@payez/next-mvp 4.4.8 → 4.4.9

package/dist/api-handlers/account/reset-password.js

@@ -72,7 +72,9 @@ async function POST(req) {
         if (!upstream.ok) {
             // PAY-1591: a password-policy refusal also carries the KNOWN rule codes so the page can say which rules failed.
             const rules = (0, safe_error_response_1.projectPasswordPolicyRules)(data);
-            return server_1.NextResponse.json({ ...(0, safe_error_response_1.idpErrorEnvelope)(data, 'Failed to reset password'), ...(rules !== undefined ? { password_policy: { rules } } : {}), ...((0, safe_error_response_1.projectResetTokenInvalid)(data) ? { reset_token_invalid: true } : {}) }, { status: upstream.status });
+            // PAY-2103: a breached-password refusal is a distinct 400; project a BOOLEAN so the anonymous
+            // route carries no code text and the page picks its own sentence.
+            return server_1.NextResponse.json({ ...(0, safe_error_response_1.idpErrorEnvelope)(data, 'Failed to reset password'), ...(rules !== undefined ? { password_policy: { rules } } : {}), ...((0, safe_error_response_1.projectResetTokenInvalid)(data) ? { reset_token_invalid: true } : {}), ...((0, safe_error_response_1.projectPasswordBreached)(data) ? { password_breached: true } : {}) }, { status: upstream.status });
         }
         return server_1.NextResponse.json(data, { status: upstream.status });
     }

package/dist/api-handlers/session/viability.js

@@ -12,6 +12,7 @@ const auth_1 = require("../../server/auth");
 const startup_init_1 = require("../../lib/startup-init");
 const idp_client_config_1 = require("../../lib/idp-client-config");
 const token_log_id_1 = require("../../lib/token-log-id");
+const sessions_1 = require("../../vibe/sessions");
 async function GET(req) {
     try {
         // Ensure initialization is complete (auth signing secret resolved from IDP)
@@ -124,12 +125,43 @@ async function GET(req) {
                         hoursExpiredAgo: ((Date.now() - mfaExpiresAt) / (1000 * 60 * 60)).toFixed(1)
                     });
                 }
+                // --- Session revocation status (PAY-1882 step 4 producer half) ---
+                // The four-state status (BAPert 66320). The middleware fails CLOSED by
+                // default on 'unknown' (a failed Vibe read) and always on 'revoked';
+                // 'active' and 'not_configured' stay viable. A consumer that does not
+                // read revocationStatus is unaffected - absent is not revoked.
+                let revocationStatus = 'not_configured';
+                // BAPert 66480 condition 2 / ruling (ii) 66700: the numeric IdP id comes from
+                // the token's own `sub` claim FIRST (session.userId can be an email).
+                const revocationUserId = (0, sessions_1.resolveNumericIdpUserId)(sessionData, sessionData.idpAccessToken);
+                if (revocationUserId > 0) {
+                    try {
+                        revocationStatus = await (0, sessions_1.getRevocationStatus)(revocationUserId, sessionToken);
+                    }
+                    catch {
+                        // getRevocationStatus does not throw by contract; fail closed if it ever does.
+                        revocationStatus = 'unknown';
+                    }
+                }
+                else {
+                    // N1 (NightHawk 66392): a session EXISTS but its userId is not a usable
+                    // numeric IdP id, so the check could not be run. That is 'unknown'
+                    // (could not determine), NOT 'not_configured' (no revocation source) -
+                    // the two must not be conflated.
+                    // BAPert 66480 condition 1: emit ONE WARN (shape only) per session.
+                    revocationStatus = (0, sessions_1.warnNonNumericUserId)(sessionToken, sessionData.userId);
+                }
                 const response = {
                     authenticated: true,
                     sessionTokenId: (0, token_log_id_1.tokenLogId)(sessionToken), // PAY-1481: correlation id for middleware tracking, never the token
                     // 2FA fields - critical for middleware redirect logic
                     requires2FA, // From cached client config (client-wide setting)
                     twoFactorComplete: effectiveTwoFactorComplete, // From session, BUT respects MFA TTL
+                    // Session revocation (PAY-1882 step 4): the four-state status, plus the
+                    // boolean the middleware's existing force-invalid branch already reads.
+                    revocationStatus,
+                    forceInvalid: revocationStatus === 'revoked' || revocationStatus === 'unknown',
+                    revoked: revocationStatus === 'revoked',
                     // Cards 141688/141741 — the IDP's routing decision, relayed verbatim.
                     //
                     // THIS IS THE SECOND IMPLEMENTATION OF VIABILITY. The other is

