@payez/next-mvp 4.8.1 → 4.8.3

package/src/api-handlers/account/reset-password.ts

@@ -1,87 +1,87 @@
-import { NextRequest, NextResponse } from 'next/server';
-import { getIDPClientConfig } from '../../lib/idp-client-config';
-import { resolveClientKey } from '../../lib/client-key';
-import { idpErrorEnvelope, projectPasswordPolicyRules, projectResetTokenInvalid, projectPasswordBreached } from '../../lib/safe-error-response';
-
-function getIdpUrl(): string {
-  const url = process.env.IDP_URL;
-  if (!url) throw new Error('[IDP_URL] FATAL: IDP_URL environment variable is REQUIRED.');
-  return url;
-}
-
-/**
- * RECOVERY CLIENT KEY — cards 268012 (S12) and 268410.
- *
- * These four proxies populated NONE of PayEzClientIdResolver's six slots, so
- * RequirePayEzUnAuthorized 404'd the request BEFORE the action ran and no
- * recovery token was ever minted. That is why S12 failed at step 1.
- *
- * NOT `ENV_CONFIG.CLIENT_ID`, which is what card 268012 originally prescribed.
- * That variable is the ENVIRONMENT-SPECIFIC NUMERIC id, and the IDP accepts a
- * numeric with NO existence check (RequirePayEzUnAuthorizedAttribute.cs:31-33)
- * while it VALIDATES a slug (:41-47). Hardcoding the numeric here would have
- * added four more sites to the 268410 family and made a stale id answer for
- * the WRONG TENANT on a password-reset path, silently. Slug-preferring, with
- * the numeric fallback logged, is the same resolver the other nine sites use.
- *
- * SERVER VALUE WINS: client_id is applied AFTER the caller's payload spread.
- * These are unauthenticated recovery endpoints, so a browser-supplied
- * client_id would be a tenant-targeting lever. The caller does not get to
- * choose which tenant their password reset is addressed to.
- */
-async function recoveryClientKey(): Promise<string | null> {
-  try {
-    const config = await getIDPClientConfig();
-    return resolveClientKey(config, 'account/reset-password').key;
-  } catch (e) {
-    console.error('[account/reset-password] could not resolve IDP client config for client_id:', e);
-    return null;
-  }
-}
-
-export async function POST(req: NextRequest) {
-  const IDP_URL = getIdpUrl();
-  try {
-    const raw = await req.json().catch(() => null);
-    const body = (raw && typeof raw === 'object' ? raw : {}) as Record<string, unknown>;
-    // PAY-1588: the IdP's ResetPasswordRequest binds exactly email/token/new_password/confirm_password. The client
-    // used to send password_reset_token / password / password_confirmation, which bind to nothing (400 at the IdP).
-    // Legacy names are accepted as aliases and mapped; only the four IdP fields are forwarded (whitelist).
-    const str = (v: unknown) => (typeof v === 'string' && v.length > 0 ? v : undefined);
-    const fields = {
-      email: str(body.email),
-      token: str(body.token) ?? str(body.password_reset_token),
-      new_password: str(body.new_password) ?? str(body.password),
-      confirm_password: str(body.confirm_password) ?? str(body.password_confirmation),
-    };
-    const missing = Object.entries(fields).filter(([, v]) => v === undefined).map(([k]) => k);
-    if (missing.length) {
-      return NextResponse.json(
-        { success: false, error: 'invalid_request', message: 'Missing required fields: ' + missing.join(', ') },
-        { status: 400 },
-      );
-    }
-    const payload = fields;
-    const clientKey = await recoveryClientKey();
-    const upstream = await fetch(`${IDP_URL}/api/Account/reset-password`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', ...(clientKey ? { 'X-Client-Id': clientKey } : {}) },
-      body: JSON.stringify({ ...payload, ...(clientKey ? { client_id: clientKey } : {}) }),
-    });
-    const data = await upstream.json().catch(() => ({}));
-    // PAY-1438: anonymous route - on failure only the whitelisted envelope (utils/api reads `message`).
