@payez/next-mvp 4.4.5 → 4.4.7

package/dist/lib/session-cookie-shape.d.ts

@@ -33,11 +33,16 @@
  * instead of degrading to one clean Redis-canonical lookup (or a genuine
  * 401 if the record really is gone).
  *
- * No signature is verified for the BA-hmac shape here — same posture the
- * pre-existing JWS fallback already took (see auth.ts's `getSession` Path B
- * comment): Redis is the liveness authority downstream, so a forged token
- * still has to land on a live session record to do anything. This function
- * only recovers the CANDIDATE token; callers must still look it up.
+ * No signature is verified here, and none CAN be: this module is secret-free
+ * and synchronous. It only CLASSIFIES and recovers the candidate token.
+ *
+ * PAY-1476: the earlier claim that "Redis is the liveness authority, so a
+ * forged token still has to land on a live session record" was the defect.
+ * A LEAKED token lands on a live record by definition, so without a signature
+ * check the token string alone was a bearer credential. The candidate token
+ * returned here must NEVER be handed to the session store directly: go through
+ * server/verified-session-token.ts resolveVerifiedSessionToken, which verifies
+ * the HMAC (ba-hmac) or the JWS signature first.
  */
 export type SessionCookieShape = 'jws' | 'ba-hmac';
 export interface ExtractedSessionToken {
@@ -53,17 +58,15 @@ export interface ExtractedSessionToken {
  * claim.
  */
 export declare function extractSessionTokenFromCookieValue(rawValue: string | null | undefined): ExtractedSessionToken | null;
-/** Extract the session token from the Better Auth session cookie WITHOUT
- *  going through Better Auth's `auth.api.getSession()`. Handles both
- *  single-cookie and chunked-cookie cases (Better Auth chunks long values
- *  across `{name}.0`, `{name}.1`, …), and BOTH cookie shapes the codebase
- *  has minted — JWS (legacy NextAuth) and BA-hmac (current Better Auth,
- *  `{token}.{hmac}`) — via `extractSessionTokenFromCookieValue` (183047:
- *  the shape-blind version of this function is what turned a single
- *  BA-primary miss into total, secret-independent fallback failure for
- *  every current cookie, since Better Auth never mints the JWS shape this
- *  used to require). No signature check — Redis is the liveness gate, so
- *  an attacker forging a token still has to land on a real Redis session
- *  (infeasible against high-entropy UUIDs). Returns null if no cookie is
- *  present or neither known shape matches. */
-export declare function extractSessionTokenFromCookie(request: Request): string | null;
+/** The RAW session-cookie value from a Request, WITHOUT going through Better
+ *  Auth's `auth.api.getSession()`. Handles single and chunked cookies (Better
+ *  Auth chunks long values across `{name}.0`, `{name}.1`, …) and every name the
+ *  cookie is minted under (240654).
+ *
+ *  PAY-1476: this used to be `extractSessionTokenFromCookie`, which returned the
+ *  TOKEN with "No signature check — Redis is the liveness gate". That turned any
+ *  leaked token into a bearer credential. It now returns the raw value only, so
+ *  the one way to get a token out of a request cookie is
+ *  server/verified-session-token.ts resolveVerifiedSessionTokenFromRequest.
+ *  Returns null if no session cookie is present. */
+export declare function extractSessionCookieValue(request: Request): string | null;

