@payez/next-mvp 4.5.7 → 4.7.10

package/dist/lib/device-id.js

@@ -0,0 +1,70 @@
+"use strict";
+/**
+ * Per-browser device identity — card 240566 (QAPert flag 2 on the 9c7a815 review).
+ *
+ * BEFORE: /api/auth/admin-login forwarded ONE hardcoded device-id cookie —
+ * `payez-PayEz-6c8201c35c1b44c9b2e823b36b95a718` — for every caller on the
+ * PUBLIC /sign-in password path. To the IDP's rate limiter and device
+ * fingerprinting, every portal user was literally the same device. Two
+ * consequences, both measured-by-inspection rather than hypothetical:
+ *   1. SHARED-FATE LOCKOUT — one attacker's failed attempts consume the
+ *      throttle budget for every legitimate user at once.
+ *   2. Per-device risk signals are meaningless: "new device" and "trusted
+ *      device" cannot distinguish anybody from anybody.
+ *
+ * The id is a routing/telemetry key, NOT a credential — the IDP must never
+ * grant anything on the strength of it, and nothing here assumes otherwise.
+ * It is client-supplied and therefore client-forgeable; that is inherent to
+ * device-id throttling and is why it supplements, never replaces, the
+ * identifier- and IP-scoped limits on the IDP side.
+ *
+ * Shape is fixed by what the IDP already accepts from
+ * createLoginHandler: `payez-PayEz-<32 lowercase hex>`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEVICE_ID_PATTERN = exports.DEVICE_ID_HEADER = void 0;
+exports.isValidDeviceId = isValidDeviceId;
+exports.getDeviceId = getDeviceId;
+exports.DEVICE_ID_HEADER = 'X-Device-Id';
+exports.DEVICE_ID_PATTERN = /^payez-PayEz-[0-9a-f]{32}$/;
+const STORAGE_KEY = 'payez.device-id';
+/** True for a well-formed device id. Used on BOTH sides of the wire. */
+function isValidDeviceId(value) {
+    return typeof value === 'string' && exports.DEVICE_ID_PATTERN.test(value);
+}
+function mint() {
+    const bytes = new Uint8Array(16);
+    crypto.getRandomValues(bytes);
+    const hex = Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
+    return `payez-PayEz-${hex}`;
+}
+/**
+ * The stable per-browser device id, minted once and persisted.
+ *
+ * Browser-only. Persistence is best-effort: private windows, disabled site
+ * data and storage-quota failures all throw on access, so every read and
+ * write is guarded. A browser that cannot persist still gets a VALID id for
+ * this call — it simply looks like a new device each time, which is the
+ * honest answer for a client that refuses to be remembered, and is still
+ * strictly better than every user sharing one identity.
+ */
+function getDeviceId() {
+    if (typeof window === 'undefined')
+        return mint();
+    try {
+        const existing = window.localStorage.getItem(STORAGE_KEY);
+        if (isValidDeviceId(existing))
+            return existing;
+    }
+    catch {
+        return mint();
+    }
+    const minted = mint();
+    try {
+        window.localStorage.setItem(STORAGE_KEY, minted);
+    }
+    catch {
+        /* not persistable — the minted id is still returned and used for this call */
+    }
+    return minted;
+}

package/dist/lib/lock-window.d.ts

@@ -0,0 +1,29 @@
+/**
+ * PAY-1608: a 2FA lock's window, stated as the IdP enforces it. Never a hard-coded "15 minutes".
+ *
+ * Core answers every 2FA lock with 429 code "locked" plus Retry-After: MfaController.SecondFactorLocked sends the
+ * full lockout (900), and VerifyTotp sends what is LEFT of the lock. The portal used to hard-code "locked for 15
+ * minutes" in three places (verify-code-copy.ts, twofa-rejection.ts, and the next-mvp BFF), which was true only
+ * while every lock was exactly 15 minutes and the user had just tripped it.
+ *
+ * The window arrives in one of two ways:
+ *   - Door A (verify-code): next-mvp >= 4.5.2 relays it in the BFF body as `retryAfterSeconds` (a number).
+ *   - Door B (admin-login): this route reads the IdP's Retry-After header itself.
+ * With no window, the sentence states NO number rather than a guessed one.
+ *
+ * Dependency-free on purpose: the verify-code page (client) and the admin-login route (server) both use it, and
+ * the chain gate executes it directly.
+ */
+/** A positive whole number of seconds from the BFF body, or undefined. Anything else - a string, 0, NaN - is dropped. */
+export declare function lockSecondsFromBody(value: unknown): number | undefined;
+/** A Retry-After header as whole seconds. ONE implementation: the package's lib/retry-after (the portal copy was the same rule). */
+export { parseRetryAfterSeconds } from './retry-after';
+/**
+ * The window in words, rounded UP so the user is never told a shorter wait than the IdP enforces:
+ * 900 -> "15 minutes", 61 -> "2 minutes", 60 -> "1 minute", 45 -> "45 seconds", 7200 -> "2 hours".
+ */
+export declare function formatLockWindow(seconds: number | undefined): string | undefined;
+/** The sentence for a lock whose window was NOT sent. It says even a correct code is refused, and states no number. */
+export declare const LOCKED_NO_WINDOW = "Too many incorrect codes. Verification is locked for now - even a correct code is refused until the lock ends. Wait before entering another code.";
+/** The locked sentence: the IdP's real window when it sent one, otherwise LOCKED_NO_WINDOW. */
+export declare function lockedSentence(seconds?: number): string;

