@oneaddress/setup 1.3.3 → 1.4.0

package/dist/index.js

@@ -856,7 +856,7 @@ var _R = ["\u2588\u2588\u2588\u2588\u2588\u2588 ", "\u2588\u2588   \u2588\u2588"
 var _S = [" \u2588\u2588\u2588\u2588\u2588\u2588", "\u2588\u2588     ", "\u2588\u2588     ", " \u2588\u2588\u2588\u2588\u2588 ", "     \u2588\u2588", "     \u2588\u2588", "\u2588\u2588\u2588\u2588\u2588\u2588 "];
 var ONE_ROWS = Array.from({ length: 7 }, (_3, i) => [_O[i], _N[i], _E[i]].join(" "));
 var ADDR_ROWS = Array.from({ length: 7 }, (_3, i) => [_A[i], _D2[i], _D2[i], _R[i], _E[i], _S[i], _S[i]].join(" "));
-var WIZARD_VERSION = true ? "1.3.3" : "?";
+var WIZARD_VERSION = true ? "1.4.0" : "?";
 function printCompactHeader() {
   const INNER = 42;
   const TOP = fn("\u250C") + dm("\u2500".repeat(INNER)) + fn("\u2510");
@@ -1204,6 +1204,7 @@ if (nodeMajor < 22 || (nodeMajor === 22 && nodeMinor < 5)) {
 
 import 'dotenv/config';
 import express, { Request, Response } from 'express';
+import { createPrivateKey } from 'node:crypto';
 import {
   verifySignature,
   decryptAddress,
@@ -1229,10 +1230,39 @@ if (!WEBHOOK_SECRET || !PARTNER_PRIVATE_KEY || !PARTNER_ID) {
   process.exit(1);
 }
 
-// In-memory dedup cache \u2014 bounded so a partner running with the default
-// scaffold can't be DoS'd by an attacker who's already past HMAC verify
-// (i.e. has stolen the webhook secret) by sending unique dispatch IDs
-// until RAM is exhausted. For production use a distributed store (Redis).
+// Startup self-check. Two faults were historically INVISIBLE until a live
+// dispatch, and both read afterwards as "partner key mismatch" deep inside a
+// try/catch, which is a day of reading webhook logs. Assert them here so the
+// receiver refuses to start and names the fix instead.
+//   1. An @oneaddress/partner-sdk too old to export decryptSession. A missing
+//      CJS export is undefined, not a load error, so tsx never complains and it
+//      fails only when the first payload arrives.
+//   2. A private key that does not parse (empty, truncated, or header stripped).
+if (typeof decryptSession !== 'function') {
+  console.error('[startup] @oneaddress/partner-sdk does not export decryptSession. Your installed SDK is too old for D5 dispatches.');
+  console.error('[startup] Fix: npm install "@oneaddress/partner-sdk@^1.8.0", then restart.');
+  process.exit(1);
+}
+// Only PEM keys are parseable this way; a post-quantum key is a base64 secret,
+// so skip the check unless the value looks like a PEM.
+if (PARTNER_PRIVATE_KEY.includes('BEGIN')) {
+  try {
+    createPrivateKey(PARTNER_PRIVATE_KEY);
+  } catch {
+    console.error('[startup] PARTNER_PRIVATE_KEY_PEM does not parse as a private key.');
+    console.error('[startup] Paste the FULL PEM, including the -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY----- lines.');
+    process.exit(1);
+  }
+}
+
+// In-memory dedup cache. Records a dispatch id only once it has been fully
+// HANDLED, so a dispatch that failed to decrypt is NOT remembered and a later
+// retry re-runs it rather than being dismissed as a duplicate. Bounded so a
+// partner running with the default scaffold can't be DoS'd by an attacker
+// who's already past HMAC verify (i.e. has stolen the webhook secret) by
+// sending unique dispatch IDs until RAM is exhausted. For production use a
+// distributed store (Redis), and prefer the completion-claim model the other
+// language scaffolds use.
 const SEEN_DISPATCHES_MAX = 10_000;
 const seenDispatches = new Set<string>();
 function rememberDispatch(id: string): void {
@@ -1296,7 +1326,12 @@ app.post('/webhook', async (req: Request, res: Response) => {
   if (dispatch && seenDispatches.has(dispatch)) {
     return res.status(200).json({ ok: true, duplicate: true });
   }
-  if (dispatch) rememberDispatch(dispatch);
+  // A dispatch is remembered ONLY after it has been fully handled (see the
+  // success returns below), never here. Remembering before the work would mark
+  // a dispatch that then FAILS to decrypt (422 below) as "seen", so OneAddress's
+  // retry after you fix the key would be dismissed as a duplicate and the update
+  // lost. The connection-verification probe (address.test) is never remembered
+  // at all, so re-running go-live always re-tests instead of short-circuiting.
 
