@payez/next-mvp 4.5.7 → 4.7.9

package/dist/auth/idp-oauth.js

@@ -0,0 +1,280 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CLOCK_TOLERANCE_SECONDS = void 0;
+exports.resolveIdpRedirectUri = resolveIdpRedirectUri;
+exports.amrIncludesMfa = amrIncludesMfa;
+exports.isAddressShaped = isAddressShaped;
+exports.resolveEmail = resolveEmail;
+exports.createIdpOAuthHooks = createIdpOAuthHooks;
+/**
+ * PAY-2305 (next-mvp 4.7.4): the two hooks that let better-auth's genericOAuth talk to THIS IdP.
+ *
+ * WHY THEY EXIST (source read, PayEz-Core master d53f192af, BAPert 74014):
+ *   - POST /api/oauth/token takes a JSON body (snake_case), not better-auth's default form body, and answers with the
+ *     Core response envelope { success, data: { access_token, refresh_token, token_type, expires_in, user } }.
+ *     better-auth's default exchange reads top-level fields and would find nothing.
+ *   - There is NO id_token and NO userinfo endpoint (deliberate, PAY-1585). The only proof of who signed in is the
+ *     access token itself: an RS-family bearer JWT (RS512 on dev-93's JWKS, measured) signed by the IdP bearer key (jwks_uri in discovery) with sub, email,
+ *     roles, amr, token_type.
+ *
+ * TRUST RULE: a claim is read ONLY from a token whose signature, issuer, expiry and token_type were verified here.
+ * Never base64-decode and believe. Only RSA signatures are accepted (the RS and PS families; the JWKS key's own declared alg is binding), so a token
+ * re-signed with HS256 using the public key as the secret, or alg none, is refused. The `aud` of an IdP bearer is the IdP's public constant, not this client, so it is not a
+ * binding; the binding to THIS client is the authorization code + PKCE verifier + exact redirect_uri that Core checks.
+ *
+ * The redirect_uri sent here MUST be byte-identical at the authorize step and the token step (Core compares it
+ * Ordinal at the token step) and equal to the registered {site_url}/api/auth/callback (Core compares it exactly,
+ * case-insensitively, at the authorize step). Both come from ONE value: the `redirectURI` of the provider config.
+ */
+const jose_1 = require("jose");
+const DISCOVERY_TTL_MS = 10 * 60 * 1000;
+const HTTP_TIMEOUT_MS = 10_000;
+/** The URI sent at authorize AND token time. Explicit env wins; else the registered {app}/api/auth/callback form. */
+function resolveIdpRedirectUri(appBaseUrl, env = process.env) {
+    const explicit = env.IDP_OAUTH_REDIRECT_URI?.trim();
+    if (explicit)
+        return explicit;
+    return appBaseUrl.replace(/\/+$/, '') + '/api/auth/callback';
+}
+/** amr arrives as an array, a JSON-array string, or a delimited string (Core's own reader accepts all three). */
+function amrIncludesMfa(amr) {
+    let values = [];
+    if (Array.isArray(amr))
+        values = amr;
+    else if (typeof amr === 'string') {
+        const t = amr.trim();
+        if (t.startsWith('[')) {
+            try {
+                const parsed = JSON.parse(t);
+                if (Array.isArray(parsed))
+                    values = parsed;
+            }
+            catch {
+                values = [];
+            }
+        }
+        else {
+            values = t.split(/[\s,]+/);
+        }
+    }
+    return values.some((v) => typeof v === 'string' && v.trim().toLowerCase() === 'mfa');
+}
+/** Max skew accepted on nbf/exp/iat when verifying the IdP access token. */
+exports.CLOCK_TOLERANCE_SECONDS = 30;
+/**
+ * Address shape, a POSITIVE character rule (PAY-2337, Scout 74285): the local part may contain only [A-Za-z0-9] and . _ % + - ' ; the domain only
+ * [A-Za-z0-9-] labels joined by dots; one @, <= 254 total, local <= 64, no leading/trailing/double dot in the local part, a dotted domain.
+ * Everything else is NOT an address, and in particular a MASK: Core masks data.user.email on purpose (MaskedEmailJsonConverter), today with '*',
+ * tomorrow maybe a bullet, an ellipsis or an 'x' run; a blacklist of one glyph would pass the next mask. Not a deliverability check.
