@payez/next-mvp 4.8.1 → 4.8.2

package/src/lib/token-log-id.ts

@@ -1,69 +1,69 @@
-/**
- * tokenLogId - a log-safe correlation id for a session token (PR 154 follow-up, BAPert ruling on PAY-1427:
- * "no token material in logs, not even partial").
- *
- * The package used to log `sessionToken.substring(0, 8) + '...'` so lines about one session could be
- * correlated. Those 8 characters ARE token material. This returns `h:` + the first 12 hex characters of
- * SHA-256(token) instead: the same correlation (one token -> one stable id, across every log line and
- * process), with nothing of the token itself.
- *
- * Synchronous and dependency-free on purpose: the call sites include Edge middleware
- * (create-middleware, auth-decision) and browser code (authStore, SessionSync), where node:crypto is
- * unavailable and Web Crypto's digest is async. SHA-256 below follows FIPS 180-4 and is verified
- * against node:crypto in test/session-token-log-id.test.cjs.
- */
-
-const K = new Uint32Array([
-  0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
-  0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
-  0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
-  0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
-  0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
-  0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
-  0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
-  0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
-]);
-
-const rotr = (x: number, n: number): number => (x >>> n) | (x << (32 - n));
-
-/** SHA-256 of the UTF-8 encoding of `input`, as lowercase hex. */
-export function sha256Hex(input: string): string {
-  const msg = new TextEncoder().encode(input);
-  const bitLen = msg.length * 8;
-  const padded = new Uint8Array(((msg.length + 9 + 63) >> 6) << 6);
-  padded.set(msg);
-  padded[msg.length] = 0x80;
-  const view = new DataView(padded.buffer);
-  view.setUint32(padded.length - 8, Math.floor(bitLen / 0x100000000));
-  view.setUint32(padded.length - 4, bitLen >>> 0);
-
-  const h = new Uint32Array([0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19]);
-  const w = new Uint32Array(64);
-  for (let off = 0; off < padded.length; off += 64) {
-    for (let i = 0; i < 16; i++) w[i] = view.getUint32(off + i * 4);
-    for (let i = 16; i < 64; i++) {
-      const s15 = w[i - 15];
-      const s2 = w[i - 2];
-      const sigma0 = rotr(s15, 7) ^ rotr(s15, 18) ^ (s15 >>> 3);
-      const sigma1 = rotr(s2, 17) ^ rotr(s2, 19) ^ (s2 >>> 10);
-      w[i] = (w[i - 16] + sigma0 + w[i - 7] + sigma1) | 0;
-    }
-    let a = h[0], b = h[1], c = h[2], d = h[3], e = h[4], f = h[5], g = h[6], hh = h[7];
-    for (let i = 0; i < 64; i++) {
-      const t1 = (hh + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + ((e & f) ^ (~e & g)) + K[i] + w[i]) | 0;
-      const t2 = ((rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + ((a & b) ^ (a & c) ^ (b & c))) | 0;
-      hh = g; g = f; f = e; e = (d + t1) | 0; d = c; c = b; b = a; a = (t1 + t2) | 0;
-    }
-    h[0] = (h[0] + a) | 0; h[1] = (h[1] + b) | 0; h[2] = (h[2] + c) | 0; h[3] = (h[3] + d) | 0;
-    h[4] = (h[4] + e) | 0; h[5] = (h[5] + f) | 0; h[6] = (h[6] + g) | 0; h[7] = (h[7] + hh) | 0;
-  }
-  let out = '';
-  for (let i = 0; i < 8; i++) out += (h[i] >>> 0).toString(16).padStart(8, '0');
-  return out;
-}
-
-/** `h:` + 12 hex of SHA-256(token); `none` when there is no token. Never any part of the token itself. */
-export function tokenLogId(token: string | null | undefined): string {
-  if (typeof token !== 'string' || token.length === 0) return 'none';
-  return 'h:' + sha256Hex(token).slice(0, 12);
-}
+/**
+ * tokenLogId - a log-safe correlation id for a session token (PR 154 follow-up, BAPert ruling on PAY-1427:
+ * "no token material in logs, not even partial").
+ *
+ * The package used to log `sessionToken.substring(0, 8) + '...'` so lines about one session could be
+ * correlated. Those 8 characters ARE token material. This returns `h:` + the first 12 hex characters of
+ * SHA-256(token) instead: the same correlation (one token -> one stable id, across every log line and
+ * process), with nothing of the token itself.
