@payez/next-mvp 4.8.1 → 4.8.3

package/src/models/SessionModel.ts

@@ -1,331 +1,331 @@
-/**
- * Session Model - Redis Session Data Structure
- *
- * This is the single source of truth for session data stored in Redis.
- * The session contains all authentication state - the JWT cookie only
- * stores the session ID (redisSessionId).
- *
- * FIELD NAMING CONVENTIONS:
- * - idp* prefix: Tokens from PayEz IDP (identity provider)
- * - oauth* prefix: Tokens from external OAuth providers (Google, etc.)
- * - mfa* prefix: Multi-factor authentication related fields
- *
- * @version 2.0.0 - Normalized field names
- * @since auth-refactor-2026-01
- */
-
-// ============================================================================
-// NORMALIZED SESSION DATA (v2)
-// ============================================================================
-
-/**
- * Session data stored in Redis.
- *
- * This interface uses normalized field names for clarity.
- * All tokens and user data live here - the browser only gets the session ID.
- */
-export interface SessionData {
-  // -------------------------------------------------------------------------
-  // Core Identity
-  // -------------------------------------------------------------------------
-
-  /** User ID from IDP (sub claim) */
-  userId: string;
-
-  /** User's email address */
-  email: string;
-
-  /** Display name (from OAuth profile or IDP) */
-  name?: string;
-
-  /** Avatar image URL (from OAuth profile) */
-  image?: string;
-
-  /** User's roles/permissions */
-  roles: string[];
-
-  // -------------------------------------------------------------------------
-  // IDP Tokens (from PayEz Identity Provider)
-  // -------------------------------------------------------------------------
-
-  /** IDP access token (JWT) - used for API calls to PayEz services */
-  idpAccessToken?: string;
-
-  /** IDP refresh token - used to get new access tokens */
-  idpRefreshToken?: string;
-
-  /** When the IDP access token expires (Unix timestamp ms) */
-  idpAccessTokenExpires: number;
-
-  /** When the IDP refresh token expires (Unix timestamp ms) */
-  idpRefreshTokenExpires?: number;
-
-  /** Decoded IDP access token claims (for quick access without re-decoding) */
-  decodedAccessToken?: any;
-
-  /**
-   * Bearer Key ID (kid from JWT header).
-   * Identifies which IDP signing key was used for this token.
-   * CRITICAL: This is from the JWT HEADER, not client_id from payload.
-   */
-  bearerKeyId?: string;
-
-  // -------------------------------------------------------------------------
-  // MFA (Multi-Factor Authentication) State
-  // -------------------------------------------------------------------------
-
-  /** Whether MFA has been verified for this session */
-  mfaVerified: boolean;
-
-  /**
-   * *** R807 (BAPert, card 362550). DID THE PRODUCER ACTUALLY SAY ANYTHING ABOUT MFA? ***
-   *
-   * `mfaVerified` above is deliberately FAIL-CLOSED: every construction site
-   * collapses an absent value to `false` (`?? false`), so by the time anyone
-   * reads it, "the producer said false" and "the producer said nothing" are
-   * indistinguishable. That collapse is CORRECT and must not be removed - a
-   * security consumer treating absence as "verified" is an AUTH BYPASS.
-   *
-   * But `routes/auth/viability.ts` asks a genuinely different question: "did the
-   * OAuth callback AFFIRMATIVELY set false, or did we simply never know?" It
-   * cannot ask that of a field whose absence has already been collapsed. This
-   * field carries that one bit, so the collapse can stay.
-   *
-   *   true      -> the producer emitted an explicit mfaVerified; `mfaVerified` is a measurement.
-   *   false     -> the producer emitted nothing; `mfaVerified`'s `false` is a DEFAULT, not a signal.
-   *   undefined -> LEGACY SESSION, minted before this field existed. Same meaning as `false`
-   *                for viability (do NOT force a re-challenge), and it is why this is
-   *                optional rather than defaulted: `?? false` here would be the very
-   *                absence-destroying move this field exists to undo.
-   *
-   * *** CONFINED, BY RULING: THIS FIELD MUST NEVER REACH AN AUTH DECISION. ***
-   * It exists to make viability LESS aggressive (suppressing a mass re-challenge of
-   * the pre-existing session population). Letting it influence an auth path would
-   * turn a permissive read into a fail-open, and R807 is void if it does. Gate on
-   * `mfaVerified` for anything that grants access; gate on this only to decide
-   * whether `mfaVerified === false` was a real statement.