+ */
+function isAddressShaped(v) {
+    if (typeof v !== 'string' || v.length === 0 || v.length > 254)
+        return false;
+    if (!/^[A-Za-z0-9._%+'-]+@[A-Za-z0-9.-]+$/.test(v))
+        return false;
+    const [local, domain] = v.split('@');
+    if (local.length > 64 || local.startsWith('.') || local.endsWith('.') || local.includes('..'))
+        return false;
+    return /^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)+$/.test(domain) && !domain.startsWith('-') && !domain.endsWith('-');
+}
+/**
+ * The account address (BAPert 74193 / 74196, 4.7.8). Core's code-flow access token has NO email claim; its sub and ws-identity name claim are
+ * both user.UserName, which is a LOGIN, not the mailbox: it may be address-shaped and still differ from the account's Email (4.7.7 vetoed on that
+ * and refused every such sign-in, NightHawk 74189). Sources: the token RESPONSE's data.user.email (token endpoint, TLS) and/or the signed token's
+ * own email claim; if both are present they must be equal. sub / the name claim are NEITHER a source NOR a veto. Not trimmed. Returns '' on any doubt.
+ */
+function resolveEmail(payload, responseEmail) {
+    // NOT trimmed: padding or a trailing newline is a malformed address (refused by the shape check), never silently repaired.
+    const raw = (v) => (typeof v === 'string' ? v : '');
+    const sources = [raw(payload.email), raw(responseEmail)].filter((v) => v.trim() !== '');
+    if (sources.length === 0 || !sources.every(isAddressShaped))
+        return '';
+    const chosen = sources[0];
+    const same = (a) => a.toLowerCase() === chosen.toLowerCase();
+    if (!sources.every(same))
+        return '';
+    return chosen;
+}
+function rolesOf(claim) {
+    if (Array.isArray(claim))
+        return claim.filter((r) => typeof r === 'string' && r.length > 0);
+    if (typeof claim === 'string' && claim.trim()) {
+        const t = claim.trim();
+        if (t.startsWith('[')) {
+            try {
+                const parsed = JSON.parse(t);
+                if (Array.isArray(parsed))
+                    return parsed.filter((r) => typeof r === 'string' && r.length > 0);
+            }
+            catch {
+                return [];
+            }
+        }
+        return t.split(/[\s,]+/).filter(Boolean);
+    }
+    return [];
+}
+function createIdpOAuthHooks(opts) {
+    const fetchFn = opts.deps?.fetch ?? fetch;
+    const now = opts.deps?.now ?? (() => Date.now());
+    const getKeySet = opts.deps?.getKeySet ?? ((uri) => (0, jose_1.createRemoteJWKSet)(new URL(uri)));
+    let discovery = null;
+    const keySets = new Map();
+    /** access token -> data.user.email / user_name from the token response, consumed by getUserInfo for THAT token (bounded; never keyed by anything shared). */
+    const responseUsers = new Map();
+    async function loadDiscovery() {
+        if (discovery && now() - discovery.at < DISCOVERY_TTL_MS)
+            return discovery.doc;
+        const res = await fetchFn(opts.discoveryUrl, {
+            headers: { Accept: 'application/json' },
+            redirect: 'error',
+            signal: AbortSignal.timeout(HTTP_TIMEOUT_MS),
+        });
+        if (!res.ok)
+            throw new Error(`IdP discovery returned ${res.status}`);
+        const doc = (await res.json());
+        if (typeof doc?.token_endpoint !== 'string' || typeof doc?.jwks_uri !== 'string' || typeof doc?.issuer !== 'string') {
+            throw new Error('IdP discovery document is missing token_endpoint, jwks_uri or issuer');
+        }
+        const allowed = new Set([new URL(opts.discoveryUrl).origin, ...(opts.trustedOrigins ?? []).map((o) => o.replace(/\/+$/, ''))]);
+        for (const field of ['token_endpoint', 'jwks_uri']) {
+            const origin = new URL(doc[field]).origin;
+            if (!allowed.has(origin))
+                throw new Error(`IdP discovery ${field} points at an untrusted origin (${origin})`);
+        }
+        discovery = { doc, at: now() }; // only a good document is cached
+        return doc;
+    }
+    /** better-auth `getToken`: JSON body, envelope unwrapped, no data.access_token => refused. */
+    async function getToken(data) {
+        const doc = await loadDiscovery();
+        if (!data.codeVerifier)
+            throw new Error('IdP token exchange refused: no PKCE code_verifier');
+        const res = await fetchFn(doc.token_endpoint, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+            redirect: 'error',
+            signal: AbortSignal.timeout(HTTP_TIMEOUT_MS),
+            body: JSON.stringify({
+                grant_type: 'authorization_code',
+                code: data.code,
+                code_verifier: data.codeVerifier,
+                // Deliberately NOT data.redirectURI: that is better-auth's own computed callback, not the registered URI.
