@payez/next-mvp 4.5.7 → 4.7.10

package/src/middleware/create-middleware.ts

@@ -158,6 +158,18 @@ export interface MvpMiddlewareOptions {
    * is signed out for not implementing the check).
    */
   revocationFailMode?: 'closed' | 'open';
+
+  /**
+   * PAY-2302 cut 1c (BAPert 73585): this app has NO revocation source - for example a development environment
+   * provisioned without a vibe client id / HMAC key - and says so EXPLICITLY. Under it a viability answer of
+   * `revocationStatus: 'not_configured'` is viable, and a loud warning is logged once at startup.
+   *
+   * It relaxes ONLY 'not_configured'. 'unknown' (a revocation read that FAILED) and 'revoked' stay closed whatever
+   * `revocationFailMode` says, and the default (option absent) is unchanged: 'not_configured' fails closed, because
+   * for an app that HAS a vibe client it means a misconfiguration (BAPert 66356). Do not use this to paper over a
+   * misconfigured production app; remove it when the environment has a vibe client + HMAC key.
+   */
+  noRevocationSource?: boolean;
 }
 
 // =============================================================================
@@ -195,8 +207,13 @@ const defaultLogger: MiddlewareLogger = {
 const LOGIN_PAGE = '/account-auth/login';
 const VERIFY_CODE_PAGE = '/account-auth/verify-code';
 
+// PAY-2315 (4.7.1): /login is a public alias of the login page. It used to take the 'public: allow' arm and never reached the
+// 'already_authenticated' redirect, so a signed-in user was shown the sign-in form. It is the login page for every arm now.
+// (safe-callback refuses /login as a destination, so this cannot redirect to itself.)
+const LOGIN_ALIAS = '/login';
+
 function isLoginPage(pathname: string): boolean {
-  return pathname === LOGIN_PAGE;
+  return pathname === LOGIN_PAGE || pathname === LOGIN_ALIAS;
 }
 
 /**
@@ -542,6 +559,15 @@ export function createMvpMiddleware(options: MvpMiddlewareOptions = {}) {
   const rbacExemptPaths = options.rbacExemptPaths || [];
   // PAY-1882 step 4: default 'closed' (Jon's option A / BAPert 66316).
   const revocationFailMode = options.revocationFailMode || 'closed';
+  // PAY-2302 cut 1c: strictly `=== true`, so a truthy string in a config file cannot switch revocation off.
+  const noRevocationSource = options.noRevocationSource === true;
+  if (noRevocationSource) {
+    log.warn(
+      '[next-mvp] noRevocationSource is ON: sessions of this app CANNOT be revoked server-side (no vibe client / HMAC key). ' +
+      "revocationStatus 'not_configured' is treated as viable; 'unknown' and 'revoked' still sign the user out. " +
+      'Remove this option once the environment has a vibe client id and HMAC key.'
+    );
+  }
   const sessionResetRoute =
     options.sessionResetRoute === true ? DEFAULT_SESSION_RESET_ROUTE
     : typeof options.sessionResetRoute === 'string' && options.sessionResetRoute ? options.sessionResetRoute
@@ -604,7 +630,8 @@ export function createMvpMiddleware(options: MvpMiddlewareOptions = {}) {
       request,
       viabilityEndpoint,
       log,
-      revocationFailMode
+      revocationFailMode,
+      noRevocationSource
     );
 
     // --- Stale session (cookie exists but session doesn't): OBSERVE ONLY, DO NOT DECIDE ---
@@ -687,11 +714,14 @@ export function createMvpMiddleware(options: MvpMiddlewareOptions = {}) {
 export function decideForceInvalid(
   data: { revocationStatus?: unknown; forceInvalid?: unknown; revoked?: unknown },
   revocationFailMode: 'closed' | 'open',
+  noRevocationSource: boolean = false,
 ): boolean {
   const status = data.revocationStatus;
   if (typeof status === 'string') {
     if (status === 'revoked') return true;
     if (status === 'active') return false;
+    // PAY-2302 cut 1c: an app that declared it has no revocation source. ONLY the exact 'not_configured' string.
+    if (status === 'not_configured' && noRevocationSource === true) return false;
     // S1 (NightHawk 66409): ANY other string - 'unknown', 'not_configured', a
     // typo like 'Revoked', 'error', or '' - is treated as 'unknown' (fail mode
     // applies), NEVER as 'active'. Returning false here would let the first
@@ -720,7 +750,8 @@ async function checkViability(
   request: NextRequest,
   endpoint: string,
   log: MiddlewareLogger,
-  revocationFailMode: 'closed' | 'open'
+  revocationFailMode: 'closed' | 'open',
+  noRevocationSource: boolean = false
 ): Promise<{
   sessionStatus: SessionStatus;
   sessionPointer: SessionPointer;
@@ -798,7 +829,7 @@ async function checkViability(
       // revocations status, decide from it + failMode and ignore the folded
       // booleans for unknown/not_configured. The booleans are read ONLY when
       // revocationStatus is ABSENT (idealresume.online's older boolean route).
-      sessionStatus.forceInvalid = decideForceInvalid(data, revocationFailMode);
+      sessionStatus.forceInvalid = decideForceInvalid(data, revocationFailMode, noRevocationSource);
       // PAY-2216: a STALE session - the cookie resolved to a token, but no store holds the session - used to set
       // pointer.exists=false, so makeAuthDecision took no_session (login, cookie NOT cleared) and its stale_session
       // arm (clearCookies) was unreachable: a dead cookie lingered and re-ran viability on every request.

