@payez/next-mvp 4.8.1 → 4.8.3

package/src/lib/redis.ts

@@ -1,105 +1,105 @@
-// E:\Repos\PayEz-Next-MVP\packages\next-mvp\src\lib\redis.ts
-import Redis, { RedisOptions } from 'ioredis';
-
-let client: Redis | null = null;
-
-// ── 183496: fail FAST and NAMED, never a 20s spinner ───────────────────────
-// The DEFAULTS were the defect (Nextpert-Scout's killable-proxy measurement,
-// BAPert 22626): no commandTimeout, so a command against a cut Redis path
-// hung 20s+, and maxRetriesPerRequest defaults to 20, so every command was
-// retried through every reconnect attempt. In the room that reads as "the
-// app hung", not "Redis blipped" - and self-heal was instant all along, so
-// the failure MODE was the whole defect.
-//
-// commandTimeout covers OFFLINE-QUEUED commands too (ioredis 5.8.2 Redis.js:
-// command.setTimeout runs BEFORE the queue/writable check), which makes it
-// the bounded offline queue the card asks for: no command, queued or sent,
-// outlives 3s. The queue itself stays ENABLED - a transient blip still
-// self-heals inside the window; only the failure mode changes. The throw
-// lands in with-auth's catch and comes out a fast 5xx, not a spinner.
-const REDIS_OPTIONS: RedisOptions = {
-  commandTimeout: 3000,
-  maxRetriesPerRequest: 1,
-};
-
-function createClient(): Redis {
-  const url = process.env.REDIS_URL;
-
-  // ── THE COMMENT THAT USED TO BE HERE WAS FALSE (Nextpert-Scout 35159). ──
-  //
-  // It said: "No REDIS_URL set, create a client that will fail fast."
-  // IT DOES NOT FAIL. Measured, not read:
-  //
-  //     new Redis({ commandTimeout, maxRetriesPerRequest, lazyConnect: true })
-  //       -> options.host === 'localhost',  options.port === 6379
-  //     (ioredis DEFAULT_REDIS_OPTIONS: port 6379, host "localhost")
-  //
-  // `lazyConnect` only DEFERS the connection to the first command; it does not
-  // prevent one. So with REDIS_URL absent this client silently targets
-  // localhost:6379. Whether that is a loud failure or a SILENT CONNECTION TO
-  // THE WRONG STORE depends entirely on what happens to be listening on the
-  // local loopback - which is not a property this module controls, and is
-  // exactly the kind of thing that differs between a container and a dev box.
-  //
-  // This mattered operationally: I told the team that deleting REDIS_URL from a
-  // configmap would be fail-closed, and recommended it as a hardening step for
-  // the 249808 remediation. That advice was wrong and rested on this comment.
-  // A loopback-exempt firewall rule also does not stop a client that has
-  // fallen back to loopback.
-  //
-  // Corrected rather than deleted, because the comment's INTENT was right and
-  // is worth preserving as a stated goal: an absent REDIS_URL SHOULD fail
-  // loudly. Making it actually do so means changing behaviour at module load
-  // (`const redis = getRedis()` at the bottom of this file runs on import), so
-  // it is carded rather than changed at speed - throwing on import would break
-  // every consumer that imports this module without needing Redis.
-  //
-  // What IS done here: the misconfiguration is now ANNOUNCED, so it can never
-  // again be silent even though it is not yet fatal.
-  if (!url || url.trim() === '') {
-    console.error(
-      '[redis] MISCONFIGURED: REDIS_URL is unset or empty. ' +
-      'This client will fall back to ioredis defaults (localhost:6379) and may ' +
-      'connect to whatever is listening there, or fail on first command. ' +
-      'It does NOT fail fast. Set REDIS_URL explicitly.',
-    );
-  }
-
-  const instance = url && url.trim() !== ''
-    // Use a standard configuration for better Docker compatibility
-    ? new Redis(url, REDIS_OPTIONS)
-    // NOTE: this does NOT fail fast - see the block above. It targets
-    // localhost:6379 by ioredis default.
-    : new Redis({ ...REDIS_OPTIONS, lazyConnect: true });
-
-  // Loud AND load-bearing: an ioredis 'error' event with NO listener is an
-  // unhandled EventEmitter error, which can take the whole PROCESS down -
-  // a Redis blip becoming a dead server is worse than the spinner was.
