@payez/next-mvp 4.8.0 → 4.8.2

package/src/lib/startup-init.ts

@@ -1,276 +1,276 @@
-/**
- * Startup Initialization for MVP
- *
- * This module ensures that critical initialization tasks are completed
- * before the application serves requests.
- *
- * Uses unified IDP client config for:
- * - BETTER_AUTH_SECRET (the Better Auth signing secret)
- * - OAuth provider configuration
- * - Auth settings (2FA, session timeouts, etc.)
- */
-
-import 'server-only';
-import { getIDPClientConfig, clearConfigRedisCache, type IDPClientConfig } from './idp-client-config';
-import { slugStateReason } from './app-slug';
-
-let initializationStarted = false;
-let initializationComplete = false;
-let initializationFailed = false;
-let initializationPromise: Promise<void> | null = null;
-let lastInitError: Error | null = null;
-
-// Cached IDP config for access after initialization
-let cachedIDPConfig: IDPClientConfig | null = null;
-
-// Startup backoff to prevent pod restart storms from hammering IDP
-let lastStartupAttemptTime = 0;
-const STARTUP_BACKOFF_MS = 30000; // 30 seconds between startup attempts after failure
-
-/**
- * Initialize the application startup sequence (async)
- * Handles async initialization like fetching secrets from IDP
- */
-export async function ensureInitialized(): Promise<void> {
-  // If already initialized, return immediately
-  if (initializationComplete) {
-    return;
-  }
-
-  // If initialization is in progress, wait for it
-  if (initializationPromise) {
-    return initializationPromise;
-  }
-
-  // Prevent hammering IDP on rapid pod restarts
-  const now = Date.now();
-  if (initializationFailed && (now - lastStartupAttemptTime) < STARTUP_BACKOFF_MS) {
-    const remainingMs = STARTUP_BACKOFF_MS - (now - lastStartupAttemptTime);
-    console.warn('[STARTUP] In backoff period after previous failure, skipping IDP call', {
-      remainingMs: Math.round(remainingMs),
-      lastError: lastInitError?.message
-    });
-    // Re-throw last error so callers know we're still in failed state
-    throw lastInitError || new Error('Initialization in backoff period');
-  }
-
-  // Track this attempt time
-  lastStartupAttemptTime = now;
-
-  // Mark as started
-  initializationStarted = true;
-
-  // Start initialization.
-  //
-  // PAY-642: a FAILED attempt must not stay installed. This used to be
-  // `initializationPromise = performInitialization(); await initializationPromise;` with no reset, and the
-  // in-progress check above runs BEFORE the backoff check, so a pod that booted while the IdP was down replayed
-  // its first rejection to every caller forever: the 30 s backoff could never lead to a retry. Same latch, same
-  // fix, as createSingleFlight (lib/single-flight.ts): callers of the failing attempt still see the rejection
-  // (loud), then the attempt clears itself, identity-guarded so a slow failure never evicts a newer attempt.
-  // After a failure the backoff check above governs when the next attempt may start.
