@payez/next-mvp 4.8.1 → 4.8.3

package/src/auth/session-reset-link.ts

@@ -1,159 +1,159 @@
-/**
- * PAY-2218 PR 2: the hand-off between the middleware and the session-reset route.
- *
- * WHY A ROUTE AT ALL. Next 15.5.x and 16.x (16.2.x without `skipProxyUrlNormalize`) strip every router flight
- * header (`rsc`, `next-router-prefetch`, `next-router-segment-prefetch`, `next-router-state-tree`) from the request
- * handed to middleware, so middleware cannot tell a router prefetch from a real navigation and its prefetch guard is
- * dead. A ROUTE HANDLER does see them, on 15.5.9, 16.1.5 and 16.2.12 (measured with a real Chromium against real
- * `next start` servers, PAY-2218 comments 2026-10-11). So the middleware no longer writes the clearing Set-Cookie
- * itself: it redirects to the reset route, and the route decides.
- *
- * WHY THE ROUTE ANSWERS A PREFETCH WITH 204, NOT A REDIRECT. On 15.5.9 the router CACHES a prefetched redirect chain
- * and the later click reuses it without calling middleware or the route again - so "decline on the prefetch, clear
- * on the real navigation" never clears there. A 204 + no-store gives the router nothing to cache, so the real click
- * reaches the route and clears (measured 2/2 on 15.5.9 and 16.2.12; the 307 mutant never clears on 15.5.9).
- *
- * WHY SIGNED. The route clears cookies on a GET. Unsigned, any page could link a signed-in user to it and log them
- * out. The middleware signs (callbackUrl, reason, error, exp, session binding); the route clears only on a valid,
- * unexpired signature and otherwise just sends the user to the login page with the cookies untouched.
- *
- * KEY SEPARATION (BAPert 72219). The signing key is DERIVED - HMAC(authSecret, 'next-mvp/session-reset/v1') - never
- * the raw auth secret, so no value the app signs with that secret for any other purpose can pass as a reset token.
- *
- * SESSION BINDING (BAPert 72219). The signature covers SHA-256 of the session cookie the redirect was issued FOR. The
- * route recomputes it from ITS OWN request's cookie and clears only on a match, so a token captured from one user
- * clears nothing when sent to another (logout-CSRF), and a second use is a no-op (the first use cleared the cookie it
- * was bound to). The hash never travels in the URL; it is only an input to the signature.
- *
- * WHY THE ROUTE REBUILDS THE LOGIN URL. The route never redirects to a URL it was handed. It takes `callbackUrl`
- * (through safeCallbackPath), `reason` and `error` (allowlisted) and builds `${LOGIN_PAGE}?...` itself, so it cannot
- * become an open redirect whatever the query says.
- *
- * Edge-safe: Web Crypto only (middleware runs on the edge runtime on 15.5.x).
- */
-import { safeCallbackPath } from './safe-callback';
-
-export const LOGIN_PAGE = '/account-auth/login';
-
-/** The mount point consumers use: `app/api/auth/session-reset/route.ts` (under /api/auth/, which middleware bypasses). */
-export const DEFAULT_SESSION_RESET_ROUTE = '/api/auth/session-reset';
-
-/** How long a signed reset link stays valid. A real navigation follows the 307 at once; this only bounds replay. */
-export const RESET_LINK_TTL_SECONDS = 300;
-
-/** The purpose label for the derived signing key. Changing it invalidates every outstanding reset link. */
-export const RESET_KEY_PURPOSE = 'next-mvp/session-reset/v1';
-
-/** The only `reason` / `error` values the middleware emits on a clearing redirect. Anything else is dropped. */
-export const RESET_REASONS: readonly string[] = ['stale', 'invalidated'];
-export const RESET_ERRORS: readonly string[] = ['SessionExpired', 'TwoFactorTimeout'];
-
-export interface ResetParams {
-  callbackUrl: string;
-  reason?: string;
-  error?: string;
-}
-
-const encoder = new TextEncoder();
-const FIELD_SEPARATOR = String.fromCharCode(10);
-
-function b64url(bytes: Uint8Array): string {
-  return btoa(String.fromCharCode(...bytes)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
-}
-
