@payez/next-mvp 4.5.7 → 4.7.10

package/dist/api-handlers/auth/credential-login-email-code.d.ts

@@ -0,0 +1,24 @@
+import { NextRequest, NextResponse } from 'next/server';
+/**
+ * POST /api/auth/admin-login/email-code - PAY-2284: "email me a code instead".
+ *
+ * WHY THIS EXISTS. The sign-in door sends NO code at all to a user who holds an authenticator ("TOTP wins when present: there is
+ * nothing to send"). When that authenticator's secret cannot be decrypted on our side (dev-93, encryption key version 57 gone), the
+ * verify step answers "a problem on our side ... use another sign-in method" - and there was no other method on the screen and no
+ * code in the user's mailbox, because none had been requested. This route is the missing action: it asks the IdP to EMAIL a code,
+ * using the provisional bearer the door already parked in the httpOnly `adm2fa` cookie. The verify turn already tries
+ * twofa/email/verify after twofa/totp/verify, so the code is accepted in the same box.
+ *
+ * What it takes from the browser: NOTHING. No body, no client id, no address - the code goes to the account the provisional bearer
+ * belongs to (the IdP decides the recipient). What it answers: { success, codeRequested, sentVia:'email', devVerificationCode? }.
+ * `codeRequested` means "we asked", never "a mail arrived" (twofa/email/send returns 200 even when the SMTP send threw, 267561).
+ */
+export declare function POST(req: NextRequest): Promise<NextResponse<{
+    success: boolean;
+    error: string;
+}> | NextResponse<{
+    devVerificationCode?: string | undefined;
+    success: boolean;
+    codeRequested: boolean;
+    sentVia: string;
+}>>;

package/dist/api-handlers/auth/credential-login-email-code.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = POST;
+const server_1 = require("next/server");
+const idp_client_config_1 = require("../../lib/idp-client-config");
+const client_key_1 = require("../../lib/client-key");
+const bearer_fetch_1 = require("../../lib/bearer-fetch");
+// `export const runtime = 'nodejs'` must be written LITERALLY in the app's route file (Next ignores a re-exported segment config).
+/** One email-code request per this many seconds per browser (the IdP rate-limits too; this stops a double click and a loop). */
+const EMAIL_CODE_COOLDOWN_S = 30;
+/**
+ * POST /api/auth/admin-login/email-code - PAY-2284: "email me a code instead".
+ *
+ * WHY THIS EXISTS. The sign-in door sends NO code at all to a user who holds an authenticator ("TOTP wins when present: there is
+ * nothing to send"). When that authenticator's secret cannot be decrypted on our side (dev-93, encryption key version 57 gone), the
+ * verify step answers "a problem on our side ... use another sign-in method" - and there was no other method on the screen and no
+ * code in the user's mailbox, because none had been requested. This route is the missing action: it asks the IdP to EMAIL a code,
+ * using the provisional bearer the door already parked in the httpOnly `adm2fa` cookie. The verify turn already tries
+ * twofa/email/verify after twofa/totp/verify, so the code is accepted in the same box.
+ *
+ * What it takes from the browser: NOTHING. No body, no client id, no address - the code goes to the account the provisional bearer
+ * belongs to (the IdP decides the recipient). What it answers: { success, codeRequested, sentVia:'email', devVerificationCode? }.
+ * `codeRequested` means "we asked", never "a mail arrived" (twofa/email/send returns 200 even when the SMTP send threw, 267561).
+ */
+async function POST(req) {
+    const provisional = req.cookies.get('adm2fa')?.value;
+    if (!provisional) {
+        return server_1.NextResponse.json({ success: false, error: 'Your verification window expired. Sign in again.' }, { status: 401 });
+    }
+    const last = Number(req.cookies.get('adm2fa_emailreq')?.value);
+    const now = Math.floor(Date.now() / 1000);
+    if (Number.isFinite(last) && last > 0 && now - last < EMAIL_CODE_COOLDOWN_S) {
+        const wait = EMAIL_CODE_COOLDOWN_S - (now - last);
+        return server_1.NextResponse.json({ success: false, error: `We just asked for a code. Give it a moment (about ${wait} seconds) before asking again.`, retryAfter: wait }, { status: 429 });
+    }
+    let clientKey = '';
+    try {
+        const config = await (0, idp_client_config_1.getIDPClientConfig)();
+        clientKey = (0, client_key_1.resolveClientKey)(config, 'graft/admin-login/email-code').key ?? '';
+    }
+    catch (err) {
+        console.error('[ADMIN_LOGIN_EMAIL_CODE] IDP client config unavailable:', err instanceof Error ? err.message : String(err));
+        return server_1.NextResponse.json({ success: false, error: 'Sign-in is temporarily unavailable. This is a problem on our side. Please try again shortly.' }, { status: 503 });
+    }
+    let sendOk = false;
+    let devCode;
+    try {
+        const sendResp = await (0, bearer_fetch_1.bearerFetch)(`${process.env.IDP_URL}/api/ExternalAuth/twofa/email/send`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Accept: 'application/json',
+                Authorization: `Bearer ${provisional}`,
+                'X-Client-Id': clientKey,
+            },
+            body: JSON.stringify({ client_id: clientKey }),
+        });
+        sendOk = sendResp.ok;
+        const text = await sendResp.text().catch(() => '');
+        if (!sendOk)
+            console.error('[ADMIN_LOGIN_EMAIL_CODE] twofa/email/send failed', sendResp.status, text.slice(0, 200));
+        try {
+            const j = JSON.parse(text);
+            const echoed = j?.dev_verification_code ?? j?.data?.dev_verification_code ?? j?.data?.result?.dev_verification_code ?? j?.result?.dev_verification_code;
+            if (typeof echoed === 'string' && echoed)
+                devCode = echoed; // present only when the server chose to echo (dev rigs); absence is the contract
+        }
+        catch {
+            /* not JSON - nothing to echo */
+        }
+    }
+    catch (err) {
+        console.error('[ADMIN_LOGIN_EMAIL_CODE] twofa/email/send fetch failed:', err instanceof Error ? err.message : String(err));
+    }
+    if (!sendOk) {
+        return server_1.NextResponse.json({ success: false, error: 'We could not ask for an email code just now - this is a problem on our side. Try again shortly.' }, { status: 502 });
+    }
+    const res = server_1.NextResponse.json({ success: true, codeRequested: true, sentVia: 'email', ...(devCode ? { devVerificationCode: devCode } : {}) }, { status: 200 });
+    const cookie = { httpOnly: true, secure: process.env.NODE_ENV === 'production', sameSite: 'lax', path: '/', maxAge: 600 };
+    res.cookies.set('adm2fa_lane', 'email', cookie); // the verify turn then tries totp -> email, exactly as for any non-SMS user
+    res.cookies.set('adm2fa_emailreq', String(now), { ...cookie, maxAge: EMAIL_CODE_COOLDOWN_S });
+    return res;
+}

