@payez/next-mvp 4.8.1 → 4.8.2

package/src/api/index.ts

@@ -1,18 +1,18 @@
-/**
- * @payez/next-mvp API Module Exports
- *
- * Provides enhanced API route handlers with automatic token management
- *
- * @version 2.0.0
- * @since auth-ready-v2
- */
-
-export {
-  createAuthHandler,
-  type AuthContext,
-  type AuthHandlerOptions,
-  type HandlerFunction
-} from './auth-handler';
-
-// Default export for convenience
+/**
+ * @payez/next-mvp API Module Exports
+ *
+ * Provides enhanced API route handlers with automatic token management
+ *
+ * @version 2.0.0
+ * @since auth-ready-v2
+ */
+
+export {
+  createAuthHandler,
+  type AuthContext,
+  type AuthHandlerOptions,
+  type HandlerFunction
+} from './auth-handler';
+
+// Default export for convenience
 export { default } from './auth-handler';

package/src/api-handlers/account/change-password.ts

@@ -1,170 +1,170 @@
-import { NextRequest, NextResponse } from 'next/server';
-import { getSession as getBetterAuthSession } from '../../server/auth';
-import { getSession } from '../../lib/session-store';
-
-interface ChangePasswordRequest {
-  current_password: string;
-  new_password: string;
-  confirm_password: string;
-}
-
-import { nanoid } from 'nanoid';
-
-/**
- * PAY-1596: the failure code comes from the IdP's REAL envelope { success, error: { code, message, details } } - the handler
- * used to read a top-level `error_code` the IdP never sends, so every refusal was CHANGE_PASSWORD_FAILED and "this account has
- * no password" / "wrong current password" could not be told apart. Allowlisted: nothing but these codes ever leaves here.
- *   - error.code NO_PASSWORD_SET / INVALID_CURRENT_PASSWORD (IdP PR 412) / VALIDATION_ERROR
- *   - the pre-412 wrong-current shape: VALIDATION_ERROR + details.value[] { code: InvalidCurrentPassword, field_name: currentPassword }
- *   - a legacy top-level error_code, for older IdPs
- */
-const CHANGE_PASSWORD_CODES = new Set(['NO_PASSWORD_SET', 'INVALID_CURRENT_PASSWORD', 'VALIDATION_ERROR']);
-
-function changePasswordFailureCode(body: any): string {
-  const err = body && typeof body.error === 'object' && body.error ? body.error : null;
-  const code: string = typeof err?.code === 'string' ? err.code : typeof body?.error_code === 'string' ? body.error_code : '';
-  if (code === 'VALIDATION_ERROR' && Array.isArray(err?.details?.value)) {
-    const wrongCurrent = err.details.value.some(
-      (e: any) => e && typeof e === 'object' && (String(e.field_name ?? e.fieldName ?? '').toLowerCase() === 'currentpassword' || String(e.code ?? '').toLowerCase() === 'invalidcurrentpassword'),
-    );
-    if (wrongCurrent) return 'INVALID_CURRENT_PASSWORD';
-  }
-  return CHANGE_PASSWORD_CODES.has(code) ? code : 'CHANGE_PASSWORD_FAILED';
-}
-import { projectPasswordPolicyDetails } from '../../lib/safe-error-response';
-
-// ...
