@payez/next-mvp 4.7.9 → 4.8.0

package/dist/routes/auth/viability.js

@@ -16,6 +16,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GET = GET;
+const revocation_fields_1 = require("../../auth/revocation-fields");
 const server_1 = require("next/server");
 const auth_1 = require("../../server/auth");
 const session_store_1 = require("../../lib/session-store");
@@ -150,6 +151,7 @@ async function GET(req) {
                 needsRefresh: false,
                 authenticated: false,
                 revocationStatus: 'unknown',
+                unavailable: true, // PAY-2339: a reader of this JSON gets the hold signal (the response is non-OK, so the middleware holds as service_error)
                 error: 'Session store unavailable',
                 code: 'STORE_UNAVAILABLE'
             }, { status: 500 });
@@ -361,8 +363,7 @@ async function GET(req) {
                 // Session revocation (PAY-1882 step 4): the four-state status, plus the
                 // boolean the middleware's existing force-invalid branch already reads.
                 revocationStatus,
-                forceInvalid: revocationStatus === 'revoked' || revocationStatus === 'unknown',
-                revoked: revocationStatus === 'revoked',
+                ...(0, revocation_fields_1.revocationFields)(revocationStatus), // PAY-2339: forceInvalid only for 'revoked'; unavailable:true for 'unknown'
                 // Clear names for middleware decision-making
                 tenantRequiresTwoFactor,
                 userHasCompletedTenantTwoFactorRequirements,
@@ -436,8 +437,7 @@ async function GET(req) {
                 reason: 'Token expired',
                 // Session revocation (PAY-1882 step 4) - same value on every return.
                 revocationStatus,
-                forceInvalid: revocationStatus === 'revoked' || revocationStatus === 'unknown',
-                revoked: revocationStatus === 'revoked',
+                ...(0, revocation_fields_1.revocationFields)(revocationStatus), // PAY-2339: forceInvalid only for 'revoked'; unavailable:true for 'unknown'
                 // RBAC fields
                 roles: session?.roles || [],
                 clientId: resolveClientId(session?.idpClientId),
@@ -452,8 +452,7 @@ async function GET(req) {
             sessionTokenId: sessionToken ? (0, token_log_id_1.tokenLogId)(sessionToken) : null,
             // Session revocation (PAY-1882 step 4) - same value on every return.
             revocationStatus,
-            forceInvalid: revocationStatus === 'revoked' || revocationStatus === 'unknown',
-            revoked: revocationStatus === 'revoked',
+            ...(0, revocation_fields_1.revocationFields)(revocationStatus), // PAY-2339: forceInvalid only for 'revoked'; unavailable:true for 'unknown'
             // Clear names
             tenantRequiresTwoFactor,
             userHasCompletedTenantTwoFactorRequirements,

package/dist/types/auth.d.ts

@@ -21,6 +21,12 @@ export interface AuthConfig {
      * An OAuth-only client is a deliberate choice, never the default.
      */
     allowTraditionalLogin?: boolean;
+    /**
+     * PAY-2334: where /api/auth/settings stands. 'loading' = not answered yet, 'ready' = answered (or nothing to ask:
+     * useDynamicProviders off), 'failed' = non-2xx, thrown, or timed out. Absent means 'ready'. A page must not tell the user
+     * "sign-in is not available" while this is 'loading', and must say a failed read is a failed read, not an empty answer.
+     */
+    settingsStatus?: 'loading' | 'ready' | 'failed';
     providers: FederatedProvider[];
     enableRecovery: boolean;
     enableEmailSignup: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "4.7.9",
+  "version": "4.8.0",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -910,6 +910,11 @@
       "require": "./dist/pages/client-admin/index.js",
       "default": "./dist/pages/client-admin/index.js"
     },
+    "./pages/service-unavailable": {
+      "types": "./dist/pages/service-unavailable/page.d.ts",
+      "require": "./dist/pages/service-unavailable/page.js",
+      "default": "./dist/pages/service-unavailable/page.js"
+    },
     "./pages/coming-soon": {
       "types": "./dist/pages/coming-soon/page.d.ts",
       "require": "./dist/pages/coming-soon/page.js",

package/src/api-handlers/session/viability.ts

@@ -4,6 +4,7 @@
  * This API route is called by the middleware to securely check if a session is valid.
  */
 