package/dist/lib/session-cookie-shape.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.extractSessionTokenFromCookieValue = extractSessionTokenFromCookieValue;
-exports.extractSessionTokenFromCookie = extractSessionTokenFromCookie;
+exports.extractSessionCookieValue = extractSessionCookieValue;
 const app_slug_1 = require("./app-slug");
 /**
  * Extract a candidate session token from a raw session-cookie value,
@@ -37,20 +37,18 @@ function extractSessionTokenFromCookieValue(rawValue) {
     }
     return null;
 }
-/** Extract the session token from the Better Auth session cookie WITHOUT
- *  going through Better Auth's `auth.api.getSession()`. Handles both
- *  single-cookie and chunked-cookie cases (Better Auth chunks long values
- *  across `{name}.0`, `{name}.1`, …), and BOTH cookie shapes the codebase
- *  has minted — JWS (legacy NextAuth) and BA-hmac (current Better Auth,
- *  `{token}.{hmac}`) — via `extractSessionTokenFromCookieValue` (183047:
- *  the shape-blind version of this function is what turned a single
- *  BA-primary miss into total, secret-independent fallback failure for
- *  every current cookie, since Better Auth never mints the JWS shape this
- *  used to require). No signature check — Redis is the liveness gate, so
- *  an attacker forging a token still has to land on a real Redis session
- *  (infeasible against high-entropy UUIDs). Returns null if no cookie is
- *  present or neither known shape matches. */
-function extractSessionTokenFromCookie(request) {
+/** The RAW session-cookie value from a Request, WITHOUT going through Better
+ *  Auth's `auth.api.getSession()`. Handles single and chunked cookies (Better
+ *  Auth chunks long values across `{name}.0`, `{name}.1`, …) and every name the
+ *  cookie is minted under (240654).
+ *
+ *  PAY-1476: this used to be `extractSessionTokenFromCookie`, which returned the
+ *  TOKEN with "No signature check — Redis is the liveness gate". That turned any
+ *  leaked token into a bearer credential. It now returns the raw value only, so
+ *  the one way to get a token out of a request cookie is
+ *  server/verified-session-token.ts resolveVerifiedSessionTokenFromRequest.
+ *  Returns null if no session cookie is present. */
+function extractSessionCookieValue(request) {
     const cookieHeader = request.headers.get('cookie');
     if (!cookieHeader)
         return null;
@@ -120,7 +118,5 @@ function extractSessionTokenFromCookie(request) {
             break;
         }
     }
-    if (!rawJwt)
-        return null;
-    return extractSessionTokenFromCookieValue(rawJwt)?.token ?? null;
+    return rawJwt || null;
 }

package/dist/lib/session-store.d.ts

@@ -101,9 +101,16 @@ export declare function deleteSessionEverywhere(sessionToken: string, appSlug?:
 export declare function setSession(sessionToken: string, data: SessionData): Promise<void>;
 /**
  * Updates tokens within an existing session.
+ *
+ * CALLERS MUST CHECK THE RETURN VALUE (320072). A null return means the session
+ * row was absent and EVERY field in `updates` was discarded — it is a dropped
+ * write, not a no-op on unchanged data. Ignoring it is how a token refresh came
+ * to report success while persisting nothing.
+ *
  * @param sessionToken The session token to update.
  * @param updates Partial session data to update.
- * @returns The updated session data, or null if the session was not found.
+ * @returns The updated session data, or null if the session was not found — in
+ *          which case NOTHING WAS WRITTEN.
  */
 export declare function updateSession(sessionToken: string, updates: Partial<SessionData>): Promise<SessionData | null>;
 /**

