@payez/next-mvp 4.5.1 → 4.5.2

package/dist/auth/auth-decision.d.ts

@@ -39,5 +39,10 @@ export type AuthAction = {
  * Main decision function - pure, testable, deterministic.
  * PAY-2136: when `context.isPrefetch` is set, no redirect it returns asks for cookies to be cleared; the
  * redirect itself is kept, and the next real navigation reaches the same decision and clears then.
+ *
+ * @deprecated PAY-2180: this exported engine is NOT the one the middleware runs. `createMvpMiddleware` decides with
+ * its own private engine (middleware/create-middleware.ts), so calling this answers a question nothing enforces.
+ * A sweep found no code consumer in the portal, idealvibe, idealresume or cryptaply. It will be REMOVED in the next
+ * major version, together with its re-exports from the package root and `/edge`. Use `createMvpMiddleware`.
  */
 export declare function makeAuthDecision(context: AuthContext): AuthAction;

package/dist/auth/auth-decision.js

@@ -9,12 +9,24 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.makeAuthDecision = makeAuthDecision;
 const safe_callback_1 = require("./safe-callback");
 const token_log_id_1 = require("../lib/token-log-id");
+/** PAY-2180: warn once per process, not per request. */
+let deprecationWarned = false;
 /**
  * Main decision function - pure, testable, deterministic.
  * PAY-2136: when `context.isPrefetch` is set, no redirect it returns asks for cookies to be cleared; the
  * redirect itself is kept, and the next real navigation reaches the same decision and clears then.
+ *
+ * @deprecated PAY-2180: this exported engine is NOT the one the middleware runs. `createMvpMiddleware` decides with
+ * its own private engine (middleware/create-middleware.ts), so calling this answers a question nothing enforces.
+ * A sweep found no code consumer in the portal, idealvibe, idealresume or cryptaply. It will be REMOVED in the next
+ * major version, together with its re-exports from the package root and `/edge`. Use `createMvpMiddleware`.
  */
 function makeAuthDecision(context) {
+    if (!deprecationWarned) {
+        deprecationWarned = true;
+        console.warn('[next-mvp] makeAuthDecision (auth/auth-decision) is deprecated (PAY-2180) and will be removed in the next major: ' +
+            'createMvpMiddleware does not use it. Use createMvpMiddleware.');
+    }
     const action = decide(context);
     if (context.isPrefetch && action.type === 'redirect' && action.clearCookies) {
         const { clearCookies: _dropped, ...rest } = action;

package/dist/lib/idp-fetch.d.ts

@@ -1,6 +1,7 @@
 import { NextRequest } from 'next/server';
 import { assertAbsoluteIdpUrl } from './idp-url-guard';
-export { assertAbsoluteIdpUrl };
+import { parseRetryAfterSeconds } from './retry-after';
+export { assertAbsoluteIdpUrl, parseRetryAfterSeconds };
 /**
  * Centralized IDP fetch helper
  * - Injects Bearer from Redis session
@@ -12,5 +13,11 @@ export interface IdpFetchResult<T = any> {
     status: number;
     json: T | null;
     attemptedRefresh: boolean;
+    /**
+     * PAY-1608: the upstream Retry-After in whole seconds, when the IDP sent a usable one. Core sends it on every
+     * 2FA lock (MfaController.SecondFactorLocked: 429 + Retry-After 900; VerifyTotp: what is left of the lock).
+     * It used to be dropped here, so no BFF could state the real lock window. Absent otherwise.
+     */
+    retryAfterSeconds?: number;
 }
 export declare function idpFetchJSON<T = any>(req: NextRequest, targetUrl: string, init?: RequestInit): Promise<IdpFetchResult<T>>;

