@payez/next-mvp 4.4.6 → 4.4.8

package/dist/api-handlers/account/change-password.js

@@ -5,6 +5,25 @@ const server_1 = require("next/server");
 const auth_1 = require("../../server/auth");
 const session_store_1 = require("../../lib/session-store");
 const nanoid_1 = require("nanoid");
+/**
+ * PAY-1596: the failure code comes from the IdP's REAL envelope { success, error: { code, message, details } } - the handler
+ * used to read a top-level `error_code` the IdP never sends, so every refusal was CHANGE_PASSWORD_FAILED and "this account has
+ * no password" / "wrong current password" could not be told apart. Allowlisted: nothing but these codes ever leaves here.
+ *   - error.code NO_PASSWORD_SET / INVALID_CURRENT_PASSWORD (IdP PR 412) / VALIDATION_ERROR
+ *   - the pre-412 wrong-current shape: VALIDATION_ERROR + details.value[] { code: InvalidCurrentPassword, field_name: currentPassword }
+ *   - a legacy top-level error_code, for older IdPs
+ */
+const CHANGE_PASSWORD_CODES = new Set(['NO_PASSWORD_SET', 'INVALID_CURRENT_PASSWORD', 'VALIDATION_ERROR']);
+function changePasswordFailureCode(body) {
+    const err = body && typeof body.error === 'object' && body.error ? body.error : null;
+    const code = typeof err?.code === 'string' ? err.code : typeof body?.error_code === 'string' ? body.error_code : '';
+    if (code === 'VALIDATION_ERROR' && Array.isArray(err?.details?.value)) {
+        const wrongCurrent = err.details.value.some((e) => e && typeof e === 'object' && (String(e.field_name ?? e.fieldName ?? '').toLowerCase() === 'currentpassword' || String(e.code ?? '').toLowerCase() === 'invalidcurrentpassword'));
+        if (wrongCurrent)
+            return 'INVALID_CURRENT_PASSWORD';
+    }
+    return CHANGE_PASSWORD_CODES.has(code) ? code : 'CHANGE_PASSWORD_FAILED';
+}
 const safe_error_response_1 = require("../../lib/safe-error-response");
 // ...
 async function POST(req) {
@@ -75,22 +94,25 @@ async function POST(req) {
         if (!idpResponse.ok) {
             // Extract error message from IDP response
             let errorMessage = 'Failed to change password';
+            const failureCode = changePasswordFailureCode(responseData);
+            // The real envelope nests details under `error`; older IdPs put them at the top level.
+            const idpDetails = (responseData.error && typeof responseData.error === 'object' ? responseData.error.details : undefined) ?? responseData.details;
             if (responseData.message) {
                 errorMessage = responseData.message;
             }
-            else if (responseData.details?.value && Array.isArray(responseData.details.value) && responseData.details.value.length > 0) {
-                errorMessage = responseData.details.value[0].message || errorMessage;
+            else if (idpDetails?.value && Array.isArray(idpDetails.value) && idpDetails.value.length > 0) {
+                errorMessage = idpDetails.value[0].message || errorMessage;
             }
-            else if (responseData.details?.message) {
-                errorMessage = responseData.details.message;
+            else if (idpDetails?.message) {
+                errorMessage = idpDetails.message;
             }
             return server_1.NextResponse.json({
                 success: false,
                 message: errorMessage,
-                error_code: responseData.error_code || 'CHANGE_PASSWORD_FAILED',
+                error_code: failureCode,
                 request_id: requestId,
                 // PAY-1438: only the password-policy messages the security pages display, never the raw envelope.