package/dist/components/auth/FederatedAuthSection.js

@@ -3,31 +3,54 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FederatedAuthSection = FederatedAuthSection;
 const jsx_runtime_1 = require("react/jsx-runtime");
+/**
+ * PAY-2104 — PER-PROVIDER BRAND TREATMENT, NOT ONE GENERIC BUTTON.
+ *
+ * Apple and Facebook both publish binding rules for their sign-in buttons and
+ * neither is satisfied by the generic "Continue with X" control this section
+ * used to render for every provider:
+ *   - APPLE (App Store Review Guidelines 4.8 / "Sign in with Apple" HIG): the
+ *     button MUST carry the Apple logo and one of Apple's own wordings. The
+ *     approved primary wording is "Sign in with Apple" ("Continue with Apple"
+ *     is the permitted alternative). "Continue with Apple" with no logo, which
+ *     is what the generic path produced, is non-compliant and is what App Store
+ *     review rejects. Black or white only.
+ *   - FACEBOOK (Meta Platform Terms / brand guidelines): "Continue with
+ *     Facebook", the Facebook "f" mark, and the brand blue (#1877F2) or white
+ *     are the sanctioned treatments.
+ * Google/Microsoft/GitHub keep the neutral control — they impose no such rule,
+ * and inventing brand colours for them would be a change nobody asked for.
+ *
+ * The mark inherits `currentColor` so it is legible on both the white neutral
+ * buttons and the black/blue branded ones without a second SVG per provider.
+ */
+const PROVIDER_BRAND = {
+    google: { label: 'Continue with Google', background: 'var(--bg-default, #ffffff)', color: 'var(--text-primary, #111827)', border: 'var(--border-default, #e5e7eb)' },
+    microsoft: { label: 'Continue with Microsoft', background: 'var(--bg-default, #ffffff)', color: 'var(--text-primary, #111827)', border: 'var(--border-default, #e5e7eb)' },
+    github: { label: 'Continue with GitHub', background: 'var(--bg-default, #ffffff)', color: 'var(--text-primary, #111827)', border: 'var(--border-default, #e5e7eb)' },
+    // Meta brand blue; white mark on blue, per the brand guidelines.
+    facebook: { label: 'Continue with Facebook', background: '#1877F2', color: '#ffffff', border: '#1877F2' },
+    // Apple HIG: black (or white) field, "Sign in with Apple", Apple logo.
+    apple: { label: 'Sign in with Apple', background: '#000000', color: '#ffffff', border: '#000000' },
+};
 const providerIcons = {
     google: {
-        label: 'Google',
-        color: '#4285F4',
-        svg: ((0, jsx_runtime_1.jsxs)("svg", { className: "w-5 h-5", viewBox: "0 0 24 24", fill: "currentColor", children: [(0, jsx_runtime_1.jsx)("path", { d: "M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z", fill: "#4285F4" }), (0, jsx_runtime_1.jsx)("path", { d: "M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z", fill: "#34A853" }), (0, jsx_runtime_1.jsx)("path", { d: "M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z", fill: "#FBBC05" }), (0, jsx_runtime_1.jsx)("path", { d: "M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z", fill: "#EA4335" })] })),
+        svg: ((0, jsx_runtime_1.jsxs)("svg", { className: "w-5 h-5", viewBox: "0 0 24 24", fill: "currentColor", "aria-hidden": "true", children: [(0, jsx_runtime_1.jsx)("path", { d: "M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z", fill: "#4285F4" }), (0, jsx_runtime_1.jsx)("path", { d: "M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z", fill: "#34A853" }), (0, jsx_runtime_1.jsx)("path", { d: "M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z", fill: "#FBBC05" }), (0, jsx_runtime_1.jsx)("path", { d: "M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z", fill: "#EA4335" })] })),
     },
     microsoft: {
-        label: 'Microsoft',
-        color: '#0078D4',
-        svg: ((0, jsx_runtime_1.jsxs)("svg", { className: "w-5 h-5", viewBox: "0 0 24 24", fill: "currentColor", children: [(0, jsx_runtime_1.jsx)("rect", { x: "1", y: "1", width: "9", height: "9", fill: "#F25022" }), (0, jsx_runtime_1.jsx)("rect", { x: "12", y: "1", width: "9", height: "9", fill: "#7FBA00" }), (0, jsx_runtime_1.jsx)("rect", { x: "1", y: "12", width: "9", height: "9", fill: "#00A4EF" }), (0, jsx_runtime_1.jsx)("rect", { x: "12", y: "12", width: "9", height: "9", fill: "#FFB900" })] })),
+        svg: ((0, jsx_runtime_1.jsxs)("svg", { className: "w-5 h-5", viewBox: "0 0 24 24", fill: "currentColor", "aria-hidden": "true", children: [(0, jsx_runtime_1.jsx)("rect", { x: "1", y: "1", width: "9", height: "9", fill: "#F25022" }), (0, jsx_runtime_1.jsx)("rect", { x: "12", y: "1", width: "9", height: "9", fill: "#7FBA00" }), (0, jsx_runtime_1.jsx)("rect", { x: "1", y: "12", width: "9", height: "9", fill: "#00A4EF" }), (0, jsx_runtime_1.jsx)("rect", { x: "12", y: "12", width: "9", height: "9", fill: "#FFB900" })] })),
     },
     facebook: {
-        label: 'Facebook',
-        color: '#1877F2',
-        svg: ((0, jsx_runtime_1.jsx)("svg", { className: "w-5 h-5", viewBox: "0 0 24 24", fill: "#1877F2", children: (0, jsx_runtime_1.jsx)("path", { d: "M24 12.073c0-6.627-5.373-12-12-12s-12 5.373-12 12c0 5.99 4.388 10.954 10.125 11.854v-8.385H7.078v-3.47h3.047V9.43c0-3.007 1.792-4.669 4.533-4.669 1.312 0 2.686.235 2.686.235v2.953H15.83c-1.491 0-1.956.925-1.956 1.874v2.25h3.328l-.532 3.47h-2.796v8.385C19.612 23.027 24 18.062 24 12.073z" }) })),
+        // currentColor: white on the Meta-blue button. A hardcoded #1877F2 fill on a