package/dist/lib/idp-fetch.js

@@ -33,13 +33,15 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.assertAbsoluteIdpUrl = void 0;
+exports.parseRetryAfterSeconds = exports.assertAbsoluteIdpUrl = void 0;
 exports.idpFetchJSON = idpFetchJSON;
 const test_aware_get_token_1 = require("./test-aware-get-token");
 const session_store_1 = require("./session-store");
 const internal_api_1 = require("./internal-api");
 const idp_url_guard_1 = require("./idp-url-guard");
 Object.defineProperty(exports, "assertAbsoluteIdpUrl", { enumerable: true, get: function () { return idp_url_guard_1.assertAbsoluteIdpUrl; } });
+const retry_after_1 = require("./retry-after");
+Object.defineProperty(exports, "parseRetryAfterSeconds", { enumerable: true, get: function () { return retry_after_1.parseRetryAfterSeconds; } });
 function buildHeaders(req, bearer, extra) {
     const headers = {
         Accept: 'application/json',
@@ -177,5 +179,6 @@ async function idpFetchJSON(req, targetUrl, init = {}) {
         }
         catch { }
     }
-    return { ok: res.ok, status: res.status, json: json, attemptedRefresh };
+    const retryAfterSeconds = (0, retry_after_1.parseRetryAfterSeconds)(res.headers?.get?.('Retry-After'));
+    return { ok: res.ok, status: res.status, json: json, attemptedRefresh, ...(retryAfterSeconds ? { retryAfterSeconds } : {}) };
 }

package/dist/lib/retry-after.d.ts

@@ -0,0 +1,10 @@
+/**
+ * PAY-1608: parse an HTTP Retry-After header to whole seconds.
+ *
+ * Accepts delta-seconds ("900") and an HTTP date in the future. Answers undefined for absent, zero, negative,
+ * fractional, past or malformed values - a caller that gets undefined states no window rather than a guessed one.
+ *
+ * A dependency-free leaf on purpose: idp-fetch re-exports it, but a test can load it without the session/redis
+ * graph idp-fetch pulls in.
+ */
+export declare function parseRetryAfterSeconds(value: string | null | undefined, nowMs?: number): number | undefined;

package/dist/lib/retry-after.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseRetryAfterSeconds = parseRetryAfterSeconds;
+/**
+ * PAY-1608: parse an HTTP Retry-After header to whole seconds.
+ *
+ * Accepts delta-seconds ("900") and an HTTP date in the future. Answers undefined for absent, zero, negative,
+ * fractional, past or malformed values - a caller that gets undefined states no window rather than a guessed one.
+ *
+ * A dependency-free leaf on purpose: idp-fetch re-exports it, but a test can load it without the session/redis
+ * graph idp-fetch pulls in.
+ */
+function parseRetryAfterSeconds(value, nowMs = Date.now()) {
+    if (typeof value !== 'string')
+        return undefined;
+    const v = value.trim();
+    if (/^\d+$/.test(v)) {
+        const n = parseInt(v, 10);
+        return n > 0 ? n : undefined;
+    }
+    // Only something that looks like an HTTP date (it has letters: "Sat, 10 Oct 2026 12:01:30 GMT") is parsed as
+    // one; "-5" and "1.5" must not reach Date.parse, which would read them as years.
+    if (!/[a-z]/i.test(v))
+        return undefined;
+    const at = Date.parse(v);
+    if (!Number.isFinite(at))
+        return undefined;
+    const secs = Math.ceil((at - nowMs) / 1000);
+    return secs > 0 ? secs : undefined;
+}

package/dist/lib/two-factor-verify-failure.d.ts

@@ -56,10 +56,18 @@ export declare function stepUpRefusal(status: number, json: unknown): StepUpRefu
  */
 export declare function upstreamErrorTexts(json: unknown): string[];
 export declare function classifyTwoFactorVerifyFailure(status: number, json: unknown): TwoFactorVerifyFailureCode;
+/**
+ * PAY-1608: the window as words - "15 minutes", "1 minute", "45 seconds", "2 hours". Rounded UP, so the user is never
+ * told a shorter wait than the IDP enforces. Undefined in, undefined out.
+ */
+export declare function formatLockWindow(seconds: number | undefined): string | undefined;
+/** PAY-1608: the LOCKED sentence with the IDP's real window, or the number-free one when none was sent. */
+export declare function lockedText(retryAfterSeconds?: number): string;
 export declare function twoFactorVerifyFailure(result: {
     status: number;
     json: unknown;
     attemptedRefresh: boolean;
+    retryAfterSeconds?: number;
 }, method: TwoFactorVerifyMethod): NextResponse;
 /**
  * PAY-1443 residual: account/send-code on the SAME verify-code screen. A send has no

