@payez/next-mvp 4.4.7 → 4.4.9

package/dist/api-handlers/account/reset-password.js

@@ -72,7 +72,9 @@ async function POST(req) {
         if (!upstream.ok) {
             // PAY-1591: a password-policy refusal also carries the KNOWN rule codes so the page can say which rules failed.
             const rules = (0, safe_error_response_1.projectPasswordPolicyRules)(data);
-            return server_1.NextResponse.json({ ...(0, safe_error_response_1.idpErrorEnvelope)(data, 'Failed to reset password'), ...(rules !== undefined ? { password_policy: { rules } } : {}), ...((0, safe_error_response_1.projectResetTokenInvalid)(data) ? { reset_token_invalid: true } : {}) }, { status: upstream.status });
+            // PAY-2103: a breached-password refusal is a distinct 400; project a BOOLEAN so the anonymous
+            // route carries no code text and the page picks its own sentence.
+            return server_1.NextResponse.json({ ...(0, safe_error_response_1.idpErrorEnvelope)(data, 'Failed to reset password'), ...(rules !== undefined ? { password_policy: { rules } } : {}), ...((0, safe_error_response_1.projectResetTokenInvalid)(data) ? { reset_token_invalid: true } : {}), ...((0, safe_error_response_1.projectPasswordBreached)(data) ? { password_breached: true } : {}) }, { status: upstream.status });
         }
         return server_1.NextResponse.json(data, { status: upstream.status });
     }

package/dist/api-handlers/session/viability.js

@@ -12,6 +12,7 @@ const auth_1 = require("../../server/auth");
 const startup_init_1 = require("../../lib/startup-init");
 const idp_client_config_1 = require("../../lib/idp-client-config");
 const token_log_id_1 = require("../../lib/token-log-id");
+const sessions_1 = require("../../vibe/sessions");
 async function GET(req) {
     try {
         // Ensure initialization is complete (auth signing secret resolved from IDP)
@@ -124,12 +125,43 @@ async function GET(req) {
                         hoursExpiredAgo: ((Date.now() - mfaExpiresAt) / (1000 * 60 * 60)).toFixed(1)
                     });
                 }
+                // --- Session revocation status (PAY-1882 step 4 producer half) ---
+                // The four-state status (BAPert 66320). The middleware fails CLOSED by
+                // default on 'unknown' (a failed Vibe read) and always on 'revoked';
+                // 'active' and 'not_configured' stay viable. A consumer that does not
+                // read revocationStatus is unaffected - absent is not revoked.
+                let revocationStatus = 'not_configured';
+                // BAPert 66480 condition 2 / ruling (ii) 66700: the numeric IdP id comes from
+                // the token's own `sub` claim FIRST (session.userId can be an email).
+                const revocationUserId = (0, sessions_1.resolveNumericIdpUserId)(sessionData, sessionData.idpAccessToken);
+                if (revocationUserId > 0) {
+                    try {
+                        revocationStatus = await (0, sessions_1.getRevocationStatus)(revocationUserId, sessionToken);
+                    }
+                    catch {
+                        // getRevocationStatus does not throw by contract; fail closed if it ever does.
+                        revocationStatus = 'unknown';
+                    }
+                }
+                else {
+                    // N1 (NightHawk 66392): a session EXISTS but its userId is not a usable
+                    // numeric IdP id, so the check could not be run. That is 'unknown'
+                    // (could not determine), NOT 'not_configured' (no revocation source) -
+                    // the two must not be conflated.
+                    // BAPert 66480 condition 1: emit ONE WARN (shape only) per session.
+                    revocationStatus = (0, sessions_1.warnNonNumericUserId)(sessionToken, sessionData.userId);
+                }
                 const response = {
                     authenticated: true,
                     sessionTokenId: (0, token_log_id_1.tokenLogId)(sessionToken), // PAY-1481: correlation id for middleware tracking, never the token
                     // 2FA fields - critical for middleware redirect logic
                     requires2FA, // From cached client config (client-wide setting)
                     twoFactorComplete: effectiveTwoFactorComplete, // From session, BUT respects MFA TTL
+                    // Session revocation (PAY-1882 step 4): the four-state status, plus the
+                    // boolean the middleware's existing force-invalid branch already reads.
+                    revocationStatus,
+                    forceInvalid: revocationStatus === 'revoked' || revocationStatus === 'unknown',
+                    revoked: revocationStatus === 'revoked',
                     // Cards 141688/141741 — the IDP's routing decision, relayed verbatim.
                     //
                     // THIS IS THE SECOND IMPLEMENTATION OF VIABILITY. The other is

package/dist/auth/better-auth.d.ts

@@ -536,8 +536,14 @@ export declare function getBetterAuthHandler(): Promise<{
  * header of the response to find the BA Redis key.
  *
  * This replaces the old databaseHooks approach which doesn't fire in stateless mode.
