@payez/next-mvp 4.8.1 → 4.8.2

package/src/api-handlers/oauth/resume.ts

@@ -1,182 +1,182 @@
-/**
- * GET /api/oauth/resume?return_url=<IdP authorize request> - moved from VibeID-Customer-Portal src/app/api/oauth/resume/route.ts
- * (PAY-1500), PAY-2302 cut 2.
- *
- * The only place an absolute post-2FA destination is followed, and only after checking it is this deployment's IdP
- * authorize endpoint (lib/authorize-resume). Everything else is refused to a same-origin page: this route must never
- * become an open redirect.
- *
- * The validation base is the app's configured IDP_URL, never anything derived from the request. If IDP_URL is unset
- * or not a URL the answer is the refusal, not a throw and not a fallback to the request's own origin (fail closed).
- * INTERNAL_IDP_URL is deliberately NOT used: the authorize URL is the PUBLIC IdP's (it is also what the registered client uses).
- *
- * PAY-2319 (4.7.1): WHERE a refusal goes is configurable and the default is the login page every generated app has
- * (`/account-auth/login?error=AUTHORIZE_RESUME_REFUSED`). 4.7.0 hard-coded the portal's `/sign-in`, which a generated app does not
- * have: the middleware forwarded it to the login page with the error code dropped and, after sign-in, to a 404.
- * An app (the portal has /sign-in) passes its own location through createOAuthResumeHandler.
- *
- * 4.7.5 (PAY-2305): THE AUTHORIZE CALL IS MADE HERE, SERVER-SIDE. Core's /api/oauth/authorize identifies a user only from an
- * `Authorization: Bearer` header (JwtMiddleware reads no cookie), so sending the BROWSER to it (4.7.0-4.7.4) could never produce a
- * code. This route now
- *   1. validates return_url and REBUILDS the authorize URL from constants (IDP_URL origin, fixed path, this app's CLIENT_ID and
- *      registered redirect_uri); only code_challenge (S256), state and scope come from return_url, each validated;
- *   2. requires a same-site navigation, a browser that STARTED the flow (better-auth's oauth_state cookie) and the signed-in app session;
- *   3. calls authorize with the user's IdP access token (redirect: 'manual', timeout; the token goes only to the IDP_URL origin and
- *      is never logged);
- *   4. accepts ONLY a redirect to the registered redirect_uri carrying a code and the state it sent, and relays it to the browser
- *      as a RELATIVE path+query rebuilt from those two values.
- * Anything else (IdP sends the user to login / 2FA enrolment / an error, no session, refresh fails, IdP unreachable) is the
- * refusal. Nothing is retried or followed.
- */
-import { buildServerAuthorizeRequest, hasOAuthStateCookie, isSameSiteResume, relayRegisteredCallback } from '../../lib/authorize-resume';
-import { resolveIdpRedirectUri } from '../../auth/idp-oauth';
-
-export const DEFAULT_REFUSAL_LOCATION = '/account-auth/login?error=AUTHORIZE_RESUME_REFUSED';
-
-export interface OAuthResumeDeps {
-  /** Test seam. Default: global fetch. */
-  fetch?: typeof fetch;
-  /** Test seam. Default: the signed-in app session's IdP access token (one refresh attempt when near expiry), else null. */
-  resolveAccessToken?: (request: Request) => Promise<string | null>;
-  /** Test seam. Default: BETTER_AUTH_URL, else the IdP client config's baseClientUrl, else http://localhost:$PORT (the SAME chain the provider config uses). */
