@payez/next-mvp 4.4.5 → 4.4.7

package/src/routes/auth/viability.ts

@@ -21,6 +21,8 @@ import {
   getBetterAuthSession as getBetterAuthRedisSession,
 } from '../../lib/session-store';
 import { getIDPClientConfig } from '../../lib/idp-client-config';
+import { logExceptionWithCorrelation } from '../../lib/safe-error-response';
+import { tokenLogId } from '../../lib/token-log-id';
 
 /**
  * Get tenant-wide 2FA requirement from cached client config (from broker handshake)
@@ -175,7 +177,7 @@ export async function GET(req: NextRequest) {
         viable: false,
         needsRefresh: false,
         authenticated: false,
-        sessionToken, // Return sessionToken so middleware can detect and clear stale cookie
+        sessionTokenId: tokenLogId(sessionToken), // PAY-1481: a correlation id, never the token; middleware only needs presence to clear the stale cookie
         reason: 'Stale session - cookie exists but session not found in Redis'
       });
     }
@@ -309,7 +311,7 @@ export async function GET(req: NextRequest) {
         viable: true,
         needsRefresh: true,
         authenticated: true,
-        sessionToken,
+        sessionTokenId: sessionToken ? tokenLogId(sessionToken) : null,
         // Clear names for middleware decision-making
         tenantRequiresTwoFactor,
         userHasCompletedTenantTwoFactorRequirements,
@@ -351,7 +353,7 @@ export async function GET(req: NextRequest) {
 
     // DEBUG: Log what we're reading from the session
     console.log('[VIABILITY] Session 2FA state:', {
-      sessionToken: sessionToken?.substring(0, 8) + '...',
+      sessionToken: tokenLogId(sessionToken),
       'session.mfaVerified': session?.mfaVerified,
       'session.twoFactorComplete': (session as any)?.twoFactorComplete,
       mfaVerifiedInSession,
@@ -379,7 +381,7 @@ export async function GET(req: NextRequest) {
         expiresIn: 0,
         hasRefreshToken,
         authenticated: true,
-        sessionToken,
+        sessionTokenId: sessionToken ? tokenLogId(sessionToken) : null,
         // Clear names
         tenantRequiresTwoFactor,
         userHasCompletedTenantTwoFactorRequirements,
@@ -403,7 +405,7 @@ export async function GET(req: NextRequest) {
       expiresIn,
       hasRefreshToken,
       authenticated: true,
-      sessionToken,
+      sessionTokenId: sessionToken ? tokenLogId(sessionToken) : null,
       // Clear names
       tenantRequiresTwoFactor,
       userHasCompletedTenantTwoFactorRequirements,
@@ -420,13 +422,15 @@ export async function GET(req: NextRequest) {
       clientId: resolveClientId(session?.idpClientId),
     });
   } catch (error) {
-    console.error('[VIABILITY_ROUTE] Error checking session viability:', error);
+    // PAY-1438: pre-auth probe - the exception text stays in the log, keyed by correlationId.
+    const correlationId = logExceptionWithCorrelation('[VIABILITY_ROUTE] Error checking session viability:', error);
     return NextResponse.json({
       viable: false,
       needsRefresh: false,
       authenticated: false,
       error: 'Failed to check session',
-      details: error instanceof Error ? error.message : 'Unknown error'
+      code: 'INTERNAL_ERROR',
+      correlationId
     }, { status: 500 });
   }
 }

package/src/server/auth.ts

@@ -6,17 +6,13 @@
  */
 
 import 'server-only';
-import { createBetterAuthInstance, secretFingerprint } from '../auth/better-auth';
-import { getIDPClientConfig } from '../lib/idp-client-config';
+import { getBetterAuthInstance } from '../auth/better-auth';
 import {
   getSession as getRedisSession,
   getBetterAuthSession as getBetterAuthRedisSession,
   type SessionData,
 } from '../lib/session-store';
-import { extractSessionTokenFromCookie } from '../lib/session-cookie-shape';
-import { createSingleFlight } from '../lib/single-flight';
-
-let authInstance: ReturnType<typeof createBetterAuthInstance> | null = null;
+import { resolveVerifiedSessionTokenFromRequest } from './verified-session-token';
 
