@payez/next-mvp 4.5.3 → 4.5.5

package/dist/auth/better-auth.js

@@ -64,6 +64,7 @@ const jose_1 = require("jose"); // better-auth's own JWT dependency
 const better_auth_1 = require("better-auth");
 const next_js_1 = require("better-auth/next-js");
 const next_js_2 = require("better-auth/next-js");
+const session_response_sanitizer_1 = require("./session-response-sanitizer");
 const magic_link_1 = require("better-auth/plugins/magic-link");
 const client_key_1 = require("../lib/client-key");
 const generic_oauth_1 = require("better-auth/plugins/generic-oauth");
@@ -887,7 +888,10 @@ async function getBetterAuthHandler() {
     if (!isBetterAuthEnabled())
         return null;
     const auth = await getBetterAuthInstance();
-    return (0, next_js_2.toNextJsHandler)(auth);
+    // PAY-2217: Better Auth's native endpoints (get-session, list-sessions, sign-in/*, sign-up/*) put the session
+    // token in the body. Strip it at the HTTP boundary here, so every consumer that mounts this handler gets it;
+    // auth.api (server-side) is untouched and still sees the token. See session-response-sanitizer.ts.
+    return (0, session_response_sanitizer_1.wrapBetterAuthHandler)(auth, (0, next_js_2.toNextJsHandler)(auth));
 }
 /**
  * Exchange OAuth identity for IDP tokens and store in the BA Redis session.

package/dist/auth/session-response-sanitizer.d.ts

@@ -0,0 +1,70 @@
+/**
+ * PAY-2217: no session token reaches browser JS from Better Auth's own HTTP endpoints.
+ *
+ * WHAT WAS WRONG. PAY-1481 removed token material from the package's own GET /api/auth/session. Better Auth's native
+ * endpoints are a separate surface served by the catch-all mount, and their default bodies carry the session
+ * credential identifier:
+ *   GET  /get-session    -> { session: { id, token, userId, ... }, user }
+ *   GET  /list-sessions  -> [ { id, token, ... } ]        (EVERY session of the user, not just this one)
+ *   POST /sign-in/*      -> { token, user, ... }
+ *   POST /sign-up/*      -> { token, user }
+ *   GET  /magic-link/verify (no callbackURL) -> { token, user }   (NightHawk G4 on PR 1190, measured on a real instance)
+ * and any plugin endpoint (passkey verify, two-factor verify, genericOAuth) answers a session object the same way.
+ * `token` is the Redis key of the session. The cookie is token.HMAC and Path B verifies the signature, so a bare
+ * token is not a replayable cookie (gate rows B1-B4 measure that), but it is a credential identifier readable by any
+ * script on the page, for this session and for every other session the user has. It breaks the PAY-1481 rule.
+ *
+ * EVERY 2xx JSON BODY IS STRIPPED, not a named list of paths. A list protects the endpoints someone remembered and
+ * silently misses the next plugin; the strip is a function of the response, so a new endpoint is covered the day it is
+ * mounted. A 2xx JSON body that legitimately needs one of these names to reach the browser would have to be
+ * allowlisted here on purpose (none is known: no client in this package reads one).
+ *
+ * WHERE THE FIX LIVES, AND WHY NOT customSession. Server-side code in this package reads session.session.token from
+ * auth.api.getSession() (viability, refresh, status, the OAuth exchange). A customSession plugin or an after-hook
+ * runs for those calls too and would strip the token from them. So the strip is applied at the HTTP BOUNDARY only:
+ * getBetterAuthHandler() returns handlers wrapped by wrapBetterAuthHandler(), and auth.api stays untouched.
+ *
+ * WHAT THE BROWSER GETS INSTEAD.
+ *   - list-sessions rows carry `isCurrent` (computed here against the caller's cookie-resolved session) and `id`.
+ *   - POST /revoke-session-by-id { id }: revokes ONE of the CALLER's sessions by its id. An id that is not one of the
+ *     caller's own sessions answers 404 (never 403: do not confirm that another user's session id exists).
+ *   - Better Auth's native POST /revoke-session { token } still exists and still requires a cookie-resolved session
+ *     that owns the token, but no browser ever holds a token to send it.
+ */
+/** Deep copy of `value` with every credential-named key removed, at any depth, in objects and arrays. */
+export declare function stripSessionCredentials(value: unknown): unknown;
+/** "/api/auth/get-session" -> "/get-session". Anything not under an /auth/ segment is returned as-is. */
+export declare function authSubPath(pathname: string): string;
+interface AuthApi {
+    getSession: (opts: {
+        headers: Headers;
+    }) => Promise<any>;
+    listSessions: (opts: {
+        headers: Headers;
+    }) => Promise<any>;
+    revokeSession: (opts: {
+        headers: Headers;
+        body: {
+            token: string;
+        };
+        asResponse?: boolean;
+    }) => Promise<any>;
+}
+/** Sanitise one already-produced Better Auth response. Pure function of (request, response, current token). */
+export declare function sanitizeBetterAuthResponse(req: Request, res: Response, currentToken: () => Promise<string | undefined>): Promise<Response>;
+type Handler = (req: Request) => Promise<Response>;
+/**
+ * Wrap Better Auth's Next.js handlers so no response carries a session credential to the browser.
+ * `auth` is the Better Auth instance; its `api` is used server-side only (to find the caller's current session and to
+ * revoke by id) and is not modified.
+ */
+export declare function wrapBetterAuthHandler(auth: {
+    api: AuthApi;
+}, handlers: {
+    GET: Handler;
+    POST: Handler;
+}): {
+    GET: Handler;
+    POST: Handler;
+};
+export {};