+ *
+ * RETURNS the IdP's own error code on an IDP refusal, or null otherwise
+ * (PAY-2005 scenario (b), BAPert ruling 67897). It used to return a bare
+ * boolean, so `REGISTRATION_NOT_ALLOWED` was indistinguishable from a network
+ * blip and every cause collapsed to one generic login-page code — a NEW user
+ * refused registration bounced silently, which is the failure Jon named.
  */
-export declare function exchangeOAuthForIdpTokens(sessionToken: string, provider?: string): Promise<boolean>;
+export declare function exchangeOAuthForIdpTokens(sessionToken: string, provider?: string): Promise<boolean | string>;
 /**
  * Write IDP tokens into an EXISTING Better Auth session. Storage only — this
  * function never acquires tokens and never decides who the caller is.
@@ -588,6 +594,17 @@ export declare function storeIdpTokensInSession(sessionToken: string, idpTokenDa
  * Try again or use another method." The cause stays in the server log, never on the page.
  */
 export declare const OAUTH_SIGN_IN_FAILED_ERROR = "OAUTH_SIGN_IN_FAILED";
+/**
+ * The ONLY IdP refusal codes the package forwards to the login page (PAY-2005 (b), BAPert 67897).
+ *
+ * Default stays PAY-1733's ONE neutral code: the cause of an ordinary failed exchange lives in the server
+ * log, never on the page. A code is forwarded ONLY when it earns a distinct user-facing message — today just
+ * the registration refusal, so a NEW Google user with registration OFF sees a clear "not open to sign-up"
+ * line instead of a silent bounce. Adding a code here REQUIRES a matching entry in the host allowlist
+ * (portal: src/lib/auth/magic-link-outcome.ts); an unlisted code renders nothing, which is a silent bounce
+ * wearing a different number. Add them together, never one alone.
+ */
+export declare const IDP_ERROR_CODES_TO_FORWARD: ReadonlySet<string>;
 /**
  * Re-emit each cookie the callback response SET as an immediate expiry, keeping the attributes that decide
  * WHICH cookie the browser overwrites (Path, Domain, Secure, SameSite, HttpOnly - a `__Secure-` name is only

package/dist/auth/better-auth.js

@@ -43,7 +43,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OAUTH_SIGN_IN_FAILED_ERROR = void 0;
+exports.IDP_ERROR_CODES_TO_FORWARD = exports.OAUTH_SIGN_IN_FAILED_ERROR = void 0;
 exports.secretFingerprint = secretFingerprint;
 exports.buildIdpOAuthProviderConfig = buildIdpOAuthProviderConfig;
 exports.buildBetterAuthProviders = buildBetterAuthProviders;
@@ -286,19 +286,42 @@ function buildBetterAuthProviders(config) {
             clientSecret: oauth.clientSecret,
             scope: wireScopes.length > 0 ? wireScopes : undefined,
             /**
-             * 260419 — CLOSE THE SECOND SELF-SERVE PROVISIONING DOOR. 259805 gated
-             * the signup BFF on allow_public_registration, but the social lane never
-             * touches that code: better-auth creates the user through its own
-             * internalAdapter at the OAuth callback, and its ONLY guard is this flag.
+             * PAY-2005 — DISABLE-SIGN-UP IS REMOVED, DELIBERATELY. DO NOT RE-ADD IT.
              *
-             * Wired from the tenant's own policy, explicit-true-opens: the IDP config
-             * keeps allowPublicRegistration UNDEFINED when the tenant never answered
-             * (idp-client-config.ts, the no-fabricated-default rule), and an
-             * unanswered policy question must not provision accounts. That matches
-             * the FE's silent-default-is-decline posture for the "Create account"
-             * affordance. A tenant that wants Google self-serve says so.
+             * 260419 wired this from `config.authSettings?.allowPublicRegistration` to
+             * close a client-side self-serve provisioning door. It cannot do that job
+             * correctly, and it BREAKS SIGN-IN:
+             *
+             *   - This app runs better-auth in STATELESS mode (no DB adapter — see the
+             *     file header). better-auth therefore has NO user store, so at the OAuth
+             *     callback it cannot tell an EXISTING user from a NEW one. Its
+             *     handleOAuthUserInfo consults `disableSignUp` for BOTH, so
+             *     `disableSignUp: true` refuses a returning user exactly like a
+             *     stranger. Measured live 2026-09-30 (PAY-2005): portal.keelauth.com
+             *     Google sign-in bounced to /sign-in with Better Auth `signup_disabled`
+             *     once client 12's allow_public_registration reported false.
+             *
+             *   - The REAL registration gate already exists and is correct, at the IDP:
+             *     PayEz.External.Id.Api ExternalAuthController.oauth-callback looks the
+             *     user up by verified email (:799); an existing user logs in UNTOUCHED
+             *     (:811); only the isNewUser branch (:853) calls INewUserRegistrar,
+             *     which refuses fail-closed when the client forbids public registration
+             *     (NewUserRegistrar.cs:65, `SecurityFlags.AllowPublicRegistration != true`).
+             *     Its own comment states the contract: "existing federated users ...
+             *     log in untouched, so gating here never blocks login."
