@payez/next-mvp 4.8.1 → 4.8.3

package/src/api-handlers/account/validate-password.ts

@@ -1,139 +1,139 @@
-import { NextRequest, NextResponse } from 'next/server';
-
-interface ValidatePasswordRequest {
-  password: string;
-}
-
-interface ValidatePasswordResponse {
-  is_valid: boolean;
-  score: number;
-  failed_requirements: string[];
-  tip?: string;
-  policy?: {
-    min_length?: number;
-    require_uppercase?: boolean;
-    require_lowercase?: boolean;
-    require_digit?: boolean;
-    require_special?: boolean;
-    min_strength_score?: number;
-  };
-}
-
-export async function POST(req: NextRequest) {
-  try {
-    const body = await req.json();
-    const { password } = body as ValidatePasswordRequest;
-    const requestId = req.headers.get('x-request-id') ?? crypto.randomUUID();
-
-    // Validate input
-    if (!password || typeof password !== 'string') {
-      return NextResponse.json(
-        {
-          is_valid: false,
-          score: 0,
-          failed_requirements: ['Password is required'],
-        } as ValidatePasswordResponse,
-        {
-          status: 200, // Return 200 even for validation errors to keep UI responsive
-          headers: { 'Cache-Control': 'no-store' },
-        }
-      );
-    }
-
-    // Get IDP base URL and client ID from environment
-    const idpBaseUrl = process.env.IDP_URL;
-
-    const clientId = process.env.CLIENT_ID;
-
-    if (!idpBaseUrl) {
-      console.error('[VALIDATE_PASSWORD] IDP_URL not configured');
-      return NextResponse.json(
-        {
-          is_valid: false,
-          score: 0,
-          failed_requirements: ['Password validation service unavailable'],
-        } as ValidatePasswordResponse,
-        {
-          status: 200,
-          headers: { 'Cache-Control': 'no-store' },
-        }
-      );
-    }
-
-    // Proxy request to IDP
-    const idpUrl = `${idpBaseUrl}/api/Account/validate-password`;
-    const payload = {
-      password,
-      client_id: clientId,
-    };
-
-    const idpResponse = await fetch(idpUrl, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        'x-request-id': requestId,
-      },
-      body: JSON.stringify(payload),
-    });
-
-    const responseData = await idpResponse.json().catch(() => ({}));
-
-    if (!idpResponse.ok) {
-      // PAY-1424: shape only, never the envelope contents (this endpoint carries a password).
-      console.error('[VALIDATE_PASSWORD] IDP error:', {
-        status: idpResponse.status,
-        bodyKeys: responseData && typeof responseData === 'object' ? Object.keys(responseData) : undefined,
-        errorKeys: (responseData as any)?.error && typeof (responseData as any)?.error === 'object' ? Object.keys((responseData as any)?.error) : undefined,
-      });
-      return NextResponse.json(
-        {
-          is_valid: false,
-          score: 0,
-          failed_requirements: ['Password validation failed'],
-        } as ValidatePasswordResponse,
-        {
-          status: 200,
-          headers: { 'Cache-Control': 'no-store' },
-        }
-      );
-    }
-
-    /**
-     * 283211 - UNWRAP THE IDP ENVELOPE. Approved by BAPert 2026-08-30.
-     *
-     * The IDP answers this endpoint with an ENVELOPE - { success, data: { is_valid, score,
-     * failed_requirements, policy } } - and this line used to hand that straight back. The
-     * `as ValidatePasswordResponse` is a COMPILE-TIME ASSERTION AND PERFORMS NO RUNTIME
-     * TRANSFORMATION, so nothing ever reshaped it and the type told us it was fine.
-     *
-     * The consumer is usePasswordValidation, which reads `data.is_valid` at the top level and
-     * calls setIsValid with it. Against an envelope that is `undefined`, so isValid never
-     * became true; and EVERY error path in this file returns a FLAT { is_valid: false }. So the
-     * success shape was unreadable and the failure shape was readable-and-false: setIsValid(true)
-     * was UNREACHABLE, and the Change Password button's `canSubmit` could never enable.