   const event = body.event as string;
 
@@ -1387,6 +1422,7 @@ app.post('/webhook', async (req: Request, res: Response) => {
   if (event === 'address.updated') {
     console.log(\`[webhook] address.updated for \${ctx.accountNumber || ctx.name}\`);
     await saveAddress(ctx, address);
+    if (dispatch) rememberDispatch(dispatch); // remember only after it is stored
     return res.status(200).json({ ok: true });
   }
 
@@ -1423,6 +1459,7 @@ app.post('/webhook', async (req: Request, res: Response) => {
         token:       callbackToken,
       }),
     });
+    if (dispatch) rememberDispatch(dispatch); // remember only after the callback posted
     return res.status(200).json({ ok: true });
   }
 
@@ -1435,7 +1472,17 @@ app.post('/webhook', async (req: Request, res: Response) => {
   // as "answered but could not decrypt", which is not what happened.
   if (event === 'address.test' || event === 'address.test-dispatch') {
     const index = typeof body.index === 'number' ? body.index : undefined;
+    // Print the decrypted record as a verification line for the connection-
+    // verification flow. The portal's verify page asks you to copy these lines
+    // (shaped "N | name | address") out of this console and paste them at the
+    // verify URL in your instruction email; decorative lines around them are
+    // ignored, so pasting the whole block is fine. Returning { verification:true }
+    // is what the go-live and receiver-verification decrypt proofs look for.
+    const a = address as { street?: unknown; suburb?: unknown; state?: unknown; postcode?: unknown };
+    const oneLine = [a.street, [a.suburb, a.state, a.postcode].filter(Boolean).join(' ')]
+      .filter(Boolean).join(', ');
     console.log(\`[webhook] \${event} verification probe decrypted OK\`);
+    console.log(\`[verification] \${index ?? '?'} | \${ctx.name} | \${oneLine}\`);
     return res.status(200).json({ verification: true, index });
   }
 
@@ -1905,10 +1952,15 @@ async def webhook(request: Request) -> Response:
     session_share    = body.get("session_key_share")
     legacy_enc       = body.get("address_encrypted")
 
+    # Decrypted display name, captured for the connection-verification probe
+    # below. Identity comes ONLY from decryption, never a cleartext wire field.
+    verified_name = ""
+
     if isinstance(session_envelope, str) and isinstance(session_share, dict):
         try:
             data = _decrypt_session(session_share, session_envelope, PRIVATE_KEY, PARTNER_ID)
             address = data.get("new_address", {})
+            verified_name = data.get("verified_name", "") or ""
         except Exception as e:
             print(f"[webhook] D5 decryption failed \u2014 check OA_PRIVATE_KEY_PEM matches key_id "
                   f"{session_share.get('key_id', '?')}: {e}")
@@ -1917,6 +1969,7 @@ async def webhook(request: Request) -> Response:
     elif isinstance(legacy_enc, dict):
         try:
             address = _decrypt_address(legacy_enc, PRIVATE_KEY, PARTNER_ID)
+            verified_name = address.get("fullName", "") or ""
         except Exception as e:
             print(f"[webhook] Decryption error (check OA_PRIVATE_KEY_PEM): {e}")
             return Response(content='{"ok":false,"error":"decryption failed - partner key mismatch"}',
@@ -1977,8 +2030,18 @@ async def webhook(request: Request) -> Response:
         # OneAddress connection-verification probe. Reaching here means the D5
         # decrypt above succeeded (a wrong key returned 422), which is exactly
         # what the check proves, so answer verification=true. Anything else reads
-        # as "answered but could not decrypt", which is not what happened.
+        # as "answered but could not decrypt", which is not what happened. We also
+        # print the decrypted record as a "N | name | address" line: the portal's
+        # verify page asks you to copy these lines from this console and paste
+        # them at the verify URL in your instruction email. Decorative lines are
+        # ignored, so pasting the whole block is fine.
+        idx = body.get("index")
+        _locality = " ".join(str(x) for x in [address.get("suburb", ""),
+                                              address.get("state", ""),
+                                              address.get("postcode", "")] if x)
+        one_line = ", ".join(str(p) for p in [address.get("street", ""), _locality] if p)
         print(f"[webhook] {event} verification probe decrypted OK")
+        print(f"[verification] {idx if idx is not None else '?'} | {verified_name} | {one_line}")
         return Response(content=json.dumps({"verification": True, "index": body.get("index")}),
                         media_type="application/json")
 