-async function hmacBytes(key: Uint8Array, message: string): Promise<Uint8Array> {
-  const k = await crypto.subtle.importKey('raw', key as BufferSource, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
-  return new Uint8Array(await crypto.subtle.sign('HMAC', k, encoder.encode(message)));
-}
-
-/** Sign with the DERIVED key: HMAC(HMAC(authSecret, purpose), message). Never with the raw auth secret. */
-async function sign(secret: string, message: string): Promise<string> {
-  const derived = await hmacBytes(encoder.encode(secret), RESET_KEY_PURPOSE);
-  return b64url(await hmacBytes(derived, message));
-}
-
-/** SHA-256 of the session cookie value, b64url. No session cookie binds to the empty string. */
-async function sessionBinding(sessionCookieValue: string | undefined): Promise<string> {
-  if (!sessionCookieValue) return '';
-  return b64url(new Uint8Array(await crypto.subtle.digest('SHA-256', encoder.encode(sessionCookieValue))));
-}
-
-/** Constant-time over equal lengths, and unequal lengths never match. */
-function sameString(a: string, b: string): boolean {
-  if (a.length !== b.length) return false;
-  let diff = 0;
-  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  return diff === 0;
-}
-
-/** The secret the app already signs its session cookie with. Undefined means "cannot sign": callers fall back. */
-export function resetSecret(): string | undefined {
-  return process.env.BETTER_AUTH_SECRET || process.env.NEXTAUTH_SECRET || undefined;
-}
-
-/** The session cookie a reset is bound to: the __Secure- one when present, else the plain one. */
-export function boundSessionCookie(get: (name: string) => string | undefined, plainName: string, secureName: string): string | undefined {
-  return get(secureName) || get(plainName) || undefined;
-}
-
-/** Normalise to exactly what the route will honour, so what is signed is what is verified. */
-export function normaliseResetParams(raw: { callbackUrl?: string | null; reason?: string | null; error?: string | null }): ResetParams {
-  const out: ResetParams = { callbackUrl: safeCallbackPath(raw.callbackUrl ?? '') };
-  if (raw.reason && RESET_REASONS.includes(raw.reason)) out.reason = raw.reason;
-  if (raw.error && RESET_ERRORS.includes(raw.error)) out.error = raw.error;
-  return out;
-}
-
-/** What the signature covers. Exported for the key-separation row, which signs it with the RAW secret. */
-export function resetPayload(p: ResetParams, exp: number, binding: string): string {
-  return ['v2', p.callbackUrl, p.reason ?? '', p.error ?? '', String(exp), binding].join(FIELD_SEPARATOR);
-}
-
-/** The login URL for these params, in the exact shape the middleware has always emitted. */
-export function loginLocation(p: ResetParams): string {
-  let loc = `${LOGIN_PAGE}?callbackUrl=${encodeURIComponent(p.callbackUrl)}`;
-  if (p.reason) loc += `&reason=${p.reason}`;
-  if (p.error) loc += `&error=${p.error}`;
-  return loc;
-}
-
-/**
- * Path + query for the reset route, bound to `sessionCookieValue` (the session cookie on the request being ended).
- * `nowMs` is injectable for tests.
- */
-export async function signedResetHref(
-  route: string,
-  p: ResetParams,
-  secret: string,
-  sessionCookieValue: string | undefined,
-  nowMs: number = Date.now()
-): Promise<string> {
-  const exp = Math.floor(nowMs / 1000) + RESET_LINK_TTL_SECONDS;
-  const q = new URLSearchParams({ callbackUrl: p.callbackUrl });
-  if (p.reason) q.set('reason', p.reason);
-  if (p.error) q.set('error', p.error);
-  q.set('exp', String(exp));
-  q.set('sig', await sign(secret, resetPayload(p, exp, await sessionBinding(sessionCookieValue))));
-  return `${route}?${q.toString()}`;
-}
-
-/**
- * Read a reset request's query. `signed` is true only for a valid, unexpired signature over the normalised params AND
- * this request's own session cookie (`sessionCookieValue`). With no session cookie there is nothing to clear: false.
- * The params are returned either way: an unsigned request still gets a sensible login redirect, just no clearing.
