hazo_auth 10.4.6 → 10.4.8

package/SETUP_CHECKLIST.md

@@ -947,10 +947,10 @@ Google OAuth Sign-In allows users to authenticate with their Google accounts. Th
 5. Configure OAuth consent screen if prompted
 6. Set **Application type** to "Web application"
 7. Add **Authorized JavaScript origins**:
-   - Development: `http://localhost:3000`
+   - Development: `http://localhost:<YOUR_PORT>`
    - Production: `https://yourdomain.com`
-8. Add **Authorized redirect URIs**:
-   - Development: `http://localhost:3000/api/auth/callback/google`
+8. Add **Authorized redirect URIs** — the path is fixed and exported as `GOOGLE_NEXTAUTH_CALLBACK_PATH` from `hazo_auth`:
+   - Development: `http://localhost:<YOUR_PORT>/api/auth/callback/google`
    - Production: `https://yourdomain.com/api/auth/callback/google`
 9. Copy the **Client ID** and **Client Secret**
 

package/cli-src/lib/auth/nextauth_config.ts

@@ -12,6 +12,7 @@ import { handle_google_oauth_login } from "../services/oauth_service.js";
 import { get_hazo_connect_instance } from "../hazo_connect_instance.server.js";
 import { create_app_logger } from "../app_logger.js";
 import { store_google_oauth_token, GoogleTokenStorageUnconfigured } from "../services/google_token_service.js";
+import { GOOGLE_OAUTH_CALLBACK_PATH, FACEBOOK_OAUTH_CALLBACK_PATH } from "../oauth_routes.js";
 
 // section: types
 export type NextAuthCallbackUser = {
@@ -102,8 +103,8 @@ export function get_nextauth_config(): AuthOptions {
         // Always redirect to our custom callback after sign-in to set hazo_auth cookies
         // The callbackUrl from signIn() comes through as `url`
         if (
-          url.includes("/api/hazo_auth/oauth/google/callback") ||
-          url.includes("/api/hazo_auth/oauth/facebook/callback")
+          url.includes(GOOGLE_OAUTH_CALLBACK_PATH) ||
+          url.includes(FACEBOOK_OAUTH_CALLBACK_PATH)
         ) {
           return url;
         }
@@ -118,9 +119,9 @@ export function get_nextauth_config(): AuthOptions {
 
         // Default: redirect to our custom OAuth callback to set cookies
         if (url.includes("facebook")) {
-          return `${baseUrl}/api/hazo_auth/oauth/facebook/callback`;
+          return `${baseUrl}${FACEBOOK_OAUTH_CALLBACK_PATH}`;
         }
-        return `${baseUrl}/api/hazo_auth/oauth/google/callback`;
+        return `${baseUrl}${GOOGLE_OAUTH_CALLBACK_PATH}`;
       },
       /**
        * Sign-in callback - handle user creation/linking for Google OAuth

package/cli-src/lib/oauth_routes.ts

@@ -0,0 +1,13 @@
+// file_description: Fixed OAuth route paths exported for consumer apps and internal use
+
+/** NextAuth's built-in OAuth redirect URI — register this in Google Cloud Console. */
+export const GOOGLE_NEXTAUTH_CALLBACK_PATH = "/api/auth/callback/google" as const;
+
+/** hazo_auth's custom post-auth handler — creates the hazo_auth session after Google sign-in. */
+export const GOOGLE_OAUTH_CALLBACK_PATH = "/api/hazo_auth/oauth/google/callback" as const;
+
+/** NextAuth's built-in OAuth redirect URI — register this in Facebook Developer Console. */
+export const FACEBOOK_NEXTAUTH_CALLBACK_PATH = "/api/auth/callback/facebook" as const;
+
+/** hazo_auth's custom post-auth handler — creates the hazo_auth session after Facebook sign-in. */
+export const FACEBOOK_OAUTH_CALLBACK_PATH = "/api/hazo_auth/oauth/facebook/callback" as const;

package/cli-src/lib/services/google_token_service.ts

@@ -90,12 +90,22 @@ export const _cryptoLoader = {
 
 async function load_crypto_module() {
   let cryptoModule: typeof import("hazo_secure/crypto") | null;
+  let importError: string | null = null;
   try {
     cryptoModule = await _cryptoLoader.load();
-  } catch {
+  } catch (err) {
+    importError = err instanceof Error ? err.message : String(err);
     cryptoModule = null;
   }
-  if (!cryptoModule) throw new GoogleTokenStorageUnconfigured();
+  if (!cryptoModule) {
+    const logger = create_app_logger();
+    logger.error("google_token_service_crypto_unavailable", {
+      filename: "google_token_service.ts",
+      reason: importError ?? "import returned null",
+      fix: "Install hazo_secure (npm install hazo_secure) and add 'hazo_secure' to serverExternalPackages in next.config.ts",
+    });
+    throw new GoogleTokenStorageUnconfigured();
+  }
   return cryptoModule;
 }
 