+import { revocationFields } from '../../auth/revocation-fields';
 import { NextRequest, NextResponse } from 'next/server';
 import { getSession as getRedisSession, getBetterAuthSession } from '../../lib/session-store';
 import { resolveSessionState } from '../../server/auth';
@@ -52,7 +53,7 @@ export async function GET(req: NextRequest) {
     if (sessionState.state === 'unknown') {
       console.warn('[VIABILITY] Session store unavailable - session state unknown');
       return NextResponse.json(
-        { authenticated: false, revocationStatus: 'unknown' as RevocationStatus, error: 'Session store unavailable', code: 'STORE_UNAVAILABLE' },
+        { authenticated: false, revocationStatus: 'unknown' as RevocationStatus, unavailable: true, error: 'Session store unavailable', code: 'STORE_UNAVAILABLE' },
         { status: 500 }
       );
     }
@@ -192,8 +193,7 @@ export async function GET(req: NextRequest) {
           // Session revocation (PAY-1882 step 4): the four-state status, plus the
           // boolean the middleware's existing force-invalid branch already reads.
           revocationStatus,
-          forceInvalid: revocationStatus === 'revoked' || revocationStatus === 'unknown',
-          revoked: revocationStatus === 'revoked',
+          ...revocationFields(revocationStatus), // PAY-2339: forceInvalid only for 'revoked'; unavailable:true for 'unknown'
           // Cards 141688/141741 — the IDP's routing decision, relayed verbatim.
           //
           // THIS IS THE SECOND IMPLEMENTATION OF VIABILITY. The other is

package/src/auth/auth-decision.ts

@@ -22,6 +22,8 @@ export interface AuthContext {
   sessionStatus: {
     exists: boolean | null; // null = check failed/timeout
     forceInvalid: boolean | null; // null = check failed/timeout
+    /** PAY-2339: the producer said the revocation backend could not answer. makeAuthDecision HOLDS (no sign-out). */
+    unavailable?: boolean;
     requires2FA: boolean;
     twoFactorComplete: boolean;
   };
@@ -34,7 +36,7 @@ export interface AuthContext {
 export type AuthAction = 
   | { type: 'allow' }
   | { type: 'redirect'; location: string; reason: string; clearCookies?: boolean }
-  | { type: 'service_error'; reason: string };
+  | { type: 'service_error'; reason: string; check?: 'revocation' | 'viability' };
 
 /** PAY-2180: warn once per process, not per request. */
 let deprecationWarned = false;
@@ -139,6 +141,16 @@ function decide(context: AuthContext): AuthAction {
     };
   }
 
+  // PAY-2339 (BAPert 74633): the revocation backend could not answer. Hold: not a verdict on the session, so no
+  // sign-out and no cookie is touched. A caller maps this to its own "temporarily unavailable" answer (the
+  // createMvpMiddleware twin sends /service-unavailable or a 503 with unavailable:true, check:'revocation').
+  if (sessionStatus.unavailable) {
+    if (isLoginPage) {
+      return { type: 'allow' };
+    }
+    return { type: 'service_error', reason: 'revocation_unknown', check: 'revocation' };
+  }
+
   // Session force invalidated - need fresh login
   if (sessionStatus.forceInvalid) {
     if (isLoginPage) {

