@payez/next-mvp 4.4.6 → 4.4.7

package/dist/api-handlers/account/change-password.js

@@ -5,6 +5,25 @@ const server_1 = require("next/server");
 const auth_1 = require("../../server/auth");
 const session_store_1 = require("../../lib/session-store");
 const nanoid_1 = require("nanoid");
+/**
+ * PAY-1596: the failure code comes from the IdP's REAL envelope { success, error: { code, message, details } } - the handler
+ * used to read a top-level `error_code` the IdP never sends, so every refusal was CHANGE_PASSWORD_FAILED and "this account has
+ * no password" / "wrong current password" could not be told apart. Allowlisted: nothing but these codes ever leaves here.
+ *   - error.code NO_PASSWORD_SET / INVALID_CURRENT_PASSWORD (IdP PR 412) / VALIDATION_ERROR
+ *   - the pre-412 wrong-current shape: VALIDATION_ERROR + details.value[] { code: InvalidCurrentPassword, field_name: currentPassword }
+ *   - a legacy top-level error_code, for older IdPs
+ */
+const CHANGE_PASSWORD_CODES = new Set(['NO_PASSWORD_SET', 'INVALID_CURRENT_PASSWORD', 'VALIDATION_ERROR']);
+function changePasswordFailureCode(body) {
+    const err = body && typeof body.error === 'object' && body.error ? body.error : null;
+    const code = typeof err?.code === 'string' ? err.code : typeof body?.error_code === 'string' ? body.error_code : '';
+    if (code === 'VALIDATION_ERROR' && Array.isArray(err?.details?.value)) {
+        const wrongCurrent = err.details.value.some((e) => e && typeof e === 'object' && (String(e.field_name ?? e.fieldName ?? '').toLowerCase() === 'currentpassword' || String(e.code ?? '').toLowerCase() === 'invalidcurrentpassword'));
+        if (wrongCurrent)
+            return 'INVALID_CURRENT_PASSWORD';
+    }
+    return CHANGE_PASSWORD_CODES.has(code) ? code : 'CHANGE_PASSWORD_FAILED';
+}
 const safe_error_response_1 = require("../../lib/safe-error-response");
 // ...
 async function POST(req) {
@@ -75,22 +94,25 @@ async function POST(req) {
         if (!idpResponse.ok) {
             // Extract error message from IDP response
             let errorMessage = 'Failed to change password';
+            const failureCode = changePasswordFailureCode(responseData);
+            // The real envelope nests details under `error`; older IdPs put them at the top level.
+            const idpDetails = (responseData.error && typeof responseData.error === 'object' ? responseData.error.details : undefined) ?? responseData.details;
             if (responseData.message) {
                 errorMessage = responseData.message;
             }
-            else if (responseData.details?.value && Array.isArray(responseData.details.value) && responseData.details.value.length > 0) {
-                errorMessage = responseData.details.value[0].message || errorMessage;
+            else if (idpDetails?.value && Array.isArray(idpDetails.value) && idpDetails.value.length > 0) {
+                errorMessage = idpDetails.value[0].message || errorMessage;
             }
-            else if (responseData.details?.message) {
-                errorMessage = responseData.details.message;
+            else if (idpDetails?.message) {
+                errorMessage = idpDetails.message;
             }
             return server_1.NextResponse.json({
                 success: false,
                 message: errorMessage,
-                error_code: responseData.error_code || 'CHANGE_PASSWORD_FAILED',
+                error_code: failureCode,
                 request_id: requestId,
                 // PAY-1438: only the password-policy messages the security pages display, never the raw envelope.