+ *
+ * Synchronous and dependency-free on purpose: the call sites include Edge middleware
+ * (create-middleware, auth-decision) and browser code (authStore, SessionSync), where node:crypto is
+ * unavailable and Web Crypto's digest is async. SHA-256 below follows FIPS 180-4 and is verified
+ * against node:crypto in test/session-token-log-id.test.cjs.
+ */
+
+const K = new Uint32Array([
+  0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+  0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+  0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+  0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+  0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+  0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+  0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+  0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+]);
+
+const rotr = (x: number, n: number): number => (x >>> n) | (x << (32 - n));
+
+/** SHA-256 of the UTF-8 encoding of `input`, as lowercase hex. */
+export function sha256Hex(input: string): string {
+  const msg = new TextEncoder().encode(input);
+  const bitLen = msg.length * 8;
+  const padded = new Uint8Array(((msg.length + 9 + 63) >> 6) << 6);
+  padded.set(msg);
+  padded[msg.length] = 0x80;
+  const view = new DataView(padded.buffer);
+  view.setUint32(padded.length - 8, Math.floor(bitLen / 0x100000000));
+  view.setUint32(padded.length - 4, bitLen >>> 0);
+
+  const h = new Uint32Array([0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19]);
+  const w = new Uint32Array(64);
+  for (let off = 0; off < padded.length; off += 64) {
+    for (let i = 0; i < 16; i++) w[i] = view.getUint32(off + i * 4);
+    for (let i = 16; i < 64; i++) {
+      const s15 = w[i - 15];
+      const s2 = w[i - 2];
+      const sigma0 = rotr(s15, 7) ^ rotr(s15, 18) ^ (s15 >>> 3);
+      const sigma1 = rotr(s2, 17) ^ rotr(s2, 19) ^ (s2 >>> 10);
+      w[i] = (w[i - 16] + sigma0 + w[i - 7] + sigma1) | 0;
+    }
+    let a = h[0], b = h[1], c = h[2], d = h[3], e = h[4], f = h[5], g = h[6], hh = h[7];
+    for (let i = 0; i < 64; i++) {
+      const t1 = (hh + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + ((e & f) ^ (~e & g)) + K[i] + w[i]) | 0;
+      const t2 = ((rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + ((a & b) ^ (a & c) ^ (b & c))) | 0;
+      hh = g; g = f; f = e; e = (d + t1) | 0; d = c; c = b; b = a; a = (t1 + t2) | 0;
+    }
+    h[0] = (h[0] + a) | 0; h[1] = (h[1] + b) | 0; h[2] = (h[2] + c) | 0; h[3] = (h[3] + d) | 0;
+    h[4] = (h[4] + e) | 0; h[5] = (h[5] + f) | 0; h[6] = (h[6] + g) | 0; h[7] = (h[7] + hh) | 0;
+  }
+  let out = '';
+  for (let i = 0; i < 8; i++) out += (h[i] >>> 0).toString(16).padStart(8, '0');
+  return out;
+}
+
+/** `h:` + 12 hex of SHA-256(token); `none` when there is no token. Never any part of the token itself. */
+export function tokenLogId(token: string | null | undefined): string {
+  if (typeof token !== 'string' || token.length === 0) return 'none';
+  return 'h:' + sha256Hex(token).slice(0, 12);
+}

package/src/lib/twofa-rejection.ts

@@ -1,91 +1,91 @@
-/**
- * Door B (/api/auth/admin-login) twofa verify: what to tell the user when every lane refused.
- *
- * Classification is by the MOST BLOCKING outcome across lanes (268121 ruling), in this order:
- *   429 from the IdP, or any lane answering code `locked`  -> 429 lockout (PAY-903)
- *   any 5xx, or a lane answering code server_error / service_unavailable (PAY-1589) -> 502 "our side, not your code"
- *   otherwise                                              -> 400 wrong / expired code
- *
- * PAY-903: MfaController.VerifyTotp returns 400 {message, code:"locked"} for a 15-minute lockout
- * (MfaTotpService ErrorCode "locked"). Status-only classification read that as "wrong code, try again" -
- * coaching a locked-out user to spend attempts. The body is inspected for EVERY lane, because with lane
- * order [totp, email] the last response is the email lane's and never carries the TOTP lockout.
- * Disclosing the lockout here is safe: this step is post-password (the caller already proved the account).
- *
- * PAY-1608: the lockout states the LOCKED LANE's own Retry-After (Core sends one on every 2FA lock; VerifyTotp sends
- * what is LEFT of it). It used to hard-code 15 minutes / 900 s. With no usable header, no number is stated and
- * `retryAfter` is omitted rather than invented.
