@payez/next-mvp 4.8.1 → 4.8.2

package/src/api-handlers/auth/jwks.ts

@@ -1,31 +1,31 @@
-import { NextRequest, NextResponse } from 'next/server';
-import { ENV_CONFIG, API_ENDPOINTS } from '../../config/env';
-import { logger } from '../../config/logger';
-import { assertAbsoluteIdpUrl } from '../../lib/idp-url-guard';
-
-export async function GET(_req: NextRequest) {
-  try {
-    const url = `${ENV_CONFIG.IDP_URL}${API_ENDPOINTS.externalAuth.jwks}`;
-    // Direct fetch - the idpFetchJSON guard is not on this path.
-    assertAbsoluteIdpUrl(url);
-    const res = await fetch(url, { headers: { 'Accept': 'application/json' } });
-    const bodyText = await res.text();
-    try {
-      const json = JSON.parse(bodyText);
-      return NextResponse.json(json, { status: res.status });
-    } catch (e) {
-      // PAY-1427: no body slice - a non-JSON upstream is an error/proxy page of unknown content.
-      logger.error('[AUTH_JWKS] Upstream returned non-JSON', { status: res.status, bodyLength: bodyText.length, contentType: res.headers.get('content-type') });
-      return NextResponse.json({ error: 'Invalid JWKS response' }, { status: 502 });
-    }
-  } catch (error) {
-    // This catch DISCARDED `error` entirely and answered a bare 502, so a config
-    // fault and a dead upstream were indistinguishable - and the guard's named
-    // message above would have been swallowed with them. The 502 body is left
-    // unchanged (it is a public response shape); the cause now reaches the log.
-    logger.error('[AUTH_JWKS] Failed to fetch JWKS', {
-      message: error instanceof Error ? error.message : String(error),
-    });
-    return NextResponse.json({ error: 'Failed to fetch JWKS' }, { status: 502 });
-  }
-}
+import { NextRequest, NextResponse } from 'next/server';
+import { ENV_CONFIG, API_ENDPOINTS } from '../../config/env';
+import { logger } from '../../config/logger';
+import { assertAbsoluteIdpUrl } from '../../lib/idp-url-guard';
+
+export async function GET(_req: NextRequest) {
+  try {
+    const url = `${ENV_CONFIG.IDP_URL}${API_ENDPOINTS.externalAuth.jwks}`;
+    // Direct fetch - the idpFetchJSON guard is not on this path.
+    assertAbsoluteIdpUrl(url);
+    const res = await fetch(url, { headers: { 'Accept': 'application/json' } });
+    const bodyText = await res.text();
+    try {
+      const json = JSON.parse(bodyText);
+      return NextResponse.json(json, { status: res.status });
+    } catch (e) {
+      // PAY-1427: no body slice - a non-JSON upstream is an error/proxy page of unknown content.
+      logger.error('[AUTH_JWKS] Upstream returned non-JSON', { status: res.status, bodyLength: bodyText.length, contentType: res.headers.get('content-type') });
+      return NextResponse.json({ error: 'Invalid JWKS response' }, { status: 502 });
+    }
+  } catch (error) {
+    // This catch DISCARDED `error` entirely and answered a bare 502, so a config
+    // fault and a dead upstream were indistinguishable - and the guard's named
+    // message above would have been swallowed with them. The 502 body is left
+    // unchanged (it is a public response shape); the cause now reaches the log.
+    logger.error('[AUTH_JWKS] Failed to fetch JWKS', {
+      message: error instanceof Error ? error.message : String(error),
+    });
+    return NextResponse.json({ error: 'Failed to fetch JWKS' }, { status: 502 });
+  }
+}

package/src/api-handlers/auth/login.ts

@@ -1,252 +1,252 @@
-/**
- * Authentication Login API Handler
- *
- * Handles user authentication against the external IDP service.
- * This handler is designed to be imported and used by Next.js applications
- * using the @payez/next-mvp package.
