@payez/next-mvp 4.5.3 → 4.5.4

package/dist/middleware/create-middleware.js

@@ -575,7 +575,16 @@ async function checkViability(request, endpoint, log, revocationFailMode) {
             // booleans for unknown/not_configured. The booleans are read ONLY when
             // revocationStatus is ABSENT (idealresume.online's older boolean route).
             sessionStatus.forceInvalid = decideForceInvalid(data, revocationFailMode);
-            sessionPointer.exists = sessionStatus.exists ?? false;
+            // PAY-2216: a STALE session - the cookie resolved to a token, but no store holds the session - used to set
+            // pointer.exists=false, so makeAuthDecision took no_session (login, cookie NOT cleared) and its stale_session
+            // arm (clearCookies) was unreachable: a dead cookie lingered and re-ran viability on every request.
+            // Stale is a POSITIVE signal and needs ALL of: this 2xx read, exists === false, a sessionTokenId (every
+            // producer sets it only when a cookie resolved to a token: routes/auth/viability.ts, api-handlers/session/
+            // viability.ts, refresh-viability.ts 'session_not_found'), and a session cookie on THIS request (plain or
+            // __Secure-). A FAILED read never gets here (exists=null -> service_error, PAY-2147); a store error throws
+            // inside every producer and answers 5xx or 'unknown' WITHOUT a sessionTokenId; no cookie -> no_session.
+            const stale = sessionStatus.exists === false && !!data.sessionTokenId && hasSessionCookie(request);
+            sessionPointer.exists = stale ? true : (sessionStatus.exists ?? false);
             sessionPointer.sessionTokenId = data.sessionTokenId ?? null;
             sessionPointer.expired = data.accessTokenExpired || false;
             sessionPointer.hasRefreshToken = data.hasRefreshToken ?? data.canRefresh ?? false;
@@ -620,7 +629,12 @@ const RBAC_EXEMPT_PATHS = ['/error', '/unauthorized', '/service-unavailable'];
 /** Handle 'allow' decision - run RBAC if enabled */
 async function handleAllow(request, pathname, sessionPointer, sessionStatus, rbacExemptPaths = []) {
     const isPublic = (0, route_config_1.isUnauthenticatedRoute)(pathname);
-    if ((0, rbac_check_1.isRBACEnabled)() && !isPublic && sessionPointer.exists) {
+    // PAY-2216: RBAC needs a session that viability CONFIRMED. A stale /api request (pointer.exists only says the
+    // cookie is present, status.exists is false) is allowed through so the route handler answers its own 401 - not an
+    // RBAC 401 here. TRUTHY, not `=== true` (NightHawk 71960): status.exists carries the producer's JSON value as-is,
+    // and a consumer route may answer authenticated: 1 / "true"; `=== true` skipped RBAC for those healthy sessions
+    // (fail-OPEN). Truthy keeps 4.5.3's RBAC coverage exactly and still excludes stale (false) and a failed read (null).
+    if ((0, rbac_check_1.isRBACEnabled)() && !isPublic && sessionPointer.exists && sessionStatus.exists) {
         // Skip RBAC for error/fallback pages (prevent redirect loops) and app-configured exempt paths
         if (RBAC_EXEMPT_PATHS.some(p => pathname.startsWith(p)) ||
             rbacExemptPaths.some(p => pathname.startsWith(p))) {