- */
-export async function readResetRequest(
-  search: URLSearchParams,
-  secret: string | undefined,
-  sessionCookieValue: string | undefined,
-  nowMs: number = Date.now()
-): Promise<{ params: ResetParams; signed: boolean }> {
-  const params = normaliseResetParams({ callbackUrl: search.get('callbackUrl'), reason: search.get('reason'), error: search.get('error') });
-  const sig = search.get('sig');
-  const exp = Number(search.get('exp'));
-  if (!secret || !sig || !sessionCookieValue || !Number.isInteger(exp) || exp < Math.floor(nowMs / 1000)) return { params, signed: false };
-  // The signature covers the NORMALISED params and THIS request's session, so a tampered value, or the token arriving
-  // with a different session cookie (another user, or the same user after signing in again), fails here.
-  const want = await sign(secret, resetPayload(params, exp, await sessionBinding(sessionCookieValue)));
-  return { params, signed: sameString(sig, want) };
-}
+/**
+ * PAY-2218 PR 2: the hand-off between the middleware and the session-reset route.
+ *
+ * WHY A ROUTE AT ALL. Next 15.5.x and 16.x (16.2.x without `skipProxyUrlNormalize`) strip every router flight
+ * header (`rsc`, `next-router-prefetch`, `next-router-segment-prefetch`, `next-router-state-tree`) from the request
+ * handed to middleware, so middleware cannot tell a router prefetch from a real navigation and its prefetch guard is
+ * dead. A ROUTE HANDLER does see them, on 15.5.9, 16.1.5 and 16.2.12 (measured with a real Chromium against real
+ * `next start` servers, PAY-2218 comments 2026-10-11). So the middleware no longer writes the clearing Set-Cookie
+ * itself: it redirects to the reset route, and the route decides.
+ *
+ * WHY THE ROUTE ANSWERS A PREFETCH WITH 204, NOT A REDIRECT. On 15.5.9 the router CACHES a prefetched redirect chain
+ * and the later click reuses it without calling middleware or the route again - so "decline on the prefetch, clear
+ * on the real navigation" never clears there. A 204 + no-store gives the router nothing to cache, so the real click
+ * reaches the route and clears (measured 2/2 on 15.5.9 and 16.2.12; the 307 mutant never clears on 15.5.9).
+ *
+ * WHY SIGNED. The route clears cookies on a GET. Unsigned, any page could link a signed-in user to it and log them
+ * out. The middleware signs (callbackUrl, reason, error, exp, session binding); the route clears only on a valid,
+ * unexpired signature and otherwise just sends the user to the login page with the cookies untouched.
+ *
+ * KEY SEPARATION (BAPert 72219). The signing key is DERIVED - HMAC(authSecret, 'next-mvp/session-reset/v1') - never
+ * the raw auth secret, so no value the app signs with that secret for any other purpose can pass as a reset token.
+ *
+ * SESSION BINDING (BAPert 72219). The signature covers SHA-256 of the session cookie the redirect was issued FOR. The
+ * route recomputes it from ITS OWN request's cookie and clears only on a match, so a token captured from one user
+ * clears nothing when sent to another (logout-CSRF), and a second use is a no-op (the first use cleared the cookie it
+ * was bound to). The hash never travels in the URL; it is only an input to the signature.
+ *
+ * WHY THE ROUTE REBUILDS THE LOGIN URL. The route never redirects to a URL it was handed. It takes `callbackUrl`
+ * (through safeCallbackPath), `reason` and `error` (allowlisted) and builds `${LOGIN_PAGE}?...` itself, so it cannot
+ * become an open redirect whatever the query says.
+ *
+ * Edge-safe: Web Crypto only (middleware runs on the edge runtime on 15.5.x).
