@payez/next-mvp 4.8.0 → 4.8.1

package/dist/middleware/create-middleware.js

@@ -198,16 +198,17 @@ function serviceUnavailableResponse(request, check = 'viability', unavailablePag
     // callback, and no Set-Cookie (nothing here touches the session). No redirect, so no 404 is possible.
     // `unavailablePage` is accepted only as a PLAIN path ([A-Za-z0-9_-/]; no query, fragment, %-encoding, dot segment or
     // scheme), so the self-check below compares like with like and a mis-set value falls back to the inline page (Scout 74668).
-    // The named page applies to the revocation hold ONLY (BAPert 74648: the viability-failure arm is untouched). If the
+    // PAY-2345: the viability-FAILURE arm (500 / timeout / breaker) takes the same path, so an app with no page of its own
+    // gets the inline 503 instead of a 404 during an outage. The two arms differ only in `check` (JSON body for /api/*). If the
     // request is already FOR the named page (an app that did not register it as public), answer inline: redirecting to
     // it again would loop with a longer callbackUrl each time (QAPert 74651).
-    const named = check === 'revocation' && unavailablePage && /^\/[A-Za-z0-9_\-\/]*$/.test(unavailablePage) && !unavailablePage.includes('//') ? unavailablePage : null;
-    if (check === 'revocation' && (!named || pathname.replace(/\/+$/, '') === named.replace(/\/+$/, ''))) {
+    const named = unavailablePage && /^\/[A-Za-z0-9_\-\/]*$/.test(unavailablePage) && !unavailablePage.includes('//') ? unavailablePage : null;
+    if (!named || pathname.replace(/\/+$/, '') === named.replace(/\/+$/, '')) {
         const href = callback.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;');
         return new server_1.NextResponse('<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Temporarily unavailable</title>' +
             '<main role="status" style="font-family:system-ui,sans-serif;max-width:28rem;margin:20vh auto;padding:0 1rem;text-align:center">' +
             '<h1 style="font-size:1.25rem">Temporarily unavailable</h1>' +
-            '<p>We could not check your session just now. You are still signed in.</p>' +
+            '<p>' + (check === 'revocation' ? 'We could not check your session just now. You are still signed in.' : 'We could not reach the sign-in service just now. Please try again.') + '</p>' +
             '<p><a href="' + href + '">Try again</a></p></main>', { status: 503, headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store', 'retry-after': '30' } });
     }
     const target = new URL(named || '/service-unavailable', request.url);
@@ -766,7 +767,7 @@ async function handleRefresh(request, safeCallback, opts) {
         log.warn('Circuit breaker preventing refresh attempt');
         // PAY-2147: a breaker that merely declines to TRY a refresh has learned nothing about the session; wiping the
         // cookies here logged out every user on the first request after a blip (HALF_OPEN refuses all but one probe).
-        return serviceUnavailableResponse(request);
+        return serviceUnavailableResponse(request, 'viability', opts.unavailablePage);
     }
     try {
         const baseUrl = (0, internal_api_url_1.getInternalApiUrl)(request);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "4.8.0",
+  "version": "4.8.1",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/auth/revocation-fields.ts

@@ -1,16 +1,16 @@
-/**
- * PAY-2339 (BAPert 74633 gap 1): the two revocation fields every viability producer emits, in ONE place so the
- * producers (api-handlers/session/viability.ts and routes/auth/viability.ts, four return sites) cannot drift.
- *
- *   forceInvalid - true ONLY for 'revoked'. An 'unknown' answer is no longer a sign-out verdict.
- *   unavailable  - true when the revocation backend could not answer: 'unknown' and ANY string that is not one of the
- *                  three recognised states. A consumer that reads this JSON (useSessionCheck, makeAuthDecision) holds
- *                  instead of signing the member out. `revocationStatus` itself is emitted unchanged.
- *
- * 'not_configured' is a configuration fault, not an outage: neither field is set for it (unchanged).
- */
-export function revocationFields(status: unknown): { forceInvalid: boolean; unavailable: boolean; revoked: boolean } {
-  const revoked = status === 'revoked';
-  const unavailable = !(status === 'revoked' || status === 'active' || status === 'not_configured');
-  return { forceInvalid: revoked, unavailable, revoked };
-}
+/**
+ * PAY-2339 (BAPert 74633 gap 1): the two revocation fields every viability producer emits, in ONE place so the
+ * producers (api-handlers/session/viability.ts and routes/auth/viability.ts, four return sites) cannot drift.
+ *
+ *   forceInvalid - true ONLY for 'revoked'. An 'unknown' answer is no longer a sign-out verdict.
+ *   unavailable  - true when the revocation backend could not answer: 'unknown' and ANY string that is not one of the
+ *                  three recognised states. A consumer that reads this JSON (useSessionCheck, makeAuthDecision) holds
+ *                  instead of signing the member out. `revocationStatus` itself is emitted unchanged.
+ *
+ * 'not_configured' is a configuration fault, not an outage: neither field is set for it (unchanged).
+ */
+export function revocationFields(status: unknown): { forceInvalid: boolean; unavailable: boolean; revoked: boolean } {
+  const revoked = status === 'revoked';
+  const unavailable = !(status === 'revoked' || status === 'active' || status === 'not_configured');
+  return { forceInvalid: revoked, unavailable, revoked };
+}

