@payez/next-mvp 4.8.7 → 4.8.9

package/README.md

@@ -548,7 +548,7 @@ import { POST as logout } from '@payez/next-mvp/routes/auth/logout';
 | Variable | Required | Description |
 |----------|----------|-------------|
 | `CLIENT_ID` | ✅ Yes | Your PayEz IDP client ID (string slug, e.g., `payez_idp_admin_web`) |
-| `IDP_URL` | ✅ Yes | PayEz IDP base URL (e.g., `https://idp.payez.net` or `http://localhost:32785`) |
+| `IDP_URL` | ✅ Yes | PayEz IDP base URL (e.g., `https://idp.payez.net` or `http://localhost:32785`). **No default in code.** Call `requireIdpUrl()` from `@payez/next-mvp/lib/require-idp-url` in your `instrumentation.ts` (4.8.8) and the server refuses to start, with one fixed sentence, when it is missing or not a full http(s) address. The quickstart generator writes the production address into `.env.local` and adds that file for you. |
 | `AUTH_TRUST_HOST` | ✅ Yes | Must be `true` - NextAuth derives OAuth URLs from request headers |
 | `NEXTAUTH_SECRET` | 🔄 Broker | **Do NOT set** - fetched automatically from IDP at startup (see below) |
 | `CLIENT_SECRET` | ⚠️ Legacy | Not needed with broker mode - IDP handles signing |

package/dist/lib/require-idp-url.d.ts

@@ -0,0 +1,12 @@
+/**
+ * 4.8.8 (item 24, Jon: "fast and loud are how i like my config errors"): the app REQUIRES IDP_URL and says so at START.
+ *
+ * There is no default in code. The quickstart generator writes the production sign-in service address into the app's .env.local
+ * at generation time; rigs override that file. When the value is missing, empty or not an absolute http(s) address, the server
+ * refuses to come up - printed once, in one fixed sentence, exit code 1 - instead of booting and failing on the first sign-in.
+ *
+ * A leaf module: no imports, so a generated `instrumentation.ts` can load it without pulling the session store or the logger.
+ */
+export declare const IDP_URL_REQUIRED_SENTENCE = "IDP_URL is not set to a full http(s) address. This app has no default sign-in service: set IDP_URL in .env.local and start again.";
+/** True when IDP_URL is present and absolute. Otherwise logs the fixed sentence and calls `exit(1)`; returns false if `exit` returns. */
+export declare function requireIdpUrl(env?: Record<string, string | undefined>, exit?: (code: number) => unknown, log?: (line: string) => void): boolean;

package/dist/lib/require-idp-url.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDP_URL_REQUIRED_SENTENCE = void 0;
+exports.requireIdpUrl = requireIdpUrl;
+/**
+ * 4.8.8 (item 24, Jon: "fast and loud are how i like my config errors"): the app REQUIRES IDP_URL and says so at START.
+ *
+ * There is no default in code. The quickstart generator writes the production sign-in service address into the app's .env.local
+ * at generation time; rigs override that file. When the value is missing, empty or not an absolute http(s) address, the server
+ * refuses to come up - printed once, in one fixed sentence, exit code 1 - instead of booting and failing on the first sign-in.
+ *
+ * A leaf module: no imports, so a generated `instrumentation.ts` can load it without pulling the session store or the logger.
+ */
+exports.IDP_URL_REQUIRED_SENTENCE = 'IDP_URL is not set to a full http(s) address. This app has no default sign-in service: set IDP_URL in .env.local and start again.';
+/** True when IDP_URL is present and absolute. Otherwise logs the fixed sentence and calls `exit(1)`; returns false if `exit` returns. */
+function requireIdpUrl(env = process.env, exit = (code) => process.exit(code), log = (line) => console.error(line)) {
+    const value = (env.IDP_URL ?? '').trim();
+    if (/^https?:\/\/[^/\s]+/i.test(value))
+        return true;
+    log('');
+    log('[STARTUP FAILED - REFUSING TO SERVE]');
+    log(`  ${exports.IDP_URL_REQUIRED_SENTENCE}`);
+    log('');
+    exit(1);
+    return false;
+}