package/dist/lib/lock-window.js

@@ -0,0 +1,53 @@
+"use strict";
+/**
+ * PAY-1608: a 2FA lock's window, stated as the IdP enforces it. Never a hard-coded "15 minutes".
+ *
+ * Core answers every 2FA lock with 429 code "locked" plus Retry-After: MfaController.SecondFactorLocked sends the
+ * full lockout (900), and VerifyTotp sends what is LEFT of the lock. The portal used to hard-code "locked for 15
+ * minutes" in three places (verify-code-copy.ts, twofa-rejection.ts, and the next-mvp BFF), which was true only
+ * while every lock was exactly 15 minutes and the user had just tripped it.
+ *
+ * The window arrives in one of two ways:
+ *   - Door A (verify-code): next-mvp >= 4.5.2 relays it in the BFF body as `retryAfterSeconds` (a number).
+ *   - Door B (admin-login): this route reads the IdP's Retry-After header itself.
+ * With no window, the sentence states NO number rather than a guessed one.
+ *
+ * Dependency-free on purpose: the verify-code page (client) and the admin-login route (server) both use it, and
+ * the chain gate executes it directly.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LOCKED_NO_WINDOW = exports.parseRetryAfterSeconds = void 0;
+exports.lockSecondsFromBody = lockSecondsFromBody;
+exports.formatLockWindow = formatLockWindow;
+exports.lockedSentence = lockedSentence;
+/** A positive whole number of seconds from the BFF body, or undefined. Anything else - a string, 0, NaN - is dropped. */
+function lockSecondsFromBody(value) {
+    return typeof value === 'number' && Number.isFinite(value) && value > 0 ? Math.ceil(value) : undefined;
+}
+/** A Retry-After header as whole seconds. ONE implementation: the package's lib/retry-after (the portal copy was the same rule). */
+var retry_after_1 = require("./retry-after");
+Object.defineProperty(exports, "parseRetryAfterSeconds", { enumerable: true, get: function () { return retry_after_1.parseRetryAfterSeconds; } });
+/**
+ * The window in words, rounded UP so the user is never told a shorter wait than the IdP enforces:
+ * 900 -> "15 minutes", 61 -> "2 minutes", 60 -> "1 minute", 45 -> "45 seconds", 7200 -> "2 hours".
+ */
+function formatLockWindow(seconds) {
+    if (typeof seconds !== 'number' || !Number.isFinite(seconds) || seconds <= 0)
+        return undefined;
+    const plural = (n, unit) => `${n} ${unit}${n === 1 ? '' : 's'}`;
+    if (seconds < 60)
+        return plural(Math.ceil(seconds), 'second');
+    const minutes = Math.ceil(seconds / 60);
+    if (minutes < 120)
+        return plural(minutes, 'minute');
+    return plural(Math.ceil(minutes / 60), 'hour');
+}
+/** The sentence for a lock whose window was NOT sent. It says even a correct code is refused, and states no number. */
+exports.LOCKED_NO_WINDOW = 'Too many incorrect codes. Verification is locked for now - even a correct code is refused until the lock ends. Wait before entering another code.';
+/** The locked sentence: the IdP's real window when it sent one, otherwise LOCKED_NO_WINDOW. */
+function lockedSentence(seconds) {
+    const window = formatLockWindow(seconds);
+    return window
+        ? `Too many incorrect codes. Verification is locked for ${window} - wait before entering another code.`
+        : exports.LOCKED_NO_WINDOW;
+}

package/dist/lib/login-error-message.d.ts

@@ -0,0 +1,18 @@
+/**
+ * PAY-2319 (4.7.2): what the login page SAYS for an `?error=` / `?oauth_error=` code, as pure functions so a test can
+ * execute them (the page is a client component and effects do not run in a static render).
+ *
+ * 4.7.1 mapped these codes in an effect that called setLoginError, but the page never RENDERED loginError (it only fed the
+ * loading gate), so no sentence was ever shown (NightHawk's walk, 73801, W1). Now that the text is displayed, a raw code from
+ * the URL must NOT be echoed: `/account-auth/login?error=<anything an attacker types>` would otherwise print attacker-chosen
+ * text on the login page (content spoofing / phishing). Known codes get their sentence; anything else gets one generic
+ * sentence; nothing from the URL is ever shown verbatim.
+ */
+export declare const GENERIC_LOGIN_ERROR = "We could not sign you in. Please try again.";
+/**
+ * The sentence for `?error=<code>`, or null when nothing should be shown.
+ * SessionExpired is a normal event (not an error) and shows nothing; an absent/empty code shows nothing.
+ */
+export declare function friendlyLoginError(code: string | null | undefined): string | null;
+/** `?oauth_error=<provider>`: only a plain provider-like slug is echoed (capitalised); anything else is the generic sentence. */
+export declare function oauthFailureMessage(provider: string | null | undefined): string | null;