+ */
+import { safeCallbackPath } from './safe-callback';
+
+export const LOGIN_PAGE = '/account-auth/login';
+
+/** The mount point consumers use: `app/api/auth/session-reset/route.ts` (under /api/auth/, which middleware bypasses). */
+export const DEFAULT_SESSION_RESET_ROUTE = '/api/auth/session-reset';
+
+/** How long a signed reset link stays valid. A real navigation follows the 307 at once; this only bounds replay. */
+export const RESET_LINK_TTL_SECONDS = 300;
+
+/** The purpose label for the derived signing key. Changing it invalidates every outstanding reset link. */
+export const RESET_KEY_PURPOSE = 'next-mvp/session-reset/v1';
+
+/** The only `reason` / `error` values the middleware emits on a clearing redirect. Anything else is dropped. */
+export const RESET_REASONS: readonly string[] = ['stale', 'invalidated'];
+export const RESET_ERRORS: readonly string[] = ['SessionExpired', 'TwoFactorTimeout'];
+
+export interface ResetParams {
+  callbackUrl: string;
+  reason?: string;
+  error?: string;
+}
+
+const encoder = new TextEncoder();
+const FIELD_SEPARATOR = String.fromCharCode(10);
+
+function b64url(bytes: Uint8Array): string {
+  return btoa(String.fromCharCode(...bytes)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
+async function hmacBytes(key: Uint8Array, message: string): Promise<Uint8Array> {
+  const k = await crypto.subtle.importKey('raw', key as BufferSource, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+  return new Uint8Array(await crypto.subtle.sign('HMAC', k, encoder.encode(message)));
+}
+
+/** Sign with the DERIVED key: HMAC(HMAC(authSecret, purpose), message). Never with the raw auth secret. */
+async function sign(secret: string, message: string): Promise<string> {
+  const derived = await hmacBytes(encoder.encode(secret), RESET_KEY_PURPOSE);
+  return b64url(await hmacBytes(derived, message));
+}
+
+/** SHA-256 of the session cookie value, b64url. No session cookie binds to the empty string. */
+async function sessionBinding(sessionCookieValue: string | undefined): Promise<string> {
+  if (!sessionCookieValue) return '';
+  return b64url(new Uint8Array(await crypto.subtle.digest('SHA-256', encoder.encode(sessionCookieValue))));
+}
+
+/** Constant-time over equal lengths, and unequal lengths never match. */
+function sameString(a: string, b: string): boolean {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+
+/** The secret the app already signs its session cookie with. Undefined means "cannot sign": callers fall back. */
+export function resetSecret(): string | undefined {
+  return process.env.BETTER_AUTH_SECRET || process.env.NEXTAUTH_SECRET || undefined;
+}
+
+/** The session cookie a reset is bound to: the __Secure- one when present, else the plain one. */
+export function boundSessionCookie(get: (name: string) => string | undefined, plainName: string, secureName: string): string | undefined {
+  return get(secureName) || get(plainName) || undefined;
+}
+
+/** Normalise to exactly what the route will honour, so what is signed is what is verified. */
+export function normaliseResetParams(raw: { callbackUrl?: string | null; reason?: string | null; error?: string | null }): ResetParams {
+  const out: ResetParams = { callbackUrl: safeCallbackPath(raw.callbackUrl ?? '') };
+  if (raw.reason && RESET_REASONS.includes(raw.reason)) out.reason = raw.reason;
+  if (raw.error && RESET_ERRORS.includes(raw.error)) out.error = raw.error;
+  return out;
+}
+
+/** What the signature covers. Exported for the key-separation row, which signs it with the RAW secret. */
+export function resetPayload(p: ResetParams, exp: number, binding: string): string {
+  return ['v2', p.callbackUrl, p.reason ?? '', p.error ?? '', String(exp), binding].join(FIELD_SEPARATOR);
+}
+
+/** The login URL for these params, in the exact shape the middleware has always emitted. */
+export function loginLocation(p: ResetParams): string {
+  let loc = `${LOGIN_PAGE}?callbackUrl=${encodeURIComponent(p.callbackUrl)}`;
+  if (p.reason) loc += `&reason=${p.reason}`;
+  if (p.error) loc += `&error=${p.error}`;
+  return loc;
+}
+
+/**
+ * Path + query for the reset route, bound to `sessionCookieValue` (the session cookie on the request being ended).
+ * `nowMs` is injectable for tests.
+ */
+export async function signedResetHref(
+  route: string,
+  p: ResetParams,
+  secret: string,
+  sessionCookieValue: string | undefined,
+  nowMs: number = Date.now()
+): Promise<string> {
+  const exp = Math.floor(nowMs / 1000) + RESET_LINK_TTL_SECONDS;
+  const q = new URLSearchParams({ callbackUrl: p.callbackUrl });
+  if (p.reason) q.set('reason', p.reason);
+  if (p.error) q.set('error', p.error);
+  q.set('exp', String(exp));
+  q.set('sig', await sign(secret, resetPayload(p, exp, await sessionBinding(sessionCookieValue))));
+  return `${route}?${q.toString()}`;
+}
+
+/**
+ * Read a reset request's query. `signed` is true only for a valid, unexpired signature over the normalised params AND
+ * this request's own session cookie (`sessionCookieValue`). With no session cookie there is nothing to clear: false.