+             *
+             * So this flag was a DUPLICATE gate that could only ever misfire — it cannot
+             * distinguish new from existing, and the IDP already refuses new identities.
+             * Removing it restores sign-in for existing users WITHOUT reopening
+             * self-serve: a NEW identity that completes the better-auth leg still gets
+             * REFUSED at the IDP exchange and never receives IDP tokens, which is the
+             * portal's actual authorization gate.
+             *
+             * WHERE "no self-serve sign-up" IS ENFORCED NOW: the IDP's NewUserRegistrar
+             * (above) as the backstop, and each app's own front-door sign-up gate
+             * (e.g. the portal's signup-gate.ts / SignUpCard) for the UI affordance.
+             * Both are correct and neither is this flag.
              */
-            disableSignUp: config.authSettings?.allowPublicRegistration !== true,
             // Google is overly eager to reuse the last account unless we
             // explicitly ask for account selection on each social login.
             prompt: typeof rawPrompt === 'string'
@@ -874,6 +897,12 @@ async function getBetterAuthHandler() {
  * header of the response to find the BA Redis key.
  *
  * This replaces the old databaseHooks approach which doesn't fire in stateless mode.
+ *
+ * RETURNS the IdP's own error code on an IDP refusal, or null otherwise
+ * (PAY-2005 scenario (b), BAPert ruling 67897). It used to return a bare
+ * boolean, so `REGISTRATION_NOT_ALLOWED` was indistinguishable from a network
+ * blip and every cause collapsed to one generic login-page code — a NEW user
+ * refused registration bounced silently, which is the failure Jon named.
  */
 async function exchangeOAuthForIdpTokens(sessionToken, provider = 'google') {
     try {
@@ -959,6 +988,36 @@ async function exchangeOAuthForIdpTokens(sessionToken, provider = 'google') {
         console.log('[BETTER_AUTH] IDP oauth-callback response:', { status: oauthRes.status, bodyLength: oauthResText.length });
         if (!oauthRes.ok) {
             console.error('[BETTER_AUTH] IDP oauth-callback failed:', oauthRes.status);
+            /**
+             * PAY-2005 scenario (b) — RETURN THE IDP'S ERROR CODE (BAPert ruling 67897).
+             *
+             * Every refusal used to return a bare `false`, so the abort collapsed ALL
+             * causes to one generic `OAUTH_SIGN_IN_FAILED`: a NEW user refused
+             * registration (`REGISTRATION_NOT_ALLOWED`, ExternalAuthController.cs:908)
+             * bounced silently, indistinguishable from a network blip. Jon named the
+             * clear message explicitly (67856): "(b) a brand-new Google user with
+             * registration OFF is refused by the IDP with a clear message, not a
+             * silent bounce."
+             *
+             * The envelope is `{ error: { code, message } }` (PayEzControllerBase.Error).
+             * We read ONLY `error.code` and return it VERBATIM — the abort puts it in
+             * the `?error=` param, and the HOST's allowlist decides whether to render
+             * it. The package does NOT interpret the code and does NOT add a message
+             * (that would be a second allowlist). No code in the body -> null (the
+             * generic host code), exactly as before.
+             */
+            let idpErrorCode = null;
+            try {
+                const parsed = JSON.parse(oauthResText);
+                // FORWARD ONLY AN ALLOWLISTED CODE. Every other refusal keeps PAY-1733's single neutral code — an
+                // unlisted code would render nothing on the host page, which is the silent bounce this exists to end.
+                if (typeof parsed?.error?.code === 'string' && exports.IDP_ERROR_CODES_TO_FORWARD.has(parsed.error.code)) {
+                    idpErrorCode = parsed.error.code;
+                }
+            }
+            catch {
+                /* non-JSON refusal body -> no code (generic abort) */
+            }
             /**
              * WHY THIS LOGS ONLY ON FAILURE, AND WHY IT LOGS THESE FIELDS.
              *
@@ -1007,7 +1066,7 @@ async function exchangeOAuthForIdpTokens(sessionToken, provider = 'google') {
                 sent_client_id: (0, client_key_1.resolveClientKey)(config, 'auth/better-auth:oauth-callback').key ?? null,
                 idp_url: idpUrl,
             });
-            return false;
+            return idpErrorCode ?? false;
         }
         let idpData;
         try {
@@ -1127,6 +1186,7 @@ async function exchangeOAuthForIdpTokens(sessionToken, provider = 'google') {
         const stored = await storeIdpTokensInSession(sessionToken, idpTokenData, provider);
         if (stored)
             console.log('[BETTER_AUTH] IDP tokens stored in session for', email);
+        // true = success (tokens stored). false = a non-IdP failure with no specific code (generic abort).
         return stored;
     }
     catch (err) {
@@ -1222,6 +1282,17 @@ async function storeIdpTokensInSession(sessionToken, idpTokenData, authProvider)
  * Try again or use another method." The cause stays in the server log, never on the page.