package/dist/lib/login-error-message.js

@@ -0,0 +1,47 @@
+"use strict";
+/**
+ * PAY-2319 (4.7.2): what the login page SAYS for an `?error=` / `?oauth_error=` code, as pure functions so a test can
+ * execute them (the page is a client component and effects do not run in a static render).
+ *
+ * 4.7.1 mapped these codes in an effect that called setLoginError, but the page never RENDERED loginError (it only fed the
+ * loading gate), so no sentence was ever shown (NightHawk's walk, 73801, W1). Now that the text is displayed, a raw code from
+ * the URL must NOT be echoed: `/account-auth/login?error=<anything an attacker types>` would otherwise print attacker-chosen
+ * text on the login page (content spoofing / phishing). Known codes get their sentence; anything else gets one generic
+ * sentence; nothing from the URL is ever shown verbatim.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GENERIC_LOGIN_ERROR = void 0;
+exports.friendlyLoginError = friendlyLoginError;
+exports.oauthFailureMessage = oauthFailureMessage;
+exports.GENERIC_LOGIN_ERROR = 'We could not sign you in. Please try again.';
+const KNOWN = {
+    TwoFactorTimeout: 'Your verification step timed out before the code was confirmed. Please sign in again.',
+    AUTHORIZE_RESUME_REFUSED: 'That sign-in request could not be continued. Please sign in again.',
+    ServiceUnavailable: 'Authentication service is temporarily unavailable. Please try again in a few minutes.',
+    CredentialsSignin: 'Invalid email or password. Please try again.',
+};
+/**
+ * The sentence for `?error=<code>`, or null when nothing should be shown.
+ * SessionExpired is a normal event (not an error) and shows nothing; an absent/empty code shows nothing.
+ */
+function friendlyLoginError(code) {
+    if (typeof code !== 'string' || code === '')
+        return null;
+    if (code === 'SessionExpired')
+        return null;
+    if (Object.prototype.hasOwnProperty.call(KNOWN, code))
+        return KNOWN[code];
+    // The old raw-JSON parse failures the middleware/proxy could bounce here:
+    if (code.startsWith('Unexpected token') || code.includes('not valid JSON')) {
+        return 'An authentication error occurred. Please try signing in again.';
+    }
+    return exports.GENERIC_LOGIN_ERROR;
+}
+/** `?oauth_error=<provider>`: only a plain provider-like slug is echoed (capitalised); anything else is the generic sentence. */
+function oauthFailureMessage(provider) {
+    if (typeof provider !== 'string' || provider === '')
+        return null;
+    if (!/^[a-z][a-z0-9_-]{0,31}$/i.test(provider))
+        return exports.GENERIC_LOGIN_ERROR;
+    return `${provider.charAt(0).toUpperCase()}${provider.slice(1)} sign-in did not complete. Please try again.`;
+}

package/dist/lib/twofa-rejection.d.ts

@@ -0,0 +1,20 @@
+export interface TwofaLaneResult {
+    status: number;
+    body: string;
+    /** PAY-2284: which lane this answer came from, so a fault in the TOTP/SMS lane can offer the email lane (never offered when the EMAIL lane is the one that faulted). */
+    lane?: 'totp' | 'sms' | 'email';
+    /** PAY-1608: this lane's Retry-After header, as received. */
+    retryAfter?: string | null;
+}
+export interface TwofaRejection {
+    status: 400 | 429 | 502;
+    error: string;
+    retryAfter?: number;
+    /**
+     * PAY-2284: true when the authenticator (or text) lane failed on OUR side and the emailed-code lane has not faulted. The sign-in
+     * card then shows a real "Email me a code instead" action. Before this, the copy said "use another sign-in method" and the screen
+     * offered none, and a TOTP holder - for whom the door sends NOTHING at sign-in - was stuck (Jon, 12 Oct, dev-93 key version 57).
+     */
+    offerEmailCode?: true;
+}
+export declare function classifyTwofaRejection(lanes: TwofaLaneResult[], retryAfterHeader?: string | null): TwofaRejection;