-  appBaseUrl?: () => Promise<string>;
-}
-
-export interface OAuthResumeOptions {
-  /** Same-origin location a refused request is sent to. Must start with a single "/" (no //host, no backslash, no scheme). */
-  refusalLocation?: string;
-  deps?: OAuthResumeDeps;
-}
-
-/** A relative, same-origin location only: the refusal must never itself become an open redirect. */
-function assertRelativeLocation(loc: string): string {
-  const ok = typeof loc === 'string' && loc.startsWith('/') && !loc.startsWith('//') && !loc.startsWith('/\\') && !/\s/.test(loc);
-  if (!ok) {
-    throw new TypeError(`createOAuthResumeHandler: refusalLocation must be a same-origin path starting with a single "/", got ${JSON.stringify(loc)}`);
-  }
-  return loc;
-}
-
-const AUTHORIZE_TIMEOUT_MS = 8000;
-
-/** Cookie header -> the `{ get(name) }` shape decodeSession wants (NextRequest.cookies). */
-function cookieJar(header: string | null): { get: (name: string) => { value: string } | undefined } {
-  const map = new Map<string, string>();
-  for (const part of (header ?? '').split(';')) {
-    const i = part.indexOf('=');
-    if (i < 1) continue;
-    const name = part.slice(0, i).trim();
-    let value = part.slice(i + 1).trim();
-    try {
-      value = decodeURIComponent(value);
-    } catch {
-      /* keep the raw value */
-    }
-    if (!map.has(name)) map.set(name, value);
-  }
-  return { get: (name) => (map.has(name) ? { value: map.get(name)! } : undefined) };
-}
-
-async function defaultResolveAccessToken(request: Request): Promise<string | null> {
-  const { decodeSession } = await import('../../server/decode-session');
-  const decoded = await decodeSession(cookieJar(request.headers.get('cookie')));
-  const sessionToken = (decoded?.jwtPayload?.sessionToken || decoded?.jwtPayload?.redisSessionId) as string | undefined;
-  if (!sessionToken) return null;
-  const { ensureFreshAccessToken } = await import('../../lib/ensure-fresh-access-token');
-  const fresh = await ensureFreshAccessToken(sessionToken, {
-    idpBaseUrl: process.env.IDP_URL as string,
-    clientId: process.env.CLIENT_ID as string,
-  });
-  return fresh.ok ? fresh.accessToken : null;
-}
-
-async function defaultAppBaseUrl(): Promise<string> {
-  if (process.env.BETTER_AUTH_URL) return process.env.BETTER_AUTH_URL;
-  try {
-    const { getIDPClientConfig } = await import('../../lib/idp-client-config');
-    const cfg = await getIDPClientConfig();
-    if (cfg?.baseClientUrl) return cfg.baseClientUrl;
-  } catch {
-    /* fall through to the local default, exactly as createBetterAuthInstance does */
-  }
-  return `http://localhost:${process.env.PORT || '3000'}`;
-}
-
-export function createOAuthResumeHandler(options: OAuthResumeOptions = {}): (request: Request) => Promise<Response> {
-  const refusalLocation = assertRelativeLocation(options.refusalLocation ?? DEFAULT_REFUSAL_LOCATION);
-  const fetchFn = options.deps?.fetch ?? ((...a: Parameters<typeof fetch>) => fetch(...a));
-  const resolveAccessToken = options.deps?.resolveAccessToken ?? defaultResolveAccessToken;
-  const appBaseUrl = options.deps?.appBaseUrl ?? defaultAppBaseUrl;
-
-  // RELATIVE Location on purpose: in a container request.url is the bind address (http://0.0.0.0:8080), so
-  // new URL(path, request.url) would send the browser to a dead host (kb 3463/5571; QAPert 59254 F1).
