@payez/next-mvp 4.8.1 → 4.8.3

package/src/api-handlers/auth/passkey-signin.ts

@@ -1,116 +1,116 @@
-import { NextRequest, NextResponse } from 'next/server';
-import { ENV_CONFIG } from '../../config/env';
-import { getIDPClientConfig } from '../../lib/idp-client-config';
-import { resolveClientKey } from '../../lib/client-key';
-import { assertAbsoluteIdpUrl } from '../../lib/idp-url-guard';
-import { idpErrorEnvelope } from '../../lib/safe-error-response';
-
-/**
- * Passkey SIGN-IN ceremony (ANONYMOUS — no session exists yet):
- *   optionsPOST -> POST /api/ExternalAuth/passwordless/passkey/options
- *   verifyPOST  -> POST /api/ExternalAuth/passwordless/passkey/verify
- *
- * Anon idiom copied from auth/better-auth.ts (exchangeOAuthForIdpTokens):
- * direct fetch to the IDP, client identified by client_id from the resolved
- * IDP client config (slug preferred, numeric id fallback) — sent BOTH as the
- * X-Client-Id header (the probe-verified routing key) and merged into the
- * body when the caller did not supply one.
- *
- * The verify response is passed through WITHOUT unwrapping: this is a
- * sign-in, its payload carries the grant the caller's session layer consumes.
- */
-
-async function clientKey(): Promise<string> {
-  const config = await getIDPClientConfig();
-  const { key } = resolveClientKey(config, 'auth/passkey-signin');
-  // Refuse rather than send an empty client_id. Card 268410: the graft's own
-  // copy of this path learned this the hard way — `|| ''` made an unset config
-  // look like a valid value and the IDP answered "client_id is required" in
-  // 7-9ms, which read as a request-shape bug for hours.
-  if (!key) throw new Error('[passkey-signin] no IDP client slug or id resolved - refusing to send an empty client_id');
-  return key;
-}
-
-async function anonCall(req: NextRequest, path: string) {
-  let parsed: Record<string, unknown> = {};
-  try {
-    const raw = await req.text();
-    if (raw && raw.trim().length > 0) parsed = JSON.parse(raw);
-  } catch {}
-
-  const key = await clientKey();
-  // This route calls fetch directly, so it does NOT reach the guard inside
-  // idpFetchJSON. Same reasoning as the clientKey() throw above: name the missing
-  // config rather than sending a request built from it.
-  assertAbsoluteIdpUrl(`${ENV_CONFIG.IDP_URL}${path}`);
-  const res = await fetch(`${ENV_CONFIG.IDP_URL}${path}`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json', 'X-Client-Id': key },
-    body: JSON.stringify({ client_id: key, ...parsed }),
-    cache: 'no-store',
-  });
-  const json = await res.json().catch(() => null);
-  return { res, json };
-}
-
-export async function optionsPOST(req: NextRequest) {
-  const { res, json } = await anonCall(req, '/api/ExternalAuth/passwordless/passkey/options');
-  // PAY-1438: anonymous route - on failure only the whitelisted envelope, never the IDP body.
-  if (!res.ok) return NextResponse.json(idpErrorEnvelope(json, 'Passkey sign-in failed'), { status: res.status });
-  return NextResponse.json(json ?? { success: false, message: 'Empty upstream response' }, { status: res.status });
-}
-
-/**
- * VERIFY DOES NOT USE anonCall — IT MUST RESHAPE, NOT SPREAD.
- *
- * The IDP contract is three fields (PasskeyModels.cs:36 PasskeyAuthVerifyRequest):
- *     assertion_id : string
- *     response     : the WHOLE AuthenticatorAssertionRawResponse from
- *                    navigator.credentials.get()
- *     client_id    : string
- *
- * anonCall SPREADS the caller's body (`{ client_id, ...parsed }`). For options
- * that is harmless. For verify it is fatal: spreading an assertion hoists
- * id/rawId/type to the top level and leaves `response` holding only the INNER
- * {clientDataJSON, authenticatorData, signature, userHandle}. The IDP's guard
- * then answers "response is required" in 4-12ms WITHOUT REACHING THE CRYPTO —
- * a timing signature DotNetPert used to prove the caller was still spreading
- * long after the graft-side plugin had been fixed.