  */
 exports.OAUTH_SIGN_IN_FAILED_ERROR = 'OAUTH_SIGN_IN_FAILED';
+/**
+ * The ONLY IdP refusal codes the package forwards to the login page (PAY-2005 (b), BAPert 67897).
+ *
+ * Default stays PAY-1733's ONE neutral code: the cause of an ordinary failed exchange lives in the server
+ * log, never on the page. A code is forwarded ONLY when it earns a distinct user-facing message — today just
+ * the registration refusal, so a NEW Google user with registration OFF sees a clear "not open to sign-up"
+ * line instead of a silent bounce. Adding a code here REQUIRES a matching entry in the host allowlist
+ * (portal: src/lib/auth/magic-link-outcome.ts); an unlisted code renders nothing, which is a silent bounce
+ * wearing a different number. Add them together, never one alone.
+ */
+exports.IDP_ERROR_CODES_TO_FORWARD = new Set(['REGISTRATION_NOT_ALLOWED']);
 /**
  * Re-emit each cookie the callback response SET as an immediate expiry, keeping the attributes that decide
  * WHICH cookie the browser overwrites (Path, Domain, Secure, SameSite, HttpOnly - a `__Secure-` name is only
@@ -1253,7 +1324,7 @@ function expireSetCookies(setCookies) {
  * expired, and the user goes to the login page with OAUTH_SIGN_IN_FAILED. Relative Location, as for the state-error
  * branch above (328439: an absolute URL built from request.url is a dead tab in a container).
  */
-async function abortOAuthSignIn(callbackResponse, sessionToken, cookieHeader, loginPath) {
+async function abortOAuthSignIn(callbackResponse, sessionToken, cookieHeader, loginPath, errorCode = exports.OAUTH_SIGN_IN_FAILED_ERROR) {
     const headers = new Headers();
     if (sessionToken) {
         try {
@@ -1275,8 +1346,8 @@ async function abortOAuthSignIn(callbackResponse, sessionToken, cookieHeader, lo
     }
     for (const sc of expireSetCookies(callbackResponse.headers.getSetCookie?.() ?? []))
         headers.append('set-cookie', sc);
-    headers.set('location', `${loginPath}${loginPath.includes('?') ? '&' : '?'}error=${exports.OAUTH_SIGN_IN_FAILED_ERROR}`);
-    console.warn('[BETTER_AUTH] OAuth sign-in ABORTED: the IdP exchange stored no tokens, so no session is kept (PAY-1733)', sessionToken ? (0, token_log_id_1.tokenLogId)(sessionToken) : '(no session)');
+    headers.set('location', `${loginPath}${loginPath.includes('?') ? '&' : '?'}error=${errorCode}`);
+    console.warn('[BETTER_AUTH] OAuth sign-in ABORTED: the IdP exchange stored no tokens, so no session is kept (PAY-1733)', sessionToken ? (0, token_log_id_1.tokenLogId)(sessionToken) : '(no session)', 'code=' + errorCode);
     return new Response(null, { status: 302, headers });
 }
 /**
@@ -1364,7 +1435,9 @@ function createAuthGetHandler(loginPath = '/account-auth/login') {
                     .map((c) => c.split(';')[0])
                     .join('; ');
                 let sessionToken = null;
-                let exchanged = false;
+                // true = tokens stored; false = no specific IdP code (generic abort); a string = the IdP's own refusal code
+                // (PAY-2005 (b): REGISTRATION_NOT_ALLOWED, etc.), forwarded so the host can show a clear message.
+                let exchange = false;
                 try {
                     const auth = await getBetterAuthInstance();
                     if (auth?.api?.getSession) {
@@ -1374,7 +1447,7 @@ function createAuthGetHandler(loginPath = '/account-auth/login') {
                         if (session?.session?.token) {
                             sessionToken = session.session.token;
                             console.log('[BETTER_AUTH] Got session token from callback:', (0, token_log_id_1.tokenLogId)(session.session.token), '| email:', session.user?.email);
-                            exchanged = await exchangeOAuthForIdpTokens(session.session.token);
+                            exchange = await exchangeOAuthForIdpTokens(session.session.token);
                         }
                         else {
                             console.warn('[BETTER_AUTH] Could not get session after OAuth callback');
@@ -1384,8 +1457,11 @@ function createAuthGetHandler(loginPath = '/account-auth/login') {
                 catch (err) {
                     console.error('[BETTER_AUTH] IDP token exchange failed:', err.message);
                 }
-                if (!exchanged)
-                    return abortOAuthSignIn(response, sessionToken, cookieHeader, loginPath);
+                if (exchange !== true) {
+                    // A specific IdP error code goes on the URL; otherwise the generic OAUTH_SIGN_IN_FAILED.
+                    const errorCode = typeof exchange === 'string' ? exchange : exports.OAUTH_SIGN_IN_FAILED_ERROR;
+                    return abortOAuthSignIn(response, sessionToken, cookieHeader, loginPath, errorCode);
+                }
             }
             return response;
         });

package/dist/components/auth/FederatedAuthSection.js

@@ -3,31 +3,54 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FederatedAuthSection = FederatedAuthSection;
 const jsx_runtime_1 = require("react/jsx-runtime");
+/**
+ * PAY-2104 — PER-PROVIDER BRAND TREATMENT, NOT ONE GENERIC BUTTON.
