@payez/next-mvp 4.5.6 → 4.7.9

package/dist/middleware/create-middleware.js

@@ -28,6 +28,8 @@ const safe_callback_1 = require("../auth/safe-callback");
 const internal_api_url_1 = require("../edge/internal-api-url");
 const app_slug_1 = require("../lib/app-slug");
 const rbac_check_1 = require("./rbac-check");
+const session_cookie_clear_1 = require("../auth/session-cookie-clear");
+const session_reset_link_1 = require("../auth/session-reset-link");
 // =============================================================================
 // DEFAULT IMPLEMENTATIONS
 // =============================================================================
@@ -58,8 +60,12 @@ const defaultLogger = {
 // =============================================================================
 const LOGIN_PAGE = '/account-auth/login';
 const VERIFY_CODE_PAGE = '/account-auth/verify-code';
+// PAY-2315 (4.7.1): /login is a public alias of the login page. It used to take the 'public: allow' arm and never reached the
+// 'already_authenticated' redirect, so a signed-in user was shown the sign-in form. It is the login page for every arm now.
+// (safe-callback refuses /login as a destination, so this cannot redirect to itself.)
+const LOGIN_ALIAS = '/login';
 function isLoginPage(pathname) {
-    return pathname === LOGIN_PAGE;
+    return pathname === LOGIN_PAGE || pathname === LOGIN_ALIAS;
 }
 /**
  * Ensures callback URLs never point to auth pages (prevents redirect loops) AND
@@ -105,24 +111,7 @@ function isPrefetchRequest(request) {
 function clearSessionCookies(response, request) {
     if (isPrefetchRequest(request))
         return;
-    const sessionCookie = (0, app_slug_1.getSessionCookieName)();
-    const secureCookie = (0, app_slug_1.getSecureSessionCookieName)();
-    // Clear main cookies
-    response.cookies.set(sessionCookie, '', { path: '/', expires: new Date(0), httpOnly: true, sameSite: 'lax' });
-    response.cookies.set(secureCookie, '', { path: '/', expires: new Date(0), httpOnly: true, sameSite: 'lax', secure: true });
-    // Clear any chunked cookies (NextAuth chunks large cookies)
-    for (const [name] of request.cookies) {
-        if (name.startsWith(`${sessionCookie}.`) || name.startsWith(`${secureCookie}.`)) {
-            const isSecure = name.startsWith('__Secure-');
-            response.cookies.set(name, '', {
-                path: '/',
-                expires: new Date(0),
-                httpOnly: true,
-                sameSite: 'lax',
-                ...(isSecure && { secure: true })
-            });
-        }
-    }
+    (0, session_cookie_clear_1.expireSessionCookies)(response, Array.from(request.cookies, ([name]) => name));
 }
 /** Create redirect response, optionally clearing cookies */
 function redirectTo(request, location, clearCookies = false) {
@@ -132,6 +121,28 @@ function redirectTo(request, location, clearCookies = false) {
     }
     return response;
 }
+/**
+ * A redirect that must also END the session. With the reset route configured, a page request is sent through it
+ * WITHOUT any Set-Cookie here: the route sees the flight headers this middleware cannot (Next strips them before
+ * middleware), answers a prefetch 204 + no-store, and clears on the real navigation. `/api/` requests and apps
+ * without the route keep the direct clear exactly as before.
+ */
+async function clearingRedirect(request, location, reset) {
+    if (!reset || request.nextUrl.pathname.startsWith('/api/')) {
+        return redirectTo(request, location, true);
+    }
+    const target = new URL(location, request.url);
+    const params = (0, session_reset_link_1.normaliseResetParams)({
+        callbackUrl: target.searchParams.get('callbackUrl'),
+        reason: target.searchParams.get('reason'),
+        error: target.searchParams.get('error'),
+    });
+    // Bound to THIS request's session cookie: the route clears only when its own request carries the same one.
+    const bound = (0, session_reset_link_1.boundSessionCookie)((n) => request.cookies.get(n)?.value, (0, app_slug_1.getSessionCookieName)(), (0, app_slug_1.getSecureSessionCookieName)());
+    const response = server_1.NextResponse.redirect(new URL(await (0, session_reset_link_1.signedResetHref)(reset.route, params, reset.secret, bound), request.url));
+    response.headers.set('cache-control', 'no-store');
+    return response;
+}
 /**
  * Terminal response for a FAILED token refresh.
  *
@@ -150,7 +161,7 @@ function redirectTo(request, location, clearCookies = false) {