package/dist/lib/twofa-rejection.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.classifyTwofaRejection = classifyTwofaRejection;
+/**
+ * Door B (/api/auth/admin-login) twofa verify: what to tell the user when every lane refused.
+ *
+ * Classification is by the MOST BLOCKING outcome across lanes (268121 ruling), in this order:
+ *   429 from the IdP, or any lane answering code `locked`  -> 429 lockout (PAY-903)
+ *   any 5xx, or a lane answering code server_error / service_unavailable (PAY-1589) -> 502 "our side, not your code"
+ *   otherwise                                              -> 400 wrong / expired code
+ *
+ * PAY-903: MfaController.VerifyTotp returns 400 {message, code:"locked"} for a 15-minute lockout
+ * (MfaTotpService ErrorCode "locked"). Status-only classification read that as "wrong code, try again" -
+ * coaching a locked-out user to spend attempts. The body is inspected for EVERY lane, because with lane
+ * order [totp, email] the last response is the email lane's and never carries the TOTP lockout.
+ * Disclosing the lockout here is safe: this step is post-password (the caller already proved the account).
+ *
+ * PAY-1608: the lockout states the LOCKED LANE's own Retry-After (Core sends one on every 2FA lock; VerifyTotp sends
+ * what is LEFT of it). It used to hard-code 15 minutes / 900 s. With no usable header, no number is stated and
+ * `retryAfter` is omitted rather than invented.
+ */
+const lock_window_1 = require("./lock-window");
+/** Every code the IdP body carries: flat {code}, envelope {error:{code}}, or {error:{details:{code}}}. */
+function laneCodes(body) {
+    try {
+        const j = JSON.parse(body);
+        if (!j || typeof j !== 'object')
+            return [];
+        const err = (j.error && typeof j.error === 'object' ? j.error : null);
+        const details = (err?.details && typeof err.details === 'object' ? err.details : null);
+        return [j.code, err?.code, details?.code].filter((c) => typeof c === 'string').map((c) => c.toLowerCase());
+    }
+    catch {
+        return [];
+    }
+}
+function classifyTwofaRejection(lanes, retryAfterHeader) {
+    const lockedLane = lanes.find((l) => laneCodes(l.body).includes('locked'));
+    if (lockedLane) {
+        const secs = (0, lock_window_1.parseRetryAfterSeconds)(lockedLane.retryAfter);
+        return { status: 429, error: (0, lock_window_1.lockedSentence)(secs), ...(secs ? { retryAfter: secs } : {}) };
+    }
+    if (lanes.some((l) => l.status === 429)) {
+        const parsed = retryAfterHeader ? parseInt(retryAfterHeader, 10) : NaN;
+        return {
+            status: 429,
+            error: 'Too many attempts. Your code is still valid - wait before trying again.',
+            retryAfter: Number.isFinite(parsed) && parsed > 0 ? parsed : 60,
+        };
+    }
+    // PAY-1589: an IdP-side fault that arrives as 400 + code (TOTP secret cannot be decrypted -> server_error;
+    // replay store down -> service_unavailable). It is not the user's code and does not count toward the lockout,
+    // so calling it "not right" sends them round a loop that cannot succeed. Email may still work, so say so.
+    const faulted = (l) => laneCodes(l.body).some((c) => c === 'server_error' || c === 'service_unavailable');
+    if (lanes.some(faulted)) {
+        const emailLaneFaulted = lanes.some((l) => l.lane === 'email' && (faulted(l) || l.status >= 500));
+        const offer = !emailLaneFaulted && lanes.some((l) => faulted(l) && (l.lane === 'totp' || l.lane === 'sms'));
+        return {
+            status: 502,
+            error: offer
+                ? 'We could not check your code just now - this is a problem on our side, not with your code. You can have us email you a code instead.'
+                : 'We could not check your code just now - this is a problem on our side, not with your code. Try again shortly.',
+            ...(offer ? { offerEmailCode: true } : {}),
+        };
+    }
+    if (lanes.some((l) => l.status >= 500)) {
+        return {
+            status: 502,
+            error: 'We could not check your code just now - this is a problem on our side, not with your code. Try again shortly.',
+        };
+    }
+    return { status: 400, error: 'That code is not right or has expired. Try again.' };
+}

package/dist/middleware/create-middleware.d.ts

@@ -136,6 +136,17 @@ export interface MvpMiddlewareOptions {
      * is signed out for not implementing the check).
      */
     revocationFailMode?: 'closed' | 'open';
+    /**
+     * PAY-2302 cut 1c (BAPert 73585): this app has NO revocation source - for example a development environment
+     * provisioned without a vibe client id / HMAC key - and says so EXPLICITLY. Under it a viability answer of
+     * `revocationStatus: 'not_configured'` is viable, and a loud warning is logged once at startup.
+     *
+     * It relaxes ONLY 'not_configured'. 'unknown' (a revocation read that FAILED) and 'revoked' stay closed whatever
+     * `revocationFailMode` says, and the default (option absent) is unchanged: 'not_configured' fails closed, because
+     * for an app that HAS a vibe client it means a misconfiguration (BAPert 66356). Do not use this to paper over a
+     * misconfigured production app; remove it when the environment has a vibe client + HMAC key.
+     */
+    noRevocationSource?: boolean;
 }
 /**
  * PAY-2136 Rule A: a speculative request (router prefetch) must NEVER mutate cookies.
@@ -166,4 +177,4 @@ export declare function decideForceInvalid(data: {
     revocationStatus?: unknown;
     forceInvalid?: unknown;
     revoked?: unknown;
-}, revocationFailMode: 'closed' | 'open'): boolean;
+}, revocationFailMode: 'closed' | 'open', noRevocationSource?: boolean): boolean;