-                details: (0, safe_error_response_1.projectPasswordPolicyDetails)(responseData.details),
+                details: (0, safe_error_response_1.projectPasswordPolicyDetails)(idpDetails),
             }, { status: idpResponse.status });
         }
         return server_1.NextResponse.json({

package/dist/auth/better-auth.d.ts

@@ -182,6 +182,9 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, opt
             refreshCache: false;
         };
     };
+    account: {
+        storeStateStrategy: "cookie";
+    };
     advanced: {
         cookiePrefix: string;
         cookies: {
@@ -192,22 +195,25 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, opt
     };
     plugins: [{
         id: "next-cookies";
+        version: string;
         hooks: {
             before: {
                 matcher(ctx: import("better-auth").HookEndpointContext): boolean;
-                handler: (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>;
+                handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
             }[];
             after: {
                 matcher(ctx: import("better-auth").HookEndpointContext): true;
-                handler: (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>;
+                handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
             }[];
         };
-    }, ...(import("better-auth").BetterAuthPlugin | {
+    }, ...({
         id: "magic-link";
+        version: string;
         endpoints: {
             signInMagicLink: import("better-auth").StrictEndpoint<"/sign-in/magic-link", {
                 method: "POST";
                 requireHeaders: true;
+                use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>[];
                 body: import("better-auth").ZodObject<{
                     email: import("better-auth").ZodEmail;
                     name: import("better-auth").ZodOptional<import("better-auth").ZodString>;
@@ -215,7 +221,7 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, opt
                     newUserCallbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
                     errorCallbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
                     metadata: import("better-auth").ZodOptional<import("better-auth").ZodRecord<import("better-auth").ZodString, import("better-auth").ZodAny>>;
-                }, import("better-auth").$strip>;
+                }, import("zod/v4/core").$strip>;
                 metadata: {
                     openapi: {
                         operationId: string;
@@ -249,8 +255,8 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, opt
                     callbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
                     errorCallbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
                     newUserCallbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
-                }, import("better-auth").$strip>;
-                use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>)[];
+                }, import("zod/v4/core").$strip>;
+                use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>[];
                 requireHeaders: true;
                 metadata: {
                     openapi: {
@@ -289,6 +295,16 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, opt
                     name: string;
                     image?: string | null | undefined;
                 };
+                session: {
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    userId: string;
+                    expiresAt: Date;
+                    token: string;
+                    ipAddress?: string | null | undefined;
+                    userAgent?: string | null | undefined;
+                };
             }>;
         };
         rateLimit: {
@@ -297,8 +313,9 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, opt
             max: number;
         }[];
         options: MagicLinkOptions;
-    } | {
+    } | import("better-auth").BetterAuthPlugin | {
         id: "generic-oauth";
+        version: string;
         init: (ctx: import("better-auth").AuthContext) => {
             context: {
                 socialProviders: import("better-auth").OAuthProvider<Record<string, any>, Partial<import("better-auth").ProviderOptions<any>>>[];
@@ -316,7 +333,7 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, opt
                     scopes: import("better-auth").ZodOptional<import("better-auth").ZodArray<import("better-auth").ZodString>>;
                     requestSignUp: import("better-auth").ZodOptional<import("better-auth").ZodBoolean>;
                     additionalData: import("better-auth").ZodOptional<import("better-auth").ZodRecord<import("better-auth").ZodString, import("better-auth").ZodAny>>;
-                }, import("better-auth").$strip>;
+                }, import("zod/v4/core").$strip>;
                 metadata: {
                     openapi: {
                         description: string;
@@ -354,7 +371,7 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, opt
                     error_description: import("better-auth").ZodOptional<import("better-auth").ZodString>;
                     state: import("better-auth").ZodOptional<import("better-auth").ZodString>;
                     iss: import("better-auth").ZodOptional<import("better-auth").ZodString>;
-                }, import("better-auth").$strip>;
+                }, import("zod/v4/core").$strip>;
                 metadata: {
                     allowedMediaTypes: string[];
                     openapi: {
@@ -379,7 +396,7 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, opt
                     };
                     scope: "server";
                 };
-            }, void>;
+            }, never>;
             oAuth2LinkAccount: import("better-auth").StrictEndpoint<"/oauth2/link", {
                 method: "POST";
                 body: import("better-auth").ZodObject<{
@@ -387,8 +404,8 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, opt
                     callbackURL: import("better-auth").ZodString;
                     scopes: import("better-auth").ZodOptional<import("better-auth").ZodArray<import("better-auth").ZodString>>;
                     errorCallbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
-                }, import("better-auth").$strip>;
-                use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                }, import("zod/v4/core").$strip>;
+                use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
                     session: {
                         session: Record<string, any> & {
                             id: string;
@@ -410,7 +427,7 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, opt
                             image?: string | null | undefined;
                         };
                     };
-                }>)[];
+                }>>[];
                 metadata: {
                     openapi: {
                         description: string;
@@ -565,12 +582,25 @@ export declare function exchangeOAuthForIdpTokens(sessionToken: string, provider
  *                      state what actually authenticated ('passkey', 'google').
  */
 export declare function storeIdpTokensInSession(sessionToken: string, idpTokenData: Record<string, unknown>, authProvider: string): Promise<boolean>;
+/**
+ * The `?error=` code the login page receives when an OAuth sign-in is ABORTED because the IdP exchange did not
+ * store tokens (PAY-1733). Hosts map it to ONE neutral line; the card's words are "That sign-in didn't work.
+ * Try again or use another method." The cause stays in the server log, never on the page.
+ */
+export declare const OAUTH_SIGN_IN_FAILED_ERROR = "OAUTH_SIGN_IN_FAILED";
+/**
+ * Re-emit each cookie the callback response SET as an immediate expiry, keeping the attributes that decide
+ * WHICH cookie the browser overwrites (Path, Domain, Secure, SameSite, HttpOnly - a `__Secure-` name is only
+ * accepted with Secure) and dropping Expires/Max-Age in favour of Max-Age=0.