package/dist/auth/session-response-sanitizer.js

@@ -0,0 +1,136 @@
+"use strict";
+/**
+ * PAY-2217: no session token reaches browser JS from Better Auth's own HTTP endpoints.
+ *
+ * WHAT WAS WRONG. PAY-1481 removed token material from the package's own GET /api/auth/session. Better Auth's native
+ * endpoints are a separate surface served by the catch-all mount, and their default bodies carry the session
+ * credential identifier:
+ *   GET  /get-session    -> { session: { id, token, userId, ... }, user }
+ *   GET  /list-sessions  -> [ { id, token, ... } ]        (EVERY session of the user, not just this one)
+ *   POST /sign-in/*      -> { token, user, ... }
+ *   POST /sign-up/*      -> { token, user }
+ *   GET  /magic-link/verify (no callbackURL) -> { token, user }   (NightHawk G4 on PR 1190, measured on a real instance)
+ * and any plugin endpoint (passkey verify, two-factor verify, genericOAuth) answers a session object the same way.
+ * `token` is the Redis key of the session. The cookie is token.HMAC and Path B verifies the signature, so a bare
+ * token is not a replayable cookie (gate rows B1-B4 measure that), but it is a credential identifier readable by any
+ * script on the page, for this session and for every other session the user has. It breaks the PAY-1481 rule.
+ *
+ * EVERY 2xx JSON BODY IS STRIPPED, not a named list of paths. A list protects the endpoints someone remembered and
+ * silently misses the next plugin; the strip is a function of the response, so a new endpoint is covered the day it is
+ * mounted. A 2xx JSON body that legitimately needs one of these names to reach the browser would have to be
+ * allowlisted here on purpose (none is known: no client in this package reads one).
+ *
+ * WHERE THE FIX LIVES, AND WHY NOT customSession. Server-side code in this package reads session.session.token from
+ * auth.api.getSession() (viability, refresh, status, the OAuth exchange). A customSession plugin or an after-hook
+ * runs for those calls too and would strip the token from them. So the strip is applied at the HTTP BOUNDARY only:
+ * getBetterAuthHandler() returns handlers wrapped by wrapBetterAuthHandler(), and auth.api stays untouched.
+ *
+ * WHAT THE BROWSER GETS INSTEAD.
+ *   - list-sessions rows carry `isCurrent` (computed here against the caller's cookie-resolved session) and `id`.
+ *   - POST /revoke-session-by-id { id }: revokes ONE of the CALLER's sessions by its id. An id that is not one of the
+ *     caller's own sessions answers 404 (never 403: do not confirm that another user's session id exists).
+ *   - Better Auth's native POST /revoke-session { token } still exists and still requires a cookie-resolved session
+ *     that owns the token, but no browser ever holds a token to send it.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stripSessionCredentials = stripSessionCredentials;
+exports.authSubPath = authSubPath;
+exports.sanitizeBetterAuthResponse = sanitizeBetterAuthResponse;
+exports.wrapBetterAuthHandler = wrapBetterAuthHandler;
+/** Credential-bearing key names, compared case- and separator-insensitively. */
+const STRIP_KEYS = new Set(['token', 'sessiontoken', 'accesstoken', 'refreshtoken', 'idtoken']);
+const norm = (k) => k.toLowerCase().replace(/[_\-\s]/g, '');
+/** Deep copy of `value` with every credential-named key removed, at any depth, in objects and arrays. */
+function stripSessionCredentials(value) {
+    if (Array.isArray(value))
+        return value.map(stripSessionCredentials);
+    if (value !== null && typeof value === 'object') {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            if (STRIP_KEYS.has(norm(k)))
+                continue;
+            out[k] = stripSessionCredentials(v);
+        }
+        return out;
+    }
+    return value;
+}
+/** "/api/auth/get-session" -> "/get-session". Anything not under an /auth/ segment is returned as-is. */