  * higher would intercept 'refresh_needed' and disable middleware token refresh across
  * the whole API surface (card 340024 C1).
  */
-function refreshFailureResponse(request, location, errorCode, clearCookies = false) {
+async function refreshFailureResponse(request, location, errorCode, clearCookies = false, reset) {
     if (request.nextUrl.pathname.startsWith('/api/')) {
         const response = server_1.NextResponse.json({ error: errorCode }, { status: 401 });
         if (clearCookies) {
@@ -158,7 +169,7 @@ function refreshFailureResponse(request, location, errorCode, clearCookies = fal
         }
         return response;
     }
-    return redirectTo(request, location, clearCookies);
+    return clearCookies ? clearingRedirect(request, location, reset) : redirectTo(request, location);
 }
 /**
  * PAY-2147: the terminal answer when the middleware CANNOT TELL whether the session is good
@@ -359,6 +370,8 @@ function redirect2FA(callbackUrl) {
 // =============================================================================
 // MIDDLEWARE FACTORY
 // =============================================================================
+/** PAY-2218: the stripped-flight-headers warning is logged once per process, not once per request. */
+let flightHeadersStrippedWarned = false;
 function createMvpMiddleware(options = {}) {
     // Resolve options with defaults
     const cb = options.circuitBreaker || defaultCircuitBreaker;
@@ -369,6 +382,29 @@ function createMvpMiddleware(options = {}) {
     const rbacExemptPaths = options.rbacExemptPaths || [];
     // PAY-1882 step 4: default 'closed' (Jon's option A / BAPert 66316).
     const revocationFailMode = options.revocationFailMode || 'closed';
+    // PAY-2302 cut 1c: strictly `=== true`, so a truthy string in a config file cannot switch revocation off.
+    const noRevocationSource = options.noRevocationSource === true;
+    if (noRevocationSource) {
+        log.warn('[next-mvp] noRevocationSource is ON: sessions of this app CANNOT be revoked server-side (no vibe client / HMAC key). ' +
+            "revocationStatus 'not_configured' is treated as viable; 'unknown' and 'revoked' still sign the user out. " +
+            'Remove this option once the environment has a vibe client id and HMAC key.');
+    }
+    const sessionResetRoute = options.sessionResetRoute === true ? session_reset_link_1.DEFAULT_SESSION_RESET_ROUTE
+        : typeof options.sessionResetRoute === 'string' && options.sessionResetRoute ? options.sessionResetRoute
+            : undefined;
+    let resetSecretMissingLogged = false;
+    const resolveReset = () => {
+        if (!sessionResetRoute)
+            return undefined;
+        const secret = (0, session_reset_link_1.resetSecret)();
+        if (secret)
+            return { route: sessionResetRoute, secret };
+        if (!resetSecretMissingLogged) {
+            resetSecretMissingLogged = true;
+            log.error('sessionResetRoute is set but no BETTER_AUTH_SECRET/NEXTAUTH_SECRET is available to sign the hand-off; clearing in middleware instead', { sessionResetRoute });
+        }
+        return undefined;
+    };
     return async function middleware(request) {
         const { pathname, searchParams } = request.nextUrl;
         // =========================================================================
@@ -387,6 +423,12 @@ function createMvpMiddleware(options = {}) {
                 return server_1.NextResponse.next();
             }
         }
+        // PAY-2218: a router request (it carries `next-url`) that arrives WITHOUT `rsc` had its flight headers stripped
+        // by Next before middleware ran, so isPrefetchRequest() cannot see a router prefetch on this app. Say so once.
+        if (!sessionResetRoute && !flightHeadersStrippedWarned && request.headers.has('next-url') && !request.headers.has('rsc')) {
+            flightHeadersStrippedWarned = true;
+            log.warn('Next strips router prefetch headers before middleware on this app, so a session-ending redirect can fire on a prefetch. Mount @payez/next-mvp/routes/auth/session-reset and set sessionResetRoute (PAY-2218).', { pathname });
+        }
         const isPublic = (0, route_config_1.isUnauthenticatedRoute)(pathname);
         const isLogin = isLoginPage(pathname);
         // --- Optimization: Skip viability check for unauthenticated public browsing ---
@@ -399,7 +441,7 @@ function createMvpMiddleware(options = {}) {
             // Has cookie - continue to viability check for 2FA enforcement
         }
         // --- Fetch session viability from internal API ---