-     *
-     * `responseData?.data ?? responseData` is defensive in both directions BY DESIGN: it unwraps
-     * the envelope we get today and passes a flat body through unchanged, so it does not break
-     * if the IDP is later made consistent with this file's own declared response type.
-     */
-    const unwrapped = (responseData as any)?.data ?? responseData;
-
-    return NextResponse.json(unwrapped as ValidatePasswordResponse, {
-      status: 200,
-      headers: { 'Cache-Control': 'no-store' },
-    });
-  } catch (error) {
-    console.error('[VALIDATE_PASSWORD] Error:', error);
-    return NextResponse.json(
-      {
-        is_valid: false,
-        score: 0,
-        failed_requirements: ['Password validation failed'],
-      } as ValidatePasswordResponse,
-      {
-        status: 200,
-        headers: { 'Cache-Control': 'no-store' },
-      }
-    );
-  }
-}
+import { NextRequest, NextResponse } from 'next/server';
+
+interface ValidatePasswordRequest {
+  password: string;
+}
+
+interface ValidatePasswordResponse {
+  is_valid: boolean;
+  score: number;
+  failed_requirements: string[];
+  tip?: string;
+  policy?: {
+    min_length?: number;
+    require_uppercase?: boolean;
+    require_lowercase?: boolean;
+    require_digit?: boolean;
+    require_special?: boolean;
+    min_strength_score?: number;
+  };
+}
+
+export async function POST(req: NextRequest) {
+  try {
+    const body = await req.json();
+    const { password } = body as ValidatePasswordRequest;
+    const requestId = req.headers.get('x-request-id') ?? crypto.randomUUID();
+
+    // Validate input
+    if (!password || typeof password !== 'string') {
+      return NextResponse.json(
+        {
+          is_valid: false,
+          score: 0,
+          failed_requirements: ['Password is required'],
+        } as ValidatePasswordResponse,
+        {
+          status: 200, // Return 200 even for validation errors to keep UI responsive
+          headers: { 'Cache-Control': 'no-store' },
+        }
+      );
+    }
+
+    // Get IDP base URL and client ID from environment
+    const idpBaseUrl = process.env.IDP_URL;
+
+    const clientId = process.env.CLIENT_ID;
+
+    if (!idpBaseUrl) {
+      console.error('[VALIDATE_PASSWORD] IDP_URL not configured');
+      return NextResponse.json(
+        {
+          is_valid: false,
+          score: 0,
+          failed_requirements: ['Password validation service unavailable'],
+        } as ValidatePasswordResponse,
+        {
+          status: 200,
+          headers: { 'Cache-Control': 'no-store' },
+        }
+      );
+    }
+
+    // Proxy request to IDP
+    const idpUrl = `${idpBaseUrl}/api/Account/validate-password`;
+    const payload = {
+      password,
+      client_id: clientId,
+    };
+
+    const idpResponse = await fetch(idpUrl, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'x-request-id': requestId,
+      },
+      body: JSON.stringify(payload),
+    });
+
+    const responseData = await idpResponse.json().catch(() => ({}));
+
+    if (!idpResponse.ok) {
+      // PAY-1424: shape only, never the envelope contents (this endpoint carries a password).
+      console.error('[VALIDATE_PASSWORD] IDP error:', {
+        status: idpResponse.status,
+        bodyKeys: responseData && typeof responseData === 'object' ? Object.keys(responseData) : undefined,
+        errorKeys: (responseData as any)?.error && typeof (responseData as any)?.error === 'object' ? Object.keys((responseData as any)?.error) : undefined,
+      });
+      return NextResponse.json(
+        {
+          is_valid: false,
+          score: 0,
+          failed_requirements: ['Password validation failed'],
+        } as ValidatePasswordResponse,
+        {
+          status: 200,
+          headers: { 'Cache-Control': 'no-store' },
+        }
+      );
+    }
+
+    /**
+     * 283211 - UNWRAP THE IDP ENVELOPE. Approved by BAPert 2026-08-30.
