@payez/next-mvp 4.4.6 → 4.4.8

package/dist/middleware/create-middleware.js

@@ -18,6 +18,7 @@
  *   });
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.TWO_FACTOR_TIMEOUT_ERROR = void 0;
 exports.createMvpMiddleware = createMvpMiddleware;
 const server_1 = require("next/server");
 const route_config_1 = require("../auth/route-config");
@@ -143,6 +144,26 @@ function refreshFailureResponse(request, location, errorCode, clearCookies = fal
 function makeAuthDecision(ctx) {
     const { pathname, isPublicRoute, isLoginPage: onLoginPage, searchParams, sessionPointer, sessionStatus, circuitBreakerOpen } = ctx;
     const safeCallback = getSafeCallbackUrl(pathname);
+    // --- PAY-884: a provisional (pre-2FA) session whose token has expired can never finish 2FA ---
+    // The IdP issues no refresh token until 2FA completes, and it validates token lifetime, so
+    // once the provisional access token expires neither refresh nor code verification can
+    // succeed. Sending the user to the verify-code page (or to error=SessionExpired, which the
+    // login page deliberately shows as NO message) strands them mid-2FA with no explanation.
+    // Say what happened instead, and clear the dead session so the next sign-in starts clean.
+    // Scoped to the verify-code page and protected pages: /api/ keeps its 401-JSON carve-out
+    // (307290), the login page stays reachable, and public pages are left to the existing arms.
+    if (isExpiredProvisionalSession(sessionPointer, sessionStatus) &&
+        !pathname.startsWith('/api/') &&
+        !onLoginPage &&
+        (pathname === VERIFY_CODE_PAGE || !isPublicRoute)) {
+        const callback = pathname === VERIFY_CODE_PAGE ? getSafeCallbackUrl(pathname, searchParams) : safeCallback;
+        return {
+            type: 'redirect',
+            location: `${LOGIN_PAGE}?callbackUrl=${encodeURIComponent(callback)}&error=${exports.TWO_FACTOR_TIMEOUT_ERROR}`,
+            reason: 'pre_2fa_token_expired',
+            clearCookies: true,
+        };
+    }
     // --- Public routes: Allow, but enforce 2FA for authenticated users ---
     if (isPublicRoute && !onLoginPage) {
         if (needsTwoFactorRedirect(pathname, sessionPointer, sessionStatus)) {
@@ -249,6 +270,21 @@ function makeAuthDecision(ctx) {
     // --- All checks passed ---
     return { type: 'allow' };
 }
+/** Login error code for a pre-2FA session that expired before the code was verified (PAY-884). */
+exports.TWO_FACTOR_TIMEOUT_ERROR = 'TwoFactorTimeout';
+/**
+ * PAY-884: 2FA outstanding, access token expired, and no refresh token to renew it.
+ * Only a viability answer that positively says the session exists qualifies (null = check failed).
+ */
+function isExpiredProvisionalSession(session, status) {
+    return (session.exists &&
+        status.exists === true &&
+        status.forceInvalid === false &&
+        status.requires2FA &&
+        !status.twoFactorComplete &&
+        session.expired === true &&
+        !session.hasRefreshToken);
+}
 /** Check if user needs 2FA redirect */
 function needsTwoFactorRedirect(pathname, session, status) {
     if (!session.exists || !status.exists)

package/dist/pages/login/page.js

@@ -131,6 +131,11 @@ function LoginForm({ altAuthSlot }) {
                 console.log('[LOGIN] SessionExpired detected - normal behavior');
                 friendlyError = null;
             }
+            else if (urlError === 'TwoFactorTimeout') {
+                // PAY-884: the sign-in expired while the verification code was outstanding. Unlike
+                // SessionExpired this is NOT silent - the user was mid-2FA and must know why they are here.
+                friendlyError = 'Your verification step timed out before the code was confirmed. Please sign in again.';
+            }
             else if (urlError === 'ServiceUnavailable') {
                 friendlyError = 'Authentication service is temporarily unavailable. Please try again in a few minutes.';
             }

