@oneaddress/setup 2.1.1 → 2.1.2

package/dist/index.js

@@ -856,7 +856,7 @@ var _R = ["\u2588\u2588\u2588\u2588\u2588\u2588 ", "\u2588\u2588   \u2588\u2588"
 var _S = [" \u2588\u2588\u2588\u2588\u2588\u2588", "\u2588\u2588     ", "\u2588\u2588     ", " \u2588\u2588\u2588\u2588\u2588 ", "     \u2588\u2588", "     \u2588\u2588", "\u2588\u2588\u2588\u2588\u2588\u2588 "];
 var ONE_ROWS = Array.from({ length: 7 }, (_3, i) => [_O[i], _N[i], _E[i]].join(" "));
 var ADDR_ROWS = Array.from({ length: 7 }, (_3, i) => [_A[i], _D2[i], _D2[i], _R[i], _E[i], _S[i], _S[i]].join(" "));
-var WIZARD_VERSION = true ? "2.1.1" : "?";
+var WIZARD_VERSION = true ? "2.1.2" : "?";
 function printCompactHeader() {
   const INNER = 42;
   const TOP = fn("\u250C") + dm("\u2500".repeat(INNER)) + fn("\u2510");
@@ -964,8 +964,8 @@ data.db-shm
   "private": true,
   "scripts": {
     "dev":      "tsx watch src/index.ts",
-    "start":    "tsx src/index.ts",
-    "headless": "tsx src/index.ts -- --headless",
+    "start":    "node --disable-warning=ExperimentalWarning node_modules/tsx/dist/cli.mjs src/index.ts",
+    "headless": "node --disable-warning=ExperimentalWarning node_modules/tsx/dist/cli.mjs src/index.ts -- --headless",
     "build":    "tsup src/index.ts --format esm --no-dts --outDir dist",
     "type-check": "tsc --noEmit",
     "test":     "tsx scripts/test.ts"
@@ -1081,6 +1081,7 @@ import {
   encryptField,
   isEncrypted,
   newSalt,
+  PassphraseRequiredError,
   verifierMatches,
   WrongPassphraseError,
   type VaultKeys,
@@ -1128,14 +1129,36 @@ function saltForThisDatabase(): Buffer {
 }
 
 function openKeys(): VaultKeys | null {
+  // THE VERIFIER IS READ FIRST, and the order is the whole fix.
+  //
+  // This used to return null the moment no passphrase was set, without ever
+  // asking whether the database was encrypted. An encrypted store opened with
+  // no passphrase therefore ran IN THE CLEAR over the top of itself: it could
+  // not decrypt the existing rows, so their blind indexes never matched, so it
+  // seeded a SECOND copy of the roster in plaintext beside the first. The next
+  // unlock then tried to converge both copies onto one key and died on a
+  // UNIQUE constraint, permanently, with the correct passphrase in hand.
+  //
+  // Reported by a partner on 2.1.1 as "it is locking me out", and the lockout
+  // was the last step of three. Two things were wrong and the quiet one was
+  // worse: plaintext customer records written into a database its owner had
+  // encrypted.
+  const stored = readMeta('verifier');
   const passphrase = process.env.ONEADDRESS_DB_PASSPHRASE;
-  if (!passphrase || !passphrase.trim()) return null;
+
+  if (!passphrase || !passphrase.trim()) {
+    // Never silently. A database with no verifier has never been locked and
+    // running it in the clear is the documented, chosen behaviour; one WITH a
+    // verifier is somebody's encrypted store and this is not the process that
+    // gets to open it.
+    if (stored !== null) throw new PassphraseRequiredError();
+    return null;
+  }
 
   const keys = deriveKeys(passphrase, saltForThisDatabase());
 