package/src/pages/login/page.tsx

@@ -29,6 +29,7 @@ import { Suspense } from 'react';
 import ReservedStatusBox from '../../components/reserved/ReservedStatusBox';
 import ReservedRecoveryWarning from '../../components/reserved/ReservedRecoveryWarning';
 import { useBranding, useColors, useLayout } from '../../theme/useTheme';
+import { friendlyLoginError, oauthFailureMessage } from '../../lib/login-error-message';
 
 function LoginForm({ altAuthSlot }: { altAuthSlot?: React.ReactNode }) {
   const searchParams = useSearchParams();
@@ -117,46 +118,20 @@ function LoginForm({ altAuthSlot }: { altAuthSlot?: React.ReactNode }) {
   // Atomic state management - only ONE can be true at a time
   const [isSubmitting, setIsSubmitting] = useState(false);
   const [loginSuccess, setLoginSuccess] = useState(false);
-  const [loginError, setLoginError] = useState<string | null>(null);
+  // undefined = the user has not acted yet (show what the URL says); null/string = an explicit state set by a handler below.
+  const [loginError, setLoginError] = useState<string | null | undefined>(undefined);
   const [loading, setLoading] = useState(false);
   const [showRecoveryOptions, setShowRecoveryOptions] = useState(false);
 
   // Force show form after timeout if stuck in loading
   const [forceShowForm, setForceShowForm] = useState(false);
 
-  // Surface OAuth failures the Better Auth mount bounced back here.
+  // PAY-2319 (4.7.2): what the URL says, derived at render (no effect) so it is shown on the FIRST paint and in a static render.
+  // 4.7.1 mapped these in effects that only set loginError, which was never rendered. Unknown codes are NOT echoed (see lib/login-error-message).
+  const urlMessage = oauthFailureMessage(oauthError) ?? friendlyLoginError(urlError);
+  const shownError: string | null = loginError !== undefined ? loginError : urlMessage;
   useEffect(() => {
-    if (oauthError) {
-      const name = oauthError.charAt(0).toUpperCase() + oauthError.slice(1);
-      setLoginError(`${name} sign-in did not complete. Please try again.`);
-    }
-  }, [oauthError]);
-
-  // Handle URL errors with user-friendly messages
-  useEffect(() => {
-    if (urlError) {
-      let friendlyError: string | null = urlError;
-
-      if (urlError === 'SessionExpired') {
-        // Session expiration is normal - don't show as error
-        console.log('[LOGIN] SessionExpired detected - normal behavior');
-        friendlyError = null;
-      } else if (urlError === 'TwoFactorTimeout') {
-        // PAY-884: the sign-in expired while the verification code was outstanding. Unlike
-        // SessionExpired this is NOT silent - the user was mid-2FA and must know why they are here.
-        friendlyError = 'Your verification step timed out before the code was confirmed. Please sign in again.';
-      } else if (urlError === 'ServiceUnavailable') {
-        friendlyError = 'Authentication service is temporarily unavailable. Please try again in a few minutes.';
-      } else if (urlError.startsWith("Unexpected token")) {
-        friendlyError = 'An authentication error occurred. Please try signing in again.';
-      } else if (urlError.includes('not valid JSON')) {
-        friendlyError = 'An authentication error occurred. Please try signing in again.';
-      } else if (urlError === 'CredentialsSignin') {
-        friendlyError = 'Invalid email or password. Please try again.';
-      }
-
-      setLoginError(friendlyError);
-    }
+    if (urlError === 'SessionExpired') console.log('[LOGIN] SessionExpired detected - normal behavior');
   }, [urlError]);
 
   // Timeout to prevent infinite loading states
@@ -186,7 +161,7 @@ function LoginForm({ altAuthSlot }: { altAuthSlot?: React.ReactNode }) {
   // package never configures emailAndPassword. See the note at the render site.
 