-  instance.on('error', (err) => {
-    console.error(`[redis] PATH FAILURE ${new Date().toISOString()}: ${err instanceof Error ? err.message : String(err)}`);
-  });
-
-  // 185121 line 3: the 16:05 event left no named trigger because ONLY 'error'
-  // was listened for. A reconnect or a clean end is silent in the artifact,
-  // so a session-death window could not be correlated with a redis event.
-  // One line per event; a recurrence now says whether redis moved at all.
-  instance.on('reconnecting', (delayMs: number) => {
-    console.warn(`[redis] RECONNECTING ${new Date().toISOString()}: next attempt in ${delayMs}ms`);
-  });
-  instance.on('end', () => {
-    console.error(`[redis] CONNECTION ENDED ${new Date().toISOString()}: no further reconnects — every session read now fails or misses`);
-  });
-
-  return instance;
-}
-
-export function getRedis(): Redis {
-  if (!client) {
-    client = createClient();
-  }
-  return client;
-}
-
-const redis = getRedis();
-export { redis };
-export default redis;
+// E:\Repos\PayEz-Next-MVP\packages\next-mvp\src\lib\redis.ts
+import Redis, { RedisOptions } from 'ioredis';
+
+let client: Redis | null = null;
+
+// ── 183496: fail FAST and NAMED, never a 20s spinner ───────────────────────
+// The DEFAULTS were the defect (Nextpert-Scout's killable-proxy measurement,
+// BAPert 22626): no commandTimeout, so a command against a cut Redis path
+// hung 20s+, and maxRetriesPerRequest defaults to 20, so every command was
+// retried through every reconnect attempt. In the room that reads as "the
+// app hung", not "Redis blipped" - and self-heal was instant all along, so
+// the failure MODE was the whole defect.
+//
+// commandTimeout covers OFFLINE-QUEUED commands too (ioredis 5.8.2 Redis.js:
+// command.setTimeout runs BEFORE the queue/writable check), which makes it
+// the bounded offline queue the card asks for: no command, queued or sent,
+// outlives 3s. The queue itself stays ENABLED - a transient blip still
+// self-heals inside the window; only the failure mode changes. The throw
+// lands in with-auth's catch and comes out a fast 5xx, not a spinner.
+const REDIS_OPTIONS: RedisOptions = {
+  commandTimeout: 3000,
+  maxRetriesPerRequest: 1,
+};
+
+function createClient(): Redis {
+  const url = process.env.REDIS_URL;
+
+  // ── THE COMMENT THAT USED TO BE HERE WAS FALSE (Nextpert-Scout 35159). ──
+  //
+  // It said: "No REDIS_URL set, create a client that will fail fast."
+  // IT DOES NOT FAIL. Measured, not read:
+  //
+  //     new Redis({ commandTimeout, maxRetriesPerRequest, lazyConnect: true })
+  //       -> options.host === 'localhost',  options.port === 6379
+  //     (ioredis DEFAULT_REDIS_OPTIONS: port 6379, host "localhost")
+  //
+  // `lazyConnect` only DEFERS the connection to the first command; it does not
+  // prevent one. So with REDIS_URL absent this client silently targets
+  // localhost:6379. Whether that is a loud failure or a SILENT CONNECTION TO
+  // THE WRONG STORE depends entirely on what happens to be listening on the
+  // local loopback - which is not a property this module controls, and is
+  // exactly the kind of thing that differs between a container and a dev box.
+  //
+  // This mattered operationally: I told the team that deleting REDIS_URL from a
+  // configmap would be fail-closed, and recommended it as a hardening step for
+  // the 249808 remediation. That advice was wrong and rested on this comment.
+  // A loopback-exempt firewall rule also does not stop a client that has
+  // fallen back to loopback.
+  //
+  // Corrected rather than deleted, because the comment's INTENT was right and
+  // is worth preserving as a stated goal: an absent REDIS_URL SHOULD fail
+  // loudly. Making it actually do so means changing behaviour at module load
+  // (`const redis = getRedis()` at the bottom of this file runs on import), so
+  // it is carded rather than changed at speed - throwing on import would break
+  // every consumer that imports this module without needing Redis.