-   *
-   * *** DECLARING IT HERE IS LOAD-BEARING FOR MORE THAN DOCUMENTATION. ***
-   * `SessionData` carries `[key: string]: any` (the "backward compatibility"
-   * member at the END of this interface, added for migration back-compat — it
-   * was line 147 before this block was inserted above it, which is the number
-   * quoted in R807/362550; adding these lines moved it down, so find it by name,
-   * not by number). Any field NOT declared explicitly is absorbed by that index
-   * signature and becomes `any` - so an undeclared `mfaSignalPresent` would let a
-   * typo at the consumer compile clean and read `undefined` forever, silently
-   * disabling the viability override. Measured, not assumed: see the card.
-   */
-  mfaSignalPresent?: boolean;
-
-  /**
-   * The IDP's own routing decision for a 2FA-pending login (cards 141688 /
-   * 141741, IDP WO 113023). Wire name is snake — `next_step`.
-   *
-   *   'enroll_mfa'  — no USABLE method (confirmed and not revoked). The user
-   *                   cannot complete a challenge; they must enrol first.
-   *   'mfa_verify'  — a usable method exists; challenge them.
-   *   null          — fully authenticated, nothing outstanding.
-   *
-   * RELAYED, NEVER DERIVED. The IDP owns this fact and is already usable-aware;
-   * recomputing it here from a method count would make a second owner and would
-   * get the revoked-method case wrong (count>0 but usable=0).
-   *
-   * NOT A COMPLETION SIGNAL. 'mfa_verify' means "can be challenged", not
-   * "is through". `mfaVerified` remains the only field that says they verified.
-   */
-  nextStep?: 'enroll_mfa' | 'mfa_verify' | null;
-
-  /** The MFA method used (email, sms, totp) */
-  mfaMethod?: 'email' | 'sms' | 'totp';
-
-  /** When MFA was completed (Unix timestamp ms) */
-  mfaCompletedAt?: number;
-
-  /** When MFA verification expires (Unix timestamp ms) */
-  mfaExpiresAt?: number;
-
-  /** How long MFA is valid in hours */
-  mfaValidityHours?: number;
-
-  /** Authentication methods from token (amr claim) */
-  authenticationMethods?: string[];
-
-  /** Authentication level from token (acr claim) */
-  authenticationLevel?: string;
-
-  // -------------------------------------------------------------------------
-  // OAuth Provider Tokens (Google, Microsoft, etc.)
-  // -------------------------------------------------------------------------
-
-  /** Which OAuth provider was used (google, apple, microsoft, etc.) */
-  oauthProvider?: string;
-
-  /** Access token from OAuth provider */
-  oauthProviderToken?: string;
-
-  /** Refresh token from OAuth provider */
-  oauthProviderRefreshToken?: string;
-
-  // -------------------------------------------------------------------------
-  // Multi-Tenant IDP Assignment
-  // -------------------------------------------------------------------------
-
-  /** IDP client ID this user belongs to */
-  idpClientId?: string;
-
-  /** Merchant ID (typically same as client ID) */
-  merchantId?: string;
-
-  // -------------------------------------------------------------------------
-  // Legacy Field Support (for backward compatibility)
-  // -------------------------------------------------------------------------
-
-  /**
-   * Allow any additional fields for backward compatibility.
-   * During migration, old sessions may have legacy field names.
-   */
-  [key: string]: any;
-}
-
-
-// ============================================================================
-// SESSION MODEL CLASS
-// ============================================================================
-
-/**
- * Session model class for working with session data.
- *
- * Provides typed access to session fields with normalized names.
