@payez/next-mvp 4.4.5 → 4.4.7

package/dist/auth/better-auth.js

@@ -43,6 +43,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAUTH_SIGN_IN_FAILED_ERROR = void 0;
 exports.secretFingerprint = secretFingerprint;
 exports.buildIdpOAuthProviderConfig = buildIdpOAuthProviderConfig;
 exports.buildBetterAuthProviders = buildBetterAuthProviders;
@@ -54,6 +55,7 @@ exports.getBetterAuthInstance = getBetterAuthInstance;
 exports.getBetterAuthHandler = getBetterAuthHandler;
 exports.exchangeOAuthForIdpTokens = exchangeOAuthForIdpTokens;
 exports.storeIdpTokensInSession = storeIdpTokensInSession;
+exports.expireSetCookies = expireSetCookies;
 exports.createAuthGetHandler = createAuthGetHandler;
 require("server-only");
 const node_async_hooks_1 = require("node:async_hooks");
@@ -68,7 +70,9 @@ const generic_oauth_1 = require("better-auth/plugins/generic-oauth");
 const idp_client_config_1 = require("../lib/idp-client-config");
 const app_slug_1 = require("../lib/app-slug");
 const redis_1 = require("../lib/redis");
+const single_flight_1 = require("../lib/single-flight");
 const session_store_1 = require("../lib/session-store");
+const token_log_id_1 = require("../lib/token-log-id");
 /**
  * 185121: short sha256 fingerprint for secrets/tokens in log lines — enough
  * to tell "same" from "divergent", never enough to reconstruct. 12 hex chars
@@ -463,6 +467,7 @@ function buildBetterAuthProviders(config) {
  * Call after getIDPClientConfig() resolves.
  */
 function createBetterAuthInstance(idpConfig, opts = {}) {
+    (0, app_slug_1.assertAppSlugMatchesIdp)(idpConfig.clientSlug);
     const appSlug = idpConfig.clientSlug || (0, app_slug_1.getAppSlug)();
     // 185121 line 1: name the secret this instance PINNED, as a hash, never the
     // secret. 183047's surviving fork is HMAC-fail vs record-miss; an HMAC-fail
@@ -745,6 +750,18 @@ function createBetterAuthInstance(idpConfig, opts = {}) {
                 refreshCache: false,
             },
         },
+        // PAY-1781 B: KEEP OAUTH STATE IN THE ENCRYPTED COOKIE, as it was on better-auth 1.5.6.
+        // 1.5.6 resolved the default as `options.database ? 'database' : 'cookie'` - we have no
+        // database, so: cookie. 1.6.13+ resolves it as `(database || secondaryStorage) ? 'database'
+        // : 'cookie'`, and we DO have secondaryStorage, so the upgrade alone would silently move every
+        // OAuth state record into Redis through the adapter above (its enrichment read-modify-write
+        // and key handling were built for session records, not state). Pinned so the upgrade changes
+        // the version, not the design. The cookie branch is where GHSA-wxw3-q3m9-c3jr lived; 1.6.2+
+        // compares the returned `state` with the nonce sealed in the cookie, and our provider is also
+        // pkce:true, which the advisory required to be false. Test: oauth-state-strategy-cookie.
+        account: {
+            storeStateStrategy: 'cookie',
+        },
         // Cookie prefix must match slim-middleware expectations ({slug}.session-token)
         advanced: {
             cookiePrefix: appSlug,
@@ -799,18 +816,33 @@ function configureBetterAuth(opts) {
     }
     state.configuredOpts = opts;
 }
+/**
+ * PAY-642 (card 338215): the init attempt no longer LATCHES A FAILURE.
+ *
+ * This used to be `state.initPromise ??= getIDPClientConfig(true).then(...)` with no .catch and no reset. One
+ * auth request against a cold process while the IdP was unreachable stored a rejected promise, and every later
+ * caller replayed it until the process restarted, even after the IdP recovered. This funnel backs every
+ * /api/auth/* route, the login GET handler and withAuth. server/auth.ts getAuthInstance() already used
+ * createSingleFlight for this exact bug; this sibling funnel was missed.
+ *
+ * Now the attempt runs through the same helper: concurrent callers share one attempt, a failure still rejects
+ * for every caller of THAT attempt (loud), the next call starts a fresh attempt, and a success is cached in
+ * state.cachedInstance as before. The flight lives on the globalThis state for the same reason the instance
+ * does (duplicated route chunks must share one init).