-  const refuse = (why: string): Response => {
-    console.warn(`[oauth-resume] AUTHORIZE_RESUME outcome=refused reason=${why}`);
-    return new Response(null, { status: 302, headers: { location: refusalLocation, 'cache-control': 'no-store' } });
-  };
-
-  return async function GET(request: Request): Promise<Response> {
-    const idpBase = process.env.IDP_URL;
-    const clientId = process.env.CLIENT_ID;
-    if (!idpBase || !clientId) return refuse('not-configured');
-
-    let redirectUri: string;
-    try {
-      redirectUri = resolveIdpRedirectUri(await appBaseUrl());
-    } catch {
-      return refuse('no-app-base');
-    }
-
-    const built = buildServerAuthorizeRequest(new URL(request.url).searchParams.get('return_url'), {
-      idpBaseUrl: idpBase,
-      clientId,
-      redirectUri,
-    });
-    if (!built) return refuse('return_url');
-
-    let appOrigin: string;
-    try {
-      appOrigin = new URL(redirectUri).origin;
-    } catch {
-      return refuse('bad-redirect-uri');
-    }
-    if (!isSameSiteResume(request.headers, appOrigin)) return refuse('not-same-site');
-    if (!hasOAuthStateCookie(request.headers.get('cookie'))) return refuse('no-oauth-state'); // this browser never started the flow
-
-    let accessToken: string | null = null;
-    try {
-      accessToken = await resolveAccessToken(request);
-    } catch {
-      accessToken = null;
-    }
-    if (!accessToken) return refuse('no-session');
-
-    const forwarded: Record<string, string> = {};
-    const ua = request.headers.get('user-agent');
-    if (ua) forwarded['User-Agent'] = ua;
-    const xff = request.headers.get('x-forwarded-for') || request.headers.get('x-real-ip');
-    if (xff) forwarded['X-Forwarded-For'] = xff;
-    const device = request.headers.get('x-device-id');
-    if (device) forwarded['X-Device-ID'] = device;
-
-    let res: Response;
-    try {
-      res = await fetchFn(built.url, {
-        method: 'GET',
-        headers: { ...forwarded, Accept: 'application/json', Authorization: `Bearer ${accessToken}` },
-        redirect: 'manual', // the Bearer header is never carried to a second URL
-        signal: AbortSignal.timeout(AUTHORIZE_TIMEOUT_MS),
-      });
-    } catch {
-      return refuse('idp-unreachable');
-    }
-
-    const relay = relayRegisteredCallback(res.status, res.headers.get('location'), redirectUri, built.state);
-    // Status only in the log: the Location can carry a code or a return_url.
-    if (!relay) return refuse(`idp-answered-${res.status}`);
-    console.log('[oauth-resume] AUTHORIZE_RESUME outcome=code-issued');
-    return new Response(null, { status: 302, headers: { location: relay, 'cache-control': 'no-store' } });
-  };
-}
-
-export const GET = createOAuthResumeHandler();
+/**
+ * GET /api/oauth/resume?return_url=<IdP authorize request> - moved from VibeID-Customer-Portal src/app/api/oauth/resume/route.ts
+ * (PAY-1500), PAY-2302 cut 2.
+ *
+ * The only place an absolute post-2FA destination is followed, and only after checking it is this deployment's IdP
+ * authorize endpoint (lib/authorize-resume). Everything else is refused to a same-origin page: this route must never
+ * become an open redirect.
+ *
+ * The validation base is the app's configured IDP_URL, never anything derived from the request. If IDP_URL is unset
+ * or not a URL the answer is the refusal, not a throw and not a fallback to the request's own origin (fail closed).
+ * INTERNAL_IDP_URL is deliberately NOT used: the authorize URL is the PUBLIC IdP's (it is also what the registered client uses).
+ *
+ * PAY-2319 (4.7.1): WHERE a refusal goes is configurable and the default is the login page every generated app has
+ * (`/account-auth/login?error=AUTHORIZE_RESUME_REFUSED`). 4.7.0 hard-coded the portal's `/sign-in`, which a generated app does not
+ * have: the middleware forwarded it to the login page with the error code dropped and, after sign-in, to a 404.
+ * An app (the portal has /sign-in) passes its own location through createOAuthResumeHandler.
+ *
+ * 4.7.5 (PAY-2305): THE AUTHORIZE CALL IS MADE HERE, SERVER-SIDE. Core's /api/oauth/authorize identifies a user only from an
+ * `Authorization: Bearer` header (JwtMiddleware reads no cookie), so sending the BROWSER to it (4.7.0-4.7.4) could never produce a
+ * code. This route now
+ *   1. validates return_url and REBUILDS the authorize URL from constants (IDP_URL origin, fixed path, this app's CLIENT_ID and
+ *      registered redirect_uri); only code_challenge (S256), state and scope come from return_url, each validated;
+ *   2. requires a same-site navigation, a browser that STARTED the flow (better-auth's oauth_state cookie) and the signed-in app session;
+ *   3. calls authorize with the user's IdP access token (redirect: 'manual', timeout; the token goes only to the IDP_URL origin and
+ *      is never logged);
+ *   4. accepts ONLY a redirect to the registered redirect_uri carrying a code and the state it sent, and relays it to the browser
+ *      as a RELATIVE path+query rebuilt from those two values.