+ * The params are returned either way: an unsigned request still gets a sensible login redirect, just no clearing.
+ */
+export async function readResetRequest(
+  search: URLSearchParams,
+  secret: string | undefined,
+  sessionCookieValue: string | undefined,
+  nowMs: number = Date.now()
+): Promise<{ params: ResetParams; signed: boolean }> {
+  const params = normaliseResetParams({ callbackUrl: search.get('callbackUrl'), reason: search.get('reason'), error: search.get('error') });
+  const sig = search.get('sig');
+  const exp = Number(search.get('exp'));
+  if (!secret || !sig || !sessionCookieValue || !Number.isInteger(exp) || exp < Math.floor(nowMs / 1000)) return { params, signed: false };
+  // The signature covers the NORMALISED params and THIS request's session, so a tampered value, or the token arriving
+  // with a different session cookie (another user, or the same user after signing in again), fails here.
+  const want = await sign(secret, resetPayload(params, exp, await sessionBinding(sessionCookieValue)));
+  return { params, signed: sameString(sig, want) };
+}

package/src/auth/session-response-sanitizer.ts

@@ -1,151 +1,151 @@
-/**
- * PAY-2217: no session token reaches browser JS from Better Auth's own HTTP endpoints.
- *
- * WHAT WAS WRONG. PAY-1481 removed token material from the package's own GET /api/auth/session. Better Auth's native
- * endpoints are a separate surface served by the catch-all mount, and their default bodies carry the session
- * credential identifier:
- *   GET  /get-session    -> { session: { id, token, userId, ... }, user }
- *   GET  /list-sessions  -> [ { id, token, ... } ]        (EVERY session of the user, not just this one)
- *   POST /sign-in/*      -> { token, user, ... }
- *   POST /sign-up/*      -> { token, user }
- *   GET  /magic-link/verify (no callbackURL) -> { token, user }   (NightHawk G4 on PR 1190, measured on a real instance)
- * and any plugin endpoint (passkey verify, two-factor verify, genericOAuth) answers a session object the same way.
- * `token` is the Redis key of the session. The cookie is token.HMAC and Path B verifies the signature, so a bare
- * token is not a replayable cookie (gate rows B1-B4 measure that), but it is a credential identifier readable by any
- * script on the page, for this session and for every other session the user has. It breaks the PAY-1481 rule.
- *
- * EVERY 2xx JSON BODY IS STRIPPED, not a named list of paths. A list protects the endpoints someone remembered and
- * silently misses the next plugin; the strip is a function of the response, so a new endpoint is covered the day it is
- * mounted. A 2xx JSON body that legitimately needs one of these names to reach the browser would have to be
- * allowlisted here on purpose (none is known: no client in this package reads one).
- *
- * WHERE THE FIX LIVES, AND WHY NOT customSession. Server-side code in this package reads session.session.token from
- * auth.api.getSession() (viability, refresh, status, the OAuth exchange). A customSession plugin or an after-hook
- * runs for those calls too and would strip the token from them. So the strip is applied at the HTTP BOUNDARY only:
- * getBetterAuthHandler() returns handlers wrapped by wrapBetterAuthHandler(), and auth.api stays untouched.
- *
- * WHAT THE BROWSER GETS INSTEAD.
- *   - list-sessions rows carry `isCurrent` (computed here against the caller's cookie-resolved session) and `id`.
- *   - POST /revoke-session-by-id { id }: revokes ONE of the CALLER's sessions by its id. An id that is not one of the
- *     caller's own sessions answers 404 (never 403: do not confirm that another user's session id exists).
- *   - Better Auth's native POST /revoke-session { token } still exists and still requires a cookie-resolved session
- *     that owns the token, but no browser ever holds a token to send it.