+ */
 async function getBetterAuthInstance() {
     if (state.cachedInstance)
         return state.cachedInstance;
-    if (!state.initPromise) {
-        state.initPromise = (0, idp_client_config_1.getIDPClientConfig)(true).then(config => {
-            const instance = createBetterAuthInstance(config, state.configuredOpts);
-            state.cachedInstance = instance;
-            console.log('[BETTER_AUTH] Instance created for', config.clientSlug || config.clientId);
-            return instance;
-        });
-    }
-    return state.initPromise;
+    state.initFlight ??= (0, single_flight_1.createSingleFlight)(() => (0, idp_client_config_1.getIDPClientConfig)(true).then(config => {
+        const instance = createBetterAuthInstance(config, state.configuredOpts);
+        state.cachedInstance = instance;
+        console.log('[BETTER_AUTH] Instance created for', config.clientSlug || config.clientId);
+        return instance;
+    }));
+    const attempt = state.initFlight.get();
+    // Kept for callers that inspect it; it always points at the CURRENT attempt, never a settled failure.
+    state.initPromise = attempt;
+    return attempt;
 }
 /**
  * Get flag-gated auth handler for Next.js route.
@@ -851,7 +883,7 @@ async function exchangeOAuthForIdpTokens(sessionToken, provider = 'google') {
         // Read the BA session from Redis
         const baRaw = await (0, redis_1.getRedis)().get(baKey).catch(() => null);
         if (!baRaw) {
-            console.warn('[BETTER_AUTH] exchangeOAuthForIdpTokens: session not found in Redis for token', sessionToken.substring(0, 10));
+            console.warn('[BETTER_AUTH] exchangeOAuthForIdpTokens: session not found in Redis for token', (0, token_log_id_1.tokenLogId)(sessionToken));
             return false;
         }
         const baData = JSON.parse(baRaw);
@@ -922,7 +954,9 @@ async function exchangeOAuthForIdpTokens(sessionToken, provider = 'google') {
             }),
         });
         const oauthResText = await oauthRes.text();
-        console.log('[BETTER_AUTH] IDP oauth-callback response:', oauthRes.status, oauthResText.substring(0, 500));
+        // PAY-1427 (QAPert, PR 154 thread 326): this printed the first 500 chars of the oauth-callback TOKEN
+        // envelope on EVERY successful OAuth login (it runs before the !ok check). Status + length only.
+        console.log('[BETTER_AUTH] IDP oauth-callback response:', { status: oauthRes.status, bodyLength: oauthResText.length });
         if (!oauthRes.ok) {
             console.error('[BETTER_AUTH] IDP oauth-callback failed:', oauthRes.status);
             /**
@@ -1154,7 +1188,7 @@ async function storeIdpTokensInSession(sessionToken, idpTokenData, authProvider)
             // conjured here would carry no Better Auth cookie, so it would be
             // unreachable by the browser and invisible to every other consumer —
             // failing as "silently signed out" rather than as an error.
-            console.warn('[BETTER_AUTH] storeIdpTokensInSession: no BA session for token', sessionToken.substring(0, 10));
+            console.warn('[BETTER_AUTH] storeIdpTokensInSession: no BA session for token', (0, token_log_id_1.tokenLogId)(sessionToken));
             return false;
         }
         const baData = JSON.parse(baRaw);
@@ -1182,12 +1216,76 @@ async function storeIdpTokensInSession(sessionToken, idpTokenData, authProvider)
         return false;
     }
 }
+/**
+ * The `?error=` code the login page receives when an OAuth sign-in is ABORTED because the IdP exchange did not
+ * store tokens (PAY-1733). Hosts map it to ONE neutral line; the card's words are "That sign-in didn't work.
+ * Try again or use another method." The cause stays in the server log, never on the page.
+ */
+exports.OAUTH_SIGN_IN_FAILED_ERROR = 'OAUTH_SIGN_IN_FAILED';
+/**
+ * Re-emit each cookie the callback response SET as an immediate expiry, keeping the attributes that decide
+ * WHICH cookie the browser overwrites (Path, Domain, Secure, SameSite, HttpOnly - a `__Secure-` name is only
+ * accepted with Secure) and dropping Expires/Max-Age in favour of Max-Age=0.