+ * Anything else (IdP sends the user to login / 2FA enrolment / an error, no session, refresh fails, IdP unreachable) is the
+ * refusal. Nothing is retried or followed.
+ */
+import { buildServerAuthorizeRequest, hasOAuthStateCookie, isSameSiteResume, relayRegisteredCallback } from '../../lib/authorize-resume';
+import { resolveIdpRedirectUri } from '../../auth/idp-oauth';
+
+export const DEFAULT_REFUSAL_LOCATION = '/account-auth/login?error=AUTHORIZE_RESUME_REFUSED';
+
+export interface OAuthResumeDeps {
+  /** Test seam. Default: global fetch. */
+  fetch?: typeof fetch;
+  /** Test seam. Default: the signed-in app session's IdP access token (one refresh attempt when near expiry), else null. */
+  resolveAccessToken?: (request: Request) => Promise<string | null>;
+  /** Test seam. Default: BETTER_AUTH_URL, else the IdP client config's baseClientUrl, else http://localhost:$PORT (the SAME chain the provider config uses). */
+  appBaseUrl?: () => Promise<string>;
+}
+
+export interface OAuthResumeOptions {
+  /** Same-origin location a refused request is sent to. Must start with a single "/" (no //host, no backslash, no scheme). */
+  refusalLocation?: string;
+  deps?: OAuthResumeDeps;
+}
+
+/** A relative, same-origin location only: the refusal must never itself become an open redirect. */
+function assertRelativeLocation(loc: string): string {
+  const ok = typeof loc === 'string' && loc.startsWith('/') && !loc.startsWith('//') && !loc.startsWith('/\\') && !/\s/.test(loc);
+  if (!ok) {
+    throw new TypeError(`createOAuthResumeHandler: refusalLocation must be a same-origin path starting with a single "/", got ${JSON.stringify(loc)}`);
+  }
+  return loc;
+}
+
+const AUTHORIZE_TIMEOUT_MS = 8000;
+
+/** Cookie header -> the `{ get(name) }` shape decodeSession wants (NextRequest.cookies). */
+function cookieJar(header: string | null): { get: (name: string) => { value: string } | undefined } {
+  const map = new Map<string, string>();
+  for (const part of (header ?? '').split(';')) {
+    const i = part.indexOf('=');
+    if (i < 1) continue;
+    const name = part.slice(0, i).trim();
+    let value = part.slice(i + 1).trim();
+    try {
+      value = decodeURIComponent(value);
+    } catch {
+      /* keep the raw value */
+    }
+    if (!map.has(name)) map.set(name, value);
+  }
+  return { get: (name) => (map.has(name) ? { value: map.get(name)! } : undefined) };
+}
+
+async function defaultResolveAccessToken(request: Request): Promise<string | null> {
+  const { decodeSession } = await import('../../server/decode-session');
+  const decoded = await decodeSession(cookieJar(request.headers.get('cookie')));
+  const sessionToken = (decoded?.jwtPayload?.sessionToken || decoded?.jwtPayload?.redisSessionId) as string | undefined;
+  if (!sessionToken) return null;
+  const { ensureFreshAccessToken } = await import('../../lib/ensure-fresh-access-token');
+  const fresh = await ensureFreshAccessToken(sessionToken, {
+    idpBaseUrl: process.env.IDP_URL as string,
+    clientId: process.env.CLIENT_ID as string,
+  });
+  return fresh.ok ? fresh.accessToken : null;
+}
+
+async function defaultAppBaseUrl(): Promise<string> {
+  if (process.env.BETTER_AUTH_URL) return process.env.BETTER_AUTH_URL;
+  try {
+    const { getIDPClientConfig } = await import('../../lib/idp-client-config');
+    const cfg = await getIDPClientConfig();