package/dist/routes/account/masked-info.d.ts

@@ -22,7 +22,7 @@ export { POST } from '../../api-handlers/account/masked-info';
  * email/phone options to the user.
  *
  * Environment variables used:
- * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
+ * - IDP_URL or NEXT_PUBLIC_IDP_URL (REQUIRED: there is no default in code)
  * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
  * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
  *

package/dist/routes/account/masked-info.js

@@ -28,7 +28,7 @@ Object.defineProperty(exports, "POST", { enumerable: true, get: function () { re
  * email/phone options to the user.
  *
  * Environment variables used:
- * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
+ * - IDP_URL or NEXT_PUBLIC_IDP_URL (REQUIRED: there is no default in code)
  * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
  * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
  *

package/dist/routes/account/send-code.d.ts

@@ -26,7 +26,7 @@ export { POST } from '../../api-handlers/account/send-code';
  * - contactId: string - ID of the masked contact to send to
  *
  * Environment variables used:
- * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
+ * - IDP_URL or NEXT_PUBLIC_IDP_URL (REQUIRED: there is no default in code)
  * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
  * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
  *

package/dist/routes/account/send-code.js

@@ -31,7 +31,7 @@ Object.defineProperty(exports, "POST", { enumerable: true, get: function () { re
  * - contactId: string - ID of the masked contact to send to
  *
  * Environment variables used:
- * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
+ * - IDP_URL or NEXT_PUBLIC_IDP_URL (REQUIRED: there is no default in code)
  * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
  * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
  *

package/dist/routes/account/verify-email.d.ts

@@ -25,7 +25,7 @@ export { POST } from '../../api-handlers/account/verify-email';
  * - emailId: string - ID of the email address used
  *
  * Environment variables used:
- * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
+ * - IDP_URL or NEXT_PUBLIC_IDP_URL (REQUIRED: there is no default in code)
  * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
  * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
  *

package/dist/routes/account/verify-email.js

@@ -30,7 +30,7 @@ Object.defineProperty(exports, "POST", { enumerable: true, get: function () { re
  * - emailId: string - ID of the email address used
  *
  * Environment variables used:
- * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
+ * - IDP_URL or NEXT_PUBLIC_IDP_URL (REQUIRED: there is no default in code)
  * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
  * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
  *

package/dist/routes/account/verify-sms.d.ts

@@ -25,7 +25,7 @@ export { POST } from '../../api-handlers/account/verify-sms';
  * - phoneId: string - ID of the phone number used
  *
  * Environment variables used:
- * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
+ * - IDP_URL or NEXT_PUBLIC_IDP_URL (REQUIRED: there is no default in code)
  * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
  * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
  *

package/dist/routes/account/verify-sms.js

@@ -30,7 +30,7 @@ Object.defineProperty(exports, "POST", { enumerable: true, get: function () { re
  * - phoneId: string - ID of the phone number used
  *
  * Environment variables used:
- * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
+ * - IDP_URL or NEXT_PUBLIC_IDP_URL (REQUIRED: there is no default in code)
  * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
  * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
  *

package/dist/routes/auth/logout.d.ts

@@ -14,6 +14,9 @@
  * @since auth-ready-v2
  */
 import { NextRequest, NextResponse } from 'next/server';
+/** 4.8.9: answered (status 500) when the server-side session delete failed. The browser's cookies are cleared either way. */
+export declare const SESSION_NOT_ENDED_CODE = "SESSION_NOT_ENDED";
+export declare const SESSION_NOT_ENDED_MESSAGE = "You were signed out on this device, but we could not end your session on the server. Try signing out again.";
 /**
  * POST /api/auth/logout - Sign out and clean up session
  *

