@payez/next-mvp 4.5.2 → 4.5.3

package/dist/auth/auth-decision.js

@@ -61,8 +61,10 @@ function decide(context) {
         return {
             type: 'redirect',
             location: '/account-auth/login?error=ServiceUnavailable&reason=CircuitBreakerOpen',
-            reason: 'CircuitBreakerOpen',
-            clearCookies: true
+            reason: 'CircuitBreakerOpen'
+            // PAY-2147: NO clearCookies. The breaker opening is not a verdict on the session; clearing here logged out every
+            // user who made a request during a blip. (Deprecated twin: it cannot express a 503 or the /service-unavailable
+            // page - createMvpMiddleware does, see serviceUnavailableResponse.)
         };
     }
     // No session pointer (JWT cookie) - need to login

package/dist/middleware/create-middleware.js

@@ -160,6 +160,31 @@ function refreshFailureResponse(request, location, errorCode, clearCookies = fal
     }
     return redirectTo(request, location, clearCookies);
 }
+/**
+ * PAY-2147: the terminal answer when the middleware CANNOT TELL whether the session is good
+ * (circuit breaker open, a half-open breaker refusing a refresh attempt, or the viability read failed).
+ *
+ * "I could not check" is not a verdict on the session, so this NEVER touches a cookie: a transient blip
+ * in the IdP / viability path used to wipe the session of every user who made any request while the
+ * breaker was open. Cookies are cleared only on a POSITIVE signal (force_invalidated, stale_session,
+ * pre_2fa_token_expired, refresh 401/403, explicit sign-out) - never from here.
+ *
+ *  - /api/*  -> 503 JSON a caller can branch on (a redirect would be followed by fetch() into a 200 HTML page).
+ *  - pages   -> /service-unavailable (public + allowDuringCircuitBreakerOpen, so it cannot loop), carrying the
+ *               requested path as `callbackUrl` so "Try again" returns the user to it still signed in. The path goes
+ *               through safeCallbackPath (URL-parser origin check): an off-origin or auth-surface value is dropped.
+ */
+function serviceUnavailableResponse(request) {
+    const { pathname, search } = request.nextUrl;
+    if (pathname.startsWith('/api/')) {
+        return server_1.NextResponse.json({ error: 'ServiceUnavailable' }, { status: 503 });
+    }
+    const target = new URL('/service-unavailable', request.url);
+    const callback = (0, safe_callback_1.safeCallbackPath)(pathname + search);
+    if (callback !== '/')
+        target.searchParams.set('callbackUrl', callback);
+    return server_1.NextResponse.redirect(target);
+}
 // =============================================================================
 // AUTH DECISION ENGINE
 // =============================================================================
@@ -198,15 +223,12 @@ function makeAuthDecision(ctx) {
         return { type: 'allow' };
     }
     // --- Circuit breaker open: Service degraded ---
+    // PAY-2147: the breaker opening says the IdP/viability path is unreachable, NOT that the session is bad.
+    // Answer "service unavailable" (503 for /api, /service-unavailable for pages) and leave every cookie alone.
     if (circuitBreakerOpen) {
         if (onLoginPage)
             return { type: 'allow' };
-        return {
-            type: 'redirect',
-            location: `${LOGIN_PAGE}?error=ServiceUnavailable`,
-            reason: 'circuit_breaker_open',
-            clearCookies: true
-        };
+        return { type: 'service_error', reason: 'circuit_breaker_open' };
     }
     // --- No session cookie: Need to login ---
     if (!sessionPointer.exists) {
@@ -227,6 +249,8 @@ function makeAuthDecision(ctx) {
     }
     // --- Service error: Can't verify session ---
     if (sessionStatus.exists === null || sessionStatus.forceInvalid === null) {
+        if (onLoginPage)
+            return { type: 'allow' }; // the login page must stay reachable while the check is down
         return { type: 'service_error', reason: 'viability_check_failed' };
     }
     // --- Session force-invalidated (admin action, password change, etc.) ---
@@ -466,6 +490,17 @@ function decideForceInvalid(data, revocationFailMode) {
     // No revocationStatus: an older boolean producer. Absence of both stays false.
     return data.forceInvalid === true || data.revoked === true;
 }
+/**
+ * PAY-2147: does the request carry a session cookie? Used ONLY when the viability read itself FAILED.
+ * Before this, a failed read left sessionPointer.exists=false, so the decision engine took its `no_session` arm
+ * (pages -> the LOGIN page, /api -> straight through) and its `exists === null` -> service_error arm below it was
+ * unreachable dead code: a user holding a perfectly good session was told to sign in during an outage. With a
+ * cookie present and the check down we do not know the session is bad, so the engine must say "service
+ * unavailable", not "sign in". No cookie -> unchanged (no_session).
+ */
+function hasSessionCookie(request) {
+    return !!(request.cookies.get((0, app_slug_1.getSessionCookieName)())?.value || request.cookies.get((0, app_slug_1.getSecureSessionCookieName)())?.value);
+}
 /** Check session viability via internal API */
 async function checkViability(request, endpoint, log, revocationFailMode) {
     const sessionStatus = {
@@ -551,12 +586,14 @@ async function checkViability(request, endpoint, log, revocationFailMode) {
             log.error('Viability check failed', { status: response.status });
             sessionStatus.exists = null;
             sessionStatus.forceInvalid = null;
+            sessionPointer.exists = hasSessionCookie(request); // PAY-2147: see hasSessionCookie
         }
     }
     catch (error) {
         log.error('Viability check error', { error: error instanceof Error ? error.message : String(error) });
         sessionStatus.exists = null;
         sessionStatus.forceInvalid = null;
+        sessionPointer.exists = hasSessionCookie(request); // PAY-2147: see hasSessionCookie
     }
     return { sessionStatus, sessionPointer };
 }
@@ -569,7 +606,7 @@ async function executeDecision(request, decision, pathname, sessionPointer, sess
         case 'redirect':
             return redirectTo(request, decision.location, decision.clearCookies);
         case 'service_error':
-            return server_1.NextResponse.redirect(new URL('/service-unavailable', request.url));
+            return serviceUnavailableResponse(request);
         case 'refresh_needed':
             // PAY-2136: a speculative request must not spend (rotate) a single-use refresh token or, on a 401/403,
             // clear the session. Let it through; the real navigation refreshes.
@@ -629,7 +666,9 @@ async function handleRefresh(request, safeCallback, opts) {
     // Check if circuit breaker allows refresh attempt
     if (!cb.canAttemptRefresh()) {
         log.warn('Circuit breaker preventing refresh attempt');
-        return refreshFailureResponse(request, `${LOGIN_PAGE}?callbackUrl=${encodeURIComponent(safeCallback)}&error=ServiceUnavailable`, 'ServiceUnavailable', true);
+        // PAY-2147: a breaker that merely declines to TRY a refresh has learned nothing about the session; wiping the
+        // cookies here logged out every user on the first request after a blip (HALF_OPEN refuses all but one probe).
+        return serviceUnavailableResponse(request);
     }
     try {
         const baseUrl = (0, internal_api_url_1.getInternalApiUrl)(request);