package/dist/lib/session-store.js

@@ -41,6 +41,7 @@ const redis_1 = __importDefault(require("./redis"));
 const crypto_1 = require("crypto");
 const app_slug_1 = require("./app-slug");
 const token_utils_1 = require("../auth/utils/token-utils");
+const token_log_id_1 = require("./token-log-id");
 // Use app-slug prefixes for multi-app isolation
 const getSessionKey = (token) => `${(0, app_slug_1.getSessionPrefix)()}${token}`;
 const getRefreshLockKey = (token) => `${(0, app_slug_1.getRefreshLockPrefix)()}${token}`;
@@ -278,11 +279,31 @@ async function setSession(sessionToken, data) {
         .expire(versionKey, exports.SESSION_TTL)
         .exec();
 }
+/**
+ * Describe a credential-bearing value for a log line WITHOUT the value: its kind only.
+ * Deliberately no length or fingerprint either - both narrow the value down.
+ */
+function describeTokenValueForLog(v) {
+    if (v === undefined)
+        return 'undefined';
+    if (v === null)
+        return 'null';
+    if (typeof v === 'string')
+        return v.length === 0 ? 'empty string' : 'non-empty string (value withheld)';
+    return `${typeof v} (value withheld)`;
+}
 /**
  * Updates tokens within an existing session.
+ *
+ * CALLERS MUST CHECK THE RETURN VALUE (320072). A null return means the session
+ * row was absent and EVERY field in `updates` was discarded — it is a dropped
+ * write, not a no-op on unchanged data. Ignoring it is how a token refresh came
+ * to report success while persisting nothing.
+ *
  * @param sessionToken The session token to update.
  * @param updates Partial session data to update.
- * @returns The updated session data, or null if the session was not found.
+ * @returns The updated session data, or null if the session was not found — in
+ *          which case NOTHING WAS WRITTEN.
  */
 async function updateSession(sessionToken, updates) {
     const key = getSessionKey(sessionToken);
@@ -290,6 +311,74 @@ async function updateSession(sessionToken, updates) {
     // Get current session to merge with updates
     const currentSession = await getSession(sessionToken);
     if (!currentSession) {
+        /**
+         * 320072: THIS IS A DROPPED WRITE, AND IT USED TO LEAVE NO TRACE.
+         *
+         * Returning null here is correct — there is no row to merge into — but it
+         * was previously done in total silence: no throw, no log. Every caller that
+         * ignores the return value therefore believed it had persisted, and the
+         * most damaging caller did exactly that (ensure-fresh-access-token).
+         *
+         * The canonical row can legitimately be absent: better-auth.ts writes the
+         * `ba:` record and the canonical row in two steps, and the second is
+         * wrapped in a try/catch that only console.warn()s — a deliberate,
+         * documented degradation that leaves the BA session correct and this row
+         * missing. That decision is fine. What was NOT fine is that the READ side
+         * reported success anyway, so nothing ever surfaced it.
+         *
+         * Logged at error, not warn: the caller's data is gone. Callers that can
+         * tolerate a missing row should check the null return — which is now the
+         * documented contract — rather than rely on this being quiet.
+         */
+        /**
+         * DO NOT LOG `key` HERE. `getSessionKey()` (line 21) is
+         * `${getSessionPrefix()}${token}` — the prefix plus the WHOLE session
+         * token — so logging it writes a live, replayable credential into
+         * console.error, and logs travel further than the process that wrote them.
+         * The redacting idiom in this file is `substring(0, 8) + '...'`.
+         *
+         * NOTE ON WHAT THIS COMMENT NO LONGER CLAIMS. It used to say this was the
+         * single unredacted departure in the file, and gave a site count. Both were
+         * wrong: a RAW refresh token was being emitted at the
+         * REFRESH_TOKEN_BEING_CLEARED site below, and the count was stale. QAPert found that
+         * leak while reviewing PR 96 — he looked *because* this comment asserted
+         * there was nothing to find, which is the worst thing a comment can do.
+         * It is fixed in the same commit as this rewrite.
+         *
+         * So the counts are gone deliberately. A tally in prose decays silently on
+         * the next edit and then actively misleads; that decay is the defect being
+         * repaired here, and reproducing it in the fix would be absurd. If you need
+         * a number, measure it — do not trust this paragraph for one.
+         *
+         * What replaces the prose is enforcement. The invariant is