+                redirect_uri: opts.redirectURI,
+                client_id: opts.clientId,
+            }),
+        });
+        let body;
+        try {
+            body = await res.json();
+        }
+        catch {
+            throw new Error(`IdP token response (${res.status}) was not JSON`);
+        }
+        if (!res.ok) {
+            const code = body?.error?.code ?? body?.error ?? body?.code ?? 'unknown';
+            throw new Error(`IdP token exchange refused (${res.status}, ${typeof code === 'string' ? code : 'unknown'})`);
+        }
+        const d = body?.data;
+        if (!d || typeof d.access_token !== 'string' || !d.access_token) {
+            throw new Error('IdP token response has no data.access_token (envelope not as expected)');
+        }
+        const expiresIn = typeof d.expires_in === 'number' && d.expires_in > 0 ? d.expires_in : undefined;
+        const expires = expiresIn ? now() + expiresIn * 1000 : undefined;
+        if (d.user && typeof d.user === 'object' && typeof d.user.email === 'string') {
+            if (responseUsers.size >= 64)
+                responseUsers.delete(responseUsers.keys().next().value);
+            responseUsers.set(d.access_token, { email: d.user.email, userName: typeof d.user.user_name === 'string' ? d.user.user_name : '' });
+        }
+        opts.onTokens?.({
+            accessToken: d.access_token,
+            refreshToken: typeof d.refresh_token === 'string' ? d.refresh_token : undefined,
+            accessTokenExpires: expires,
+            tokenType: typeof d.token_type === 'string' ? d.token_type : undefined,
+            user: d.user && typeof d.user === 'object' ? d.user : undefined,
+        });
+        return {
+            tokenType: typeof d.token_type === 'string' ? d.token_type : 'Bearer',
+            accessToken: d.access_token,
+            refreshToken: typeof d.refresh_token === 'string' ? d.refresh_token : undefined,
+            accessTokenExpiresAt: expires ? new Date(expires) : undefined,
+            scopes: [],
+        };
+    }
+    /** better-auth `getUserInfo`: the user comes from the VERIFIED access token. Returns null (never a guess) on any doubt. */
+    async function getUserInfo(tokens) {
+        try {
+            if (!tokens?.accessToken)
+                return null;
+            const doc = await loadDiscovery();
+            // A token without a kid is refused: no "first key" fallback. (A kid that is not in the key set is refused by jose.)
+            const kid = (0, jose_1.decodeProtectedHeader)(tokens.accessToken).kid;
+            if (typeof kid !== 'string' || !kid)
+                throw new Error('token header has no kid');
+            const jwksUri = doc.jwks_uri;
+            let keys = keySets.get(jwksUri);
+            if (!keys) {
+                keys = getKeySet(jwksUri);
+                keySets.set(jwksUri, keys);
+            }
+            const { payload } = await (0, jose_1.jwtVerify)(tokens.accessToken, keys, {
+                // RSA signatures ONLY (RS256/384/512, PS256/384/512; BAPert 74117): never HS* (a token "signed" with the public key as an HMAC
+                // secret), never none, never ES. 4.7.4/4.7.5 pinned RS256 from a source read; the live IdP's JWKS (dev-93, kid 46) declares alg RS512
+                // and every real access token was refused (NightHawk 74114). Which RS alg is binding is the JWKS KEY's own declared
+                // `alg`: jose only offers a JWK to a token whose header alg equals that JWK's `alg`, so a token cannot choose a
+                // weaker/other algorithm than the published key says. A JWK with no `alg` accepts any listed RSA alg; a symmetric (oct) key is never usable for these algorithms.
+                algorithms: ['RS256', 'RS384', 'RS512', 'PS256', 'PS384', 'PS512'],
+                issuer: opts.issuer ?? doc.issuer,
+                currentDate: new Date(now()),
+                // The IdP stamps nbf = issue time with no skew and the token is verified in the same second it is minted (NightHawk 74151:
+                // "nbf claim timestamp check failed"). 30 s, bounded. jose applies it to exp too: a token is accepted up to 30 s after exp.