package/dist/middleware/create-middleware.js

@@ -60,8 +60,12 @@ const defaultLogger = {
 // =============================================================================
 const LOGIN_PAGE = '/account-auth/login';
 const VERIFY_CODE_PAGE = '/account-auth/verify-code';
+// PAY-2315 (4.7.1): /login is a public alias of the login page. It used to take the 'public: allow' arm and never reached the
+// 'already_authenticated' redirect, so a signed-in user was shown the sign-in form. It is the login page for every arm now.
+// (safe-callback refuses /login as a destination, so this cannot redirect to itself.)
+const LOGIN_ALIAS = '/login';
 function isLoginPage(pathname) {
-    return pathname === LOGIN_PAGE;
+    return pathname === LOGIN_PAGE || pathname === LOGIN_ALIAS;
 }
 /**
  * Ensures callback URLs never point to auth pages (prevents redirect loops) AND
@@ -378,6 +382,13 @@ function createMvpMiddleware(options = {}) {
     const rbacExemptPaths = options.rbacExemptPaths || [];
     // PAY-1882 step 4: default 'closed' (Jon's option A / BAPert 66316).
     const revocationFailMode = options.revocationFailMode || 'closed';
+    // PAY-2302 cut 1c: strictly `=== true`, so a truthy string in a config file cannot switch revocation off.
+    const noRevocationSource = options.noRevocationSource === true;
+    if (noRevocationSource) {
+        log.warn('[next-mvp] noRevocationSource is ON: sessions of this app CANNOT be revoked server-side (no vibe client / HMAC key). ' +
+            "revocationStatus 'not_configured' is treated as viable; 'unknown' and 'revoked' still sign the user out. " +
+            'Remove this option once the environment has a vibe client id and HMAC key.');
+    }
     const sessionResetRoute = options.sessionResetRoute === true ? session_reset_link_1.DEFAULT_SESSION_RESET_ROUTE
         : typeof options.sessionResetRoute === 'string' && options.sessionResetRoute ? options.sessionResetRoute
             : undefined;
@@ -430,7 +441,7 @@ function createMvpMiddleware(options = {}) {
             // Has cookie - continue to viability check for 2FA enforcement
         }
         // --- Fetch session viability from internal API ---
-        const { sessionStatus, sessionPointer } = await checkViability(request, viabilityEndpoint, log, revocationFailMode);
+        const { sessionStatus, sessionPointer } = await checkViability(request, viabilityEndpoint, log, revocationFailMode, noRevocationSource);
         // --- Stale session (cookie exists but session doesn't): OBSERVE ONLY, DO NOT DECIDE ---
         //
         // *** CARD 349607. THIS BLOCK USED TO `return` HERE, AND THAT RETURN WAS A BYPASS. ***
@@ -505,13 +516,16 @@ function createMvpMiddleware(options = {}) {
  * 'unknown'/'not_configured'. The booleans are read ONLY when revocationStatus is
  * absent (idealresume.online's older boolean-only route).
  */
-function decideForceInvalid(data, revocationFailMode) {
+function decideForceInvalid(data, revocationFailMode, noRevocationSource = false) {
     const status = data.revocationStatus;
     if (typeof status === 'string') {
         if (status === 'revoked')
             return true;
         if (status === 'active')
             return false;
+        // PAY-2302 cut 1c: an app that declared it has no revocation source. ONLY the exact 'not_configured' string.
+        if (status === 'not_configured' && noRevocationSource === true)
+            return false;
         // S1 (NightHawk 66409): ANY other string - 'unknown', 'not_configured', a
         // typo like 'Revoked', 'error', or '' - is treated as 'unknown' (fail mode
         // applies), NEVER as 'active'. Returning false here would let the first
@@ -534,7 +548,7 @@ function hasSessionCookie(request) {
     return !!(request.cookies.get((0, app_slug_1.getSessionCookieName)())?.value || request.cookies.get((0, app_slug_1.getSecureSessionCookieName)())?.value);
 }
 /** Check session viability via internal API */
-async function checkViability(request, endpoint, log, revocationFailMode) {
+async function checkViability(request, endpoint, log, revocationFailMode, noRevocationSource = false) {
     const sessionStatus = {
         exists: false,
         forceInvalid: false,
@@ -606,7 +620,7 @@ async function checkViability(request, endpoint, log, revocationFailMode) {
             // revocations status, decide from it + failMode and ignore the folded
             // booleans for unknown/not_configured. The booleans are read ONLY when
             // revocationStatus is ABSENT (idealresume.online's older boolean route).
-            sessionStatus.forceInvalid = decideForceInvalid(data, revocationFailMode);
+            sessionStatus.forceInvalid = decideForceInvalid(data, revocationFailMode, noRevocationSource);
             // PAY-2216: a STALE session - the cookie resolved to a token, but no store holds the session - used to set
             // pointer.exists=false, so makeAuthDecision took no_session (login, cookie NOT cleared) and its stale_session
             // arm (clearCookies) was unreachable: a dead cookie lingered and re-ran viability on every request.

