@payez/next-mvp 4.8.1 → 4.8.2

package/src/server/slim-middleware.ts

@@ -1,117 +1,117 @@
-/**
- * Slim Middleware — Cookie-Only Auth Check
- *
- * Replaces the self-fetching middleware with a cookie existence check.
- * All real auth validation happens in server-side layouts (authGuard).
- *
- * Zero self-fetches. Zero Redis calls. Zero JWT decoding.
- * Just: does the session cookie exist? Yes → pass through. No → redirect to login.
- */
-
-import { NextRequest, NextResponse } from 'next/server';
-import { getSessionCookieName, getSecureSessionCookieName } from '../lib/app-slug';
-
-// =============================================================================
-// TYPES
-// =============================================================================
-
-export interface SlimMiddlewareOptions {
-  /** Routes that don't require authentication (glob-style patterns) */
-  publicRoutes?: string[];
-  /** Login page URL (default: /account-auth/login) */
-  loginUrl?: string;
-  /** Additional paths to always bypass (e.g., /api/auth/, /api/session/) */
-  bypassPrefixes?: string[];
-}
-
-// =============================================================================
-// DEFAULT BYPASS PATHS
-// =============================================================================
-
-/** Routes that must always bypass middleware (prevent infinite loops) */
-const DEFAULT_BYPASS_PREFIXES = [
-  '/api/auth/',
-  '/api/session/',
-  '/_next/',
-  '/favicon.ico',
-];
-
-/** Static file extensions to bypass */
-const STATIC_EXTENSIONS = /\.(svg|png|jpg|jpeg|gif|webp|ico|css|js|woff|woff2|ttf|eot|map)$/i;
-
-// =============================================================================
-// MAIN
-// =============================================================================
-
-/**
- * Create a slim middleware that only checks cookie existence.
- * Auth validation is deferred to server-side layouts (authGuard).
- */
-export function createSlimMiddleware(options?: SlimMiddlewareOptions) {
-  const publicRoutes = options?.publicRoutes || [];
-  const loginUrl = options?.loginUrl || '/account-auth/login';
-  const extraBypass = options?.bypassPrefixes || [];
-  const allBypass = [...DEFAULT_BYPASS_PREFIXES, ...extraBypass];
-
-  // Pre-compile public route patterns for fast matching
-  const publicMatchers = publicRoutes.map(pattern => {
-    if (pattern.endsWith('/*')) {
-      const prefix = pattern.slice(0, -2);
-      return (p: string) => p === prefix || p.startsWith(prefix + '/');
-    }
-    if (pattern.endsWith('*')) {
-      const prefix = pattern.slice(0, -1);
-      return (p: string) => p.startsWith(prefix);
-    }
-    if (pattern.startsWith('/*.')) {
-      const ext = pattern.slice(2);
-      return (p: string) => p.endsWith(ext);
-    }
-    return (p: string) => p === pattern;
-  });
-
-  return function middleware(request: NextRequest): NextResponse {
-    const { pathname } = request.nextUrl;
-
-    // 1. Always bypass static/internal routes
-    if (STATIC_EXTENSIONS.test(pathname)) {
-      return NextResponse.next();
-    }
-    for (const prefix of allBypass) {
-      if (pathname.startsWith(prefix)) {
-        return NextResponse.next();
-      }
-    }
-
-    // 2. Check if it's a public route → pass through
-    for (const matcher of publicMatchers) {
-      if (matcher(pathname)) {
-        return NextResponse.next();
-      }
-    }
-
-    // 3. THE ONLY AUTH CHECK: Does a session cookie exist?
-    const sessionCookieName = getSessionCookieName();
-    const secureCookieName = getSecureSessionCookieName();
-    const hasCookie =
-      request.cookies.has(sessionCookieName) ||
-      request.cookies.has(secureCookieName);
-
-    if (!hasCookie) {
-      // No cookie on a protected route → redirect to login
-      // API routes get 401 instead of redirect
-      if (pathname.startsWith('/api/')) {
-        return NextResponse.json(
-          { error: 'Unauthorized', message: 'No session' },
-          { status: 401 }
-        );
-      }
-
-      const callbackUrl = encodeURIComponent(pathname);
-      return NextResponse.redirect(new URL(`${loginUrl}?callbackUrl=${callbackUrl}`, request.url));
-    }
-
-    // Cookie exists → pass through, layout authGuard does the real validation
-    return NextResponse.next();
-  };
-}
+/**
+ * Slim Middleware — Cookie-Only Auth Check
+ *
+ * Replaces the self-fetching middleware with a cookie existence check.