   // Show loading spinner for initial loads
-  if (!forceShowForm && !loginError && (loading || (status === 'loading' && !session))) {
+  if (!forceShowForm && !shownError && (loading || (status === 'loading' && !session))) {
     return (
       <div className={`flex flex-col items-center justify-center min-h-screen ${colors.background}`}>
         <svg className="animate-spin h-6 w-6" style={{ color: buttonColor }} viewBox="0 0 24 24" fill="none">
@@ -246,6 +221,17 @@ function LoginForm({ altAuthSlot }: { altAuthSlot?: React.ReactNode }) {
             </p>
           </div>
 
+          {/* PAY-2319 (4.7.2): the error sentence. 4.7.1 set loginError but never rendered it. */}
+          {shownError && (
+            <div
+              role="alert"
+              data-testid="login-error"
+              className="mb-6 rounded-lg border border-red-200 bg-red-50 px-4 py-3 text-sm text-red-700"
+            >
+              {shownError}
+            </div>
+          )}
+
           {/* Social sign-in — rendered ONLY from the IDP client config's
               enabled providers (see the /api/auth/settings discovery above).
               Above the form, divider idiom per the package's ModeAwareLoginPage. */}

package/src/routes/auth/credential-login-email-code.ts

@@ -0,0 +1,6 @@
+/**
+ * PAY-2302 cut 1: ask the IdP to email a code when the authenticator lane failed on our side.
+ * The handler lives in api-handlers/auth/credential-login-email-code.ts (moved from VibeID-Customer-Portal src/app/api/auth/admin-login/email-code/route.ts). A consuming app's route file
+ * re-exports POST and writes `export const runtime = 'nodejs'` literally.
+ */
+export { POST } from '../../api-handlers/auth/credential-login-email-code';

package/src/routes/auth/credential-login.ts

@@ -0,0 +1,6 @@
+/**
+ * PAY-2302 cut 1: password sign-in route (IdP ExternalAuth/login, session written via lib/session-store, 2FA-outstanding handling).
+ * The handler lives in api-handlers/auth/credential-login.ts (moved from VibeID-Customer-Portal src/app/api/auth/admin-login/route.ts). A consuming app's route file
+ * re-exports POST and writes `export const runtime = 'nodejs'` literally.
+ */
+export { POST } from '../../api-handlers/auth/credential-login';

package/src/routes/oauth/resume.ts

@@ -0,0 +1,11 @@
+/**
+ * PAY-2302 cut 2: post-2FA OAuth authorize resume route. The handler lives in api-handlers/oauth/resume.ts
+ * (moved from VibeID-Customer-Portal src/app/api/oauth/resume/route.ts). A consuming app's route file re-exports GET
+ * and writes `export const runtime = 'nodejs'` literally.
+ *
+ * 4.7.3: `createOAuthResumeHandler({ refusalLocation })` and `DEFAULT_REFUSAL_LOCATION` are re-exported HERE because a consumer can only
+ * import what `package.json` `exports` lists, and this route module is the entry. An app whose sign-in page is not
+ * /account-auth/login (the portal uses /sign-in) writes `export const GET = createOAuthResumeHandler({ refusalLocation: '/sign-in?error=AUTHORIZE_RESUME_REFUSED' });`.
+ */
+export { GET, createOAuthResumeHandler, DEFAULT_REFUSAL_LOCATION } from '../../api-handlers/oauth/resume';
+export type { OAuthResumeOptions, OAuthResumeDeps } from '../../api-handlers/oauth/resume';

package/src/types/auth.ts

@@ -25,6 +25,12 @@ export interface AuthConfig {
    * An OAuth-only client is a deliberate choice, never the default.
    */
   allowTraditionalLogin?: boolean;
+  /**
+   * PAY-2334: where /api/auth/settings stands. 'loading' = not answered yet, 'ready' = answered (or nothing to ask:
+   * useDynamicProviders off), 'failed' = non-2xx, thrown, or timed out. Absent means 'ready'. A page must not tell the user
+   * "sign-in is not available" while this is 'loading', and must say a failed read is a failed read, not an empty answer.
+   */
+  settingsStatus?: 'loading' | 'ready' | 'failed';
   providers: FederatedProvider[];
   enableRecovery: boolean;
   enableEmailSignup: boolean;