@@ -2542,10 +2605,22 @@ public class OneAddressWebhookController {
             } else if ("address.test".equals(event) || "address.test-dispatch".equals(event)) {
                 // OneAddress connection-verification probe. Reaching here means the
                 // D5 decrypt above succeeded (a wrong key returned 422), which is
-                // what the check proves, so answer verification=true.
+                // what the check proves, so answer verification=true. We also print
+                // the decrypted record as a "N | name | address" line: the portal's
+                // verify page asks you to copy these lines from this console and
+                // paste them at the verify URL in your instruction email.
                 if (dispatchId != null && !dispatchId.isBlank()) store.markProcessed(dispatchId, "verification:ok");
                 Object idx = body.get("index");
+                java.util.function.Function<String, String> fld = k -> {
+                    Object v = address.get(k);
+                    return v == null ? "" : String.valueOf(v);
+                };
+                String oaLoc = java.util.stream.Stream.of(fld.apply("suburb"), fld.apply("state"), fld.apply("postcode"))
+                    .filter(s -> !s.isBlank()).collect(java.util.stream.Collectors.joining(" "));
+                String oaLine = java.util.stream.Stream.of(fld.apply("street"), oaLoc)
+                    .filter(s -> !s.isBlank()).collect(java.util.stream.Collectors.joining(", "));
                 log.info("[OneAddress] {} verification probe decrypted OK", event);
+                log.info("[verification] {} | {} | {}", idx == null ? "?" : idx, verifiedName, oaLine);
                 return ResponseEntity.ok("{\\"verification\\":true,\\"index\\":" + (idx == null ? "null" : idx.toString()) + "}");
             } else {
                 log.info("[OneAddress] skipping unknown event: {}", event);
@@ -3404,10 +3479,20 @@ app.MapPost("/webhooks/oneaddress", async (HttpRequest request) =>
     {
         // OneAddress connection-verification probe. Reaching here means the D5
         // decrypt above succeeded (a wrong key returned 422), which is what the
-        // check proves, so answer verification=true.
+        // check proves, so answer verification=true. We also print the decrypted
+        // record as a "N | name | address" line: the portal's verify page asks
+        // you to copy these lines from this console and paste them at the verify
+        // URL in your instruction email.
         int? index = body.TryGetProperty("index", out var idxEl) && idxEl.ValueKind == JsonValueKind.Number
             ? idxEl.GetInt32() : (int?)null;
+        static string OaStr(JsonElement a, string k) =>
+            a.TryGetProperty(k, out var el) && el.ValueKind == JsonValueKind.String ? (el.GetString() ?? "") : "";
+        var oaLoc  = string.Join(" ", new[] { OaStr(address, "suburb"), OaStr(address, "state"), OaStr(address, "postcode") }
+            .Where(s => !string.IsNullOrWhiteSpace(s)));
+        var oaLine = string.Join(", ", new[] { OaStr(address, "street"), oaLoc }
+            .Where(s => !string.IsNullOrWhiteSpace(s)));
         app.Logger.LogInformation("[OneAddress] {EventType} verification probe decrypted OK", eventType);
+        app.Logger.LogInformation("[verification] {Line}", (index?.ToString() ?? "?") + " | " + verifiedName + " | " + oaLine);
         return Results.Json(new { verification = true, index });
     }
 
@@ -4252,6 +4337,9 @@ func main() {
 			// OneAddress connection-verification probe. Reaching this case means the
 			// decrypt above succeeded (a wrong key returned 422), which is what the
 			// check proves, so answer verification=true rather than the ok:true below.
+			// We also print the decrypted record as a "N | name | address" line: the
+			// portal's verify page asks you to copy these lines from this console and
+			// paste them at the verify URL in your instruction email.
 			log.Printf("[webhook] %s verification probe decrypted OK", event)
 			if dispatch != "" {
 				_ = store.MarkProcessed(dispatch, "verification:ok")
@@ -4260,6 +4348,23 @@ func main() {
 			if v, ok := parsed["index"]; ok {
 				idx = v
 			}
+			var locParts []string
+			for _, s := range []string{str(address, "suburb"), str(address, "state"), str(address, "postcode")} {
+				if s != "" {
+					locParts = append(locParts, s)
+				}
+			}
+			var lineParts []string
+			for _, s := range []string{str(address, "street"), strings.Join(locParts, " ")} {
+				if s != "" {
+					lineParts = append(lineParts, s)
+				}
+			}
+			idxStr := "?"
+			if idx != nil {
+				idxStr = fmt.Sprintf("%v", idx)
+			}
+			log.Printf("[verification] %s | %s | %s", idxStr, verifiedName, strings.Join(lineParts, ", "))
 			jsonResp(w, 200, map[string]any{"verification": true, "index": idx})
 			return
 