-        const { sessionStatus, sessionPointer } = await checkViability(request, viabilityEndpoint, log, revocationFailMode);
+        const { sessionStatus, sessionPointer } = await checkViability(request, viabilityEndpoint, log, revocationFailMode, noRevocationSource);
         // --- Stale session (cookie exists but session doesn't): OBSERVE ONLY, DO NOT DECIDE ---
         //
         // *** CARD 349607. THIS BLOCK USED TO `return` HERE, AND THAT RETURN WAS A BYPASS. ***
@@ -456,6 +498,7 @@ function createMvpMiddleware(options = {}) {
             logger: log,
             refreshEndpoint,
             rbacExemptPaths,
+            reset: resolveReset(),
             onRefreshSuccess: options.onRefreshSuccess,
             onRefreshFailure: options.onRefreshFailure,
         });
@@ -473,13 +516,16 @@ function createMvpMiddleware(options = {}) {
  * 'unknown'/'not_configured'. The booleans are read ONLY when revocationStatus is
  * absent (idealresume.online's older boolean-only route).
  */
-function decideForceInvalid(data, revocationFailMode) {
+function decideForceInvalid(data, revocationFailMode, noRevocationSource = false) {
     const status = data.revocationStatus;
     if (typeof status === 'string') {
         if (status === 'revoked')
             return true;
         if (status === 'active')
             return false;
+        // PAY-2302 cut 1c: an app that declared it has no revocation source. ONLY the exact 'not_configured' string.
+        if (status === 'not_configured' && noRevocationSource === true)
+            return false;
         // S1 (NightHawk 66409): ANY other string - 'unknown', 'not_configured', a
         // typo like 'Revoked', 'error', or '' - is treated as 'unknown' (fail mode
         // applies), NEVER as 'active'. Returning false here would let the first
@@ -502,7 +548,7 @@ function hasSessionCookie(request) {
     return !!(request.cookies.get((0, app_slug_1.getSessionCookieName)())?.value || request.cookies.get((0, app_slug_1.getSecureSessionCookieName)())?.value);
 }
 /** Check session viability via internal API */
-async function checkViability(request, endpoint, log, revocationFailMode) {
+async function checkViability(request, endpoint, log, revocationFailMode, noRevocationSource = false) {
     const sessionStatus = {
         exists: false,
         forceInvalid: false,
@@ -574,7 +620,7 @@ async function checkViability(request, endpoint, log, revocationFailMode) {
             // revocations status, decide from it + failMode and ignore the folded
             // booleans for unknown/not_configured. The booleans are read ONLY when
             // revocationStatus is ABSENT (idealresume.online's older boolean route).
-            sessionStatus.forceInvalid = decideForceInvalid(data, revocationFailMode);
+            sessionStatus.forceInvalid = decideForceInvalid(data, revocationFailMode, noRevocationSource);
             // PAY-2216: a STALE session - the cookie resolved to a token, but no store holds the session - used to set
             // pointer.exists=false, so makeAuthDecision took no_session (login, cookie NOT cleared) and its stale_session
             // arm (clearCookies) was unreachable: a dead cookie lingered and re-ran viability on every request.
@@ -613,7 +659,9 @@ async function executeDecision(request, decision, pathname, sessionPointer, sess
         case 'allow':
             return handleAllow(request, pathname, sessionPointer, sessionStatus, opts.rbacExemptPaths);
         case 'redirect':
-            return redirectTo(request, decision.location, decision.clearCookies);
+            return decision.clearCookies
+                ? clearingRedirect(request, decision.location, opts.reset)
+                : redirectTo(request, decision.location);
         case 'service_error':
             return serviceUnavailableResponse(request);
         case 'refresh_needed':
@@ -719,7 +767,7 @@ async function handleRefresh(request, safeCallback, opts) {
             clearingCookies: isPermanentFailure
         });
         onRefreshFailure?.(response.status, false);
-        return refreshFailureResponse(request, `${LOGIN_PAGE}?callbackUrl=${encodeURIComponent(safeCallback)}&error=${errorParam}`, errorParam, isPermanentFailure);
+        return refreshFailureResponse(request, `${LOGIN_PAGE}?callbackUrl=${encodeURIComponent(safeCallback)}&error=${errorParam}`, errorParam, isPermanentFailure, opts.reset);
     }
     catch (error) {
         const isNetwork = cb.isNetworkError(error);