+    if (cfg?.baseClientUrl) return cfg.baseClientUrl;
+  } catch {
+    /* fall through to the local default, exactly as createBetterAuthInstance does */
+  }
+  return `http://localhost:${process.env.PORT || '3000'}`;
+}
+
+export function createOAuthResumeHandler(options: OAuthResumeOptions = {}): (request: Request) => Promise<Response> {
+  const refusalLocation = assertRelativeLocation(options.refusalLocation ?? DEFAULT_REFUSAL_LOCATION);
+  const fetchFn = options.deps?.fetch ?? ((...a: Parameters<typeof fetch>) => fetch(...a));
+  const resolveAccessToken = options.deps?.resolveAccessToken ?? defaultResolveAccessToken;
+  const appBaseUrl = options.deps?.appBaseUrl ?? defaultAppBaseUrl;
+
+  // RELATIVE Location on purpose: in a container request.url is the bind address (http://0.0.0.0:8080), so
+  // new URL(path, request.url) would send the browser to a dead host (kb 3463/5571; QAPert 59254 F1).
+  const refuse = (why: string): Response => {
+    console.warn(`[oauth-resume] AUTHORIZE_RESUME outcome=refused reason=${why}`);
+    return new Response(null, { status: 302, headers: { location: refusalLocation, 'cache-control': 'no-store' } });
+  };
+
+  return async function GET(request: Request): Promise<Response> {
+    const idpBase = process.env.IDP_URL;
+    const clientId = process.env.CLIENT_ID;
+    if (!idpBase || !clientId) return refuse('not-configured');
+
+    let redirectUri: string;
+    try {
+      redirectUri = resolveIdpRedirectUri(await appBaseUrl());
+    } catch {
+      return refuse('no-app-base');
+    }
+
+    const built = buildServerAuthorizeRequest(new URL(request.url).searchParams.get('return_url'), {
+      idpBaseUrl: idpBase,
+      clientId,
+      redirectUri,
+    });
+    if (!built) return refuse('return_url');
+
+    let appOrigin: string;
+    try {
+      appOrigin = new URL(redirectUri).origin;
+    } catch {
+      return refuse('bad-redirect-uri');
+    }
+    if (!isSameSiteResume(request.headers, appOrigin)) return refuse('not-same-site');
+    if (!hasOAuthStateCookie(request.headers.get('cookie'))) return refuse('no-oauth-state'); // this browser never started the flow
+
+    let accessToken: string | null = null;
+    try {
+      accessToken = await resolveAccessToken(request);
+    } catch {
+      accessToken = null;
+    }
+    if (!accessToken) return refuse('no-session');
+
+    const forwarded: Record<string, string> = {};
+    const ua = request.headers.get('user-agent');
+    if (ua) forwarded['User-Agent'] = ua;
+    const xff = request.headers.get('x-forwarded-for') || request.headers.get('x-real-ip');
+    if (xff) forwarded['X-Forwarded-For'] = xff;
+    const device = request.headers.get('x-device-id');
+    if (device) forwarded['X-Device-ID'] = device;
+
+    let res: Response;
+    try {
+      res = await fetchFn(built.url, {
+        method: 'GET',
+        headers: { ...forwarded, Accept: 'application/json', Authorization: `Bearer ${accessToken}` },
+        redirect: 'manual', // the Bearer header is never carried to a second URL
+        signal: AbortSignal.timeout(AUTHORIZE_TIMEOUT_MS),
+      });
+    } catch {
+      return refuse('idp-unreachable');
+    }
+
+    const relay = relayRegisteredCallback(res.status, res.headers.get('location'), redirectUri, built.state);
+    // Status only in the log: the Location can carry a code or a return_url.