+  //
+  // What IS done here: the misconfiguration is now ANNOUNCED, so it can never
+  // again be silent even though it is not yet fatal.
+  if (!url || url.trim() === '') {
+    console.error(
+      '[redis] MISCONFIGURED: REDIS_URL is unset or empty. ' +
+      'This client will fall back to ioredis defaults (localhost:6379) and may ' +
+      'connect to whatever is listening there, or fail on first command. ' +
+      'It does NOT fail fast. Set REDIS_URL explicitly.',
+    );
+  }
+
+  const instance = url && url.trim() !== ''
+    // Use a standard configuration for better Docker compatibility
+    ? new Redis(url, REDIS_OPTIONS)
+    // NOTE: this does NOT fail fast - see the block above. It targets
+    // localhost:6379 by ioredis default.
+    : new Redis({ ...REDIS_OPTIONS, lazyConnect: true });
+
+  // Loud AND load-bearing: an ioredis 'error' event with NO listener is an
+  // unhandled EventEmitter error, which can take the whole PROCESS down -
+  // a Redis blip becoming a dead server is worse than the spinner was.
+  instance.on('error', (err) => {
+    console.error(`[redis] PATH FAILURE ${new Date().toISOString()}: ${err instanceof Error ? err.message : String(err)}`);
+  });
+
+  // 185121 line 3: the 16:05 event left no named trigger because ONLY 'error'
+  // was listened for. A reconnect or a clean end is silent in the artifact,
+  // so a session-death window could not be correlated with a redis event.
+  // One line per event; a recurrence now says whether redis moved at all.
+  instance.on('reconnecting', (delayMs: number) => {
+    console.warn(`[redis] RECONNECTING ${new Date().toISOString()}: next attempt in ${delayMs}ms`);
+  });
+  instance.on('end', () => {
+    console.error(`[redis] CONNECTION ENDED ${new Date().toISOString()}: no further reconnects — every session read now fails or misses`);
+  });
+
+  return instance;
+}
+
+export function getRedis(): Redis {
+  if (!client) {
+    client = createClient();
+  }
+  return client;
+}
+
+const redis = getRedis();
+export { redis };
+export default redis;

package/src/lib/refresh-token-validator.ts

@@ -1,64 +1,64 @@
-import { jwtDecode } from './jwt-decode';
-import { tokenRefreshLogger } from '../config/logger';
-
-interface RefreshTokenPayload { exp: number; iat: number; jti: string; user_id: string; token_type: string; binding: string; }
-
-export function isRefreshTokenValid(token: string): boolean {
-  if (!token) return false;
-  try { const decoded = jwtDecode<RefreshTokenPayload>(token); if (!decoded) return false; const now = Math.floor(Date.now() / 1000); if (decoded.exp < now) return false; if (decoded.token_type !== 'refresh_token') return false; return true; } catch { return false; }
-}
-
-export function isRefreshTokenExpiring(token: string, bufferMinutes: number = 60): boolean {
-  if (!token) return true;
-  try { const decoded = jwtDecode<RefreshTokenPayload>(token); if (!decoded?.exp) return true; const now = Math.floor(Date.now() / 1000); const buffer = bufferMinutes * 60; return decoded.exp <= (now + buffer); } catch { return true; }
-}
-
-export function getRefreshTokenExpiration(token: string): number | null {
-  if (!token) return null; try { const decoded = jwtDecode<RefreshTokenPayload>(token); if (!decoded?.exp) return null; return decoded.exp * 1000; } catch { return null; }
-}
-
-export function getRefreshTokenTimeRemaining(token: string): number | null {
-  if (!token) return null; try { const decoded = jwtDecode<RefreshTokenPayload>(token); if (!decoded?.exp) return null; const now = Math.floor(Date.now() / 1000); const timeRemaining = decoded.exp - now; return timeRemaining > 0 ? timeRemaining : null; } catch { return null; }
-}
-
-export interface RefreshViabilityCheck {
-  canRefresh: boolean;