-                details: (0, safe_error_response_1.projectPasswordPolicyDetails)(responseData.details),
+                details: (0, safe_error_response_1.projectPasswordPolicyDetails)(idpDetails),
             }, { status: idpResponse.status });
         }
         return server_1.NextResponse.json({

package/dist/auth/better-auth.d.ts

@@ -182,6 +182,9 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, opt
             refreshCache: false;
         };
     };
+    account: {
+        storeStateStrategy: "cookie";
+    };
     advanced: {
         cookiePrefix: string;
         cookies: {
@@ -192,22 +195,25 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, opt
     };
     plugins: [{
         id: "next-cookies";
+        version: string;
         hooks: {
             before: {
                 matcher(ctx: import("better-auth").HookEndpointContext): boolean;
-                handler: (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>;
+                handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
             }[];
             after: {
                 matcher(ctx: import("better-auth").HookEndpointContext): true;
-                handler: (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>;
+                handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
             }[];
         };
-    }, ...(import("better-auth").BetterAuthPlugin | {
+    }, ...({
         id: "magic-link";
+        version: string;
         endpoints: {
             signInMagicLink: import("better-auth").StrictEndpoint<"/sign-in/magic-link", {
                 method: "POST";
                 requireHeaders: true;
+                use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>[];
                 body: import("better-auth").ZodObject<{
                     email: import("better-auth").ZodEmail;
                     name: import("better-auth").ZodOptional<import("better-auth").ZodString>;
@@ -215,7 +221,7 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, opt
                     newUserCallbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
                     errorCallbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
                     metadata: import("better-auth").ZodOptional<import("better-auth").ZodRecord<import("better-auth").ZodString, import("better-auth").ZodAny>>;
-                }, import("better-auth").$strip>;
+                }, import("zod/v4/core").$strip>;
                 metadata: {
                     openapi: {
                         operationId: string;
@@ -249,8 +255,8 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, opt
                     callbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
                     errorCallbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
                     newUserCallbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
-                }, import("better-auth").$strip>;
-                use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>)[];
+                }, import("zod/v4/core").$strip>;
+                use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>[];
                 requireHeaders: true;
                 metadata: {
                     openapi: {
@@ -289,6 +295,16 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, opt
                     name: string;
                     image?: string | null | undefined;
                 };
+                session: {
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    userId: string;
+                    expiresAt: Date;
+                    token: string;
+                    ipAddress?: string | null | undefined;
+                    userAgent?: string | null | undefined;
+                };
             }>;
         };
         rateLimit: {
@@ -297,8 +313,9 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, opt
             max: number;
         }[];
         options: MagicLinkOptions;
-    } | {
+    } | import("better-auth").BetterAuthPlugin | {
         id: "generic-oauth";
+        version: string;
         init: (ctx: import("better-auth").AuthContext) => {
             context: {
                 socialProviders: import("better-auth").OAuthProvider<Record<string, any>, Partial<import("better-auth").ProviderOptions<any>>>[];
@@ -316,7 +333,7 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, opt
                     scopes: import("better-auth").ZodOptional<import("better-auth").ZodArray<import("better-auth").ZodString>>;
                     requestSignUp: import("better-auth").ZodOptional<import("better-auth").ZodBoolean>;
                     additionalData: import("better-auth").ZodOptional<import("better-auth").ZodRecord<import("better-auth").ZodString, import("better-auth").ZodAny>>;
-                }, import("better-auth").$strip>;
+                }, import("zod/v4/core").$strip>;
                 metadata: {
                     openapi: {
                         description: string;
@@ -354,7 +371,7 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, opt
                     error_description: import("better-auth").ZodOptional<import("better-auth").ZodString>;
                     state: import("better-auth").ZodOptional<import("better-auth").ZodString>;
                     iss: import("better-auth").ZodOptional<import("better-auth").ZodString>;
-                }, import("better-auth").$strip>;
+                }, import("zod/v4/core").$strip>;
                 metadata: {
                     allowedMediaTypes: string[];
                     openapi: {
@@ -379,7 +396,7 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, opt
                     };
                     scope: "server";
                 };
-            }, void>;
+            }, never>;
             oAuth2LinkAccount: import("better-auth").StrictEndpoint<"/oauth2/link", {
                 method: "POST";
                 body: import("better-auth").ZodObject<{
@@ -387,8 +404,8 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, opt
                     callbackURL: import("better-auth").ZodString;
                     scopes: import("better-auth").ZodOptional<import("better-auth").ZodArray<import("better-auth").ZodString>>;
                     errorCallbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
-                }, import("better-auth").$strip>;
-                use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                }, import("zod/v4/core").$strip>;
+                use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
                     session: {
                         session: Record<string, any> & {
                             id: string;
@@ -410,7 +427,7 @@ export declare function createBetterAuthInstance(idpConfig: IDPClientConfig, opt
                             image?: string | null | undefined;
                         };
                     };
-                }>)[];
+                }>>[];
                 metadata: {
                     openapi: {
                         description: string;
@@ -519,8 +536,14 @@ export declare function getBetterAuthHandler(): Promise<{
  * header of the response to find the BA Redis key.