- *
- * This route and the Better Auth plugin endpoint are TWO PATHS to the same IDP
- * endpoint. Fixing only the plugin left this one live, spreading, and reachable
- * on a URL one segment away from the correct one — which is what kept the
- * sign-in leg red across several runs.
- *
- * Accepts the assertion either already nested (`{ assertion_id, response }`) or
- * flat (`{ assertion_id, id, rawId, type, response }`) and normalises both, so a
- * caller written against either shape works.
- */
-export async function verifyPOST(req: NextRequest) {
-  let parsed: Record<string, unknown> = {};
-  try {
-    const raw = await req.text();
-    if (raw && raw.trim().length > 0) parsed = JSON.parse(raw);
-  } catch { /* empty body -> the IDP's own validation answers */ }
-
-  const { assertion_id: assertionId, response, ...rest } = parsed;
-
-  // Already-nested callers send `response` holding a full assertion (it has an
-  // `id`). Flat callers send the assertion's own fields alongside assertion_id,
-  // and their `response` is the inner attestation half — not a whole assertion.
-  const nested = response && typeof response === 'object' && 'id' in (response as object);
-  const assertion = nested ? response : { ...rest, response };
-
-  const key = await clientKey();
-  // Direct fetch - see the note in anonCall; the idpFetchJSON guard is not on this path.
-  assertAbsoluteIdpUrl(`${ENV_CONFIG.IDP_URL}/api/ExternalAuth/passwordless/passkey/verify`);
-  const res = await fetch(`${ENV_CONFIG.IDP_URL}/api/ExternalAuth/passwordless/passkey/verify`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json', 'X-Client-Id': key },
-    body: JSON.stringify({ client_id: key, assertion_id: assertionId, response: assertion }),
-    cache: 'no-store',
-  });
-  const json = await res.json().catch(() => null);
-  if (!res.ok) return NextResponse.json(idpErrorEnvelope(json, 'Passkey sign-in failed'), { status: res.status });
-  return NextResponse.json(json ?? { success: false, message: 'Empty upstream response' }, { status: res.status });
-}
+import { NextRequest, NextResponse } from 'next/server';
+import { ENV_CONFIG } from '../../config/env';
+import { getIDPClientConfig } from '../../lib/idp-client-config';
+import { resolveClientKey } from '../../lib/client-key';
+import { assertAbsoluteIdpUrl } from '../../lib/idp-url-guard';
+import { idpErrorEnvelope } from '../../lib/safe-error-response';
+
+/**
+ * Passkey SIGN-IN ceremony (ANONYMOUS — no session exists yet):
+ *   optionsPOST -> POST /api/ExternalAuth/passwordless/passkey/options
+ *   verifyPOST  -> POST /api/ExternalAuth/passwordless/passkey/verify
+ *
+ * Anon idiom copied from auth/better-auth.ts (exchangeOAuthForIdpTokens):
+ * direct fetch to the IDP, client identified by client_id from the resolved
+ * IDP client config (slug preferred, numeric id fallback) — sent BOTH as the
+ * X-Client-Id header (the probe-verified routing key) and merged into the
+ * body when the caller did not supply one.
+ *
+ * The verify response is passed through WITHOUT unwrapping: this is a
+ * sign-in, its payload carries the grant the caller's session layer consumes.
+ */
+
+async function clientKey(): Promise<string> {
+  const config = await getIDPClientConfig();
+  const { key } = resolveClientKey(config, 'auth/passkey-signin');
+  // Refuse rather than send an empty client_id. Card 268410: the graft's own
+  // copy of this path learned this the hard way — `|| ''` made an unset config
+  // look like a valid value and the IDP answered "client_id is required" in
+  // 7-9ms, which read as a request-shape bug for hours.
+  if (!key) throw new Error('[passkey-signin] no IDP client slug or id resolved - refusing to send an empty client_id');
+  return key;
+}
+
+async function anonCall(req: NextRequest, path: string) {
+  let parsed: Record<string, unknown> = {};
+  try {
+    const raw = await req.text();
+    if (raw && raw.trim().length > 0) parsed = JSON.parse(raw);
+  } catch {}
+
+  const key = await clientKey();
+  // This route calls fetch directly, so it does NOT reach the guard inside
+  // idpFetchJSON. Same reasoning as the clientKey() throw above: name the missing
+  // config rather than sending a request built from it.