+                clockTolerance: exports.CLOCK_TOLERANCE_SECONDS,
+            });
+            if (payload.token_type !== 'bearer_token')
+                throw new Error('token_type is not bearer_token');
+            if (typeof payload.sub !== 'string' || !payload.sub)
+                throw new Error('no sub');
+            const hasEmailClaim = typeof payload.email === 'string' && payload.email.trim() !== '';
+            const responseUser = responseUsers.get(tokens.accessToken);
+            responseUsers.delete(tokens.accessToken);
+            // The response user object (UNSIGNED body) must be the TOKEN's user (Scout 74198, DotNetPert-Scout 74202): Core fills data.user.user_name and the
+            // signed sub from the same loaded user in one mint, so WHENEVER a response user exists (even if a signed email claim is also present), user_name MUST be present
+            // and equal sub (case-insensitive). A different or missing user_name means the address may belong to someone else -> refuse. Does not constrain email == sub.
+            if (responseUser && responseUser.userName.trim().toLowerCase() !== payload.sub.trim().toLowerCase()) {
+                throw new Error('token response user is missing or does not match the token subject');
+            }
+            // A MASKED / unusable response address is ABSENT (PAY-2337), not "a different address": a valid signed claim still signs in, and with no claim
+            // there is no source. NEVER repaired or unmasked (no prefix match against sub or the claim). Log names only the fact, no value, no length.
+            const responseEmailRaw = responseUser?.email ?? '';
+            const responseEmailUsable = isAddressShaped(responseEmailRaw);
+            const responseMasked = responseEmailRaw.trim() !== '' && !responseEmailUsable;
+            if (responseMasked)
+                console.warn('[BETTER_AUTH] payez-idp token response address is masked or unusable; ignored');
+            const email = resolveEmail(payload, responseEmailUsable ? responseEmailRaw : undefined);
+            if (!email) {
+                throw new Error(responseMasked ? 'response address is masked' : 'no usable email (needs data.user.email or an email claim, address-shaped, equal when both are present)');
+            }
+            const name = (typeof payload.name === 'string' && payload.name.trim()) ||
+                (typeof payload.full_name === 'string' && payload.full_name.trim()) ||
+                email.split('@')[0];
+            const claims = {
+                sub: payload.sub,
+                email,
+                name,
+                userId: typeof payload.user_id === 'string' || typeof payload.user_id === 'number' ? String(payload.user_id) : undefined,
+                roles: rolesOf(payload.roles),
+                mfaVerified: amrIncludesMfa(payload.amr),
+                // Only the signed token's own email CLAIM can be verified; an address that came from the token response (data.user.email) never asserts it.
+                emailVerified: hasEmailClaim && (payload.email_verified === true || payload.email_verified === 'true'),
+            };
+            opts.onClaims?.(claims);
+            return { id: claims.sub, email: claims.email, name: claims.name, emailVerified: claims.emailVerified };
+        }
+        catch (err) {
+            // Reason only, never the token.
+            console.warn('[BETTER_AUTH] payez-idp access token refused:', err instanceof Error ? err.message : String(err));
+            return null;
+        }
+    }
+    return { getToken, getUserInfo };
+}

package/dist/auth/safe-callback.js

@@ -68,6 +68,14 @@ exports.resolveCallbackDestination = resolveCallbackDestination;
 exports.DEFAULT_CALLBACK = '/';
 /** The auth surface. A callback pointing back into it causes a redirect cycle. */
 const AUTH_PREFIX = '/account-auth/';
+/**
+ * PAY-2315 (4.7.1): the middleware now treats the public /login page like /account-auth/login (a signed-in user is sent
+ * on), so a callback or a resolved path that is /login itself must be refused here too - otherwise /login with no
+ * callbackUrl would resolve its own pathname as the destination and redirect to itself forever.
+ */
+function isAuthSurface(pathname) {
+    return pathname.startsWith(AUTH_PREFIX) || pathname === '/login' || pathname.startsWith('/login/');
+}
 /**
  * Synthetic, unreachable base. Only ever used as the resolution origin for the
  * comparison below - never emitted, never navigated to. `.invalid` is reserved
@@ -95,7 +103,7 @@ function safeCallbackPath(raw, fallback = exports.DEFAULT_CALLBACK) {
     if (url.origin !== BASE)
         return fallback;
     // Loopbacks into the auth surface cause redirect cycles.