   // Checked BEFORE anything is written. A mistyped passphrase must not be able
   // to write a single row of ciphertext that nothing can ever read back.
-  const stored = readMeta('verifier');
   if (stored === null) writeMeta('verifier', buildVerifier(keys));
   else if (!verifierMatches(keys, stored)) throw new WrongPassphraseError();
 
@@ -1182,7 +1205,16 @@ export function once(column: string, value: string | null): string | null {
   return isEncrypted(value) ? value : encryptField(keys, column, value);
 }
 
-export { WrongPassphraseError };
+export { PassphraseRequiredError, WrongPassphraseError };
+
+/**
+ * Is this stored value ciphertext? Exported for the repair pass in \`store.ts\`.
+ *
+ * The repair has to tell an encrypted row from a plaintext one written beside
+ * it by a run that had no passphrase, and that is the only question that
+ * separates them.
+ */
+export { isEncrypted };
 export default db;
 `
     },
@@ -1363,6 +1395,25 @@ export class WrongPassphraseError extends Error {
   }
 }
 
+/**
+ * The database is encrypted and nobody supplied a passphrase.
+ *
+ * NAMED SEPARATELY FROM \\\`WrongPassphraseError\\\` because the remedy is different:
+ * one means try again, the other means you have not been asked yet. Before this
+ * existed the case had no error at all - opening an encrypted database with no
+ * passphrase returned no keys and the receiver carried on IN THE CLEAR over the
+ * top of it, which cost a partner their database. See the refusal in db.ts.
+ */
+export class PassphraseRequiredError extends Error {
+  constructor() {
+    super(
+      'This database is encrypted. Set ONEADDRESS_DB_PASSPHRASE, or run \`npm start\` ' +
+      'in a terminal to be asked for it.',
+    );
+    this.name = 'PassphraseRequiredError';
+  }
+}
+
 export interface VaultKeys {
   /** AES-256-GCM key for the personal columns. */
   cipherKey: Buffer;
@@ -1814,7 +1865,7 @@ export function notePreviousAddress(prev: Record<string, unknown>): void {
  * \`--headless\` skips both: no prompt (a service has nobody to ask), no screen.
  */
 import { printBanner } from './brand.js';
-import { WrongPassphraseError } from './vault.js';
+import { PassphraseRequiredError, WrongPassphraseError } from './vault.js';
 