-  const attempt = performInitialization();
-  initializationPromise = attempt;
-  attempt.catch(() => {
-    if (initializationPromise === attempt) initializationPromise = null;
-  });
-  await attempt;
-}
-
-/**
- * Synchronously log startup status
- * Can be called before async initialization is complete
- */
-export function logStartupStatus(): void {
-  if (!initializationStarted) {
-    console.log('\n');
-    console.log('╔══════════════════════════════════════════════════════════════╗');
-    console.log('║            🚀 PayEz Next MVP - Starting Up                    ║');
-    console.log('║                                                              ║');
-    console.log('║  Async initialization in progress...                         ║');
-    console.log('║  - Resolving BETTER_AUTH_SECRET from IDP                     ║');
-    console.log('║  - Verifying environment configuration                       ║');
-    console.log('║                                                              ║');
-    console.log('║  Check logs below for detailed initialization status:        ║');
-    console.log('╚══════════════════════════════════════════════════════════════╝');
-    console.log('');
-  } else if (initializationComplete) {
-    console.log('\n');
-    console.log('╔══════════════════════════════════════════════════════════════╗');
-    console.log('║            ✨ PayEz Next MVP Ready for Requests ✨            ║');
-    console.log('╚══════════════════════════════════════════════════════════════╝');
-    console.log('');
-  } else if (lastInitError) {
-    console.log('\n');
-    console.log('╔══════════════════════════════════════════════════════════════╗');
-    console.log('║  ⚠️  Startup error detected - initialization may still retry  ║');
-    console.log('╚══════════════════════════════════════════════════════════════╝');
-    console.log('');
-  }
-}
-
-async function performInitialization(): Promise<void> {
-  console.log('\n');
-  console.log('╔══════════════════════════════════════════════════════════════╗');
-  console.log('║            PayEz Next MVP - Async Startup                     ║');
-  console.log('╚══════════════════════════════════════════════════════════════╝');
-  console.log('');
-
-  try {
-    // Step 1: Fetch full client config from IDP (includes secret, providers, settings)
-    console.log('[STARTUP] Step 1/2: Fetching client config from IDP...');
-
-    // Clear any stale Redis cache so startup always gets fresh IDP data
-    await clearConfigRedisCache();
-
-    try {
-      const config = await getIDPClientConfig(true);
-      cachedIDPConfig = config;
-
-      console.log('[STARTUP] Client config loaded successfully');
-      console.log('[STARTUP]    - Client ID:', config.clientId);
-      console.log('[STARTUP]    - Client Slug:', config.clientSlug);
-      console.log('[STARTUP]    - Secret length:', config.authSecret?.length || 0, 'chars');
-      console.log('[STARTUP]    - OAuth Providers:', config.oauthProviders?.filter(p => p.enabled).map(p => p.provider).join(', ') || 'none');
-      console.log('[STARTUP]    - Require 2FA:', config.authSettings?.require2FA);
-      console.log('[STARTUP]    - Cache TTL:', config.configCacheTtlSeconds, 'seconds');
-      console.log('[STARTUP]    - Base Client URL:', config.baseClientUrl || '(not set)');
-
-      // Set BETTER_AUTH_SECRET from IDP response if not already set.
-      // Also mirror to legacy NEXTAUTH_SECRET during the rename transition
-      // so any consumer code still reading the old name keeps working.
-      if (config.authSecret && !process.env.BETTER_AUTH_SECRET) {
-        process.env.BETTER_AUTH_SECRET = config.authSecret;
-        console.log('[STARTUP] Set BETTER_AUTH_SECRET from IDP config');
-      }
-      if (config.authSecret && !process.env.NEXTAUTH_SECRET) {
-        process.env.NEXTAUTH_SECRET = config.authSecret;
-      }
-    } catch (error) {
-      const errorMsg = error instanceof Error ? error.message : String(error);
-      console.error('[STARTUP] IDP config fetch failed:', errorMsg);
-
-      // No fallback available — IDP config is the only source for the auth secret
-      console.error('[STARTUP] No fallback available for auth secret resolution');
-    }
-
-    // Step 2: Verify BETTER_AUTH_SECRET is available - FAIL FAST if not
-    console.log('[STARTUP] Step 2/2: Verifying BETTER_AUTH_SECRET...');
-
-    const secret = process.env.BETTER_AUTH_SECRET || process.env.NEXTAUTH_SECRET;
-    if (!secret || secret.trim() === '') {
-      console.error('');
-      console.error('╔══════════════════════════════════════════════════════════════╗');
-      console.error('║   ❌ FATAL: BETTER_AUTH_SECRET NOT AVAILABLE                  ║');
-      console.error('║                                                              ║');
-      console.error('║   The app cannot start without a valid auth signing secret.  ║');
-      console.error('║   This should be fetched from IDP at startup.                ║');
-      console.error('║                                                              ║');
-      console.error('║   Possible causes:                                           ║');
-      console.error('║   • IDP is not running or unreachable                        ║');
-      console.error('║   • CLIENT_ID is not registered in IDP                       ║');
-      console.error('║   • IDP_URL is incorrect                                     ║');
-      console.error('║   • Network connectivity issue                               ║');
-      console.error('╚══════════════════════════════════════════════════════════════╝');
-      console.error('');
-      throw new Error('FATAL: BETTER_AUTH_SECRET not available - cannot start without valid secret from IDP');
-    }
-
-    console.log('[STARTUP] BETTER_AUTH_SECRET verified (' + secret.length + ' chars)');
-
-    // Step 3: Validate cookie name consistency
-    // This catches bugs where getJwtCookieName() returns a different name than
-    // what auth-options.ts configures, which causes sessions to fail in production
-    const { validateCookieNameConsistency, getSessionCookieName, assertAppSlugMatchesIdp, assertIdpSlugKnown } = await import('./app-slug');
-    validateCookieNameConsistency();
-    // rigpert 60743: refuse to run with two cookie-name sources (IdP clientSlug vs APP_SLUG/CLIENT_ID).
