_1.jsx)("h3", { className: "font-semibold mb-2 text-gray-300", children: "Result:" }), (0, jsx_runtime_1.jsx)("pre", { className: "text-xs overflow-x-auto whitespace-pre-wrap text-green-400", children: JSON.stringify(result, null, 2) })] })), (0, jsx_runtime_1.jsxs)("details", { className: "mt-4", children: [(0, jsx_runtime_1.jsx)("summary", { className: "cursor-pointer text-gray-400 hover:text-white", children: "Raw Session Details" }), (0, jsx_runtime_1.jsx)("pre", { className: "mt-2 text-xs bg-gray-800 p-2 rounded overflow-x-auto text-gray-300", children: JSON.stringify(sessionDetails, null, 2) })] })] }));
+    return ((0, jsx_runtime_1.jsxs)("div", { className: "p-8 max-w-2xl mx-auto bg-gray-900 min-h-screen text-white", children: [(0, jsx_runtime_1.jsx)("h1", { className: "text-2xl font-bold mb-4", children: "Refresh Token Test" }), (0, jsx_runtime_1.jsxs)("div", { className: "mb-6 rounded border border-blue-500 bg-blue-900/30 p-4", children: [(0, jsx_runtime_1.jsx)("h2", { className: "font-semibold mb-2 text-blue-300", children: "Current Session" }), (0, jsx_runtime_1.jsxs)("div", { className: "text-sm space-y-1 font-mono", children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("span", { className: "text-gray-400", children: "User:" }), " ", session?.user?.email || "Not logged in"] }), (0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("span", { className: "text-gray-400", children: "2FA Complete:" }), " ", String(session?.user?.twoFactorSessionVerified ?? "unknown")] }), (0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("span", { className: "text-gray-400", children: "Access Token:" }), " ", sessionDetails ? (sessionDetails.hasAccessToken ? "present (server-side only)" : "absent") : "N/A"] }), (0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("span", { className: "text-gray-400", children: "Refresh Token:" }), " ", sessionDetails ? (sessionDetails.hasRefreshToken ? "present (server-side only)" : "absent") : "N/A"] }), (0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("span", { className: "text-gray-400", children: "Access Expires:" }), " ", formatExpiry(sessionDetails?.accessTokenExpires)] })] })] }), (0, jsx_runtime_1.jsxs)("div", { className: "flex gap-2 mb-4", children: [(0, jsx_runtime_1.jsx)("button", { className: "bg-blue-600 hover:bg-blue-700 text-white px-4 py-2 rounded disabled:opacity-50", onClick: handleRefresh, disabled: loading, children: loading ? "Refreshing..." : "Test Refresh Token" }), (0, jsx_runtime_1.jsx)("button", { className: "bg-red-600 hover:bg-red-700 text-white px-4 py-2 rounded disabled:opacity-50", onClick: handleForceExpire, disabled: loading, children: "Force Expire Token" }), (0, jsx_runtime_1.jsx)("button", { className: "bg-gray-600 hover:bg-gray-700 text-white px-4 py-2 rounded", onClick: () => window.location.reload(), children: "Reload Page" })] }), result && ((0, jsx_runtime_1.jsxs)("div", { className: "rounded border border-gray-600 bg-gray-800 p-4", children: [(0, jsx_runtime_1.jsx)("h3", { className: "font-semibold mb-2 text-gray-300", children: "Result:" }), (0, jsx_runtime_1.jsx)("pre", { className: "text-xs overflow-x-auto whitespace-pre-wrap text-green-400", children: JSON.stringify((0, redact_credentials_1.redactCredentials)(result), null, 2) })] })), (0, jsx_runtime_1.jsxs)("details", { className: "mt-4", children: [(0, jsx_runtime_1.jsx)("summary", { className: "cursor-pointer text-gray-400 hover:text-white", children: "Raw Session Details" }), (0, jsx_runtime_1.jsx)("pre", { className: "mt-2 text-xs bg-gray-800 p-2 rounded overflow-x-auto text-gray-300", children: JSON.stringify((0, redact_credentials_1.redactCredentials)(sessionDetails), null, 2) })] })] }));
 }
 exports.default = RefreshTokenPage;