+ *
+ * Apple and Facebook both publish binding rules for their sign-in buttons and
+ * neither is satisfied by the generic "Continue with X" control this section
+ * used to render for every provider:
+ *   - APPLE (App Store Review Guidelines 4.8 / "Sign in with Apple" HIG): the
+ *     button MUST carry the Apple logo and one of Apple's own wordings. The
+ *     approved primary wording is "Sign in with Apple" ("Continue with Apple"
+ *     is the permitted alternative). "Continue with Apple" with no logo, which
+ *     is what the generic path produced, is non-compliant and is what App Store
+ *     review rejects. Black or white only.
+ *   - FACEBOOK (Meta Platform Terms / brand guidelines): "Continue with
+ *     Facebook", the Facebook "f" mark, and the brand blue (#1877F2) or white
+ *     are the sanctioned treatments.
+ * Google/Microsoft/GitHub keep the neutral control — they impose no such rule,
+ * and inventing brand colours for them would be a change nobody asked for.
+ *
+ * The mark inherits `currentColor` so it is legible on both the white neutral
+ * buttons and the black/blue branded ones without a second SVG per provider.
+ */
+const PROVIDER_BRAND = {
+    google: { label: 'Continue with Google', background: 'var(--bg-default, #ffffff)', color: 'var(--text-primary, #111827)', border: 'var(--border-default, #e5e7eb)' },
+    microsoft: { label: 'Continue with Microsoft', background: 'var(--bg-default, #ffffff)', color: 'var(--text-primary, #111827)', border: 'var(--border-default, #e5e7eb)' },
+    github: { label: 'Continue with GitHub', background: 'var(--bg-default, #ffffff)', color: 'var(--text-primary, #111827)', border: 'var(--border-default, #e5e7eb)' },
+    // Meta brand blue; white mark on blue, per the brand guidelines.
+    facebook: { label: 'Continue with Facebook', background: '#1877F2', color: '#ffffff', border: '#1877F2' },
+    // Apple HIG: black (or white) field, "Sign in with Apple", Apple logo.
+    apple: { label: 'Sign in with Apple', background: '#000000', color: '#ffffff', border: '#000000' },
+};
 const providerIcons = {
     google: {
-        label: 'Google',
-        color: '#4285F4',
-        svg: ((0, jsx_runtime_1.jsxs)("svg", { className: "w-5 h-5", viewBox: "0 0 24 24", fill: "currentColor", children: [(0, jsx_runtime_1.jsx)("path", { d: "M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z", fill: "#4285F4" }), (0, jsx_runtime_1.jsx)("path", { d: "M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z", fill: "#34A853" }), (0, jsx_runtime_1.jsx)("path", { d: "M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z", fill: "#FBBC05" }), (0, jsx_runtime_1.jsx)("path", { d: "M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z", fill: "#EA4335" })] })),
+        svg: ((0, jsx_runtime_1.jsxs)("svg", { className: "w-5 h-5", viewBox: "0 0 24 24", fill: "currentColor", "aria-hidden": "true", children: [(0, jsx_runtime_1.jsx)("path", { d: "M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z", fill: "#4285F4" }), (0, jsx_runtime_1.jsx)("path", { d: "M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z", fill: "#34A853" }), (0, jsx_runtime_1.jsx)("path", { d: "M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z", fill: "#FBBC05" }), (0, jsx_runtime_1.jsx)("path", { d: "M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z", fill: "#EA4335" })] })),
     },
     microsoft: {
-        label: 'Microsoft',
-        color: '#0078D4',
-        svg: ((0, jsx_runtime_1.jsxs)("svg", { className: "w-5 h-5", viewBox: "0 0 24 24", fill: "currentColor", children: [(0, jsx_runtime_1.jsx)("rect", { x: "1", y: "1", width: "9", height: "9", fill: "#F25022" }), (0, jsx_runtime_1.jsx)("rect", { x: "12", y: "1", width: "9", height: "9", fill: "#7FBA00" }), (0, jsx_runtime_1.jsx)("rect", { x: "1", y: "12", width: "9", height: "9", fill: "#00A4EF" }), (0, jsx_runtime_1.jsx)("rect", { x: "12", y: "12", width: "9", height: "9", fill: "#FFB900" })] })),
+        svg: ((0, jsx_runtime_1.jsxs)("svg", { className: "w-5 h-5", viewBox: "0 0 24 24", fill: "currentColor", "aria-hidden": "true", children: [(0, jsx_runtime_1.jsx)("rect", { x: "1", y: "1", width: "9", height: "9", fill: "#F25022" }), (0, jsx_runtime_1.jsx)("rect", { x: "12", y: "1", width: "9", height: "9", fill: "#7FBA00" }), (0, jsx_runtime_1.jsx)("rect", { x: "1", y: "12", width: "9", height: "9", fill: "#00A4EF" }), (0, jsx_runtime_1.jsx)("rect", { x: "12", y: "12", width: "9", height: "9", fill: "#FFB900" })] })),
     },
     facebook: {
-        label: 'Facebook',
-        color: '#1877F2',
-        svg: ((0, jsx_runtime_1.jsx)("svg", { className: "w-5 h-5", viewBox: "0 0 24 24", fill: "#1877F2", children: (0, jsx_runtime_1.jsx)("path", { d: "M24 12.073c0-6.627-5.373-12-12-12s-12 5.373-12 12c0 5.99 4.388 10.954 10.125 11.854v-8.385H7.078v-3.47h3.047V9.43c0-3.007 1.792-4.669 4.533-4.669 1.312 0 2.686.235 2.686.235v2.953H15.83c-1.491 0-1.956.925-1.956 1.874v2.25h3.328l-.532 3.47h-2.796v8.385C19.612 23.027 24 18.062 24 12.073z" }) })),
+        // currentColor: white on the Meta-blue button. A hardcoded #1877F2 fill on a
+        // #1877F2 field is an invisible mark — the exact way a branded button ships
+        // looking like a blank one.