+         * NO RAW CREDENTIAL IS EVER EMITTED FROM THIS FUNCTION, and it is pinned by
+         * executable assertions, not by this text:
+         *   - Case 4 (session token, this log)
+         *   - Case 5 (refresh token, the REFRESH_TOKEN_BEING_CLEARED log below)
+         * in test/ensure-fresh-persist-failure.test.cjs. Both were proven to fail
+         * when their fix is mutated out. Delete a redaction and a test goes red;
+         * delete this comment and nothing does. Trust the tests.
+         *
+         * Caught by QAPert on 320072 and made binding by BAPert (R1043 s1).
+         *
+         * The prefix is logged SEPARATELY and deliberately, because it is the field
+         * that makes this line diagnostic rather than decorative: a "no canonical
+         * row" miss has two very different causes, and only the prefix tells them
+         * apart —
+         *   wrong keyspace  (slug/prefix disagreement — the 241875 / 213416 defect
+         *                    documented at line 111, where a writer and a reader
+         *                    resolved different slugs and every lookup silently
+         *                    missed), versus
+         *   absent row      (the documented better-auth.ts two-step degradation).
+         * The prefix is an app slug, not a secret. Redacting it too would leave a
+         * log that says only "something was missing".
+         */
+        console.error('[SESSION-STORE] UPDATE_DROPPED_NO_CANONICAL_ROW', {
+            keyPrefix: (0, app_slug_1.getSessionPrefix)(),
+            sessionToken: (0, token_log_id_1.tokenLogId)(sessionToken),
+            updatedFields: Object.keys(updates),
+            note: 'updateSession found no session row; ALL updates were discarded and null was returned',
+        });
         return null;
     }
     // CRITICAL: Track any refresh token changes (check both old and new field names)
@@ -301,10 +390,15 @@ async function updateSession(sessionToken, updates) {
             : hadRefreshToken;
     if (hadRefreshToken && !willHaveRefreshToken) {
         console.error('[SESSION-STORE] ⚠️ REFRESH_TOKEN_BEING_CLEARED', {
-            sessionToken: sessionToken.substring(0, 8) + '...',
+            sessionToken: (0, token_log_id_1.tokenLogId)(sessionToken),
             userId: currentSession.userId,
             updateKeys: Object.keys(updates),
-            refreshTokenInUpdate: updates.idpRefreshToken || updates.refreshToken,
+            // NEVER the value: a refresh token is a long-lived credential and this line ships to the
+            // log sink. The old `idpRefreshToken || refreshToken` printed a live legacy token raw when
+            // idpRefreshToken was null/"" (which clears) and refreshToken still held one.
+            // Test: test/session-store-refresh-token-not-logged.test.cjs
+            idpRefreshTokenInUpdate: describeTokenValueForLog(updates.idpRefreshToken),
+            legacyRefreshTokenInUpdate: describeTokenValueForLog(updates.refreshToken),
             refreshTokenClearedReason: updates.refreshTokenClearedReason || 'UNKNOWN',
             stack: new Error().stack
         });
@@ -354,15 +448,67 @@ function mfaLifetimeFromAccessToken(accessToken) {
     if (!decoded)
         return {};
     const fields = {};
+    /**
+     * *** TEST THE CONVERTED VALUE, NOT THE CLAIM'S PRESENCE. ***
+     *
+     * This guard previously branched on `claim !== undefined && claim !== null`
+     * and then wrote `Number(claim) * 1000`. Those are two different questions,
+     * and for a non-numeric claim they disagree: the claim IS present, so the
+     * branch is taken, and the value written is NaN. That single NaN defeats both
+     * guards in this system at once, in opposite directions:
+     *
+     *   - `mfaEvidencePresent = mfaLifetime.mfaExpiresAt !== undefined` is TRUE
+     *     for NaN, so R908(e) certifies a ceremony it never observed and GRANTS
+     *     mfaVerified.
+     *   - consumers read `mfaExpiresAt || 0`, and NaN is FALSY, so that collapses
+     *     to 0, `0 > 0` is false, and the session NEVER expires.
+     *
+     * Net: `mfaVerified: true` that nothing can ever expire — the exact
+     * pre-339563 fail-open described at the top of this function, restored
+     * through a malformed claim, and silent (neither warning below fires on NaN).
+     *
+     * So a claim that will not convert is treated as NO CLAIM: the key is OMITTED
+     * and R908(e) withholds the grant, identical to the absent-claim lane. Absent
+     * and unreadable are the same epistemic state — we do not know the expiry —
+     * and they must not produce opposite security outcomes.
+     *