+function authSubPath(pathname) {
+    const i = pathname.indexOf('/api/auth/');
+    if (i >= 0)
+        return pathname.slice(i + '/api/auth'.length).replace(/\/+$/, '') || '/';
+    return pathname.replace(/\/+$/, '') || '/';
+}
+function isJson(res) {
+    return (res.headers.get('content-type') || '').toLowerCase().includes('application/json');
+}
+/** A Response with a new JSON body and the original status and headers (content-length recomputed by the runtime). */
+function withJsonBody(res, body) {
+    const headers = new Headers(res.headers);
+    headers.delete('content-length');
+    return new Response(JSON.stringify(body), { status: res.status, statusText: res.statusText, headers });
+}
+/** Sanitise one already-produced Better Auth response. Pure function of (request, response, current token). */
+async function sanitizeBetterAuthResponse(req, res, currentToken) {
+    const sub = authSubPath(new URL(req.url).pathname);
+    if (!res.ok || !isJson(res))
+        return res;
+    let body;
+    try {
+        body = await res.clone().json();
+    }
+    catch {
+        return res; // unreadable body: nothing to strip, and do not turn it into a different failure
+    }
+    if (sub === '/list-sessions' && Array.isArray(body)) {
+        const cur = await currentToken().catch(() => undefined);
+        body = body.map((row) => row && typeof row === 'object' ? { ...row, isCurrent: !!cur && row.token === cur } : row);
+    }
+    return withJsonBody(res, stripSessionCredentials(body));
+}
+const json = (status, body) => new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json' } });
+/** POST /revoke-session-by-id { id }: revoke one of the caller's own sessions by id. */
+async function revokeById(req, api) {
+    let id;
+    try {
+        id = (await req.json())?.id;
+    }
+    catch {
+        return json(400, { code: 'INVALID_REQUEST', message: 'Body must be JSON { id }' });
+    }
+    if (typeof id !== 'string' || id.length === 0) {
+        return json(400, { code: 'INVALID_REQUEST', message: 'id is required' });
+    }
+    const headers = new Headers(req.headers);
+    const rows = await api.listSessions({ headers }).catch(() => null);
+    if (rows === null)
+        return json(401, { code: 'UNAUTHORIZED', message: 'No session' });
+    // listSessions returns ONLY the caller's own sessions, so a foreign id cannot match: 404, not 403.
+    const row = Array.isArray(rows) ? rows.find((r) => r && r.id === id && typeof r.token === 'string') : undefined;
+    if (!row)
+        return json(404, { code: 'SESSION_NOT_FOUND', message: 'No such session' });
+    const res = await api.revokeSession({ headers, body: { token: row.token }, asResponse: true });
+    // Pass Better Auth's own answer (and its Set-Cookie when the current session was the one revoked) through.
+    return res instanceof Response ? res : json(200, { status: true });
+}
+/**
+ * Wrap Better Auth's Next.js handlers so no response carries a session credential to the browser.
+ * `auth` is the Better Auth instance; its `api` is used server-side only (to find the caller's current session and to
+ * revoke by id) and is not modified.
+ */
+function wrapBetterAuthHandler(auth, handlers) {
+    const currentTokenFor = (req) => async () => {
+        const s = await auth.api.getSession({ headers: new Headers(req.headers) });
+        return s?.session?.token;
+    };
+    return {
+        GET: async (req) => sanitizeBetterAuthResponse(req, await handlers.GET(req), currentTokenFor(req)),
+        POST: async (req) => {
+            const sub = authSubPath(new URL(req.url).pathname);
+            if (sub === '/revoke-session-by-id')
+                return revokeById(req, auth.api);
+            return sanitizeBetterAuthResponse(req, await handlers.POST(req), currentTokenFor(req));
+        },
+    };
+}