@@ -5105,8 +5210,16 @@ Route::post('/webhook', function (Request $request): Response {
     if ($eventType === 'address.test' || $eventType === 'address.test-dispatch') {
         // OneAddress connection-verification probe. Reaching here means the D5
         // decrypt above succeeded (a wrong key returned 422), which is what the
-        // check proves, so answer verification=true.
+        // check proves, so answer verification=true. We also print the decrypted
+        // record as a "N | name | address" line: the portal's verify page asks
+        // you to copy these lines from this console and paste them at the verify
+        // URL in your instruction email.
+        $oaAddr = is_array($address) ? $address : [];
+        $oaKeep = static fn($s) => $s !== null && $s !== '';
+        $oaLoc  = implode(' ', array_filter([$oaAddr['suburb'] ?? '', $oaAddr['state'] ?? '', $oaAddr['postcode'] ?? ''], $oaKeep));
+        $oaLine = implode(', ', array_filter([$oaAddr['street'] ?? '', $oaLoc], $oaKeep));
         \\Log::info('[OneAddress] verification probe decrypted OK', ['event' => $eventType]);
+        \\Log::info('[verification] ' . ($body['index'] ?? '?') . ' | ' . $verifiedName . ' | ' . $oaLine);
         return response()->json(['verification' => true, 'index' => $body['index'] ?? null]);
     }
 
@@ -5296,7 +5409,7 @@ async function scaffold(platform, outputDir, partnerId, webhookSecret, webhookUr
 
