@payez/next-mvp 4.8.1 → 4.8.3

package/src/api-handlers/anon/preferences.ts

@@ -1,123 +1,123 @@
-/**
- * Anonymous Session Preferences API Handler
- *
- * GET /api/anon/preferences - Get current preferences
- * POST /api/anon/preferences - Update preferences
- *
- * Sets a cookie to track anonymous visitors and stores preferences in Redis.
- */
-
-import { NextRequest, NextResponse } from 'next/server';
-import { cookies } from 'next/headers';
-import {
-  getOrCreateAnonSession,
-  updateAnonPreferences,
-  ANON_COOKIE_NAME,
-  AnonSessionPreferences,
-} from '../../lib/anon-session';
-
-const COOKIE_MAX_AGE = 90 * 24 * 60 * 60; // 90 days in seconds
-
-/**
- * GET handler - retrieves anonymous session preferences
- */
-export async function GET(request: NextRequest) {
-  try {
-    const cookieStore = await cookies();
-    let anonId = cookieStore.get(ANON_COOKIE_NAME)?.value;
-
-    // Get or create session
-    const session = await getOrCreateAnonSession(anonId);
-
-    // Build response
-    const response = NextResponse.json({
-      success: true,
-      data: {
-        id: session.id,
-        preferences: session.preferences,
-        metrics: session.metrics,
-      },
-    });
-
-    // Set cookie if it's a new session
-    if (!anonId || anonId !== session.id) {
-      response.cookies.set(ANON_COOKIE_NAME, session.id, {
-        httpOnly: true,
-        secure: process.env.NODE_ENV === 'production',
-        sameSite: 'lax',
-        maxAge: COOKIE_MAX_AGE,
-        path: '/',
-      });
-    }
-
-    return response;
-  } catch (error) {
-    console.error('[ANON-PREFERENCES] GET error:', error);
-    return NextResponse.json(
-      { success: false, error: 'Failed to get preferences' },
-      { status: 500 }
-    );
-  }
-}
-
-/**
- * POST handler - updates anonymous session preferences
- */
-export async function POST(request: NextRequest) {
-  try {
-    const cookieStore = await cookies();
-    let anonId = cookieStore.get(ANON_COOKIE_NAME)?.value;
-
-    // Get or create session first
-    const session = await getOrCreateAnonSession(anonId);
-    anonId = session.id;
-
-    // Parse body for preferences to update
-    const body = await request.json();
-    const preferences: Partial<AnonSessionPreferences> = body.preferences || body;
-
-    // Validate preferences
-    if (typeof preferences !== 'object') {
-      return NextResponse.json(
-        { success: false, error: 'Invalid preferences format' },
-        { status: 400 }
-      );
-    }
-
-    // Update preferences
-    const updatedSession = await updateAnonPreferences(anonId, preferences);
-
-    if (!updatedSession) {
-      return NextResponse.json(
-        { success: false, error: 'Session not found' },
-        { status: 404 }
-      );
-    }
-
-    // Build response
-    const response = NextResponse.json({
-      success: true,
-      data: {
-        id: updatedSession.id,
-        preferences: updatedSession.preferences,
-      },
-    });
-
-    // Ensure cookie is set
-    response.cookies.set(ANON_COOKIE_NAME, anonId, {
-      httpOnly: true,
-      secure: process.env.NODE_ENV === 'production',
-      sameSite: 'lax',
-      maxAge: COOKIE_MAX_AGE,
-      path: '/',
-    });
-
-    return response;
-  } catch (error) {
-    console.error('[ANON-PREFERENCES] POST error:', error);
-    return NextResponse.json(
-      { success: false, error: 'Failed to update preferences' },
-      { status: 500 }
-    );
-  }
-}
+/**
+ * Anonymous Session Preferences API Handler
+ *
+ * GET /api/anon/preferences - Get current preferences
+ * POST /api/anon/preferences - Update preferences
+ *
+ * Sets a cookie to track anonymous visitors and stores preferences in Redis.