package/src/auth/revocation-fields.ts

@@ -0,0 +1,16 @@
+/**
+ * PAY-2339 (BAPert 74633 gap 1): the two revocation fields every viability producer emits, in ONE place so the
+ * producers (api-handlers/session/viability.ts and routes/auth/viability.ts, four return sites) cannot drift.
+ *
+ *   forceInvalid - true ONLY for 'revoked'. An 'unknown' answer is no longer a sign-out verdict.
+ *   unavailable  - true when the revocation backend could not answer: 'unknown' and ANY string that is not one of the
+ *                  three recognised states. A consumer that reads this JSON (useSessionCheck, makeAuthDecision) holds
+ *                  instead of signing the member out. `revocationStatus` itself is emitted unchanged.
+ *
+ * 'not_configured' is a configuration fault, not an outage: neither field is set for it (unchanged).
+ */
+export function revocationFields(status: unknown): { forceInvalid: boolean; unavailable: boolean; revoked: boolean } {
+  const revoked = status === 'revoked';
+  const unavailable = !(status === 'revoked' || status === 'active' || status === 'not_configured');
+  return { forceInvalid: revoked, unavailable, revoked };
+}

package/src/client/AuthContext.tsx

@@ -38,9 +38,15 @@ interface AuthProviderProps {
   useDynamicProviders?: boolean;
 }
 
+/** PAY-2334: how long /api/auth/settings may take before the sign-in card stops waiting and says it could not load. */
+export const SETTINGS_FETCH_TIMEOUT_MS = 10000;
+
 export function AuthProvider({ children, config, useDynamicProviders = true }: AuthProviderProps) {
   const [dynamicProviders, setDynamicProviders] = useState<FederatedProvider[]>([]);
   const [providersLoaded, setProvidersLoaded] = useState(!useDynamicProviders);
+  // PAY-2334: providersLoaded is true on failure too (it only means "stop waiting"), so it cannot tell an empty answer from
+  // no answer. This can: loading -> ready (answered) | failed (non-2xx, thrown, timed out).
+  const [settingsStatus, setSettingsStatus] = useState<'loading' | 'ready' | 'failed'>(useDynamicProviders ? 'loading' : 'ready');
 
   // What the IDP says this client offers. null until /api/auth/settings answers.
   const [serverSettings, setServerSettings] = useState<{
@@ -66,6 +72,9 @@ export function AuthProvider({ children, config, useDynamicProviders = true }: A
     let mounted = true;
 
     async function fetchDynamicProviders() {
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), SETTINGS_FETCH_TIMEOUT_MS);
+      let status: 'ready' | 'failed' = 'failed';
       try {
         // READ THE IDP. This used to be a hardcoded literal:
         //     const result = { google: { id: 'google', name: 'Google' } };
@@ -75,7 +84,7 @@ export function AuthProvider({ children, config, useDynamicProviders = true }: A
         //
         // /api/auth/settings already serves the real answer (enabledProviders,
         // allowFederatedLogin, enablePasswordReset) and nothing consumed it.
-        const response = await fetch('/api/auth/settings');
+        const response = await fetch('/api/auth/settings', { signal: controller.signal });
         if (!response.ok) {
           // No silent substitution. Absent settings means we do not know what this
           // client offers, and inventing a provider list is how a tenant ends up with a
@@ -98,6 +107,7 @@ export function AuthProvider({ children, config, useDynamicProviders = true }: A
           .map(id => PROVIDER_MAP[id])
           .filter((p): p is FederatedProvider => p !== undefined);
 