 export type IdpTokenResult =
   | { success: true; accessToken: string; sessionData: SessionData }
@@ -102,32 +98,30 @@ function attachSessionData(session: any, sessionData: SessionData | null, sessio
  * test/single-flight-retry.test.cjs, which imports dist/ and therefore
  * exercises the artefact that actually ships.
  *
- * Semantics, all asserted by that suite: concurrent callers share ONE
- * underlying init; a rejection reaches every caller awaiting that attempt
- * (failures stay loud -- getIDPClientConfig is fail-loud by design and callers
- * depend on it); the NEXT call after a failure starts a fresh attempt; and a
- * slow failure never evicts a newer in-flight attempt.
+ * PAY-1623 (package half, BAPert 62449): THIS FUNNEL NO LONGER BUILDS ITS OWN
+ * INSTANCE. It used to call `createBetterAuthInstance(config)` with no opts, so
+ * it carried NONE of the app-supplied plugins registered by the host app at
+ * startup (`configureBetterAuth()` -> `state.configuredOpts`). `samlAcs()` and
+ * `passkeySignIn()` arrive only that way, so `getAuthInstance()` returned an
+ * instance on which `auth.api.samlAcs` was `undefined` — the exact package twin
+ * of the portal ACS crash `t.api.samlAcs is not a function` (Jon's walk,
+ * 2026-09-21; Portal PR 517 fixed the portal by importing the CONFIGURED
+ * instance, `getBetterAuthInstance`, which is why this file must now resolve the
+ * same one). It also silently created a SECOND, divergent instance beside the
+ * one every /api/auth/* route uses — two instances, two secrets, one process.
+ *
+ * It now DELEGATES to that configured funnel, which is the single source of
+ * truth for the process's Better Auth instance:
+ *   - it carries `state.configuredOpts` (better-auth.ts:930), so the app
+ *     plugins are present;
+ *   - its init is already single-flighted with the retry semantics described in
+ *     lib/single-flight.ts (see getBetterAuthInstance, card 244549/338215), so
+ *     this function keeps the same no-latch recovery contract;
+ *   - there is now ONE instance, so the double-init / divergent-secret hazard
+ *     this path used to create is gone by construction.
  */
-const authInit = createSingleFlight(async () => {
-  const config = await getIDPClientConfig(true);
-  authInstance = createBetterAuthInstance(config);
-  // 185121 line 1, path 2: this module-scope instance had NO creation log
-  // line — first-called during a config transition window it pinned a
-  // divergent secret INVISIBLY. Name the path and the secret fingerprint
-  // (the createBetterAuthInstance line already logged the same hash;
-  // this line is what attributes it to THIS init path).
-  // Guard matches createBetterAuthInstance's: getIDPClientConfig currently
-  // throws FATAL on a missing authSecret (QAPert 27328 verified), but that
-  // guarantee is one refactor away — log ABSENT rather than ever throw here.
-  console.log(
-    `[AUTH] getAuthInstance: created BA instance via server/auth.ts — authSecret ${config.authSecret ? `sha256:${secretFingerprint(config.authSecret as string)}` : 'ABSENT'}`
-  );
-  return authInstance;
-});
-
 export async function getAuthInstance() {
-  if (authInstance) return authInstance;
-  return authInit.get();
+  return getBetterAuthInstance();
 }
 
 
@@ -172,14 +166,18 @@ export async function getSession(request?: Request): Promise<any> {
     return attachSessionData(betterAuthSession, sessionData, sessionToken);
   }
 
-  // Path B — Better Auth said null/incomplete. Fall back to manual cookie
+  // Path B — Better Auth said null/incomplete. Fall back to a VERIFIED cookie
   // decode + Redis-canonical liveness check. This catches cases where the
   // canonical app session at `{slug}:{token}` is still alive but Better
   // Auth's `ba:{slug}:{token}` secondary record was evicted or the
-  // in-memory cookie cache returned stale-null. No JWT signature check —
-  // Redis lookup is the validation: an attacker forging a session-token
-  // claim hits NO_SESSION because Redis has no matching entry.
-  const sessionToken = extractSessionTokenFromCookie(request);
+  // in-memory cookie cache returned stale-null.
+  //
+  // PAY-1476: this path used to take the token with NO signature check, on the
+  // theory that "Redis lookup is the validation". It is not: a leaked token has
+  // a live record, so the token string alone authenticated, with any garbage in
+  // the signature position, and a forged JWS too. The token now comes only from
+  // the shared verified resolver (HMAC or JWS signature checked first).
+  const sessionToken = await resolveVerifiedSessionTokenFromRequest(request);
   if (!sessionToken) return null;
 