  *
  * This replaces the old databaseHooks approach which doesn't fire in stateless mode.
+ *
+ * RETURNS the IdP's own error code on an IDP refusal, or null otherwise
+ * (PAY-2005 scenario (b), BAPert ruling 67897). It used to return a bare
+ * boolean, so `REGISTRATION_NOT_ALLOWED` was indistinguishable from a network
+ * blip and every cause collapsed to one generic login-page code — a NEW user
+ * refused registration bounced silently, which is the failure Jon named.
  */
-export declare function exchangeOAuthForIdpTokens(sessionToken: string, provider?: string): Promise<boolean>;
+export declare function exchangeOAuthForIdpTokens(sessionToken: string, provider?: string): Promise<boolean | string>;
 /**
  * Write IDP tokens into an EXISTING Better Auth session. Storage only — this
  * function never acquires tokens and never decides who the caller is.
@@ -565,12 +588,36 @@ export declare function exchangeOAuthForIdpTokens(sessionToken: string, provider
  *                      state what actually authenticated ('passkey', 'google').
  */
 export declare function storeIdpTokensInSession(sessionToken: string, idpTokenData: Record<string, unknown>, authProvider: string): Promise<boolean>;
+/**
+ * The `?error=` code the login page receives when an OAuth sign-in is ABORTED because the IdP exchange did not
+ * store tokens (PAY-1733). Hosts map it to ONE neutral line; the card's words are "That sign-in didn't work.
+ * Try again or use another method." The cause stays in the server log, never on the page.
+ */
+export declare const OAUTH_SIGN_IN_FAILED_ERROR = "OAUTH_SIGN_IN_FAILED";
+/**
+ * The ONLY IdP refusal codes the package forwards to the login page (PAY-2005 (b), BAPert 67897).
+ *
+ * Default stays PAY-1733's ONE neutral code: the cause of an ordinary failed exchange lives in the server
+ * log, never on the page. A code is forwarded ONLY when it earns a distinct user-facing message — today just
+ * the registration refusal, so a NEW Google user with registration OFF sees a clear "not open to sign-up"
+ * line instead of a silent bounce. Adding a code here REQUIRES a matching entry in the host allowlist
+ * (portal: src/lib/auth/magic-link-outcome.ts); an unlisted code renders nothing, which is a silent bounce
+ * wearing a different number. Add them together, never one alone.
+ */
+export declare const IDP_ERROR_CODES_TO_FORWARD: ReadonlySet<string>;
+/**
+ * Re-emit each cookie the callback response SET as an immediate expiry, keeping the attributes that decide
+ * WHICH cookie the browser overwrites (Path, Domain, Secure, SameSite, HttpOnly - a `__Secure-` name is only
+ * accepted with Secure) and dropping Expires/Max-Age in favour of Max-Age=0.
+ */
+export declare function expireSetCookies(setCookies: readonly string[]): string[];
 /**
  * Create a production-ready GET handler for the auth catch-all route.
  *
  * Wraps better-auth's GET handler with:
  * - OAuth state error recovery (redirects to login instead of error page)
- * - IDP token exchange after successful OAuth callback
+ * - IDP token exchange after successful OAuth callback - and, when it stores no tokens, the sign-in is ABORTED
+ *   (session destroyed, cookies expired, login page with OAUTH_SIGN_IN_FAILED; PAY-1733)
  *
  * Usage in host app:
  * ```ts

package/dist/auth/better-auth.js

@@ -43,6 +43,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDP_ERROR_CODES_TO_FORWARD = exports.OAUTH_SIGN_IN_FAILED_ERROR = void 0;
 exports.secretFingerprint = secretFingerprint;
 exports.buildIdpOAuthProviderConfig = buildIdpOAuthProviderConfig;
 exports.buildBetterAuthProviders = buildBetterAuthProviders;
@@ -54,6 +55,7 @@ exports.getBetterAuthInstance = getBetterAuthInstance;
 exports.getBetterAuthHandler = getBetterAuthHandler;
 exports.exchangeOAuthForIdpTokens = exchangeOAuthForIdpTokens;
 exports.storeIdpTokensInSession = storeIdpTokensInSession;
+exports.expireSetCookies = expireSetCookies;
 exports.createAuthGetHandler = createAuthGetHandler;
 require("server-only");
 const node_async_hooks_1 = require("node:async_hooks");
@@ -284,19 +286,42 @@ function buildBetterAuthProviders(config) {
             clientSecret: oauth.clientSecret,
             scope: wireScopes.length > 0 ? wireScopes : undefined,
             /**
-             * 260419 — CLOSE THE SECOND SELF-SERVE PROVISIONING DOOR. 259805 gated
-             * the signup BFF on allow_public_registration, but the social lane never
-             * touches that code: better-auth creates the user through its own
-             * internalAdapter at the OAuth callback, and its ONLY guard is this flag.