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
+import {
+  getOrCreateAnonSession,
+  updateAnonPreferences,
+  ANON_COOKIE_NAME,
+  AnonSessionPreferences,
+} from '../../lib/anon-session';
+
+const COOKIE_MAX_AGE = 90 * 24 * 60 * 60; // 90 days in seconds
+
+/**
+ * GET handler - retrieves anonymous session preferences
+ */
+export async function GET(request: NextRequest) {
+  try {
+    const cookieStore = await cookies();
+    let anonId = cookieStore.get(ANON_COOKIE_NAME)?.value;
+
+    // Get or create session
+    const session = await getOrCreateAnonSession(anonId);
+
+    // Build response
+    const response = NextResponse.json({
+      success: true,
+      data: {
+        id: session.id,
+        preferences: session.preferences,
+        metrics: session.metrics,
+      },
+    });
+
+    // Set cookie if it's a new session
+    if (!anonId || anonId !== session.id) {
+      response.cookies.set(ANON_COOKIE_NAME, session.id, {
+        httpOnly: true,
+        secure: process.env.NODE_ENV === 'production',
+        sameSite: 'lax',
+        maxAge: COOKIE_MAX_AGE,
+        path: '/',
+      });
+    }
+
+    return response;
+  } catch (error) {
+    console.error('[ANON-PREFERENCES] GET error:', error);
+    return NextResponse.json(
+      { success: false, error: 'Failed to get preferences' },
+      { status: 500 }
+    );
+  }
+}
+
+/**
+ * POST handler - updates anonymous session preferences
+ */
+export async function POST(request: NextRequest) {
+  try {
+    const cookieStore = await cookies();
+    let anonId = cookieStore.get(ANON_COOKIE_NAME)?.value;
+
+    // Get or create session first
+    const session = await getOrCreateAnonSession(anonId);
+    anonId = session.id;
+
+    // Parse body for preferences to update
+    const body = await request.json();
+    const preferences: Partial<AnonSessionPreferences> = body.preferences || body;
+
+    // Validate preferences
+    if (typeof preferences !== 'object') {
+      return NextResponse.json(
+        { success: false, error: 'Invalid preferences format' },
+        { status: 400 }
+      );
+    }
+
+    // Update preferences
+    const updatedSession = await updateAnonPreferences(anonId, preferences);
+
+    if (!updatedSession) {
+      return NextResponse.json(
+        { success: false, error: 'Session not found' },
+        { status: 404 }
+      );
+    }
+
+    // Build response
+    const response = NextResponse.json({
+      success: true,
+      data: {
+        id: updatedSession.id,
+        preferences: updatedSession.preferences,
+      },
+    });
+
+    // Ensure cookie is set
+    response.cookies.set(ANON_COOKIE_NAME, anonId, {
+      httpOnly: true,
+      secure: process.env.NODE_ENV === 'production',
+      sameSite: 'lax',
+      maxAge: COOKIE_MAX_AGE,
+      path: '/',
+    });
+
+    return response;
+  } catch (error) {
+    console.error('[ANON-PREFERENCES] POST error:', error);
+    return NextResponse.json(
+      { success: false, error: 'Failed to update preferences' },
+      { status: 500 }
+    );
+  }
+}

package/src/api-handlers/auth/credential-login-email-code.ts

@@ -1,92 +1,92 @@
-import { NextRequest, NextResponse } from 'next/server';
-import { getIDPClientConfig } from '../../lib/idp-client-config';
-import { resolveClientKey } from '../../lib/client-key';
-import { bearerFetch } from '../../lib/bearer-fetch';
-
-// `export const runtime = 'nodejs'` must be written LITERALLY in the app's route file (Next ignores a re-exported segment config).
-
-/** One email-code request per this many seconds per browser (the IdP rate-limits too; this stops a double click and a loop). */
-const EMAIL_CODE_COOLDOWN_S = 30;
-
-/**
- * POST /api/auth/admin-login/email-code - PAY-2284: "email me a code instead".
- *
- * WHY THIS EXISTS. The sign-in door sends NO code at all to a user who holds an authenticator ("TOTP wins when present: there is
- * nothing to send"). When that authenticator's secret cannot be decrypted on our side (dev-93, encryption key version 57 gone), the
- * verify step answers "a problem on our side ... use another sign-in method" - and there was no other method on the screen and no
- * code in the user's mailbox, because none had been requested. This route is the missing action: it asks the IdP to EMAIL a code,
- * using the provisional bearer the door already parked in the httpOnly `adm2fa` cookie. The verify turn already tries
- * twofa/email/verify after twofa/totp/verify, so the code is accepted in the same box.
- *
- * What it takes from the browser: NOTHING. No body, no client id, no address - the code goes to the account the provisional bearer
- * belongs to (the IdP decides the recipient). What it answers: { success, codeRequested, sentVia:'email', devVerificationCode? }.
- * `codeRequested` means "we asked", never "a mail arrived" (twofa/email/send returns 200 even when the SMTP send threw, 267561).