package/dist/pages/test-env/redact-credentials.d.ts

@@ -0,0 +1,6 @@
+/** A stable, non-reversible stand-in for a credential: `h:<12 hex>  (<n> chars, hidden)`. */
+export declare function maskToken(value: string): string;
+/** Is a string under this key displayable? Credential names lose even when a timestamp suffix matches. */
+export declare function isDisplayableKey(keyName: string): boolean;
+/** A deep copy of `value` in which every string not under a displayable key is replaced by maskToken. */
+export declare function redactCredentials(value: unknown, keyName?: string): unknown;

package/dist/pages/test-env/redact-credentials.js

@@ -0,0 +1,101 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.maskToken = maskToken;
+exports.isDisplayableKey = isDisplayableKey;
+exports.redactCredentials = redactCredentials;
+/**
+ * redact-credentials - what the test-env debug pages may show of a credential: a stable hash and a length, never
+ * characters of the value (PAY-1470, BAPert rulings 59022 and 59040).
+ *
+ * PAY-1481 item 2 (QAPert, PR 186 review 59083): this was a DENYLIST (keys ending in token/secret/password/...).
+ * Opaque credentials under `tokens.access`, `redisSessionId`, `sid`, `authorization`, `cookie`, `backupCodes[]` and
+ * `code` passed unmasked. It is now an ALLOWLIST: a string is shown only when its key is a known DISPLAYABLE field
+ * (identity, roles, timestamps, provider and flag metadata, standard JWT claims). Every other string - an unknown
+ * key, an array item under an unknown key, a top-level string - becomes maskToken. A new field is hidden until
+ * someone decides it is displayable, which is the safe direction for a page reachable in production builds.
+ *
+ * Kept from the denylist era, and applied EVEN under a displayable key, because a credential can sit under an
+ * innocent name: a JWT (three base64url segments, length floors so "4.1.42" is not one), a PEM armour band, and the
+ * password in scheme://user:password@host. Numbers, booleans and null are never credentials and stay readable.
+ *
+ * There is no Reveal and no copy. "Never renders token material" includes click-to-reveal (59040).
+ */
+const token_log_id_1 = require("../../lib/token-log-id");
+/** A stable, non-reversible stand-in for a credential: `h:<12 hex>  (<n> chars, hidden)`. */
+function maskToken(value) {
+    return `${(0, token_log_id_1.tokenLogId)(value)}  (${value.length} chars, hidden)`;
+}
+/**
+ * Keys whose string values are displayable. Exact names (case-insensitive), plus timestamp / flag suffix patterns.
+ * An exact listed key wins (tokenType is metadata); otherwise a key naming a credential (CREDENTIAL_NAME) is refused.
+ */
+const DISPLAYABLE_KEYS = new Set([
+    // identity
+    'id', 'userId', 'user_id', 'sub', 'email', 'name', 'given_name', 'family_name', 'preferred_username', 'image',
+    'picture', 'locale', 'phone_number_verified',
+    // authorisation metadata
+    'role', 'roles', 'scope', 'scopes', 'permissions', 'authenticationMethods', 'authenticationLevel', 'amr', 'acr',
+    'oauthProvider', 'provider', 'providerId', 'tokenType', 'token_type', 'type', 'typ', 'alg', 'kid', 'iss', 'aud',
+    'azp', 'jti',
+    // client / tenant
+    'clientId', 'client_id', 'idpClientId', 'clientSlug', 'slug', 'tenant', 'tenantId', 'merchantId', 'appSlug',
+    // result / status fields of the test-env routes