+             * PAY-2005 — DISABLE-SIGN-UP IS REMOVED, DELIBERATELY. DO NOT RE-ADD IT.
              *
-             * Wired from the tenant's own policy, explicit-true-opens: the IDP config
-             * keeps allowPublicRegistration UNDEFINED when the tenant never answered
-             * (idp-client-config.ts, the no-fabricated-default rule), and an
-             * unanswered policy question must not provision accounts. That matches
-             * the FE's silent-default-is-decline posture for the "Create account"
-             * affordance. A tenant that wants Google self-serve says so.
+             * 260419 wired this from `config.authSettings?.allowPublicRegistration` to
+             * close a client-side self-serve provisioning door. It cannot do that job
+             * correctly, and it BREAKS SIGN-IN:
+             *
+             *   - This app runs better-auth in STATELESS mode (no DB adapter — see the
+             *     file header). better-auth therefore has NO user store, so at the OAuth
+             *     callback it cannot tell an EXISTING user from a NEW one. Its
+             *     handleOAuthUserInfo consults `disableSignUp` for BOTH, so
+             *     `disableSignUp: true` refuses a returning user exactly like a
+             *     stranger. Measured live 2026-09-30 (PAY-2005): portal.keelauth.com
+             *     Google sign-in bounced to /sign-in with Better Auth `signup_disabled`
+             *     once client 12's allow_public_registration reported false.
+             *
+             *   - The REAL registration gate already exists and is correct, at the IDP:
+             *     PayEz.External.Id.Api ExternalAuthController.oauth-callback looks the
+             *     user up by verified email (:799); an existing user logs in UNTOUCHED
+             *     (:811); only the isNewUser branch (:853) calls INewUserRegistrar,
+             *     which refuses fail-closed when the client forbids public registration
+             *     (NewUserRegistrar.cs:65, `SecurityFlags.AllowPublicRegistration != true`).
+             *     Its own comment states the contract: "existing federated users ...
+             *     log in untouched, so gating here never blocks login."
+             *
+             * So this flag was a DUPLICATE gate that could only ever misfire — it cannot
+             * distinguish new from existing, and the IDP already refuses new identities.
+             * Removing it restores sign-in for existing users WITHOUT reopening
+             * self-serve: a NEW identity that completes the better-auth leg still gets
+             * REFUSED at the IDP exchange and never receives IDP tokens, which is the
+             * portal's actual authorization gate.
+             *
+             * WHERE "no self-serve sign-up" IS ENFORCED NOW: the IDP's NewUserRegistrar
+             * (above) as the backstop, and each app's own front-door sign-up gate
+             * (e.g. the portal's signup-gate.ts / SignUpCard) for the UI affordance.
+             * Both are correct and neither is this flag.
              */
-            disableSignUp: config.authSettings?.allowPublicRegistration !== true,
             // Google is overly eager to reuse the last account unless we
             // explicitly ask for account selection on each social login.
             prompt: typeof rawPrompt === 'string'
@@ -748,6 +773,18 @@ function createBetterAuthInstance(idpConfig, opts = {}) {
                 refreshCache: false,
             },
         },
+        // PAY-1781 B: KEEP OAUTH STATE IN THE ENCRYPTED COOKIE, as it was on better-auth 1.5.6.