-    if (url.pathname.startsWith(AUTH_PREFIX))
+    if (isAuthSurface(url.pathname))
         return fallback;
     // PAY-2218: `_rsc` is Next's flight cache-buster. Once skipProxyUrlNormalize lets it reach middleware it leaks
     // into return targets (`callbackUrl=/overview?_rsc=abc12`, NightHawk 72013); it is never a meaningful part of a
@@ -143,7 +151,7 @@ function safeCallbackPath(raw, fallback = exports.DEFAULT_CALLBACK) {
     }
     if (echo.origin !== BASE)
         return fallback;
-    if (echo.pathname.startsWith(AUTH_PREFIX))
+    if (isAuthSurface(echo.pathname))
         return fallback;
     if (echo.pathname + echo.search + echo.hash !== candidate)
         return fallback;

package/dist/components/auth/CredentialSignInForm.d.ts

@@ -0,0 +1,33 @@
+import { type FetchLike } from '../../lib/credential-sign-in-client';
+/**
+ * PAY-2302 cut 1b: the package's email + password (+ 2FA code) sign-in form.
+ *
+ * WHY IT EXISTS. The package's own Better Auth instance has no emailAndPassword, so the login page had no credential form
+ * (removed 2026-08-02, BAPert 17586: "restore this form together" with the backend that makes it work). This is that pair:
+ * the backend is routes/auth/credential-login (+ credential-login-email-code), which the app mounts at
+ * /api/auth/admin-login[/email-code]; this component drives it. Moved from the portal's AdminLoginCard (VibeID-Customer-Portal
+ * 3d654917), re-styled with the package's own TraditionalAuthSection instead of the portal's AuthCard chrome.
+ *
+ * MOUNT IT through the login page's slot, so nothing changes for a consumer that does not opt in:
+ *     <LoginPage altAuthSlot={<CredentialSignInForm />} />
+ * (An app that has not mounted the two routes must NOT mount this form: it would be the dead control 17586 removed.)
+ *
+ * Two steps, the IdP's own contract (an access token with no refresh token means a second factor is outstanding):
+ *   'credentials' - email + password
+ *   'code'        - the 2FA code; the door parks the provisional bearer in an httpOnly cookie, this step resubmits with the code.
+ *
+ * After success the browser goes to the callbackUrl, passed through safeCallbackPath (same-origin paths only); when the page
+ * carries ?return_url (an IdP authorize request) it goes to the app's /api/oauth/resume instead, which resumes that request.
+ */
+interface Props {
+    /** Where to go after sign-in. Default: the page's ?callbackUrl, else /dashboard. Always passed through safeCallbackPath. */
+    callbackUrl?: string;
+    /** Test seam: the fetch used for both doors. */
+    fetchImpl?: FetchLike;
+    /** Test seam: navigation after success. */
+    onSignedIn?: (destination: string) => void;
+    showForgotPassword?: boolean;
+}
+export declare function resolveDestination(explicit?: string): string;
+export declare function CredentialSignInForm({ callbackUrl, fetchImpl, onSignedIn, showForgotPassword }: Props): import("react/jsx-runtime").JSX.Element;
+export default CredentialSignInForm;

package/dist/components/auth/CredentialSignInForm.js

@@ -0,0 +1,134 @@
+"use strict";
+'use client';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveDestination = resolveDestination;
+exports.CredentialSignInForm = CredentialSignInForm;
+const jsx_runtime_1 = require("react/jsx-runtime");
+const react_1 = require("react");
+const TraditionalAuthSection_1 = require("./TraditionalAuthSection");
+const safe_callback_1 = require("../../auth/safe-callback");
+const authorize_resume_1 = require("../../lib/authorize-resume");
+const code_step_copy_1 = require("../../lib/code-step-copy");
+const credential_sign_in_client_1 = require("../../lib/credential-sign-in-client");
+const inputStyle = {
+    borderColor: 'var(--border-default, #e5e7eb)',
+    color: 'var(--text-primary, #111827)',
+    background: 'var(--bg-input, white)',
+};
+function resolveDestination(explicit) {
+    let raw = explicit;
+    let returnUrl = null;
+    if (typeof window !== 'undefined') {
+        const params = new URLSearchParams(window.location.search);
+        if (raw === undefined)
+            raw = params.get('callbackUrl') ?? undefined;
+        // PAY-2302 cut 2: an IdP that sent the user here mid-authorize (?return_url=<IdP authorize request>) must get the
+        // authorize request resumed after sign-in. The href points at the app's OWN /api/oauth/resume, which validates the
+        // URL against IDP_URL server-side; nothing absolute is navigated to from here, and the result is still guarded.