- */
-export class SessionModel {
-  // Core Identity
-  userId: string;
-  email: string;
-  name?: string;
-  image?: string;
-  roles: string[];
-
-  // IDP Tokens
-  idpAccessToken?: string;
-  idpRefreshToken?: string;
-  idpAccessTokenExpires: number;
-  idpRefreshTokenExpires?: number;
-  decodedAccessToken?: any;
-  bearerKeyId?: string;
-
-  // MFA State
-  mfaVerified: boolean;
-  /** R807: see SessionData.mfaSignalPresent. Propagated verbatim, never defaulted. */
-  mfaSignalPresent?: boolean;
-  mfaMethod?: 'email' | 'sms' | 'totp';
-  mfaCompletedAt?: number;
-  mfaExpiresAt?: number;
-  mfaValidityHours?: number;
-  authenticationMethods?: string[];
-  authenticationLevel?: string;
-
-  // OAuth Provider
-  oauthProvider?: string;
-  oauthProviderToken?: string;
-  oauthProviderRefreshToken?: string;
-
-  // Multi-Tenant
-  idpClientId?: string;
-  merchantId?: string;
-
-  constructor(data: SessionData) {
-    // Core Identity
-    this.userId = data.userId;
-    this.email = data.email;
-    this.name = data.name;
-    this.image = data.image;
-    this.roles = data.roles || [];
-
-    // IDP Tokens
-    this.idpAccessToken = data.idpAccessToken;
-    this.idpRefreshToken = data.idpRefreshToken;
-    this.idpAccessTokenExpires = data.idpAccessTokenExpires;
-    this.idpRefreshTokenExpires = data.idpRefreshTokenExpires;
-    this.decodedAccessToken = data.decodedAccessToken;
-    this.bearerKeyId = data.bearerKeyId;
-
-    // MFA State
-    this.mfaVerified = data.mfaVerified ?? false;
-    // *** R807: PROPAGATE, DO NOT DEFAULT. *** `?? false` here would destroy the
-    // legacy/never-knew distinction on every path through this class - invisibly,
-    // because callers construct a SessionModel without restating the field.
-    this.mfaSignalPresent = data.mfaSignalPresent;
-    this.mfaMethod = data.mfaMethod;
-    this.mfaCompletedAt = data.mfaCompletedAt;
-    this.mfaExpiresAt = data.mfaExpiresAt;
-    this.mfaValidityHours = data.mfaValidityHours;
-    this.authenticationMethods = data.authenticationMethods;
-    this.authenticationLevel = data.authenticationLevel;
-
-    // OAuth Provider
-    this.oauthProvider = data.oauthProvider;
-    this.oauthProviderToken = data.oauthProviderToken;
-    this.oauthProviderRefreshToken = data.oauthProviderRefreshToken;
-
-    // Multi-Tenant
-    this.idpClientId = data.idpClientId;
-    this.merchantId = data.merchantId;
-  }
-
-  /**
-   * Check if the IDP access token has expired.
-   */
-  isAccessTokenExpired(): boolean {
-    return Date.now() >= this.idpAccessTokenExpires;
-  }
-
-  /**
-   * Check if the IDP refresh token has expired.
-   */
-  isRefreshTokenExpired(): boolean {
-    if (!this.idpRefreshTokenExpires) return false;
-    return Date.now() >= this.idpRefreshTokenExpires;
-  }
-
-  /**
-   * Check if MFA has expired.
-   */
-  isMfaExpired(): boolean {
-    if (!this.mfaExpiresAt) return false;
-    return Date.now() > this.mfaExpiresAt;
-  }
-
-  /**
-   * Convert to plain object for storage.
-   */
-  toJSON(): SessionData {
-    return {
-      userId: this.userId,
-      email: this.email,
-      name: this.name,
-      image: this.image,
-      roles: this.roles,
-      idpAccessToken: this.idpAccessToken,
-      idpRefreshToken: this.idpRefreshToken,
-      idpAccessTokenExpires: this.idpAccessTokenExpires,
-      idpRefreshTokenExpires: this.idpRefreshTokenExpires,
-      decodedAccessToken: this.decodedAccessToken,
-      bearerKeyId: this.bearerKeyId,
-      mfaVerified: this.mfaVerified,
-      // R807: must survive the Redis round-trip, or the session is re-read as
-      // `legacy` one hop later and viability silently stops firing.
-      mfaSignalPresent: this.mfaSignalPresent,
-      mfaMethod: this.mfaMethod,
-      mfaCompletedAt: this.mfaCompletedAt,
-      mfaExpiresAt: this.mfaExpiresAt,
-      mfaValidityHours: this.mfaValidityHours,
-      authenticationMethods: this.authenticationMethods,
-      authenticationLevel: this.authenticationLevel,
-      oauthProvider: this.oauthProvider,
-      oauthProviderToken: this.oauthProviderToken,
-      oauthProviderRefreshToken: this.oauthProviderRefreshToken,
-      idpClientId: this.idpClientId,
-      merchantId: this.merchantId,
-    };
-  }
-}
+/**
+ * Session Model - Redis Session Data Structure
+ *
+ * This is the single source of truth for session data stored in Redis.