- */
-
-/** Credential-bearing key names, compared case- and separator-insensitively. */
-const STRIP_KEYS = new Set(['token', 'sessiontoken', 'accesstoken', 'refreshtoken', 'idtoken']);
-
-const norm = (k: string): string => k.toLowerCase().replace(/[_\-\s]/g, '');
-
-/** Deep copy of `value` with every credential-named key removed, at any depth, in objects and arrays. */
-export function stripSessionCredentials(value: unknown): unknown {
-  if (Array.isArray(value)) return value.map(stripSessionCredentials);
-  if (value !== null && typeof value === 'object') {
-    const out: Record<string, unknown> = {};
-    for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
-      if (STRIP_KEYS.has(norm(k))) continue;
-      out[k] = stripSessionCredentials(v);
-    }
-    return out;
-  }
-  return value;
-}
-
-/** "/api/auth/get-session" -> "/get-session". Anything not under an /auth/ segment is returned as-is. */
-export function authSubPath(pathname: string): string {
-  const i = pathname.indexOf('/api/auth/');
-  if (i >= 0) return pathname.slice(i + '/api/auth'.length).replace(/\/+$/, '') || '/';
-  return pathname.replace(/\/+$/, '') || '/';
-}
-
-function isJson(res: Response): boolean {
-  return (res.headers.get('content-type') || '').toLowerCase().includes('application/json');
-}
-
-/** A Response with a new JSON body and the original status and headers (content-length recomputed by the runtime). */
-function withJsonBody(res: Response, body: unknown): Response {
-  const headers = new Headers(res.headers);
-  headers.delete('content-length');
-  return new Response(JSON.stringify(body), { status: res.status, statusText: res.statusText, headers });
-}
-
-interface AuthApi {
-  getSession: (opts: { headers: Headers }) => Promise<any>;
-  listSessions: (opts: { headers: Headers }) => Promise<any>;
-  revokeSession: (opts: { headers: Headers; body: { token: string }; asResponse?: boolean }) => Promise<any>;
-}
-
-/** Sanitise one already-produced Better Auth response. Pure function of (request, response, current token). */
-export async function sanitizeBetterAuthResponse(
-  req: Request,
-  res: Response,
-  currentToken: () => Promise<string | undefined>,
-): Promise<Response> {
-  const sub = authSubPath(new URL(req.url).pathname);
-  if (!res.ok || !isJson(res)) return res;
-
-  let body: unknown;
-  try {
-    body = await res.clone().json();
-  } catch {
-    return res; // unreadable body: nothing to strip, and do not turn it into a different failure
-  }
-
-  if (sub === '/list-sessions' && Array.isArray(body)) {
-    const cur = await currentToken().catch(() => undefined);
-    body = body.map((row: any) =>
-      row && typeof row === 'object' ? { ...row, isCurrent: !!cur && row.token === cur } : row,
-    );
-  }
-  return withJsonBody(res, stripSessionCredentials(body));
-}
-
-const json = (status: number, body: unknown): Response =>
-  new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json' } });
-
-/** POST /revoke-session-by-id { id }: revoke one of the caller's own sessions by id. */
-async function revokeById(req: Request, api: AuthApi): Promise<Response> {
-  let id: unknown;
-  try {
-    id = (await req.json())?.id;
-  } catch {
-    return json(400, { code: 'INVALID_REQUEST', message: 'Body must be JSON { id }' });
-  }
-  if (typeof id !== 'string' || id.length === 0) {
-    return json(400, { code: 'INVALID_REQUEST', message: 'id is required' });
-  }
-  const headers = new Headers(req.headers);
-  const rows = await api.listSessions({ headers }).catch(() => null);
-  if (rows === null) return json(401, { code: 'UNAUTHORIZED', message: 'No session' });
-  // listSessions returns ONLY the caller's own sessions, so a foreign id cannot match: 404, not 403.
-  const row = Array.isArray(rows) ? rows.find((r: any) => r && r.id === id && typeof r.token === 'string') : undefined;
-  if (!row) return json(404, { code: 'SESSION_NOT_FOUND', message: 'No such session' });
-  const res = await api.revokeSession({ headers, body: { token: row.token }, asResponse: true });
-  // Pass Better Auth's own answer (and its Set-Cookie when the current session was the one revoked) through.
-  return res instanceof Response ? res : json(200, { status: true });
-}
-
-type Handler = (req: Request) => Promise<Response>;
-
-/**
- * Wrap Better Auth's Next.js handlers so no response carries a session credential to the browser.
- * `auth` is the Better Auth instance; its `api` is used server-side only (to find the caller's current session and to
- * revoke by id) and is not modified.