-    assertIdpSlugKnown(cachedIDPConfig?.clientSlug);
-    assertAppSlugMatchesIdp(cachedIDPConfig?.clientSlug);
-    console.log('[STARTUP] Cookie name consistency validated:', getSessionCookieName());
-
-    // All done
-    console.log('');
-    console.log('╔══════════════════════════════════════════════════════════════╗');
-    console.log('║            PayEz Next MVP Ready for Requests                  ║');
-    console.log('╚══════════════════════════════════════════════════════════════╝');
-    console.log('');
-
-    initializationComplete = true;
-    initializationFailed = false;
-    lastInitError = null;
-  } catch (error) {
-    lastInitError = error instanceof Error ? error : new Error(String(error));
-    initializationFailed = true;
-
-    const errorMsg = lastInitError.message || 'Unknown error';
-    const isConnectionError = errorMsg.includes('fetch failed') || errorMsg.includes('ECONNREFUSED');
-    const idpUrl = (process.env.IDP_URL || 'NOT SET').padEnd(46);
-    const clientId = (process.env.CLIENT_ID || 'NOT SET').padEnd(43);
-
-    const connectionLine = isConnectionError
-      ? '║   🔌 CONNECTION REFUSED - IDP appears to be down             ║\n║                                                              ║\n'
-      : '';
-
-    console.error(`
-╔══════════════════════════════════════════════════════════════╗
-║   ❌ FATAL: BETTER_AUTH_SECRET NOT AVAILABLE                  ║
-║                                                              ║
-║   The app cannot start without a valid auth signing secret.  ║
-║   This should be fetched from IDP at startup.                ║
-║                                                              ║
-${connectionLine}║   Possible causes:                                           ║
-║   • IDP is not running or unreachable                        ║
-║   • CLIENT_ID is not registered in IDP                       ║
-║   • IDP_URL is incorrect                                     ║
-║   • Network connectivity issue                               ║
-║                                                              ║
-║   Current config:                                            ║
-║   • IDP_URL: ${idpUrl}║
-║   • CLIENT_ID: ${clientId}║
-╚══════════════════════════════════════════════════════════════╝
-
-[STARTUP] Error: ${errorMsg}
-`);
-
-    // Re-throw so callers know initialization failed
-    throw lastInitError;
-  }
-}
-
-/**
- * Get the cached IDP config after initialization.
- * Returns null if not yet initialized.
- */
-/**
- * For health endpoints (rigpert 60765): a guard that does not stop the process is an empty red unless the mismatch is visible
- * where operators and promote-fe look. Returns `SLUG_MISMATCH: cookie=<idp slug> gate=<app slug>` while the drift holds, else null;
- * a health route should answer non-200 with this as the reason. Null until the IdP config has been fetched.
- */
-export function getSlugMismatchReason(): string | null {
-  return slugStateReason(cachedIDPConfig?.clientSlug, initializationComplete || initializationFailed);
-}
-
-export function getStartupIDPConfig(): IDPClientConfig | null {
-  return cachedIDPConfig;
-}
-
-/**
- * Check if initialization failed (auth signing secret couldn't be retrieved)
- */
-export function isInitializationFailed(): boolean {
-  return initializationFailed;
-}
-
-/**
- * Get the last initialization error
- */
-export function getInitializationError(): Error | null {
-  return lastInitError;
-}
-
-/**
- * Check if the app is ready to handle auth requests
- */
-export function isAppReady(): boolean {
-  return initializationComplete && !initializationFailed;
-}
+/**
+ * Startup Initialization for MVP
+ *
+ * This module ensures that critical initialization tasks are completed
+ * before the application serves requests.