- *
- * @version 2.0
- * @requires No authentication (public endpoint)
- */
-
-import { NextRequest, NextResponse } from 'next/server';
-
-// Add protection headers to all responses
-function addSecurityHeaders(response: NextResponse) {
-  // Content Security Policy - restrictive for auth endpoints
-  response.headers.set('Content-Security-Policy', "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';");
-
-  // Prevent clickjacking
-  response.headers.set('X-Frame-Options', 'DENY');
-
-  // Prevent MIME type sniffing
-  response.headers.set('X-Content-Type-Options', 'nosniff');
-
-  // Enable XSS protection
-  response.headers.set('X-XSS-Protection', '1; mode=block');
-
-  // Strict transport security for HTTPS
-  response.headers.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains; preload');
-
-  // Referrer policy
-  response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
-
-  // Permissions policy
-  response.headers.set('Permissions-Policy', 'geolocation=(), microphone=(), camera=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()');
-
-  // Cache control for sensitive auth endpoints
-  response.headers.set('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
-  response.headers.set('Pragma', 'no-cache');
-  response.headers.set('Expires', '0');
-
-  return response;
-}
-
-interface LoginRequest {
-  username_or_email: string;
-  password: string;
-  client_id?: string;
-  client_type?: string;
-  two_factor_code?: string;
-  two_factor_recovery_code?: string;
-}
-
-interface LoginConfig {
-  idpBaseUrl: string;
-  clientId: string;
-  loginEndpoint?: string;
-  clientType?: string; // "partner" or "idp", defaults to "partner" for CryptAply
-}
-
-/**
- * Creates a login handler for Next.js API routes
- *
- * @param config Configuration for IDP connection
- * @returns Next.js POST handler function
- *
- * @example
- * ```typescript
- * // In your app's /app/api/auth/login/route.ts
- * import { createLoginHandler } from '@payez/next-mvp/api-handlers/auth/login';
- *
- * export const POST = createLoginHandler({
- *   idpBaseUrl: process.env.IDP_URL!,
- *   clientId: process.env.CLIENT_ID!,
- *   loginEndpoint: '/api/ExternalAuth/login'
- * });
- * ```
- */
-export function createLoginHandler(config: LoginConfig) {
-  const { idpBaseUrl, clientId, loginEndpoint = '/api/ExternalAuth/login', clientType = 'partner' } = config;
-
-  return async function POST(req: NextRequest) {
-    let body: LoginRequest;
-
-    try {
-      body = await req.json();
-    } catch (parseError) {
-      return NextResponse.json(
-        { error: 'Invalid JSON format' },
-        { status: 400 }
-      );
-    }
-
-    const { username_or_email, password, client_type, two_factor_code, two_factor_recovery_code } = body;
-
-    // Validate required fields
-    if (!username_or_email || typeof username_or_email !== 'string' || username_or_email.trim() === '') {
-      return NextResponse.json(
-        { error: 'username_or_email is required' },
-        { status: 400 }
-      );
-    }
-
-    if (!password || typeof password !== 'string' || password.trim() === '') {
-      return NextResponse.json(
-        { error: 'Password is required' },
-        { status: 400 }
-      );
-    }
-
-    const idpUrl = `${idpBaseUrl}${loginEndpoint}`;
-    const payload: any = {
-      username_or_email,
-      password,
-      client_id: clientId,
-      client_type: client_type || clientType // Use provided client_type or config default
-    };
-
-    // Add optional 2FA fields if provided
-    if (two_factor_code) {
-      payload.two_factor_code = two_factor_code;
-    }
-    if (two_factor_recovery_code) {
-      payload.two_factor_recovery_code = two_factor_recovery_code;
-    }
-
-    // Extract client headers for forwarding to IDP
-    const clientHeaders: Record<string, string> = {};
-
-    // Forward client IP if available.
-    // 269334 / R21: forward the FULL chain, do NOT collapse to [0] - see the same
-    // change in lib/idp-fetch.ts. [0] is the forgeable client-supplied entry and
-    // collapsing to it destroys the chain the IDP's trusted-hop logic reads.