-    if (!upstream.ok) {
-      // PAY-1591: a password-policy refusal also carries the KNOWN rule codes so the page can say which rules failed.
-      const rules = projectPasswordPolicyRules(data);
-      // PAY-2103: a breached-password refusal is a distinct 400; project a BOOLEAN so the anonymous
-      // route carries no code text and the page picks its own sentence.
-      return NextResponse.json(
-        { ...idpErrorEnvelope(data, 'Failed to reset password'), ...(rules !== undefined ? { password_policy: { rules } } : {}), ...(projectResetTokenInvalid(data) ? { reset_token_invalid: true } : {}), ...(projectPasswordBreached(data) ? { password_breached: true } : {}) },
-        { status: upstream.status },
-      );
-    }
-    return NextResponse.json(data, { status: upstream.status });
-  } catch {
-    return NextResponse.json({ success: false, error: 'reset_password_failed' }, { status: 500 });
-  }
-}
+import { NextRequest, NextResponse } from 'next/server';
+import { getIDPClientConfig } from '../../lib/idp-client-config';
+import { resolveClientKey } from '../../lib/client-key';
+import { idpErrorEnvelope, projectPasswordPolicyRules, projectResetTokenInvalid, projectPasswordBreached } from '../../lib/safe-error-response';
+
+function getIdpUrl(): string {
+  const url = process.env.IDP_URL;
+  if (!url) throw new Error('[IDP_URL] FATAL: IDP_URL environment variable is REQUIRED.');
+  return url;
+}
+
+/**
+ * RECOVERY CLIENT KEY — cards 268012 (S12) and 268410.
+ *
+ * These four proxies populated NONE of PayEzClientIdResolver's six slots, so
+ * RequirePayEzUnAuthorized 404'd the request BEFORE the action ran and no
+ * recovery token was ever minted. That is why S12 failed at step 1.
+ *
+ * NOT `ENV_CONFIG.CLIENT_ID`, which is what card 268012 originally prescribed.
+ * That variable is the ENVIRONMENT-SPECIFIC NUMERIC id, and the IDP accepts a
+ * numeric with NO existence check (RequirePayEzUnAuthorizedAttribute.cs:31-33)
+ * while it VALIDATES a slug (:41-47). Hardcoding the numeric here would have
+ * added four more sites to the 268410 family and made a stale id answer for
+ * the WRONG TENANT on a password-reset path, silently. Slug-preferring, with
+ * the numeric fallback logged, is the same resolver the other nine sites use.
+ *
+ * SERVER VALUE WINS: client_id is applied AFTER the caller's payload spread.
+ * These are unauthenticated recovery endpoints, so a browser-supplied
+ * client_id would be a tenant-targeting lever. The caller does not get to
+ * choose which tenant their password reset is addressed to.
+ */
+async function recoveryClientKey(): Promise<string | null> {
+  try {
+    const config = await getIDPClientConfig();
+    return resolveClientKey(config, 'account/reset-password').key;
+  } catch (e) {
+    console.error('[account/reset-password] could not resolve IDP client config for client_id:', e);
+    return null;
+  }
+}
+
+export async function POST(req: NextRequest) {
+  const IDP_URL = getIdpUrl();
+  try {
+    const raw = await req.json().catch(() => null);
+    const body = (raw && typeof raw === 'object' ? raw : {}) as Record<string, unknown>;
+    // PAY-1588: the IdP's ResetPasswordRequest binds exactly email/token/new_password/confirm_password. The client
+    // used to send password_reset_token / password / password_confirmation, which bind to nothing (400 at the IdP).
+    // Legacy names are accepted as aliases and mapped; only the four IdP fields are forwarded (whitelist).