- */
-import { lockedSentence, parseRetryAfterSeconds } from './lock-window';
-
-export interface TwofaLaneResult {
-  status: number;
-  body: string;
-  /** PAY-2284: which lane this answer came from, so a fault in the TOTP/SMS lane can offer the email lane (never offered when the EMAIL lane is the one that faulted). */
-  lane?: 'totp' | 'sms' | 'email';
-  /** PAY-1608: this lane's Retry-After header, as received. */
-  retryAfter?: string | null;
-}
-
-export interface TwofaRejection {
-  status: 400 | 429 | 502;
-  error: string;
-  retryAfter?: number;
-  /**
-   * PAY-2284: true when the authenticator (or text) lane failed on OUR side and the emailed-code lane has not faulted. The sign-in
-   * card then shows a real "Email me a code instead" action. Before this, the copy said "use another sign-in method" and the screen
-   * offered none, and a TOTP holder - for whom the door sends NOTHING at sign-in - was stuck (Jon, 12 Oct, dev-93 key version 57).
-   */
-  offerEmailCode?: true;
-}
-
-/** Every code the IdP body carries: flat {code}, envelope {error:{code}}, or {error:{details:{code}}}. */
-function laneCodes(body: string): string[] {
-  try {
-    const j = JSON.parse(body) as Record<string, unknown> | null;
-    if (!j || typeof j !== 'object') return [];
-    const err = (j.error && typeof j.error === 'object' ? j.error : null) as Record<string, unknown> | null;
-    const details = (err?.details && typeof err.details === 'object' ? err.details : null) as Record<string, unknown> | null;
-    return [j.code, err?.code, details?.code].filter((c): c is string => typeof c === 'string').map((c) => c.toLowerCase());
-  } catch {
-    return [];
-  }
-}
-
-export function classifyTwofaRejection(lanes: TwofaLaneResult[], retryAfterHeader?: string | null): TwofaRejection {
-  const lockedLane = lanes.find((l) => laneCodes(l.body).includes('locked'));
-  if (lockedLane) {
-    const secs = parseRetryAfterSeconds(lockedLane.retryAfter);
-    return { status: 429, error: lockedSentence(secs), ...(secs ? { retryAfter: secs } : {}) };
-  }
-  if (lanes.some((l) => l.status === 429)) {
-    const parsed = retryAfterHeader ? parseInt(retryAfterHeader, 10) : NaN;
-    return {
-      status: 429,
-      error: 'Too many attempts. Your code is still valid - wait before trying again.',
-      retryAfter: Number.isFinite(parsed) && parsed > 0 ? parsed : 60,
-    };
-  }
-  // PAY-1589: an IdP-side fault that arrives as 400 + code (TOTP secret cannot be decrypted -> server_error;
-  // replay store down -> service_unavailable). It is not the user's code and does not count toward the lockout,
-  // so calling it "not right" sends them round a loop that cannot succeed. Email may still work, so say so.
-  const faulted = (l: TwofaLaneResult) => laneCodes(l.body).some((c) => c === 'server_error' || c === 'service_unavailable');
-  if (lanes.some(faulted)) {
-    const emailLaneFaulted = lanes.some((l) => l.lane === 'email' && (faulted(l) || l.status >= 500));
-    const offer = !emailLaneFaulted && lanes.some((l) => faulted(l) && (l.lane === 'totp' || l.lane === 'sms'));
-    return {
-      status: 502,
-      error: offer
-        ? 'We could not check your code just now - this is a problem on our side, not with your code. You can have us email you a code instead.'
-        : 'We could not check your code just now - this is a problem on our side, not with your code. Try again shortly.',
-      ...(offer ? { offerEmailCode: true as const } : {}),
-    };
-  }
-  if (lanes.some((l) => l.status >= 500)) {
-    return {
-      status: 502,
-      error: 'We could not check your code just now - this is a problem on our side, not with your code. Try again shortly.',
-    };
-  }
-  return { status: 400, error: 'That code is not right or has expired. Try again.' };
-}
+/**
+ * Door B (/api/auth/admin-login) twofa verify: what to tell the user when every lane refused.
+ *
+ * Classification is by the MOST BLOCKING outcome across lanes (268121 ruling), in this order:
+ *   429 from the IdP, or any lane answering code `locked`  -> 429 lockout (PAY-903)
+ *   any 5xx, or a lane answering code server_error / service_unavailable (PAY-1589) -> 502 "our side, not your code"
+ *   otherwise                                              -> 400 wrong / expired code
+ *
+ * PAY-903: MfaController.VerifyTotp returns 400 {message, code:"locked"} for a 15-minute lockout
+ * (MfaTotpService ErrorCode "locked"). Status-only classification read that as "wrong code, try again" -
+ * coaching a locked-out user to spend attempts. The body is inspected for EVERY lane, because with lane
+ * order [totp, email] the last response is the email lane's and never carries the TOTP lockout.