package/dist/pages/login/page.js

@@ -29,6 +29,7 @@ const better_auth_client_1 = require("../../client/better-auth-client");
 const navigation_1 = require("next/navigation");
 const react_2 = require("react");
 const useTheme_1 = require("../../theme/useTheme");
+const login_error_message_1 = require("../../lib/login-error-message");
 function LoginForm({ altAuthSlot }) {
     const searchParams = (0, navigation_1.useSearchParams)();
     const callbackUrl = searchParams?.get('callbackUrl') || '/dashboard';
@@ -110,46 +111,19 @@ function LoginForm({ altAuthSlot }) {
     // Atomic state management - only ONE can be true at a time
     const [isSubmitting, setIsSubmitting] = (0, react_1.useState)(false);
     const [loginSuccess, setLoginSuccess] = (0, react_1.useState)(false);
-    const [loginError, setLoginError] = (0, react_1.useState)(null);
+    // undefined = the user has not acted yet (show what the URL says); null/string = an explicit state set by a handler below.
+    const [loginError, setLoginError] = (0, react_1.useState)(undefined);
     const [loading, setLoading] = (0, react_1.useState)(false);
     const [showRecoveryOptions, setShowRecoveryOptions] = (0, react_1.useState)(false);
     // Force show form after timeout if stuck in loading
     const [forceShowForm, setForceShowForm] = (0, react_1.useState)(false);
-    // Surface OAuth failures the Better Auth mount bounced back here.
+    // PAY-2319 (4.7.2): what the URL says, derived at render (no effect) so it is shown on the FIRST paint and in a static render.
+    // 4.7.1 mapped these in effects that only set loginError, which was never rendered. Unknown codes are NOT echoed (see lib/login-error-message).
+    const urlMessage = (0, login_error_message_1.oauthFailureMessage)(oauthError) ?? (0, login_error_message_1.friendlyLoginError)(urlError);
+    const shownError = loginError !== undefined ? loginError : urlMessage;
     (0, react_1.useEffect)(() => {
-        if (oauthError) {
-            const name = oauthError.charAt(0).toUpperCase() + oauthError.slice(1);
-            setLoginError(`${name} sign-in did not complete. Please try again.`);
-        }
-    }, [oauthError]);
-    // Handle URL errors with user-friendly messages
-    (0, react_1.useEffect)(() => {
-        if (urlError) {
-            let friendlyError = urlError;
-            if (urlError === 'SessionExpired') {
-                // Session expiration is normal - don't show as error
-                console.log('[LOGIN] SessionExpired detected - normal behavior');
-                friendlyError = null;
-            }
-            else if (urlError === 'TwoFactorTimeout') {
-                // PAY-884: the sign-in expired while the verification code was outstanding. Unlike
-                // SessionExpired this is NOT silent - the user was mid-2FA and must know why they are here.
-                friendlyError = 'Your verification step timed out before the code was confirmed. Please sign in again.';
-            }
-            else if (urlError === 'ServiceUnavailable') {
-                friendlyError = 'Authentication service is temporarily unavailable. Please try again in a few minutes.';
-            }
-            else if (urlError.startsWith("Unexpected token")) {
-                friendlyError = 'An authentication error occurred. Please try signing in again.';
-            }
-            else if (urlError.includes('not valid JSON')) {
-                friendlyError = 'An authentication error occurred. Please try signing in again.';
-            }
-            else if (urlError === 'CredentialsSignin') {