- */
-export async function POST(req: NextRequest) {
-  const provisional = req.cookies.get('adm2fa')?.value;
-  if (!provisional) {
-    return NextResponse.json({ success: false, error: 'Your verification window expired. Sign in again.' }, { status: 401 });
-  }
-
-  const last = Number(req.cookies.get('adm2fa_emailreq')?.value);
-  const now = Math.floor(Date.now() / 1000);
-  if (Number.isFinite(last) && last > 0 && now - last < EMAIL_CODE_COOLDOWN_S) {
-    const wait = EMAIL_CODE_COOLDOWN_S - (now - last);
-    return NextResponse.json(
-      { success: false, error: `We just asked for a code. Give it a moment (about ${wait} seconds) before asking again.`, retryAfter: wait },
-      { status: 429 },
-    );
-  }
-
-  let clientKey = '';
-  try {
-    const config = await getIDPClientConfig();
-    clientKey = resolveClientKey(config, 'graft/admin-login/email-code').key ?? '';
-  } catch (err) {
-    console.error('[ADMIN_LOGIN_EMAIL_CODE] IDP client config unavailable:', err instanceof Error ? err.message : String(err));
-    return NextResponse.json(
-      { success: false, error: 'Sign-in is temporarily unavailable. This is a problem on our side. Please try again shortly.' },
-      { status: 503 },
-    );
-  }
-
-  let sendOk = false;
-  let devCode: string | undefined;
-  try {
-    const sendResp = await bearerFetch(`${process.env.IDP_URL}/api/ExternalAuth/twofa/email/send`, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        Accept: 'application/json',
-        Authorization: `Bearer ${provisional}`,
-        'X-Client-Id': clientKey,
-      },
-      body: JSON.stringify({ client_id: clientKey }),
-    });
-    sendOk = sendResp.ok;
-    const text = await sendResp.text().catch(() => '');
-    if (!sendOk) console.error('[ADMIN_LOGIN_EMAIL_CODE] twofa/email/send failed', sendResp.status, text.slice(0, 200));
-    try {
-      const j = JSON.parse(text) as { dev_verification_code?: unknown; data?: { dev_verification_code?: unknown; result?: { dev_verification_code?: unknown } }; result?: { dev_verification_code?: unknown } } | null;
-      const echoed = j?.dev_verification_code ?? j?.data?.dev_verification_code ?? j?.data?.result?.dev_verification_code ?? j?.result?.dev_verification_code;
-      if (typeof echoed === 'string' && echoed) devCode = echoed; // present only when the server chose to echo (dev rigs); absence is the contract
-    } catch {
-      /* not JSON - nothing to echo */
-    }
-  } catch (err) {
-    console.error('[ADMIN_LOGIN_EMAIL_CODE] twofa/email/send fetch failed:', err instanceof Error ? err.message : String(err));
-  }
-
-  if (!sendOk) {
-    return NextResponse.json({ success: false, error: 'We could not ask for an email code just now - this is a problem on our side. Try again shortly.' }, { status: 502 });
-  }
-
-  const res = NextResponse.json(
-    { success: true, codeRequested: true, sentVia: 'email', ...(devCode ? { devVerificationCode: devCode } : {}) },
-    { status: 200 },
-  );
-  const cookie = { httpOnly: true, secure: process.env.NODE_ENV === 'production', sameSite: 'lax' as const, path: '/', maxAge: 600 };
-  res.cookies.set('adm2fa_lane', 'email', cookie); // the verify turn then tries totp -> email, exactly as for any non-SMS user
-  res.cookies.set('adm2fa_emailreq', String(now), { ...cookie, maxAge: EMAIL_CODE_COOLDOWN_S });
-  return res;
-}
+import { NextRequest, NextResponse } from 'next/server';
+import { getIDPClientConfig } from '../../lib/idp-client-config';
+import { resolveClientKey } from '../../lib/client-key';
+import { bearerFetch } from '../../lib/bearer-fetch';
+
+// `export const runtime = 'nodejs'` must be written LITERALLY in the app's route file (Next ignores a re-exported segment config).
+
+/** One email-code request per this many seconds per browser (the IdP rate-limits too; this stops a double click and a loop). */
+const EMAIL_CODE_COOLDOWN_S = 30;
+
+/**
+ * POST /api/auth/admin-login/email-code - PAY-2284: "email me a code instead".