+    const str = (v: unknown) => (typeof v === 'string' && v.length > 0 ? v : undefined);
+    const fields = {
+      email: str(body.email),
+      token: str(body.token) ?? str(body.password_reset_token),
+      new_password: str(body.new_password) ?? str(body.password),
+      confirm_password: str(body.confirm_password) ?? str(body.password_confirmation),
+    };
+    const missing = Object.entries(fields).filter(([, v]) => v === undefined).map(([k]) => k);
+    if (missing.length) {
+      return NextResponse.json(
+        { success: false, error: 'invalid_request', message: 'Missing required fields: ' + missing.join(', ') },
+        { status: 400 },
+      );
+    }
+    const payload = fields;
+    const clientKey = await recoveryClientKey();
+    const upstream = await fetch(`${IDP_URL}/api/Account/reset-password`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', ...(clientKey ? { 'X-Client-Id': clientKey } : {}) },
+      body: JSON.stringify({ ...payload, ...(clientKey ? { client_id: clientKey } : {}) }),
+    });
+    const data = await upstream.json().catch(() => ({}));
+    // PAY-1438: anonymous route - on failure only the whitelisted envelope (utils/api reads `message`).
+    if (!upstream.ok) {
+      // PAY-1591: a password-policy refusal also carries the KNOWN rule codes so the page can say which rules failed.
+      const rules = projectPasswordPolicyRules(data);
+      // PAY-2103: a breached-password refusal is a distinct 400; project a BOOLEAN so the anonymous
+      // route carries no code text and the page picks its own sentence.
+      return NextResponse.json(
+        { ...idpErrorEnvelope(data, 'Failed to reset password'), ...(rules !== undefined ? { password_policy: { rules } } : {}), ...(projectResetTokenInvalid(data) ? { reset_token_invalid: true } : {}), ...(projectPasswordBreached(data) ? { password_breached: true } : {}) },
+        { status: upstream.status },
+      );
+    }
+    return NextResponse.json(data, { status: upstream.status });
+  } catch {
+    return NextResponse.json({ success: false, error: 'reset_password_failed' }, { status: 500 });
+  }
+}

package/src/api-handlers/account/send-code.ts

@@ -1,70 +1,70 @@
-/**
- * Send 2FA Verification Code Handler
- *
- * Sends a verification code via email or SMS to the authenticated user.
- * Requires a provisional Bearer token (ACR=1) from initial login.
- *
- * @package @payez/next-mvp
- */
-
-import { NextRequest, NextResponse } from 'next/server';
-import { idpFetchJSON } from '../../lib/idp-fetch';
-import { ENV_CONFIG } from '../../config/env';
-import { twoFactorSendCodeFailure } from '../../lib/two-factor-verify-failure';
-
-export async function POST(req: NextRequest) {
-  try {
-    // Parse request body
-    const body = await req.json();
-    const method = String(body.method || '').toLowerCase();
-
-    if (method !== 'sms' && method !== 'email') {
-      return NextResponse.json(
-        {
-          success: false,
-          error: 'Method must be either "sms" or "email"',
-          code: 'INVALID_METHOD',
-        },
-        { status: 400 }
-      );
-    }
-
-    // Build IDP endpoint URL
-    const idpEndpoint = method === 'sms'
-      ? '/api/ExternalAuth/twofa/sms/send'
-      : '/api/ExternalAuth/twofa/email/send';
-
-    // Send client_id in body (lower_snake_case per PayEz standards)
-    const idpBody = JSON.stringify({ client_id: ENV_CONFIG.CLIENT_ID });
-
-    // Call IDP using idpFetchJSON which auto-injects Bearer token from Redis session
-    const result = await idpFetchJSON(req, `${ENV_CONFIG.IDP_URL}${idpEndpoint}`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: idpBody,
-    });
-
-    if (!result.ok) {
-      // PAY-1443: never relay the IDP's message/code - fixed sentence + stable code, status kept.
-      return twoFactorSendCodeFailure(result, method);
-    }
-
-    return NextResponse.json(
-      {
-        success: true,
-        message: `Verification code sent via ${method}`,
-      },
-      { status: 200 }
-    );
-  } catch (error) {
-    console.error('[SEND_CODE] Error:', error);
-    return NextResponse.json(
-      {
-        success: false,
-        error: 'Failed to send verification code',
-        code: 'INTERNAL_ERROR',
-      },
-      { status: 500 }
-    );
-  }
-}
+/**
+ * Send 2FA Verification Code Handler
+ *
+ * Sends a verification code via email or SMS to the authenticated user.