-  reason: 'valid_refresh_token' | 'no_refresh_token' | 'refresh_token_expired' | 'session_missing';
-  timeRemaining?: number;
-  expiresAt?: string;
-  accessTokenExpired?: boolean;
-  accessTokenTimeRemaining?: number;
-}
-
-export function checkRefreshViability(sessionData: any): RefreshViabilityCheck {
-  if (!sessionData) return { canRefresh: false, reason: 'session_missing' };
-  let accessTokenExpired = false; let accessTokenTimeRemaining: number | undefined;
-  if (sessionData.idpAccessTokenExpires) {
-    const now = Date.now(); let expiresAtMs = sessionData.idpAccessTokenExpires;
-    if (typeof expiresAtMs === 'string') expiresAtMs = parseInt(expiresAtMs, 10);
-    if (expiresAtMs < 1000000000000) expiresAtMs = expiresAtMs * 1000;
-    accessTokenTimeRemaining = Math.floor((expiresAtMs - now) / 1000);
-    const bufferSec = 5 * 60; // 5 minutes pre-expiry buffer
-    accessTokenExpired = accessTokenTimeRemaining <= bufferSec;
-    tokenRefreshLogger.debug('[REFRESH_VIABILITY] Access token expiration check', { now, expiresAtMs, accessTokenTimeRemaining, bufferSec, accessTokenExpired });
-  }
-  if (!sessionData.idpRefreshToken) return { canRefresh: false, reason: 'no_refresh_token', accessTokenExpired, accessTokenTimeRemaining };
-  if (sessionData.idpRefreshTokenExpires) {
-    let refreshExpMs = sessionData.idpRefreshTokenExpires;
-    if (typeof refreshExpMs === 'string') refreshExpMs = parseInt(refreshExpMs, 10);
-    if (refreshExpMs < 1000000000000) refreshExpMs = refreshExpMs * 1000;
-    const nowMs = Date.now(); const timeRemainingSec = Math.floor((refreshExpMs - nowMs) / 1000);
-    if (timeRemainingSec <= 0) return { canRefresh: false, reason: 'refresh_token_expired', accessTokenExpired, accessTokenTimeRemaining };
-    return { canRefresh: true, reason: 'valid_refresh_token', timeRemaining: timeRemainingSec, expiresAt: new Date(refreshExpMs).toISOString(), accessTokenExpired, accessTokenTimeRemaining };
-  }
-  try {
-    const decoded = jwtDecode<RefreshTokenPayload>(sessionData.idpRefreshToken); const nowSec = Math.floor(Date.now() / 1000);
-    if (!decoded?.exp || decoded.token_type !== 'refresh_token') return { canRefresh: false, reason: 'refresh_token_expired', accessTokenExpired, accessTokenTimeRemaining };
-    const timeRemaining = decoded.exp - nowSec; if (timeRemaining <= 0) return { canRefresh: false, reason: 'refresh_token_expired', accessTokenExpired, accessTokenTimeRemaining };
-    const expiresAtIso = new Date(decoded.exp * 1000).toISOString();
-    return { canRefresh: true, reason: 'valid_refresh_token', timeRemaining, expiresAt: expiresAtIso, accessTokenExpired, accessTokenTimeRemaining };
-  } catch (error) {
-    tokenRefreshLogger.debug('[REFRESH_VIABILITY] Failed to decode refresh token for viability', { error: error instanceof Error ? error.message : String(error) });
-    return { canRefresh: false, reason: 'refresh_token_expired', accessTokenExpired, accessTokenTimeRemaining };
-  }
-}
+import { jwtDecode } from './jwt-decode';
+import { tokenRefreshLogger } from '../config/logger';
+
+interface RefreshTokenPayload { exp: number; iat: number; jti: string; user_id: string; token_type: string; binding: string; }
+
+export function isRefreshTokenValid(token: string): boolean {
+  if (!token) return false;
+  try { const decoded = jwtDecode<RefreshTokenPayload>(token); if (!decoded) return false; const now = Math.floor(Date.now() / 1000); if (decoded.exp < now) return false; if (decoded.token_type !== 'refresh_token') return false; return true; } catch { return false; }
+}
+
+export function isRefreshTokenExpiring(token: string, bufferMinutes: number = 60): boolean {
+  if (!token) return true;