-    const clientIp = req.headers.get('x-forwarded-for') || req.headers.get('x-real-ip');
-    if (clientIp) {
-      clientHeaders['X-Forwarded-For'] = clientIp;
-    }
-
-    // Forward user agent if available
-    const userAgent = req.headers.get('user-agent');
-    if (userAgent) {
-      clientHeaders['User-Agent'] = userAgent;
-    }
-
-    const headers = {
-      'Content-Type': 'application/json',
-      'Accept': 'application/json',
-      'Cookie': 'X-Device-Id=payez-PayEz-6c8201c35c1b44c9b2e823b36b95a718',
-      ...clientHeaders
-    };
-
-    try {
-      const backendResponse = await fetch(idpUrl, {
-        method: 'POST',
-        headers,
-        body: JSON.stringify(payload),
-      });
-
-      const rawText = await backendResponse.text();
-      let data: any;
-
-      try {
-        data = JSON.parse(rawText);
-      } catch (jsonError) {
-        // PAY-1424: never the raw body - a non-JSON IDP/proxy error page can echo request
-        // context (credentials) back. Status, length and content-type are enough to triage.
-        console.error('[LOGIN] IDP returned non-JSON response', {
-          status: backendResponse.status,
-          bodyLength: rawText.length,
-          contentType: backendResponse.headers.get('content-type'),
-        });
-        return NextResponse.json(
-          { error: 'Invalid response from authentication service' },
-          { status: 502 }
-        );
-      }
-
-      if (!backendResponse.ok) {
-        // Handle rate limiting specifically
-        if (backendResponse.status === 429) {
-          const retryAfter = backendResponse.headers.get('retry-after');
-          const retryAfterSeconds = retryAfter ? parseInt(retryAfter) : 60;
-
-          return addSecurityHeaders(NextResponse.json({
-            success: false,
-            error: 'RATE_LIMIT_EXCEEDED',
-            message: 'Too many login attempts. Please try again later.',
-            retryAfter: retryAfterSeconds
-          }, { status: 429 }));
-        }
-
-        // Pass through error from IDP
-        // PAY-1424: shape only, never the envelope contents.
-        console.error('[LOGIN] IDP service error', {
-          status: backendResponse.status,
-          bodyKeys: data && typeof data === 'object' ? Object.keys(data) : undefined,
-          errorKeys: data?.error && typeof data?.error === 'object' ? Object.keys(data?.error) : undefined,
-        });
-        return addSecurityHeaders(NextResponse.json(data, { status: backendResponse.status }));
-      }
-
-      if (!data.success) {
-        // IDP returned a canonical error envelope with HTTP 200
-        // PAY-1424: shape only, never the envelope contents.
-        console.error('[LOGIN] IDP authentication failure', {
-          bodyKeys: data && typeof data === 'object' ? Object.keys(data) : undefined,
-          errorKeys: data?.error && typeof data?.error === 'object' ? Object.keys(data?.error) : undefined,
-        });
-        return addSecurityHeaders(NextResponse.json(data, { status: 200 }));
-      }
-
-      // Normalize response shape for NextAuth authorize()
-      const normalized = {
-        success: data?.success === true,
-        result: (data?.data && data?.data?.result) ? data.data.result : (data?.result ?? data),
-        // Preserve original payload for debugging/compatibility
-        original: data
-      };
-
-      return addSecurityHeaders(NextResponse.json(normalized as any));
-
-    } catch (error) {
-      // Handle network and other errors
-      console.error('[LOGIN] FETCH FAILED:', {
-        error: error instanceof Error ? error.message : String(error),
-        idpUrl
-      });
-
-      if (error instanceof Error && error.message.includes('fetch')) {
-        return NextResponse.json(
-          { error: 'Unable to connect to authentication service' },
-          { status: 503 }
-        );
-      }
-
-      return NextResponse.json(
-        { error: 'An unexpected error occurred during login' },
-        { status: 500 }
-      );
-    }
-  };
-}
-
-/**
- * Default export for backward compatibility
- * Requires environment variables: IDP_URL, CLIENT_ID
- */
-export const POST = createLoginHandler({
-  idpBaseUrl: process.env.IDP_URL!,
-  clientId: process.env.CLIENT_ID || 'payez_default_client',
-  loginEndpoint: '/api/ExternalAuth/login'
-});
+/**
+ * Authentication Login API Handler
+ *
+ * Handles user authentication against the external IDP service.
+ * This handler is designed to be imported and used by Next.js applications
+ * using the @payez/next-mvp package.