package/src/middleware/create-middleware.ts

@@ -381,19 +381,20 @@ function serviceUnavailableResponse(request: NextRequest, check: UnavailableChec
   // PAY-2339 (BAPert 74640, P13): a HELD revocation answer needs no page in the consumer. Unless the app names its own
   // page (`unavailablePage`), the middleware answers inline: a minimal 503 HTML, a "try again" link to the safe
   // callback, and no Set-Cookie (nothing here touches the session). No redirect, so no 404 is possible.
-  // `unavailablePage` is accepted only as a PLAIN path ([A-Za-z0-9_-/]; no query, fragment, %-encoding, dot segment or
-  // scheme), so the self-check below compares like with like and a mis-set value falls back to the inline page (Scout 74668).
-  // The named page applies to the revocation hold ONLY (BAPert 74648: the viability-failure arm is untouched). If the
+  // `unavailablePage` is accepted only as a PLAIN path ([A-Za-z0-9_-/]; no query, fragment, %-encoding, dot segment or
+  // scheme), so the self-check below compares like with like and a mis-set value falls back to the inline page (Scout 74668).
+  // PAY-2345: the viability-FAILURE arm (500 / timeout / breaker) takes the same path, so an app with no page of its own
+  // gets the inline 503 instead of a 404 during an outage. The two arms differ only in `check` (JSON body for /api/*). If the
   // request is already FOR the named page (an app that did not register it as public), answer inline: redirecting to
   // it again would loop with a longer callbackUrl each time (QAPert 74651).
-  const named = check === 'revocation' && unavailablePage && /^\/[A-Za-z0-9_\-\/]*$/.test(unavailablePage) && !unavailablePage.includes('//') ? unavailablePage : null;
-  if (check === 'revocation' && (!named || pathname.replace(/\/+$/, '') === named.replace(/\/+$/, ''))) {
+  const named = unavailablePage && /^\/[A-Za-z0-9_\-\/]*$/.test(unavailablePage) && !unavailablePage.includes('//') ? unavailablePage : null;
+  if (!named || pathname.replace(/\/+$/, '') === named.replace(/\/+$/, '')) {
     const href = callback.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;');
     return new NextResponse(
       '<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Temporarily unavailable</title>' +
         '<main role="status" style="font-family:system-ui,sans-serif;max-width:28rem;margin:20vh auto;padding:0 1rem;text-align:center">' +
         '<h1 style="font-size:1.25rem">Temporarily unavailable</h1>' +
-        '<p>We could not check your session just now. You are still signed in.</p>' +
+        '<p>' + (check === 'revocation' ? 'We could not check your session just now. You are still signed in.' : 'We could not reach the sign-in service just now. Please try again.') + '</p>' +
         '<p><a href="' + href + '">Try again</a></p></main>',
       { status: 503, headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store', 'retry-after': '30' } },
     );
@@ -1064,7 +1065,7 @@ async function handleRefresh(
     log.warn('Circuit breaker preventing refresh attempt');
     // PAY-2147: a breaker that merely declines to TRY a refresh has learned nothing about the session; wiping the
     // cookies here logged out every user on the first request after a blip (HALF_OPEN refuses all but one probe).
-    return serviceUnavailableResponse(request);
+    return serviceUnavailableResponse(request, 'viability', opts.unavailablePage);
   }
 