-                friendlyError = 'Invalid email or password. Please try again.';
-            }
-            setLoginError(friendlyError);
-        }
+        if (urlError === 'SessionExpired')
+            console.log('[LOGIN] SessionExpired detected - normal behavior');
     }, [urlError]);
     // Timeout to prevent infinite loading states
     (0, react_1.useEffect)(() => {
@@ -175,7 +149,7 @@ function LoginForm({ altAuthSlot }) {
     // authClient.signIn.email, which better-auth always rejected because this
     // package never configures emailAndPassword. See the note at the render site.
     // Show loading spinner for initial loads
-    if (!forceShowForm && !loginError && (loading || (status === 'loading' && !session))) {
+    if (!forceShowForm && !shownError && (loading || (status === 'loading' && !session))) {
         return ((0, jsx_runtime_1.jsxs)("div", { className: `flex flex-col items-center justify-center min-h-screen ${colors.background}`, children: [(0, jsx_runtime_1.jsxs)("svg", { className: "animate-spin h-6 w-6", style: { color: buttonColor }, viewBox: "0 0 24 24", fill: "none", children: [(0, jsx_runtime_1.jsx)("circle", { className: "opacity-25", cx: "12", cy: "12", r: "10", stroke: "currentColor", strokeWidth: "4" }), (0, jsx_runtime_1.jsx)("path", { className: "opacity-75", fill: "currentColor", d: "M4 12a8 8 0 018-8v4a4 4 0 00-4 4H4z" })] }), (0, jsx_runtime_1.jsx)("p", { className: `mt-4 text-sm ${colors.muted}`, children: status === 'loading' ? 'Loading...' : 'Authenticating...' })] }));
     }
     return ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsx)("style", { dangerouslySetInnerHTML: { __html: `
@@ -206,7 +180,7 @@ function LoginForm({ altAuthSlot }) {
         .themed-status-submitting svg {
           color: ${buttonColor} !important;
         }
-      ` } }), (0, jsx_runtime_1.jsx)("div", { className: `min-h-screen flex items-center justify-center px-4 ${colors.background}`, children: (0, jsx_runtime_1.jsx)("div", { className: "max-w-md w-full", children: (0, jsx_runtime_1.jsxs)("div", { className: `rounded-2xl shadow-xl p-8 ${colors.card} ${colors.border} text-gray-800`, children: [(0, jsx_runtime_1.jsxs)("div", { className: "text-center mb-8", children: [(0, jsx_runtime_1.jsx)("h1", { className: "text-3xl font-bold mb-2", style: { color: 'inherit' }, children: branding.tagline || 'Welcome Back' }), (0, jsx_runtime_1.jsx)("p", { className: colors.muted, children: "Sign in to your account" })] }), googleEnabled && ((0, jsx_runtime_1.jsx)(jsx_runtime_1.Fragment, { children: (0, jsx_runtime_1.jsxs)("button", { type: "button", onClick: () => void handleGoogleSignIn(), disabled: googleLoading || isSubmitting, "data-testid": "google-sign-in", className: "w-full px-4 py-3 mb-6 rounded-lg border border-gray-300 font-semibold transition-colors flex items-center justify-center gap-2 disabled:opacity-50 disabled:cursor-not-allowed hover:bg-gray-50", style: { backgroundColor: 'white', color: '#1f2937' }, children: [googleLoading ? ((0, jsx_runtime_1.jsxs)("svg", { className: "animate-spin w-5 h-5", fill: "none", viewBox: "0 0 24 24", children: [(0, jsx_runtime_1.jsx)("circle", { className: "opacity-25", cx: "12", cy: "12", r: "10", stroke: "currentColor", strokeWidth: "4" }), (0, jsx_runtime_1.jsx)("path", { className: "opacity-75", fill: "currentColor", d: "M4 12a8 8 0 018-8v4a4 4 0 00-4 4H4z" })] })) : ((0, jsx_runtime_1.jsxs)("svg", { className: "w-5 h-5", viewBox: "0 0 24 24", fill: "currentColor", children: [(0, jsx_runtime_1.jsx)("path", { d: "M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z", fill: "#4285F4" }), (0, jsx_runtime_1.jsx)("path", { d: "M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z", fill: "#34A853" }), (0, jsx_runtime_1.jsx)("path", { d: "M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z", fill: "#FBBC05" }), (0, jsx_runtime_1.jsx)("path", { d: "M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z", fill: "#EA4335" })] })), googleLoading ? 