+    if (!relay) return refuse(`idp-answered-${res.status}`);
+    console.log('[oauth-resume] AUTHORIZE_RESUME outcome=code-issued');
+    return new Response(null, { status: 302, headers: { location: relay, 'cache-control': 'no-store' } });
+  };
+}
+
+export const GET = createOAuthResumeHandler();

package/src/api-handlers/onboarding/send-email-code.ts

@@ -1,18 +1,18 @@
-/**
- * POST /api/onboarding/send-email-code (PAY-2121).
- *
- * Body: { onboard_token } - token-driven, no session. Thin proxy to the IdP's
- * POST /api/Onboarding/send-email-code. The IdP derives the recipient from the
- * token's BOUND email only, never from client input, so a tampered link cannot
- * redirect the code. Also the resend leg the verify card's cooldown fires
- * against.
- */
-import { NextRequest } from 'next/server';
-import { onboardingBadRequest, onboardingProxy } from '../../lib/onboarding-proxy';
-
-export async function POST(req: NextRequest) {
-  const body = await req.json().catch(() => ({} as Record<string, unknown>));
-  const onboardToken = (body as Record<string, unknown>)?.onboard_token;
-  if (!onboardToken) return onboardingBadRequest('MISSING_TOKEN', 'onboard_token is required');
-  return onboardingProxy(req, '/api/Onboarding/send-email-code');
-}
+/**
+ * POST /api/onboarding/send-email-code (PAY-2121).
+ *
+ * Body: { onboard_token } - token-driven, no session. Thin proxy to the IdP's
+ * POST /api/Onboarding/send-email-code. The IdP derives the recipient from the
+ * token's BOUND email only, never from client input, so a tampered link cannot
+ * redirect the code. Also the resend leg the verify card's cooldown fires
+ * against.
+ */
+import { NextRequest } from 'next/server';
+import { onboardingBadRequest, onboardingProxy } from '../../lib/onboarding-proxy';
+
+export async function POST(req: NextRequest) {
+  const body = await req.json().catch(() => ({} as Record<string, unknown>));
+  const onboardToken = (body as Record<string, unknown>)?.onboard_token;
+  if (!onboardToken) return onboardingBadRequest('MISSING_TOKEN', 'onboard_token is required');
+  return onboardingProxy(req, '/api/Onboarding/send-email-code');
+}

package/src/api-handlers/onboarding/set-password.ts

@@ -1,21 +1,21 @@
-/**
- * POST /api/onboarding/set-password (PAY-2121).
- *
- * Body: { onboard_token, email, reset_token, new_password } - the locked
- * contract (IdP OnboardingDtos.cs SetPasswordRequest, all four snake_case).
- * email + reset_token come from the verify-code response; the IdP re-checks
- * email against the token's bound user before consuming the single-use token.
- * On success the IdP sets the password AND completes onboarding (issues tokens).
- * Thin proxy - status and body pass through verbatim.
- */
-import { NextRequest } from 'next/server';
-import { onboardingBadRequest, onboardingProxy } from '../../lib/onboarding-proxy';
-
-export async function POST(req: NextRequest) {
-  const body = await req.json().catch(() => ({} as Record<string, unknown>));
-  const b = body as Record<string, unknown>;
-  if (!b?.onboard_token) return onboardingBadRequest('MISSING_TOKEN', 'onboard_token is required');
-  if (!b?.email || !b?.reset_token) return onboardingBadRequest('MISSING_RESET_CONTEXT', 'email and reset_token (from verify-code) are required');
-  if (!b?.new_password) return onboardingBadRequest('MISSING_PASSWORD', 'new_password is required');
-  return onboardingProxy(req, '/api/Onboarding/set-password');
-}
+/**
+ * POST /api/onboarding/set-password (PAY-2121).
+ *
+ * Body: { onboard_token, email, reset_token, new_password } - the locked
+ * contract (IdP OnboardingDtos.cs SetPasswordRequest, all four snake_case).
+ * email + reset_token come from the verify-code response; the IdP re-checks
+ * email against the token's bound user before consuming the single-use token.
+ * On success the IdP sets the password AND completes onboarding (issues tokens).