+ * Requires a provisional Bearer token (ACR=1) from initial login.
+ *
+ * @package @payez/next-mvp
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { idpFetchJSON } from '../../lib/idp-fetch';
+import { ENV_CONFIG } from '../../config/env';
+import { twoFactorSendCodeFailure } from '../../lib/two-factor-verify-failure';
+
+export async function POST(req: NextRequest) {
+  try {
+    // Parse request body
+    const body = await req.json();
+    const method = String(body.method || '').toLowerCase();
+
+    if (method !== 'sms' && method !== 'email') {
+      return NextResponse.json(
+        {
+          success: false,
+          error: 'Method must be either "sms" or "email"',
+          code: 'INVALID_METHOD',
+        },
+        { status: 400 }
+      );
+    }
+
+    // Build IDP endpoint URL
+    const idpEndpoint = method === 'sms'
+      ? '/api/ExternalAuth/twofa/sms/send'
+      : '/api/ExternalAuth/twofa/email/send';
+
+    // Send client_id in body (lower_snake_case per PayEz standards)
+    const idpBody = JSON.stringify({ client_id: ENV_CONFIG.CLIENT_ID });
+
+    // Call IDP using idpFetchJSON which auto-injects Bearer token from Redis session
+    const result = await idpFetchJSON(req, `${ENV_CONFIG.IDP_URL}${idpEndpoint}`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: idpBody,
+    });
+
+    if (!result.ok) {
+      // PAY-1443: never relay the IDP's message/code - fixed sentence + stable code, status kept.
+      return twoFactorSendCodeFailure(result, method);
+    }
+
+    return NextResponse.json(
+      {
+        success: true,
+        message: `Verification code sent via ${method}`,
+      },
+      { status: 200 }
+    );
+  } catch (error) {
+    console.error('[SEND_CODE] Error:', error);
+    return NextResponse.json(
+      {
+        success: false,
+        error: 'Failed to send verification code',
+        code: 'INTERNAL_ERROR',
+      },
+      { status: 500 }
+    );
+  }
+}

package/src/api-handlers/account/update-phone.ts

@@ -1,84 +1,84 @@
-import { NextRequest, NextResponse } from 'next/server';
-import { idpFetchJSON } from '../../lib/idp-fetch';
-import { ENV_CONFIG } from '../../config/env';
-
-/**
- * Update Phone Number API Handler
- *
- * PATCH /api/account/update-phone - Update user's phone number
- * Used for 2FA setup - users need to add a phone to enable SMS verification.
- */
-export async function POST(req: NextRequest) {
-  try {
-    // Parse request body
-    let body: { phoneNumber?: string };
-    try {
-      body = await req.json();
-    } catch {
-      return NextResponse.json(
-        { success: false, error: { code: 'INVALID_JSON', message: 'Invalid request body' } },
-        { status: 400 }
-      );
-    }
-
-    const { phoneNumber } = body;
-
-    if (!phoneNumber) {
-      return NextResponse.json(
-        { success: false, error: { code: 'INVALID_INPUT', message: 'Phone number is required' } },
-        { status: 400 }
-      );
-    }
-
-    // PATCH profile with phone_number only
-    const url = `${ENV_CONFIG.IDP_URL}/api/Account/profile`;
-    const result = await idpFetchJSON(req, url, {
-      method: 'PATCH',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ phone_number: phoneNumber }),
-    });
-
-    if (!result.ok) {
-      // PAY-1424: shape only, never the IDP body (profile endpoint - PII).