'Redirecting to Google…' : 'Continue with Google'] }) })), altAuthSlot && (0, jsx_runtime_1.jsx)("div", { className: "mt-4", children: altAuthSlot }), (0, jsx_runtime_1.jsx)("div", { className: `mt-6 text-center text-sm ${colors.muted}`, children: (0, jsx_runtime_1.jsx)("a", { href: "/account-auth/recovery", className: "themed-link hover:underline", children: "Start account recovery" }) })] }) }) })] }));
+      ` } }), (0, jsx_runtime_1.jsx)("div", { className: `min-h-screen flex items-center justify-center px-4 ${colors.background}`, children: (0, jsx_runtime_1.jsx)("div", { className: "max-w-md w-full", children: (0, jsx_runtime_1.jsxs)("div", { className: `rounded-2xl shadow-xl p-8 ${colors.card} ${colors.border} text-gray-800`, children: [(0, jsx_runtime_1.jsxs)("div", { className: "text-center mb-8", children: [(0, jsx_runtime_1.jsx)("h1", { className: "text-3xl font-bold mb-2", style: { color: 'inherit' }, children: branding.tagline || 'Welcome Back' }), (0, jsx_runtime_1.jsx)("p", { className: colors.muted, children: "Sign in to your account" })] }), shownError && ((0, jsx_runtime_1.jsx)("div", { role: "alert", "data-testid": "login-error", className: "mb-6 rounded-lg border border-red-200 bg-red-50 px-4 py-3 text-sm text-red-700", children: shownError })), googleEnabled && ((0, jsx_runtime_1.jsx)(jsx_runtime_1.Fragment, { children: (0, jsx_runtime_1.jsxs)("button", { type: "button", onClick: () => void handleGoogleSignIn(), disabled: googleLoading || isSubmitting, "data-testid": "google-sign-in", className: "w-full px-4 py-3 mb-6 rounded-lg border border-gray-300 font-semibold transition-colors flex items-center justify-center gap-2 disabled:opacity-50 disabled:cursor-not-allowed hover:bg-gray-50", style: { backgroundColor: 'white', color: '#1f2937' }, children: [googleLoading ? ((0, jsx_runtime_1.jsxs)("svg", { className: "animate-spin w-5 h-5", fill: "none", viewBox: "0 0 24 24", children: [(0, jsx_runtime_1.jsx)("circle", { className: "opacity-25", cx: "12", cy: "12", r: "10", stroke: "currentColor", strokeWidth: "4" }), (0, jsx_runtime_1.jsx)("path", { className: "opacity-75", fill: "currentColor", d: "M4 12a8 8 0 018-8v4a4 4 0 00-4 4H4z" })] })) : ((0, jsx_runtime_1.jsxs)("svg", { className: "w-5 h-5", viewBox: "0 0 24 24", fill: "currentColor", children: [(0, jsx_runtime_1.jsx)("path", { d: "M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z", fill: "#4285F4" }), (0, jsx_runtime_1.jsx)("path", { d: "M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z", fill: "#34A853" }), (0, jsx_runtime_1.jsx)("path", { d: "M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z", fill: "#FBBC05" }), (0, jsx_runtime_1.jsx)("path", { d: "M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z", fill: "#EA4335" })] })), googleLoading ? 'Redirecting to Google…' : 'Continue with Google'] }) })), altAuthSlot && (0, jsx_runtime_1.jsx)("div", { className: "mt-4", children: altAuthSlot }), (0, jsx_runtime_1.jsx)("div", { className: `mt-6 text-center text-sm ${colors.muted}`, children: (0, jsx_runtime_1.jsx)("a", { href: "/account-auth/recovery", className: "themed-link hover:underline", children: "Start account recovery" }) })] }) }) })] }));
 }
 function LoginPageFallback() {
     const colors = (0, useTheme_1.useColors)();