+ * All real auth validation happens in server-side layouts (authGuard).
+ *
+ * Zero self-fetches. Zero Redis calls. Zero JWT decoding.
+ * Just: does the session cookie exist? Yes → pass through. No → redirect to login.
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { getSessionCookieName, getSecureSessionCookieName } from '../lib/app-slug';
+
+// =============================================================================
+// TYPES
+// =============================================================================
+
+export interface SlimMiddlewareOptions {
+  /** Routes that don't require authentication (glob-style patterns) */
+  publicRoutes?: string[];
+  /** Login page URL (default: /account-auth/login) */
+  loginUrl?: string;
+  /** Additional paths to always bypass (e.g., /api/auth/, /api/session/) */
+  bypassPrefixes?: string[];
+}
+
+// =============================================================================
+// DEFAULT BYPASS PATHS
+// =============================================================================
+
+/** Routes that must always bypass middleware (prevent infinite loops) */
+const DEFAULT_BYPASS_PREFIXES = [
+  '/api/auth/',
+  '/api/session/',
+  '/_next/',
+  '/favicon.ico',
+];
+
+/** Static file extensions to bypass */
+const STATIC_EXTENSIONS = /\.(svg|png|jpg|jpeg|gif|webp|ico|css|js|woff|woff2|ttf|eot|map)$/i;
+
+// =============================================================================
+// MAIN
+// =============================================================================
+
+/**
+ * Create a slim middleware that only checks cookie existence.
+ * Auth validation is deferred to server-side layouts (authGuard).
+ */
+export function createSlimMiddleware(options?: SlimMiddlewareOptions) {
+  const publicRoutes = options?.publicRoutes || [];
+  const loginUrl = options?.loginUrl || '/account-auth/login';
+  const extraBypass = options?.bypassPrefixes || [];
+  const allBypass = [...DEFAULT_BYPASS_PREFIXES, ...extraBypass];
+
+  // Pre-compile public route patterns for fast matching
+  const publicMatchers = publicRoutes.map(pattern => {
+    if (pattern.endsWith('/*')) {
+      const prefix = pattern.slice(0, -2);
+      return (p: string) => p === prefix || p.startsWith(prefix + '/');
+    }
+    if (pattern.endsWith('*')) {
+      const prefix = pattern.slice(0, -1);
+      return (p: string) => p.startsWith(prefix);
+    }
+    if (pattern.startsWith('/*.')) {
+      const ext = pattern.slice(2);
+      return (p: string) => p.endsWith(ext);
+    }
+    return (p: string) => p === pattern;
+  });
+
+  return function middleware(request: NextRequest): NextResponse {
+    const { pathname } = request.nextUrl;
+
+    // 1. Always bypass static/internal routes
+    if (STATIC_EXTENSIONS.test(pathname)) {
+      return NextResponse.next();
+    }
+    for (const prefix of allBypass) {
+      if (pathname.startsWith(prefix)) {
+        return NextResponse.next();
+      }
+    }
+
+    // 2. Check if it's a public route → pass through
+    for (const matcher of publicMatchers) {
+      if (matcher(pathname)) {
+        return NextResponse.next();
+      }
+    }
+
+    // 3. THE ONLY AUTH CHECK: Does a session cookie exist?
+    const sessionCookieName = getSessionCookieName();
+    const secureCookieName = getSecureSessionCookieName();
+    const hasCookie =
+      request.cookies.has(sessionCookieName) ||
+      request.cookies.has(secureCookieName);
+
+    if (!hasCookie) {
+      // No cookie on a protected route → redirect to login
+      // API routes get 401 instead of redirect
+      if (pathname.startsWith('/api/')) {
+        return NextResponse.json(
+          { error: 'Unauthorized', message: 'No session' },
+          { status: 401 }
+        );
+      }
+
+      const callbackUrl = encodeURIComponent(pathname);
+      return NextResponse.redirect(new URL(`${loginUrl}?callbackUrl=${callbackUrl}`, request.url));
+    }
+
+    // Cookie exists → pass through, layout authGuard does the real validation
+    return NextResponse.next();
+  };
+}

package/src/server/verified-session-token.ts

@@ -1,103 +1,103 @@
-/**
- * PAY-1476 / card 372275 (R941 s1b) - THE ONE SHARED VERIFIED RESOLVER for a session token taken from a cookie.