   let sessionData: SessionData | null = null;

package/src/server/decode-session.ts

@@ -7,12 +7,14 @@
 
 import 'server-only';
 import { cookies } from 'next/headers';
-import { jwtVerify, type JWTPayload } from 'jose';
+import { type JWTPayload } from 'jose';
 import { getSession, type SessionData } from '../lib/session-store';
 import { getIDPClientConfig } from '../lib/idp-client-config';
 import { getSessionCookieName, getSecureSessionCookieName } from '../lib/app-slug';
 import { ensureInitialized } from '../lib/startup-init';
 import { extractSessionTokenFromCookieValue } from '../lib/session-cookie-shape';
+import { resolveVerifiedSessionCookie } from './verified-session-token';
+import { tokenLogId } from '../lib/token-log-id';
 
 export interface DecodedSession {
   sessionData: SessionData;
@@ -137,7 +139,7 @@ async function tryBetterAuthSession(
     if (!idpTokens?.roles?.length) {
       console.warn(
         '[DECODE-SESSION] Leg 1 declining: idpTokens unusable (no roles) for session',
-        result.session.token.substring(0, 10),
+        tokenLogId(result.session.token),
         '— falling through to the sess: leg'
       );
       return null;
@@ -252,32 +254,20 @@ export async function decodeSession(
     // death, because the ONLY fallback was structurally blind to the only
     // shape it would ever be handed.
     //
-    // Check the shape FIRST. A BA-hmac cookie skips jose entirely and goes
-    // straight to the Redis-canonical liveness check below — same posture
-    // as the JWS path always had (no signature re-check here either; Redis
-    // presence is the authority). A JWS-shaped cookie (legacy NextAuth-era,
-    // if any still linger) keeps the original jwtVerify path unchanged.
+    // PAY-1476: the shape still decides HOW to verify, but BOTH shapes are now
+    // verified, by the shared resolver. This branch used to take a BA-hmac
+    // cookie's token with no signature check ("Redis presence is the
+    // authority"), so `{leaked token}.{anything}` authenticated here - including
+    // behind the portal's admin API gate. The resolver checks the HMAC with
+    // timingSafeEqual (ba-hmac) or runs jwtVerify (jws) against the same
+    // env-first auth secret, and returns null on any failure.
     const shaped = extractSessionTokenFromCookieValue(cookieValue);
-
-    let sessionToken: string | undefined;
-    let payload: JWTPayload | undefined;
-
-    if (shaped?.shape === 'ba-hmac') {
-      sessionToken = shaped.token;
-    } else {
-      const secretKey = new TextEncoder().encode(secret);
-      try {
-        const result = await jwtVerify(cookieValue, secretKey);
-        payload = result.payload;
-      } catch (jwtError) {
-        console.warn('[DECODE-SESSION] JWT verification failed:', jwtError instanceof Error ? jwtError.message : String(jwtError));
-        return null;
-      }
-      sessionToken = (payload as any).sessionToken || (payload as any).redisSessionId;
-    }
+    const verified = await resolveVerifiedSessionCookie(cookieValue);
+    const sessionToken = verified?.token;
+    const payload: JWTPayload | undefined = verified?.payload;
 
     if (!sessionToken) {
-      console.warn('[DECODE-SESSION] No sessionToken resolved from cookie (shape:', shaped?.shape ?? 'unrecognized', ')');
+      console.warn('[DECODE-SESSION] Session cookie did not verify (shape:', shaped?.shape ?? 'unrecognized', ')');
       return null;
     }
 
@@ -292,7 +282,7 @@ export async function decodeSession(
       // fixing a silent path.
       console.warn(
         '[DECODE-SESSION] No sess: record for token',
-        sessionToken.substring(0, 10),
+        tokenLogId(sessionToken),
         '— no fallback available, session will be signed out'
       );
       return null;