package/dist/pages/verify-code/page.js

@@ -302,7 +302,8 @@ function VerifyCodeForm({ enrollHref }) {
                         sessionStorage.removeItem(VERIFY_IN_PROGRESS_KEY);
                     }
                     const safeCallback = callbackUrl.startsWith('/account-auth/') ? '/dashboard' : callbackUrl;
-                    const errorParam = isJwtExpired ? '&error=SessionExpired' : '';
+                    // PAY-884: an expired JWT here is the provisional pre-2FA token - say so on the login page.
+                    const errorParam = isJwtExpired ? '&error=TwoFactorTimeout' : '';
                     router.push(`/account-auth/login?callbackUrl=${encodeURIComponent(safeCallback)}${errorParam}`);
                 }, 1500);
                 return;
@@ -366,7 +367,8 @@ function VerifyCodeForm({ enrollHref }) {
                         sessionStorage.removeItem(VERIFY_IN_PROGRESS_KEY);
                     }
                     const safeCallback = callbackUrl.startsWith('/account-auth/') ? '/dashboard' : callbackUrl;
-                    const errorParam = isJwtExpired ? '&error=SessionExpired' : '';
+                    // PAY-884: an expired JWT here is the provisional pre-2FA token - say so on the login page.
+                    const errorParam = isJwtExpired ? '&error=TwoFactorTimeout' : '';
                     router.push(`/account-auth/login?callbackUrl=${encodeURIComponent(safeCallback)}${errorParam}`);
                 }, 1500);
                 return;

package/dist/routes/auth/settings.js

@@ -31,6 +31,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.GET = GET;
 const server_1 = require("next/server");
 const idp_client_config_1 = require("../../lib/idp-client-config");
+const never_in_response_1 = require("../../lib/never-in-response");
 /**
  * Fail closed and LOUD. 503 + success:false + a code, and CRUCIALLY no policy
  * fields at all - not defaults, not partials. A consumer cannot mistake an
@@ -105,5 +106,7 @@ async function GET() {
         require2FA: authSettings.require2FA,
         allowed2FAMethods: authSettings.allowed2FAMethods,
     };
-    return server_1.NextResponse.json({ success: true, data: settings }, { headers: { 'Cache-Control': 'no-store' } });
+    // PAY-1529: the public policy is built from an allowlist above; secretSafeJson is the runtime backstop
+    // that answers 500 instead of serving it if a registered secret ever reaches this body anyway.
+    return (0, never_in_response_1.secretSafeJson)({ success: true, data: settings }, { headers: { 'Cache-Control': 'no-store' } }, 'GET /api/auth/settings');
 }