+        status = 'ready';
         setDynamicProviders(oauthProviders);
         setServerSettings({
           allowFederatedLogin: settings?.allowFederatedLogin !== false,
@@ -109,7 +119,9 @@ export function AuthProvider({ children, config, useDynamicProviders = true }: A
       } catch (err) {
         console.error('[AuthProvider] could not read /api/auth/settings:', err);
       } finally {
+        clearTimeout(timer);
         if (mounted) {
+          setSettingsStatus(status);
           setProvidersLoaded(true);
         }
       }
@@ -130,6 +142,7 @@ export function AuthProvider({ children, config, useDynamicProviders = true }: A
     ...defaultConfig,
     ...config,
     providers, // from the IDP when useDynamicProviders is on
+    settingsStatus: useDynamicProviders ? settingsStatus : 'ready',
     // THE SERVER DECIDES, THE SITE MAY OVERRIDE. A site that passes an explicit value
     // still wins; absent that, what the tenant's IDP reports is what renders. A client
     // hardcoding its own auth mode is how a sign-in screen and its IDP disagree.

package/src/components/auth/ModeAwareLoginPage.tsx

@@ -105,7 +105,27 @@ export function ModeAwareLoginPage({
           and rendered BOTH sections on the same condition - so a client configured with
           no sign-in method at all got the full form. Say so instead: a blank card leaves
           the user pressing nothing, and the operator with no idea what is wrong. */}
-      {!isFederated && !isTraditional && (
+      {!isFederated && !isTraditional && config.settingsStatus === 'loading' && (
+        <div role="status" className="px-4 py-3 rounded-lg text-sm text-left" style={{ color: 'var(--text-secondary, #6b7280)' }}>
+          <p>Loading sign-in options…</p>
+        </div>
+      )}
+
+      {!isFederated && !isTraditional && config.settingsStatus === 'failed' && (
+        <div
+          role="alert"
+          className="px-4 py-3 rounded-lg text-sm text-left"
+          style={{
+            border: '1px solid var(--border-default, #e5e7eb)',
+            color: 'var(--text-primary, #111827)',
+          }}
+        >
+          <p className="font-semibold">Could not load sign-in options.</p>
+          <p className="mt-1">Please reload the page. If it keeps happening, contact an administrator.</p>
+        </div>
+      )}
+
+      {!isFederated && !isTraditional && (config.settingsStatus ?? 'ready') === 'ready' && (
         <div
           role="alert"
           className="px-4 py-3 rounded-lg text-sm text-left"

package/src/components/auth/ModeAwareSignupPage.tsx

@@ -154,116 +154,46 @@ export function ModeAwareSignupPage({
         </form>
       )}
 
-      {/* Hybrid Mode - Show both */}
-      {isFederated === false && isTraditional === false && (
-        <>
-          <FederatedAuthSection
-            providers={config.providers}
-            onProviderClick={handleFederatedClick}
-            isLoading={totalLoading}
-          />
-
-          {config.providers.length > 0 && config.enableEmailSignup && (
-            <div className="relative my-6">
-              <div className="absolute inset-0 flex items-center">
-                <div
-                  className="w-full"
-                  style={{
-                    borderTop: '1px solid var(--border-default)',
-                  }}
-                ></div>
-              </div>
-              <div className="relative flex justify-center text-sm">
-                <span
-                  className="px-2"
-                  style={{
-                    background: 'var(--bg-card)',
-                    color: 'var(--text-secondary)',
-                  }}
-                >
-                  Or sign up with email
-                </span>
-              </div>
-            </div>
-          )}
-
-          {config.enableEmailSignup && (
-            <form onSubmit={handleTraditionalSubmit} className="space-y-4">
-              <div>
-                <label className="block text-sm font-medium mb-2" style={{ color: 'var(--text-primary)' }}>
-                  Email Address
-                </label>
-                <input
-                  type="email"
-                  value={email}
-                  onChange={(e) => setEmail(e.target.value)}
-                  placeholder="you@example.com"
-                  disabled={totalLoading}
-                  required
-                  className="w-full px-4 py-3 rounded-lg border transition-colors focus:outline-none focus:ring-2 disabled:opacity-50"
-                  style={{
-                    border: '1px solid var(--border-default)',
-                    color: 'var(--text-primary)',
-                    background: 'var(--bg-default)',
-                  }}
-                />
-              </div>
-
-              <div>
-                <label className="block text-sm font-medium mb-2" style={{ color: 'var(--text-primary)' }}>
-                  Password
-                </label>
-                <input
-                  type="password"
-                  value={password}
-                  onChange={(e) => setPassword(e.target.value)}
-                  placeholder="••••••••"
-                  disabled={totalLoading}
-                  required
-                  className="w-full px-4 py-3 rounded-lg border transition-colors focus:outline-none focus:ring-2 disabled:opacity-50"
-                  style={{
-                    border: '1px solid var(--border-default)',
-                    color: 'var(--text-primary)',
-                    background: 'var(--bg-default)',
-                  }}
-                />
-              </div>
+      {/* PAY-2334: same three states as the login page. Not answered yet -> neutral text; read failed -> say so;
+          only an ANSWERED "nothing offered" falls through to the branch below. */}
+      {!isFederated && !isTraditional && config.settingsStatus === 'loading' && (
+        <div role="status" className="px-4 py-3 rounded-lg text-sm text-left" style={{ color: 'var(--text-secondary, #6b7280)' }}>
+          <p>Loading sign-up options…</p>
+        </div>
+      )}
 