+ *
+ * WHY THIS EXISTS. The sign-in door sends NO code at all to a user who holds an authenticator ("TOTP wins when present: there is
+ * nothing to send"). When that authenticator's secret cannot be decrypted on our side (dev-93, encryption key version 57 gone), the
+ * verify step answers "a problem on our side ... use another sign-in method" - and there was no other method on the screen and no
+ * code in the user's mailbox, because none had been requested. This route is the missing action: it asks the IdP to EMAIL a code,
+ * using the provisional bearer the door already parked in the httpOnly `adm2fa` cookie. The verify turn already tries
+ * twofa/email/verify after twofa/totp/verify, so the code is accepted in the same box.
+ *
+ * What it takes from the browser: NOTHING. No body, no client id, no address - the code goes to the account the provisional bearer
+ * belongs to (the IdP decides the recipient). What it answers: { success, codeRequested, sentVia:'email', devVerificationCode? }.
+ * `codeRequested` means "we asked", never "a mail arrived" (twofa/email/send returns 200 even when the SMTP send threw, 267561).
+ */
+export async function POST(req: NextRequest) {
+  const provisional = req.cookies.get('adm2fa')?.value;
+  if (!provisional) {
+    return NextResponse.json({ success: false, error: 'Your verification window expired. Sign in again.' }, { status: 401 });
+  }
+
+  const last = Number(req.cookies.get('adm2fa_emailreq')?.value);
+  const now = Math.floor(Date.now() / 1000);
+  if (Number.isFinite(last) && last > 0 && now - last < EMAIL_CODE_COOLDOWN_S) {
+    const wait = EMAIL_CODE_COOLDOWN_S - (now - last);
+    return NextResponse.json(
+      { success: false, error: `We just asked for a code. Give it a moment (about ${wait} seconds) before asking again.`, retryAfter: wait },
+      { status: 429 },
+    );
+  }
+
+  let clientKey = '';
+  try {
+    const config = await getIDPClientConfig();
+    clientKey = resolveClientKey(config, 'graft/admin-login/email-code').key ?? '';
+  } catch (err) {
+    console.error('[ADMIN_LOGIN_EMAIL_CODE] IDP client config unavailable:', err instanceof Error ? err.message : String(err));
+    return NextResponse.json(
+      { success: false, error: 'Sign-in is temporarily unavailable. This is a problem on our side. Please try again shortly.' },
+      { status: 503 },
+    );
+  }
+
+  let sendOk = false;
+  let devCode: string | undefined;
+  try {
+    const sendResp = await bearerFetch(`${process.env.IDP_URL}/api/ExternalAuth/twofa/email/send`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Accept: 'application/json',
+        Authorization: `Bearer ${provisional}`,
+        'X-Client-Id': clientKey,
+      },
+      body: JSON.stringify({ client_id: clientKey }),
+    });
+    sendOk = sendResp.ok;
+    const text = await sendResp.text().catch(() => '');
+    if (!sendOk) console.error('[ADMIN_LOGIN_EMAIL_CODE] twofa/email/send failed', sendResp.status, text.slice(0, 200));
+    try {
+      const j = JSON.parse(text) as { dev_verification_code?: unknown; data?: { dev_verification_code?: unknown; result?: { dev_verification_code?: unknown } }; result?: { dev_verification_code?: unknown } } | null;
+      const echoed = j?.dev_verification_code ?? j?.data?.dev_verification_code ?? j?.data?.result?.dev_verification_code ?? j?.result?.dev_verification_code;
+      if (typeof echoed === 'string' && echoed) devCode = echoed; // present only when the server chose to echo (dev rigs); absence is the contract
+    } catch {
+      /* not JSON - nothing to echo */
+    }
+  } catch (err) {
+    console.error('[ADMIN_LOGIN_EMAIL_CODE] twofa/email/send fetch failed:', err instanceof Error ? err.message : String(err));
+  }
+
+  if (!sendOk) {
+    return NextResponse.json({ success: false, error: 'We could not ask for an email code just now - this is a problem on our side. Try again shortly.' }, { status: 502 });
+  }
+
+  const res = NextResponse.json(
+    { success: true, codeRequested: true, sentVia: 'email', ...(devCode ? { devVerificationCode: devCode } : {}) },
+    { status: 200 },
+  );
+  const cookie = { httpOnly: true, secure: process.env.NODE_ENV === 'production', sameSite: 'lax' as const, path: '/', maxAge: 600 };
+  res.cookies.set('adm2fa_lane', 'email', cookie); // the verify turn then tries totp -> email, exactly as for any non-SMS user
+  res.cookies.set('adm2fa_emailreq', String(now), { ...cookie, maxAge: EMAIL_CODE_COOLDOWN_S });
+  return res;
+}