package/dist/api-handlers/auth/credential-login.d.ts

@@ -0,0 +1,41 @@
+/**
+ * PAY-2302 (cut 1): THIS HANDLER NOW LIVES IN @payez/next-mvp. It was written as an app-local route in
+ * VibeID-Customer-Portal (src/app/api/auth/admin-login/route.ts, card 238225) because the package had no credential sign-in:
+ * its Better Auth instance configures socialProviders only (no emailAndPassword) and createLoginHandler (api-handlers/auth/login.ts)
+ * proxies the IdP without writing a session. It moved here so a generated app (create-next-app) can sign a user in; the portal
+ * re-exports it. Where the history below says "the package", "app-local" or "the graft", read it as written BEFORE the move.
+ *
+ * Admin password sign-in — card 238225 stage-2.
+ *
+ * Deliberately NOT a better-auth flow: better-auth's own auth/better-auth.js
+ * only configures socialProviders (Google) - zero emailAndPassword - and
+ * BAPert's ruling (32776, re 32769) was explicit: keep the shared package
+ * untouched, land this as an app-local custom route instead. It talks to the
+ * IDP the same way @payez/next-mvp's createLoginHandler does
+ * (api-handlers/auth/login.js: POST {IDP_URL}/api/ExternalAuth/login), which
+ * is the exact endpoint QAPert's TOTP fixture already proved works (mail
+ * 32622). createLoginHandler itself was not reused here - its own doc
+ * comment says it normalizes "for NextAuth authorize()", a caller this
+ * better-auth-only package no longer has.
+ *
+ * Two-step, same shape testing/qa/H1-AUTH-MECHANISM-2026-07-31.md documents
+ * for the IDP: an access token with NO refresh token means 2FA is
+ * outstanding (refresh is deliberately withheld until the second factor
+ * clears). Step 1 (email+password) either finishes in one shot or comes back
+ * asking for a code; step 2 resubmits email+password+code together - the IDP
+ * endpoint accepts two_factor_code directly on the same login call, so this
+ * never needs the already-authenticated totp-verify/verify-code endpoints
+ * (those add a *second* factor to an existing session; this establishes the
+ * first one).
+ *
+ * Session write: this is the "legacy JWT + Redis" path decode-session.js
+ * still actively maintains as a fallback (see its 183047 rework, and
+ * session-cookie-shape.js's JWS branch) - not dead NextAuth-era code, just
+ * unused by anything else in the package because better-auth mints its own
+ * ba-hmac cookies for every OTHER sign-in path. Nothing else in the package
+ * currently WRITES this shape; this route is the one place that now does,
+ * by design (BAPert 32776: "custom route ... writes session via
+ * lib/session-store.js").
+ */
+import { NextRequest, NextResponse } from 'next/server';
+export declare function POST(req: NextRequest): Promise<NextResponse<unknown>>;