package/dist/routes/auth/logout.js

@@ -15,6 +15,7 @@
  * @since auth-ready-v2
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.SESSION_NOT_ENDED_MESSAGE = exports.SESSION_NOT_ENDED_CODE = void 0;
 exports.POST = POST;
 const server_1 = require("next/server");
 const auth_1 = require("../../server/auth");
@@ -22,6 +23,9 @@ const session_store_1 = require("../../lib/session-store");
 const app_slug_1 = require("../../lib/app-slug");
 const site_logger_1 = require("../../lib/site-logger");
 const safe_error_response_1 = require("../../lib/safe-error-response");
+/** 4.8.9: answered (status 500) when the server-side session delete failed. The browser's cookies are cleared either way. */
+exports.SESSION_NOT_ENDED_CODE = 'SESSION_NOT_ENDED';
+exports.SESSION_NOT_ENDED_MESSAGE = 'You were signed out on this device, but we could not end your session on the server. Try signing out again.';
 /**
  * POST /api/auth/logout - Sign out and clean up session
  *
@@ -41,6 +45,9 @@ async function POST(req) {
             });
         }
         const sessionId = session.session?.token;
+        // 4.8.9: a sign-out that did not end the session must not say it did. The delete below can fail (a faulting store); the
+        // cookies are still cleared, but the answer is then a typed failure instead of success:true.
+        let serverDeleteFailed = false;
         // Delete session from EVERY store — canonical + BA secondary (181922).
         // Canonical-only deletion let the ba: record resurrect the session.
         if (sessionId) {
@@ -49,7 +56,8 @@ async function POST(req) {
                 console.info('[LOGOUT_ROUTE] Session deleted from store');
             }
             catch (error) {
-                console.warn('[LOGOUT_ROUTE] Failed to delete session:', error);
+                serverDeleteFailed = true;
+                console.error('[LOGOUT_ROUTE] Failed to delete session - the server session is STILL LIVE:', error);
             }
         }
         // Log logout event (fire-and-forget)
@@ -65,10 +73,12 @@ async function POST(req) {
             });
         }
         // Build response that clears session cookies
-        const response = server_1.NextResponse.json({
-            success: true,
-            message: 'Logged out successfully'
-        });
+        const response = serverDeleteFailed
+            ? server_1.NextResponse.json({ success: false, code: exports.SESSION_NOT_ENDED_CODE, message: exports.SESSION_NOT_ENDED_MESSAGE }, { status: 500 })
+            : server_1.NextResponse.json({
+                success: true,
+                message: 'Logged out successfully'
+            });
         // Clear NextAuth session cookies (using app-slug prefixed names)
         const cookieNames = [
             (0, app_slug_1.getSessionCookieName)(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "4.8.7",
+  "version": "4.8.9",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -179,6 +179,11 @@
       "require": "./dist/lib/api-handler.js",
       "default": "./dist/lib/api-handler.js"
     },
+    "./lib/require-idp-url": {
+      "types": "./dist/lib/require-idp-url.d.ts",
+      "require": "./dist/lib/require-idp-url.js",
+      "default": "./dist/lib/require-idp-url.js"
+    },
     "./lib/startup-init": {
       "types": "./dist/lib/startup-init.d.ts",
       "require": "./dist/lib/startup-init.js",

package/src/lib/require-idp-url.ts

@@ -0,0 +1,27 @@
+/**
+ * 4.8.8 (item 24, Jon: "fast and loud are how i like my config errors"): the app REQUIRES IDP_URL and says so at START.
+ *
+ * There is no default in code. The quickstart generator writes the production sign-in service address into the app's .env.local
+ * at generation time; rigs override that file. When the value is missing, empty or not an absolute http(s) address, the server
+ * refuses to come up - printed once, in one fixed sentence, exit code 1 - instead of booting and failing on the first sign-in.
+ *
+ * A leaf module: no imports, so a generated `instrumentation.ts` can load it without pulling the session store or the logger.
+ */
+export const IDP_URL_REQUIRED_SENTENCE =
+  'IDP_URL is not set to a full http(s) address. This app has no default sign-in service: set IDP_URL in .env.local and start again.';
+
+/** True when IDP_URL is present and absolute. Otherwise logs the fixed sentence and calls `exit(1)`; returns false if `exit` returns. */
+export function requireIdpUrl(
+  env: Record<string, string | undefined> = process.env,
+  exit: (code: number) => unknown = (code) => process.exit(code),
+  log: (line: string) => void = (line) => console.error(line),
+): boolean {
+  const value = (env.IDP_URL ?? '').trim();
+  if (/^https?:\/\/[^/\s]+/i.test(value)) return true;
+  log('');
+  log('[STARTUP FAILED - REFUSING TO SERVE]');
+  log(`  ${IDP_URL_REQUIRED_SENTENCE}`);
+  log('');
+  exit(1);
+  return false;
+}