package/src/server/verified-session-token.ts

@@ -0,0 +1,103 @@
+/**
+ * PAY-1476 / card 372275 (R941 s1b) - THE ONE SHARED VERIFIED RESOLVER for a session token taken from a cookie.
+ *
+ * THE DEFECT (4.4.5, measured at the deployed portal by QAPert-NightHawk, mail 59030):
+ *   Module A  server/decode-session.ts  the ba-hmac branch took `{token}.{anything}` and used segment 0 unread.
+ *   Module B  server/auth.ts  Path B    took the token from ANY recognised shape and never verified anything;
+ *                                       a forged JWS resolved there too.
+ * Both then treated "a Redis record exists" as the validation. So a leaked session token string was a bearer
+ * credential with no signature needed, including on the portal's admin API gate (api-admin-gate -> decodeSession).
+ *
+ * THE RULE THIS MODULE ENFORCES: a cookie yields a session token ONLY after its signature checks out against
+ * the auth secret. Every caller that turns a cookie into a token for the session store awaits this function.
+ * lib/session-cookie-shape.ts stays classification-only and secret-free (it cannot verify, by construction).
+ *
+ *   ba-hmac  `{token}.{sig}` as Better Auth mints it (better-call signCookieValue): sig =
+ *            base64(HMAC-SHA256(secret, token)), standard padding, 44 characters. Compared with
+ *            crypto.timingSafeEqual over equal-length buffers.
+ *   jws      legacy NextAuth-era cookie: jose jwtVerify with the same secret, then the sessionToken
+ *            (or redisSessionId) claim.
+ *   anything else, a missing secret, or a failed check -> null. Never throws.
+ *
+ * THE SECRET is the auth secret from getIDPClientConfig(), which resolves env-first (BETTER_AUTH_SECRET,
+ * NEXTAUTH_SECRET, then IdP config; PAY-1460). The cookie HMAC key IS the auth secret, so the resolver and the
+ * config loader cannot disagree about which secret signs sessions (BAPert 59034).
+ */
+import { createHmac, timingSafeEqual } from 'crypto';
+import { jwtVerify, type JWTPayload } from 'jose';
+import { getIDPClientConfig } from '../lib/idp-client-config';
+import { extractSessionCookieValue, extractSessionTokenFromCookieValue } from '../lib/session-cookie-shape';
+
+/** Better Auth's signature: base64 of a 32-byte HMAC-SHA256, padded = 44 chars ending in '='. */
+const BA_SIGNATURE_LENGTH = 44;
+
+async function authSecret(): Promise<string | null> {
+  try {
+    const config = await getIDPClientConfig();
+    return config?.authSecret ? String(config.authSecret) : null;
+  } catch {
+    return null;
+  }
+}
+
+function verifyBaHmac(rawValue: string, secret: string): string | null {
+  const dot = rawValue.lastIndexOf('.');
+  if (dot < 1) return null;
+  const token = rawValue.slice(0, dot);
+  let signature = rawValue.slice(dot + 1);
+  if (signature.includes('%')) {
+    try {
+      signature = decodeURIComponent(signature);
+    } catch {
+      return null;
+    }
+  }
+  if (signature.length !== BA_SIGNATURE_LENGTH || !signature.endsWith('=')) return null;
+  const expected = createHmac('sha256', secret).update(token, 'utf8').digest('base64');
+  const a = Buffer.from(signature, 'utf8');
+  const b = Buffer.from(expected, 'utf8');
+  if (a.length !== b.length) return null;
+  return timingSafeEqual(a, b) ? token : null;
+}
+
+export interface VerifiedSessionCookie {
+  token: string;
+  shape: 'ba-hmac' | 'jws';
+  /** The verified JWS payload (jws shape only). */
+  payload?: JWTPayload;
+}
+
+async function verifyJws(rawValue: string, secret: string): Promise<VerifiedSessionCookie | null> {
+  try {
+    const { payload } = await jwtVerify(rawValue, new TextEncoder().encode(secret));
+    const claim = (payload as Record<string, unknown>).sessionToken ?? (payload as Record<string, unknown>).redisSessionId;
+    return typeof claim === 'string' && claim ? { token: claim, shape: 'jws', payload } : null;
+  } catch {
+    return null;
+  }
+}
+
+/** The verified session cookie (token, shape, JWS payload), or null unless its signature verifies. */
+export async function resolveVerifiedSessionCookie(rawValue: string | null | undefined): Promise<VerifiedSessionCookie | null> {
+  if (!rawValue) return null;
+  const shaped = extractSessionTokenFromCookieValue(rawValue);
+  if (!shaped) return null;
+  const secret = await authSecret();
+  if (!secret) return null;
+  if (shaped.shape === 'ba-hmac') {
+    const token = verifyBaHmac(rawValue, secret);
+    return token ? { token, shape: 'ba-hmac' } : null;
+  }
+  return verifyJws(rawValue, secret);
+}
+
+/** The session token carried by a raw session-cookie value, or null unless its signature verifies. */
+export async function resolveVerifiedSessionToken(rawValue: string | null | undefined): Promise<string | null> {
+  const verified = await resolveVerifiedSessionCookie(rawValue);
+  return verified ? verified.token : null;
+}
+
+/** Same, reading the session cookie (every name it is minted under, chunks joined) from a Request. */
+export async function resolveVerifiedSessionTokenFromRequest(request: Request): Promise<string | null> {
+  return resolveVerifiedSessionToken(extractSessionCookieValue(request));
+}