+        // 1.5.6 resolved the default as `options.database ? 'database' : 'cookie'` - we have no
+        // database, so: cookie. 1.6.13+ resolves it as `(database || secondaryStorage) ? 'database'
+        // : 'cookie'`, and we DO have secondaryStorage, so the upgrade alone would silently move every
+        // OAuth state record into Redis through the adapter above (its enrichment read-modify-write
+        // and key handling were built for session records, not state). Pinned so the upgrade changes
+        // the version, not the design. The cookie branch is where GHSA-wxw3-q3m9-c3jr lived; 1.6.2+
+        // compares the returned `state` with the nonce sealed in the cookie, and our provider is also
+        // pkce:true, which the advisory required to be false. Test: oauth-state-strategy-cookie.
+        account: {
+            storeStateStrategy: 'cookie',
+        },
         // Cookie prefix must match slim-middleware expectations ({slug}.session-token)
         advanced: {
             cookiePrefix: appSlug,
@@ -860,6 +897,12 @@ async function getBetterAuthHandler() {
  * header of the response to find the BA Redis key.
  *
  * This replaces the old databaseHooks approach which doesn't fire in stateless mode.
+ *
+ * RETURNS the IdP's own error code on an IDP refusal, or null otherwise
+ * (PAY-2005 scenario (b), BAPert ruling 67897). It used to return a bare
+ * boolean, so `REGISTRATION_NOT_ALLOWED` was indistinguishable from a network
+ * blip and every cause collapsed to one generic login-page code — a NEW user
+ * refused registration bounced silently, which is the failure Jon named.
  */
 async function exchangeOAuthForIdpTokens(sessionToken, provider = 'google') {
     try {
@@ -945,6 +988,36 @@ async function exchangeOAuthForIdpTokens(sessionToken, provider = 'google') {
         console.log('[BETTER_AUTH] IDP oauth-callback response:', { status: oauthRes.status, bodyLength: oauthResText.length });
         if (!oauthRes.ok) {
             console.error('[BETTER_AUTH] IDP oauth-callback failed:', oauthRes.status);
+            /**
+             * PAY-2005 scenario (b) — RETURN THE IDP'S ERROR CODE (BAPert ruling 67897).
+             *
+             * Every refusal used to return a bare `false`, so the abort collapsed ALL
+             * causes to one generic `OAUTH_SIGN_IN_FAILED`: a NEW user refused
+             * registration (`REGISTRATION_NOT_ALLOWED`, ExternalAuthController.cs:908)
+             * bounced silently, indistinguishable from a network blip. Jon named the
+             * clear message explicitly (67856): "(b) a brand-new Google user with
+             * registration OFF is refused by the IDP with a clear message, not a
+             * silent bounce."
+             *
+             * The envelope is `{ error: { code, message } }` (PayEzControllerBase.Error).
+             * We read ONLY `error.code` and return it VERBATIM — the abort puts it in
+             * the `?error=` param, and the HOST's allowlist decides whether to render
+             * it. The package does NOT interpret the code and does NOT add a message
+             * (that would be a second allowlist). No code in the body -> null (the
+             * generic host code), exactly as before.
+             */
+            let idpErrorCode = null;
+            try {
+                const parsed = JSON.parse(oauthResText);
+                // FORWARD ONLY AN ALLOWLISTED CODE. Every other refusal keeps PAY-1733's single neutral code — an
+                // unlisted code would render nothing on the host page, which is the silent bounce this exists to end.
+                if (typeof parsed?.error?.code === 'string' && exports.IDP_ERROR_CODES_TO_FORWARD.has(parsed.error.code)) {
+                    idpErrorCode = parsed.error.code;
+                }
+            }
+            catch {
+                /* non-JSON refusal body -> no code (generic abort) */
+            }
             /**
              * WHY THIS LOGS ONLY ON FAILURE, AND WHY IT LOGS THESE FIELDS.