+        // #1877F2 field is an invisible mark — the exact way a branded button ships
+        // looking like a blank one.
+        svg: ((0, jsx_runtime_1.jsx)("svg", { className: "w-5 h-5", viewBox: "0 0 24 24", fill: "currentColor", "aria-hidden": "true", children: (0, jsx_runtime_1.jsx)("path", { d: "M24 12.073c0-6.627-5.373-12-12-12s-12 5.373-12 12c0 5.99 4.388 10.954 10.125 11.854v-8.385H7.078v-3.47h3.047V9.43c0-3.007 1.792-4.669 4.533-4.669 1.312 0 2.686.235 2.686.235v2.953H15.83c-1.491 0-1.956.925-1.956 1.874v2.25h3.328l-.532 3.47h-2.796v8.385C19.612 23.027 24 18.062 24 12.073z" }) })),
     },
     github: {
-        label: 'GitHub',
-        color: '#000000',
-        svg: ((0, jsx_runtime_1.jsx)("svg", { className: "w-5 h-5", viewBox: "0 0 24 24", fill: "currentColor", children: (0, jsx_runtime_1.jsx)("path", { d: "M12 0c-6.626 0-12 5.373-12 12 0 5.302 3.438 9.8 8.207 11.387.599.111.793-.261.793-.577v-2.234c-3.338.726-4.033-1.416-4.033-1.416-.546-1.387-1.333-1.756-1.333-1.756-1.089-.745.083-.729.083-.729 1.205.084 1.839 1.237 1.839 1.237 1.07 1.834 2.807 1.304 3.492.997.107-.775.418-1.305.762-1.604-2.665-.305-5.467-1.334-5.467-5.931 0-1.311.469-2.381 1.236-3.221-.124-.303-.535-1.524.117-3.176 0 0 1.008-.322 3.301 1.23.957-.266 1.983-.399 3.003-.404 1.02.005 2.047.138 3.006.404 2.291-1.552 3.297-1.23 3.297-1.23.653 1.653.242 2.874.118 3.176.77.84 1.235 1.911 1.235 3.221 0 4.609-2.807 5.624-5.479 5.921.43.372.823 1.102.823 2.222v3.293c0 .319.192.694.801.576 4.765-1.589 8.199-6.086 8.199-11.386 0-6.627-5.373-12-12-12z" }) })),
+        svg: ((0, jsx_runtime_1.jsx)("svg", { className: "w-5 h-5", viewBox: "0 0 24 24", fill: "currentColor", "aria-hidden": "true", children: (0, jsx_runtime_1.jsx)("path", { d: "M12 0c-6.626 0-12 5.373-12 12 0 5.302 3.438 9.8 8.207 11.387.599.111.793-.261.793-.577v-2.234c-3.338.726-4.033-1.416-4.033-1.416-.546-1.387-1.333-1.756-1.333-1.756-1.089-.745.083-.729.083-.729 1.205.084 1.839 1.237 1.839 1.237 1.07 1.834 2.807 1.304 3.492.997.107-.775.418-1.305.762-1.604-2.665-.305-5.467-1.334-5.467-5.931 0-1.311.469-2.381 1.236-3.221-.124-.303-.535-1.524.117-3.176 0 0 1.008-.322 3.301 1.23.957-.266 1.983-.399 3.003-.404 1.02.005 2.047.138 3.006.404 2.291-1.552 3.297-1.23 3.297-1.23.653 1.653.242 2.874.118 3.176.77.84 1.235 1.911 1.235 3.221 0 4.609-2.807 5.624-5.479 5.921.43.372.823 1.102.823 2.222v3.293c0 .319.192.694.801.576 4.765-1.589 8.199-6.086 8.199-11.386 0-6.627-5.373-12-12-12z" }) })),
     },
     apple: {
-        label: 'Apple',
-        color: '#000000',
-        svg: ((0, jsx_runtime_1.jsx)("svg", { className: "w-5 h-5", viewBox: "0 0 24 24", fill: "currentColor", children: (0, jsx_runtime_1.jsx)("path", { d: "M17.05 20.28c-.98.95-2.05.8-3.08.35-1.09-.46-2.09-.48-3.24 0-1.44.62-2.2.44-3.06-.35C2.79 15.25 3.51 7.59 9.05 7.31c1.35.07 2.29.74 3.08.8 1.18-.24 2.31-.93 3.57-.84 1.51.12 2.65.72 3.4 1.8-3.12 1.87-2.38 5.98.48 7.13-.57 1.5-1.31 2.99-2.54 4.09l.01-.01zM12.03 7.25c-.15-2.23 1.66-4.07 3.74-4.25.29 2.58-2.34 4.5-3.74 4.25z" }) })),
+        svg: ((0, jsx_runtime_1.jsx)("svg", { className: "w-5 h-5", viewBox: "0 0 24 24", fill: "currentColor", "aria-hidden": "true", children: (0, jsx_runtime_1.jsx)("path", { d: "M17.05 20.28c-.98.95-2.05.8-3.08.35-1.09-.46-2.09-.48-3.24 0-1.44.62-2.2.44-3.06-.35C2.79 15.25 3.51 7.59 9.05 7.31c1.35.07 2.29.74 3.08.8 1.18-.24 2.31-.93 3.57-.84 1.51.12 2.65.72 3.4 1.8-3.12 1.87-2.38 5.98.48 7.13-.57 1.5-1.31 2.99-2.54 4.09l.01-.01zM12.03 7.25c-.15-2.23 1.66-4.07 3.74-4.25.29 2.58-2.34 4.5-3.74 4.25z" }) })),
     },
 };
 function FederatedAuthSection({ providers, onProviderClick, isLoading }) {
@@ -35,11 +58,17 @@ function FederatedAuthSection({ providers, onProviderClick, isLoading }) {
         return null;
     }
     return ((0, jsx_runtime_1.jsx)("div", { className: "space-y-3", children: providers.map((provider) => {
-            const config = providerIcons[provider];
-            return ((0, jsx_runtime_1.jsxs)("button", { type: "button", onClick: () => onProviderClick(provider), disabled: isLoading, className: `w-full px-4 py-3 rounded-lg border-2 font-semibold transition-colors flex items-center justify-center gap-2 disabled:opacity-50 disabled:cursor-not-allowed`, style: {
-                    border: '1px solid var(--border-default)',
-                    color: 'var(--text-primary)',
-                    background: 'var(--bg-default)',
-                }, children: [config.svg, "Continue with ", config.label] }, provider));
+            const icon = providerIcons[provider];
+            const brand = PROVIDER_BRAND[provider] ?? {
+                label: `Continue with ${provider}`,
+                background: 'var(--bg-default, #ffffff)',
+                color: 'var(--text-primary, #111827)',
+                border: 'var(--border-default, #e5e7eb)',
+            };
+            return ((0, jsx_runtime_1.jsxs)("button", { type: "button", onClick: () => onProviderClick(provider), disabled: isLoading, "data-provider": provider, className: `w-full px-4 py-3 rounded-lg border-2 font-semibold transition-colors flex items-center justify-center gap-2 disabled:opacity-50 disabled:cursor-not-allowed`, style: {
+                    border: `1px solid ${brand.border}`,
+                    color: brand.color,
+                    background: brand.background,
+                }, children: [icon.svg, brand.label] }, provider));
         }) }));
 }