+ * The session contains all authentication state - the JWT cookie only
+ * stores the session ID (redisSessionId).
+ *
+ * FIELD NAMING CONVENTIONS:
+ * - idp* prefix: Tokens from PayEz IDP (identity provider)
+ * - oauth* prefix: Tokens from external OAuth providers (Google, etc.)
+ * - mfa* prefix: Multi-factor authentication related fields
+ *
+ * @version 2.0.0 - Normalized field names
+ * @since auth-refactor-2026-01
+ */
+
+// ============================================================================
+// NORMALIZED SESSION DATA (v2)
+// ============================================================================
+
+/**
+ * Session data stored in Redis.
+ *
+ * This interface uses normalized field names for clarity.
+ * All tokens and user data live here - the browser only gets the session ID.
+ */
+export interface SessionData {
+  // -------------------------------------------------------------------------
+  // Core Identity
+  // -------------------------------------------------------------------------
+
+  /** User ID from IDP (sub claim) */
+  userId: string;
+
+  /** User's email address */
+  email: string;
+
+  /** Display name (from OAuth profile or IDP) */
+  name?: string;
+
+  /** Avatar image URL (from OAuth profile) */
+  image?: string;
+
+  /** User's roles/permissions */
+  roles: string[];
+
+  // -------------------------------------------------------------------------
+  // IDP Tokens (from PayEz Identity Provider)
+  // -------------------------------------------------------------------------
+
+  /** IDP access token (JWT) - used for API calls to PayEz services */
+  idpAccessToken?: string;
+
+  /** IDP refresh token - used to get new access tokens */
+  idpRefreshToken?: string;
+
+  /** When the IDP access token expires (Unix timestamp ms) */
+  idpAccessTokenExpires: number;
+
+  /** When the IDP refresh token expires (Unix timestamp ms) */
+  idpRefreshTokenExpires?: number;
+
+  /** Decoded IDP access token claims (for quick access without re-decoding) */
+  decodedAccessToken?: any;
+
+  /**
+   * Bearer Key ID (kid from JWT header).
+   * Identifies which IDP signing key was used for this token.
+   * CRITICAL: This is from the JWT HEADER, not client_id from payload.
+   */
+  bearerKeyId?: string;
+
+  // -------------------------------------------------------------------------
+  // MFA (Multi-Factor Authentication) State
+  // -------------------------------------------------------------------------
+
+  /** Whether MFA has been verified for this session */
+  mfaVerified: boolean;
+
+  /**
+   * *** R807 (BAPert, card 362550). DID THE PRODUCER ACTUALLY SAY ANYTHING ABOUT MFA? ***
+   *
+   * `mfaVerified` above is deliberately FAIL-CLOSED: every construction site
+   * collapses an absent value to `false` (`?? false`), so by the time anyone
+   * reads it, "the producer said false" and "the producer said nothing" are
+   * indistinguishable. That collapse is CORRECT and must not be removed - a
+   * security consumer treating absence as "verified" is an AUTH BYPASS.
+   *
+   * But `routes/auth/viability.ts` asks a genuinely different question: "did the
+   * OAuth callback AFFIRMATIVELY set false, or did we simply never know?" It
+   * cannot ask that of a field whose absence has already been collapsed. This
+   * field carries that one bit, so the collapse can stay.
+   *
+   *   true      -> the producer emitted an explicit mfaVerified; `mfaVerified` is a measurement.
+   *   false     -> the producer emitted nothing; `mfaVerified`'s `false` is a DEFAULT, not a signal.
+   *   undefined -> LEGACY SESSION, minted before this field existed. Same meaning as `false`
+   *                for viability (do NOT force a re-challenge), and it is why this is
+   *                optional rather than defaulted: `?? false` here would be the very
+   *                absence-destroying move this field exists to undo.
+   *
+   * *** CONFINED, BY RULING: THIS FIELD MUST NEVER REACH AN AUTH DECISION. ***
+   * It exists to make viability LESS aggressive (suppressing a mass re-challenge of
+   * the pre-existing session population). Letting it influence an auth path would
+   * turn a permissive read into a fail-open, and R807 is void if it does. Gate on
+   * `mfaVerified` for anything that grants access; gate on this only to decide
+   * whether `mfaVerified === false` was a real statement.