+     *
+     * The IDP answers this endpoint with an ENVELOPE - { success, data: { is_valid, score,
+     * failed_requirements, policy } } - and this line used to hand that straight back. The
+     * `as ValidatePasswordResponse` is a COMPILE-TIME ASSERTION AND PERFORMS NO RUNTIME
+     * TRANSFORMATION, so nothing ever reshaped it and the type told us it was fine.
+     *
+     * The consumer is usePasswordValidation, which reads `data.is_valid` at the top level and
+     * calls setIsValid with it. Against an envelope that is `undefined`, so isValid never
+     * became true; and EVERY error path in this file returns a FLAT { is_valid: false }. So the
+     * success shape was unreadable and the failure shape was readable-and-false: setIsValid(true)
+     * was UNREACHABLE, and the Change Password button's `canSubmit` could never enable.
+     *
+     * `responseData?.data ?? responseData` is defensive in both directions BY DESIGN: it unwraps
+     * the envelope we get today and passes a flat body through unchanged, so it does not break
+     * if the IDP is later made consistent with this file's own declared response type.
+     */
+    const unwrapped = (responseData as any)?.data ?? responseData;
+
+    return NextResponse.json(unwrapped as ValidatePasswordResponse, {
+      status: 200,
+      headers: { 'Cache-Control': 'no-store' },
+    });
+  } catch (error) {
+    console.error('[VALIDATE_PASSWORD] Error:', error);
+    return NextResponse.json(
+      {
+        is_valid: false,
+        score: 0,
+        failed_requirements: ['Password validation failed'],
+      } as ValidatePasswordResponse,
+      {
+        status: 200,
+        headers: { 'Cache-Control': 'no-store' },
+      }
+    );
+  }
+}

package/src/api-handlers/account/verify-email.ts

@@ -1,134 +1,134 @@
-/**
- * Verify Email 2FA Code Handler
- *
- * Verifies the 2FA email verification code and completes the 2FA flow.
- * Updates the session with new tokens upon successful verification.
- *
- * @package @payez/next-mvp
- */
-
-import { NextRequest, NextResponse } from 'next/server';
-import { idpFetchJSON } from '../../lib/idp-fetch';
-import { ENV_CONFIG } from '../../config/env';
-import { getTokenTestAware } from '../../lib/test-aware-get-token';
-import { transitionTo2FASession } from '../../lib/session-store';
-import { jwtDecode } from '../../lib/jwt-decode';
-import { twoFactorVerifyFailure } from '../../lib/two-factor-verify-failure';
-
-export async function POST(req: NextRequest) {
-  try {
-    // Parse request body
-    const body = await req.json();
-    const verificationCode = body.verificationCode || body.verification_code;
-
-    if (!verificationCode) {
-      return NextResponse.json(
-        {
-          success: false,
-          error: 'Verification code is required',
-          code: 'INVALID_REQUEST',
-        },
-        { status: 400 }
-      );
-    }
-
-    // Call IDP using idpFetchJSON which auto-injects Bearer token from Redis session
-    const result = await idpFetchJSON(req, `${ENV_CONFIG.IDP_URL}/api/ExternalAuth/twofa/email/verify`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ verification_code: verificationCode }),
-    });
-
-    if (!result.ok) {
-      // PAY-1443: never relay the IDP's error text - it arrives as a C# anonymous-object
-      // ToString ("{ message = ... }") on the deployed IDP. Classify it, answer a fixed sentence.
-      return twoFactorVerifyFailure(result, 'email');
-    }
-
-    // Unwrap IDP envelope
-    const unwrappedData = result.json?.data || result.json;
-
-    // If we have new tokens, update the session to complete 2FA
-    // Reports whether the session ACTUALLY transitioned. Must not be assumed
-    // from a 2xx: the IDP can verify the code while we fail to transition
-    // (no tokens returned, or no resolvable session token).