- *
- * THE DEFECT (4.4.5, measured at the deployed portal by QAPert-NightHawk, mail 59030):
- *   Module A  server/decode-session.ts  the ba-hmac branch took `{token}.{anything}` and used segment 0 unread.
- *   Module B  server/auth.ts  Path B    took the token from ANY recognised shape and never verified anything;
- *                                       a forged JWS resolved there too.
- * Both then treated "a Redis record exists" as the validation. So a leaked session token string was a bearer
- * credential with no signature needed, including on the portal's admin API gate (api-admin-gate -> decodeSession).
- *
- * THE RULE THIS MODULE ENFORCES: a cookie yields a session token ONLY after its signature checks out against
- * the auth secret. Every caller that turns a cookie into a token for the session store awaits this function.
- * lib/session-cookie-shape.ts stays classification-only and secret-free (it cannot verify, by construction).
- *
- *   ba-hmac  `{token}.{sig}` as Better Auth mints it (better-call signCookieValue): sig =
- *            base64(HMAC-SHA256(secret, token)), standard padding, 44 characters. Compared with
- *            crypto.timingSafeEqual over equal-length buffers.
- *   jws      legacy NextAuth-era cookie: jose jwtVerify with the same secret, then the sessionToken
- *            (or redisSessionId) claim.
- *   anything else, a missing secret, or a failed check -> null. Never throws.
- *
- * THE SECRET is the auth secret from getIDPClientConfig(), which resolves env-first (BETTER_AUTH_SECRET,
- * NEXTAUTH_SECRET, then IdP config; PAY-1460). The cookie HMAC key IS the auth secret, so the resolver and the
- * config loader cannot disagree about which secret signs sessions (BAPert 59034).
- */
-import { createHmac, timingSafeEqual } from 'crypto';
-import { jwtVerify, type JWTPayload } from 'jose';
-import { getIDPClientConfig } from '../lib/idp-client-config';
-import { extractSessionCookieValue, extractSessionTokenFromCookieValue } from '../lib/session-cookie-shape';
-
-/** Better Auth's signature: base64 of a 32-byte HMAC-SHA256, padded = 44 chars ending in '='. */
-const BA_SIGNATURE_LENGTH = 44;
-
-async function authSecret(): Promise<string | null> {
-  try {
-    const config = await getIDPClientConfig();
-    return config?.authSecret ? String(config.authSecret) : null;
-  } catch {
-    return null;
-  }
-}
-
-function verifyBaHmac(rawValue: string, secret: string): string | null {
-  const dot = rawValue.lastIndexOf('.');
-  if (dot < 1) return null;
-  const token = rawValue.slice(0, dot);
-  let signature = rawValue.slice(dot + 1);
-  if (signature.includes('%')) {
-    try {
-      signature = decodeURIComponent(signature);
-    } catch {
-      return null;
-    }
-  }
-  if (signature.length !== BA_SIGNATURE_LENGTH || !signature.endsWith('=')) return null;
-  const expected = createHmac('sha256', secret).update(token, 'utf8').digest('base64');
-  const a = Buffer.from(signature, 'utf8');
-  const b = Buffer.from(expected, 'utf8');
-  if (a.length !== b.length) return null;
-  return timingSafeEqual(a, b) ? token : null;
-}
-
-export interface VerifiedSessionCookie {
-  token: string;
-  shape: 'ba-hmac' | 'jws';
-  /** The verified JWS payload (jws shape only). */
-  payload?: JWTPayload;
-}
-
-async function verifyJws(rawValue: string, secret: string): Promise<VerifiedSessionCookie | null> {
-  try {