@@ -119,9 +129,16 @@ export async function store_google_oauth_token(
     await (keys as unknown as { current(): Promise<unknown> }).current();
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
+    const currentKeyId = process.env.HAZO_AUTH_OAUTH_KEY_CURRENT;
+    const missingVars: string[] = [];
+    if (!currentKeyId) missingVars.push("HAZO_AUTH_OAUTH_KEY_CURRENT");
+    else if (!process.env[`HAZO_AUTH_OAUTH_KEY_${currentKeyId.toUpperCase()}`])
+      missingVars.push(`HAZO_AUTH_OAUTH_KEY_${currentKeyId.toUpperCase()}`);
     logger.error("google_token_service_key_provider_failed", {
       filename: "google_token_service.ts",
       error: msg,
+      missing_env_vars: missingVars.length ? missingVars : "unknown — check HAZO_AUTH_OAUTH_KEY_CURRENT and HAZO_AUTH_OAUTH_KEY_<ID>",
+      fix: "Set HAZO_AUTH_OAUTH_KEY_CURRENT=<key-id> and HAZO_AUTH_OAUTH_KEY_<KEY-ID>=<base64-aes-key> in your environment",
     });
     throw new GoogleTokenStorageUnconfigured();
   }

package/dist/index.d.ts

@@ -6,5 +6,6 @@ export { AuthenticationRequiredError, TenantRequiredError, TenantAccessDeniedErr
 export type { LegalDoc, LegalAcceptanceRecord, LegalAcceptanceMap } from './lib/legal/legal_docs_types';
 export { cn, merge_class_names } from "./lib/utils.js";
 export { HAZO_AUTH_PERMISSIONS, ALL_ADMIN_PERMISSIONS, GLOBAL_ADMIN_PERMISSION } from "./lib/constants.js";
+export { GOOGLE_NEXTAUTH_CALLBACK_PATH, GOOGLE_OAUTH_CALLBACK_PATH, FACEBOOK_NEXTAUTH_CALLBACK_PATH, FACEBOOK_OAUTH_CALLBACK_PATH, } from "./lib/oauth_routes.js";
 export { requestGoogleScopes } from "./lib/auth/request_google_scopes.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,cAAc,+BAA+B,CAAC;AAC9C,cAAc,6BAA6B,CAAC;AAG5C,cAAc,oBAAoB,CAAC;AAGnC,YAAY,EACV,YAAY,EACZ,cAAc,EACd,aAAa,EACb,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAG/B,YAAY,EAAE,QAAQ,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAGxG,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGpD,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAGxG,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,cAAc,+BAA+B,CAAC;AAC9C,cAAc,6BAA6B,CAAC;AAG5C,cAAc,oBAAoB,CAAC;AAGnC,YAAY,EACV,YAAY,EACZ,cAAc,EACd,aAAa,EACb,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAG/B,YAAY,EAAE,QAAQ,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAGxG,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGpD,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AACxG,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAC1B,+BAA+B,EAC/B,4BAA4B,GAC7B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/index.js

@@ -14,5 +14,6 @@ export { AuthenticationRequiredError, TenantRequiredError, TenantAccessDeniedErr
 export { cn, merge_class_names } from "./lib/utils.js";
 // section: constant_exports
 export { HAZO_AUTH_PERMISSIONS, ALL_ADMIN_PERMISSIONS, GLOBAL_ADMIN_PERMISSION } from "./lib/constants.js";
+export { GOOGLE_NEXTAUTH_CALLBACK_PATH, GOOGLE_OAUTH_CALLBACK_PATH, FACEBOOK_NEXTAUTH_CALLBACK_PATH, FACEBOOK_OAUTH_CALLBACK_PATH, } from "./lib/oauth_routes.js";
 // section: google_oauth_exports
 export { requestGoogleScopes } from "./lib/auth/request_google_scopes.js";

package/dist/lib/auth/nextauth_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nextauth_config.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/nextauth_config.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAW,MAAM,WAAW,CAAC;AActD,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAGF;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,WAAW,CAwQjD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAW7C"}
+{"version":3,"file":"nextauth_config.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/nextauth_config.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAW,MAAM,WAAW,CAAC;AAetD,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAGF;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,WAAW,CAwQjD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAW7C"}