 // src/register.ts
 var import_node_crypto = require("crypto");
-var PKG_VERSION = true ? "1.3.3" : "dev";
+var PKG_VERSION = true ? "1.4.0" : "dev";
 var REGISTER_URL = "https://partners.oneaddress.io/api/partner/installs";
 function hmacSha256(secret, message) {
   return (0, import_node_crypto.createHmac)("sha256", secret).update(message).digest("hex");
@@ -6299,6 +6412,7 @@ async function main() {
   let webhookReady = true;
   let tunnelBase = null;
   let existingUrlReason = "";
+  let keepExistingUrl = false;
   const existingUrlResult = await getExistingWebhookUrl(pid, secret, (r2) => {
     existingUrlReason = r2;
   });
@@ -6314,9 +6428,9 @@ Continuing will overwrite it.`
     });
     assertNotCancelled(continueAnyway);
     if (!continueAnyway) {
-      runCleanup();
-      Se("Setup cancelled \u2014 your existing webhook URL was not changed.");
-      process.exit(0);
+      keepExistingUrl = true;
+      webhookUrl = existingUrlResult;
+      M2.info(`Keeping your existing webhook URL: ${webhookUrl}`);
     }
   } else if (existingUrlResult === void 0) {
     M2.warn(
@@ -6333,70 +6447,72 @@ Continuing will overwrite it.`
       process.exit(0);
     }
   }
-  const hasPublicUrl = await ye({
-    message: "Do you have a public HTTPS URL where this server is reachable?",
-    initialValue: false
-  });
-  assertNotCancelled(hasPublicUrl);
-  if (hasPublicUrl) {
-    const providedUrl = await he({
-      message: "Your public HTTPS webhook URL",
-      placeholder: "https://my-api.example.com/webhook",
-      validate: (v2) => {
-        if (!v2.trim()) return "URL is required";
-        if (!v2.trim().startsWith("https://"))
-          return "Must start with https:// \u2014 OneAddress enforces HTTPS for outbound webhooks";
-      }
+  if (!keepExistingUrl) {
+    const hasPublicUrl = await ye({
+      message: "Do you have a public HTTPS URL where this server is reachable?",
+      initialValue: false
     });
-    assertNotCancelled(providedUrl);
-    webhookUrl = providedUrl.trim();
-  } else {
-    M2.info("\nSetting up a free HTTPS tunnel via Cloudflare Tunnel\u2026");
-    const s4 = Y2();
-    s4.start("Starting Cloudflare Tunnel");
-    onCleanup(stopTunnel);
-    try {
-      let tunnel = await startTunnel(3001);
-      webhookUrl = `${tunnel.url}/webhook`;
-      tunnelBase = tunnel.url;
-      s4.stop(`Tunnel active: ${tunnel.url}`);
-      M2.warn(
-        "IMPORTANT: This tunnel URL is temporary. It lives only while this wizard\nkeeps running, and every run gets a new address. Before going to production,\ndeploy to a permanent server and update the webhook URL in the portal."
-      );
-      const s4b = Y2();
-      s4b.start("Waiting for the tunnel to start routing");
-      webhookReady = await waitForTunnelReady(tunnel.url);
-      if (!webhookReady) {
-        s4b.stop("First tunnel is slow to route, trying a fresh one");
-        stopTunnel();
-        tunnel = await startTunnel(3001);
+    assertNotCancelled(hasPublicUrl);
+    if (hasPublicUrl) {
+      const providedUrl = await he({
+        message: "Your public HTTPS webhook URL",
+        placeholder: "https://my-api.example.com/webhook",
+        validate: (v2) => {
+          if (!v2.trim()) return "URL is required";
+          if (!v2.trim().startsWith("https://"))
+            return "Must start with https:// \u2014 OneAddress enforces HTTPS for outbound webhooks";
+        }
+      });
+      assertNotCancelled(providedUrl);
+      webhookUrl = providedUrl.trim();
+    } else {
+      M2.info("\nSetting up a free HTTPS tunnel via Cloudflare Tunnel\u2026");
+      const s4 = Y2();
+      s4.start("Starting Cloudflare Tunnel");
+      onCleanup(stopTunnel);
+      try {
+        let tunnel = await startTunnel(3001);
         webhookUrl = `${tunnel.url}/webhook`;
         tunnelBase = tunnel.url;
-        const s4c = Y2();
-        s4c.start(`Waiting for the new tunnel to route: ${tunnel.url}`);
-        webhookReady = await waitForTunnelReady(tunnel.url, { budgetMs: 45e3 });
-        s4c.stop(webhookReady ? "Tunnel is routing" : "Tunnel still not routing");
-      } else {
-        s4b.stop("Tunnel is routing");
-      }
-      if (!webhookReady) {
+        s4.stop(`Tunnel active: ${tunnel.url}`);
         M2.warn(
-          `The tunnel edge is still not routing after a retry. This is almost always
+          "IMPORTANT: This tunnel URL is temporary. It lives only while this wizard\nkeeps running, and every run gets a new address. Before going to production,\ndeploy to a permanent server and update the webhook URL in the portal."
+        );
+        const s4b = Y2();
+        s4b.start("Waiting for the tunnel to start routing");
+        webhookReady = await waitForTunnelReady(tunnel.url);
+        if (!webhookReady) {
+          s4b.stop("First tunnel is slow to route, trying a fresh one");
+          stopTunnel();
+          tunnel = await startTunnel(3001);
+          webhookUrl = `${tunnel.url}/webhook`;
+          tunnelBase = tunnel.url;
+          const s4c = Y2();
+          s4c.start(`Waiting for the new tunnel to route: ${tunnel.url}`);
+          webhookReady = await waitForTunnelReady(tunnel.url, { budgetMs: 45e3 });
+          s4c.stop(webhookReady ? "Tunnel is routing" : "Tunnel still not routing");
+        } else {
+          s4b.stop("Tunnel is routing");
+        }
+        if (!webhookReady) {
+          M2.warn(
+            `The tunnel edge is still not routing after a retry. This is almost always
 one of two things, and neither is your server (it is running on :3001):
   1. Open ${tunnel.url}/health in a browser. If it never loads, your network
      is blocking cloudflared and no wait will fix it, so try a different network.
   2. The tunnel only lives while this wizard runs, so keep this window open.`
+          );
+        }
+      } catch (err) {
+        s4.stop("Tunnel setup failed");
+        M2.warn(`Could not start tunnel: ${err instanceof Error ? err.message : String(err)}`);
+        M2.warn(
+          "To get a public URL manually, try: npx cloudflared tunnel --url http://localhost:3001\nOr deploy to any server and set the URL in partners.oneaddress.io \u2192 My Profile."
         );
       }
-    } catch (err) {
-      s4.stop("Tunnel setup failed");
-      M2.warn(`Could not start tunnel: ${err instanceof Error ? err.message : String(err)}`);
-      M2.warn(
-        "To get a public URL manually, try: npx cloudflared tunnel --url http://localhost:3001\nOr deploy to any server and set the URL in partners.oneaddress.io \u2192 My Profile."
-      );
     }
   }
-  if (webhookUrl) {
+  if (webhookUrl && !keepExistingUrl) {
     const s5 = Y2();
     s5.start("Registering webhook URL in the Partner Portal");
     const reg = await registerWebhookUrl(pid, secret, webhookUrl);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneaddress/setup",
-  "version": "1.3.3",
+  "version": "1.4.0",
   "description": "Interactive setup wizard for OneAddress partner webhook integrations",
   "main": "dist/index.js",
   "bin": {