-    const { payload } = await jwtVerify(rawValue, new TextEncoder().encode(secret));
-    const claim = (payload as Record<string, unknown>).sessionToken ?? (payload as Record<string, unknown>).redisSessionId;
-    return typeof claim === 'string' && claim ? { token: claim, shape: 'jws', payload } : null;
-  } catch {
-    return null;
-  }
-}
-
-/** The verified session cookie (token, shape, JWS payload), or null unless its signature verifies. */
-export async function resolveVerifiedSessionCookie(rawValue: string | null | undefined): Promise<VerifiedSessionCookie | null> {
-  if (!rawValue) return null;
-  const shaped = extractSessionTokenFromCookieValue(rawValue);
-  if (!shaped) return null;
-  const secret = await authSecret();
-  if (!secret) return null;
-  if (shaped.shape === 'ba-hmac') {
-    const token = verifyBaHmac(rawValue, secret);
-    return token ? { token, shape: 'ba-hmac' } : null;
-  }
-  return verifyJws(rawValue, secret);
-}
-
-/** The session token carried by a raw session-cookie value, or null unless its signature verifies. */
-export async function resolveVerifiedSessionToken(rawValue: string | null | undefined): Promise<string | null> {
-  const verified = await resolveVerifiedSessionCookie(rawValue);
-  return verified ? verified.token : null;
-}
-
-/** Same, reading the session cookie (every name it is minted under, chunks joined) from a Request. */
-export async function resolveVerifiedSessionTokenFromRequest(request: Request): Promise<string | null> {
-  return resolveVerifiedSessionToken(extractSessionCookieValue(request));
-}
+/**
+ * PAY-1476 / card 372275 (R941 s1b) - THE ONE SHARED VERIFIED RESOLVER for a session token taken from a cookie.
+ *
+ * THE DEFECT (4.4.5, measured at the deployed portal by QAPert-NightHawk, mail 59030):
+ *   Module A  server/decode-session.ts  the ba-hmac branch took `{token}.{anything}` and used segment 0 unread.
+ *   Module B  server/auth.ts  Path B    took the token from ANY recognised shape and never verified anything;
+ *                                       a forged JWS resolved there too.
+ * Both then treated "a Redis record exists" as the validation. So a leaked session token string was a bearer
+ * credential with no signature needed, including on the portal's admin API gate (api-admin-gate -> decodeSession).
+ *
+ * THE RULE THIS MODULE ENFORCES: a cookie yields a session token ONLY after its signature checks out against
+ * the auth secret. Every caller that turns a cookie into a token for the session store awaits this function.
+ * lib/session-cookie-shape.ts stays classification-only and secret-free (it cannot verify, by construction).
+ *
+ *   ba-hmac  `{token}.{sig}` as Better Auth mints it (better-call signCookieValue): sig =
+ *            base64(HMAC-SHA256(secret, token)), standard padding, 44 characters. Compared with
+ *            crypto.timingSafeEqual over equal-length buffers.
+ *   jws      legacy NextAuth-era cookie: jose jwtVerify with the same secret, then the sessionToken
+ *            (or redisSessionId) claim.
+ *   anything else, a missing secret, or a failed check -> null. Never throws.
+ *
+ * THE SECRET is the auth secret from getIDPClientConfig(), which resolves env-first (BETTER_AUTH_SECRET,
+ * NEXTAUTH_SECRET, then IdP config; PAY-1460). The cookie HMAC key IS the auth secret, so the resolver and the
+ * config loader cannot disagree about which secret signs sessions (BAPert 59034).