+        svg: ((0, jsx_runtime_1.jsx)("svg", { className: "w-5 h-5", viewBox: "0 0 24 24", fill: "currentColor", "aria-hidden": "true", children: (0, jsx_runtime_1.jsx)("path", { d: "M24 12.073c0-6.627-5.373-12-12-12s-12 5.373-12 12c0 5.99 4.388 10.954 10.125 11.854v-8.385H7.078v-3.47h3.047V9.43c0-3.007 1.792-4.669 4.533-4.669 1.312 0 2.686.235 2.686.235v2.953H15.83c-1.491 0-1.956.925-1.956 1.874v2.25h3.328l-.532 3.47h-2.796v8.385C19.612 23.027 24 18.062 24 12.073z" }) })),
     },
     github: {
-        label: 'GitHub',
-        color: '#000000',
-        svg: ((0, jsx_runtime_1.jsx)("svg", { className: "w-5 h-5", viewBox: "0 0 24 24", fill: "currentColor", children: (0, jsx_runtime_1.jsx)("path", { d: "M12 0c-6.626 0-12 5.373-12 12 0 5.302 3.438 9.8 8.207 11.387.599.111.793-.261.793-.577v-2.234c-3.338.726-4.033-1.416-4.033-1.416-.546-1.387-1.333-1.756-1.333-1.756-1.089-.745.083-.729.083-.729 1.205.084 1.839 1.237 1.839 1.237 1.07 1.834 2.807 1.304 3.492.997.107-.775.418-1.305.762-1.604-2.665-.305-5.467-1.334-5.467-5.931 0-1.311.469-2.381 1.236-3.221-.124-.303-.535-1.524.117-3.176 0 0 1.008-.322 3.301 1.23.957-.266 1.983-.399 3.003-.404 1.02.005 2.047.138 3.006.404 2.291-1.552 3.297-1.23 3.297-1.23.653 1.653.242 2.874.118 3.176.77.84 1.235 1.911 1.235 3.221 0 4.609-2.807 5.624-5.479 5.921.43.372.823 1.102.823 2.222v3.293c0 .319.192.694.801.576 4.765-1.589 8.199-6.086 8.199-11.386 0-6.627-5.373-12-12-12z" }) })),
+        svg: ((0, jsx_runtime_1.jsx)("svg", { className: "w-5 h-5", viewBox: "0 0 24 24", fill: "currentColor", "aria-hidden": "true", children: (0, jsx_runtime_1.jsx)("path", { d: "M12 0c-6.626 0-12 5.373-12 12 0 5.302 3.438 9.8 8.207 11.387.599.111.793-.261.793-.577v-2.234c-3.338.726-4.033-1.416-4.033-1.416-.546-1.387-1.333-1.756-1.333-1.756-1.089-.745.083-.729.083-.729 1.205.084 1.839 1.237 1.839 1.237 1.07 1.834 2.807 1.304 3.492.997.107-.775.418-1.305.762-1.604-2.665-.305-5.467-1.334-5.467-5.931 0-1.311.469-2.381 1.236-3.221-.124-.303-.535-1.524.117-3.176 0 0 1.008-.322 3.301 1.23.957-.266 1.983-.399 3.003-.404 1.02.005 2.047.138 3.006.404 2.291-1.552 3.297-1.23 3.297-1.23.653 1.653.242 2.874.118 3.176.77.84 1.235 1.911 1.235 3.221 0 4.609-2.807 5.624-5.479 5.921.43.372.823 1.102.823 2.222v3.293c0 .319.192.694.801.576 4.765-1.589 8.199-6.086 8.199-11.386 0-6.627-5.373-12-12-12z" }) })),
     },
     apple: {
-        label: 'Apple',
-        color: '#000000',
-        svg: ((0, jsx_runtime_1.jsx)("svg", { className: "w-5 h-5", viewBox: "0 0 24 24", fill: "currentColor", children: (0, jsx_runtime_1.jsx)("path", { d: "M17.05 20.28c-.98.95-2.05.8-3.08.35-1.09-.46-2.09-.48-3.24 0-1.44.62-2.2.44-3.06-.35C2.79 15.25 3.51 7.59 9.05 7.31c1.35.07 2.29.74 3.08.8 1.18-.24 2.31-.93 3.57-.84 1.51.12 2.65.72 3.4 1.8-3.12 1.87-2.38 5.98.48 7.13-.57 1.5-1.31 2.99-2.54 4.09l.01-.01zM12.03 7.25c-.15-2.23 1.66-4.07 3.74-4.25.29 2.58-2.34 4.5-3.74 4.25z" }) })),
+        svg: ((0, jsx_runtime_1.jsx)("svg", { className: "w-5 h-5", viewBox: "0 0 24 24", fill: "currentColor", "aria-hidden": "true", children: (0, jsx_runtime_1.jsx)("path", { d: "M17.05 20.28c-.98.95-2.05.8-3.08.35-1.09-.46-2.09-.48-3.24 0-1.44.62-2.2.44-3.06-.35C2.79 15.25 3.51 7.59 9.05 7.31c1.35.07 2.29.74 3.08.8 1.18-.24 2.31-.93 3.57-.84 1.51.12 2.65.72 3.4 1.8-3.12 1.87-2.38 5.98.48 7.13-.57 1.5-1.31 2.99-2.54 4.09l.01-.01zM12.03 7.25c-.15-2.23 1.66-4.07 3.74-4.25.29 2.58-2.34 4.5-3.74 4.25z" }) })),
     },
 };
 function FederatedAuthSection({ providers, onProviderClick, isLoading }) {
@@ -35,11 +58,17 @@ function FederatedAuthSection({ providers, onProviderClick, isLoading }) {
         return null;
     }
     return ((0, jsx_runtime_1.jsx)("div", { className: "space-y-3", children: providers.map((provider) => {