package/dist/lib/auth/nextauth_config.js

@@ -8,6 +8,7 @@ import { handle_google_oauth_login } from "../services/oauth_service.js";
 import { get_hazo_connect_instance } from "../hazo_connect_instance.server.js";
 import { create_app_logger } from "../app_logger.js";
 import { store_google_oauth_token, GoogleTokenStorageUnconfigured } from "../services/google_token_service.js";
+import { GOOGLE_OAUTH_CALLBACK_PATH, FACEBOOK_OAUTH_CALLBACK_PATH } from "../oauth_routes.js";
 // section: config
 /**
  * Gets NextAuth.js configuration with enabled OAuth providers
@@ -60,8 +61,8 @@ export function get_nextauth_config() {
                 console.log("[NextAuth redirect callback]", { url, baseUrl });
                 // Always redirect to our custom callback after sign-in to set hazo_auth cookies
                 // The callbackUrl from signIn() comes through as `url`
-                if (url.includes("/api/hazo_auth/oauth/google/callback") ||
-                    url.includes("/api/hazo_auth/oauth/facebook/callback")) {
+                if (url.includes(GOOGLE_OAUTH_CALLBACK_PATH) ||
+                    url.includes(FACEBOOK_OAUTH_CALLBACK_PATH)) {
                     return url;
                 }
                 // If URL is relative or same origin, allow it
@@ -73,9 +74,9 @@ export function get_nextauth_config() {
                 }
                 // Default: redirect to our custom OAuth callback to set cookies
                 if (url.includes("facebook")) {
-                    return `${baseUrl}/api/hazo_auth/oauth/facebook/callback`;
+                    return `${baseUrl}${FACEBOOK_OAUTH_CALLBACK_PATH}`;
                 }
-                return `${baseUrl}/api/hazo_auth/oauth/google/callback`;
+                return `${baseUrl}${GOOGLE_OAUTH_CALLBACK_PATH}`;
             },
             /**
              * Sign-in callback - handle user creation/linking for Google OAuth

package/dist/lib/oauth_routes.d.ts

@@ -0,0 +1,9 @@
+/** NextAuth's built-in OAuth redirect URI — register this in Google Cloud Console. */
+export declare const GOOGLE_NEXTAUTH_CALLBACK_PATH: "/api/auth/callback/google";
+/** hazo_auth's custom post-auth handler — creates the hazo_auth session after Google sign-in. */
+export declare const GOOGLE_OAUTH_CALLBACK_PATH: "/api/hazo_auth/oauth/google/callback";
+/** NextAuth's built-in OAuth redirect URI — register this in Facebook Developer Console. */
+export declare const FACEBOOK_NEXTAUTH_CALLBACK_PATH: "/api/auth/callback/facebook";
+/** hazo_auth's custom post-auth handler — creates the hazo_auth session after Facebook sign-in. */
+export declare const FACEBOOK_OAUTH_CALLBACK_PATH: "/api/hazo_auth/oauth/facebook/callback";
+//# sourceMappingURL=oauth_routes.d.ts.map

package/dist/lib/oauth_routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth_routes.d.ts","sourceRoot":"","sources":["../../src/lib/oauth_routes.ts"],"names":[],"mappings":"AAEA,sFAAsF;AACtF,eAAO,MAAM,6BAA6B,EAAG,2BAAoC,CAAC;AAElF,iGAAiG;AACjG,eAAO,MAAM,0BAA0B,EAAG,sCAA+C,CAAC;AAE1F,4FAA4F;AAC5F,eAAO,MAAM,+BAA+B,EAAG,6BAAsC,CAAC;AAEtF,mGAAmG;AACnG,eAAO,MAAM,4BAA4B,EAAG,wCAAiD,CAAC"}

package/dist/lib/oauth_routes.js

@@ -0,0 +1,9 @@
+// file_description: Fixed OAuth route paths exported for consumer apps and internal use
+/** NextAuth's built-in OAuth redirect URI — register this in Google Cloud Console. */
+export const GOOGLE_NEXTAUTH_CALLBACK_PATH = "/api/auth/callback/google";
+/** hazo_auth's custom post-auth handler — creates the hazo_auth session after Google sign-in. */
+export const GOOGLE_OAUTH_CALLBACK_PATH = "/api/hazo_auth/oauth/google/callback";
+/** NextAuth's built-in OAuth redirect URI — register this in Facebook Developer Console. */
+export const FACEBOOK_NEXTAUTH_CALLBACK_PATH = "/api/auth/callback/facebook";
+/** hazo_auth's custom post-auth handler — creates the hazo_auth session after Facebook sign-in. */
+export const FACEBOOK_OAUTH_CALLBACK_PATH = "/api/hazo_auth/oauth/facebook/callback";