package/dist/routes/auth/credential-login-email-code.d.ts

@@ -0,0 +1,6 @@
+/**
+ * PAY-2302 cut 1: ask the IdP to email a code when the authenticator lane failed on our side.
+ * The handler lives in api-handlers/auth/credential-login-email-code.ts (moved from VibeID-Customer-Portal src/app/api/auth/admin-login/email-code/route.ts). A consuming app's route file
+ * re-exports POST and writes `export const runtime = 'nodejs'` literally.
+ */
+export { POST } from '../../api-handlers/auth/credential-login-email-code';

package/dist/routes/auth/credential-login-email-code.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = void 0;
+/**
+ * PAY-2302 cut 1: ask the IdP to email a code when the authenticator lane failed on our side.
+ * The handler lives in api-handlers/auth/credential-login-email-code.ts (moved from VibeID-Customer-Portal src/app/api/auth/admin-login/email-code/route.ts). A consuming app's route file
+ * re-exports POST and writes `export const runtime = 'nodejs'` literally.
+ */
+var credential_login_email_code_1 = require("../../api-handlers/auth/credential-login-email-code");
+Object.defineProperty(exports, "POST", { enumerable: true, get: function () { return credential_login_email_code_1.POST; } });

package/dist/routes/auth/credential-login.d.ts

@@ -0,0 +1,6 @@
+/**
+ * PAY-2302 cut 1: password sign-in route (IdP ExternalAuth/login, session written via lib/session-store, 2FA-outstanding handling).
+ * The handler lives in api-handlers/auth/credential-login.ts (moved from VibeID-Customer-Portal src/app/api/auth/admin-login/route.ts). A consuming app's route file
+ * re-exports POST and writes `export const runtime = 'nodejs'` literally.
+ */
+export { POST } from '../../api-handlers/auth/credential-login';

package/dist/routes/auth/credential-login.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = void 0;
+/**
+ * PAY-2302 cut 1: password sign-in route (IdP ExternalAuth/login, session written via lib/session-store, 2FA-outstanding handling).
+ * The handler lives in api-handlers/auth/credential-login.ts (moved from VibeID-Customer-Portal src/app/api/auth/admin-login/route.ts). A consuming app's route file
+ * re-exports POST and writes `export const runtime = 'nodejs'` literally.
+ */
+var credential_login_1 = require("../../api-handlers/auth/credential-login");
+Object.defineProperty(exports, "POST", { enumerable: true, get: function () { return credential_login_1.POST; } });

package/dist/routes/auth/session-reset.d.ts

@@ -0,0 +1,21 @@
+/**
+ * PAY-2218 PR 2: the session-reset route. Mount it at app/api/auth/session-reset/route.ts:
+ *
+ *     export { GET } from '@payez/next-mvp/routes/auth/session-reset';
+ *
+ * and turn it on with createMvpMiddleware({ sessionResetRoute: true }). The middleware then sends a page's
+ * session-ending redirect (stale session, force-invalidated, pre-2FA timeout, refresh 401/403) here instead of
+ * clearing the cookies itself. See src/auth/session-reset-link.ts for the measurements behind each rule.
+ *
+ *  - Router PREFETCH (the route sees `next-router-prefetch`, which Next strips before middleware): 204 + no-store,
+ *    no redirect, no Set-Cookie. A redirect here would be cached by the 15.5.x router and reused by the click, so
+ *    the real navigation would never come back to clear.
+ *  - Real navigation with a valid signed hand-off: expire the session cookies and 307 to the login page.
+ *  - Anything unsigned, tampered, expired, or bound to a DIFFERENT session than this request's cookie: 307 to the
+ *    login page and touch NO cookie (nobody can link a signed-in user here to log them out; a second use is a no-op).
+ *
+ * The login URL is always rebuilt from allowlisted parts; the route never redirects to a URL it was given.
+ */
+import { NextRequest, NextResponse } from 'next/server';
+export declare const dynamic = "force-dynamic";
+export declare function GET(request: NextRequest): Promise<NextResponse>;