-            const config = providerIcons[provider];
-            return ((0, jsx_runtime_1.jsxs)("button", { type: "button", onClick: () => onProviderClick(provider), disabled: isLoading, className: `w-full px-4 py-3 rounded-lg border-2 font-semibold transition-colors flex items-center justify-center gap-2 disabled:opacity-50 disabled:cursor-not-allowed`, style: {
-                    border: '1px solid var(--border-default)',
-                    color: 'var(--text-primary)',
-                    background: 'var(--bg-default)',
-                }, children: [config.svg, "Continue with ", config.label] }, provider));
+            const icon = providerIcons[provider];
+            const brand = PROVIDER_BRAND[provider] ?? {
+                label: `Continue with ${provider}`,
+                background: 'var(--bg-default, #ffffff)',
+                color: 'var(--text-primary, #111827)',
+                border: 'var(--border-default, #e5e7eb)',
+            };
+            return ((0, jsx_runtime_1.jsxs)("button", { type: "button", onClick: () => onProviderClick(provider), disabled: isLoading, "data-provider": provider, className: `w-full px-4 py-3 rounded-lg border-2 font-semibold transition-colors flex items-center justify-center gap-2 disabled:opacity-50 disabled:cursor-not-allowed`, style: {
+                    border: `1px solid ${brand.border}`,
+                    color: brand.color,
+                    background: brand.background,
+                }, children: [icon.svg, brand.label] }, provider));
         }) }));
 }

package/dist/hooks/useAvailableProviders.js

@@ -57,27 +57,48 @@ function useAvailableProviders() {
         let mounted = true;
         async function fetchProviders() {
             try {
-                // Fetch available providers from Better Auth
-                // Better Auth doesn't have a getProviders equivalent, so we use a static list
-                // based on configured social providers
-                const result = {
-                    google: { id: 'google', name: 'Google' },
-                };
+                // PAY-2104: THIS USED TO BE A HARDCODED GOOGLE LITERAL.
+                //
+                //   const result = { google: { id: 'google', name: 'Google' } };
+                //
+                // under a comment claiming providers were "loaded dynamically". It
+                // returned Google for EVERY client whatever the tenant had enabled -
+                // a config-shaped constant, so Apple/Facebook (PAY-2104) could never
+                // appear and a client that had DISABLED Google would still see its
+                // button. The real answer is served by /api/auth/settings (the same
+                // route routes/auth/settings.ts builds from the IDP's oauthProviders).
+                const response = await fetch('/api/auth/settings', { cache: 'no-store' });
                 if (!mounted)
                     return;
-                setRawProviders(result);
-                if (result) {
-                    // Filter to OAuth providers only (exclude credentials)
-                    // Map to our FederatedProvider type
-                    const oauthProviders = Object.keys(result)
-                        .filter(id => OAUTH_PROVIDERS.includes(id))
-                        .map(id => PROVIDER_MAP[id])
-                        .filter((p) => p !== undefined);
-                    setProviders(oauthProviders);
+                if (!response.ok) {
+                    // FAIL CLOSED. An unreadable policy is not an empty provider list
+                    // that we may then pad with a guess - it is "we do not know". See
+                    // the PAY-1243 rule: never fabricate a provider list.