+    'status', 'statusText', 'success', 'action', 'message', 'error', 'reason', 'outcome', 'source', 'shape', 'mode',
+].map((k) => k.toLowerCase()));
+/** Timestamps, durations and booleans-as-strings by suffix: expires, accessTokenExpires, mfaCompletedAt, iat... */
+const DISPLAYABLE_SUFFIX = /(expires|_at|iat|exp|nbf|hours|seconds|verified|required|enabled|count|version)$/i;
+/** camelCase timestamps (createdAt, mfaCompletedAt): tested on the ORIGINAL key so `format` / `chat` do not match. */
+const CAMEL_AT = /[a-z0-9]At$/;
+/** A key that names a credential is never displayable, whatever suffix it has (e.g. refreshTokenCreatedAt stays OK
+ *  because it names a TIME; `authorization`, `cookie`, `sid`, `code` are credentials). */
+const CREDENTIAL_NAME = /(token|secret|password|passwd|apikey|api_key|credential|authorization|cookie|^sid$|session_?id$|^code$|codes?$|otp|pin$|signature|private)/i;
+const URL_WITH_USERINFO = /^([a-z][a-z0-9+.-]*:\/\/)([^/\s:@]+):([^/\s@]+)@/i;
+const PEM_BLOCK = /-----BEGIN [A-Z0-9][A-Z0-9 ]*-----/;
+function looksLikeJwt(v) {
+    if (v.length < 40)
+        return false;
+    const parts = v.split('.');
+    return parts.length === 3 && parts.every((p) => p.length >= 8 && /^[A-Za-z0-9_-]+$/.test(p));
+}
+/** Is a string under this key displayable? Credential names lose even when a timestamp suffix matches. */
+function isDisplayableKey(keyName) {
+    if (!keyName)
+        return false;
+    const k = keyName.toLowerCase();
+    // 1. An exact, deliberately listed field (tokenType is metadata even though it says "token").
+    if (DISPLAYABLE_KEYS.has(k))
+        return true;
+    // 2. A key naming a credential is refused - unless what it names is a TIME about it (accessTokenExpires).
+    const namesTime = /(expires|_at|iat|exp|nbf|hours|seconds)$/i.test(k) || CAMEL_AT.test(keyName);
+    if (CREDENTIAL_NAME.test(k) && !namesTime)
+        return false;
+    // 3. Metadata by suffix: timestamps, durations, flags, counts, versions, URLs (userinfo is still masked).
+    return DISPLAYABLE_SUFFIX.test(k) || CAMEL_AT.test(keyName) || /url$/i.test(k);
+}
+/** A deep copy of `value` in which every string not under a displayable key is replaced by maskToken. */
+function redactCredentials(value, keyName = '') {
+    // Array items inherit the array's key: backupCodes[] items are credentials, roles[] items are not.
+    if (Array.isArray(value))
+        return value.map((v) => redactCredentials(v, keyName));
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, redactCredentials(v, k)]));
+    }
+    // NightHawk (PR 204 review): a numeric OTP / code under a credential-named key is a credential too.
+    if (typeof value === 'number' && keyName && !isDisplayableKey(keyName) && CREDENTIAL_NAME.test(keyName)) {
+        return maskToken(String(value));
+    }
+    if (typeof value !== 'string' || value.length === 0)
+        return value;
+    if (looksLikeJwt(value))
+        return maskToken(value);
+    if (PEM_BLOCK.test(value))
+        return '••• PEM block redacted (' + value.length + ' chars) •••';
+    if (!isDisplayableKey(keyName))
+        return maskToken(value);
+    let shown = value;
+    if (URL_WITH_USERINFO.test(shown))
+        shown = shown.replace(URL_WITH_USERINFO, '$1$2:•••••@');
+    // NightHawk (PR 204 review): a URL's query and fragment carry tokens (?token=, #access_token=). Names stay, values go.
+    shown = shown.replace(/([?&#][^=&#\s]+=)[^&#\s]*/g, '$1•••');
+    return shown;
+}