+  assertAbsoluteIdpUrl(`${ENV_CONFIG.IDP_URL}${path}`);
+  const res = await fetch(`${ENV_CONFIG.IDP_URL}${path}`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', 'X-Client-Id': key },
+    body: JSON.stringify({ client_id: key, ...parsed }),
+    cache: 'no-store',
+  });
+  const json = await res.json().catch(() => null);
+  return { res, json };
+}
+
+export async function optionsPOST(req: NextRequest) {
+  const { res, json } = await anonCall(req, '/api/ExternalAuth/passwordless/passkey/options');
+  // PAY-1438: anonymous route - on failure only the whitelisted envelope, never the IDP body.
+  if (!res.ok) return NextResponse.json(idpErrorEnvelope(json, 'Passkey sign-in failed'), { status: res.status });
+  return NextResponse.json(json ?? { success: false, message: 'Empty upstream response' }, { status: res.status });
+}
+
+/**
+ * VERIFY DOES NOT USE anonCall — IT MUST RESHAPE, NOT SPREAD.
+ *
+ * The IDP contract is three fields (PasskeyModels.cs:36 PasskeyAuthVerifyRequest):
+ *     assertion_id : string
+ *     response     : the WHOLE AuthenticatorAssertionRawResponse from
+ *                    navigator.credentials.get()
+ *     client_id    : string
+ *
+ * anonCall SPREADS the caller's body (`{ client_id, ...parsed }`). For options
+ * that is harmless. For verify it is fatal: spreading an assertion hoists
+ * id/rawId/type to the top level and leaves `response` holding only the INNER
+ * {clientDataJSON, authenticatorData, signature, userHandle}. The IDP's guard
+ * then answers "response is required" in 4-12ms WITHOUT REACHING THE CRYPTO —
+ * a timing signature DotNetPert used to prove the caller was still spreading
+ * long after the graft-side plugin had been fixed.
+ *
+ * This route and the Better Auth plugin endpoint are TWO PATHS to the same IDP
+ * endpoint. Fixing only the plugin left this one live, spreading, and reachable
+ * on a URL one segment away from the correct one — which is what kept the
+ * sign-in leg red across several runs.
+ *
+ * Accepts the assertion either already nested (`{ assertion_id, response }`) or
+ * flat (`{ assertion_id, id, rawId, type, response }`) and normalises both, so a
+ * caller written against either shape works.
+ */
+export async function verifyPOST(req: NextRequest) {
+  let parsed: Record<string, unknown> = {};
+  try {
+    const raw = await req.text();
+    if (raw && raw.trim().length > 0) parsed = JSON.parse(raw);
+  } catch { /* empty body -> the IDP's own validation answers */ }
+
+  const { assertion_id: assertionId, response, ...rest } = parsed;
+
+  // Already-nested callers send `response` holding a full assertion (it has an
+  // `id`). Flat callers send the assertion's own fields alongside assertion_id,
+  // and their `response` is the inner attestation half — not a whole assertion.
+  const nested = response && typeof response === 'object' && 'id' in (response as object);
+  const assertion = nested ? response : { ...rest, response };
+
+  const key = await clientKey();
+  // Direct fetch - see the note in anonCall; the idpFetchJSON guard is not on this path.
+  assertAbsoluteIdpUrl(`${ENV_CONFIG.IDP_URL}/api/ExternalAuth/passwordless/passkey/verify`);
+  const res = await fetch(`${ENV_CONFIG.IDP_URL}/api/ExternalAuth/passwordless/passkey/verify`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', 'X-Client-Id': key },
+    body: JSON.stringify({ client_id: key, assertion_id: assertionId, response: assertion }),
+    cache: 'no-store',
+  });
+  const json = await res.json().catch(() => null);
+  if (!res.ok) return NextResponse.json(idpErrorEnvelope(json, 'Passkey sign-in failed'), { status: res.status });
+  return NextResponse.json(json ?? { success: false, message: 'Empty upstream response' }, { status: res.status });
+}