package/dist/lib/services/google_token_service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"google_token_service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/google_token_service.ts"],"names":[],"mappings":"AASA,qBAAa,8BAA+B,SAAQ,KAAK;;CAOxD;AAID,MAAM,MAAM,2BAA2B,GAAG;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,eAAe,GAAG,oBAAoB,GAAG,gBAAgB,GAAG,cAAc,CAAA;CAAE,CAAC;AAErG,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAmCF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa;gBACd,OAAO,CAAC,cAAc,oBAAoB,CAAC,CAAC;CACvD,CAAC;AAeF;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,2BAA2B,GAClC,OAAO,CAAC,IAAI,CAAC,CA0Ef;AAID;;;GAGG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAC3B,OAAO,CAAC,iBAAiB,CAAC,CA6I5B;AAID;;GAEG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA6D1C;AAID;;;GAGG;AACH,wBAAsB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAexF"}
+{"version":3,"file":"google_token_service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/google_token_service.ts"],"names":[],"mappings":"AASA,qBAAa,8BAA+B,SAAQ,KAAK;;CAOxD;AAID,MAAM,MAAM,2BAA2B,GAAG;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,eAAe,GAAG,oBAAoB,GAAG,gBAAgB,GAAG,cAAc,CAAA;CAAE,CAAC;AAErG,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAmCF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa;gBACd,OAAO,CAAC,cAAc,oBAAoB,CAAC,CAAC;CACvD,CAAC;AAyBF;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,2BAA2B,GAClC,OAAO,CAAC,IAAI,CAAC,CAiFf;AAID;;;GAGG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAC3B,OAAO,CAAC,iBAAiB,CAAC,CA6I5B;AAID;;GAEG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA6D1C;AAID;;;GAGG;AACH,wBAAsB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAexF"}

package/dist/lib/services/google_token_service.js

@@ -45,14 +45,23 @@ export const _cryptoLoader = {
 };
 async function load_crypto_module() {
     let cryptoModule;
+    let importError = null;
     try {
         cryptoModule = await _cryptoLoader.load();
     }
-    catch (_a) {
+    catch (err) {
+        importError = err instanceof Error ? err.message : String(err);
         cryptoModule = null;
     }
-    if (!cryptoModule)
+    if (!cryptoModule) {
+        const logger = create_app_logger();
+        logger.error("google_token_service_crypto_unavailable", {
+            filename: "google_token_service.ts",
+            reason: importError !== null && importError !== void 0 ? importError : "import returned null",
+            fix: "Install hazo_secure (npm install hazo_secure) and add 'hazo_secure' to serverExternalPackages in next.config.ts",
+        });
         throw new GoogleTokenStorageUnconfigured();
+    }
     return cryptoModule;
 }
 // section: store
@@ -71,9 +80,17 @@ export async function store_google_oauth_token(params) {
     }
     catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
+        const currentKeyId = process.env.HAZO_AUTH_OAUTH_KEY_CURRENT;
+        const missingVars = [];
+        if (!currentKeyId)
+            missingVars.push("HAZO_AUTH_OAUTH_KEY_CURRENT");
+        else if (!process.env[`HAZO_AUTH_OAUTH_KEY_${currentKeyId.toUpperCase()}`])
+            missingVars.push(`HAZO_AUTH_OAUTH_KEY_${currentKeyId.toUpperCase()}`);
         logger.error("google_token_service_key_provider_failed", {
             filename: "google_token_service.ts",
             error: msg,
+            missing_env_vars: missingVars.length ? missingVars : "unknown — check HAZO_AUTH_OAUTH_KEY_CURRENT and HAZO_AUTH_OAUTH_KEY_<ID>",
+            fix: "Set HAZO_AUTH_OAUTH_KEY_CURRENT=<key-id> and HAZO_AUTH_OAUTH_KEY_<KEY-ID>=<base64-aes-key> in your environment",
         });
         throw new GoogleTokenStorageUnconfigured();
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hazo_auth",
-  "version": "10.4.6",
+  "version": "10.4.8",
   "description": "Zero-config authentication UI components for Next.js with RBAC, OAuth, scope-based multi-tenancy, and invitations",
   "keywords": [
     "authentication",