              *
@@ -993,7 +1066,7 @@ async function exchangeOAuthForIdpTokens(sessionToken, provider = 'google') {
                 sent_client_id: (0, client_key_1.resolveClientKey)(config, 'auth/better-auth:oauth-callback').key ?? null,
                 idp_url: idpUrl,
             });
-            return false;
+            return idpErrorCode ?? false;
         }
         let idpData;
         try {
@@ -1113,6 +1186,7 @@ async function exchangeOAuthForIdpTokens(sessionToken, provider = 'google') {
         const stored = await storeIdpTokensInSession(sessionToken, idpTokenData, provider);
         if (stored)
             console.log('[BETTER_AUTH] IDP tokens stored in session for', email);
+        // true = success (tokens stored). false = a non-IdP failure with no specific code (generic abort).
         return stored;
     }
     catch (err) {
@@ -1202,12 +1276,87 @@ async function storeIdpTokensInSession(sessionToken, idpTokenData, authProvider)
         return false;
     }
 }
+/**
+ * The `?error=` code the login page receives when an OAuth sign-in is ABORTED because the IdP exchange did not
+ * store tokens (PAY-1733). Hosts map it to ONE neutral line; the card's words are "That sign-in didn't work.
+ * Try again or use another method." The cause stays in the server log, never on the page.
+ */
+exports.OAUTH_SIGN_IN_FAILED_ERROR = 'OAUTH_SIGN_IN_FAILED';
+/**
+ * The ONLY IdP refusal codes the package forwards to the login page (PAY-2005 (b), BAPert 67897).
+ *
+ * Default stays PAY-1733's ONE neutral code: the cause of an ordinary failed exchange lives in the server
+ * log, never on the page. A code is forwarded ONLY when it earns a distinct user-facing message — today just
+ * the registration refusal, so a NEW Google user with registration OFF sees a clear "not open to sign-up"
+ * line instead of a silent bounce. Adding a code here REQUIRES a matching entry in the host allowlist
+ * (portal: src/lib/auth/magic-link-outcome.ts); an unlisted code renders nothing, which is a silent bounce
+ * wearing a different number. Add them together, never one alone.
+ */
+exports.IDP_ERROR_CODES_TO_FORWARD = new Set(['REGISTRATION_NOT_ALLOWED']);
+/**
+ * Re-emit each cookie the callback response SET as an immediate expiry, keeping the attributes that decide
+ * WHICH cookie the browser overwrites (Path, Domain, Secure, SameSite, HttpOnly - a `__Secure-` name is only
+ * accepted with Secure) and dropping Expires/Max-Age in favour of Max-Age=0.
+ */
+function expireSetCookies(setCookies) {
+    const out = [];
+    for (const sc of setCookies) {
+        const [pair, ...attrs] = sc.split(';').map((s) => s.trim());
+        const eq = pair.indexOf('=');
+        const name = eq > 0 ? pair.slice(0, eq) : '';
+        if (!name)
+            continue;
+        const kept = attrs.filter((a) => /^(path|domain|secure|samesite|httponly)\b/i.test(a));
+        out.push([`${name}=`, ...kept, 'Max-Age=0'].join('; '));
+    }
+    return out;
+}
+/**
+ * PAY-1733 (Jon, live on :4797): ABORT an OAuth sign-in whose IdP exchange did not store tokens.
+ *
+ * Before this, a failed exchange was a console.error and the user kept the Better Auth session the callback had
+ * just created: signed in, holding NO IdP tokens. The host then routed that session to 2FA, which painted the
+ * user's email and failed every call - a red "sign in again" screen about an account the app could no longer
+ * authenticate. The IdP's 401 was CORRECT (it fail-closes unverified assertions); keeping the session was the bug.
+ *
+ * So: no session without IdP tokens. The Better Auth session is destroyed (its own signOut, best effort, then the
+ * `ba:<slug>:<token>` record directly - that record is what makes it resolvable), every cookie the callback set is
+ * expired, and the user goes to the login page with OAUTH_SIGN_IN_FAILED. Relative Location, as for the state-error
+ * branch above (328439: an absolute URL built from request.url is a dead tab in a container).