package/dist/hooks/useAvailableProviders.js

@@ -57,27 +57,48 @@ function useAvailableProviders() {
         let mounted = true;
         async function fetchProviders() {
             try {
-                // Fetch available providers from Better Auth
-                // Better Auth doesn't have a getProviders equivalent, so we use a static list
-                // based on configured social providers
-                const result = {
-                    google: { id: 'google', name: 'Google' },
-                };
+                // PAY-2104: THIS USED TO BE A HARDCODED GOOGLE LITERAL.
+                //
+                //   const result = { google: { id: 'google', name: 'Google' } };
+                //
+                // under a comment claiming providers were "loaded dynamically". It
+                // returned Google for EVERY client whatever the tenant had enabled -
+                // a config-shaped constant, so Apple/Facebook (PAY-2104) could never
+                // appear and a client that had DISABLED Google would still see its
+                // button. The real answer is served by /api/auth/settings (the same
+                // route routes/auth/settings.ts builds from the IDP's oauthProviders).
+                const response = await fetch('/api/auth/settings', { cache: 'no-store' });
                 if (!mounted)
                     return;
-                setRawProviders(result);
-                if (result) {
-                    // Filter to OAuth providers only (exclude credentials)
-                    // Map to our FederatedProvider type
-                    const oauthProviders = Object.keys(result)
-                        .filter(id => OAUTH_PROVIDERS.includes(id))
-                        .map(id => PROVIDER_MAP[id])
-                        .filter((p) => p !== undefined);
-                    setProviders(oauthProviders);
+                if (!response.ok) {
+                    // FAIL CLOSED. An unreadable policy is not an empty provider list
+                    // that we may then pad with a guess - it is "we do not know". See
+                    // the PAY-1243 rule: never fabricate a provider list.
+                    throw new Error(`Failed to fetch auth settings: ${response.status}`);
                 }
-                else {
-                    setProviders([]);
+                const body = await response.json().catch(() => null);
+                const settings = body?.data ?? body;
+                if (body?.success === false || !settings) {
+                    throw new Error(body?.error?.code ?? 'POLICY_UNAVAILABLE');
                 }
+                // Keep the raw provider rows (id -> the settings row) for callers that
+                // want more than the mapped union type, exactly as before.
+                const enabledIds = Array.isArray(settings.enabledProviders)
+                    ? settings.enabledProviders.filter((p) => typeof p === 'string')
+                    : [];
+                const raw = {};
+                for (const id of enabledIds)
+                    raw[id] = { id, name: id };
+                if (!mounted)
+                    return;
+                setRawProviders(raw);
+                // Filter to OAuth providers only (exclude credentials) and map to our
+                // FederatedProvider union, in the IDP's order.
+                const oauthProviders = enabledIds
+                    .filter(id => OAUTH_PROVIDERS.includes(id))
+                    .map(id => PROVIDER_MAP[id])
+                    .filter((p) => p !== undefined);
+                setProviders(oauthProviders);
                 setError(null);
             }
             catch (err) {
@@ -85,6 +106,7 @@ function useAvailableProviders() {
                     return;
                 setError(err instanceof Error ? err : new Error(String(err)));
                 setProviders([]);
+                setRawProviders(null); // never leave a stale list behind a failure
             }
             finally {
                 if (mounted) {