+     * Omitted, never set-to-undefined: updateSession() merges with
+     * `{ ...current, ...updates }`, so a present-but-undefined key would CLOBBER
+     * a good stored value. Pinned by test/mfa-expiry-malformed-claim.test.cjs.
+     *
+     * *** `Number.isFinite` ALONE IS NOT ENOUGH — IT MUST ALSO BE POSITIVE. ***
+     * `Number([])` is 0, and 0 is perfectly finite. But the consumer guard reads
+     * `mfaExpiresAt || 0`, and 0 is FALSY, so a stored zero is indistinguishable
+     * from a missing value and fails open in precisely the same way NaN does —
+     * while still passing `!== undefined` and so still earning the R908(e) grant.
+     * The honest invariant is not "is it a number" but "can this value ever
+     * expire a session", and only a positive one can. A zero/negative
+     * `mfa_expires` is meaningless anyway (epoch 1970 or earlier).
+     *
+     * The `typeof` gate rejects objects and arrays outright rather than letting
+     * JS coercion invent a number for them: `[]` -> 0 and `[5]` -> 5 are accidents
+     * of coercion, not claims the IDP made.
+     */
+    const claimToNumber = (claim) => {
+        if (typeof claim !== 'number' && typeof claim !== 'string')
+            return undefined;
+        if (claim === '')
+            return undefined;
+        const n = Number(claim);
+        return Number.isFinite(n) && n > 0 ? n : undefined;
+    };
     // Claims are Unix SECONDS; SessionData stores milliseconds.
-    if (decoded.mfa_expires !== undefined && decoded.mfa_expires !== null) {
-        fields.mfaExpiresAt = Number(decoded.mfa_expires) * 1000;
+    const mfaExpires = claimToNumber(decoded.mfa_expires);
+    if (mfaExpires !== undefined) {
+        fields.mfaExpiresAt = mfaExpires * 1000;
     }
-    if (decoded.mfa_time !== undefined && decoded.mfa_time !== null) {
-        fields.mfaCompletedAt = Number(decoded.mfa_time) * 1000;
+    const mfaTime = claimToNumber(decoded.mfa_time);
+    if (mfaTime !== undefined) {
+        fields.mfaCompletedAt = mfaTime * 1000;
     }
-    if (decoded.mfa_validity_hours !== undefined && decoded.mfa_validity_hours !== null) {
-        fields.mfaValidityHours = Number(decoded.mfa_validity_hours);
+    const mfaValidityHours = claimToNumber(decoded.mfa_validity_hours);
+    if (mfaValidityHours !== undefined) {
+        fields.mfaValidityHours = mfaValidityHours;
     }
     return fields;
 }
@@ -376,7 +522,7 @@ function mfaLifetimeFromAccessToken(accessToken) {
 async function transitionTo2FASession(sessionToken, tokens, mfaMethod) {
     const newAccessToken = tokens.idpAccessToken || tokens.accessToken;
     console.log('[transitionTo2FASession] Called with:', {
-        sessionToken: sessionToken?.substring(0, 8) + '...',
+        sessionToken: (0, token_log_id_1.tokenLogId)(sessionToken),
         mfaMethod,
         hasAccessToken: !!newAccessToken,
         hasRefreshToken: !!(tokens.idpRefreshToken || tokens.refreshToken),
@@ -433,7 +579,7 @@ async function transitionTo2FASession(sessionToken, tokens, mfaMethod) {
             'mfaVerified; setting nextStep=mfa_verify so the consumer re-challenges. ' +
             'If this fires for a lane that DID complete a real ceremony, the defect is ' +
             'on the emit side (R908(b)) - do not "fix" it by minting the flag here.', {
-            sessionToken: sessionToken?.substring(0, 8) + '...',
+            sessionToken: (0, token_log_id_1.tokenLogId)(sessionToken),
             mfaMethod,
             hasAccessToken: !!newAccessToken,
         });
@@ -603,7 +749,7 @@ async function acquireRefreshLock(sessionToken, requestId, maxWaitMs = 5000) {
         const result = await redis_1.default.set(lockKey, JSON.stringify(lockInfo), 'PX', REFRESH_LOCK_TTL * 1000, 'NX');
         if (result === 'OK') {
             console.debug('[SESSION-STORE] Refresh lock acquired', {
-                sessionToken: sessionToken.substring(0, 8) + '...',
+                sessionToken: (0, token_log_id_1.tokenLogId)(sessionToken),
                 requestId,
                 lockVersion
             });
@@ -613,14 +759,14 @@ async function acquireRefreshLock(sessionToken, requestId, maxWaitMs = 5000) {
             // Lock already exists, check if we should wait
             if (maxWaitMs > 0) {
                 console.debug('[SESSION-STORE] Refresh lock already exists, waiting for release', {
-                    sessionToken: sessionToken.substring(0, 8) + '...',
+                    sessionToken: (0, token_log_id_1.tokenLogId)(sessionToken),
                     requestId,
                     maxWaitMs
                 });
                 return await waitForRefreshLockRelease(sessionToken, requestId, maxWaitMs);