+   *
+   * *** DECLARING IT HERE IS LOAD-BEARING FOR MORE THAN DOCUMENTATION. ***
+   * `SessionData` carries `[key: string]: any` (the "backward compatibility"
+   * member at the END of this interface, added for migration back-compat — it
+   * was line 147 before this block was inserted above it, which is the number
+   * quoted in R807/362550; adding these lines moved it down, so find it by name,
+   * not by number). Any field NOT declared explicitly is absorbed by that index
+   * signature and becomes `any` - so an undeclared `mfaSignalPresent` would let a
+   * typo at the consumer compile clean and read `undefined` forever, silently
+   * disabling the viability override. Measured, not assumed: see the card.
+   */
+  mfaSignalPresent?: boolean;
+
+  /**
+   * The IDP's own routing decision for a 2FA-pending login (cards 141688 /
+   * 141741, IDP WO 113023). Wire name is snake — `next_step`.
+   *
+   *   'enroll_mfa'  — no USABLE method (confirmed and not revoked). The user
+   *                   cannot complete a challenge; they must enrol first.
+   *   'mfa_verify'  — a usable method exists; challenge them.
+   *   null          — fully authenticated, nothing outstanding.
+   *
+   * RELAYED, NEVER DERIVED. The IDP owns this fact and is already usable-aware;
+   * recomputing it here from a method count would make a second owner and would
+   * get the revoked-method case wrong (count>0 but usable=0).
+   *
+   * NOT A COMPLETION SIGNAL. 'mfa_verify' means "can be challenged", not
+   * "is through". `mfaVerified` remains the only field that says they verified.
+   */
+  nextStep?: 'enroll_mfa' | 'mfa_verify' | null;
+
+  /** The MFA method used (email, sms, totp) */
+  mfaMethod?: 'email' | 'sms' | 'totp';
+
+  /** When MFA was completed (Unix timestamp ms) */
+  mfaCompletedAt?: number;
+
+  /** When MFA verification expires (Unix timestamp ms) */
+  mfaExpiresAt?: number;
+
+  /** How long MFA is valid in hours */
+  mfaValidityHours?: number;
+
+  /** Authentication methods from token (amr claim) */
+  authenticationMethods?: string[];
+
+  /** Authentication level from token (acr claim) */
+  authenticationLevel?: string;
+
+  // -------------------------------------------------------------------------
+  // OAuth Provider Tokens (Google, Microsoft, etc.)
+  // -------------------------------------------------------------------------
+
+  /** Which OAuth provider was used (google, apple, microsoft, etc.) */
+  oauthProvider?: string;
+
+  /** Access token from OAuth provider */
+  oauthProviderToken?: string;
+
+  /** Refresh token from OAuth provider */
+  oauthProviderRefreshToken?: string;
+
+  // -------------------------------------------------------------------------
+  // Multi-Tenant IDP Assignment
+  // -------------------------------------------------------------------------
+
+  /** IDP client ID this user belongs to */
+  idpClientId?: string;
+
+  /** Merchant ID (typically same as client ID) */
+  merchantId?: string;
+
+  // -------------------------------------------------------------------------
+  // Legacy Field Support (for backward compatibility)
+  // -------------------------------------------------------------------------
+
+  /**
+   * Allow any additional fields for backward compatibility.
+   * During migration, old sessions may have legacy field names.
+   */
+  [key: string]: any;
+}
+
+
+// ============================================================================
+// SESSION MODEL CLASS
+// ============================================================================
+
+/**
+ * Session model class for working with session data.
+ *
+ * Provides typed access to session fields with normalized names.