package/dist/lib/safe-error-response.d.ts

@@ -65,3 +65,11 @@ export declare function projectResetTokenInvalid(json: unknown): boolean;
  * (the caller must be able to tell a refused password from a dead recovery session).
  */
 export declare function projectPasswordPolicyRules(json: unknown): string[] | undefined;
+/**
+ * PAY-2103 (AUTH-009 breached-password check): the IdP refuses a password found in a breach corpus with
+ * the typed code `password_breached` in its 400 validation envelope (error.code, or error.details.code,
+ * or a value[] entry while it settles). The reset-password route is ANONYMOUS, so only a BOOLEAN crosses
+ * (`password_breached: true`), never the code text: the page maps the boolean to its own sentence. Reads
+ * only the code, never IdP text.
+ */
+export declare function projectPasswordBreached(json: unknown): boolean;

package/dist/lib/safe-error-response.js

@@ -21,6 +21,7 @@ exports.projectPasswordPolicyDetails = projectPasswordPolicyDetails;
 exports.idpErrorEnvelope = idpErrorEnvelope;
 exports.projectResetTokenInvalid = projectResetTokenInvalid;
 exports.projectPasswordPolicyRules = projectPasswordPolicyRules;
+exports.projectPasswordBreached = projectPasswordBreached;
 const password_rules_1 = require("./password-rules");
 const str = (v) => (typeof v === 'string' ? v : undefined);
 /** Log an exception with a fresh correlationId and return the id for the response body. */
@@ -128,3 +129,29 @@ function projectPasswordPolicyRules(json) {
         return undefined;
     return (0, password_rules_1.knownPasswordRules)(details.rules);
 }
+/**
+ * PAY-2103 (AUTH-009 breached-password check): the IdP refuses a password found in a breach corpus with
+ * the typed code `password_breached` in its 400 validation envelope (error.code, or error.details.code,
+ * or a value[] entry while it settles). The reset-password route is ANONYMOUS, so only a BOOLEAN crosses
+ * (`password_breached: true`), never the code text: the page maps the boolean to its own sentence. Reads
+ * only the code, never IdP text.
+ */
+function projectPasswordBreached(json) {
+    if (!json || typeof json !== 'object')
+        return false;
+    const top = json;
+    const err = top.error && typeof top.error === 'object' ? top.error : {};
+    const direct = str(err.code) ?? str(top.code) ?? str(top.error_code);
+    if (direct?.toLowerCase() === 'password_breached')
+        return true;
+    const details = (err.details && typeof err.details === 'object' ? err.details : top.details && typeof top.details === 'object' ? top.details : null);
+    if (str(details?.code)?.toLowerCase() === 'password_breached')
+        return true;
+    // THE SHAPE THE IdP ACTUALLY SENDS (DotNetPert-Scout, PAY-2103 PR 850caa07a): error.details =
+    // { field:'new_password', code:'password_policy', rules:['password_breached'], requirements:[...] }.
+    // The breach is a member of rules[], not a code - the house envelope carries every password rule
+    // that way. Reading only a code would MISS the real refusal.
+    if (Array.isArray(details?.rules) && details.rules.some((r) => typeof r === 'string' && r.toLowerCase() === 'password_breached'))
+        return true;
+    return Array.isArray(details?.value) && details.value.some((v) => !!v && typeof v === 'object' && str(v.code)?.toLowerCase() === 'password_breached');
+}

package/dist/middleware/create-middleware.d.ts

@@ -99,7 +99,48 @@ export interface MvpMiddlewareOptions {
     bypassPaths?: string[];
     /** Paths exempt from RBAC checks (auth still enforced, just no page-permission check) */
     rbacExemptPaths?: string[];
+    /**
+     * PAY-1882 step 4 - how this app treats a producer that reports the session's
+     * revocation status as `'unknown'` (a Vibe read that FAILED: non-OK, timeout,
+     * throw - the status could not be determined).
+     *
+     *   'closed' (DEFAULT) - an unknown revocation status is NOT viable; the
+     *                        session is force-invalidated and the user re-auths.
+     *                        This is Jon's PAY-1880 ruling (option A, fail closed),
+     *                        2026-09-27, and BAPert 66316/66320 restates it for
+     *                        step 4. Consequence, accepted explicitly: a Vibe
+     *                        outage signs this app's users out. 'not_configured'
+     *                        also fails closed here - both live consumers ARE
+     *                        configured (BAPert 66356), so for them it means a
+     *                        misconfiguration, not "no revocation source".
+     *   'open'             - an unknown OR not-configured status stays viable
+     *                        (availability over fail-closed). Per-app opt-out for a
+     *                        deployment with no revocation source, or the two live
+     *                        consumers while Jon decides.
+     *
+     * Neither mode changes `'revoked'` (always force-invalid) or an ABSENT
+     * `revocationStatus` (an older producer - unchanged behaviour, so no consumer
+     * is signed out for not implementing the check).
+     */
+    revocationFailMode?: 'closed' | 'open';
 }
 /** Login error code for a pre-2FA session that expired before the code was verified (PAY-884). */
 export declare const TWO_FACTOR_TIMEOUT_ERROR = "TwoFactorTimeout";
 export declare function createMvpMiddleware(options?: MvpMiddlewareOptions): (request: NextRequest) => Promise<NextResponse>;
+/**
+ * The revocation decision, as a pure function (PAY-1882 step 4, NightHawk 66392).
+ *
+ * Separate + exported so the B1 defect is testable with a REAL mutant: the bug was
+ * that `data.forceInvalid === true` was read BEFORE revocationFailMode, so a
+ * producer that folds 'unknown' into forceInvalid made the 'open' lever dead.
+ *
+ * RULE: when the producer supplies `revocationStatus`, it is AUTHORITATIVE - the
+ * decision is made from it plus failMode, and the folded booleans are ignored for
+ * 'unknown'/'not_configured'. The booleans are read ONLY when revocationStatus is
+ * absent (idealresume.online's older boolean-only route).
+ */
+export declare function decideForceInvalid(data: {
+    revocationStatus?: unknown;
+    forceInvalid?: unknown;
+    revoked?: unknown;
+}, revocationFailMode: 'closed' | 'open'): boolean;