package/dist/middleware/create-middleware.js

@@ -575,7 +575,16 @@ async function checkViability(request, endpoint, log, revocationFailMode) {
             // booleans for unknown/not_configured. The booleans are read ONLY when
             // revocationStatus is ABSENT (idealresume.online's older boolean route).
             sessionStatus.forceInvalid = decideForceInvalid(data, revocationFailMode);
-            sessionPointer.exists = sessionStatus.exists ?? false;
+            // PAY-2216: a STALE session - the cookie resolved to a token, but no store holds the session - used to set
+            // pointer.exists=false, so makeAuthDecision took no_session (login, cookie NOT cleared) and its stale_session
+            // arm (clearCookies) was unreachable: a dead cookie lingered and re-ran viability on every request.
+            // Stale is a POSITIVE signal and needs ALL of: this 2xx read, exists === false, a sessionTokenId (every
+            // producer sets it only when a cookie resolved to a token: routes/auth/viability.ts, api-handlers/session/
+            // viability.ts, refresh-viability.ts 'session_not_found'), and a session cookie on THIS request (plain or
+            // __Secure-). A FAILED read never gets here (exists=null -> service_error, PAY-2147); a store error throws
+            // inside every producer and answers 5xx or 'unknown' WITHOUT a sessionTokenId; no cookie -> no_session.
+            const stale = sessionStatus.exists === false && !!data.sessionTokenId && hasSessionCookie(request);
+            sessionPointer.exists = stale ? true : (sessionStatus.exists ?? false);
             sessionPointer.sessionTokenId = data.sessionTokenId ?? null;
             sessionPointer.expired = data.accessTokenExpired || false;
             sessionPointer.hasRefreshToken = data.hasRefreshToken ?? data.canRefresh ?? false;
@@ -620,7 +629,12 @@ const RBAC_EXEMPT_PATHS = ['/error', '/unauthorized', '/service-unavailable'];
 /** Handle 'allow' decision - run RBAC if enabled */
 async function handleAllow(request, pathname, sessionPointer, sessionStatus, rbacExemptPaths = []) {
     const isPublic = (0, route_config_1.isUnauthenticatedRoute)(pathname);
-    if ((0, rbac_check_1.isRBACEnabled)() && !isPublic && sessionPointer.exists) {
+    // PAY-2216: RBAC needs a session that viability CONFIRMED. A stale /api request (pointer.exists only says the
+    // cookie is present, status.exists is false) is allowed through so the route handler answers its own 401 - not an
+    // RBAC 401 here. TRUTHY, not `=== true` (NightHawk 71960): status.exists carries the producer's JSON value as-is,
+    // and a consumer route may answer authenticated: 1 / "true"; `=== true` skipped RBAC for those healthy sessions
+    // (fail-OPEN). Truthy keeps 4.5.3's RBAC coverage exactly and still excludes stale (false) and a failed read (null).
+    if ((0, rbac_check_1.isRBACEnabled)() && !isPublic && sessionPointer.exists && sessionStatus.exists) {
         // Skip RBAC for error/fallback pages (prevent redirect loops) and app-configured exempt paths
         if (RBAC_EXEMPT_PATHS.some(p => pathname.startsWith(p)) ||
             rbacExemptPaths.some(p => pathname.startsWith(p))) {