-      console.error('[UPDATE_PHONE] IDP error:', {
-        status: result.status,
-        bodyKeys: (result.json as any) && typeof (result.json as any) === 'object' ? Object.keys((result.json as any)) : undefined,
-        errorKeys: (result.json as any)?.error && typeof (result.json as any)?.error === 'object' ? Object.keys((result.json as any)?.error) : undefined,
-      });
-      return NextResponse.json(
-        {
-          success: false,
-          error: {
-            code: (result.json as any)?.error?.code || 'UPDATE_FAILED',
-            message: (result.json as any)?.error?.message || 'Failed to update phone number',
-          },
-          meta: { attemptedRefresh: result.attemptedRefresh },
-        },
-        { status: result.status }
-      );
-    }
-
-    const responseData = result.json as any;
-
-    // Unwrap if IDP returns envelope { success, data }
-    if (responseData && typeof responseData === 'object' && 'success' in responseData && 'data' in responseData) {
-      return NextResponse.json({
-        success: true,
-        message: 'Phone number updated successfully',
-        data: responseData.data,
-      });
-    }
-
-    return NextResponse.json({
-      success: true,
-      message: 'Phone number updated successfully',
-      data: responseData,
-    });
-  } catch (error) {
-    console.error('[UPDATE_PHONE] Error:', error);
-    return NextResponse.json(
-      { success: false, error: { code: 'INTERNAL_ERROR', message: 'Failed to update phone number' } },
-      { status: 500 }
-    );
-  }
-}
+import { NextRequest, NextResponse } from 'next/server';
+import { idpFetchJSON } from '../../lib/idp-fetch';
+import { ENV_CONFIG } from '../../config/env';
+
+/**
+ * Update Phone Number API Handler
+ *
+ * PATCH /api/account/update-phone - Update user's phone number
+ * Used for 2FA setup - users need to add a phone to enable SMS verification.
+ */
+export async function POST(req: NextRequest) {
+  try {
+    // Parse request body
+    let body: { phoneNumber?: string };
+    try {
+      body = await req.json();
+    } catch {
+      return NextResponse.json(
+        { success: false, error: { code: 'INVALID_JSON', message: 'Invalid request body' } },
+        { status: 400 }
+      );
+    }
+
+    const { phoneNumber } = body;
+
+    if (!phoneNumber) {
+      return NextResponse.json(
+        { success: false, error: { code: 'INVALID_INPUT', message: 'Phone number is required' } },
+        { status: 400 }
+      );
+    }
+
+    // PATCH profile with phone_number only
+    const url = `${ENV_CONFIG.IDP_URL}/api/Account/profile`;
+    const result = await idpFetchJSON(req, url, {
+      method: 'PATCH',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ phone_number: phoneNumber }),
+    });
+
+    if (!result.ok) {
+      // PAY-1424: shape only, never the IDP body (profile endpoint - PII).
+      console.error('[UPDATE_PHONE] IDP error:', {
+        status: result.status,
+        bodyKeys: (result.json as any) && typeof (result.json as any) === 'object' ? Object.keys((result.json as any)) : undefined,
+        errorKeys: (result.json as any)?.error && typeof (result.json as any)?.error === 'object' ? Object.keys((result.json as any)?.error) : undefined,
+      });
+      return NextResponse.json(
+        {
+          success: false,
+          error: {
+            code: (result.json as any)?.error?.code || 'UPDATE_FAILED',
+            message: (result.json as any)?.error?.message || 'Failed to update phone number',
+          },
+          meta: { attemptedRefresh: result.attemptedRefresh },
+        },
+        { status: result.status }
+      );
+    }
+
+    const responseData = result.json as any;
+
+    // Unwrap if IDP returns envelope { success, data }
+    if (responseData && typeof responseData === 'object' && 'success' in responseData && 'data' in responseData) {
+      return NextResponse.json({
+        success: true,
+        message: 'Phone number updated successfully',
+        data: responseData.data,
+      });
+    }
+
+    return NextResponse.json({
+      success: true,
+      message: 'Phone number updated successfully',
+      data: responseData,
+    });
+  } catch (error) {
+    console.error('[UPDATE_PHONE] Error:', error);
+    return NextResponse.json(
+      { success: false, error: { code: 'INTERNAL_ERROR', message: 'Failed to update phone number' } },
+      { status: 500 }
+    );
+  }
+}