+ *
+ * @version 2.0
+ * @requires No authentication (public endpoint)
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+
+// Add protection headers to all responses
+function addSecurityHeaders(response: NextResponse) {
+  // Content Security Policy - restrictive for auth endpoints
+  response.headers.set('Content-Security-Policy', "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';");
+
+  // Prevent clickjacking
+  response.headers.set('X-Frame-Options', 'DENY');
+
+  // Prevent MIME type sniffing
+  response.headers.set('X-Content-Type-Options', 'nosniff');
+
+  // Enable XSS protection
+  response.headers.set('X-XSS-Protection', '1; mode=block');
+
+  // Strict transport security for HTTPS
+  response.headers.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains; preload');
+
+  // Referrer policy
+  response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
+
+  // Permissions policy
+  response.headers.set('Permissions-Policy', 'geolocation=(), microphone=(), camera=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()');
+
+  // Cache control for sensitive auth endpoints
+  response.headers.set('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
+  response.headers.set('Pragma', 'no-cache');
+  response.headers.set('Expires', '0');
+
+  return response;
+}
+
+interface LoginRequest {
+  username_or_email: string;
+  password: string;
+  client_id?: string;
+  client_type?: string;
+  two_factor_code?: string;
+  two_factor_recovery_code?: string;
+}
+
+interface LoginConfig {
+  idpBaseUrl: string;
+  clientId: string;
+  loginEndpoint?: string;
+  clientType?: string; // "partner" or "idp", defaults to "partner" for CryptAply
+}
+
+/**
+ * Creates a login handler for Next.js API routes
+ *
+ * @param config Configuration for IDP connection
+ * @returns Next.js POST handler function
+ *
+ * @example
+ * ```typescript
+ * // In your app's /app/api/auth/login/route.ts
+ * import { createLoginHandler } from '@payez/next-mvp/api-handlers/auth/login';
+ *
+ * export const POST = createLoginHandler({
+ *   idpBaseUrl: process.env.IDP_URL!,
+ *   clientId: process.env.CLIENT_ID!,
+ *   loginEndpoint: '/api/ExternalAuth/login'
+ * });
+ * ```
+ */
+export function createLoginHandler(config: LoginConfig) {
+  const { idpBaseUrl, clientId, loginEndpoint = '/api/ExternalAuth/login', clientType = 'partner' } = config;
+
+  return async function POST(req: NextRequest) {
+    let body: LoginRequest;
+
+    try {
+      body = await req.json();
+    } catch (parseError) {
+      return NextResponse.json(
+        { error: 'Invalid JSON format' },
+        { status: 400 }
+      );
+    }
+
+    const { username_or_email, password, client_type, two_factor_code, two_factor_recovery_code } = body;
+
+    // Validate required fields
+    if (!username_or_email || typeof username_or_email !== 'string' || username_or_email.trim() === '') {
+      return NextResponse.json(
+        { error: 'username_or_email is required' },
+        { status: 400 }
+      );
+    }
+
+    if (!password || typeof password !== 'string' || password.trim() === '') {
+      return NextResponse.json(
+        { error: 'Password is required' },
+        { status: 400 }
+      );
+    }
+
+    const idpUrl = `${idpBaseUrl}${loginEndpoint}`;
+    const payload: any = {
+      username_or_email,
+      password,
+      client_id: clientId,
+      client_type: client_type || clientType // Use provided client_type or config default
+    };
+
+    // Add optional 2FA fields if provided
+    if (two_factor_code) {
+      payload.two_factor_code = two_factor_code;
+    }
+    if (two_factor_recovery_code) {
+      payload.two_factor_recovery_code = two_factor_recovery_code;
+    }
+
+    // Extract client headers for forwarding to IDP
+    const clientHeaders: Record<string, string> = {};
+
+    // Forward client IP if available.
+    // 269334 / R21: forward the FULL chain, do NOT collapse to [0] - see the same
+    // change in lib/idp-fetch.ts. [0] is the forgeable client-supplied entry and
+    // collapsing to it destroys the chain the IDP's trusted-hop logic reads.