package/dist/pages/verify-code/page.js

@@ -302,7 +302,8 @@ function VerifyCodeForm({ enrollHref }) {
                         sessionStorage.removeItem(VERIFY_IN_PROGRESS_KEY);
                     }
                     const safeCallback = callbackUrl.startsWith('/account-auth/') ? '/dashboard' : callbackUrl;
-                    const errorParam = isJwtExpired ? '&error=SessionExpired' : '';
+                    // PAY-884: an expired JWT here is the provisional pre-2FA token - say so on the login page.
+                    const errorParam = isJwtExpired ? '&error=TwoFactorTimeout' : '';
                     router.push(`/account-auth/login?callbackUrl=${encodeURIComponent(safeCallback)}${errorParam}`);
                 }, 1500);
                 return;
@@ -366,7 +367,8 @@ function VerifyCodeForm({ enrollHref }) {
                         sessionStorage.removeItem(VERIFY_IN_PROGRESS_KEY);
                     }
                     const safeCallback = callbackUrl.startsWith('/account-auth/') ? '/dashboard' : callbackUrl;
-                    const errorParam = isJwtExpired ? '&error=SessionExpired' : '';
+                    // PAY-884: an expired JWT here is the provisional pre-2FA token - say so on the login page.
+                    const errorParam = isJwtExpired ? '&error=TwoFactorTimeout' : '';
                     router.push(`/account-auth/login?callbackUrl=${encodeURIComponent(safeCallback)}${errorParam}`);
                 }, 1500);
                 return;
@@ -405,7 +407,8 @@ function VerifyCodeForm({ enrollHref }) {
                     if (!updateRes.ok) {
                         console.warn('[2FA] update-session returned non-OK status:', updateRes.status);
                         const errorData = await updateRes.json();
-                        console.warn('[2FA] update-session error:', errorData);
+                        // PAY-1427: the request carried access_token/refresh_token; log the error envelope's shape, never its contents.
+                        console.warn('[2FA] update-session error:', { keys: errorData && typeof errorData === 'object' ? Object.keys(errorData) : typeof errorData, code: errorData?.error?.code ?? errorData?.code });
                     }
                     else {
                         console.log('[2FA] Session updated successfully with MFA tokens');

package/dist/routes/auth/logout.d.ts

@@ -27,5 +27,6 @@ export declare function POST(req: NextRequest): Promise<NextResponse<{
     message: string;
 }> | NextResponse<{
     error: string;
-    details: string;
+    code: string;
+    correlationId: string;
 }>>;

package/dist/routes/auth/logout.js

@@ -21,6 +21,7 @@ const auth_1 = require("../../server/auth");
 const session_store_1 = require("../../lib/session-store");
 const app_slug_1 = require("../../lib/app-slug");
 const site_logger_1 = require("../../lib/site-logger");
+const safe_error_response_1 = require("../../lib/safe-error-response");
 /**
  * POST /api/auth/logout - Sign out and clean up session
  *
@@ -90,10 +91,11 @@ async function POST(req) {
         return response;
     }
     catch (error) {
-        console.error('[LOGOUT_ROUTE] Error during logout:', error);
+        const correlationId = (0, safe_error_response_1.logExceptionWithCorrelation)('[LOGOUT_ROUTE] Error during logout:', error);
         return server_1.NextResponse.json({
             error: 'Failed to logout',
-            details: error instanceof Error ? error.message : 'Unknown error'
+            code: 'INTERNAL_ERROR',
+            correlationId,
         }, { status: 500 });
     }
 }

package/dist/routes/auth/session.d.ts

@@ -46,7 +46,4 @@ export declare function POST(req: NextRequest): Promise<NextResponse<{
 }> | NextResponse<{
     success: boolean;
     message: string;
-}> | NextResponse<{
-    error: string;
-    details: string;
 }>>;

