@payez/next-mvp 4.8.7 → 4.8.8

package/README.md

@@ -548,7 +548,7 @@ import { POST as logout } from '@payez/next-mvp/routes/auth/logout';
 | Variable | Required | Description |
 |----------|----------|-------------|
 | `CLIENT_ID` | ✅ Yes | Your PayEz IDP client ID (string slug, e.g., `payez_idp_admin_web`) |
-| `IDP_URL` | ✅ Yes | PayEz IDP base URL (e.g., `https://idp.payez.net` or `http://localhost:32785`) |
+| `IDP_URL` | ✅ Yes | PayEz IDP base URL (e.g., `https://idp.payez.net` or `http://localhost:32785`). **No default in code.** Call `requireIdpUrl()` from `@payez/next-mvp/lib/require-idp-url` in your `instrumentation.ts` (4.8.8) and the server refuses to start, with one fixed sentence, when it is missing or not a full http(s) address. The quickstart generator writes the production address into `.env.local` and adds that file for you. |
 | `AUTH_TRUST_HOST` | ✅ Yes | Must be `true` - NextAuth derives OAuth URLs from request headers |
 | `NEXTAUTH_SECRET` | 🔄 Broker | **Do NOT set** - fetched automatically from IDP at startup (see below) |
 | `CLIENT_SECRET` | ⚠️ Legacy | Not needed with broker mode - IDP handles signing |

package/dist/lib/require-idp-url.d.ts

@@ -0,0 +1,12 @@
+/**
+ * 4.8.8 (item 24, Jon: "fast and loud are how i like my config errors"): the app REQUIRES IDP_URL and says so at START.
+ *
+ * There is no default in code. The quickstart generator writes the production sign-in service address into the app's .env.local
+ * at generation time; rigs override that file. When the value is missing, empty or not an absolute http(s) address, the server
+ * refuses to come up - printed once, in one fixed sentence, exit code 1 - instead of booting and failing on the first sign-in.
+ *
+ * A leaf module: no imports, so a generated `instrumentation.ts` can load it without pulling the session store or the logger.
+ */
+export declare const IDP_URL_REQUIRED_SENTENCE = "IDP_URL is not set to a full http(s) address. This app has no default sign-in service: set IDP_URL in .env.local and start again.";
+/** True when IDP_URL is present and absolute. Otherwise logs the fixed sentence and calls `exit(1)`; returns false if `exit` returns. */
+export declare function requireIdpUrl(env?: Record<string, string | undefined>, exit?: (code: number) => unknown, log?: (line: string) => void): boolean;

package/dist/lib/require-idp-url.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDP_URL_REQUIRED_SENTENCE = void 0;
+exports.requireIdpUrl = requireIdpUrl;
+/**
+ * 4.8.8 (item 24, Jon: "fast and loud are how i like my config errors"): the app REQUIRES IDP_URL and says so at START.
+ *
+ * There is no default in code. The quickstart generator writes the production sign-in service address into the app's .env.local
+ * at generation time; rigs override that file. When the value is missing, empty or not an absolute http(s) address, the server
+ * refuses to come up - printed once, in one fixed sentence, exit code 1 - instead of booting and failing on the first sign-in.
+ *
+ * A leaf module: no imports, so a generated `instrumentation.ts` can load it without pulling the session store or the logger.
+ */
+exports.IDP_URL_REQUIRED_SENTENCE = 'IDP_URL is not set to a full http(s) address. This app has no default sign-in service: set IDP_URL in .env.local and start again.';
+/** True when IDP_URL is present and absolute. Otherwise logs the fixed sentence and calls `exit(1)`; returns false if `exit` returns. */
+function requireIdpUrl(env = process.env, exit = (code) => process.exit(code), log = (line) => console.error(line)) {
+    const value = (env.IDP_URL ?? '').trim();
+    if (/^https?:\/\/[^/\s]+/i.test(value))
+        return true;
+    log('');
+    log('[STARTUP FAILED - REFUSING TO SERVE]');
+    log(`  ${exports.IDP_URL_REQUIRED_SENTENCE}`);
+    log('');
+    exit(1);
+    return false;
+}

package/dist/routes/account/masked-info.d.ts

@@ -22,7 +22,7 @@ export { POST } from '../../api-handlers/account/masked-info';
  * email/phone options to the user.
  *
  * Environment variables used:
- * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
+ * - IDP_URL or NEXT_PUBLIC_IDP_URL (REQUIRED: there is no default in code)
  * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
  * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
  *

package/dist/routes/account/masked-info.js

@@ -28,7 +28,7 @@ Object.defineProperty(exports, "POST", { enumerable: true, get: function () { re
  * email/phone options to the user.
  *
  * Environment variables used:
- * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
+ * - IDP_URL or NEXT_PUBLIC_IDP_URL (REQUIRED: there is no default in code)
  * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
  * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
  *

package/dist/routes/account/send-code.d.ts

@@ -26,7 +26,7 @@ export { POST } from '../../api-handlers/account/send-code';
  * - contactId: string - ID of the masked contact to send to
  *
  * Environment variables used:
- * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
+ * - IDP_URL or NEXT_PUBLIC_IDP_URL (REQUIRED: there is no default in code)
  * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
  * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
  *