package/dist/pages/login/page.js

@@ -29,6 +29,7 @@ const better_auth_client_1 = require("../../client/better-auth-client");
 const navigation_1 = require("next/navigation");
 const react_2 = require("react");
 const useTheme_1 = require("../../theme/useTheme");
+const login_error_message_1 = require("../../lib/login-error-message");
 function LoginForm({ altAuthSlot }) {
     const searchParams = (0, navigation_1.useSearchParams)();
     const callbackUrl = searchParams?.get('callbackUrl') || '/dashboard';
@@ -110,46 +111,19 @@ function LoginForm({ altAuthSlot }) {
     // Atomic state management - only ONE can be true at a time
     const [isSubmitting, setIsSubmitting] = (0, react_1.useState)(false);
     const [loginSuccess, setLoginSuccess] = (0, react_1.useState)(false);
-    const [loginError, setLoginError] = (0, react_1.useState)(null);
+    // undefined = the user has not acted yet (show what the URL says); null/string = an explicit state set by a handler below.
+    const [loginError, setLoginError] = (0, react_1.useState)(undefined);
     const [loading, setLoading] = (0, react_1.useState)(false);
     const [showRecoveryOptions, setShowRecoveryOptions] = (0, react_1.useState)(false);
     // Force show form after timeout if stuck in loading
     const [forceShowForm, setForceShowForm] = (0, react_1.useState)(false);
-    // Surface OAuth failures the Better Auth mount bounced back here.
+    // PAY-2319 (4.7.2): what the URL says, derived at render (no effect) so it is shown on the FIRST paint and in a static render.
+    // 4.7.1 mapped these in effects that only set loginError, which was never rendered. Unknown codes are NOT echoed (see lib/login-error-message).
+    const urlMessage = (0, login_error_message_1.oauthFailureMessage)(oauthError) ?? (0, login_error_message_1.friendlyLoginError)(urlError);
+    const shownError = loginError !== undefined ? loginError : urlMessage;
     (0, react_1.useEffect)(() => {
-        if (oauthError) {
-            const name = oauthError.charAt(0).toUpperCase() + oauthError.slice(1);
-            setLoginError(`${name} sign-in did not complete. Please try again.`);
-        }
-    }, [oauthError]);
-    // Handle URL errors with user-friendly messages
-    (0, react_1.useEffect)(() => {
-        if (urlError) {
-            let friendlyError = urlError;
-            if (urlError === 'SessionExpired') {
-                // Session expiration is normal - don't show as error
-                console.log('[LOGIN] SessionExpired detected - normal behavior');
-                friendlyError = null;
-            }
-            else if (urlError === 'TwoFactorTimeout') {
-                // PAY-884: the sign-in expired while the verification code was outstanding. Unlike
-                // SessionExpired this is NOT silent - the user was mid-2FA and must know why they are here.
-                friendlyError = 'Your verification step timed out before the code was confirmed. Please sign in again.';
-            }
-            else if (urlError === 'ServiceUnavailable') {
-                friendlyError = 'Authentication service is temporarily unavailable. Please try again in a few minutes.';
-            }
-            else if (urlError.startsWith("Unexpected token")) {
-                friendlyError = 'An authentication error occurred. Please try signing in again.';
-            }
-            else if (urlError.includes('not valid JSON')) {
-                friendlyError = 'An authentication error occurred. Please try signing in again.';
-            }
-            else if (urlError === 'CredentialsSignin') {
-                friendlyError = 'Invalid email or password. Please try again.';
-            }
-            setLoginError(friendlyError);
-        }
+        if (urlError === 'SessionExpired')
+            console.log('[LOGIN] SessionExpired detected - normal behavior');
     }, [urlError]);
     // Timeout to prevent infinite loading states
     (0, react_1.useEffect)(() => {
@@ -175,7 +149,7 @@ function LoginForm({ altAuthSlot }) {
     // authClient.signIn.email, which better-auth always rejected because this
     // package never configures emailAndPassword. See the note at the render site.
     // Show loading spinner for initial loads
-    if (!forceShowForm && !loginError && (loading || (status === 'loading' && !session))) {
+    if (!forceShowForm && !shownError && (loading || (status === 'loading' && !session))) {
         return ((0, jsx_runtime_1.jsxs)("div", { className: `flex flex-col items-center justify-center min-h-screen ${colors.background}`, children: [(0, jsx_runtime_1.jsxs)("svg", { className: "animate-spin h-6 w-6", style: { color: buttonColor }, viewBox: "0 0 24 24", fill: "none", children: [(0, jsx_runtime_1.jsx)("circle", { className: "opacity-25", cx: "12", cy: "12", r: "10", stroke: "currentColor", strokeWidth: "4" }), (0, jsx_runtime_1.jsx)("path", { className: "opacity-75", fill: "currentColor", d: "M4 12a8 8 0 018-8v4a4 4 0 00-4 4H4z" })] }), (0, jsx_runtime_1.jsx)("p", { className: `mt-4 text-sm ${colors.muted}`, children: status === 'loading' ? 'Loading...' : 'Authenticating...' })] }));
     }
     return ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsx)("style", { dangerouslySetInnerHTML: { __html: `
@@ -206,7 +180,7 @@ function LoginForm({ altAuthSlot }) {
         .themed-status-submitting svg {
           color: ${buttonColor} !important;
         }