-
-export async function POST(req: NextRequest) {
-  const requestId = nanoid();
-  try {
-    // Get session from Better Auth
-    const betterAuthSession = await getBetterAuthSession(req);
-    const sessionToken = betterAuthSession?.session?.token as string | undefined;
-    if (!betterAuthSession || typeof sessionToken !== 'string') {
-      return NextResponse.json({ success: false, message: 'Unauthorized' }, { status: 401 });
-    }
-    const sessionData = await getSession(sessionToken);
-    // NOTE: Field is idpAccessToken (not accessToken) per normalized naming convention
-    if (!sessionData?.idpAccessToken) {
-      return NextResponse.json(
-        {
-          success: false,
-          message: 'Authentication required - no access token available',
-          error_code: 'UNAUTHORIZED',
-          request_id: requestId,
-        },
-        { status: 401 }
-      );
-    }
-
-    const body = await req.json();
-    const { current_password, new_password, confirm_password } = body as ChangePasswordRequest;
-
-    // Validate input
-    if (!current_password || !new_password || !confirm_password) {
-      return NextResponse.json(
-        {
-          success: false,
-          message: 'Current password, new password, and confirmation are required',
-          error_code: 'VALIDATION_ERROR',
-          request_id: requestId,
-        },
-        { status: 400 }
-      );
-    }
-
-    if (new_password !== confirm_password) {
-      return NextResponse.json(
-        {
-          success: false,
-          message: 'New password and confirmation do not match',
-          error_code: 'VALIDATION_ERROR',
-          request_id: requestId,
-        },
-        { status: 400 }
-      );
-    }
-
-    // Get IDP base URL from environment
-    const idpBaseUrl = process.env.IDP_URL;
-
-    if (!idpBaseUrl) {
-      console.error('[CHANGE_PASSWORD] IDP_URL not configured');
-      return NextResponse.json(
-        {
-          success: false,
-          message: 'Service configuration error',
-          error_code: 'CONFIGURATION_ERROR',
-          request_id: requestId,
-        },
-        { status: 500 }
-      );
-    }
-
-    // Proxy request to IDP
-    const idpUrl = `${idpBaseUrl}/api/Account/change-password`;
-    const idpResponse = await fetch(idpUrl, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        'Authorization': `Bearer ${sessionData.idpAccessToken}`,
-        'x-request-id': requestId,
-      },
-      body: JSON.stringify({
-        current_password,
-        new_password,
-        confirm_password,
-      }),
-    });
-
-    const responseData = await idpResponse.json().catch(() => ({}));
-
-    if (!idpResponse.ok) {
-      // Extract error message from IDP response
-      let errorMessage = 'Failed to change password';
-
-      const failureCode = changePasswordFailureCode(responseData);
-      // The real envelope nests details under `error`; older IdPs put them at the top level.
-      const idpDetails = (responseData.error && typeof responseData.error === 'object' ? responseData.error.details : undefined) ?? responseData.details;
-      if (responseData.message) {
-        errorMessage = responseData.message;
-      } else if (idpDetails?.value && Array.isArray(idpDetails.value) && idpDetails.value.length > 0) {
-        errorMessage = idpDetails.value[0].message || errorMessage;
-      } else if (idpDetails?.message) {
-        errorMessage = idpDetails.message;
-      }
-
-      return NextResponse.json(
-        {
-          success: false,
-          message: errorMessage,
-          error_code: failureCode,
-          request_id: requestId,
-          // PAY-1438: only the password-policy messages the security pages display, never the raw envelope.
-          details: projectPasswordPolicyDetails(idpDetails),
-        },
-        { status: idpResponse.status }
-      );
-    }
-
-    return NextResponse.json({
-      success: true,
-      message: responseData.message || 'Password changed successfully',
-      request_id: requestId,
-    });
-  } catch (error) {
-    const requestId = req.headers.get('x-request-id') ?? crypto.randomUUID();
-    // PAY-1438: the exception text stays in the log, keyed by the request_id the caller receives.
-    console.error('[CHANGE_PASSWORD] Error:', { request_id: requestId, error });
-    return NextResponse.json(
-      {
-        success: false,
-        message: 'Failed to change password',
-        error_code: 'INTERNAL_ERROR',
-        request_id: requestId,
-      },
-      { status: 500 }
-    );
-  }
-}
+import { NextRequest, NextResponse } from 'next/server';
+import { getSession as getBetterAuthSession } from '../../server/auth';
+import { getSession } from '../../lib/session-store';
+
+interface ChangePasswordRequest {
+  current_password: string;
+  new_password: string;
+  confirm_password: string;
+}
+
+import { nanoid } from 'nanoid';
+
+/**
+ * PAY-1596: the failure code comes from the IdP's REAL envelope { success, error: { code, message, details } } - the handler
+ * used to read a top-level `error_code` the IdP never sends, so every refusal was CHANGE_PASSWORD_FAILED and "this account has
+ * no password" / "wrong current password" could not be told apart. Allowlisted: nothing but these codes ever leaves here.
