@payez/next-mvp 4.5.3 → 4.5.4

package/src/middleware/create-middleware.ts

@@ -741,7 +741,16 @@ async function checkViability(
       // booleans for unknown/not_configured. The booleans are read ONLY when
       // revocationStatus is ABSENT (idealresume.online's older boolean route).
       sessionStatus.forceInvalid = decideForceInvalid(data, revocationFailMode);
-      sessionPointer.exists = sessionStatus.exists ?? false;
+      // PAY-2216: a STALE session - the cookie resolved to a token, but no store holds the session - used to set
+      // pointer.exists=false, so makeAuthDecision took no_session (login, cookie NOT cleared) and its stale_session
+      // arm (clearCookies) was unreachable: a dead cookie lingered and re-ran viability on every request.
+      // Stale is a POSITIVE signal and needs ALL of: this 2xx read, exists === false, a sessionTokenId (every
+      // producer sets it only when a cookie resolved to a token: routes/auth/viability.ts, api-handlers/session/
+      // viability.ts, refresh-viability.ts 'session_not_found'), and a session cookie on THIS request (plain or
+      // __Secure-). A FAILED read never gets here (exists=null -> service_error, PAY-2147); a store error throws
+      // inside every producer and answers 5xx or 'unknown' WITHOUT a sessionTokenId; no cookie -> no_session.
+      const stale = sessionStatus.exists === false && !!data.sessionTokenId && hasSessionCookie(request);
+      sessionPointer.exists = stale ? true : (sessionStatus.exists ?? false);
       sessionPointer.sessionTokenId = data.sessionTokenId ?? null;
       sessionPointer.expired = data.accessTokenExpired || false;
       sessionPointer.hasRefreshToken = data.hasRefreshToken ?? data.canRefresh ?? false;
@@ -815,7 +824,12 @@ async function handleAllow(
 ): Promise<NextResponse> {
   const isPublic = isUnauthenticatedRoute(pathname);
 
-  if (isRBACEnabled() && !isPublic && sessionPointer.exists) {
+  // PAY-2216: RBAC needs a session that viability CONFIRMED. A stale /api request (pointer.exists only says the
+  // cookie is present, status.exists is false) is allowed through so the route handler answers its own 401 - not an
+  // RBAC 401 here. TRUTHY, not `=== true` (NightHawk 71960): status.exists carries the producer's JSON value as-is,
+  // and a consumer route may answer authenticated: 1 / "true"; `=== true` skipped RBAC for those healthy sessions
+  // (fail-OPEN). Truthy keeps 4.5.3's RBAC coverage exactly and still excludes stale (false) and a failed read (null).
+  if (isRBACEnabled() && !isPublic && sessionPointer.exists && sessionStatus.exists) {
     // Skip RBAC for error/fallback pages (prevent redirect loops) and app-configured exempt paths
     if (RBAC_EXEMPT_PATHS.some(p => pathname.startsWith(p)) ||
         rbacExemptPaths.some(p => pathname.startsWith(p))) {