-              <div>
-                <label className="block text-sm font-medium mb-2" style={{ color: 'var(--text-primary)' }}>
-                  Confirm Password
-                </label>
-                <input
-                  type="password"
-                  value={confirmPassword}
-                  onChange={(e) => setConfirmPassword(e.target.value)}
-                  placeholder="••••••••"
-                  disabled={totalLoading}
-                  required
-                  className="w-full px-4 py-3 rounded-lg border transition-colors focus:outline-none focus:ring-2 disabled:opacity-50"
-                  style={{
-                    border: '1px solid var(--border-default)',
-                    color: 'var(--text-primary)',
-                    background: 'var(--bg-default)',
-                  }}
-                />
-              </div>
+      {!isFederated && !isTraditional && config.settingsStatus === 'failed' && (
+        <div
+          role="alert"
+          className="px-4 py-3 rounded-lg text-sm text-left"
+          style={{
+            border: '1px solid var(--border-default, #e5e7eb)',
+            color: 'var(--text-primary, #111827)',
+          }}
+        >
+          <p className="font-semibold">Could not load sign-up options.</p>
+          <p className="mt-1">Please reload the page. If it keeps happening, contact an administrator.</p>
+        </div>
+      )}
 
-              <button
-                type="submit"
-                disabled={totalLoading}
-                className="w-full py-3 px-4 rounded-lg font-semibold focus:outline-none focus:ring-2 disabled:opacity-50 disabled:cursor-not-allowed transition-colors mt-6"
-                style={{
-                  border: '1px solid var(--border-default)',
-                  color: 'white',
-                  background: 'var(--color-primary, #10b981)',
-                }}
-              >
-                {totalLoading ? 'Creating Account...' : 'Create Account'}
-              </button>
-            </form>
-          )}
-        </>
+      {/* PAY-2341: ANSWERED, and nothing is offered. This branch used to be labelled "Hybrid Mode - Show both" and
+          rendered the federated section plus the email sign-up form on the same "neither" condition, so a client with no
+          sign-up method showed a working-looking form. Say so, as the login page does (ModeAwareLoginPage). */}
+      {!isFederated && !isTraditional && (config.settingsStatus ?? 'ready') === 'ready' && (
+        <div
+          role="alert"
+          className="px-4 py-3 rounded-lg text-sm text-left"
+          style={{
+            border: '1px solid var(--border-default, #e5e7eb)',
+            color: 'var(--text-primary, #111827)',
+          }}
+        >
+          <p className="font-semibold">Sign-up is not available for this application.</p>
+          <p className="mt-1">
+            No sign-up method is enabled for this client. An administrator needs to enable
+            a federated provider or username and password sign-in.
+          </p>
+        </div>
       )}
     </>
   );