+ * Thin proxy - status and body pass through verbatim.
+ */
+import { NextRequest } from 'next/server';
+import { onboardingBadRequest, onboardingProxy } from '../../lib/onboarding-proxy';
+
+export async function POST(req: NextRequest) {
+  const body = await req.json().catch(() => ({} as Record<string, unknown>));
+  const b = body as Record<string, unknown>;
+  if (!b?.onboard_token) return onboardingBadRequest('MISSING_TOKEN', 'onboard_token is required');
+  if (!b?.email || !b?.reset_token) return onboardingBadRequest('MISSING_RESET_CONTEXT', 'email and reset_token (from verify-code) are required');
+  if (!b?.new_password) return onboardingBadRequest('MISSING_PASSWORD', 'new_password is required');
+  return onboardingProxy(req, '/api/Onboarding/set-password');
+}

package/src/api-handlers/onboarding/verify-code.ts

@@ -1,20 +1,20 @@
-/**
- * POST /api/onboarding/verify-code (PAY-2121).
- *
- * Body: { onboard_token, code } - token-driven, no session. Thin proxy to the
- * IdP's POST /api/Onboarding/verify-code, which answers
- * { success, reset_token, email, client_key } on success (OnboardingDtos.cs
- * VerifyCodeResponse). reset_token + email are what the set-password step needs
- * next. The onboard_token IS the auth; there is no session to attach.
- */
-import { NextRequest } from 'next/server';
-import { onboardingBadRequest, onboardingProxy } from '../../lib/onboarding-proxy';
-
-export async function POST(req: NextRequest) {
-  const body = await req.json().catch(() => ({} as Record<string, unknown>));
-  const onboardToken = (body as Record<string, unknown>)?.onboard_token;
-  const code = (body as Record<string, unknown>)?.code;
-  if (!onboardToken) return onboardingBadRequest('MISSING_TOKEN', 'onboard_token is required');
-  if (!code) return onboardingBadRequest('MISSING_CODE', 'code is required');
-  return onboardingProxy(req, '/api/Onboarding/verify-code');
-}
+/**
+ * POST /api/onboarding/verify-code (PAY-2121).
+ *
+ * Body: { onboard_token, code } - token-driven, no session. Thin proxy to the
+ * IdP's POST /api/Onboarding/verify-code, which answers
+ * { success, reset_token, email, client_key } on success (OnboardingDtos.cs
+ * VerifyCodeResponse). reset_token + email are what the set-password step needs
+ * next. The onboard_token IS the auth; there is no session to attach.
+ */
+import { NextRequest } from 'next/server';
+import { onboardingBadRequest, onboardingProxy } from '../../lib/onboarding-proxy';
+
+export async function POST(req: NextRequest) {
+  const body = await req.json().catch(() => ({} as Record<string, unknown>));
+  const onboardToken = (body as Record<string, unknown>)?.onboard_token;
+  const code = (body as Record<string, unknown>)?.code;
+  if (!onboardToken) return onboardingBadRequest('MISSING_TOKEN', 'onboard_token is required');
+  if (!code) return onboardingBadRequest('MISSING_CODE', 'code is required');
+  return onboardingProxy(req, '/api/Onboarding/verify-code');
+}

package/src/api-handlers/onboarding/verify-welcome-email.ts

@@ -1,17 +1,17 @@
-/**
- * POST /api/onboarding/verify-welcome-email (PAY-2121).
- *
- * Body: { onboard_token } - token-driven, no session. Thin proxy to the IdP's
- * POST /api/Onboarding/verify-welcome-email, which answers the masked contact
- * info + expiry the verify card displays. The onboarding page calls this to
- * render its "check your email / here is what we know" state.