package/src/stores/authStore.ts

@@ -26,6 +26,7 @@ import {
   getCsrfCookieName,
   getSecureCsrfCookieName
 } from '../lib/app-slug';
+import { tokenLogId } from '../lib/token-log-id';
 
 // ===============================
 // INTERFACES & TYPES
@@ -484,19 +485,28 @@ export const useAuthStore = create<AuthStore>()(
 
       forceLogoutAndRedirect: async (reason: string) => {
         const state = get();
-        
+        // Same truncation convention as the server-side session logs (session-store.ts,
+        // refresh.ts): a session token is a bearer credential, and this line goes to the
+        // browser console (and whatever aggregates authLogger client-side) - full value
+        // was leftover debug logging (DotNetPert-Scout, mail 58678).
+        // PAY-1505: the ternary that used to stand here fell back to the RAW token on its false arm.
+        // Safe only by the unenforced property that the arm is reached when the token is falsy -
+        // exactly the shape the source guard exists to refuse. tokenLogId already answers 'none'
+        // for an absent token, so the fallback is not needed.
+        const sessionTokenPrefix = tokenLogId(state.session?.sessionToken);
+
         // AGGRESSIVE LOGGING TO TRACK EXECUTION
         console.error('🚨 FORCE LOGOUT INITIATED 🚨', {
           reason,
           userId: state.user?.id,
-          sessionToken: state.session?.sessionToken,
+          sessionToken: sessionTokenPrefix,
           timestamp: new Date().toISOString()
         });
-        
+
         authLogger.error('[AuthStore] Force logout initiated', {
           reason,
           userId: state.user?.id,
-          sessionToken: state.session?.sessionToken
+          sessionToken: sessionTokenPrefix
         });
         
         try {
@@ -1870,7 +1880,8 @@ export const useAuthStore = create<AuthStore>()(
         
         // If this event is about the current user, update their state
         if (data.userId === state.user?.id && state.session) {
-          authLogger.info('[AuthStore] Updating current user state from SignalR:', data);
+          // PAY-1427: the event is user state; log its shape, not its contents.
+          authLogger.info('[AuthStore] Updating current user state from SignalR:', { keys: Object.keys(data || {}) });
           // ... user state update logic would go here
         }
       },

package/src/types/recovery.ts

@@ -1,4 +1,4 @@
-export type RecoveryStep = 'initiate' | 'select-method' | 'verify-code' | 'set-password' | 'complete';
+export type RecoveryStep = 'initiate' | 'select-method' | 'verify-code' | 'set-password' | 'requested' | 'complete';
 
 export interface RecoverySession {
   recoveryToken: string;

package/src/utils/api.ts

@@ -1,6 +1,7 @@
 import { ENV_CONFIG, API_ENDPOINTS } from '../config/env';
 import { TwoFactorMethod } from '../types/security';
 import { standardizedApi, isApiSuccess, isApiError, extractApiData } from '../lib/standardized-client-api';
+import { knownPasswordRules, passwordRuleSentences } from '../lib/password-rules';
 
 export class ApiError extends Error {
     type: string;
@@ -96,6 +97,35 @@ export async function apiFetch<T>(url: string, options: ApiOptions = {}): Promis
 // DELETED: apiFetchAuth - Use clientApi from @/lib/client-api instead for proper token refresh handling
 