-    let sessionTransitioned = false;
-
-    if (unwrappedData.access_token && unwrappedData.refresh_token) {
-      // Get session token from NextAuth
-      // Support both field names: sessionToken (auth.ts JWT) and redisSessionId (legacy)
-      const token = await getTokenTestAware(req);
-      const sessionToken = (token?.sessionToken || token?.redisSessionId) as string | undefined;
-
-      if (sessionToken) {
-        console.log('[VERIFY_EMAIL] Updating session with new tokens');
-
-        // Decode access token to get actual expiration
-        let accessTokenExpires = Date.now() + (15 * 60 * 1000); // Default: 15 minutes
-        try {
-          const decoded = jwtDecode<{ exp?: number }>(unwrappedData.access_token);
-          if (decoded?.exp) {
-            accessTokenExpires = decoded.exp * 1000; // Convert to milliseconds
-          }
-        } catch (err) {
-          console.warn('[VERIFY_EMAIL] Could not decode access token, using default expiration');
-        }
-
-        // Decode refresh token to get actual expiration (optional)
-        let refreshTokenExpires = Date.now() + (3 * 24 * 60 * 60 * 1000); // Default: 3 days
-        try {
-          const decoded = jwtDecode<{ exp?: number }>(unwrappedData.refresh_token);
-          if (decoded?.exp) {
-            refreshTokenExpires = decoded.exp * 1000;
-          }
-        } catch {
-          // Refresh token may not have exp claim, use default
-        }
-
-        // Update session with new tokens and mark 2FA complete
-        await transitionTo2FASession(
-          sessionToken,
-          {
-            accessToken: unwrappedData.access_token,
-            refreshToken: unwrappedData.refresh_token,
-            accessTokenExpires,
-            refreshTokenExpires
-          },
-          'email' // Store 2FA method for refresh token flow
-        );
-
-        sessionTransitioned = true;
-
-        console.log('[VERIFY_EMAIL] Session updated successfully', {
-          accessTokenExpires: new Date(accessTokenExpires).toISOString(),
-          refreshTokenExpires: new Date(refreshTokenExpires).toISOString()
-        });
-      } else {
-        console.warn('[VERIFY_EMAIL] IDP verified the code but no session token was resolvable — session NOT transitioned');
-      }
-    } else {
-      console.warn('[VERIFY_EMAIL] IDP returned 2xx without tokens — session NOT transitioned');
-    }
-
-    // Return simplified success response (don't expose tokens to client)
-    return NextResponse.json({
-      success: true,
-      verificationSuccessful: true,
-      // NOT a copy of `success` — reports what actually happened. A client that
-      // trusted a hardcoded true would show the user as MFA-verified while the
-      // session still says otherwise.
-      twoFactorSessionVerified: sessionTransitioned,
-      message: unwrappedData.message || 'Email code verified successfully'
-    }, { status: 200 });
-  } catch (error) {
-    console.error('[VERIFY_EMAIL] Error:', error);
-    return NextResponse.json(
-      {
-        success: false,
-        error: 'Failed to verify code',
-        code: 'INTERNAL_ERROR',
-      },
-      { status: 500 }
-    );
-  }
-}
+/**
+ * Verify Email 2FA Code Handler
+ *
+ * Verifies the 2FA email verification code and completes the 2FA flow.
+ * Updates the session with new tokens upon successful verification.
+ *
+ * @package @payez/next-mvp
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { idpFetchJSON } from '../../lib/idp-fetch';
+import { ENV_CONFIG } from '../../config/env';
+import { getTokenTestAware } from '../../lib/test-aware-get-token';
+import { transitionTo2FASession } from '../../lib/session-store';
+import { jwtDecode } from '../../lib/jwt-decode';
+import { twoFactorVerifyFailure } from '../../lib/two-factor-verify-failure';
+
+export async function POST(req: NextRequest) {
+  try {
+    // Parse request body
+    const body = await req.json();
+    const verificationCode = body.verificationCode || body.verification_code;
+
+    if (!verificationCode) {
+      return NextResponse.json(
+        {
+          success: false,
+          error: 'Verification code is required',
+          code: 'INVALID_REQUEST',
+        },
+        { status: 400 }
+      );
+    }
+
+    // Call IDP using idpFetchJSON which auto-injects Bearer token from Redis session
+    const result = await idpFetchJSON(req, `${ENV_CONFIG.IDP_URL}/api/ExternalAuth/twofa/email/verify`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ verification_code: verificationCode }),
+    });
+
+    if (!result.ok) {
+      // PAY-1443: never relay the IDP's error text - it arrives as a C# anonymous-object
+      // ToString ("{ message = ... }") on the deployed IDP. Classify it, answer a fixed sentence.