+ *
+ * Uses unified IDP client config for:
+ * - BETTER_AUTH_SECRET (the Better Auth signing secret)
+ * - OAuth provider configuration
+ * - Auth settings (2FA, session timeouts, etc.)
+ */
+
+import 'server-only';
+import { getIDPClientConfig, clearConfigRedisCache, type IDPClientConfig } from './idp-client-config';
+import { slugStateReason } from './app-slug';
+
+let initializationStarted = false;
+let initializationComplete = false;
+let initializationFailed = false;
+let initializationPromise: Promise<void> | null = null;
+let lastInitError: Error | null = null;
+
+// Cached IDP config for access after initialization
+let cachedIDPConfig: IDPClientConfig | null = null;
+
+// Startup backoff to prevent pod restart storms from hammering IDP
+let lastStartupAttemptTime = 0;
+const STARTUP_BACKOFF_MS = 30000; // 30 seconds between startup attempts after failure
+
+/**
+ * Initialize the application startup sequence (async)
+ * Handles async initialization like fetching secrets from IDP
+ */
+export async function ensureInitialized(): Promise<void> {
+  // If already initialized, return immediately
+  if (initializationComplete) {
+    return;
+  }
+
+  // If initialization is in progress, wait for it
+  if (initializationPromise) {
+    return initializationPromise;
+  }
+
+  // Prevent hammering IDP on rapid pod restarts
+  const now = Date.now();
+  if (initializationFailed && (now - lastStartupAttemptTime) < STARTUP_BACKOFF_MS) {
+    const remainingMs = STARTUP_BACKOFF_MS - (now - lastStartupAttemptTime);
+    console.warn('[STARTUP] In backoff period after previous failure, skipping IDP call', {
+      remainingMs: Math.round(remainingMs),
+      lastError: lastInitError?.message
+    });
+    // Re-throw last error so callers know we're still in failed state
+    throw lastInitError || new Error('Initialization in backoff period');
+  }
+
+  // Track this attempt time
+  lastStartupAttemptTime = now;
+
+  // Mark as started
+  initializationStarted = true;
+
+  // Start initialization.
+  //
+  // PAY-642: a FAILED attempt must not stay installed. This used to be
+  // `initializationPromise = performInitialization(); await initializationPromise;` with no reset, and the
+  // in-progress check above runs BEFORE the backoff check, so a pod that booted while the IdP was down replayed
+  // its first rejection to every caller forever: the 30 s backoff could never lead to a retry. Same latch, same
+  // fix, as createSingleFlight (lib/single-flight.ts): callers of the failing attempt still see the rejection
+  // (loud), then the attempt clears itself, identity-guarded so a slow failure never evicts a newer attempt.
+  // After a failure the backoff check above governs when the next attempt may start.