package/dist/routes/account/send-code.js

@@ -31,7 +31,7 @@ Object.defineProperty(exports, "POST", { enumerable: true, get: function () { re
  * - contactId: string - ID of the masked contact to send to
  *
  * Environment variables used:
- * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
+ * - IDP_URL or NEXT_PUBLIC_IDP_URL (REQUIRED: there is no default in code)
  * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
  * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
  *

package/dist/routes/account/verify-email.d.ts

@@ -25,7 +25,7 @@ export { POST } from '../../api-handlers/account/verify-email';
  * - emailId: string - ID of the email address used
  *
  * Environment variables used:
- * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
+ * - IDP_URL or NEXT_PUBLIC_IDP_URL (REQUIRED: there is no default in code)
  * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
  * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
  *

package/dist/routes/account/verify-email.js

@@ -30,7 +30,7 @@ Object.defineProperty(exports, "POST", { enumerable: true, get: function () { re
  * - emailId: string - ID of the email address used
  *
  * Environment variables used:
- * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
+ * - IDP_URL or NEXT_PUBLIC_IDP_URL (REQUIRED: there is no default in code)
  * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
  * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
  *

package/dist/routes/account/verify-sms.d.ts

@@ -25,7 +25,7 @@ export { POST } from '../../api-handlers/account/verify-sms';
  * - phoneId: string - ID of the phone number used
  *
  * Environment variables used:
- * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
+ * - IDP_URL or NEXT_PUBLIC_IDP_URL (REQUIRED: there is no default in code)
  * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
  * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
  *

package/dist/routes/account/verify-sms.js

@@ -30,7 +30,7 @@ Object.defineProperty(exports, "POST", { enumerable: true, get: function () { re
  * - phoneId: string - ID of the phone number used
  *
  * Environment variables used:
- * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
+ * - IDP_URL or NEXT_PUBLIC_IDP_URL (REQUIRED: there is no default in code)
  * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
  * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "4.8.7",
+  "version": "4.8.8",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -179,6 +179,11 @@
       "require": "./dist/lib/api-handler.js",
       "default": "./dist/lib/api-handler.js"
     },
+    "./lib/require-idp-url": {
+      "types": "./dist/lib/require-idp-url.d.ts",
+      "require": "./dist/lib/require-idp-url.js",
+      "default": "./dist/lib/require-idp-url.js"
+    },
     "./lib/startup-init": {
       "types": "./dist/lib/startup-init.d.ts",
       "require": "./dist/lib/startup-init.js",

package/src/lib/require-idp-url.ts

@@ -0,0 +1,27 @@
+/**
+ * 4.8.8 (item 24, Jon: "fast and loud are how i like my config errors"): the app REQUIRES IDP_URL and says so at START.
+ *
+ * There is no default in code. The quickstart generator writes the production sign-in service address into the app's .env.local
+ * at generation time; rigs override that file. When the value is missing, empty or not an absolute http(s) address, the server
+ * refuses to come up - printed once, in one fixed sentence, exit code 1 - instead of booting and failing on the first sign-in.
+ *
+ * A leaf module: no imports, so a generated `instrumentation.ts` can load it without pulling the session store or the logger.
+ */
+export const IDP_URL_REQUIRED_SENTENCE =
+  'IDP_URL is not set to a full http(s) address. This app has no default sign-in service: set IDP_URL in .env.local and start again.';
+
+/** True when IDP_URL is present and absolute. Otherwise logs the fixed sentence and calls `exit(1)`; returns false if `exit` returns. */
+export function requireIdpUrl(
+  env: Record<string, string | undefined> = process.env,
+  exit: (code: number) => unknown = (code) => process.exit(code),
+  log: (line: string) => void = (line) => console.error(line),
+): boolean {
+  const value = (env.IDP_URL ?? '').trim();
+  if (/^https?:\/\/[^/\s]+/i.test(value)) return true;
+  log('');
+  log('[STARTUP FAILED - REFUSING TO SERVE]');
+  log(`  ${IDP_URL_REQUIRED_SENTENCE}`);
+  log('');
+  exit(1);
+  return false;
+}

package/src/routes/account/masked-info.ts

@@ -26,7 +26,7 @@ export { POST } from '../../api-handlers/account/masked-info';
  * email/phone options to the user.
  *
  * Environment variables used:
- * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
+ * - IDP_URL or NEXT_PUBLIC_IDP_URL (REQUIRED: there is no default in code)
  * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
  * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
  *

package/src/routes/account/send-code.ts

@@ -29,7 +29,7 @@ export { POST } from '../../api-handlers/account/send-code';
  * - contactId: string - ID of the masked contact to send to
  *
  * Environment variables used:
- * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
+ * - IDP_URL or NEXT_PUBLIC_IDP_URL (REQUIRED: there is no default in code)
  * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
  * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
  *

package/src/routes/account/verify-email.ts

@@ -28,7 +28,7 @@ export { POST } from '../../api-handlers/account/verify-email';
  * - emailId: string - ID of the email address used
  *
  * Environment variables used:
- * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
+ * - IDP_URL or NEXT_PUBLIC_IDP_URL (REQUIRED: there is no default in code)
  * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
  * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
  *

package/src/routes/account/verify-sms.ts

@@ -28,7 +28,7 @@ export { POST } from '../../api-handlers/account/verify-sms';
  * - phoneId: string - ID of the phone number used
  *
  * Environment variables used:
- * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
+ * - IDP_URL or NEXT_PUBLIC_IDP_URL (REQUIRED: there is no default in code)
  * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
  * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
  *