package/dist/server/auth.d.ts

@@ -24,300 +24,42 @@ export type IdpTokenResult = {
     terminal: false;
     sessionData: SessionData;
 };
-export declare function getAuthInstance(): Promise<import("better-auth/types").Auth<{
-    baseURL: string;
-    secret: string;
-    socialProviders: Record<string, import("../auth/better-auth").BetterAuthSocialProvider>;
-    trustedOrigins: string[];
-    secondaryStorage: {
-        get: (key: string) => Promise<string | null>;
-        set: (key: string, value: string, ttl?: number) => Promise<void>;
-        delete: (key: string) => Promise<void>;
-    };
-    session: {
-        cookieCache: {
-            enabled: false;
-            maxAge: number;
-            refreshCache: false;
-        };
-    };
-    advanced: {
-        cookiePrefix: string;
-        cookies: {
-            session_token: {
-                name: string;
-            };
-        };
-    };
-    plugins: [{
-        id: "next-cookies";
-        hooks: {
-            before: {
-                matcher(ctx: import("@better-auth/core").HookEndpointContext): boolean;
-                handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
-            }[];
-            after: {
-                matcher(ctx: import("@better-auth/core").HookEndpointContext): true;
-                handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
-            }[];
-        };
-    }, ...(import("@better-auth/core").BetterAuthPlugin | {
-        id: "magic-link";
-        endpoints: {
-            signInMagicLink: import("better-call").StrictEndpoint<"/sign-in/magic-link", {
-                method: "POST";
-                requireHeaders: true;
-                body: import("zod").ZodObject<{
-                    email: import("zod").ZodEmail;
-                    name: import("zod").ZodOptional<import("zod").ZodString>;
-                    callbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                    newUserCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                    errorCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                    metadata: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
-                }, import("better-auth/*").$strip>;
-                metadata: {
-                    openapi: {
-                        operationId: string;
-                        description: string;
-                        responses: {
-                            200: {
-                                description: string;
-                                content: {
-                                    "application/json": {
-                                        schema: {
-                                            type: "object";
-                                            properties: {
-                                                status: {
-                                                    type: string;
-                                                };
-                                            };
-                                        };
-                                    };
-                                };
-                            };
-                        };
-                    };
-                };
-            }, {
-                status: boolean;
-            }>;
-            magicLinkVerify: import("better-call").StrictEndpoint<"/magic-link/verify", {
-                method: "GET";
-                query: import("zod").ZodObject<{
-                    token: import("zod").ZodString;
-                    callbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                    errorCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                    newUserCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                }, import("better-auth/*").$strip>;
-                use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>)[];
-                requireHeaders: true;
-                metadata: {
-                    openapi: {
-                        operationId: string;
-                        description: string;
-                        responses: {
-                            200: {
-                                description: string;
-                                content: {
-                                    "application/json": {
-                                        schema: {
-                                            type: "object";
-                                            properties: {
-                                                session: {
-                                                    $ref: string;
-                                                };
-                                                user: {
-                                                    $ref: string;
-                                                };
-                                            };
-                                        };
-                                    };
-                                };
-                            };
-                        };
-                    };
-                };
-            }, {
-                token: string;
-                user: {
-                    id: string;
-                    createdAt: Date;
-                    updatedAt: Date;
-                    email: string;
-                    emailVerified: boolean;
-                    name: string;
-                    image?: string | null | undefined;
-                };
-            }>;
-        };
-        rateLimit: {
-            pathMatcher(path: string): boolean;
-            window: number;
-            max: number;
-        }[];
-        options: import("better-auth/plugins/magic-link").MagicLinkOptions;
-    } | {
-        id: "generic-oauth";
-        init: (ctx: import("@better-auth/core").AuthContext) => {
-            context: {
-                socialProviders: import("better-auth/*").OAuthProvider<Record<string, any>, Partial<import("better-auth/*").ProviderOptions<any>>>[];
-            };
-        };
-        endpoints: {
-            signInWithOAuth2: import("better-call").StrictEndpoint<"/sign-in/oauth2", {
-                method: "POST";
-                body: import("zod").ZodObject<{
-                    providerId: import("zod").ZodString;
-                    callbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                    errorCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                    newUserCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                    disableRedirect: import("zod").ZodOptional<import("zod").ZodBoolean>;
-                    scopes: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
-                    requestSignUp: import("zod").ZodOptional<import("zod").ZodBoolean>;
-                    additionalData: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
-                }, import("better-auth/*").$strip>;
-                metadata: {
-                    openapi: {
-                        description: string;
-                        responses: {
-                            200: {
-                                description: string;
-                                content: {
-                                    "application/json": {
-                                        schema: {
-                                            type: "object";
-                                            properties: {
-                                                url: {
-                                                    type: string;
-                                                };
-                                                redirect: {
-                                                    type: string;
-                                                };
-                                            };
-                                        };
-                                    };
-                                };
-                            };
-                        };
-                    };
-                };
-            }, {