+  const attempt = performInitialization();
+  initializationPromise = attempt;
+  attempt.catch(() => {
+    if (initializationPromise === attempt) initializationPromise = null;
+  });
+  await attempt;
+}
+
+/**
+ * Synchronously log startup status
+ * Can be called before async initialization is complete
+ */
+export function logStartupStatus(): void {
+  if (!initializationStarted) {
+    console.log('\n');
+    console.log('╔══════════════════════════════════════════════════════════════╗');
+    console.log('║            🚀 PayEz Next MVP - Starting Up                    ║');
+    console.log('║                                                              ║');
+    console.log('║  Async initialization in progress...                         ║');
+    console.log('║  - Resolving BETTER_AUTH_SECRET from IDP                     ║');
+    console.log('║  - Verifying environment configuration                       ║');
+    console.log('║                                                              ║');
+    console.log('║  Check logs below for detailed initialization status:        ║');
+    console.log('╚══════════════════════════════════════════════════════════════╝');
+    console.log('');
+  } else if (initializationComplete) {
+    console.log('\n');
+    console.log('╔══════════════════════════════════════════════════════════════╗');
+    console.log('║            ✨ PayEz Next MVP Ready for Requests ✨            ║');
+    console.log('╚══════════════════════════════════════════════════════════════╝');
+    console.log('');
+  } else if (lastInitError) {
+    console.log('\n');
+    console.log('╔══════════════════════════════════════════════════════════════╗');
+    console.log('║  ⚠️  Startup error detected - initialization may still retry  ║');
+    console.log('╚══════════════════════════════════════════════════════════════╝');
+    console.log('');
+  }
+}
+
+async function performInitialization(): Promise<void> {
+  console.log('\n');
+  console.log('╔══════════════════════════════════════════════════════════════╗');
+  console.log('║            PayEz Next MVP - Async Startup                     ║');
+  console.log('╚══════════════════════════════════════════════════════════════╝');
+  console.log('');
+
+  try {
+    // Step 1: Fetch full client config from IDP (includes secret, providers, settings)
+    console.log('[STARTUP] Step 1/2: Fetching client config from IDP...');
+
+    // Clear any stale Redis cache so startup always gets fresh IDP data
+    await clearConfigRedisCache();
+
+    try {
+      const config = await getIDPClientConfig(true);
+      cachedIDPConfig = config;
+
+      console.log('[STARTUP] Client config loaded successfully');
+      console.log('[STARTUP]    - Client ID:', config.clientId);
+      console.log('[STARTUP]    - Client Slug:', config.clientSlug);
+      console.log('[STARTUP]    - Secret length:', config.authSecret?.length || 0, 'chars');
+      console.log('[STARTUP]    - OAuth Providers:', config.oauthProviders?.filter(p => p.enabled).map(p => p.provider).join(', ') || 'none');
+      console.log('[STARTUP]    - Require 2FA:', config.authSettings?.require2FA);
+      console.log('[STARTUP]    - Cache TTL:', config.configCacheTtlSeconds, 'seconds');
+      console.log('[STARTUP]    - Base Client URL:', config.baseClientUrl || '(not set)');
+
+      // Set BETTER_AUTH_SECRET from IDP response if not already set.
+      // Also mirror to legacy NEXTAUTH_SECRET during the rename transition
+      // so any consumer code still reading the old name keeps working.
+      if (config.authSecret && !process.env.BETTER_AUTH_SECRET) {
+        process.env.BETTER_AUTH_SECRET = config.authSecret;
+        console.log('[STARTUP] Set BETTER_AUTH_SECRET from IDP config');
+      }
+      if (config.authSecret && !process.env.NEXTAUTH_SECRET) {
+        process.env.NEXTAUTH_SECRET = config.authSecret;
+      }
+    } catch (error) {
+      const errorMsg = error instanceof Error ? error.message : String(error);
+      console.error('[STARTUP] IDP config fetch failed:', errorMsg);
+
+      // No fallback available — IDP config is the only source for the auth secret
+      console.error('[STARTUP] No fallback available for auth secret resolution');
+    }
+
+    // Step 2: Verify BETTER_AUTH_SECRET is available - FAIL FAST if not
+    console.log('[STARTUP] Step 2/2: Verifying BETTER_AUTH_SECRET...');
+
+    const secret = process.env.BETTER_AUTH_SECRET || process.env.NEXTAUTH_SECRET;
+    if (!secret || secret.trim() === '') {
+      console.error('');
+      console.error('╔══════════════════════════════════════════════════════════════╗');
+      console.error('║   ❌ FATAL: BETTER_AUTH_SECRET NOT AVAILABLE                  ║');
+      console.error('║                                                              ║');
+      console.error('║   The app cannot start without a valid auth signing secret.  ║');
+      console.error('║   This should be fetched from IDP at startup.                ║');
+      console.error('║                                                              ║');
+      console.error('║   Possible causes:                                           ║');
+      console.error('║   • IDP is not running or unreachable                        ║');
+      console.error('║   • CLIENT_ID is not registered in IDP                       ║');
+      console.error('║   • IDP_URL is incorrect                                     ║');
+      console.error('║   • Network connectivity issue                               ║');
+      console.error('╚══════════════════════════════════════════════════════════════╝');
+      console.error('');
+      throw new Error('FATAL: BETTER_AUTH_SECRET not available - cannot start without valid secret from IDP');
+    }
+
+    console.log('[STARTUP] BETTER_AUTH_SECRET verified (' + secret.length + ' chars)');
+
+    // Step 3: Validate cookie name consistency
+    // This catches bugs where getJwtCookieName() returns a different name than
+    // what auth-options.ts configures, which causes sessions to fail in production
+    const { validateCookieNameConsistency, getSessionCookieName, assertAppSlugMatchesIdp, assertIdpSlugKnown } = await import('./app-slug');
+    validateCookieNameConsistency();
+    // rigpert 60743: refuse to run with two cookie-name sources (IdP clientSlug vs APP_SLUG/CLIENT_ID).