package/dist/stores/authStore.js

@@ -425,25 +425,12 @@ exports.useAuthStore = (0, zustand_1.create)()((0, middleware_1.devtools)((set,
         try {
             // COORDINATED REFRESH: The server now handles distributed locking
             // We just need to make the refresh call and let the server coordinate
-            // Resolve session token for header
-            const resolveSessionTokenForHeader = async () => {
-                let token = get().session?.sessionToken;
-                if (token)
-                    return token;
-                try {
-                    for (let attempt = 1; attempt <= 3 && !token; attempt++) {
-                        const { data: s } = await better_auth_client_1.authClient.getSession();
-                        token = s?.sessionToken;
-                        if (!token) {
-                            await new Promise(r => setTimeout(r, 150));
-                        }
-                    }
-                }
-                catch {
-                    logger_1.authLogger.warn('[AuthStore] Failed to resolve session token from Better Auth during refresh');
-                }
-                return token;
-            };
+            // PAY-2217: the session token is NOT read from Better Auth's getSession() any more. The HTTP body no
+            // longer carries it (wrapBetterAuthHandler), and this read was already dead: getSession() returns
+            // { session: { token } }, never a top-level `sessionToken`, so the 3 x 150 ms retry loop that used to sit
+            // here always ran to exhaustion. The server resolves the session from the cookie and REJECTS an
+            // x-session-token header when it cannot (refresh.ts, 246007), so the header is advisory at best.
+            const resolveSessionTokenForHeader = async () => get().session?.sessionToken;
             const sessionTokenHeader = await resolveSessionTokenForHeader();
             const refreshResponse = await fetch('/api/auth/refresh', {
                 method: 'POST',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "4.5.3",
+  "version": "4.5.5",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/auth/better-auth.ts

@@ -16,6 +16,7 @@ import { decodeJwt } from 'jose';   // better-auth's own JWT dependency
 import { betterAuth } from 'better-auth';
 import { nextCookies } from 'better-auth/next-js';
 import { toNextJsHandler } from 'better-auth/next-js';
+import { wrapBetterAuthHandler } from './session-response-sanitizer';
 import { magicLink, type MagicLinkOptions } from 'better-auth/plugins/magic-link';
 import { resolveClientKey } from '../lib/client-key';
 import { genericOAuth } from 'better-auth/plugins/generic-oauth';
@@ -996,7 +997,10 @@ export async function getBetterAuthHandler(): Promise<{ GET: (req: Request) => P
   if (!isBetterAuthEnabled()) return null;
 
   const auth = await getBetterAuthInstance();
-  return toNextJsHandler(auth);
+  // PAY-2217: Better Auth's native endpoints (get-session, list-sessions, sign-in/*, sign-up/*) put the session
+  // token in the body. Strip it at the HTTP boundary here, so every consumer that mounts this handler gets it;
+  // auth.api (server-side) is untouched and still sees the token. See session-response-sanitizer.ts.
+  return wrapBetterAuthHandler(auth as any, toNextJsHandler(auth));
 }
 