-                url: string;
-                redirect: boolean;
-            }>;
-            oAuth2Callback: import("better-call").StrictEndpoint<"/oauth2/callback/:providerId", {
-                method: "GET";
-                query: import("zod").ZodObject<{
-                    code: import("zod").ZodOptional<import("zod").ZodString>;
-                    error: import("zod").ZodOptional<import("zod").ZodString>;
-                    error_description: import("zod").ZodOptional<import("zod").ZodString>;
-                    state: import("zod").ZodOptional<import("zod").ZodString>;
-                    iss: import("zod").ZodOptional<import("zod").ZodString>;
-                }, import("better-auth/*").$strip>;
-                metadata: {
-                    allowedMediaTypes: string[];
-                    openapi: {
-                        description: string;
-                        responses: {
-                            200: {
-                                description: string;
-                                content: {
-                                    "application/json": {
-                                        schema: {
-                                            type: "object";
-                                            properties: {
-                                                url: {
-                                                    type: string;
-                                                };
-                                            };
-                                        };
-                                    };
-                                };
-                            };
-                        };
-                    };
-                    scope: "server";
-                };
-            }, void>;
-            oAuth2LinkAccount: import("better-call").StrictEndpoint<"/oauth2/link", {
-                method: "POST";
-                body: import("zod").ZodObject<{
-                    providerId: import("zod").ZodString;
-                    callbackURL: import("zod").ZodString;
-                    scopes: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
-                    errorCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                }, import("better-auth/*").$strip>;
-                use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
-                    session: {
-                        session: Record<string, any> & {
-                            id: string;
-                            createdAt: Date;
-                            updatedAt: Date;
-                            userId: string;
-                            expiresAt: Date;
-                            token: string;
-                            ipAddress?: string | null | undefined;
-                            userAgent?: string | null | undefined;
-                        };
-                        user: Record<string, any> & {
-                            id: string;
-                            createdAt: Date;
-                            updatedAt: Date;
-                            email: string;
-                            emailVerified: boolean;
-                            name: string;
-                            image?: string | null | undefined;
-                        };
-                    };
-                }>)[];
-                metadata: {
-                    openapi: {
-                        description: string;
-                        responses: {
-                            "200": {
-                                description: string;
-                                content: {
-                                    "application/json": {
-                                        schema: {
-                                            type: "object";
-                                            properties: {
-                                                url: {
-                                                    type: string;
-                                                    format: string;
-                                                    description: string;
-                                                };
-                                                redirect: {
-                                                    type: string;
-                                                    description: string;
-                                                    enum: boolean[];
-                                                };
-                                            };
-                                            required: string[];
-                                        };
-                                    };
-                                };
-                            };
-                        };
-                    };
-                };
-            }, {
-                url: string;
-                redirect: boolean;
-            }>;
-        };
-        options: import("better-auth/plugins/generic-oauth").GenericOAuthOptions;
-        $ERROR_CODES: {
-            INVALID_OAUTH_CONFIGURATION: import("better-auth/*").RawError<"INVALID_OAUTH_CONFIGURATION">;
-            TOKEN_URL_NOT_FOUND: import("better-auth/*").RawError<"TOKEN_URL_NOT_FOUND">;
-            PROVIDER_CONFIG_NOT_FOUND: import("better-auth/*").RawError<"PROVIDER_CONFIG_NOT_FOUND">;
-            PROVIDER_ID_REQUIRED: import("better-auth/*").RawError<"PROVIDER_ID_REQUIRED">;
-            INVALID_OAUTH_CONFIG: import("better-auth/*").RawError<"INVALID_OAUTH_CONFIG">;
-            SESSION_REQUIRED: import("better-auth/*").RawError<"SESSION_REQUIRED">;
-            ISSUER_MISMATCH: import("better-auth/*").RawError<"ISSUER_MISMATCH">;
-            ISSUER_MISSING: import("better-auth/*").RawError<"ISSUER_MISSING">;
-        };
-    })[]];
-}>>;
+/**
+ * Get the initialized Better Auth instance (singleton).
+ *
+ * 244549: the single-flight memoisation lives in lib/single-flight.ts rather
+ * than inline here, and that placement is deliberate rather than tidiness.
+ * The bug being fixed -- a REJECTED init promise cached for the life of the
+ * process, so recovery was restart-only -- went unnoticed precisely because
+ * this module cannot be loaded in a unit test: importing it pulls in
+ * better-auth and the whole IDP config stack. Extracted into a zero-import
+ * module, the retry semantics are covered by
+ * test/single-flight-retry.test.cjs, which imports dist/ and therefore
+ * exercises the artefact that actually ships.
+ *
+ * PAY-1623 (package half, BAPert 62449): THIS FUNNEL NO LONGER BUILDS ITS OWN
+ * INSTANCE. It used to call `createBetterAuthInstance(config)` with no opts, so
+ * it carried NONE of the app-supplied plugins registered by the host app at
+ * startup (`configureBetterAuth()` -> `state.configuredOpts`). `samlAcs()` and
+ * `passkeySignIn()` arrive only that way, so `getAuthInstance()` returned an
+ * instance on which `auth.api.samlAcs` was `undefined` — the exact package twin
+ * of the portal ACS crash `t.api.samlAcs is not a function` (Jon's walk,
+ * 2026-09-21; Portal PR 517 fixed the portal by importing the CONFIGURED
+ * instance, `getBetterAuthInstance`, which is why this file must now resolve the
+ * same one). It also silently created a SECOND, divergent instance beside the
+ * one every /api/auth/* route uses — two instances, two secrets, one process.
+ *
+ * It now DELEGATES to that configured funnel, which is the single source of
+ * truth for the process's Better Auth instance:
+ *   - it carries `state.configuredOpts` (better-auth.ts:930), so the app
+ *     plugins are present;
+ *   - its init is already single-flighted with the retry semantics described in
+ *     lib/single-flight.ts (see getBetterAuthInstance, card 244549/338215), so
+ *     this function keeps the same no-latch recovery contract;
+ *   - there is now ONE instance, so the double-init / divergent-secret hazard
+ *     this path used to create is gone by construction.
+ */
+export declare function getAuthInstance(): Promise<any>;
 /**
  * Get the current session from a request.
  *