+ */
+export declare function expireSetCookies(setCookies: readonly string[]): string[];
 /**
  * Create a production-ready GET handler for the auth catch-all route.
  *
  * Wraps better-auth's GET handler with:
  * - OAuth state error recovery (redirects to login instead of error page)
- * - IDP token exchange after successful OAuth callback
+ * - IDP token exchange after successful OAuth callback - and, when it stores no tokens, the sign-in is ABORTED
+ *   (session destroyed, cookies expired, login page with OAUTH_SIGN_IN_FAILED; PAY-1733)
  *
  * Usage in host app:
  * ```ts

package/dist/auth/better-auth.js

@@ -43,6 +43,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAUTH_SIGN_IN_FAILED_ERROR = void 0;
 exports.secretFingerprint = secretFingerprint;
 exports.buildIdpOAuthProviderConfig = buildIdpOAuthProviderConfig;
 exports.buildBetterAuthProviders = buildBetterAuthProviders;
@@ -54,6 +55,7 @@ exports.getBetterAuthInstance = getBetterAuthInstance;
 exports.getBetterAuthHandler = getBetterAuthHandler;
 exports.exchangeOAuthForIdpTokens = exchangeOAuthForIdpTokens;
 exports.storeIdpTokensInSession = storeIdpTokensInSession;
+exports.expireSetCookies = expireSetCookies;
 exports.createAuthGetHandler = createAuthGetHandler;
 require("server-only");
 const node_async_hooks_1 = require("node:async_hooks");
@@ -748,6 +750,18 @@ function createBetterAuthInstance(idpConfig, opts = {}) {
                 refreshCache: false,
             },
         },
+        // PAY-1781 B: KEEP OAUTH STATE IN THE ENCRYPTED COOKIE, as it was on better-auth 1.5.6.
+        // 1.5.6 resolved the default as `options.database ? 'database' : 'cookie'` - we have no
+        // database, so: cookie. 1.6.13+ resolves it as `(database || secondaryStorage) ? 'database'
+        // : 'cookie'`, and we DO have secondaryStorage, so the upgrade alone would silently move every
+        // OAuth state record into Redis through the adapter above (its enrichment read-modify-write
+        // and key handling were built for session records, not state). Pinned so the upgrade changes
+        // the version, not the design. The cookie branch is where GHSA-wxw3-q3m9-c3jr lived; 1.6.2+
+        // compares the returned `state` with the nonce sealed in the cookie, and our provider is also
+        // pkce:true, which the advisory required to be false. Test: oauth-state-strategy-cookie.
+        account: {
+            storeStateStrategy: 'cookie',
+        },
         // Cookie prefix must match slim-middleware expectations ({slug}.session-token)
         advanced: {
             cookiePrefix: appSlug,
@@ -1202,12 +1216,76 @@ async function storeIdpTokensInSession(sessionToken, idpTokenData, authProvider)
         return false;
     }
 }
+/**
+ * The `?error=` code the login page receives when an OAuth sign-in is ABORTED because the IdP exchange did not
+ * store tokens (PAY-1733). Hosts map it to ONE neutral line; the card's words are "That sign-in didn't work.
+ * Try again or use another method." The cause stays in the server log, never on the page.
+ */
+exports.OAUTH_SIGN_IN_FAILED_ERROR = 'OAUTH_SIGN_IN_FAILED';
+/**
+ * Re-emit each cookie the callback response SET as an immediate expiry, keeping the attributes that decide
+ * WHICH cookie the browser overwrites (Path, Domain, Secure, SameSite, HttpOnly - a `__Secure-` name is only
+ * accepted with Secure) and dropping Expires/Max-Age in favour of Max-Age=0.
+ */
+function expireSetCookies(setCookies) {
+    const out = [];
+    for (const sc of setCookies) {
+        const [pair, ...attrs] = sc.split(';').map((s) => s.trim());
+        const eq = pair.indexOf('=');
+        const name = eq > 0 ? pair.slice(0, eq) : '';
+        if (!name)
+            continue;
+        const kept = attrs.filter((a) => /^(path|domain|secure|samesite|httponly)\b/i.test(a));
+        out.push([`${name}=`, ...kept, 'Max-Age=0'].join('; '));
+    }
+    return out;
+}
+/**
+ * PAY-1733 (Jon, live on :4797): ABORT an OAuth sign-in whose IdP exchange did not store tokens.
+ *
+ * Before this, a failed exchange was a console.error and the user kept the Better Auth session the callback had
+ * just created: signed in, holding NO IdP tokens. The host then routed that session to 2FA, which painted the
+ * user's email and failed every call - a red "sign in again" screen about an account the app could no longer
+ * authenticate. The IdP's 401 was CORRECT (it fail-closes unverified assertions); keeping the session was the bug.