package/dist/routes/auth/session.js

@@ -19,6 +19,8 @@ exports.POST = POST;
 const server_1 = require("next/server");
 const auth_1 = require("../../server/auth");
 const session_store_1 = require("../../lib/session-store");
+const safe_error_response_1 = require("../../lib/safe-error-response");
+const token_log_id_1 = require("../../lib/token-log-id");
 /**
  * GET /api/auth/session - Check current session status
  *
@@ -41,7 +43,7 @@ async function GET(req) {
             userId: authSession.user?.id,
             email: authSession.user?.email,
             name: authSession.user?.name,
-            redisSessionId: redisSessionId ? redisSessionId.substring(0, 8) + '...' : 'MISSING',
+            redisSessionId: redisSessionId ? (0, token_log_id_1.tokenLogId)(redisSessionId) : 'MISSING',
         });
         // Fetch full session data from Redis
         const session = redisSessionId ? await (0, session_store_1.getSession)(redisSessionId) : null;
@@ -66,7 +68,7 @@ async function GET(req) {
         if (!session) {
             console.error('[SESSION_ROUTE] Redis session MISS — refusing to report authenticated', {
                 userId: authSession.user?.id,
-                redisSessionId: redisSessionId ? redisSessionId.substring(0, 8) + '...' : 'MISSING',
+                redisSessionId: redisSessionId ? (0, token_log_id_1.tokenLogId)(redisSessionId) : 'MISSING',
                 reason: redisSessionId ? 'session expired or evicted' : 'no session token on auth session',
             });
             return server_1.NextResponse.json({});
@@ -93,10 +95,11 @@ async function GET(req) {
                 idpClientId: session?.idpClientId,
                 merchantId: session?.merchantId,
             },
-            // Session tokens
-            sessionToken: redisSessionId,
-            accessToken: session?.idpAccessToken,
-            refreshToken: session?.idpRefreshToken,
+            // PAY-1481 item 1: NO token material. This body is read by browser JS, so returning the session token and the
+            // IdP access/refresh tokens handed them to any script on the page (the refresh token outlives the session).
+            // Server routes read tokens from the session store; the UI only needs presence and expiry.
+            hasAccessToken: !!session?.idpAccessToken,
+            hasRefreshToken: !!session?.idpRefreshToken,
             accessTokenExpires: session?.idpAccessTokenExpires,
             expires: authSession.session?.expiresAt
                 ? new Date(authSession.session.expiresAt).toISOString()
@@ -104,10 +107,12 @@ async function GET(req) {
         });
     }
     catch (error) {
-        console.error('[SESSION_ROUTE] Error checking session:', error);
+        // PAY-1438: pre-auth route - the exception text stays in the log, keyed by correlationId.
+        const correlationId = (0, safe_error_response_1.logExceptionWithCorrelation)('[SESSION_ROUTE] Error checking session:', error);
         return server_1.NextResponse.json({
             error: 'Failed to check session',
-            details: error instanceof Error ? error.message : 'Unknown error'
+            code: 'INTERNAL_ERROR',
+            correlationId,
         }, { status: 500 });
     }
 }
@@ -231,10 +236,11 @@ async function POST(req) {
         });
     }
     catch (error) {
-        console.error('[SESSION_ROUTE] Error updating session:', error);
+        const correlationId = (0, safe_error_response_1.logExceptionWithCorrelation)('[SESSION_ROUTE] Error updating session:', error);
         return server_1.NextResponse.json({
             error: 'Failed to update session',
-            details: error instanceof Error ? error.message : 'Unknown error'
+            code: 'INTERNAL_ERROR',
+            correlationId,
         }, { status: 500 });
     }
 }

package/dist/routes/auth/settings.js

@@ -31,6 +31,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.GET = GET;
 const server_1 = require("next/server");
 const idp_client_config_1 = require("../../lib/idp-client-config");
+const never_in_response_1 = require("../../lib/never-in-response");
 /**
  * Fail closed and LOUD. 503 + success:false + a code, and CRUCIALLY no policy
  * fields at all - not defaults, not partials. A consumer cannot mistake an
@@ -105,5 +106,7 @@ async function GET() {
         require2FA: authSettings.require2FA,
         allowed2FAMethods: authSettings.allowed2FAMethods,
     };
-    return server_1.NextResponse.json({ success: true, data: settings }, { headers: { 'Cache-Control': 'no-store' } });
+    // PAY-1529: the public policy is built from an allowlist above; secretSafeJson is the runtime backstop
+    // that answers 500 instead of serving it if a registered secret ever reaches this body anyway.
+    return (0, never_in_response_1.secretSafeJson)({ success: true, data: settings }, { headers: { 'Cache-Control': 'no-store' } }, 'GET /api/auth/settings');
 }

package/dist/routes/auth/viability.d.ts

@@ -33,7 +33,7 @@ export declare function GET(req: NextRequest): Promise<NextResponse<{
     expiresIn: number;
     hasRefreshToken: boolean;
     authenticated: boolean;
-    sessionToken: any;
+    sessionTokenId: string | null;
     tenantRequiresTwoFactor: boolean;
     userHasCompletedTenantTwoFactorRequirements: boolean;
     userStillNeedsTwoFactor: boolean;
@@ -50,5 +50,6 @@ export declare function GET(req: NextRequest): Promise<NextResponse<{
     needsRefresh: boolean;
     authenticated: boolean;
     error: string;
-    details: string;
+    code: string;
+    correlationId: string;
 }>>;