             }
             console.warn('[SESSION-STORE] Refresh lock already exists, not waiting', {
-                sessionToken: sessionToken.substring(0, 8) + '...',
+                sessionToken: (0, token_log_id_1.tokenLogId)(sessionToken),
                 requestId
             });
             return { acquired: false };
@@ -628,7 +774,7 @@ async function acquireRefreshLock(sessionToken, requestId, maxWaitMs = 5000) {
     }
     catch (error) {
         console.error('[SESSION-STORE] Failed to acquire refresh lock', {
-            sessionToken: sessionToken.substring(0, 8) + '...',
+            sessionToken: (0, token_log_id_1.tokenLogId)(sessionToken),
             requestId,
             error: error instanceof Error ? error.message : String(error)
         });
@@ -654,7 +800,7 @@ async function waitForRefreshLockRelease(sessionToken, requestId, maxWaitMs) {
         }
         catch (error) {
             console.error('[SESSION-STORE] Error while waiting for refresh lock release', {
-                sessionToken: sessionToken.substring(0, 8) + '...',
+                sessionToken: (0, token_log_id_1.tokenLogId)(sessionToken),
                 requestId,
                 error: error instanceof Error ? error.message : String(error)
             });
@@ -662,7 +808,7 @@ async function waitForRefreshLockRelease(sessionToken, requestId, maxWaitMs) {
         }
     }
     console.warn('[SESSION-STORE] Timeout waiting for refresh lock release', {
-        sessionToken: sessionToken.substring(0, 8) + '...',
+        sessionToken: (0, token_log_id_1.tokenLogId)(sessionToken),
         requestId,
         waitedMs: Date.now() - startTime
     });
@@ -701,7 +847,7 @@ async function releaseRefreshLock(sessionToken, requestId, lockVersion) {
         const result = await redis_1.default.eval(luaScript, 1, lockKey, requestId, lockVersion ? lockVersion.toString() : '');
         if (result === 1) {
             console.debug('[SESSION-STORE] Refresh lock released successfully', {
-                sessionToken: sessionToken.substring(0, 8) + '...',
+                sessionToken: (0, token_log_id_1.tokenLogId)(sessionToken),
                 requestId,
                 lockVersion
             });
@@ -709,21 +855,21 @@ async function releaseRefreshLock(sessionToken, requestId, lockVersion) {
         }
         else if (result === 0) {
             console.warn('[SESSION-STORE] Attempted to release non-existent refresh lock', {
-                sessionToken: sessionToken.substring(0, 8) + '...',
+                sessionToken: (0, token_log_id_1.tokenLogId)(sessionToken),
                 requestId
             });
             return false;
         }
         else if (result === -1) {
             console.error('[SESSION-STORE] Attempted to release refresh lock owned by another request', {
-                sessionToken: sessionToken.substring(0, 8) + '...',
+                sessionToken: (0, token_log_id_1.tokenLogId)(sessionToken),
                 requestId
             });
             return false;
         }
         else if (result === -2) {
             console.error('[SESSION-STORE] Lock version mismatch during release', {
-                sessionToken: sessionToken.substring(0, 8) + '...',
+                sessionToken: (0, token_log_id_1.tokenLogId)(sessionToken),
                 requestId,
                 lockVersion
             });
@@ -731,7 +877,7 @@ async function releaseRefreshLock(sessionToken, requestId, lockVersion) {
         }
         else {
             console.error('[SESSION-STORE] Unexpected result from lock release script', {
-                sessionToken: sessionToken.substring(0, 8) + '...',
+                sessionToken: (0, token_log_id_1.tokenLogId)(sessionToken),
                 requestId,
                 result
             });
@@ -740,7 +886,7 @@ async function releaseRefreshLock(sessionToken, requestId, lockVersion) {
     }
     catch (error) {
         console.error('[SESSION-STORE] Failed to release refresh lock', {
-            sessionToken: sessionToken.substring(0, 8) + '...',
+            sessionToken: (0, token_log_id_1.tokenLogId)(sessionToken),
             requestId,
             error: error instanceof Error ? error.message : String(error)
         });
@@ -761,7 +907,7 @@ async function checkRefreshLock(sessionToken) {
     }
     catch (error) {
         console.error('[SESSION-STORE] Failed to check refresh lock', {
-            sessionToken: sessionToken.substring(0, 8) + '...',
+            sessionToken: (0, token_log_id_1.tokenLogId)(sessionToken),
             error: error instanceof Error ? error.message : String(error)
         });
         return null;

