@payez/next-mvp 4.5.7 → 4.7.9

package/src/api-handlers/auth/credential-login-email-code.ts

@@ -0,0 +1,92 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { getIDPClientConfig } from '../../lib/idp-client-config';
+import { resolveClientKey } from '../../lib/client-key';
+import { bearerFetch } from '../../lib/bearer-fetch';
+
+// `export const runtime = 'nodejs'` must be written LITERALLY in the app's route file (Next ignores a re-exported segment config).
+
+/** One email-code request per this many seconds per browser (the IdP rate-limits too; this stops a double click and a loop). */
+const EMAIL_CODE_COOLDOWN_S = 30;
+
+/**
+ * POST /api/auth/admin-login/email-code - PAY-2284: "email me a code instead".
+ *
+ * WHY THIS EXISTS. The sign-in door sends NO code at all to a user who holds an authenticator ("TOTP wins when present: there is
+ * nothing to send"). When that authenticator's secret cannot be decrypted on our side (dev-93, encryption key version 57 gone), the
+ * verify step answers "a problem on our side ... use another sign-in method" - and there was no other method on the screen and no
+ * code in the user's mailbox, because none had been requested. This route is the missing action: it asks the IdP to EMAIL a code,
+ * using the provisional bearer the door already parked in the httpOnly `adm2fa` cookie. The verify turn already tries
+ * twofa/email/verify after twofa/totp/verify, so the code is accepted in the same box.
+ *
+ * What it takes from the browser: NOTHING. No body, no client id, no address - the code goes to the account the provisional bearer
+ * belongs to (the IdP decides the recipient). What it answers: { success, codeRequested, sentVia:'email', devVerificationCode? }.
+ * `codeRequested` means "we asked", never "a mail arrived" (twofa/email/send returns 200 even when the SMTP send threw, 267561).
+ */
+export async function POST(req: NextRequest) {
+  const provisional = req.cookies.get('adm2fa')?.value;
+  if (!provisional) {
+    return NextResponse.json({ success: false, error: 'Your verification window expired. Sign in again.' }, { status: 401 });
+  }
+
+  const last = Number(req.cookies.get('adm2fa_emailreq')?.value);
+  const now = Math.floor(Date.now() / 1000);
+  if (Number.isFinite(last) && last > 0 && now - last < EMAIL_CODE_COOLDOWN_S) {
+    const wait = EMAIL_CODE_COOLDOWN_S - (now - last);
+    return NextResponse.json(
+      { success: false, error: `We just asked for a code. Give it a moment (about ${wait} seconds) before asking again.`, retryAfter: wait },
+      { status: 429 },
+    );
+  }
+
+  let clientKey = '';
+  try {
+    const config = await getIDPClientConfig();
+    clientKey = resolveClientKey(config, 'graft/admin-login/email-code').key ?? '';
+  } catch (err) {
+    console.error('[ADMIN_LOGIN_EMAIL_CODE] IDP client config unavailable:', err instanceof Error ? err.message : String(err));
+    return NextResponse.json(
+      { success: false, error: 'Sign-in is temporarily unavailable. This is a problem on our side. Please try again shortly.' },
+      { status: 503 },
+    );
+  }
+
+  let sendOk = false;
+  let devCode: string | undefined;
+  try {
+    const sendResp = await bearerFetch(`${process.env.IDP_URL}/api/ExternalAuth/twofa/email/send`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Accept: 'application/json',
+        Authorization: `Bearer ${provisional}`,
+        'X-Client-Id': clientKey,
+      },
+      body: JSON.stringify({ client_id: clientKey }),
+    });
+    sendOk = sendResp.ok;
+    const text = await sendResp.text().catch(() => '');
+    if (!sendOk) console.error('[ADMIN_LOGIN_EMAIL_CODE] twofa/email/send failed', sendResp.status, text.slice(0, 200));
+    try {
+      const j = JSON.parse(text) as { dev_verification_code?: unknown; data?: { dev_verification_code?: unknown; result?: { dev_verification_code?: unknown } }; result?: { dev_verification_code?: unknown } } | null;
+      const echoed = j?.dev_verification_code ?? j?.data?.dev_verification_code ?? j?.data?.result?.dev_verification_code ?? j?.result?.dev_verification_code;
+      if (typeof echoed === 'string' && echoed) devCode = echoed; // present only when the server chose to echo (dev rigs); absence is the contract
+    } catch {
+      /* not JSON - nothing to echo */
+    }
+  } catch (err) {
+    console.error('[ADMIN_LOGIN_EMAIL_CODE] twofa/email/send fetch failed:', err instanceof Error ? err.message : String(err));
+  }
+
+  if (!sendOk) {
+    return NextResponse.json({ success: false, error: 'We could not ask for an email code just now - this is a problem on our side. Try again shortly.' }, { status: 502 });
+  }
+
+  const res = NextResponse.json(
+    { success: true, codeRequested: true, sentVia: 'email', ...(devCode ? { devVerificationCode: devCode } : {}) },
+    { status: 200 },
+  );
+  const cookie = { httpOnly: true, secure: process.env.NODE_ENV === 'production', sameSite: 'lax' as const, path: '/', maxAge: 600 };
+  res.cookies.set('adm2fa_lane', 'email', cookie); // the verify turn then tries totp -> email, exactly as for any non-SMS user
+  res.cookies.set('adm2fa_emailreq', String(now), { ...cookie, maxAge: EMAIL_CODE_COOLDOWN_S });
+  return res;
+}