package/dist/lib/two-factor-verify-failure.js

@@ -4,6 +4,8 @@ exports.STEP_UP_REFUSAL_CODE = void 0;
 exports.stepUpRefusal = stepUpRefusal;
 exports.upstreamErrorTexts = upstreamErrorTexts;
 exports.classifyTwoFactorVerifyFailure = classifyTwoFactorVerifyFailure;
+exports.formatLockWindow = formatLockWindow;
+exports.lockedText = lockedText;
 exports.twoFactorVerifyFailure = twoFactorVerifyFailure;
 exports.classifyTwoFactorSendFailure = classifyTwoFactorSendFailure;
 exports.twoFactorSendCodeFailure = twoFactorSendCodeFailure;
@@ -33,7 +35,9 @@ const INVALID_CODE_TEXT = {
     backup_code: 'Invalid backup code. Please try again.',
 };
 const FIXED_TEXT = {
-    LOCKED: 'Too many incorrect codes. Verification is locked for 15 minutes - wait before entering another code.',
+    // PAY-1608: NO NUMBER HERE. This is the sentence for a lock whose window the IDP did not send; lockedText()
+    // states the real window when Retry-After arrives. A hard-coded "15 minutes" was true only while every lock was 15.
+    LOCKED: 'Too many incorrect codes. Verification is locked for now - even a correct code is refused until the lock ends. Wait before entering another code.',
     RATE_LIMITED: 'Too many attempts. Please wait a moment and try again.',
     SESSION_REJECTED: 'We could not verify the code for this session. Please try again.',
     VERIFY_UNAVAILABLE: 'We could not verify the code right now. Please try again.',
@@ -186,13 +190,41 @@ function classifyTwoFactorVerifyFailure(status, json) {
         return 'VERIFY_UNAVAILABLE';
     return 'VERIFY_FAILED';
 }
+/**
+ * PAY-1608: the window as words - "15 minutes", "1 minute", "45 seconds", "2 hours". Rounded UP, so the user is never
+ * told a shorter wait than the IDP enforces. Undefined in, undefined out.
+ */
+function formatLockWindow(seconds) {
+    if (typeof seconds !== 'number' || !Number.isFinite(seconds) || seconds <= 0)
+        return undefined;
+    const plural = (n, unit) => `${n} ${unit}${n === 1 ? '' : 's'}`;
+    if (seconds < 60)
+        return plural(Math.ceil(seconds), 'second');
+    const minutes = Math.ceil(seconds / 60);
+    if (minutes < 120)
+        return plural(minutes, 'minute');
+    return plural(Math.ceil(minutes / 60), 'hour');
+}
+/** PAY-1608: the LOCKED sentence with the IDP's real window, or the number-free one when none was sent. */
+function lockedText(retryAfterSeconds) {
+    const window = formatLockWindow(retryAfterSeconds);
+    return window
+        ? `Too many incorrect codes. Verification is locked for ${window} - wait before entering another code.`
+        : FIXED_TEXT.LOCKED;
+}
 function twoFactorVerifyFailure(result, method) {
     const refusal = stepUpRefusal(result.status, result.json);
     if (refusal)
         return stepUpResponse(refusal, result.attemptedRefresh);
     const code = classifyTwoFactorVerifyFailure(result.status, result.json);
-    const error = code === 'INVALID_CODE' ? INVALID_CODE_TEXT[method] : FIXED_TEXT[code];
-    return server_1.NextResponse.json({ success: false, error, code, meta: { attemptedRefresh: result.attemptedRefresh } }, { status: result.status });
+    const error = code === 'INVALID_CODE' ? INVALID_CODE_TEXT[method]
+        : code === 'LOCKED' ? lockedText(result.retryAfterSeconds)
+            : FIXED_TEXT[code];
+    // PAY-1608: a lock or a throttle relays the IDP's window, as a number (for a client that words it itself) and as the
+    // standard header. Never on other failures, and never invented: absent upstream means absent here.
+    const wait = (code === 'LOCKED' || code === 'RATE_LIMITED') && formatLockWindow(result.retryAfterSeconds)
+        ? Math.ceil(result.retryAfterSeconds) : undefined;
+    return server_1.NextResponse.json({ success: false, error, code, ...(wait ? { retryAfterSeconds: wait } : {}), meta: { attemptedRefresh: result.attemptedRefresh } }, { status: result.status, ...(wait ? { headers: { 'Retry-After': String(wait) } } : {}) });
 }
 const SEND_LABEL = { sms: 'text message', email: 'email' };
 function classifyTwoFactorSendFailure(status, json) {