+        returnUrl = params.get('return_url');
+    }
+    return (0, safe_callback_1.safeCallbackPath)((0, authorize_resume_1.authorizeResumeHref)(returnUrl), (0, safe_callback_1.safeCallbackPath)(raw, '/dashboard'));
+}
+function CredentialSignInForm({ callbackUrl, fetchImpl, onSignedIn, showForgotPassword = false }) {
+    const [step, setStep] = (0, react_1.useState)('credentials');
+    const [email, setEmail] = (0, react_1.useState)('');
+    const [password, setPassword] = (0, react_1.useState)('');
+    const [code, setCode] = (0, react_1.useState)('');
+    const [busy, setBusy] = (0, react_1.useState)(false);
+    const [error, setError] = (0, react_1.useState)(null);
+    const [fieldError, setFieldError] = (0, react_1.useState)(null);
+    const [codeRequest, setCodeRequest] = (0, react_1.useState)(code_step_copy_1.NO_CODE_REQUEST);
+    const [offerEmailCode, setOfferEmailCode] = (0, react_1.useState)(false);
+    const [emailCodeMsg, setEmailCodeMsg] = (0, react_1.useState)(null);
+    async function submit(withCode) {
+        setBusy(true);
+        setError(null);
+        setOfferEmailCode(false);
+        try {
+            const r = await (0, credential_sign_in_client_1.credentialSignIn)({ email, password, code: withCode }, fetchImpl);
+            if (r.kind === 'success') {
+                const destination = resolveDestination(callbackUrl);
+                if (onSignedIn)
+                    onSignedIn(destination);
+                else
+                    window.location.href = destination;
+                return;
+            }
+            if (r.kind === 'two_factor') {
+                setCodeRequest(r.codeRequest);
+                setStep('code');
+                return;
+            }
+            setError(r.message);
+            if (r.kind === 'error')
+                setOfferEmailCode(r.offerEmailCode);
+        }
+        finally {
+            setBusy(false);
+        }
+    }
+    function onCredentialsSubmit(e) {
+        e.preventDefault();
+        const invalid = (0, credential_sign_in_client_1.validateCredentials)(email, password);
+        if (invalid) {
+            setFieldError(invalid.email ?? invalid.password ?? null);
+            return;
+        }
+        setFieldError(null);
+        void submit();
+    }
+    function onCodeSubmit(e) {
+        e.preventDefault();
+        const trimmed = code.trim();
+        if (!trimmed) {
+            setFieldError('Enter your authentication code.');
+            return;
+        }
+        setFieldError(null);
+        void submit(trimmed);
+    }
+    function onBack() {
+        setStep('credentials');
+        setCodeRequest(code_step_copy_1.NO_CODE_REQUEST);
+        setCode('');
+        setFieldError(null);
+        setError(null);
+        setOfferEmailCode(false);
+        setEmailCodeMsg(null);
+    }
+    async function askForEmailCode() {
+        setBusy(true);
+        setEmailCodeMsg(null);
+        try {
+            const r = await (0, credential_sign_in_client_1.requestEmailCode)(fetchImpl);
+            if (r.kind === 'requested') {
+                setCodeRequest(r.codeRequest);
+                setError(null);
+                setOfferEmailCode(false);
+                setEmailCodeMsg('We asked for a code to be emailed to you. Enter it above when it arrives.');
+            }
+            else {
+                setEmailCodeMsg(r.message);
+            }
+        }
+        finally {
+            setBusy(false);
+        }
+    }
+    const problem = fieldError ?? error;
+    const problemLine = problem && ((0, jsx_runtime_1.jsx)("p", { role: "alert", "data-testid": "credential-sign-in-error", className: "text-sm mt-3", style: { color: 'var(--color-error, #ef4444)' }, children: problem }));
+    if (step === 'code') {
+        return ((0, jsx_runtime_1.jsxs)("div", { "data-testid": "credential-sign-in-code-step", className: "text-left", children: [(0, jsx_runtime_1.jsx)("p", { className: "text-sm mb-4", style: { color: 'var(--text-primary, #111827)' }, children: (0, code_step_copy_1.codeStepInstruction)(email, codeRequest) }), (0, jsx_runtime_1.jsxs)("form", { onSubmit: onCodeSubmit, noValidate: true, className: "space-y-4", children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("label", { htmlFor: "credential-code", className: "block text-sm font-medium mb-2", style: { color: 'var(--text-primary, #111827)' }, children: "Authentication code" }), (0, jsx_runtime_1.jsx)("input", { id: "credential-code", name: "code", type: "text", inputMode: "numeric", autoComplete: "one-time-code", required: true, placeholder: "000000", value: code, disabled: busy, onChange: (e) => {