+    const clientIp = req.headers.get('x-forwarded-for') || req.headers.get('x-real-ip');
+    if (clientIp) {
+      clientHeaders['X-Forwarded-For'] = clientIp;
+    }
+
+    // Forward user agent if available
+    const userAgent = req.headers.get('user-agent');
+    if (userAgent) {
+      clientHeaders['User-Agent'] = userAgent;
+    }
+
+    const headers = {
+      'Content-Type': 'application/json',
+      'Accept': 'application/json',
+      'Cookie': 'X-Device-Id=payez-PayEz-6c8201c35c1b44c9b2e823b36b95a718',
+      ...clientHeaders
+    };
+
+    try {
+      const backendResponse = await fetch(idpUrl, {
+        method: 'POST',
+        headers,
+        body: JSON.stringify(payload),
+      });
+
+      const rawText = await backendResponse.text();
+      let data: any;
+
+      try {
+        data = JSON.parse(rawText);
+      } catch (jsonError) {
+        // PAY-1424: never the raw body - a non-JSON IDP/proxy error page can echo request
+        // context (credentials) back. Status, length and content-type are enough to triage.
+        console.error('[LOGIN] IDP returned non-JSON response', {
+          status: backendResponse.status,
+          bodyLength: rawText.length,
+          contentType: backendResponse.headers.get('content-type'),
+        });
+        return NextResponse.json(
+          { error: 'Invalid response from authentication service' },
+          { status: 502 }
+        );
+      }
+
+      if (!backendResponse.ok) {
+        // Handle rate limiting specifically
+        if (backendResponse.status === 429) {
+          const retryAfter = backendResponse.headers.get('retry-after');
+          const retryAfterSeconds = retryAfter ? parseInt(retryAfter) : 60;
+
+          return addSecurityHeaders(NextResponse.json({
+            success: false,
+            error: 'RATE_LIMIT_EXCEEDED',
+            message: 'Too many login attempts. Please try again later.',
+            retryAfter: retryAfterSeconds
+          }, { status: 429 }));
+        }
+
+        // Pass through error from IDP
+        // PAY-1424: shape only, never the envelope contents.
+        console.error('[LOGIN] IDP service error', {
+          status: backendResponse.status,
+          bodyKeys: data && typeof data === 'object' ? Object.keys(data) : undefined,
+          errorKeys: data?.error && typeof data?.error === 'object' ? Object.keys(data?.error) : undefined,
+        });
+        return addSecurityHeaders(NextResponse.json(data, { status: backendResponse.status }));
+      }
+
+      if (!data.success) {
+        // IDP returned a canonical error envelope with HTTP 200
+        // PAY-1424: shape only, never the envelope contents.
+        console.error('[LOGIN] IDP authentication failure', {
+          bodyKeys: data && typeof data === 'object' ? Object.keys(data) : undefined,
+          errorKeys: data?.error && typeof data?.error === 'object' ? Object.keys(data?.error) : undefined,
+        });
+        return addSecurityHeaders(NextResponse.json(data, { status: 200 }));
+      }
+
+      // Normalize response shape for NextAuth authorize()
+      const normalized = {
+        success: data?.success === true,
+        result: (data?.data && data?.data?.result) ? data.data.result : (data?.result ?? data),
+        // Preserve original payload for debugging/compatibility
+        original: data
+      };
+
+      return addSecurityHeaders(NextResponse.json(normalized as any));
+
+    } catch (error) {
+      // Handle network and other errors
+      console.error('[LOGIN] FETCH FAILED:', {
+        error: error instanceof Error ? error.message : String(error),
+        idpUrl
+      });
+
+      if (error instanceof Error && error.message.includes('fetch')) {
+        return NextResponse.json(
+          { error: 'Unable to connect to authentication service' },
+          { status: 503 }
+        );
+      }
+
+      return NextResponse.json(
+        { error: 'An unexpected error occurred during login' },
+        { status: 500 }
+      );
+    }
+  };
+}
+
+/**
+ * Default export for backward compatibility
+ * Requires environment variables: IDP_URL, CLIENT_ID
+ */
+export const POST = createLoginHandler({
+  idpBaseUrl: process.env.IDP_URL!,
+  clientId: process.env.CLIENT_ID || 'payez_default_client',
+  loginEndpoint: '/api/ExternalAuth/login'
+});