 /**

package/src/auth/session-response-sanitizer.ts

@@ -0,0 +1,151 @@
+/**
+ * PAY-2217: no session token reaches browser JS from Better Auth's own HTTP endpoints.
+ *
+ * WHAT WAS WRONG. PAY-1481 removed token material from the package's own GET /api/auth/session. Better Auth's native
+ * endpoints are a separate surface served by the catch-all mount, and their default bodies carry the session
+ * credential identifier:
+ *   GET  /get-session    -> { session: { id, token, userId, ... }, user }
+ *   GET  /list-sessions  -> [ { id, token, ... } ]        (EVERY session of the user, not just this one)
+ *   POST /sign-in/*      -> { token, user, ... }
+ *   POST /sign-up/*      -> { token, user }
+ *   GET  /magic-link/verify (no callbackURL) -> { token, user }   (NightHawk G4 on PR 1190, measured on a real instance)
+ * and any plugin endpoint (passkey verify, two-factor verify, genericOAuth) answers a session object the same way.
+ * `token` is the Redis key of the session. The cookie is token.HMAC and Path B verifies the signature, so a bare
+ * token is not a replayable cookie (gate rows B1-B4 measure that), but it is a credential identifier readable by any
+ * script on the page, for this session and for every other session the user has. It breaks the PAY-1481 rule.
+ *
+ * EVERY 2xx JSON BODY IS STRIPPED, not a named list of paths. A list protects the endpoints someone remembered and
+ * silently misses the next plugin; the strip is a function of the response, so a new endpoint is covered the day it is
+ * mounted. A 2xx JSON body that legitimately needs one of these names to reach the browser would have to be
+ * allowlisted here on purpose (none is known: no client in this package reads one).
+ *
+ * WHERE THE FIX LIVES, AND WHY NOT customSession. Server-side code in this package reads session.session.token from
+ * auth.api.getSession() (viability, refresh, status, the OAuth exchange). A customSession plugin or an after-hook
+ * runs for those calls too and would strip the token from them. So the strip is applied at the HTTP BOUNDARY only:
+ * getBetterAuthHandler() returns handlers wrapped by wrapBetterAuthHandler(), and auth.api stays untouched.
+ *
+ * WHAT THE BROWSER GETS INSTEAD.
+ *   - list-sessions rows carry `isCurrent` (computed here against the caller's cookie-resolved session) and `id`.
+ *   - POST /revoke-session-by-id { id }: revokes ONE of the CALLER's sessions by its id. An id that is not one of the
+ *     caller's own sessions answers 404 (never 403: do not confirm that another user's session id exists).
+ *   - Better Auth's native POST /revoke-session { token } still exists and still requires a cookie-resolved session
+ *     that owns the token, but no browser ever holds a token to send it.
+ */
+
+/** Credential-bearing key names, compared case- and separator-insensitively. */
+const STRIP_KEYS = new Set(['token', 'sessiontoken', 'accesstoken', 'refreshtoken', 'idtoken']);
+
+const norm = (k: string): string => k.toLowerCase().replace(/[_\-\s]/g, '');
+
+/** Deep copy of `value` with every credential-named key removed, at any depth, in objects and arrays. */
+export function stripSessionCredentials(value: unknown): unknown {
+  if (Array.isArray(value)) return value.map(stripSessionCredentials);
+  if (value !== null && typeof value === 'object') {
+    const out: Record<string, unknown> = {};
+    for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
+      if (STRIP_KEYS.has(norm(k))) continue;
+      out[k] = stripSessionCredentials(v);
+    }
+    return out;
+  }
+  return value;
+}
+
+/** "/api/auth/get-session" -> "/get-session". Anything not under an /auth/ segment is returned as-is. */
+export function authSubPath(pathname: string): string {
+  const i = pathname.indexOf('/api/auth/');
+  if (i >= 0) return pathname.slice(i + '/api/auth'.length).replace(/\/+$/, '') || '/';
+  return pathname.replace(/\/+$/, '') || '/';
+}
+
+function isJson(res: Response): boolean {
+  return (res.headers.get('content-type') || '').toLowerCase().includes('application/json');