- */
-export function wrapBetterAuthHandler(
-  auth: { api: AuthApi },
-  handlers: { GET: Handler; POST: Handler },
-): { GET: Handler; POST: Handler } {
-  const currentTokenFor = (req: Request) => async (): Promise<string | undefined> => {
-    const s = await auth.api.getSession({ headers: new Headers(req.headers) });
-    return s?.session?.token;
-  };
-  return {
-    GET: async (req) => sanitizeBetterAuthResponse(req, await handlers.GET(req), currentTokenFor(req)),
-    POST: async (req) => {
-      const sub = authSubPath(new URL(req.url).pathname);
-      if (sub === '/revoke-session-by-id') return revokeById(req, auth.api);
-      return sanitizeBetterAuthResponse(req, await handlers.POST(req), currentTokenFor(req));
-    },
-  };
-}
+/**
+ * PAY-2217: no session token reaches browser JS from Better Auth's own HTTP endpoints.
+ *
+ * WHAT WAS WRONG. PAY-1481 removed token material from the package's own GET /api/auth/session. Better Auth's native
+ * endpoints are a separate surface served by the catch-all mount, and their default bodies carry the session
+ * credential identifier:
+ *   GET  /get-session    -> { session: { id, token, userId, ... }, user }
+ *   GET  /list-sessions  -> [ { id, token, ... } ]        (EVERY session of the user, not just this one)
+ *   POST /sign-in/*      -> { token, user, ... }
+ *   POST /sign-up/*      -> { token, user }
+ *   GET  /magic-link/verify (no callbackURL) -> { token, user }   (NightHawk G4 on PR 1190, measured on a real instance)
+ * and any plugin endpoint (passkey verify, two-factor verify, genericOAuth) answers a session object the same way.
+ * `token` is the Redis key of the session. The cookie is token.HMAC and Path B verifies the signature, so a bare
+ * token is not a replayable cookie (gate rows B1-B4 measure that), but it is a credential identifier readable by any
+ * script on the page, for this session and for every other session the user has. It breaks the PAY-1481 rule.
+ *
+ * EVERY 2xx JSON BODY IS STRIPPED, not a named list of paths. A list protects the endpoints someone remembered and
+ * silently misses the next plugin; the strip is a function of the response, so a new endpoint is covered the day it is
+ * mounted. A 2xx JSON body that legitimately needs one of these names to reach the browser would have to be
+ * allowlisted here on purpose (none is known: no client in this package reads one).
+ *
+ * WHERE THE FIX LIVES, AND WHY NOT customSession. Server-side code in this package reads session.session.token from
+ * auth.api.getSession() (viability, refresh, status, the OAuth exchange). A customSession plugin or an after-hook
+ * runs for those calls too and would strip the token from them. So the strip is applied at the HTTP BOUNDARY only:
+ * getBetterAuthHandler() returns handlers wrapped by wrapBetterAuthHandler(), and auth.api stays untouched.
+ *
+ * WHAT THE BROWSER GETS INSTEAD.
+ *   - list-sessions rows carry `isCurrent` (computed here against the caller's cookie-resolved session) and `id`.
+ *   - POST /revoke-session-by-id { id }: revokes ONE of the CALLER's sessions by its id. An id that is not one of the
+ *     caller's own sessions answers 404 (never 403: do not confirm that another user's session id exists).
+ *   - Better Auth's native POST /revoke-session { token } still exists and still requires a cookie-resolved session
+ *     that owns the token, but no browser ever holds a token to send it.