package/dist/middleware/create-middleware.js

@@ -20,6 +20,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TWO_FACTOR_TIMEOUT_ERROR = void 0;
 exports.createMvpMiddleware = createMvpMiddleware;
+exports.decideForceInvalid = decideForceInvalid;
 const server_1 = require("next/server");
 const route_config_1 = require("../auth/route-config");
 const safe_callback_1 = require("../auth/safe-callback");
@@ -317,6 +318,8 @@ function createMvpMiddleware(options = {}) {
     const refreshEndpoint = options.refreshEndpoint || '/api/auth/refresh';
     const bypassPaths = options.bypassPaths || [];
     const rbacExemptPaths = options.rbacExemptPaths || [];
+    // PAY-1882 step 4: default 'closed' (Jon's option A / BAPert 66316).
+    const revocationFailMode = options.revocationFailMode || 'closed';
     return async function middleware(request) {
         const { pathname, searchParams } = request.nextUrl;
         // =========================================================================
@@ -347,7 +350,7 @@ function createMvpMiddleware(options = {}) {
             // Has cookie - continue to viability check for 2FA enforcement
         }
         // --- Fetch session viability from internal API ---
-        const { sessionStatus, sessionPointer } = await checkViability(request, viabilityEndpoint, log);
+        const { sessionStatus, sessionPointer } = await checkViability(request, viabilityEndpoint, log, revocationFailMode);
         // --- Stale session (cookie exists but session doesn't): OBSERVE ONLY, DO NOT DECIDE ---
         //
         // *** CARD 349607. THIS BLOCK USED TO `return` HERE, AND THAT RETURN WAS A BYPASS. ***
@@ -409,8 +412,37 @@ function createMvpMiddleware(options = {}) {
         });
     };
 }
+/**
+ * The revocation decision, as a pure function (PAY-1882 step 4, NightHawk 66392).
+ *
+ * Separate + exported so the B1 defect is testable with a REAL mutant: the bug was
+ * that `data.forceInvalid === true` was read BEFORE revocationFailMode, so a
+ * producer that folds 'unknown' into forceInvalid made the 'open' lever dead.
+ *
+ * RULE: when the producer supplies `revocationStatus`, it is AUTHORITATIVE - the
+ * decision is made from it plus failMode, and the folded booleans are ignored for
+ * 'unknown'/'not_configured'. The booleans are read ONLY when revocationStatus is
+ * absent (idealresume.online's older boolean-only route).
+ */
+function decideForceInvalid(data, revocationFailMode) {
+    const status = data.revocationStatus;
+    if (typeof status === 'string') {
+        if (status === 'revoked')
+            return true;
+        if (status === 'active')
+            return false;
+        // S1 (NightHawk 66409): ANY other string - 'unknown', 'not_configured', a
+        // typo like 'Revoked', 'error', or '' - is treated as 'unknown' (fail mode
+        // applies), NEVER as 'active'. Returning false here would let the first
+        // producer that emits an unexpected state silently switch revocation OFF -
+        // the exact PAY-1880 fail-open class. Only an explicit 'active' is viable.
+        return revocationFailMode === 'closed';
+    }
+    // No revocationStatus: an older boolean producer. Absence of both stays false.
+    return data.forceInvalid === true || data.revoked === true;
+}
 /** Check session viability via internal API */
-async function checkViability(request, endpoint, log) {
+async function checkViability(request, endpoint, log, revocationFailMode) {
     const sessionStatus = {
         exists: false,
         forceInvalid: false,
@@ -443,6 +475,46 @@ async function checkViability(request, endpoint, log) {
             sessionStatus.exists = data.authenticated ?? (!!data.sessionTokenId && data.reason !== 'session_not_found');
             sessionStatus.requires2FA = data.requires2FA || false;
             sessionStatus.twoFactorComplete = data.twoFactorComplete || false;
+            // --- Session revocation (PAY-1882 Step 4) ---
+            // Two producer spellings are honoured, because both exist on the wire:
+            //   - boolean `forceInvalid` / `revoked` (idealresume.online's route today)
+            //   - the three-state `revocationStatus` the package's own viability
+            //     handlers now emit (PAY-1882 step 4).
+            //
+            // RULING (Jon, via BAPert 66316): 'revoked' ALWAYS fails closed. 'unknown'
+            // (a FAILED Vibe read) fails closed by default and is the ONLY state that
+            // the per-app `revocationFailMode` option can relax to viable.
+            //
+            // Four producer states (BAPert 66320), with the fail-closed ruling for
+            // 'not_configured' added by BAPert 66356:
+            //   'active'         - Vibe read OK, not revoked  -> viable
+            //   'revoked'        - Vibe says revoked          -> force-invalid, ALWAYS
+            //   'unknown'        - read FAILED                -> force-invalid if 'closed'
+            //   'not_configured' - no revocation source       -> force-invalid if 'closed'
+            //
+            // WHY 'not_configured' FAILS CLOSED WHEN 'closed': both live consumers of
+            // this middleware (portal.keelauth.com / keelauth-portal, idealvibe.online)
+            // DO set IDP_URL + VIBE_CLIENT_ID + VIBE_HMAC_KEY (BAPert 66356, measured in
+            // their committed manifests + the graft pipeline's own secret check), so for
+            // them 'not_configured' can only mean a MISCONFIGURATION - revocation
+            // silently switched off is exactly the PAY-1880 fail-open bug. An app with
+            // no revocation source that genuinely wants availability sets
+            // revocationFailMode 'open'.
+            //
+            // A MISSING revocationStatus (an older producer) keeps today's behaviour,
+            // i.e. NOT force-invalid: absence must never sign out a population that
+            // never opted into the check.
+            //
+            // *** revocationStatus IS AUTHORITATIVE WHEN PRESENT (NightHawk 66392). ***
+            // The package's own producers emit `forceInvalid: revocationStatus ===
+            // 'revoked' || revocationStatus === 'unknown'`. If the boolean were read
+            // FIRST, `forceInvalid: true` would short-circuit before revocationFailMode
+            // was consulted, so `'open'` could never keep an 'unknown' session viable -
+            // the opt-out lever would be DEAD. So: when a producer supplies a
+            // revocations status, decide from it + failMode and ignore the folded
+            // booleans for unknown/not_configured. The booleans are read ONLY when
+            // revocationStatus is ABSENT (idealresume.online's older boolean route).
+            sessionStatus.forceInvalid = decideForceInvalid(data, revocationFailMode);
             sessionPointer.exists = sessionStatus.exists ?? false;
             sessionPointer.sessionTokenId = data.sessionTokenId ?? null;
             sessionPointer.expired = data.accessTokenExpired || false;