package/src/routes/account/masked-info.ts

@@ -26,7 +26,7 @@ export { POST } from '../../api-handlers/account/masked-info';
  * email/phone options to the user.
  *
  * Environment variables used:
- * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
+ * - IDP_URL or NEXT_PUBLIC_IDP_URL (REQUIRED: there is no default in code)
  * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
  * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
  *

package/src/routes/account/send-code.ts

@@ -29,7 +29,7 @@ export { POST } from '../../api-handlers/account/send-code';
  * - contactId: string - ID of the masked contact to send to
  *
  * Environment variables used:
- * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
+ * - IDP_URL or NEXT_PUBLIC_IDP_URL (REQUIRED: there is no default in code)
  * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
  * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
  *

package/src/routes/account/verify-email.ts

@@ -28,7 +28,7 @@ export { POST } from '../../api-handlers/account/verify-email';
  * - emailId: string - ID of the email address used
  *
  * Environment variables used:
- * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
+ * - IDP_URL or NEXT_PUBLIC_IDP_URL (REQUIRED: there is no default in code)
  * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
  * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
  *

package/src/routes/account/verify-sms.ts

@@ -28,7 +28,7 @@ export { POST } from '../../api-handlers/account/verify-sms';
  * - phoneId: string - ID of the phone number used
  *
  * Environment variables used:
- * - IDP_URL or NEXT_PUBLIC_IDP_URL (default: http://localhost:32785)
+ * - IDP_URL or NEXT_PUBLIC_IDP_URL (REQUIRED: there is no default in code)
  * - CLIENT_ID or NEXT_PUBLIC_IDP_CLIENT_ID (required)
  * - BETTER_AUTH_SECRET (required — fetched from IDP at startup)
  *

package/src/routes/auth/logout.ts

@@ -27,6 +27,10 @@ import {
 import { siteEvents, getClientIp } from '../../lib/site-logger';
 import { logExceptionWithCorrelation } from '../../lib/safe-error-response';
 
+/** 4.8.9: answered (status 500) when the server-side session delete failed. The browser's cookies are cleared either way. */
+export const SESSION_NOT_ENDED_CODE = 'SESSION_NOT_ENDED';
+export const SESSION_NOT_ENDED_MESSAGE = 'You were signed out on this device, but we could not end your session on the server. Try signing out again.';
+
 /**
  * POST /api/auth/logout - Sign out and clean up session
  *
@@ -48,6 +52,9 @@ export async function POST(req: NextRequest) {
     }
 
     const sessionId = session.session?.token;
+    // 4.8.9: a sign-out that did not end the session must not say it did. The delete below can fail (a faulting store); the
+    // cookies are still cleared, but the answer is then a typed failure instead of success:true.
+    let serverDeleteFailed = false;
 
     // Delete session from EVERY store — canonical + BA secondary (181922).
     // Canonical-only deletion let the ba: record resurrect the session.
@@ -56,7 +63,8 @@ export async function POST(req: NextRequest) {
         await deleteSessionEverywhere(sessionId);
         console.info('[LOGOUT_ROUTE] Session deleted from store');
       } catch (error) {
-        console.warn('[LOGOUT_ROUTE] Failed to delete session:', error);
+        serverDeleteFailed = true;
+        console.error('[LOGOUT_ROUTE] Failed to delete session - the server session is STILL LIVE:', error);
       }
     }
 
@@ -74,10 +82,12 @@ export async function POST(req: NextRequest) {
     }
 
     // Build response that clears session cookies
-    const response = NextResponse.json({
-      success: true,
-      message: 'Logged out successfully'
-    });
+    const response = serverDeleteFailed
+      ? NextResponse.json({ success: false, code: SESSION_NOT_ENDED_CODE, message: SESSION_NOT_ENDED_MESSAGE }, { status: 500 })
+      : NextResponse.json({
+          success: true,
+          message: 'Logged out successfully'
+        });
 
     // Clear NextAuth session cookies (using app-slug prefixed names)
     const cookieNames = [