package/dist/routes/auth/session-reset.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dynamic = void 0;
+exports.GET = GET;
+/**
+ * PAY-2218 PR 2: the session-reset route. Mount it at app/api/auth/session-reset/route.ts:
+ *
+ *     export { GET } from '@payez/next-mvp/routes/auth/session-reset';
+ *
+ * and turn it on with createMvpMiddleware({ sessionResetRoute: true }). The middleware then sends a page's
+ * session-ending redirect (stale session, force-invalidated, pre-2FA timeout, refresh 401/403) here instead of
+ * clearing the cookies itself. See src/auth/session-reset-link.ts for the measurements behind each rule.
+ *
+ *  - Router PREFETCH (the route sees `next-router-prefetch`, which Next strips before middleware): 204 + no-store,
+ *    no redirect, no Set-Cookie. A redirect here would be cached by the 15.5.x router and reused by the click, so
+ *    the real navigation would never come back to clear.
+ *  - Real navigation with a valid signed hand-off: expire the session cookies and 307 to the login page.
+ *  - Anything unsigned, tampered, expired, or bound to a DIFFERENT session than this request's cookie: 307 to the
+ *    login page and touch NO cookie (nobody can link a signed-in user here to log them out; a second use is a no-op).
+ *
+ * The login URL is always rebuilt from allowlisted parts; the route never redirects to a URL it was given.
+ */
+const server_1 = require("next/server");
+const create_middleware_1 = require("../../middleware/create-middleware");
+const session_cookie_clear_1 = require("../../auth/session-cookie-clear");
+const app_slug_1 = require("../../lib/app-slug");
+const session_reset_link_1 = require("../../auth/session-reset-link");
+exports.dynamic = 'force-dynamic';
+async function GET(request) {
+    if ((0, create_middleware_1.isPrefetchRequest)(request)) {
+        return new server_1.NextResponse(null, { status: 204, headers: { 'cache-control': 'no-store' } });
+    }
+    const bound = (0, session_reset_link_1.boundSessionCookie)((n) => request.cookies.get(n)?.value, (0, app_slug_1.getSessionCookieName)(), (0, app_slug_1.getSecureSessionCookieName)());
+    const { params, signed } = await (0, session_reset_link_1.readResetRequest)(request.nextUrl.searchParams, (0, session_reset_link_1.resetSecret)(), bound);
+    const response = server_1.NextResponse.redirect(new URL((0, session_reset_link_1.loginLocation)(params), request.url), 307);
+    response.headers.set('cache-control', 'no-store');
+    if (signed)
+        (0, session_cookie_clear_1.expireSessionCookies)(response, Array.from(request.cookies, ([name]) => name));
+    return response;
+}

package/dist/routes/oauth/resume.d.ts

@@ -0,0 +1,11 @@
+/**
+ * PAY-2302 cut 2: post-2FA OAuth authorize resume route. The handler lives in api-handlers/oauth/resume.ts
+ * (moved from VibeID-Customer-Portal src/app/api/oauth/resume/route.ts). A consuming app's route file re-exports GET
+ * and writes `export const runtime = 'nodejs'` literally.
+ *
+ * 4.7.3: `createOAuthResumeHandler({ refusalLocation })` and `DEFAULT_REFUSAL_LOCATION` are re-exported HERE because a consumer can only
+ * import what `package.json` `exports` lists, and this route module is the entry. An app whose sign-in page is not
+ * /account-auth/login (the portal uses /sign-in) writes `export const GET = createOAuthResumeHandler({ refusalLocation: '/sign-in?error=AUTHORIZE_RESUME_REFUSED' });`.
+ */
+export { GET, createOAuthResumeHandler, DEFAULT_REFUSAL_LOCATION } from '../../api-handlers/oauth/resume';
+export type { OAuthResumeOptions, OAuthResumeDeps } from '../../api-handlers/oauth/resume';

package/dist/routes/oauth/resume.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_REFUSAL_LOCATION = exports.createOAuthResumeHandler = exports.GET = void 0;
+/**
+ * PAY-2302 cut 2: post-2FA OAuth authorize resume route. The handler lives in api-handlers/oauth/resume.ts
+ * (moved from VibeID-Customer-Portal src/app/api/oauth/resume/route.ts). A consuming app's route file re-exports GET
+ * and writes `export const runtime = 'nodejs'` literally.
+ *
+ * 4.7.3: `createOAuthResumeHandler({ refusalLocation })` and `DEFAULT_REFUSAL_LOCATION` are re-exported HERE because a consumer can only
+ * import what `package.json` `exports` lists, and this route module is the entry. An app whose sign-in page is not
+ * /account-auth/login (the portal uses /sign-in) writes `export const GET = createOAuthResumeHandler({ refusalLocation: '/sign-in?error=AUTHORIZE_RESUME_REFUSED' });`.
+ */
+var resume_1 = require("../../api-handlers/oauth/resume");
+Object.defineProperty(exports, "GET", { enumerable: true, get: function () { return resume_1.GET; } });
+Object.defineProperty(exports, "createOAuthResumeHandler", { enumerable: true, get: function () { return resume_1.createOAuthResumeHandler; } });
+Object.defineProperty(exports, "DEFAULT_REFUSAL_LOCATION", { enumerable: true, get: function () { return resume_1.DEFAULT_REFUSAL_LOCATION; } });