 // Account API for masked info and 2FA
+/**
+ * PAY-1591: what the user reads when the LAST recovery step fails. Four outcomes, told apart only by codes the IdP really sends
+ * (see resetFailureText): a password-policy refusal names the failed rules; an explicit expired/used token says so and links back
+ * to recovery; any other 400/422 gets a neutral 'check the requirements and try again' (the user's recovery session is kept); and
+ * a server or transport failure gets a retry sentence. None of them is the old fixed "Failed to reset password".
+ */
+export const RECOVERY_EXPIRED_TEXT = 'This reset link has expired or was already used. Start password recovery again.';
+
+export const RESET_NEUTRAL_TEXT = "We couldn't set that password. Check it meets the requirements shown and try again.";
+
+/**
+ * Three tiers for a 400/422 from reset (rigpert 60822, QAPert 60820), decided ONLY on codes the IdP actually sends:
+ *   policy        details.code password_policy (projected by the handler as password_policy) -> the rule sentences
+ *   tokenInvalid  an EXPLICIT expired/used signal (token_expired / token_used / Identity InvalidToken, projected as
+ *                 reset_token_invalid) -> 'link expired, start again'
+ *   anything else -> NEUTRAL, which must NOT tell the user their link is dead: the served IdP sends a weak-password refusal with
+ *                 no code, and 'expired' there loops them after they spent their emailed code. The recovery session is kept, so
+ *                 they can retry.
+ */
+export function resetFailureText(status: number, rules: string[] = [], policy = false, tokenInvalid = false): string {
+    if (status === 400 || status === 422) {
+        if (tokenInvalid && !policy) return RECOVERY_EXPIRED_TEXT;
+        if (!policy) return RESET_NEUTRAL_TEXT;
+        const base = "That password wasn't accepted.";
+        return rules.length ? `${base} ${passwordRuleSentences(rules)}` : `${base} Try a different one; the rules are shown above.`;
+    }
+    return "We couldn't reset your password just now. Please try again.";
+}
+
 export class AccountApi {
     /**
      * Get masked user info (email, phone, authenticator status)
@@ -116,18 +146,16 @@ export class AccountApi {
         // Empty body: user info comes from JWT token
         const result = await standardizedApi.post<any>('/api/account/masked-info', {}, accessToken);
 
+        // PAY-1427: masked email/phone are still user data - log the response shape, never its values.
         console.log('[DEBUG] getMaskedInfo result:', {
             success: isApiSuccess(result),
             hasData: isApiSuccess(result) && !!result.data,
-            rawData: isApiSuccess(result) ? result.data : null,
             dataFields: isApiSuccess(result) && result.data ? Object.keys(result.data) : []
         });
 
-        console.log('[DEBUG] getMaskedInfo raw data structure:', JSON.stringify(isApiSuccess(result) ? result.data : result, null, 2));
-
         if (!isApiSuccess(result)) {
             const errorMessage = isApiError(result) ? result.message : 'Failed to get masked info';
-            console.error('[DEBUG] getMaskedInfo failed:', result);
+            console.error('[DEBUG] getMaskedInfo failed:', { keys: result && typeof result === 'object' ? Object.keys(result) : typeof result });
             throw new ApiError(errorMessage, result);
         }
         // Use only snake_case fields from backend response
@@ -149,6 +177,8 @@ export class AccountApi {
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ email }),
         });
+        // PAY-1588: a throttled caller (429) must look exactly like an unknown one - no session, no distinguishing error.
+        if (res.status === 429) return { success: false, data: {} } as any;
         if (!res.ok) throw new Error('Failed to initiate recovery');
         return res.json();
     }
@@ -193,12 +223,21 @@ export class AccountApi {
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({
                 email,
-                password_reset_token: resetToken,
+                token: resetToken,
                 new_password: newPassword,
                 confirm_password: confirmPassword,
             }),
         });
-        if (!res.ok) throw new Error('Failed to reset password');
+        if (!res.ok) {
+            const body = await res.json().catch(() => null);
+            const policy = !!body?.password_policy;
+            const rules = knownPasswordRules(body?.password_policy?.rules);
+            const tokenInvalid = body?.reset_token_invalid === true;
+            const err = new Error(resetFailureText(res.status, rules, policy, tokenInvalid)) as Error & { rules?: string[]; code?: string };
+            if (rules.length) err.rules = rules;
+            if ((res.status === 400 || res.status === 422) && tokenInvalid && !policy) err.code = 'RECOVERY_EXPIRED';
+            throw err;
+        }
         return res.json();
     }
 
@@ -210,8 +249,8 @@ export class AccountApi {
             body: JSON.stringify({
                 email: data.email,
                 token: data.token,
-                password: data.password,
-                password_confirmation: data.password_confirmation
+                new_password: data.password,
+                confirm_password: data.password_confirmation
             })
         })
         const result = await res.json().catch(() => ({}))