 /**
  * No dashboard without a terminal to draw it in.
@@ -1878,25 +1929,79 @@ async function databaseIsLocked(): Promise<boolean> {
  * hook is not available, being asked in the clear beats not being asked.
  */
 async function ask(prompt: string): Promise<string> {
-  const { createInterface } = await import('node:readline/promises');
-  const rl = createInterface({ input: process.stdin, output: process.stdout, terminal: true });
-  const hooked = rl as unknown as { _writeToOutput?: (s: string) => void };
-  const original = hooked._writeToOutput;
-  try {
-    hooked._writeToOutput = function (chunk: string): void {
-      // Echo the prompt itself, mask everything the user types.
-      if (chunk.includes(prompt)) process.stdout.write(chunk);
-      else process.stdout.write('*');
+  process.stdout.write(prompt);
+
+  // NO readline. Two versions of this used readline's \`_writeToOutput\` hook to
+  // mask the echo and BOTH ECHOED THE PASSPHRASE IN CLEAR, which was only found
+  // by driving a real terminal and reading what came back. The first filtered
+  // on whether the chunk contained the prompt, not knowing readline repaints
+  // prompt and input together on every keystroke, so the condition was always
+  // true. The second repainted the line and still leaked, because the echo was
+  // never coming from that hook at all.
+  //
+  // Reading the keys directly removes the guessing. Raw mode turns the
+  // terminal's own echo OFF, so the ONLY thing that can reach the screen is
+  // what is written below: one asterisk per character, which is what a partner
+  // asked for and what every other passphrase prompt does.
+  const stdin = process.stdin;
+  if (!stdin.isTTY || typeof stdin.setRawMode !== 'function') {
+    // No terminal to control. Being asked in the clear beats not being asked,
+    // and this path is only reached where nothing is watching anyway.
+    const { createInterface } = await import('node:readline/promises');
+    const rl = createInterface({ input: stdin, output: process.stdout });
+    try {
+      const answer = await rl.question('');
+      return answer.trim();
+    } finally { rl.close(); }
+  }
+
+  const wasRaw = stdin.isRaw === true;
+  stdin.setRawMode(true);
+  stdin.resume();
+  stdin.setEncoding('utf8');
+
+  return new Promise<string>((resolve) => {
+    let typed = '';
+    const restore = (): void => {
+      stdin.removeListener('data', onData);
+      stdin.setRawMode(wasRaw);
+      stdin.pause();
     };
-  } catch { /* keep the visible prompt */ }
-  try {
-    const answer = await rl.question(prompt);
-    process.stdout.write('\\n');
-    return answer.trim();
-  } finally {
-    if (original) hooked._writeToOutput = original;
-    rl.close();
-  }
+    const onData = (chunk: string): void => {
+      for (const ch of chunk) {
+        if (ch === '\\r' || ch === '\\n') {
+          restore();
+          process.stdout.write('\\n');
+          resolve(typed.trim());
+          return;
+        }
+        if (ch === '\\u0003') {            // Ctrl+C
+          restore();
+          process.stdout.write('\\n');
+          process.exit(130);
+        }
+        if (ch === '\\u0004') {            // Ctrl+D on an empty line ends it
+          restore();
+          process.stdout.write('\\n');
+          resolve(typed.trim());
+          return;
+        }
+        if (ch === '\\u007f' || ch === '\\b') {
+          // Backspace has to move the asterisks too, or the mask stops matching
+          // what is actually in the buffer and the count misleads.
+          if (typed.length > 0) {
+            typed = typed.slice(0, -1);
+            process.stdout.write('\\b \\b');
+          }
+          continue;
+        }
+        if (ch < ' ') continue;          // ignore the rest of the control range
+        typed += ch;
+        process.stdout.write('*');
+      }
+    };
+    stdin.on('data', onData);
+  });
 }
 
 /**
@@ -1927,7 +2032,17 @@ async function resolvePassphrase(): Promise<string | null> {
   if (headless || !process.stdin.isTTY) return null;
 
   if (await databaseIsLocked()) {
-    process.stdout.write('\\n  This customer database is encrypted.\\n\\n');
+    // NAMES THE WAY OUT, because a partner can arrive here having never
+    // knowingly set a passphrase. Versions before 2.0.1 asked for one with a
+    // prompt that did not say whether it was creating or checking, so a
+    // database can carry a verifier its owner does not remember agreeing to.
+    // Reported by exactly that partner: "there was no opportunity to set a
+    // passphrase". Without this line the only options are guess or search the
+    // internet, and the answer is one command.
+    process.stdout.write('\\n  This customer database is encrypted.\\n');
+    process.stdout.write('  If you do not know the passphrase, delete data.db and start\\n');
+    process.stdout.write('  again: it holds your demo roster and test dispatches, nothing\\n');
+    process.stdout.write('  OneAddress needs.\\n\\n');
     const answer = await ask('  Passphrase to unlock: ');
     return answer || null;
   }
@@ -1967,6 +2082,15 @@ async function main(): Promise<void> {
     const server = await import('./server.js');
     config = { partnerName: server.PARTNER_NAME, port: server.PORT };
   } catch (err) {
+    if (err instanceof PassphraseRequiredError) {
+      // Reached when nobody could be asked: a service unit, a piped stdin, or
+      // the setup wizard's own health-check autostart. Before the refusal in
+      // db.ts this case ran in the clear and corrupted the database instead.
+      console.error('\\n  This database is encrypted and no passphrase was supplied.');
+      console.error('  Run \`npm start\` in a terminal to be asked for it, or set');
+      console.error('  ONEADDRESS_DB_PASSPHRASE for an unattended start.\\n');
+      process.exit(1);
+    }
     if (err instanceof WrongPassphraseError) {
       // Named for what it is. Without this the first symptom is a decryption
       // error on a live dispatch, which reads as a corrupt database and sends
@@ -2117,7 +2241,7 @@ export function safeOneAddressCallbackUrl(raw: string): string | null {
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { report } from './report.js';
-import db, { accountKey, dec, enc, encrypted, once } from './db.js';
+import db, { accountKey, dec, enc, encrypted, isEncrypted, once } from './db.js';
 