+ * Disclosing the lockout here is safe: this step is post-password (the caller already proved the account).
+ *
+ * PAY-1608: the lockout states the LOCKED LANE's own Retry-After (Core sends one on every 2FA lock; VerifyTotp sends
+ * what is LEFT of it). It used to hard-code 15 minutes / 900 s. With no usable header, no number is stated and
+ * `retryAfter` is omitted rather than invented.
+ */
+import { lockedSentence, parseRetryAfterSeconds } from './lock-window';
+
+export interface TwofaLaneResult {
+  status: number;
+  body: string;
+  /** PAY-2284: which lane this answer came from, so a fault in the TOTP/SMS lane can offer the email lane (never offered when the EMAIL lane is the one that faulted). */
+  lane?: 'totp' | 'sms' | 'email';
+  /** PAY-1608: this lane's Retry-After header, as received. */
+  retryAfter?: string | null;
+}
+
+export interface TwofaRejection {
+  status: 400 | 429 | 502;
+  error: string;
+  retryAfter?: number;
+  /**
+   * PAY-2284: true when the authenticator (or text) lane failed on OUR side and the emailed-code lane has not faulted. The sign-in
+   * card then shows a real "Email me a code instead" action. Before this, the copy said "use another sign-in method" and the screen
+   * offered none, and a TOTP holder - for whom the door sends NOTHING at sign-in - was stuck (Jon, 12 Oct, dev-93 key version 57).
+   */
+  offerEmailCode?: true;
+}
+
+/** Every code the IdP body carries: flat {code}, envelope {error:{code}}, or {error:{details:{code}}}. */
+function laneCodes(body: string): string[] {
+  try {
+    const j = JSON.parse(body) as Record<string, unknown> | null;
+    if (!j || typeof j !== 'object') return [];
+    const err = (j.error && typeof j.error === 'object' ? j.error : null) as Record<string, unknown> | null;
+    const details = (err?.details && typeof err.details === 'object' ? err.details : null) as Record<string, unknown> | null;
+    return [j.code, err?.code, details?.code].filter((c): c is string => typeof c === 'string').map((c) => c.toLowerCase());
+  } catch {
+    return [];
+  }
+}
+
+export function classifyTwofaRejection(lanes: TwofaLaneResult[], retryAfterHeader?: string | null): TwofaRejection {
+  const lockedLane = lanes.find((l) => laneCodes(l.body).includes('locked'));
+  if (lockedLane) {
+    const secs = parseRetryAfterSeconds(lockedLane.retryAfter);
+    return { status: 429, error: lockedSentence(secs), ...(secs ? { retryAfter: secs } : {}) };
+  }
+  if (lanes.some((l) => l.status === 429)) {
+    const parsed = retryAfterHeader ? parseInt(retryAfterHeader, 10) : NaN;
+    return {
+      status: 429,
+      error: 'Too many attempts. Your code is still valid - wait before trying again.',
+      retryAfter: Number.isFinite(parsed) && parsed > 0 ? parsed : 60,
+    };
+  }
+  // PAY-1589: an IdP-side fault that arrives as 400 + code (TOTP secret cannot be decrypted -> server_error;
+  // replay store down -> service_unavailable). It is not the user's code and does not count toward the lockout,
+  // so calling it "not right" sends them round a loop that cannot succeed. Email may still work, so say so.
+  const faulted = (l: TwofaLaneResult) => laneCodes(l.body).some((c) => c === 'server_error' || c === 'service_unavailable');
+  if (lanes.some(faulted)) {
+    const emailLaneFaulted = lanes.some((l) => l.lane === 'email' && (faulted(l) || l.status >= 500));
+    const offer = !emailLaneFaulted && lanes.some((l) => faulted(l) && (l.lane === 'totp' || l.lane === 'sms'));
+    return {
+      status: 502,
+      error: offer
+        ? 'We could not check your code just now - this is a problem on our side, not with your code. You can have us email you a code instead.'
+        : 'We could not check your code just now - this is a problem on our side, not with your code. Try again shortly.',
+      ...(offer ? { offerEmailCode: true as const } : {}),
+    };
+  }
+  if (lanes.some((l) => l.status >= 500)) {
+    return {
+      status: 502,
+      error: 'We could not check your code just now - this is a problem on our side, not with your code. Try again shortly.',
+    };
+  }
+  return { status: 400, error: 'That code is not right or has expired. Try again.' };
+}