+ *   - error.code NO_PASSWORD_SET / INVALID_CURRENT_PASSWORD (IdP PR 412) / VALIDATION_ERROR
+ *   - the pre-412 wrong-current shape: VALIDATION_ERROR + details.value[] { code: InvalidCurrentPassword, field_name: currentPassword }
+ *   - a legacy top-level error_code, for older IdPs
+ */
+const CHANGE_PASSWORD_CODES = new Set(['NO_PASSWORD_SET', 'INVALID_CURRENT_PASSWORD', 'VALIDATION_ERROR']);
+
+function changePasswordFailureCode(body: any): string {
+  const err = body && typeof body.error === 'object' && body.error ? body.error : null;
+  const code: string = typeof err?.code === 'string' ? err.code : typeof body?.error_code === 'string' ? body.error_code : '';
+  if (code === 'VALIDATION_ERROR' && Array.isArray(err?.details?.value)) {
+    const wrongCurrent = err.details.value.some(
+      (e: any) => e && typeof e === 'object' && (String(e.field_name ?? e.fieldName ?? '').toLowerCase() === 'currentpassword' || String(e.code ?? '').toLowerCase() === 'invalidcurrentpassword'),
+    );
+    if (wrongCurrent) return 'INVALID_CURRENT_PASSWORD';
+  }
+  return CHANGE_PASSWORD_CODES.has(code) ? code : 'CHANGE_PASSWORD_FAILED';
+}
+import { projectPasswordPolicyDetails } from '../../lib/safe-error-response';
+
+// ...
+
+export async function POST(req: NextRequest) {
+  const requestId = nanoid();
+  try {
+    // Get session from Better Auth
+    const betterAuthSession = await getBetterAuthSession(req);
+    const sessionToken = betterAuthSession?.session?.token as string | undefined;
+    if (!betterAuthSession || typeof sessionToken !== 'string') {
+      return NextResponse.json({ success: false, message: 'Unauthorized' }, { status: 401 });
+    }
+    const sessionData = await getSession(sessionToken);
+    // NOTE: Field is idpAccessToken (not accessToken) per normalized naming convention
+    if (!sessionData?.idpAccessToken) {
+      return NextResponse.json(
+        {
+          success: false,
+          message: 'Authentication required - no access token available',
+          error_code: 'UNAUTHORIZED',
+          request_id: requestId,
+        },
+        { status: 401 }
+      );
+    }
+
+    const body = await req.json();
+    const { current_password, new_password, confirm_password } = body as ChangePasswordRequest;
+
+    // Validate input
+    if (!current_password || !new_password || !confirm_password) {
+      return NextResponse.json(
+        {
+          success: false,
+          message: 'Current password, new password, and confirmation are required',
+          error_code: 'VALIDATION_ERROR',
+          request_id: requestId,
+        },
+        { status: 400 }
+      );
+    }
+
+    if (new_password !== confirm_password) {
+      return NextResponse.json(
+        {
+          success: false,
+          message: 'New password and confirmation do not match',
+          error_code: 'VALIDATION_ERROR',
+          request_id: requestId,
+        },
+        { status: 400 }
+      );
+    }
+
+    // Get IDP base URL from environment
+    const idpBaseUrl = process.env.IDP_URL;
+
+    if (!idpBaseUrl) {
+      console.error('[CHANGE_PASSWORD] IDP_URL not configured');
+      return NextResponse.json(
+        {
+          success: false,
+          message: 'Service configuration error',
+          error_code: 'CONFIGURATION_ERROR',
+          request_id: requestId,
+        },
+        { status: 500 }
+      );
+    }
+
+    // Proxy request to IDP
+    const idpUrl = `${idpBaseUrl}/api/Account/change-password`;
+    const idpResponse = await fetch(idpUrl, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'Authorization': `Bearer ${sessionData.idpAccessToken}`,
+        'x-request-id': requestId,
+      },
+      body: JSON.stringify({
+        current_password,
+        new_password,
+        confirm_password,
+      }),
+    });
+
+    const responseData = await idpResponse.json().catch(() => ({}));
+
+    if (!idpResponse.ok) {
+      // Extract error message from IDP response
+      let errorMessage = 'Failed to change password';
+
+      const failureCode = changePasswordFailureCode(responseData);
+      // The real envelope nests details under `error`; older IdPs put them at the top level.
+      const idpDetails = (responseData.error && typeof responseData.error === 'object' ? responseData.error.details : undefined) ?? responseData.details;
+      if (responseData.message) {
+        errorMessage = responseData.message;
+      } else if (idpDetails?.value && Array.isArray(idpDetails.value) && idpDetails.value.length > 0) {
+        errorMessage = idpDetails.value[0].message || errorMessage;
+      } else if (idpDetails?.message) {
+        errorMessage = idpDetails.message;
+      }
+
+      return NextResponse.json(
+        {
+          success: false,
+          message: errorMessage,
+          error_code: failureCode,
+          request_id: requestId,
+          // PAY-1438: only the password-policy messages the security pages display, never the raw envelope.