+    assertIdpSlugKnown(cachedIDPConfig?.clientSlug);
+    assertAppSlugMatchesIdp(cachedIDPConfig?.clientSlug);
+    console.log('[STARTUP] Cookie name consistency validated:', getSessionCookieName());
+
+    // All done
+    console.log('');
+    console.log('╔══════════════════════════════════════════════════════════════╗');
+    console.log('║            PayEz Next MVP Ready for Requests                  ║');
+    console.log('╚══════════════════════════════════════════════════════════════╝');
+    console.log('');
+
+    initializationComplete = true;
+    initializationFailed = false;
+    lastInitError = null;
+  } catch (error) {
+    lastInitError = error instanceof Error ? error : new Error(String(error));
+    initializationFailed = true;
+
+    const errorMsg = lastInitError.message || 'Unknown error';
+    const isConnectionError = errorMsg.includes('fetch failed') || errorMsg.includes('ECONNREFUSED');
+    const idpUrl = (process.env.IDP_URL || 'NOT SET').padEnd(46);
+    const clientId = (process.env.CLIENT_ID || 'NOT SET').padEnd(43);
+
+    const connectionLine = isConnectionError
+      ? '║   🔌 CONNECTION REFUSED - IDP appears to be down             ║\n║                                                              ║\n'
+      : '';
+
+    console.error(`
+╔══════════════════════════════════════════════════════════════╗
+║   ❌ FATAL: BETTER_AUTH_SECRET NOT AVAILABLE                  ║
+║                                                              ║
+║   The app cannot start without a valid auth signing secret.  ║
+║   This should be fetched from IDP at startup.                ║
+║                                                              ║
+${connectionLine}║   Possible causes:                                           ║
+║   • IDP is not running or unreachable                        ║
+║   • CLIENT_ID is not registered in IDP                       ║
+║   • IDP_URL is incorrect                                     ║
+║   • Network connectivity issue                               ║
+║                                                              ║
+║   Current config:                                            ║
+║   • IDP_URL: ${idpUrl}║
+║   • CLIENT_ID: ${clientId}║
+╚══════════════════════════════════════════════════════════════╝
+
+[STARTUP] Error: ${errorMsg}
+`);
+
+    // Re-throw so callers know initialization failed
+    throw lastInitError;
+  }
+}
+
+/**
+ * Get the cached IDP config after initialization.
+ * Returns null if not yet initialized.
+ */
+/**
+ * For health endpoints (rigpert 60765): a guard that does not stop the process is an empty red unless the mismatch is visible
+ * where operators and promote-fe look. Returns `SLUG_MISMATCH: cookie=<idp slug> gate=<app slug>` while the drift holds, else null;
+ * a health route should answer non-200 with this as the reason. Null until the IdP config has been fetched.