package/dist/lib/startup-init.d.ts

@@ -25,6 +25,12 @@ export declare function logStartupStatus(): void;
  * Get the cached IDP config after initialization.
  * Returns null if not yet initialized.
  */
+/**
+ * For health endpoints (rigpert 60765): a guard that does not stop the process is an empty red unless the mismatch is visible
+ * where operators and promote-fe look. Returns `SLUG_MISMATCH: cookie=<idp slug> gate=<app slug>` while the drift holds, else null;
+ * a health route should answer non-200 with this as the reason. Null until the IdP config has been fetched.
+ */
+export declare function getSlugMismatchReason(): string | null;
 export declare function getStartupIDPConfig(): IDPClientConfig | null;
 /**
  * Check if initialization failed (auth signing secret couldn't be retrieved)

package/dist/lib/startup-init.js

@@ -46,12 +46,14 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ensureInitialized = ensureInitialized;
 exports.logStartupStatus = logStartupStatus;
+exports.getSlugMismatchReason = getSlugMismatchReason;
 exports.getStartupIDPConfig = getStartupIDPConfig;
 exports.isInitializationFailed = isInitializationFailed;
 exports.getInitializationError = getInitializationError;
 exports.isAppReady = isAppReady;
 require("server-only");
 const idp_client_config_1 = require("./idp-client-config");
+const app_slug_1 = require("./app-slug");
 let initializationStarted = false;
 let initializationComplete = false;
 let initializationFailed = false;
@@ -90,9 +92,22 @@ async function ensureInitialized() {
     lastStartupAttemptTime = now;
     // Mark as started
     initializationStarted = true;
-    // Start initialization
-    initializationPromise = performInitialization();
-    await initializationPromise;
+    // Start initialization.
+    //
+    // PAY-642: a FAILED attempt must not stay installed. This used to be
+    // `initializationPromise = performInitialization(); await initializationPromise;` with no reset, and the
+    // in-progress check above runs BEFORE the backoff check, so a pod that booted while the IdP was down replayed
+    // its first rejection to every caller forever: the 30 s backoff could never lead to a retry. Same latch, same
+    // fix, as createSingleFlight (lib/single-flight.ts): callers of the failing attempt still see the rejection
+    // (loud), then the attempt clears itself, identity-guarded so a slow failure never evicts a newer attempt.
+    // After a failure the backoff check above governs when the next attempt may start.
+    const attempt = performInitialization();
+    initializationPromise = attempt;
+    attempt.catch(() => {
+        if (initializationPromise === attempt)
+            initializationPromise = null;
+    });
+    await attempt;
 }
 /**
  * Synchronously log startup status
@@ -190,8 +205,11 @@ async function performInitialization() {
         // Step 3: Validate cookie name consistency
         // This catches bugs where getJwtCookieName() returns a different name than
         // what auth-options.ts configures, which causes sessions to fail in production
-        const { validateCookieNameConsistency, getSessionCookieName } = await Promise.resolve().then(() => __importStar(require('./app-slug')));
+        const { validateCookieNameConsistency, getSessionCookieName, assertAppSlugMatchesIdp, assertIdpSlugKnown } = await Promise.resolve().then(() => __importStar(require('./app-slug')));
         validateCookieNameConsistency();
+        // rigpert 60743: refuse to run with two cookie-name sources (IdP clientSlug vs APP_SLUG/CLIENT_ID).
+        assertIdpSlugKnown(cachedIDPConfig?.clientSlug);
+        assertAppSlugMatchesIdp(cachedIDPConfig?.clientSlug);
         console.log('[STARTUP] Cookie name consistency validated:', getSessionCookieName());
         // All done
         console.log('');
@@ -241,6 +259,14 @@ ${connectionLine}║   Possible causes:
  * Get the cached IDP config after initialization.
  * Returns null if not yet initialized.
  */
+/**
+ * For health endpoints (rigpert 60765): a guard that does not stop the process is an empty red unless the mismatch is visible
+ * where operators and promote-fe look. Returns `SLUG_MISMATCH: cookie=<idp slug> gate=<app slug>` while the drift holds, else null;
+ * a health route should answer non-200 with this as the reason. Null until the IdP config has been fetched.
+ */
+function getSlugMismatchReason() {
+    return (0, app_slug_1.slugStateReason)(cachedIDPConfig?.clientSlug, initializationComplete || initializationFailed);
+}
 function getStartupIDPConfig() {
     return cachedIDPConfig;
 }