   try {

package/src/pages/service-unavailable/page.tsx

@@ -1,63 +1,63 @@
-'use client';
-
-import React, { Suspense } from 'react';
-import { useSearchParams } from 'next/navigation';
-
-/**
- * PAY-2339 (option C): the default "temporarily unavailable" page the middleware sends a member to when the revocation
- * check (or the viability read) could not answer. Mount it in one line in the consuming app:
- *
- *     // app/service-unavailable/page.tsx
- *     export { default } from '@payez/next-mvp/pages/service-unavailable';
- *
- * It signs nobody out and clears nothing: "Try again" goes back to `callbackUrl`, and the member is still signed in. A
- * consumer may replace the page (and the wording) with its own at the same route.
- *
- * `callbackUrl` is untrusted input. Only a same-origin PATH is followed ("/dashboard"); anything else (an absolute URL,
- * a protocol-relative "//host", a "javascript:" value, a backslash trick, nothing at all) falls back to "/".
- */
-export function safeReturnPath(raw: string | null | undefined): string {
-  if (!raw || typeof raw !== 'string') return '/';
-  if (!raw.startsWith('/') || raw.startsWith('//') || raw.includes('\\')) return '/';
-  if (/[\u0000-\u001f]/.test(raw)) return '/';
-  return raw;
-}
-
-function ServiceUnavailableContent() {
-  const params = useSearchParams();
-  const back = safeReturnPath(params?.get('callbackUrl'));
-  return (
-    <div className="min-h-screen flex items-center justify-center p-4">
-      <div
-        role="status"
-        className="max-w-md w-full text-center rounded-xl p-8 shadow-lg border"
-        style={{
-          backgroundColor: 'var(--bg-card, #ffffff)',
-          borderColor: 'var(--border-default, #e5e7eb)',
-        }}
-      >
-        <h1 className="text-xl font-semibold mb-2" style={{ color: 'var(--text-primary, #111827)' }}>
-          Temporarily unavailable
-        </h1>
-        <p className="mb-6" style={{ color: 'var(--text-secondary, #6b7280)' }}>
-          We could not check your session just now. You are still signed in. Please try again in a moment.
-        </p>
-        <a
-          href={back}
-          className="inline-block rounded-lg px-4 py-2 font-medium"
-          style={{ background: 'var(--color-primary, #10b981)', color: 'white' }}
-        >
-          Try again
-        </a>
-      </div>
-    </div>
-  );
-}
-
-export default function ServiceUnavailablePage() {
-  return (
-    <Suspense fallback={null}>
-      <ServiceUnavailableContent />
-    </Suspense>
-  );
-}
+'use client';
+
+import React, { Suspense } from 'react';
+import { useSearchParams } from 'next/navigation';
+
+/**
+ * PAY-2339 (option C): the default "temporarily unavailable" page the middleware sends a member to when the revocation
+ * check (or the viability read) could not answer. Mount it in one line in the consuming app:
+ *
+ *     // app/service-unavailable/page.tsx
+ *     export { default } from '@payez/next-mvp/pages/service-unavailable';
+ *
+ * It signs nobody out and clears nothing: "Try again" goes back to `callbackUrl`, and the member is still signed in. A
+ * consumer may replace the page (and the wording) with its own at the same route.
+ *
+ * `callbackUrl` is untrusted input. Only a same-origin PATH is followed ("/dashboard"); anything else (an absolute URL,
+ * a protocol-relative "//host", a "javascript:" value, a backslash trick, nothing at all) falls back to "/".
+ */
+export function safeReturnPath(raw: string | null | undefined): string {
+  if (!raw || typeof raw !== 'string') return '/';
+  if (!raw.startsWith('/') || raw.startsWith('//') || raw.includes('\\')) return '/';
+  if (/[\u0000-\u001f]/.test(raw)) return '/';
+  return raw;
+}
+
+function ServiceUnavailableContent() {
+  const params = useSearchParams();
+  const back = safeReturnPath(params?.get('callbackUrl'));
+  return (
+    <div className="min-h-screen flex items-center justify-center p-4">
+      <div
+        role="status"
+        className="max-w-md w-full text-center rounded-xl p-8 shadow-lg border"
+        style={{
+          backgroundColor: 'var(--bg-card, #ffffff)',
+          borderColor: 'var(--border-default, #e5e7eb)',
+        }}
+      >
+        <h1 className="text-xl font-semibold mb-2" style={{ color: 'var(--text-primary, #111827)' }}>
+          Temporarily unavailable
+        </h1>
+        <p className="mb-6" style={{ color: 'var(--text-secondary, #6b7280)' }}>
+          We could not check your session just now. You are still signed in. Please try again in a moment.
+        </p>
+        <a
+          href={back}
+          className="inline-block rounded-lg px-4 py-2 font-medium"
+          style={{ background: 'var(--color-primary, #10b981)', color: 'white' }}
+        >
+          Try again
+        </a>
+      </div>
+    </div>
+  );
+}
+
+export default function ServiceUnavailablePage() {
+  return (
+    <Suspense fallback={null}>
+      <ServiceUnavailableContent />
+    </Suspense>
+  );
+}