 export type Address = Record<string, unknown>;
 
@@ -2178,6 +2302,48 @@ ensureColumn('address_history', 'prev_address', "TEXT NOT NULL DEFAULT '{}'");
 // pass produces the same key rather than hashing a ciphertext and orphaning the
 // row. A row orphaned that way still reads fine in a listing and is invisible
 // to every dispatch, which is the worst kind of broken.
+// REPAIR FIRST, because a database can already be in the state the refusal in
+// db.ts now prevents. Before that refusal existed, a run with no passphrase
+// against an encrypted store could not decrypt the roster, so its blind indexes
+// never matched and it seeded a SECOND copy of every customer in plaintext. The
+// relabel below then maps both copies onto one key and dies on UNIQUE, with the
+// correct passphrase in hand and no way forward but deleting the file.
+//
+// So the plaintext twin is dropped. WHICH ONE GOES IS NOT A GUESS: the
+// encrypted row is the one the owner's passphrase wrote, the plaintext row was
+// written by a process that could not read it. Only the second is discarded,
+// and only when an encrypted row for the same account exists.
+//
+// Scoped to an encrypted database. With no keys there is nothing to compare,
+// every row is plaintext, and there is no duplicate to find.
+if (encrypted) {
+  const all = db.prepare('SELECT rowid AS rid, account_number FROM customers').all() as Array<
+    { rid: number; account_number: string }
+  >;
+  const seen = new Map<string, boolean>();   // plain account -> has an encrypted row
+  for (const r of all) {
+    if (isEncrypted(r.account_number)) {
+      const plain = dec('account_number', r.account_number);
+      if (plain) seen.set(plain, true);
+    }
+  }
+  const drop = db.prepare('DELETE FROM customers WHERE rowid = ?');
+  let dropped = 0;
+  for (const r of all) {
+    if (isEncrypted(r.account_number)) continue;
+    if (!seen.get(r.account_number)) continue;
+    drop.run(r.rid);
+    dropped += 1;
+  }
+  if (dropped > 0) {
+    // Said out loud. A silent repair of somebody's customer table is the kind
+    // of thing they should hear about from us rather than notice later.
+    report.warn(
+      \`[store] repaired \${dropped} plaintext duplicate customer row(s) left by a run with no passphrase\`,
+    );
+  }
+}
+
 {
   const rows = db.prepare('SELECT rowid AS rid, account_number, name, address FROM customers').all() as Array<
     { rid: number; account_number: string; name: string; address: string }
@@ -7990,7 +8156,7 @@ async function scaffold(platform, outputDir, partnerId, webhookSecret, webhookUr
 
 // src/register.ts
 var import_node_crypto = require("crypto");
-var PKG_VERSION = true ? "2.1.1" : "dev";
+var PKG_VERSION = true ? "2.1.2" : "dev";
 var REGISTER_URL = "https://partners.oneaddress.io/api/partner/installs";
 function hmacSha256(secret, message) {
   return (0, import_node_crypto.createHmac)("sha256", secret).update(message).digest("hex");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneaddress/setup",
-  "version": "2.1.1",
+  "version": "2.1.2",
   "description": "Interactive setup wizard for OneAddress partner webhook integrations",
   "main": "dist/index.js",
   "bin": {