-      ` } }), (0, jsx_runtime_1.jsx)("div", { className: `min-h-screen flex items-center justify-center px-4 ${colors.background}`, children: (0, jsx_runtime_1.jsx)("div", { className: "max-w-md w-full", children: (0, jsx_runtime_1.jsxs)("div", { className: `rounded-2xl shadow-xl p-8 ${colors.card} ${colors.border} text-gray-800`, children: [(0, jsx_runtime_1.jsxs)("div", { className: "text-center mb-8", children: [(0, jsx_runtime_1.jsx)("h1", { className: "text-3xl font-bold mb-2", style: { color: 'inherit' }, children: branding.tagline || 'Welcome Back' }), (0, jsx_runtime_1.jsx)("p", { className: colors.muted, children: "Sign in to your account" })] }), googleEnabled && ((0, jsx_runtime_1.jsx)(jsx_runtime_1.Fragment, { children: (0, jsx_runtime_1.jsxs)("button", { type: "button", onClick: () => void handleGoogleSignIn(), disabled: googleLoading || isSubmitting, "data-testid": "google-sign-in", className: "w-full px-4 py-3 mb-6 rounded-lg border border-gray-300 font-semibold transition-colors flex items-center justify-center gap-2 disabled:opacity-50 disabled:cursor-not-allowed hover:bg-gray-50", style: { backgroundColor: 'white', color: '#1f2937' }, children: [googleLoading ? ((0, jsx_runtime_1.jsxs)("svg", { className: "animate-spin w-5 h-5", fill: "none", viewBox: "0 0 24 24", children: [(0, jsx_runtime_1.jsx)("circle", { className: "opacity-25", cx: "12", cy: "12", r: "10", stroke: "currentColor", strokeWidth: "4" }), (0, jsx_runtime_1.jsx)("path", { className: "opacity-75", fill: "currentColor", d: "M4 12a8 8 0 018-8v4a4 4 0 00-4 4H4z" })] })) : ((0, jsx_runtime_1.jsxs)("svg", { className: "w-5 h-5", viewBox: "0 0 24 24", fill: "currentColor", children: [(0, jsx_runtime_1.jsx)("path", { d: "M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z", fill: "#4285F4" }), (0, jsx_runtime_1.jsx)("path", { d: "M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z", fill: "#34A853" }), (0, jsx_runtime_1.jsx)("path", { d: "M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z", fill: "#FBBC05" }), (0, jsx_runtime_1.jsx)("path", { d: "M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z", fill: "#EA4335" })] })), googleLoading ? 'Redirecting to Google…' : 'Continue with Google'] }) })), altAuthSlot && (0, jsx_runtime_1.jsx)("div", { className: "mt-4", children: altAuthSlot }), (0, jsx_runtime_1.jsx)("div", { className: `mt-6 text-center text-sm ${colors.muted}`, children: (0, jsx_runtime_1.jsx)("a", { href: "/account-auth/recovery", className: "themed-link hover:underline", children: "Start account recovery" }) })] }) }) })] }));
+      ` } }), (0, jsx_runtime_1.jsx)("div", { className: `min-h-screen flex items-center justify-center px-4 ${colors.background}`, children: (0, jsx_runtime_1.jsx)("div", { className: "max-w-md w-full", children: (0, jsx_runtime_1.jsxs)("div", { className: `rounded-2xl shadow-xl p-8 ${colors.card} ${colors.border} text-gray-800`, children: [(0, jsx_runtime_1.jsxs)("div", { className: "text-center mb-8", children: [(0, jsx_runtime_1.jsx)("h1", { className: "text-3xl font-bold mb-2", style: { color: 'inherit' }, children: branding.tagline || 'Welcome Back' }), (0, jsx_runtime_1.jsx)("p", { className: colors.muted, children: "Sign in to your account" })] }), shownError && ((0, jsx_runtime_1.jsx)("div", { role: "alert", "data-testid": "login-error", className: "mb-6 rounded-lg border border-red-200 bg-red-50 px-4 py-3 text-sm text-red-700", children: shownError })), googleEnabled && ((0, jsx_runtime_1.jsx)(jsx_runtime_1.Fragment, { children: (0, jsx_runtime_1.jsxs)("button", { type: "button", onClick: () => void handleGoogleSignIn(), disabled: googleLoading || isSubmitting, "data-testid": "google-sign-in", className: "w-full px-4 py-3 mb-6 rounded-lg border border-gray-300 font-semibold transition-colors flex items-center justify-center gap-2 disabled:opacity-50 disabled:cursor-not-allowed hover:bg-gray-50", style: { backgroundColor: 'white', color: '#1f2937' }, children: [googleLoading ? ((0, jsx_runtime_1.jsxs)("svg", { className: "animate-spin w-5 h-5", fill: "none", viewBox: "0 0 24 24", children: [(0, jsx_runtime_1.jsx)("circle", { className: "opacity-25", cx: "12", cy: "12", r: "10", stroke: "currentColor", strokeWidth: "4" }), (0, jsx_runtime_1.jsx)("path", { className: "opacity-75", fill: "currentColor", d: "M4 12a8 8 0 018-8v4a4 4 0 00-4 4H4z" })] })) : ((0, jsx_runtime_1.jsxs)("svg", { className: "w-5 h-5", viewBox: "0 0 24 24", fill: "currentColor", children: [(0, jsx_runtime_1.jsx)("path", { d: "M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z", fill: "#4285F4" }), (0, jsx_runtime_1.jsx)("path", { d: "M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z", fill: "#34A853" }), (0, jsx_runtime_1.jsx)("path", { d: "M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z", fill: "#FBBC05" }), (0, jsx_runtime_1.jsx)("path", { d: "M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z", fill: "#EA4335" })] })), googleLoading ? 'Redirecting to Google…' : 'Continue with Google'] }) })), altAuthSlot && (0, jsx_runtime_1.jsx)("div", { className: "mt-4", children: altAuthSlot }), (0, jsx_runtime_1.jsx)("div", { className: `mt-6 text-center text-sm ${colors.muted}`, children: (0, jsx_runtime_1.jsx)("a", { href: "/account-auth/recovery", className: "themed-link hover:underline", children: "Start account recovery" }) })] }) }) })] }));
 }
 function LoginPageFallback() {
     const colors = (0, useTheme_1.useColors)();