package/dist/routes/auth/viability.d.ts

@@ -14,6 +14,7 @@
  * @since auth-ready-v2
  */
 import { NextRequest, NextResponse } from 'next/server';
+import { type RevocationStatus } from '../../vibe/sessions';
 /**
  * GET /api/session/viability - Check if session is viable
  *
@@ -34,6 +35,9 @@ export declare function GET(req: NextRequest): Promise<NextResponse<{
     hasRefreshToken: boolean;
     authenticated: boolean;
     sessionTokenId: string | null;
+    revocationStatus: RevocationStatus;
+    forceInvalid: boolean;
+    revoked: boolean;
     tenantRequiresTwoFactor: boolean;
     userHasCompletedTenantTwoFactorRequirements: boolean;
     userStillNeedsTwoFactor: boolean;
@@ -49,6 +53,7 @@ export declare function GET(req: NextRequest): Promise<NextResponse<{
     viable: boolean;
     needsRefresh: boolean;
     authenticated: boolean;
+    revocationStatus: RevocationStatus;
     error: string;
     code: string;
     correlationId: string;

package/dist/routes/auth/viability.js

@@ -22,6 +22,7 @@ const session_store_1 = require("../../lib/session-store");
 const idp_client_config_1 = require("../../lib/idp-client-config");
 const safe_error_response_1 = require("../../lib/safe-error-response");
 const token_log_id_1 = require("../../lib/token-log-id");
+const sessions_1 = require("../../vibe/sessions");
 /**
  * Get tenant-wide 2FA requirement from cached client config (from broker handshake)
  */
@@ -248,6 +249,41 @@ async function GET(req) {
         const oauthSessionNeedsTwoFactor = session?.mfaSignalPresent === true &&
             session?.mfaVerified === false &&
             !(session.idpRefreshToken || session?.refreshToken);
+        // --- Session revocation status (PAY-1882 step 4 producer half) ---
+        /*
+         * Resolve the four-state revocation status for this user (BAPert 66320).
+         * Read it HERE, above every authenticated return, so all three responses
+         * carry the SAME value - the same discipline as nextStep above.
+         *
+         * The middleware fails CLOSED by default on 'unknown' (a failed Vibe read)
+         * and always on 'revoked'; 'active' and 'not_configured' stay viable. A
+         * consumer that does NOT read revocationStatus is unaffected - absent is not
+         * revoked - so shipping this changes nothing for them until they opt in.
+         */
+        let revocationStatus = 'not_configured';
+        if (session) {
+            // BAPert 66480 condition 2 / ruling (ii) 66700: the numeric IdP id comes from
+            // the token's own `sub` claim FIRST (session.userId can be an email).
+            const revocationUserId = (0, sessions_1.resolveNumericIdpUserId)(session, session.idpAccessToken);
+            if (revocationUserId > 0) {
+                try {
+                    revocationStatus = await (0, sessions_1.getRevocationStatus)(revocationUserId, sessionToken);
+                }
+                catch {
+                    // getRevocationStatus does not throw by contract, but never let a
+                    // revocation probe take down the viability answer: fail closed.
+                    revocationStatus = 'unknown';
+                }
+            }
+            else {
+                // N1 (NightHawk 66392): a session exists but carries no usable numeric
+                // IdP id, so the check could not run -> 'unknown' (could not determine),
+                // NOT 'not_configured' (no revocation source).
+                // BAPert 66480 condition 1: emit ONE WARN (shape only) so a non-numeric
+                // id surfaces as a log line, not an unexplained sign-out.
+                revocationStatus = (0, sessions_1.warnNonNumericUserId)(sessionToken, session.userId);
+            }
+        }
         // Check access token expiry
         const now = Math.floor(Date.now() / 1000);
         // 240654 addendum 2: fall back to the Redis session's own expiry.
@@ -292,6 +328,11 @@ async function GET(req) {
                 needsRefresh: true,
                 authenticated: true,
                 sessionTokenId: sessionToken ? (0, token_log_id_1.tokenLogId)(sessionToken) : null,
+                // Session revocation (PAY-1882 step 4): the four-state status, plus the
+                // boolean the middleware's existing force-invalid branch already reads.
+                revocationStatus,
+                forceInvalid: revocationStatus === 'revoked' || revocationStatus === 'unknown',
+                revoked: revocationStatus === 'revoked',
                 // Clear names for middleware decision-making
                 tenantRequiresTwoFactor,
                 userHasCompletedTenantTwoFactorRequirements,
@@ -363,6 +404,10 @@ async function GET(req) {
                 twoFactorComplete: userHasCompletedTenantTwoFactorRequirements,
                 accessTokenExpired: true,
                 reason: 'Token expired',
+                // Session revocation (PAY-1882 step 4) - same value on every return.
+                revocationStatus,
+                forceInvalid: revocationStatus === 'revoked' || revocationStatus === 'unknown',
+                revoked: revocationStatus === 'revoked',
                 // RBAC fields
                 roles: session?.roles || [],
                 clientId: resolveClientId(session?.idpClientId),
@@ -375,6 +420,10 @@ async function GET(req) {
             hasRefreshToken,
             authenticated: true,
             sessionTokenId: sessionToken ? (0, token_log_id_1.tokenLogId)(sessionToken) : null,
+            // Session revocation (PAY-1882 step 4) - same value on every return.
+            revocationStatus,
+            forceInvalid: revocationStatus === 'revoked' || revocationStatus === 'unknown',
+            revoked: revocationStatus === 'revoked',
             // Clear names
             tenantRequiresTwoFactor,
             userHasCompletedTenantTwoFactorRequirements,
@@ -398,6 +447,10 @@ async function GET(req) {
             viable: false,
             needsRefresh: false,
             authenticated: false,
+            // PAY-1882 step 4: an exception here means the status could not be read.
+            // Report 'unknown' (not a bare 500 with no revocation signal) so the
+            // middleware's fail-closed default applies rather than reading it as viable.
+            revocationStatus: 'unknown',
             error: 'Failed to check session',
             code: 'INTERNAL_ERROR',
             correlationId