+ */
+function expireSetCookies(setCookies) {
+    const out = [];
+    for (const sc of setCookies) {
+        const [pair, ...attrs] = sc.split(';').map((s) => s.trim());
+        const eq = pair.indexOf('=');
+        const name = eq > 0 ? pair.slice(0, eq) : '';
+        if (!name)
+            continue;
+        const kept = attrs.filter((a) => /^(path|domain|secure|samesite|httponly)\b/i.test(a));
+        out.push([`${name}=`, ...kept, 'Max-Age=0'].join('; '));
+    }
+    return out;
+}
+/**
+ * PAY-1733 (Jon, live on :4797): ABORT an OAuth sign-in whose IdP exchange did not store tokens.
+ *
+ * Before this, a failed exchange was a console.error and the user kept the Better Auth session the callback had
+ * just created: signed in, holding NO IdP tokens. The host then routed that session to 2FA, which painted the
+ * user's email and failed every call - a red "sign in again" screen about an account the app could no longer
+ * authenticate. The IdP's 401 was CORRECT (it fail-closes unverified assertions); keeping the session was the bug.
+ *
+ * So: no session without IdP tokens. The Better Auth session is destroyed (its own signOut, best effort, then the
+ * `ba:<slug>:<token>` record directly - that record is what makes it resolvable), every cookie the callback set is
+ * expired, and the user goes to the login page with OAUTH_SIGN_IN_FAILED. Relative Location, as for the state-error
+ * branch above (328439: an absolute URL built from request.url is a dead tab in a container).
+ */
+async function abortOAuthSignIn(callbackResponse, sessionToken, cookieHeader, loginPath) {
+    const headers = new Headers();
+    if (sessionToken) {
+        try {
+            const auth = await getBetterAuthInstance();
+            const out = await auth?.api?.signOut?.({ headers: new Headers({ cookie: cookieHeader }), asResponse: true });
+            for (const sc of out?.headers?.getSetCookie?.() ?? [])
+                headers.append('set-cookie', sc);
+        }
+        catch (err) {
+            console.warn('[BETTER_AUTH] abort: Better Auth signOut failed, deleting the record directly:', err instanceof Error ? err.message : String(err));
+        }
+        try {
+            const config = await (0, idp_client_config_1.getIDPClientConfig)();
+            await (0, redis_1.getRedis)().del(`ba:${config.clientSlug || (0, app_slug_1.getAppSlug)()}:${sessionToken}`);
+        }
+        catch (err) {
+            console.error('[BETTER_AUTH] abort: could not delete the Better Auth session record', (0, token_log_id_1.tokenLogId)(sessionToken), err instanceof Error ? err.message : String(err));
+        }
+    }
+    for (const sc of expireSetCookies(callbackResponse.headers.getSetCookie?.() ?? []))
+        headers.append('set-cookie', sc);
+    headers.set('location', `${loginPath}${loginPath.includes('?') ? '&' : '?'}error=${exports.OAUTH_SIGN_IN_FAILED_ERROR}`);
+    console.warn('[BETTER_AUTH] OAuth sign-in ABORTED: the IdP exchange stored no tokens, so no session is kept (PAY-1733)', sessionToken ? (0, token_log_id_1.tokenLogId)(sessionToken) : '(no session)');
+    return new Response(null, { status: 302, headers });
+}
 /**
  * Create a production-ready GET handler for the auth catch-all route.
  *
  * Wraps better-auth's GET handler with:
  * - OAuth state error recovery (redirects to login instead of error page)
- * - IDP token exchange after successful OAuth callback
+ * - IDP token exchange after successful OAuth callback - and, when it stores no tokens, the sign-in is ABORTED
+ *   (session destroyed, cookies expired, login page with OAUTH_SIGN_IN_FAILED; PAY-1733)
  *
  * Usage in host app:
  * ```ts
@@ -1256,56 +1354,27 @@ function createAuthGetHandler(loginPath = '/account-auth/login') {
                     return new Response(null, { status: 302, headers: { location: loginPath } });
                 }
             }
-            // After successful OAuth callback: exchange the PROVIDER identity for IDP tokens.