package/dist/routes/auth/credential-login-email-code.d.ts

@@ -0,0 +1,6 @@
+/**
+ * PAY-2302 cut 1: ask the IdP to email a code when the authenticator lane failed on our side.
+ * The handler lives in api-handlers/auth/credential-login-email-code.ts (moved from VibeID-Customer-Portal src/app/api/auth/admin-login/email-code/route.ts). A consuming app's route file
+ * re-exports POST and writes `export const runtime = 'nodejs'` literally.
+ */
+export { POST } from '../../api-handlers/auth/credential-login-email-code';

package/dist/routes/auth/credential-login-email-code.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = void 0;
+/**
+ * PAY-2302 cut 1: ask the IdP to email a code when the authenticator lane failed on our side.
+ * The handler lives in api-handlers/auth/credential-login-email-code.ts (moved from VibeID-Customer-Portal src/app/api/auth/admin-login/email-code/route.ts). A consuming app's route file
+ * re-exports POST and writes `export const runtime = 'nodejs'` literally.
+ */
+var credential_login_email_code_1 = require("../../api-handlers/auth/credential-login-email-code");
+Object.defineProperty(exports, "POST", { enumerable: true, get: function () { return credential_login_email_code_1.POST; } });

package/dist/routes/auth/credential-login.d.ts

@@ -0,0 +1,6 @@
+/**
+ * PAY-2302 cut 1: password sign-in route (IdP ExternalAuth/login, session written via lib/session-store, 2FA-outstanding handling).
+ * The handler lives in api-handlers/auth/credential-login.ts (moved from VibeID-Customer-Portal src/app/api/auth/admin-login/route.ts). A consuming app's route file
+ * re-exports POST and writes `export const runtime = 'nodejs'` literally.
+ */
+export { POST } from '../../api-handlers/auth/credential-login';

package/dist/routes/auth/credential-login.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = void 0;
+/**
+ * PAY-2302 cut 1: password sign-in route (IdP ExternalAuth/login, session written via lib/session-store, 2FA-outstanding handling).
+ * The handler lives in api-handlers/auth/credential-login.ts (moved from VibeID-Customer-Portal src/app/api/auth/admin-login/route.ts). A consuming app's route file
+ * re-exports POST and writes `export const runtime = 'nodejs'` literally.
+ */
+var credential_login_1 = require("../../api-handlers/auth/credential-login");
+Object.defineProperty(exports, "POST", { enumerable: true, get: function () { return credential_login_1.POST; } });

package/dist/routes/oauth/resume.d.ts

@@ -0,0 +1,11 @@
+/**
+ * PAY-2302 cut 2: post-2FA OAuth authorize resume route. The handler lives in api-handlers/oauth/resume.ts
+ * (moved from VibeID-Customer-Portal src/app/api/oauth/resume/route.ts). A consuming app's route file re-exports GET
+ * and writes `export const runtime = 'nodejs'` literally.
+ *
+ * 4.7.3: `createOAuthResumeHandler({ refusalLocation })` and `DEFAULT_REFUSAL_LOCATION` are re-exported HERE because a consumer can only
+ * import what `package.json` `exports` lists, and this route module is the entry. An app whose sign-in page is not
+ * /account-auth/login (the portal uses /sign-in) writes `export const GET = createOAuthResumeHandler({ refusalLocation: '/sign-in?error=AUTHORIZE_RESUME_REFUSED' });`.
+ */
+export { GET, createOAuthResumeHandler, DEFAULT_REFUSAL_LOCATION } from '../../api-handlers/oauth/resume';
+export type { OAuthResumeOptions, OAuthResumeDeps } from '../../api-handlers/oauth/resume';

package/dist/routes/oauth/resume.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_REFUSAL_LOCATION = exports.createOAuthResumeHandler = exports.GET = void 0;
+/**
+ * PAY-2302 cut 2: post-2FA OAuth authorize resume route. The handler lives in api-handlers/oauth/resume.ts
+ * (moved from VibeID-Customer-Portal src/app/api/oauth/resume/route.ts). A consuming app's route file re-exports GET
+ * and writes `export const runtime = 'nodejs'` literally.
+ *
+ * 4.7.3: `createOAuthResumeHandler({ refusalLocation })` and `DEFAULT_REFUSAL_LOCATION` are re-exported HERE because a consumer can only
+ * import what `package.json` `exports` lists, and this route module is the entry. An app whose sign-in page is not
+ * /account-auth/login (the portal uses /sign-in) writes `export const GET = createOAuthResumeHandler({ refusalLocation: '/sign-in?error=AUTHORIZE_RESUME_REFUSED' });`.
+ */
+var resume_1 = require("../../api-handlers/oauth/resume");
+Object.defineProperty(exports, "GET", { enumerable: true, get: function () { return resume_1.GET; } });
+Object.defineProperty(exports, "createOAuthResumeHandler", { enumerable: true, get: function () { return resume_1.createOAuthResumeHandler; } });
+Object.defineProperty(exports, "DEFAULT_REFUSAL_LOCATION", { enumerable: true, get: function () { return resume_1.DEFAULT_REFUSAL_LOCATION; } });

package/dist/types/auth.d.ts

@@ -21,6 +21,12 @@ export interface AuthConfig {
      * An OAuth-only client is a deliberate choice, never the default.
      */
     allowTraditionalLogin?: boolean;
+    /**
+     * PAY-2334: where /api/auth/settings stands. 'loading' = not answered yet, 'ready' = answered (or nothing to ask:
+     * useDynamicProviders off), 'failed' = non-2xx, thrown, or timed out. Absent means 'ready'. A page must not tell the user
+     * "sign-in is not available" while this is 'loading', and must say a failed read is a failed read, not an empty answer.
+     */
+    settingsStatus?: 'loading' | 'ready' | 'failed';
     providers: FederatedProvider[];
     enableRecovery: boolean;
     enableEmailSignup: boolean;