+                    throw new Error(`Failed to fetch auth settings: ${response.status}`);
                 }
-                else {
-                    setProviders([]);
+                const body = await response.json().catch(() => null);
+                const settings = body?.data ?? body;
+                if (body?.success === false || !settings) {
+                    throw new Error(body?.error?.code ?? 'POLICY_UNAVAILABLE');
                 }
+                // Keep the raw provider rows (id -> the settings row) for callers that
+                // want more than the mapped union type, exactly as before.
+                const enabledIds = Array.isArray(settings.enabledProviders)
+                    ? settings.enabledProviders.filter((p) => typeof p === 'string')
+                    : [];
+                const raw = {};
+                for (const id of enabledIds)
+                    raw[id] = { id, name: id };
+                if (!mounted)
+                    return;
+                setRawProviders(raw);
+                // Filter to OAuth providers only (exclude credentials) and map to our
+                // FederatedProvider union, in the IDP's order.
+                const oauthProviders = enabledIds
+                    .filter(id => OAUTH_PROVIDERS.includes(id))
+                    .map(id => PROVIDER_MAP[id])
+                    .filter((p) => p !== undefined);
+                setProviders(oauthProviders);
                 setError(null);
             }
             catch (err) {
@@ -85,6 +106,7 @@ function useAvailableProviders() {
                     return;
                 setError(err instanceof Error ? err : new Error(String(err)));
                 setProviders([]);
+                setRawProviders(null); // never leave a stale list behind a failure
             }
             finally {
                 if (mounted) {

package/dist/lib/nextauth-secret.d.ts

@@ -0,0 +1,51 @@
+/**
+ * resolveNextAuthSecret - COMPATIBILITY SHIM (restored 2026-09-30, PAY-2005 / N7).
+ *
+ * ---------------------------------------------------------------------------
+ * WHY THIS FILE EXISTS, AND WHY IT IS A SHIM RATHER THAN A FEATURE
+ * ---------------------------------------------------------------------------
+ * The NextAuth-era broker secret resolver was DELETED in
+ *     4d3d29e6  "feat!: Better Auth 4.0.0 — NextAuth fully removed"
+ * and it is intentionally NOT coming back as first-class API: this package is
+ * Better Auth now, and new apps must not resolve a NextAuth secret at all.
+ *
+ * It is restored here ONLY because ONE consumer is still mid-migration and cannot
+ * take the 4.4.x bump without it:
+ *
+ *   CONSUMER THAT NEEDS THIS: the customer portal
+ *   (`payez_idp_admin_web` / VibeID-Customer-Portal). It is pinned at
+ *   @payez/next-mvp 4.0.46 and still runs BOTH next-auth@4.24 and better-auth; its
+ *   `src/lib/server-session.ts` and `src/lib/session-token.ts` (and 5 route files)
+ *   import `resolveNextAuthSecret` from here. Without this export, bumping the
+ *   portal to 4.4.x breaks its build. BAPert ruled (68003) to ship this scoped
+ *   shim rather than force the portal's full NextAuth->BetterAuth migration
+ *   tonight. That migration is tracked as its own card; WHEN IT LANDS, DELETE
+ *   THIS FILE.
+ *
+ * DO NOT add new consumers. If you are starting an app, use Better Auth's own
+ * secret handling; you do not need this.
+ *
+ * ---------------------------------------------------------------------------
+ * BEHAVIOUR (faithful to the 4.0.46 implementation, with one deliberate change)
+ * ---------------------------------------------------------------------------
+ * Priority: (1) process.env.NEXTAUTH_SECRET if set; (2) fetch from the IDP via a
+ * signed client assertion; (3) cache in-memory 5 min and stamp NEXTAUTH_SECRET.
+ *
+ * DELIBERATE CHANGE, 4.0.46 -> here: 4.0.46 validated the fetched secret with
+ * `validateNextAuthSecret`, which this package's 4.4.x no longer exports (it was
+ * renamed to `validateAuthSecret` with an IDENTICAL body). The shim calls
+ * `validateAuthSecret` - same predicate, current name - so there is no second
+ * copy of the rule. The validation semantics are unchanged.
+ *
+ * SERVER-ONLY: the IDP handshake and NEXTAUTH_SECRET are server concerns.
+ */
+import 'server-only';
+/**
+ * Resolve the NextAuth secret (server-only).
+ *
+ * Priority:
+ * 1) Use process.env.NEXTAUTH_SECRET if present (allows overrides/production)
+ * 2) Fetch from the IDP broker endpoint - the IDP handles all Key Vault/signing
+ * 3) Cache result in-memory and set process.env.NEXTAUTH_SECRET for later calls
+ */
+export declare function resolveNextAuthSecret(): Promise<string>;