package/dist/lib/token-lifecycle.js

@@ -27,6 +27,7 @@ const session_store_1 = require("./session-store");
 const auth_1 = require("../server/auth");
 const redis_1 = require("./redis");
 const app_slug_1 = require("./app-slug");
+const token_log_id_1 = require("./token-log-id");
 // 5 minute threshold for "needs refresh" - matches refresh handler pattern
 const REFRESH_THRESHOLD_MS = 5 * 60 * 1000;
 // Concurrent refresh handling configuration
@@ -360,7 +361,7 @@ async function ensureFreshToken(request) {
             }
         }
         console.log('[TOKEN_LIFECYCLE] ensureFreshToken check:', {
-            sessionToken: sessionToken.substring(0, 8) + '...',
+            sessionToken: (0, token_log_id_1.tokenLogId)(sessionToken),
             accessTokenExpires: tokenExpiresStr,
             now: new Date().toISOString(),
             needsRefresh: needsRefreshNow,

package/dist/lib/token-log-id.d.ts

@@ -0,0 +1,18 @@
+/**
+ * tokenLogId - a log-safe correlation id for a session token (PR 154 follow-up, BAPert ruling on PAY-1427:
+ * "no token material in logs, not even partial").
+ *
+ * The package used to log `sessionToken.substring(0, 8) + '...'` so lines about one session could be
+ * correlated. Those 8 characters ARE token material. This returns `h:` + the first 12 hex characters of
+ * SHA-256(token) instead: the same correlation (one token -> one stable id, across every log line and
+ * process), with nothing of the token itself.
+ *
+ * Synchronous and dependency-free on purpose: the call sites include Edge middleware
+ * (create-middleware, auth-decision) and browser code (authStore, SessionSync), where node:crypto is
+ * unavailable and Web Crypto's digest is async. SHA-256 below follows FIPS 180-4 and is verified
+ * against node:crypto in test/session-token-log-id.test.cjs.
+ */
+/** SHA-256 of the UTF-8 encoding of `input`, as lowercase hex. */
+export declare function sha256Hex(input: string): string;
+/** `h:` + 12 hex of SHA-256(token); `none` when there is no token. Never any part of the token itself. */
+export declare function tokenLogId(token: string | null | undefined): string;