+ */
+async function abortOAuthSignIn(callbackResponse, sessionToken, cookieHeader, loginPath, errorCode = exports.OAUTH_SIGN_IN_FAILED_ERROR) {
+    const headers = new Headers();
+    if (sessionToken) {
+        try {
+            const auth = await getBetterAuthInstance();
+            const out = await auth?.api?.signOut?.({ headers: new Headers({ cookie: cookieHeader }), asResponse: true });
+            for (const sc of out?.headers?.getSetCookie?.() ?? [])
+                headers.append('set-cookie', sc);
+        }
+        catch (err) {
+            console.warn('[BETTER_AUTH] abort: Better Auth signOut failed, deleting the record directly:', err instanceof Error ? err.message : String(err));
+        }
+        try {
+            const config = await (0, idp_client_config_1.getIDPClientConfig)();
+            await (0, redis_1.getRedis)().del(`ba:${config.clientSlug || (0, app_slug_1.getAppSlug)()}:${sessionToken}`);
+        }
+        catch (err) {
+            console.error('[BETTER_AUTH] abort: could not delete the Better Auth session record', (0, token_log_id_1.tokenLogId)(sessionToken), err instanceof Error ? err.message : String(err));
+        }
+    }
+    for (const sc of expireSetCookies(callbackResponse.headers.getSetCookie?.() ?? []))
+        headers.append('set-cookie', sc);
+    headers.set('location', `${loginPath}${loginPath.includes('?') ? '&' : '?'}error=${errorCode}`);
+    console.warn('[BETTER_AUTH] OAuth sign-in ABORTED: the IdP exchange stored no tokens, so no session is kept (PAY-1733)', sessionToken ? (0, token_log_id_1.tokenLogId)(sessionToken) : '(no session)', 'code=' + errorCode);
+    return new Response(null, { status: 302, headers });
+}
 /**
  * Create a production-ready GET handler for the auth catch-all route.
  *
  * Wraps better-auth's GET handler with:
  * - OAuth state error recovery (redirects to login instead of error page)
- * - IDP token exchange after successful OAuth callback
+ * - IDP token exchange after successful OAuth callback - and, when it stores no tokens, the sign-in is ABORTED
+ *   (session destroyed, cookies expired, login page with OAUTH_SIGN_IN_FAILED; PAY-1733)
  *
  * Usage in host app:
  * ```ts
@@ -1276,22 +1425,29 @@ function createAuthGetHandler(loginPath = '/account-auth/login') {
                     return new Response(null, { status: 302, headers: { location: loginPath } });
                 }
             }
-            // After successful OAuth callback: exchange Google identity for IDP tokens
+            // After the OAuth callback: exchange the provider identity for IDP tokens. If that does NOT store tokens - the
+            // IdP refused (401), no session was found, or anything threw - the sign-in is ABORTED (PAY-1733). A session is
+            // kept only when it holds IdP tokens.
             const url = new URL(request.url);
             if (url.pathname.includes('/callback/') && response.status === 302) {
+                const setCookies = response.headers.getSetCookie?.() || [];
+                const cookieHeader = setCookies
+                    .map((c) => c.split(';')[0])
+                    .join('; ');
+                let sessionToken = null;
+                // true = tokens stored; false = no specific IdP code (generic abort); a string = the IdP's own refusal code
+                // (PAY-2005 (b): REGISTRATION_NOT_ALLOWED, etc.), forwarded so the host can show a clear message.
+                let exchange = false;
                 try {
                     const auth = await getBetterAuthInstance();
                     if (auth?.api?.getSession) {
-                        const setCookies = response.headers.getSetCookie?.() || [];
-                        const cookieHeader = setCookies
-                            .map((c) => c.split(';')[0])
-                            .join('; ');
                         const headers = new Headers();
                         headers.set('cookie', cookieHeader);
                         const session = await auth.api.getSession({ headers });
                         if (session?.session?.token) {
+                            sessionToken = session.session.token;
                             console.log('[BETTER_AUTH] Got session token from callback:', (0, token_log_id_1.tokenLogId)(session.session.token), '| email:', session.user?.email);
-                            await exchangeOAuthForIdpTokens(session.session.token);
+                            exchange = await exchangeOAuthForIdpTokens(session.session.token);
                         }
                         else {
                             console.warn('[BETTER_AUTH] Could not get session after OAuth callback');
@@ -1301,6 +1457,11 @@ function createAuthGetHandler(loginPath = '/account-auth/login') {
                 catch (err) {
                     console.error('[BETTER_AUTH] IDP token exchange failed:', err.message);
                 }
+                if (exchange !== true) {
+                    // A specific IdP error code goes on the URL; otherwise the generic OAUTH_SIGN_IN_FAILED.
+                    const errorCode = typeof exchange === 'string' ? exchange : exports.OAUTH_SIGN_IN_FAILED_ERROR;
+                    return abortOAuthSignIn(response, sessionToken, cookieHeader, loginPath, errorCode);
+                }
             }
             return response;
         });