+ */
+
+/** Credential-bearing key names, compared case- and separator-insensitively. */
+const STRIP_KEYS = new Set(['token', 'sessiontoken', 'accesstoken', 'refreshtoken', 'idtoken']);
+
+const norm = (k: string): string => k.toLowerCase().replace(/[_\-\s]/g, '');
+
+/** Deep copy of `value` with every credential-named key removed, at any depth, in objects and arrays. */
+export function stripSessionCredentials(value: unknown): unknown {
+  if (Array.isArray(value)) return value.map(stripSessionCredentials);
+  if (value !== null && typeof value === 'object') {
+    const out: Record<string, unknown> = {};
+    for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
+      if (STRIP_KEYS.has(norm(k))) continue;
+      out[k] = stripSessionCredentials(v);
+    }
+    return out;
+  }
+  return value;
+}
+
+/** "/api/auth/get-session" -> "/get-session". Anything not under an /auth/ segment is returned as-is. */
+export function authSubPath(pathname: string): string {
+  const i = pathname.indexOf('/api/auth/');
+  if (i >= 0) return pathname.slice(i + '/api/auth'.length).replace(/\/+$/, '') || '/';
+  return pathname.replace(/\/+$/, '') || '/';
+}
+
+function isJson(res: Response): boolean {
+  return (res.headers.get('content-type') || '').toLowerCase().includes('application/json');
+}
+
+/** A Response with a new JSON body and the original status and headers (content-length recomputed by the runtime). */
+function withJsonBody(res: Response, body: unknown): Response {
+  const headers = new Headers(res.headers);
+  headers.delete('content-length');
+  return new Response(JSON.stringify(body), { status: res.status, statusText: res.statusText, headers });
+}
+
+interface AuthApi {
+  getSession: (opts: { headers: Headers }) => Promise<any>;
+  listSessions: (opts: { headers: Headers }) => Promise<any>;
+  revokeSession: (opts: { headers: Headers; body: { token: string }; asResponse?: boolean }) => Promise<any>;
+}
+
+/** Sanitise one already-produced Better Auth response. Pure function of (request, response, current token). */
+export async function sanitizeBetterAuthResponse(
+  req: Request,
+  res: Response,
+  currentToken: () => Promise<string | undefined>,
+): Promise<Response> {
+  const sub = authSubPath(new URL(req.url).pathname);
+  if (!res.ok || !isJson(res)) return res;
+
+  let body: unknown;
+  try {
+    body = await res.clone().json();
+  } catch {
+    return res; // unreadable body: nothing to strip, and do not turn it into a different failure
+  }
+
+  if (sub === '/list-sessions' && Array.isArray(body)) {
+    const cur = await currentToken().catch(() => undefined);
+    body = body.map((row: any) =>
+      row && typeof row === 'object' ? { ...row, isCurrent: !!cur && row.token === cur } : row,
+    );
+  }
+  return withJsonBody(res, stripSessionCredentials(body));
+}
+
+const json = (status: number, body: unknown): Response =>
+  new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json' } });
+
+/** POST /revoke-session-by-id { id }: revoke one of the caller's own sessions by id. */
+async function revokeById(req: Request, api: AuthApi): Promise<Response> {
+  let id: unknown;
+  try {
+    id = (await req.json())?.id;
+  } catch {
+    return json(400, { code: 'INVALID_REQUEST', message: 'Body must be JSON { id }' });
+  }
+  if (typeof id !== 'string' || id.length === 0) {
+    return json(400, { code: 'INVALID_REQUEST', message: 'id is required' });
+  }
+  const headers = new Headers(req.headers);
+  const rows = await api.listSessions({ headers }).catch(() => null);
+  if (rows === null) return json(401, { code: 'UNAUTHORIZED', message: 'No session' });
+  // listSessions returns ONLY the caller's own sessions, so a foreign id cannot match: 404, not 403.
+  const row = Array.isArray(rows) ? rows.find((r: any) => r && r.id === id && typeof r.token === 'string') : undefined;
+  if (!row) return json(404, { code: 'SESSION_NOT_FOUND', message: 'No such session' });
+  const res = await api.revokeSession({ headers, body: { token: row.token }, asResponse: true });
+  // Pass Better Auth's own answer (and its Set-Cookie when the current session was the one revoked) through.
+  return res instanceof Response ? res : json(200, { status: true });
+}
+
+type Handler = (req: Request) => Promise<Response>;
+
+/**
+ * Wrap Better Auth's Next.js handlers so no response carries a session credential to the browser.
+ * `auth` is the Better Auth instance; its `api` is used server-side only (to find the caller's current session and to
+ * revoke by id) and is not modified.
+ */
+export function wrapBetterAuthHandler(
+  auth: { api: AuthApi },
+  handlers: { GET: Handler; POST: Handler },
+): { GET: Handler; POST: Handler } {
+  const currentTokenFor = (req: Request) => async (): Promise<string | undefined> => {
+    const s = await auth.api.getSession({ headers: new Headers(req.headers) });
+    return s?.session?.token;
+  };
+  return {
+    GET: async (req) => sanitizeBetterAuthResponse(req, await handlers.GET(req), currentTokenFor(req)),
+    POST: async (req) => {
+      const sub = authSubPath(new URL(req.url).pathname);
+      if (sub === '/revoke-session-by-id') return revokeById(req, auth.api);
+      return sanitizeBetterAuthResponse(req, await handlers.POST(req), currentTokenFor(req));
+    },
+  };
+}