- */
-import { NextRequest } from 'next/server';
-import { onboardingBadRequest, onboardingProxy } from '../../lib/onboarding-proxy';
-
-export async function POST(req: NextRequest) {
-  const body = await req.json().catch(() => ({} as Record<string, unknown>));
-  const onboardToken = (body as Record<string, unknown>)?.onboard_token;
-  if (!onboardToken) return onboardingBadRequest('MISSING_TOKEN', 'onboard_token is required');
-  return onboardingProxy(req, '/api/Onboarding/verify-welcome-email');
-}
+/**
+ * POST /api/onboarding/verify-welcome-email (PAY-2121).
+ *
+ * Body: { onboard_token } - token-driven, no session. Thin proxy to the IdP's
+ * POST /api/Onboarding/verify-welcome-email, which answers the masked contact
+ * info + expiry the verify card displays. The onboarding page calls this to
+ * render its "check your email / here is what we know" state.
+ */
+import { NextRequest } from 'next/server';
+import { onboardingBadRequest, onboardingProxy } from '../../lib/onboarding-proxy';
+
+export async function POST(req: NextRequest) {
+  const body = await req.json().catch(() => ({} as Record<string, unknown>));
+  const onboardToken = (body as Record<string, unknown>)?.onboard_token;
+  if (!onboardToken) return onboardingBadRequest('MISSING_TOKEN', 'onboard_token is required');
+  return onboardingProxy(req, '/api/Onboarding/verify-welcome-email');
+}

package/src/api-handlers/passkeys/list.ts

@@ -1,32 +1,32 @@
-import { NextRequest, NextResponse } from 'next/server';
-import { idpFetchJSON } from '../../lib/idp-fetch';
-import { ENV_CONFIG } from '../../config/env';
-import { projectIdpError } from '../../lib/safe-error-response';
-
-/**
- * List the signed-in user's passkeys (GET /api/Passkeys, user JWT).
- * Probe-verified live 2026-08-01 (anon -> 401 = routed).
- * No session -> upstream 401, passed through, never invented locally.
- */
-export async function GET(req: NextRequest) {
-  const result = await idpFetchJSON(req, `${ENV_CONFIG.IDP_URL}/api/Passkeys`, { method: 'GET' });
-
-  if (!result.ok) {
-    return NextResponse.json(
-      {
-        success: false,
-        message: 'Upstream error',
-        error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: projectIdpError(result.json) },
-        meta: { attemptedRefresh: result.attemptedRefresh },
-      },
-      { status: result.status },
-    );
-  }
-
-  const bodyJson: any = result.json;
-  if (bodyJson && typeof bodyJson === 'object' && 'success' in bodyJson && 'data' in bodyJson) {
-    if (bodyJson.success === true) return NextResponse.json(bodyJson.data, { status: 200 });
-    return NextResponse.json(bodyJson, { status: 200 });
-  }
-  return NextResponse.json(bodyJson ?? {}, { status: 200 });
-}
+import { NextRequest, NextResponse } from 'next/server';
+import { idpFetchJSON } from '../../lib/idp-fetch';
+import { ENV_CONFIG } from '../../config/env';
+import { projectIdpError } from '../../lib/safe-error-response';
+
+/**
+ * List the signed-in user's passkeys (GET /api/Passkeys, user JWT).
+ * Probe-verified live 2026-08-01 (anon -> 401 = routed).
+ * No session -> upstream 401, passed through, never invented locally.
+ */
+export async function GET(req: NextRequest) {
+  const result = await idpFetchJSON(req, `${ENV_CONFIG.IDP_URL}/api/Passkeys`, { method: 'GET' });
+
+  if (!result.ok) {
+    return NextResponse.json(
+      {
+        success: false,
+        message: 'Upstream error',
+        error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: projectIdpError(result.json) },
+        meta: { attemptedRefresh: result.attemptedRefresh },
+      },
+      { status: result.status },
+    );
+  }
+
+  const bodyJson: any = result.json;
+  if (bodyJson && typeof bodyJson === 'object' && 'success' in bodyJson && 'data' in bodyJson) {
+    if (bodyJson.success === true) return NextResponse.json(bodyJson.data, { status: 200 });
+    return NextResponse.json(bodyJson, { status: 200 });
+  }
+  return NextResponse.json(bodyJson ?? {}, { status: 200 });
+}