+ */
+import { createHmac, timingSafeEqual } from 'crypto';
+import { jwtVerify, type JWTPayload } from 'jose';
+import { getIDPClientConfig } from '../lib/idp-client-config';
+import { extractSessionCookieValue, extractSessionTokenFromCookieValue } from '../lib/session-cookie-shape';
+
+/** Better Auth's signature: base64 of a 32-byte HMAC-SHA256, padded = 44 chars ending in '='. */
+const BA_SIGNATURE_LENGTH = 44;
+
+async function authSecret(): Promise<string | null> {
+  try {
+    const config = await getIDPClientConfig();
+    return config?.authSecret ? String(config.authSecret) : null;
+  } catch {
+    return null;
+  }
+}
+
+function verifyBaHmac(rawValue: string, secret: string): string | null {
+  const dot = rawValue.lastIndexOf('.');
+  if (dot < 1) return null;
+  const token = rawValue.slice(0, dot);
+  let signature = rawValue.slice(dot + 1);
+  if (signature.includes('%')) {
+    try {
+      signature = decodeURIComponent(signature);
+    } catch {
+      return null;
+    }
+  }
+  if (signature.length !== BA_SIGNATURE_LENGTH || !signature.endsWith('=')) return null;
+  const expected = createHmac('sha256', secret).update(token, 'utf8').digest('base64');
+  const a = Buffer.from(signature, 'utf8');
+  const b = Buffer.from(expected, 'utf8');
+  if (a.length !== b.length) return null;
+  return timingSafeEqual(a, b) ? token : null;
+}
+
+export interface VerifiedSessionCookie {
+  token: string;
+  shape: 'ba-hmac' | 'jws';
+  /** The verified JWS payload (jws shape only). */
+  payload?: JWTPayload;
+}
+
+async function verifyJws(rawValue: string, secret: string): Promise<VerifiedSessionCookie | null> {
+  try {
+    const { payload } = await jwtVerify(rawValue, new TextEncoder().encode(secret));
+    const claim = (payload as Record<string, unknown>).sessionToken ?? (payload as Record<string, unknown>).redisSessionId;
+    return typeof claim === 'string' && claim ? { token: claim, shape: 'jws', payload } : null;
+  } catch {
+    return null;
+  }
+}
+
+/** The verified session cookie (token, shape, JWS payload), or null unless its signature verifies. */
+export async function resolveVerifiedSessionCookie(rawValue: string | null | undefined): Promise<VerifiedSessionCookie | null> {
+  if (!rawValue) return null;
+  const shaped = extractSessionTokenFromCookieValue(rawValue);
+  if (!shaped) return null;
+  const secret = await authSecret();
+  if (!secret) return null;
+  if (shaped.shape === 'ba-hmac') {
+    const token = verifyBaHmac(rawValue, secret);
+    return token ? { token, shape: 'ba-hmac' } : null;
+  }
+  return verifyJws(rawValue, secret);
+}
+
+/** The session token carried by a raw session-cookie value, or null unless its signature verifies. */
+export async function resolveVerifiedSessionToken(rawValue: string | null | undefined): Promise<string | null> {
+  const verified = await resolveVerifiedSessionCookie(rawValue);
+  return verified ? verified.token : null;
+}
+
+/** Same, reading the session cookie (every name it is minted under, chunks joined) from a Request. */
+export async function resolveVerifiedSessionTokenFromRequest(request: Request): Promise<string | null> {
+  return resolveVerifiedSessionToken(extractSessionCookieValue(request));
+}

package/src/server/with-auth.ts

@@ -1,93 +1,93 @@
-/**
- * Server-Side Auth Wrapper for API Routes & Server Actions
- *
- * Wraps route handlers with session validation. Uses direct Redis reads.
- * Zero HTTP self-fetches.
- *
- * Usage:
- *   export const GET = withAuth(async (req, auth) => {
- *     return NextResponse.json({ userId: auth.userId });
- *   });
- *
- *   // With role requirement:
- *   export const POST = withAuth(async (req, auth) => { ... }, { requiredRoles: ['admin'] });
- */
-
-import 'server-only';
-import { NextRequest, NextResponse } from 'next/server';
-import { decodeSession } from './decode-session';
-import type { SessionData } from '../lib/session-store';
-
-// =============================================================================
-// TYPES
-// =============================================================================
-
-export interface ApiAuthResult {
-  userId: string;
-  email: string;
-  roles: string[];
-  sessionData: SessionData;
-  accessToken?: string;
-}
-
-export interface WithAuthOptions {
-  /** Roles required to access the route (any match = allowed) */
-  requiredRoles?: string[];
-}
-
-// =============================================================================
-// MAIN
-// =============================================================================
-
-/**
- * Wrap an API route handler with auth validation.
- * Returns 401 if not authenticated, 403 if missing required roles.