-            //
-            // ⚠ WAS "exchange Google identity" — and it meant it literally. This call
-            // site passed no provider, so it took exchangeOAuthForIdpTokens's
-            // `provider: string = 'google'` default and asserted "google" to
-            // /api/ExternalAuth/oauth-callback for EVERY provider. That was harmless
-            // while Google was the only one wired, and became wrong the moment a second
-            // provider shipped: a GitHub sign-in forwarded a GitHub access_token
-            // labelled `provider: 'google'`, so the IDP tried to verify it as a Google
-            // identity and fail-closed with 401 UNVERIFIED_ASSERTION in
-            // `response_time_ms: 0` — it never had to call anyone to know it was wrong.
-            //
-            // The diagnostics made this maximally confusing: `access_token_forwarded:
-            // true` is correct and the token really did arrive. The FIELD was fine; the
-            // LABEL on it was a lie. Nothing on the client half is broken.
-            //
-            // The provider was never unavailable — it is the path segment this very
-            // `if` matches on (/api/auth/callback/github). Derive it instead of
-            // defaulting, because a default here cannot be right for more than one
-            // provider at a time.
+            // After the OAuth callback: exchange the provider identity for IDP tokens. If that does NOT store tokens - the
+            // IdP refused (401), no session was found, or anything threw - the sign-in is ABORTED (PAY-1733). A session is
+            // kept only when it holds IdP tokens.
             const url = new URL(request.url);
             if (url.pathname.includes('/callback/') && response.status === 302) {
+                const setCookies = response.headers.getSetCookie?.() || [];
+                const cookieHeader = setCookies
+                    .map((c) => c.split(';')[0])
+                    .join('; ');
+                let sessionToken = null;
+                let exchanged = false;
                 try {
                     const auth = await getBetterAuthInstance();
                     if (auth?.api?.getSession) {
-                        const setCookies = response.headers.getSetCookie?.() || [];
-                        const cookieHeader = setCookies
-                            .map((c) => c.split(';')[0])
-                            .join('; ');
                         const headers = new Headers();
                         headers.set('cookie', cookieHeader);
                         const session = await auth.api.getSession({ headers });
                         if (session?.session?.token) {
-                            // /api/auth/callback/<provider>[?query] -> "<provider>"
-                            const callbackProvider = url.pathname
-                                .split('/callback/')[1]
-                                ?.split('/')[0]
-                                ?.split('?')[0]
-                                ?.trim()
-                                .toLowerCase() || '';
-                            if (!callbackProvider) {
-                                // Do NOT quietly fall back to 'google'. That silent default is the
-                                // exact defect this block fixes, and re-introducing it here would
-                                // reproduce it for whatever unparseable shape got us here.
-                                console.error('[BETTER_AUTH] OAuth callback matched /callback/ but no provider could be derived from', url.pathname, '— refusing to assert a guessed provider to the IDP. No exchange performed.');
-                            }
-                            else {
-                                console.log('[BETTER_AUTH] Got session token from callback:', session.session.token.substring(0, 10), '| provider:', callbackProvider, '| email:', session.user?.email);
-                                await exchangeOAuthForIdpTokens(session.session.token, callbackProvider);
-                            }
+                            sessionToken = session.session.token;
+                            console.log('[BETTER_AUTH] Got session token from callback:', (0, token_log_id_1.tokenLogId)(session.session.token), '| email:', session.user?.email);
+                            exchanged = await exchangeOAuthForIdpTokens(session.session.token);
                         }
                         else {
                             console.warn('[BETTER_AUTH] Could not get session after OAuth callback');
@@ -1315,6 +1384,8 @@ function createAuthGetHandler(loginPath = '/account-auth/login') {
                 catch (err) {
                     console.error('[BETTER_AUTH] IDP token exchange failed:', err.message);
                 }
+                if (!exchanged)
+                    return abortOAuthSignIn(response, sessionToken, cookieHeader, loginPath);
             }
             return response;
         });

package/dist/auth/utils/idp-client.js

@@ -183,7 +183,8 @@ async function idpRefreshToken(refreshToken, mfaContext) {
         });
         if (!response.ok) {
             const errorText = await response.text().catch(() => 'Unknown error');
-            console.error('[IDP_CLIENT] Token refresh failed:', response.status, errorText);
+            // PAY-1427: never the raw upstream body (the refresh.ts:528 twin PR 139 fixed). Status + length only.
+            console.error('[IDP_CLIENT] Token refresh failed:', { status: response.status, bodyLength: errorText.length });
             return {
                 success: false,
                 error: {