+ */
+export class SessionModel {
+  // Core Identity
+  userId: string;
+  email: string;
+  name?: string;
+  image?: string;
+  roles: string[];
+
+  // IDP Tokens
+  idpAccessToken?: string;
+  idpRefreshToken?: string;
+  idpAccessTokenExpires: number;
+  idpRefreshTokenExpires?: number;
+  decodedAccessToken?: any;
+  bearerKeyId?: string;
+
+  // MFA State
+  mfaVerified: boolean;
+  /** R807: see SessionData.mfaSignalPresent. Propagated verbatim, never defaulted. */
+  mfaSignalPresent?: boolean;
+  mfaMethod?: 'email' | 'sms' | 'totp';
+  mfaCompletedAt?: number;
+  mfaExpiresAt?: number;
+  mfaValidityHours?: number;
+  authenticationMethods?: string[];
+  authenticationLevel?: string;
+
+  // OAuth Provider
+  oauthProvider?: string;
+  oauthProviderToken?: string;
+  oauthProviderRefreshToken?: string;
+
+  // Multi-Tenant
+  idpClientId?: string;
+  merchantId?: string;
+
+  constructor(data: SessionData) {
+    // Core Identity
+    this.userId = data.userId;
+    this.email = data.email;
+    this.name = data.name;
+    this.image = data.image;
+    this.roles = data.roles || [];
+
+    // IDP Tokens
+    this.idpAccessToken = data.idpAccessToken;
+    this.idpRefreshToken = data.idpRefreshToken;
+    this.idpAccessTokenExpires = data.idpAccessTokenExpires;
+    this.idpRefreshTokenExpires = data.idpRefreshTokenExpires;
+    this.decodedAccessToken = data.decodedAccessToken;
+    this.bearerKeyId = data.bearerKeyId;
+
+    // MFA State
+    this.mfaVerified = data.mfaVerified ?? false;
+    // *** R807: PROPAGATE, DO NOT DEFAULT. *** `?? false` here would destroy the
+    // legacy/never-knew distinction on every path through this class - invisibly,
+    // because callers construct a SessionModel without restating the field.
+    this.mfaSignalPresent = data.mfaSignalPresent;
+    this.mfaMethod = data.mfaMethod;
+    this.mfaCompletedAt = data.mfaCompletedAt;
+    this.mfaExpiresAt = data.mfaExpiresAt;
+    this.mfaValidityHours = data.mfaValidityHours;
+    this.authenticationMethods = data.authenticationMethods;
+    this.authenticationLevel = data.authenticationLevel;
+
+    // OAuth Provider
+    this.oauthProvider = data.oauthProvider;
+    this.oauthProviderToken = data.oauthProviderToken;
+    this.oauthProviderRefreshToken = data.oauthProviderRefreshToken;
+
+    // Multi-Tenant
+    this.idpClientId = data.idpClientId;
+    this.merchantId = data.merchantId;
+  }
+
+  /**
+   * Check if the IDP access token has expired.
+   */
+  isAccessTokenExpired(): boolean {
+    return Date.now() >= this.idpAccessTokenExpires;
+  }
+
+  /**
+   * Check if the IDP refresh token has expired.
+   */
+  isRefreshTokenExpired(): boolean {
+    if (!this.idpRefreshTokenExpires) return false;
+    return Date.now() >= this.idpRefreshTokenExpires;
+  }
+
+  /**
+   * Check if MFA has expired.
+   */
+  isMfaExpired(): boolean {
+    if (!this.mfaExpiresAt) return false;
+    return Date.now() > this.mfaExpiresAt;
+  }
+
+  /**
+   * Convert to plain object for storage.
+   */
+  toJSON(): SessionData {
+    return {
+      userId: this.userId,
+      email: this.email,
+      name: this.name,
+      image: this.image,
+      roles: this.roles,
+      idpAccessToken: this.idpAccessToken,
+      idpRefreshToken: this.idpRefreshToken,
+      idpAccessTokenExpires: this.idpAccessTokenExpires,
+      idpRefreshTokenExpires: this.idpRefreshTokenExpires,
+      decodedAccessToken: this.decodedAccessToken,
+      bearerKeyId: this.bearerKeyId,
+      mfaVerified: this.mfaVerified,
+      // R807: must survive the Redis round-trip, or the session is re-read as
+      // `legacy` one hop later and viability silently stops firing.
+      mfaSignalPresent: this.mfaSignalPresent,
+      mfaMethod: this.mfaMethod,
+      mfaCompletedAt: this.mfaCompletedAt,
+      mfaExpiresAt: this.mfaExpiresAt,
+      mfaValidityHours: this.mfaValidityHours,
+      authenticationMethods: this.authenticationMethods,
+      authenticationLevel: this.authenticationLevel,
+      oauthProvider: this.oauthProvider,
+      oauthProviderToken: this.oauthProviderToken,
+      oauthProviderRefreshToken: this.oauthProviderRefreshToken,
+      idpClientId: this.idpClientId,
+      merchantId: this.merchantId,
+    };
+  }
+}