+                                        setCode(e.target.value);
+                                        setFieldError(null);
+                                    }, className: "w-full px-4 py-3 rounded-lg border transition-colors focus:outline-none focus:ring-2 disabled:opacity-50", style: inputStyle })] }), (0, jsx_runtime_1.jsx)("button", { type: "submit", disabled: busy, className: "w-full py-3 px-4 rounded-lg font-semibold focus:outline-none focus:ring-2 disabled:opacity-50 disabled:cursor-not-allowed transition-colors", style: { background: 'var(--btn-primary-bg, #11B588)', color: 'var(--btn-primary-text, white)' }, children: busy ? 'Verifying…' : 'Verify' })] }), (0, jsx_runtime_1.jsx)("button", { type: "button", onClick: onBack, disabled: busy, className: "text-sm underline mt-4", style: { background: 'none', border: 'none', padding: 0, color: 'var(--text-muted, #6b7280)' }, children: "Back" }), problemLine, (offerEmailCode || emailCodeMsg) && ((0, jsx_runtime_1.jsxs)("div", { "data-testid": "email-code-offer", className: "mt-4", children: [offerEmailCode && ((0, jsx_runtime_1.jsx)("button", { type: "button", onClick: () => void askForEmailCode(), disabled: busy, className: "text-sm font-semibold underline", style: { background: 'none', border: 'none', padding: 0, color: 'var(--text-primary, #111827)' }, children: "Email me a code instead" })), emailCodeMsg && ((0, jsx_runtime_1.jsx)("p", { role: "status", "data-testid": "email-code-offer-msg", className: "text-sm mt-2", style: { color: 'var(--text-primary, #111827)' }, children: emailCodeMsg }))] }))] }));
+    }
+    return ((0, jsx_runtime_1.jsxs)("div", { "data-testid": "credential-sign-in", className: "text-left", children: [(0, jsx_runtime_1.jsx)(TraditionalAuthSection_1.TraditionalAuthSection, { email: email, password: password, onEmailChange: (v) => {
+                    setEmail(v);
+                    setFieldError(null);
+                }, onPasswordChange: (v) => {
+                    setPassword(v);
+                    setFieldError(null);
+                }, onSubmit: onCredentialsSubmit, isLoading: busy, buttonText: "Sign in", showForgotPassword: showForgotPassword }), problemLine] }));
+}
+exports.default = CredentialSignInForm;

package/dist/lib/authorize-resume.d.ts

@@ -0,0 +1,87 @@
+/**
+ * PAY-2302 cut 2: moved VERBATIM (logic unchanged) from VibeID-Customer-Portal src/lib/auth/authorize-resume.ts.
+ * PAY-1500 (portal half of PAY-1479): resume the IdP OAuth authorize request after 2FA.
+ *
+ * The IdP sends an OAuth principal who still owes 2FA to the portal's /account-auth/verify-code with
+ *   ?next_step=enroll_mfa|mfa_verify&callbackUrl=<absolute IdP authorize URL>&return_url=<same>
+ * (OAuthController.Authorize; hotfix-2 66ca7a8eb routes BOTH cases to verify-code, /account/security is gone). safeCallbackPath rightly refuses that absolute URL,
+ * so after 2FA the user used to land on the default page and sign-in never finished.
+ *
+ * This is NOT a relaxation of safeCallbackPath. The browser is sent to the portal's own
+ * /api/oauth/resume, which checks return_url SERVER-SIDE against IDP_URL (origin + the authorize path)
+ * and only then redirects. Anything else is refused. IDP_URL never reaches the client.
+ */
+export declare const AUTHORIZE_RESUME_ROUTE = "/api/oauth/resume";
+/** True only for `<IDP_URL origin>/api/oauth/authorize` (path case-insensitive, as ASP.NET routes). */
+export declare function isIdpAuthorizeUrl(candidate: string | null | undefined, idpBaseUrl: string): boolean;
+/**
+ * Server side: the redirect target, REBUILT from trusted parts - IDP_URL's origin and the authorize path
+ * are ours; only the query string comes from the request. Null unless isIdpAuthorizeUrl holds.
+ */
+export declare function idpAuthorizeRedirect(candidate: string | null | undefined, idpBaseUrl: string): string | null;
+/**
+ * Client side: the SAME-ORIGIN portal path that resumes authorize, or null when the IdP did not ask for one.
+ * Callers still pass the result through safeCallbackPath before navigating.