+          details: projectPasswordPolicyDetails(idpDetails),
+        },
+        { status: idpResponse.status }
+      );
+    }
+
+    return NextResponse.json({
+      success: true,
+      message: responseData.message || 'Password changed successfully',
+      request_id: requestId,
+    });
+  } catch (error) {
+    const requestId = req.headers.get('x-request-id') ?? crypto.randomUUID();
+    // PAY-1438: the exception text stays in the log, keyed by the request_id the caller receives.
+    console.error('[CHANGE_PASSWORD] Error:', { request_id: requestId, error });
+    return NextResponse.json(
+      {
+        success: false,
+        message: 'Failed to change password',
+        error_code: 'INTERNAL_ERROR',
+        request_id: requestId,
+      },
+      { status: 500 }
+    );
+  }
+}

package/src/api-handlers/account/masked-info.ts

@@ -1,46 +1,46 @@
-import { NextRequest, NextResponse } from 'next/server';
-import { idpFetchJSON } from '../../lib/idp-fetch';
-import { ENV_CONFIG } from '../../config/env';
-import { projectIdpError } from '../../lib/safe-error-response';
-
-// IDP masked-info is POST and uses capital 'A' in /api/Account
-export async function POST(req: NextRequest) {
-  const url = `${ENV_CONFIG.IDP_URL}/api/Account/masked-info`;
-
-  // Forward request body if present; IDP often accepts empty object
-  let body = '{}';
-  try {
-    const raw = await req.text();
-    if (raw && raw.trim().length > 0) body = raw;
-  } catch {}
-
-  const result = await idpFetchJSON(req, url, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body
-  });
-
-  if (!result.ok) {
-    return NextResponse.json(
-      {
-        success: false,
-        message: 'Upstream error',
-        error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: projectIdpError(result.json) },
-        meta: { attemptedRefresh: result.attemptedRefresh },
-      },
-      { status: result.status }
-    );
-  }
-
-  const bodyJson: any = result.json;
-  // Unwrap if IDP returns envelope { success, data }
-  if (bodyJson && typeof bodyJson === 'object' && 'success' in bodyJson && 'data' in bodyJson) {
-    if ((bodyJson as any).success === true) {
-      return NextResponse.json((bodyJson as any).data, { status: 200 });
-    }
-    return NextResponse.json(bodyJson, { status: 200 });
-  }
-
-  // Passthrough otherwise
-  return NextResponse.json(bodyJson ?? {}, { status: 200 });
-}
+import { NextRequest, NextResponse } from 'next/server';
+import { idpFetchJSON } from '../../lib/idp-fetch';
+import { ENV_CONFIG } from '../../config/env';
+import { projectIdpError } from '../../lib/safe-error-response';
+
+// IDP masked-info is POST and uses capital 'A' in /api/Account
+export async function POST(req: NextRequest) {
+  const url = `${ENV_CONFIG.IDP_URL}/api/Account/masked-info`;
+
+  // Forward request body if present; IDP often accepts empty object
+  let body = '{}';
+  try {
+    const raw = await req.text();
+    if (raw && raw.trim().length > 0) body = raw;
+  } catch {}
+
+  const result = await idpFetchJSON(req, url, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body
+  });
+
+  if (!result.ok) {
+    return NextResponse.json(
+      {
+        success: false,
+        message: 'Upstream error',
+        error: { code: 'UPSTREAM_SERVICE_ERROR', status: result.status, details: projectIdpError(result.json) },
+        meta: { attemptedRefresh: result.attemptedRefresh },
+      },
+      { status: result.status }
+    );
+  }
+
+  const bodyJson: any = result.json;
+  // Unwrap if IDP returns envelope { success, data }
+  if (bodyJson && typeof bodyJson === 'object' && 'success' in bodyJson && 'data' in bodyJson) {
+    if ((bodyJson as any).success === true) {
+      return NextResponse.json((bodyJson as any).data, { status: 200 });
+    }
+    return NextResponse.json(bodyJson, { status: 200 });
+  }
+
+  // Passthrough otherwise
+  return NextResponse.json(bodyJson ?? {}, { status: 200 });
+}