package/dist/server/auth.js

@@ -47,11 +47,8 @@ exports.getFreshIdpToken = getFreshIdpToken;
 exports.requireSession = requireSession;
 require("server-only");
 const better_auth_1 = require("../auth/better-auth");
-const idp_client_config_1 = require("../lib/idp-client-config");
 const session_store_1 = require("../lib/session-store");
 const verified_session_token_1 = require("./verified-session-token");
-const single_flight_1 = require("../lib/single-flight");
-let authInstance = null;
 function buildSessionDataFromAuthSession(session) {
     const user = session?.user;
     if (!user?.id && !user?.email) {
@@ -116,30 +113,30 @@ function attachSessionData(session, sessionData, sessionToken) {
  * test/single-flight-retry.test.cjs, which imports dist/ and therefore
  * exercises the artefact that actually ships.
  *
- * Semantics, all asserted by that suite: concurrent callers share ONE
- * underlying init; a rejection reaches every caller awaiting that attempt
- * (failures stay loud -- getIDPClientConfig is fail-loud by design and callers
- * depend on it); the NEXT call after a failure starts a fresh attempt; and a
- * slow failure never evicts a newer in-flight attempt.
+ * PAY-1623 (package half, BAPert 62449): THIS FUNNEL NO LONGER BUILDS ITS OWN
+ * INSTANCE. It used to call `createBetterAuthInstance(config)` with no opts, so
+ * it carried NONE of the app-supplied plugins registered by the host app at
+ * startup (`configureBetterAuth()` -> `state.configuredOpts`). `samlAcs()` and
+ * `passkeySignIn()` arrive only that way, so `getAuthInstance()` returned an
+ * instance on which `auth.api.samlAcs` was `undefined` — the exact package twin
+ * of the portal ACS crash `t.api.samlAcs is not a function` (Jon's walk,
+ * 2026-09-21; Portal PR 517 fixed the portal by importing the CONFIGURED
+ * instance, `getBetterAuthInstance`, which is why this file must now resolve the
+ * same one). It also silently created a SECOND, divergent instance beside the
+ * one every /api/auth/* route uses — two instances, two secrets, one process.
+ *
+ * It now DELEGATES to that configured funnel, which is the single source of
+ * truth for the process's Better Auth instance:
+ *   - it carries `state.configuredOpts` (better-auth.ts:930), so the app
+ *     plugins are present;
+ *   - its init is already single-flighted with the retry semantics described in
+ *     lib/single-flight.ts (see getBetterAuthInstance, card 244549/338215), so
+ *     this function keeps the same no-latch recovery contract;
+ *   - there is now ONE instance, so the double-init / divergent-secret hazard
+ *     this path used to create is gone by construction.
  */
-const authInit = (0, single_flight_1.createSingleFlight)(async () => {
-    const config = await (0, idp_client_config_1.getIDPClientConfig)(true);
-    authInstance = (0, better_auth_1.createBetterAuthInstance)(config);
-    // 185121 line 1, path 2: this module-scope instance had NO creation log
-    // line — first-called during a config transition window it pinned a
-    // divergent secret INVISIBLY. Name the path and the secret fingerprint
-    // (the createBetterAuthInstance line already logged the same hash;
-    // this line is what attributes it to THIS init path).
-    // Guard matches createBetterAuthInstance's: getIDPClientConfig currently
-    // throws FATAL on a missing authSecret (QAPert 27328 verified), but that
-    // guarantee is one refactor away — log ABSENT rather than ever throw here.
-    console.log(`[AUTH] getAuthInstance: created BA instance via server/auth.ts — authSecret ${config.authSecret ? `sha256:${(0, better_auth_1.secretFingerprint)(config.authSecret)}` : 'ABSENT'}`);
-    return authInstance;
-});
 async function getAuthInstance() {
-    if (authInstance)
-        return authInstance;
-    return authInit.get();
+    return (0, better_auth_1.getBetterAuthInstance)();
 }
 /**
  * Get the current session from a request.