package/dist/utils/api.d.ts

@@ -33,6 +33,12 @@ export declare function apiFetch<T>(url: string, options?: ApiOptions): Promise<
  */
 export declare const RECOVERY_EXPIRED_TEXT = "This reset link has expired or was already used. Start password recovery again.";
 export declare const RESET_NEUTRAL_TEXT = "We couldn't set that password. Check it meets the requirements shown and try again.";
+/**
+ * PAY-2103 (AUTH-009): the IdP refuses a password found in a breach corpus; the route projects a
+ * `password_breached: true` boolean, and the user reads this. Distinct from the policy sentence,
+ * which would wrongly tell them to re-read the requirements.
+ */
+export declare const RESET_BREACHED_TEXT = "This password appears in a known data breach. Choose a different one.";
 /**
  * Three tiers for a 400/422 from reset (rigpert 60822, QAPert 60820), decided ONLY on codes the IdP actually sends:
  *   policy        details.code password_policy (projected by the handler as password_policy) -> the rule sentences

package/dist/utils/api.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.accountApi = exports.AccountApi = exports.RESET_NEUTRAL_TEXT = exports.RECOVERY_EXPIRED_TEXT = exports.ApiError = void 0;
+exports.accountApi = exports.AccountApi = exports.RESET_BREACHED_TEXT = exports.RESET_NEUTRAL_TEXT = exports.RECOVERY_EXPIRED_TEXT = exports.ApiError = void 0;
 exports.apiFetch = apiFetch;
 exports.resetFailureText = resetFailureText;
 const standardized_client_api_1 = require("../lib/standardized-client-api");
@@ -84,6 +84,12 @@ async function apiFetch(url, options = {}) {
  */
 exports.RECOVERY_EXPIRED_TEXT = 'This reset link has expired or was already used. Start password recovery again.';
 exports.RESET_NEUTRAL_TEXT = "We couldn't set that password. Check it meets the requirements shown and try again.";
+/**
+ * PAY-2103 (AUTH-009): the IdP refuses a password found in a breach corpus; the route projects a
+ * `password_breached: true` boolean, and the user reads this. Distinct from the policy sentence,
+ * which would wrongly tell them to re-read the requirements.
+ */
+exports.RESET_BREACHED_TEXT = 'This password appears in a known data breach. Choose a different one.';
 /**
  * Three tiers for a 400/422 from reset (rigpert 60822, QAPert 60820), decided ONLY on codes the IdP actually sends:
  *   policy        details.code password_policy (projected by the handler as password_policy) -> the rule sentences
@@ -196,7 +202,9 @@ class AccountApi {
             const policy = !!body?.password_policy;
             const rules = (0, password_rules_1.knownPasswordRules)(body?.password_policy?.rules);
             const tokenInvalid = body?.reset_token_invalid === true;
-            const err = new Error(resetFailureText(res.status, rules, policy, tokenInvalid));
+            // PAY-2103: a breached password is its own outcome, not a policy refusal.
+            const breached = body?.password_breached === true;
+            const err = new Error(breached ? exports.RESET_BREACHED_TEXT : resetFailureText(res.status, rules, policy, tokenInvalid));
             if (rules.length)
                 err.rules = rules;
             if ((res.status === 400 || res.status === 422) && tokenInvalid && !policy)