+}
+
+/** A Response with a new JSON body and the original status and headers (content-length recomputed by the runtime). */
+function withJsonBody(res: Response, body: unknown): Response {
+  const headers = new Headers(res.headers);
+  headers.delete('content-length');
+  return new Response(JSON.stringify(body), { status: res.status, statusText: res.statusText, headers });
+}
+
+interface AuthApi {
+  getSession: (opts: { headers: Headers }) => Promise<any>;
+  listSessions: (opts: { headers: Headers }) => Promise<any>;
+  revokeSession: (opts: { headers: Headers; body: { token: string }; asResponse?: boolean }) => Promise<any>;
+}
+
+/** Sanitise one already-produced Better Auth response. Pure function of (request, response, current token). */
+export async function sanitizeBetterAuthResponse(
+  req: Request,
+  res: Response,
+  currentToken: () => Promise<string | undefined>,
+): Promise<Response> {
+  const sub = authSubPath(new URL(req.url).pathname);
+  if (!res.ok || !isJson(res)) return res;
+
+  let body: unknown;
+  try {
+    body = await res.clone().json();
+  } catch {
+    return res; // unreadable body: nothing to strip, and do not turn it into a different failure
+  }
+
+  if (sub === '/list-sessions' && Array.isArray(body)) {
+    const cur = await currentToken().catch(() => undefined);
+    body = body.map((row: any) =>
+      row && typeof row === 'object' ? { ...row, isCurrent: !!cur && row.token === cur } : row,
+    );
+  }
+  return withJsonBody(res, stripSessionCredentials(body));
+}
+
+const json = (status: number, body: unknown): Response =>
+  new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json' } });
+
+/** POST /revoke-session-by-id { id }: revoke one of the caller's own sessions by id. */
+async function revokeById(req: Request, api: AuthApi): Promise<Response> {
+  let id: unknown;
+  try {
+    id = (await req.json())?.id;
+  } catch {
+    return json(400, { code: 'INVALID_REQUEST', message: 'Body must be JSON { id }' });
+  }
+  if (typeof id !== 'string' || id.length === 0) {
+    return json(400, { code: 'INVALID_REQUEST', message: 'id is required' });
+  }
+  const headers = new Headers(req.headers);
+  const rows = await api.listSessions({ headers }).catch(() => null);
+  if (rows === null) return json(401, { code: 'UNAUTHORIZED', message: 'No session' });
+  // listSessions returns ONLY the caller's own sessions, so a foreign id cannot match: 404, not 403.
+  const row = Array.isArray(rows) ? rows.find((r: any) => r && r.id === id && typeof r.token === 'string') : undefined;
+  if (!row) return json(404, { code: 'SESSION_NOT_FOUND', message: 'No such session' });
+  const res = await api.revokeSession({ headers, body: { token: row.token }, asResponse: true });
+  // Pass Better Auth's own answer (and its Set-Cookie when the current session was the one revoked) through.
+  return res instanceof Response ? res : json(200, { status: true });
+}
+
+type Handler = (req: Request) => Promise<Response>;
+
+/**
+ * Wrap Better Auth's Next.js handlers so no response carries a session credential to the browser.
+ * `auth` is the Better Auth instance; its `api` is used server-side only (to find the caller's current session and to
+ * revoke by id) and is not modified.
+ */
+export function wrapBetterAuthHandler(
+  auth: { api: AuthApi },
+  handlers: { GET: Handler; POST: Handler },
+): { GET: Handler; POST: Handler } {
+  const currentTokenFor = (req: Request) => async (): Promise<string | undefined> => {
+    const s = await auth.api.getSession({ headers: new Headers(req.headers) });
+    return s?.session?.token;
+  };
+  return {
+    GET: async (req) => sanitizeBetterAuthResponse(req, await handlers.GET(req), currentTokenFor(req)),
+    POST: async (req) => {
+      const sub = authSubPath(new URL(req.url).pathname);
+      if (sub === '/revoke-session-by-id') return revokeById(req, auth.api);
+      return sanitizeBetterAuthResponse(req, await handlers.POST(req), currentTokenFor(req));
+    },
+  };
+}