+ *
+ * So: no session without IdP tokens. The Better Auth session is destroyed (its own signOut, best effort, then the
+ * `ba:<slug>:<token>` record directly - that record is what makes it resolvable), every cookie the callback set is
+ * expired, and the user goes to the login page with OAUTH_SIGN_IN_FAILED. Relative Location, as for the state-error
+ * branch above (328439: an absolute URL built from request.url is a dead tab in a container).
+ */
+async function abortOAuthSignIn(callbackResponse, sessionToken, cookieHeader, loginPath) {
+    const headers = new Headers();
+    if (sessionToken) {
+        try {
+            const auth = await getBetterAuthInstance();
+            const out = await auth?.api?.signOut?.({ headers: new Headers({ cookie: cookieHeader }), asResponse: true });
+            for (const sc of out?.headers?.getSetCookie?.() ?? [])
+                headers.append('set-cookie', sc);
+        }
+        catch (err) {
+            console.warn('[BETTER_AUTH] abort: Better Auth signOut failed, deleting the record directly:', err instanceof Error ? err.message : String(err));
+        }
+        try {
+            const config = await (0, idp_client_config_1.getIDPClientConfig)();
+            await (0, redis_1.getRedis)().del(`ba:${config.clientSlug || (0, app_slug_1.getAppSlug)()}:${sessionToken}`);
+        }
+        catch (err) {
+            console.error('[BETTER_AUTH] abort: could not delete the Better Auth session record', (0, token_log_id_1.tokenLogId)(sessionToken), err instanceof Error ? err.message : String(err));
+        }
+    }
+    for (const sc of expireSetCookies(callbackResponse.headers.getSetCookie?.() ?? []))
+        headers.append('set-cookie', sc);
+    headers.set('location', `${loginPath}${loginPath.includes('?') ? '&' : '?'}error=${exports.OAUTH_SIGN_IN_FAILED_ERROR}`);
+    console.warn('[BETTER_AUTH] OAuth sign-in ABORTED: the IdP exchange stored no tokens, so no session is kept (PAY-1733)', sessionToken ? (0, token_log_id_1.tokenLogId)(sessionToken) : '(no session)');
+    return new Response(null, { status: 302, headers });
+}
 /**
  * Create a production-ready GET handler for the auth catch-all route.
  *
  * Wraps better-auth's GET handler with:
  * - OAuth state error recovery (redirects to login instead of error page)
- * - IDP token exchange after successful OAuth callback
+ * - IDP token exchange after successful OAuth callback - and, when it stores no tokens, the sign-in is ABORTED
+ *   (session destroyed, cookies expired, login page with OAUTH_SIGN_IN_FAILED; PAY-1733)
  *
  * Usage in host app:
  * ```ts
@@ -1276,22 +1354,27 @@ function createAuthGetHandler(loginPath = '/account-auth/login') {
                     return new Response(null, { status: 302, headers: { location: loginPath } });
                 }
             }
-            // After successful OAuth callback: exchange Google identity for IDP tokens
+            // After the OAuth callback: exchange the provider identity for IDP tokens. If that does NOT store tokens - the
+            // IdP refused (401), no session was found, or anything threw - the sign-in is ABORTED (PAY-1733). A session is
+            // kept only when it holds IdP tokens.
             const url = new URL(request.url);
             if (url.pathname.includes('/callback/') && response.status === 302) {
+                const setCookies = response.headers.getSetCookie?.() || [];
+                const cookieHeader = setCookies
+                    .map((c) => c.split(';')[0])
+                    .join('; ');
+                let sessionToken = null;
+                let exchanged = false;
                 try {
                     const auth = await getBetterAuthInstance();
                     if (auth?.api?.getSession) {
-                        const setCookies = response.headers.getSetCookie?.() || [];
-                        const cookieHeader = setCookies
-                            .map((c) => c.split(';')[0])
-                            .join('; ');
                         const headers = new Headers();
                         headers.set('cookie', cookieHeader);
                         const session = await auth.api.getSession({ headers });
                         if (session?.session?.token) {
+                            sessionToken = session.session.token;
                             console.log('[BETTER_AUTH] Got session token from callback:', (0, token_log_id_1.tokenLogId)(session.session.token), '| email:', session.user?.email);
-                            await exchangeOAuthForIdpTokens(session.session.token);
+                            exchanged = await exchangeOAuthForIdpTokens(session.session.token);
                         }
                         else {
                             console.warn('[BETTER_AUTH] Could not get session after OAuth callback');
@@ -1301,6 +1384,8 @@ function createAuthGetHandler(loginPath = '/account-auth/login') {
                 catch (err) {
                     console.error('[BETTER_AUTH] IDP token exchange failed:', err.message);
                 }
+                if (!exchanged)
+                    return abortOAuthSignIn(response, sessionToken, cookieHeader, loginPath);
             }
             return response;
         });