- */
-export function withAuth(
-  handler: (req: NextRequest, auth: ApiAuthResult) => Promise<NextResponse>,
-  options?: WithAuthOptions
-): (req: NextRequest) => Promise<NextResponse> {
-  return async (req: NextRequest): Promise<NextResponse> => {
-    try {
-      // Decode session from request cookies (direct Redis, no self-fetch)
-      const decoded = await decodeSession(req.cookies);
-
-      if (!decoded) {
-        return NextResponse.json(
-          { error: 'Unauthorized', message: 'No valid session' },
-          { status: 401 }
-        );
-      }
-
-      const { sessionData } = decoded;
-
-      // Check required roles
-      if (options?.requiredRoles && options.requiredRoles.length > 0) {
-        const userRoles = sessionData.roles || [];
-        const hasRole = options.requiredRoles.some(r => userRoles.includes(r));
-        if (!hasRole) {
-          return NextResponse.json(
-            { error: 'Forbidden', message: 'Insufficient permissions' },
-            { status: 403 }
-          );
-        }
-      }
-
-      const auth: ApiAuthResult = {
-        userId: sessionData.userId,
-        email: sessionData.email,
-        roles: sessionData.roles || [],
-        sessionData,
-        accessToken: sessionData.idpAccessToken,
-      };
-
-      return handler(req, auth);
-    } catch (error) {
-      console.error('[WITH-AUTH] Error:', error instanceof Error ? error.message : String(error));
-      return NextResponse.json(
-        { error: 'Internal Server Error', message: 'Auth check failed' },
-        { status: 500 }
-      );
-    }
-  };
-}
+/**
+ * Server-Side Auth Wrapper for API Routes & Server Actions
+ *
+ * Wraps route handlers with session validation. Uses direct Redis reads.
+ * Zero HTTP self-fetches.
+ *
+ * Usage:
+ *   export const GET = withAuth(async (req, auth) => {
+ *     return NextResponse.json({ userId: auth.userId });
+ *   });
+ *
+ *   // With role requirement:
+ *   export const POST = withAuth(async (req, auth) => { ... }, { requiredRoles: ['admin'] });
+ */
+
+import 'server-only';
+import { NextRequest, NextResponse } from 'next/server';
+import { decodeSession } from './decode-session';
+import type { SessionData } from '../lib/session-store';
+
+// =============================================================================
+// TYPES
+// =============================================================================
+
+export interface ApiAuthResult {
+  userId: string;
+  email: string;
+  roles: string[];
+  sessionData: SessionData;
+  accessToken?: string;
+}
+
+export interface WithAuthOptions {
+  /** Roles required to access the route (any match = allowed) */
+  requiredRoles?: string[];
+}
+
+// =============================================================================
+// MAIN
+// =============================================================================
+
+/**
+ * Wrap an API route handler with auth validation.
+ * Returns 401 if not authenticated, 403 if missing required roles.
+ */
+export function withAuth(
+  handler: (req: NextRequest, auth: ApiAuthResult) => Promise<NextResponse>,
+  options?: WithAuthOptions
+): (req: NextRequest) => Promise<NextResponse> {
+  return async (req: NextRequest): Promise<NextResponse> => {
+    try {
+      // Decode session from request cookies (direct Redis, no self-fetch)
+      const decoded = await decodeSession(req.cookies);
+
+      if (!decoded) {
+        return NextResponse.json(
+          { error: 'Unauthorized', message: 'No valid session' },
+          { status: 401 }
+        );
+      }
+
+      const { sessionData } = decoded;
+
+      // Check required roles
+      if (options?.requiredRoles && options.requiredRoles.length > 0) {
+        const userRoles = sessionData.roles || [];
+        const hasRole = options.requiredRoles.some(r => userRoles.includes(r));
+        if (!hasRole) {
+          return NextResponse.json(
+            { error: 'Forbidden', message: 'Insufficient permissions' },
+            { status: 403 }
+          );
+        }
+      }
+
+      const auth: ApiAuthResult = {
+        userId: sessionData.userId,
+        email: sessionData.email,
+        roles: sessionData.roles || [],
+        sessionData,
+        accessToken: sessionData.idpAccessToken,
+      };
+
+      return handler(req, auth);
+    } catch (error) {
+      console.error('[WITH-AUTH] Error:', error instanceof Error ? error.message : String(error));
+      return NextResponse.json(
+        { error: 'Internal Server Error', message: 'Auth check failed' },
+        { status: 500 }
+      );
+    }
+  };
+}