package/src/middleware/create-middleware.ts

@@ -741,7 +741,16 @@ async function checkViability(
       // booleans for unknown/not_configured. The booleans are read ONLY when
       // revocationStatus is ABSENT (idealresume.online's older boolean route).
       sessionStatus.forceInvalid = decideForceInvalid(data, revocationFailMode);
-      sessionPointer.exists = sessionStatus.exists ?? false;
+      // PAY-2216: a STALE session - the cookie resolved to a token, but no store holds the session - used to set
+      // pointer.exists=false, so makeAuthDecision took no_session (login, cookie NOT cleared) and its stale_session
+      // arm (clearCookies) was unreachable: a dead cookie lingered and re-ran viability on every request.
+      // Stale is a POSITIVE signal and needs ALL of: this 2xx read, exists === false, a sessionTokenId (every
+      // producer sets it only when a cookie resolved to a token: routes/auth/viability.ts, api-handlers/session/
+      // viability.ts, refresh-viability.ts 'session_not_found'), and a session cookie on THIS request (plain or
+      // __Secure-). A FAILED read never gets here (exists=null -> service_error, PAY-2147); a store error throws
+      // inside every producer and answers 5xx or 'unknown' WITHOUT a sessionTokenId; no cookie -> no_session.
+      const stale = sessionStatus.exists === false && !!data.sessionTokenId && hasSessionCookie(request);
+      sessionPointer.exists = stale ? true : (sessionStatus.exists ?? false);
       sessionPointer.sessionTokenId = data.sessionTokenId ?? null;
       sessionPointer.expired = data.accessTokenExpired || false;
       sessionPointer.hasRefreshToken = data.hasRefreshToken ?? data.canRefresh ?? false;
@@ -815,7 +824,12 @@ async function handleAllow(
 ): Promise<NextResponse> {
   const isPublic = isUnauthenticatedRoute(pathname);
 
-  if (isRBACEnabled() && !isPublic && sessionPointer.exists) {
+  // PAY-2216: RBAC needs a session that viability CONFIRMED. A stale /api request (pointer.exists only says the
+  // cookie is present, status.exists is false) is allowed through so the route handler answers its own 401 - not an
+  // RBAC 401 here. TRUTHY, not `=== true` (NightHawk 71960): status.exists carries the producer's JSON value as-is,
+  // and a consumer route may answer authenticated: 1 / "true"; `=== true` skipped RBAC for those healthy sessions
+  // (fail-OPEN). Truthy keeps 4.5.3's RBAC coverage exactly and still excludes stale (false) and a failed read (null).
+  if (isRBACEnabled() && !isPublic && sessionPointer.exists && sessionStatus.exists) {
     // Skip RBAC for error/fallback pages (prevent redirect loops) and app-configured exempt paths
     if (RBAC_EXEMPT_PATHS.some(p => pathname.startsWith(p)) ||
         rbacExemptPaths.some(p => pathname.startsWith(p))) {

package/src/stores/authStore.ts

@@ -637,23 +637,13 @@ export const useAuthStore = create<AuthStore>()(
           // COORDINATED REFRESH: The server now handles distributed locking
           // We just need to make the refresh call and let the server coordinate
 
-          // Resolve session token for header
-          const resolveSessionTokenForHeader = async (): Promise<string | undefined> => {
-            let token = get().session?.sessionToken as string | undefined;
-            if (token) return token;
-            try {
-              for (let attempt = 1; attempt <= 3 && !token; attempt++) {
-                const { data: s } = await authClient.getSession();
-                token = (s as any)?.sessionToken;
-                if (!token) {
-                  await new Promise(r => setTimeout(r, 150));
-                }
-              }
-            } catch {
-              authLogger.warn('[AuthStore] Failed to resolve session token from Better Auth during refresh');
-            }
-            return token;
-          };
+          // PAY-2217: the session token is NOT read from Better Auth's getSession() any more. The HTTP body no
+          // longer carries it (wrapBetterAuthHandler), and this read was already dead: getSession() returns
+          // { session: { token } }, never a top-level `sessionToken`, so the 3 x 150 ms retry loop that used to sit
+          // here always ran to exhaustion. The server resolves the session from the cookie and REJECTS an
+          // x-session-token header when it cannot (refresh.ts, 246007), so the header is advisory at best.
+          const resolveSessionTokenForHeader = async (): Promise<string | undefined> =>
+            get().session?.sessionToken as string | undefined;
 
           const sessionTokenHeader = await resolveSessionTokenForHeader();