+      return twoFactorVerifyFailure(result, 'email');
+    }
+
+    // Unwrap IDP envelope
+    const unwrappedData = result.json?.data || result.json;
+
+    // If we have new tokens, update the session to complete 2FA
+    // Reports whether the session ACTUALLY transitioned. Must not be assumed
+    // from a 2xx: the IDP can verify the code while we fail to transition
+    // (no tokens returned, or no resolvable session token).
+    let sessionTransitioned = false;
+
+    if (unwrappedData.access_token && unwrappedData.refresh_token) {
+      // Get session token from NextAuth
+      // Support both field names: sessionToken (auth.ts JWT) and redisSessionId (legacy)
+      const token = await getTokenTestAware(req);
+      const sessionToken = (token?.sessionToken || token?.redisSessionId) as string | undefined;
+
+      if (sessionToken) {
+        console.log('[VERIFY_EMAIL] Updating session with new tokens');
+
+        // Decode access token to get actual expiration
+        let accessTokenExpires = Date.now() + (15 * 60 * 1000); // Default: 15 minutes
+        try {
+          const decoded = jwtDecode<{ exp?: number }>(unwrappedData.access_token);
+          if (decoded?.exp) {
+            accessTokenExpires = decoded.exp * 1000; // Convert to milliseconds
+          }
+        } catch (err) {
+          console.warn('[VERIFY_EMAIL] Could not decode access token, using default expiration');
+        }
+
+        // Decode refresh token to get actual expiration (optional)
+        let refreshTokenExpires = Date.now() + (3 * 24 * 60 * 60 * 1000); // Default: 3 days
+        try {
+          const decoded = jwtDecode<{ exp?: number }>(unwrappedData.refresh_token);
+          if (decoded?.exp) {
+            refreshTokenExpires = decoded.exp * 1000;
+          }
+        } catch {
+          // Refresh token may not have exp claim, use default
+        }
+
+        // Update session with new tokens and mark 2FA complete
+        await transitionTo2FASession(
+          sessionToken,
+          {
+            accessToken: unwrappedData.access_token,
+            refreshToken: unwrappedData.refresh_token,
+            accessTokenExpires,
+            refreshTokenExpires
+          },
+          'email' // Store 2FA method for refresh token flow
+        );
+
+        sessionTransitioned = true;
+
+        console.log('[VERIFY_EMAIL] Session updated successfully', {
+          accessTokenExpires: new Date(accessTokenExpires).toISOString(),
+          refreshTokenExpires: new Date(refreshTokenExpires).toISOString()
+        });
+      } else {
+        console.warn('[VERIFY_EMAIL] IDP verified the code but no session token was resolvable — session NOT transitioned');
+      }
+    } else {
+      console.warn('[VERIFY_EMAIL] IDP returned 2xx without tokens — session NOT transitioned');
+    }
+
+    // Return simplified success response (don't expose tokens to client)
+    return NextResponse.json({
+      success: true,
+      verificationSuccessful: true,
+      // NOT a copy of `success` — reports what actually happened. A client that
+      // trusted a hardcoded true would show the user as MFA-verified while the
+      // session still says otherwise.
+      twoFactorSessionVerified: sessionTransitioned,
+      message: unwrappedData.message || 'Email code verified successfully'
+    }, { status: 200 });
+  } catch (error) {
+    console.error('[VERIFY_EMAIL] Error:', error);
+    return NextResponse.json(
+      {
+        success: false,
+        error: 'Failed to verify code',
+        code: 'INTERNAL_ERROR',
+      },
+      { status: 500 }
+    );
+  }
+}