+ */
+export function getSlugMismatchReason(): string | null {
+  return slugStateReason(cachedIDPConfig?.clientSlug, initializationComplete || initializationFailed);
+}
+
+export function getStartupIDPConfig(): IDPClientConfig | null {
+  return cachedIDPConfig;
+}
+
+/**
+ * Check if initialization failed (auth signing secret couldn't be retrieved)
+ */
+export function isInitializationFailed(): boolean {
+  return initializationFailed;
+}
+
+/**
+ * Get the last initialization error
+ */
+export function getInitializationError(): Error | null {
+  return lastInitError;
+}
+
+/**
+ * Check if the app is ready to handle auth requests
+ */
+export function isAppReady(): boolean {
+  return initializationComplete && !initializationFailed;
+}

package/src/lib/test-aware-get-token.ts

@@ -1,41 +1,41 @@
-import { NextRequest } from 'next/server';
-import { logger } from '../config/logger';
-import { getSession } from '../server/auth';
-import { getSessionCookieName } from './app-slug';
-
-export async function getTokenTestAware(req: NextRequest): Promise<any> {
-  if (process.env.TEST_MODE === 'true') {
-    try {
-      let secret = process.env.BETTER_AUTH_SECRET || process.env.NEXTAUTH_SECRET;
-      if (!secret || secret.trim() === '') {
-        const { getIDPClientConfig } = await import('./idp-client-config');
-        const idpConfig = await getIDPClientConfig();
-        secret = idpConfig.authSecret;
-      }
-      // Use app-slug prefixed cookie name
-      const cookieName = getSessionCookieName();
-      const cookies = req.headers.get('cookie'); if (!cookies) { logger.debug('[GET_TOKEN] No cookies in request'); return null; }
-      const cookieValue = cookies.split(';').find(c => c.trim().startsWith(`${cookieName}=`))?.split('=')[1];
-      if (!cookieValue) { logger.debug('[GET_TOKEN] Session token cookie not found'); return null; }
-      const { jwtVerify } = await import('jose');
-      const secretKey = new TextEncoder().encode(secret);
-      const { payload } = await jwtVerify(cookieValue, secretKey);
-      logger.debug('[GET_TOKEN] TEST_MODE token decoded:', { hasPayload: !!payload, redisSessionId: (payload as any).redisSessionId, sub: (payload as any).sub });
-      return payload;
-    } catch (error) { logger.error('[GET_TOKEN] TEST_MODE token decode error:', { error: error instanceof Error ? error.message : String(error) }); return null; }
-  }
-  // Production path: Better Auth session
-  const session = await getSession(req);
-  if (session?.user && session?.session?.token) {
-    return {
-      sub: session.user.id,
-      email: session.user.email,
-      name: session.user.name,
-      sessionToken: session.session.token,
-      roles: session.user.roles || [],
-      ...session.user,
-    };
-  }
-
-  return null;
-}
+import { NextRequest } from 'next/server';
+import { logger } from '../config/logger';
+import { getSession } from '../server/auth';
+import { getSessionCookieName } from './app-slug';
+
+export async function getTokenTestAware(req: NextRequest): Promise<any> {
+  if (process.env.TEST_MODE === 'true') {
+    try {
+      let secret = process.env.BETTER_AUTH_SECRET || process.env.NEXTAUTH_SECRET;
+      if (!secret || secret.trim() === '') {
+        const { getIDPClientConfig } = await import('./idp-client-config');
+        const idpConfig = await getIDPClientConfig();
+        secret = idpConfig.authSecret;
+      }
+      // Use app-slug prefixed cookie name
+      const cookieName = getSessionCookieName();
+      const cookies = req.headers.get('cookie'); if (!cookies) { logger.debug('[GET_TOKEN] No cookies in request'); return null; }
+      const cookieValue = cookies.split(';').find(c => c.trim().startsWith(`${cookieName}=`))?.split('=')[1];
+      if (!cookieValue) { logger.debug('[GET_TOKEN] Session token cookie not found'); return null; }
+      const { jwtVerify } = await import('jose');
+      const secretKey = new TextEncoder().encode(secret);
+      const { payload } = await jwtVerify(cookieValue, secretKey);
+      logger.debug('[GET_TOKEN] TEST_MODE token decoded:', { hasPayload: !!payload, redisSessionId: (payload as any).redisSessionId, sub: (payload as any).sub });
+      return payload;
+    } catch (error) { logger.error('[GET_TOKEN] TEST_MODE token decode error:', { error: error instanceof Error ? error.message : String(error) }); return null; }
+  }
+  // Production path: Better Auth session
+  const session = await getSession(req);
+  if (session?.user && session?.session?.token) {
+    return {
+      sub: session.user.id,
+      email: session.user.email,
+      name: session.user.name,
+      sessionToken: session.session.token,
+      roles: session.user.roles || [],
+      ...session.user,
+    };
+  }
+
+  return null;
+}