+ *
+ * WHY THE ASTERISK IS RE-ENCODED (PAY-1547, measured by NextPert 59939, completeness measured here).
+ * One consumer of this value is `authClient.signIn.social({ callbackURL })`, which POSTs to better-auth
+ * and is validated by its own originCheckMiddleware BEFORE anything redirects. For a relative path that
+ * check is decided entirely by one regex (better-auth 1.5.6, auth/trusted-origins.mjs:16 - the
+ * `allowRelativePaths` branch, and api/middlewares/origin-check.mjs:51 passes
+ * `allowRelativePaths: label !== 'origin'`, so it IS that branch for a callbackURL):
+ *
+ *     /^\/(?!\/|\\|%2f|%5c)[\w\-.\+\/@]*(?:\?[\w\-.\+\/=&%@]*)?$/
+ *
+ * A character this helper emits RAW and that charset rejects is a hard 403 INVALID_CALLBACK_URL on the
+ * Google button - not a silent fallback. Measured exhaustively over printable ASCII by diffing what
+ * `URLSearchParams` leaves raw against that charset: the raw set is alphanumerics plus `* - . _`, and
+ * *** `*` IS THE ONLY REJECTED MEMBER *** (`%` is permitted, which is why every other special character
+ * survives - URLSearchParams already percent-encoded it).
+ *
+ * `*` is reachable because `state` and `scope` are chosen by the OAuth CLIENT, not by us, so we cannot
+ * decline to emit it. `%2A` is the same character to every parser: re-reading this query string returns
+ * the byte-identical `return_url` (asserted in test/authorize-resume.test.cjs), so this is an encoding
+ * change and NOT a value change. It is applied here, at the ONE computation, rather than at the sinks -
+ * the two `window.location.href` sinks are browser navigations that touch no library and for which this
+ * is a behavioural no-op, so there is no reason to make them each carry it.
+ */
+export declare function authorizeResumeHref(returnUrl: string | null | undefined): string | null;
+export interface ServerAuthorizeParams {
+    idpBaseUrl: string;
+    /** This app's IdP client slug (CLIENT_ID). The request's client_id must equal it. */
+    clientId: string;
+    /** The app's REGISTERED redirect_uri, e.g. http://localhost:3000/api/auth/callback. The request's redirect_uri must equal it exactly. */
+    redirectUri: string;
+}
+export interface ServerAuthorizeRequest {
+    /** Built from constants + validated pieces only. This is what gets fetched. */
+    url: string;
+    state: string;
+}
+/**
+ * Build the authorize URL to call, or null (refuse). Origin, path, response_type, client_id and redirect_uri are OURS; from
+ * return_url only code_challenge (+ method, S256 only), state and scope are taken, each charset/length validated. A return_url for
+ * another client or another redirect_uri is refused (no "someone else's client"). Unknown extra parameters are NOT forwarded.
+ */
+export declare function buildServerAuthorizeRequest(returnUrl: string | null | undefined, p: ServerAuthorizeParams): ServerAuthorizeRequest | null;
+/**
+ * The IdP's answer to the server-side authorize call. Returns the RELATIVE path+query to send the browser to, or null (refuse).
+ * Only a redirect whose Location is EXACTLY the registered redirect_uri (origin + path), with a code and the state we sent and no
+ * error, qualifies. The relayed value is REBUILT from the validated code and state, never copied from the Location.
+ */
+export declare function relayRegisteredCallback(status: number, location: string | null | undefined, redirectUri: string, sentState: string): string | null;
+/**
+ * The resume must be a same-site navigation. Sec-Fetch-Site decides when the browser sends it; otherwise Referer must be this
+ * app's own origin; with neither it is refused (a crafted cross-site link must not make the victim's browser trigger authorize
+ * with the victim's token).
+ */
+export declare function isSameSiteResume(headers: {
+    get(name: string): string | null;
+}, appOrigin: string): boolean;
+/**
+ * Binds the resume to a browser that STARTED this app's OAuth flow: better-auth (storeStateStrategy 'cookie') sets an
+ * `oauth_state` cookie (Max-Age 600; name may carry a `__Secure-` and an app prefix) when sign-in begins. Its value is sealed, so only
+ * its presence is checked; the state MATCH is enforced by better-auth's callback, which fails closed. A crafted link opened in a
+ * browser that never began the flow has no such cookie and is refused here, before the user's token is used.
+ */
+export declare function hasOAuthStateCookie(cookieHeader: string | null | undefined): boolean;