+  try { const decoded = jwtDecode<RefreshTokenPayload>(token); if (!decoded?.exp) return true; const now = Math.floor(Date.now() / 1000); const buffer = bufferMinutes * 60; return decoded.exp <= (now + buffer); } catch { return true; }
+}
+
+export function getRefreshTokenExpiration(token: string): number | null {
+  if (!token) return null; try { const decoded = jwtDecode<RefreshTokenPayload>(token); if (!decoded?.exp) return null; return decoded.exp * 1000; } catch { return null; }
+}
+
+export function getRefreshTokenTimeRemaining(token: string): number | null {
+  if (!token) return null; try { const decoded = jwtDecode<RefreshTokenPayload>(token); if (!decoded?.exp) return null; const now = Math.floor(Date.now() / 1000); const timeRemaining = decoded.exp - now; return timeRemaining > 0 ? timeRemaining : null; } catch { return null; }
+}
+
+export interface RefreshViabilityCheck {
+  canRefresh: boolean;
+  reason: 'valid_refresh_token' | 'no_refresh_token' | 'refresh_token_expired' | 'session_missing';
+  timeRemaining?: number;
+  expiresAt?: string;
+  accessTokenExpired?: boolean;
+  accessTokenTimeRemaining?: number;
+}
+
+export function checkRefreshViability(sessionData: any): RefreshViabilityCheck {
+  if (!sessionData) return { canRefresh: false, reason: 'session_missing' };
+  let accessTokenExpired = false; let accessTokenTimeRemaining: number | undefined;
+  if (sessionData.idpAccessTokenExpires) {
+    const now = Date.now(); let expiresAtMs = sessionData.idpAccessTokenExpires;
+    if (typeof expiresAtMs === 'string') expiresAtMs = parseInt(expiresAtMs, 10);
+    if (expiresAtMs < 1000000000000) expiresAtMs = expiresAtMs * 1000;
+    accessTokenTimeRemaining = Math.floor((expiresAtMs - now) / 1000);
+    const bufferSec = 5 * 60; // 5 minutes pre-expiry buffer
+    accessTokenExpired = accessTokenTimeRemaining <= bufferSec;
+    tokenRefreshLogger.debug('[REFRESH_VIABILITY] Access token expiration check', { now, expiresAtMs, accessTokenTimeRemaining, bufferSec, accessTokenExpired });
+  }
+  if (!sessionData.idpRefreshToken) return { canRefresh: false, reason: 'no_refresh_token', accessTokenExpired, accessTokenTimeRemaining };
+  if (sessionData.idpRefreshTokenExpires) {
+    let refreshExpMs = sessionData.idpRefreshTokenExpires;
+    if (typeof refreshExpMs === 'string') refreshExpMs = parseInt(refreshExpMs, 10);
+    if (refreshExpMs < 1000000000000) refreshExpMs = refreshExpMs * 1000;
+    const nowMs = Date.now(); const timeRemainingSec = Math.floor((refreshExpMs - nowMs) / 1000);
+    if (timeRemainingSec <= 0) return { canRefresh: false, reason: 'refresh_token_expired', accessTokenExpired, accessTokenTimeRemaining };
+    return { canRefresh: true, reason: 'valid_refresh_token', timeRemaining: timeRemainingSec, expiresAt: new Date(refreshExpMs).toISOString(), accessTokenExpired, accessTokenTimeRemaining };
+  }
+  try {
+    const decoded = jwtDecode<RefreshTokenPayload>(sessionData.idpRefreshToken); const nowSec = Math.floor(Date.now() / 1000);
+    if (!decoded?.exp || decoded.token_type !== 'refresh_token') return { canRefresh: false, reason: 'refresh_token_expired', accessTokenExpired, accessTokenTimeRemaining };
+    const timeRemaining = decoded.exp - nowSec; if (timeRemaining <= 0) return { canRefresh: false, reason: 'refresh_token_expired', accessTokenExpired, accessTokenTimeRemaining };
+    const expiresAtIso = new Date(decoded.exp * 1000).toISOString();
+    return { canRefresh: true, reason: 'valid_refresh_token', timeRemaining, expiresAt: expiresAtIso, accessTokenExpired, accessTokenTimeRemaining };
+  } catch (error) {
+    tokenRefreshLogger.debug('[REFRESH_VIABILITY] Failed to decode refresh token for viability', { error: error instanceof Error ? error.message : String(error) });
+    return { canRefresh: false, reason: 'refresh_token_expired', accessTokenExpired, accessTokenTimeRemaining };
+  }
+}