@open-mercato/checkout 0.6.4-develop.4371.1.8f3030407e → 0.6.4

package/src/modules/checkout/data/__tests__/validators.test.ts

@@ -1,4 +1,11 @@
-import { createLinkSchema, createTemplateSchema } from '../validators'
+import {
+  createLinkSchema,
+  createTemplateSchema,
+  updateLinkSchema,
+  updateTemplateSchema,
+} from '../validators'
+
+const TEMPLATE_ID = '020b29c5-db01-4ee3-8080-1d9b185c5e29'
 
 describe('checkout validators', () => {
   test('createTemplateSchema accepts payloads that omit optional normalized fields', () => {
@@ -44,4 +51,62 @@ describe('checkout validators', () => {
     expect(result.slug).toBeNull()
     expect(result.password).toBeNull()
   })
+
+  test('updateTemplateSchema rejects a cleared gatewayProviderKey', () => {
+    expect(() =>
+      updateTemplateSchema.parse({
+        id: TEMPLATE_ID,
+        name: 'Consulting Fee',
+        pricingMode: 'fixed',
+        fixedPriceAmount: 49.99,
+        fixedPriceCurrencyCode: 'USD',
+        gatewayProviderKey: null,
+      }),
+    ).toThrow()
+
+    expect(() =>
+      updateTemplateSchema.parse({
+        id: TEMPLATE_ID,
+        name: 'Consulting Fee',
+        pricingMode: 'fixed',
+        fixedPriceAmount: 49.99,
+        fixedPriceCurrencyCode: 'USD',
+        gatewayProviderKey: '   ',
+      }),
+    ).toThrow()
+  })
+
+  test('updateTemplateSchema accepts edits that omit gatewayProviderKey', () => {
+    const result = updateTemplateSchema.parse({
+      id: TEMPLATE_ID,
+      name: 'Consulting Fee renamed',
+    })
+
+    expect(Object.prototype.hasOwnProperty.call(result, 'gatewayProviderKey')).toBe(false)
+  })
+
+  test('updateLinkSchema accepts a null gatewayProviderKey (issue #2505)', () => {
+    const result = updateLinkSchema.parse({
+      id: TEMPLATE_ID,
+      name: 'Consulting Fee link',
+      pricingMode: 'fixed',
+      fixedPriceAmount: 49.99,
+      fixedPriceCurrencyCode: 'USD',
+      gatewayProviderKey: null,
+    })
+
+    expect(result.gatewayProviderKey).toBeNull()
+  })
+
+  test('createTemplateSchema still rejects a null gatewayProviderKey', () => {
+    expect(() =>
+      createTemplateSchema.parse({
+        name: 'QA template',
+        pricingMode: 'fixed',
+        fixedPriceAmount: 49.99,
+        fixedPriceCurrencyCode: 'USD',
+        gatewayProviderKey: null,
+      }),
+    ).toThrow()
+  })
 })

package/src/modules/checkout/data/validators.ts

@@ -109,7 +109,7 @@ const checkoutContentSchema = z.object({
   customAmountMax: positiveMoneySchema.optional().nullable(),
   customAmountCurrencyCode: currencyCodeSchema.optional().nullable(),
   priceListItems: z.array(priceListItemSchema).optional().nullable(),
-  gatewayProviderKey: requiredTrimmedString('checkout.validation.gatewayProviderKey.required'),
+  gatewayProviderKey: optionalTrimmedString,
   gatewaySettings: gatewaySettingsSchema,
   customFieldsetCode: optionalFieldsetCodeSchema,
   collectCustomerDetails: z.boolean().default(true),
@@ -174,7 +174,16 @@ function validatePricingConsistency<T extends z.infer<typeof checkoutContentSche
   }
 }
 
-export const createTemplateSchema = checkoutContentSchema.superRefine(validatePricingConsistency)
+export const createTemplateSchema = checkoutContentSchema.superRefine((value, ctx) => {
+  validatePricingConsistency(value, ctx)
+  if (!value.gatewayProviderKey) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: 'checkout.validation.gatewayProviderKey.required',
+      path: ['gatewayProviderKey'],
+    })
+  }
+})
 
 function applyPartialPricingConsistency(value: Record<string, unknown>, ctx: z.RefinementCtx) {
   if (!value.pricingMode) return
@@ -195,6 +204,13 @@ export const updateTemplateSchema = checkoutContentSchema.partial().extend({
   customerFieldsSchema: z.array(customerFieldDefinitionSchema).optional(),
 }).superRefine((value, ctx) => {
   applyPartialPricingConsistency(value, ctx)
+  if (Object.prototype.hasOwnProperty.call(value, 'gatewayProviderKey') && !value.gatewayProviderKey) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: 'checkout.validation.gatewayProviderKey.required',
+      path: ['gatewayProviderKey'],
+    })
+  }
 })
 
 export const createLinkSchema = createTemplateSchema.safeExtend({

package/src/modules/checkout/lib/__tests__/utils.test.ts

@@ -1,3 +1,4 @@
+import { createHmac } from 'crypto'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { clearPaymentGatewayDescriptors, registerPaymentGatewayDescriptor } from '@open-mercato/shared/modules/payment_gateways/types'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
@@ -157,6 +158,32 @@ describe('checkout utils', () => {
     expect(buildConsentProof(link, { terms: true, privacyPolicy: false })).not.toHaveProperty('privacyPolicy')
   })
 
+  it('derives consent markdownHash from the server secret so it is tamper-evident', () => {
+    const link = createLink({
+      legalDocuments: {
+        terms: { title: 'Terms', markdown: 'terms body', required: true },
+      },
+    })
+
+    process.env.AUTH_SECRET = 'consent-secret-a'
+    const proofWithSecretA = buildConsentProof(link, { terms: true, privacyPolicy: false }) as {
+      terms: { markdownHash: string }
+    }
+    const hashWithSecretA = proofWithSecretA.terms.markdownHash
+
+    const forgedHashFromPublicConstant = createHmac('sha256', 'terms').update('terms body').digest('hex')
+    expect(hashWithSecretA).not.toBe(forgedHashFromPublicConstant)
+
+    const forgedHashFromPlainSha = createHmac('sha256', 'terms').update('terms\nterms body').digest('hex')
+    expect(hashWithSecretA).not.toBe(forgedHashFromPlainSha)
+
+    process.env.AUTH_SECRET = 'consent-secret-b'
+    const proofWithSecretB = buildConsentProof(link, { terms: true, privacyPolicy: false }) as {
+      terms: { markdownHash: string }
+    }
+    expect(proofWithSecretB.terms.markdownHash).not.toBe(hashWithSecretA)
+  })
+
   it('verifies password access tokens only for the matching slug', () => {
     const token = signCheckoutAccessToken('launch-offer', {
       linkId: 'link_1',
@@ -208,6 +235,91 @@ describe('checkout utils', () => {
     })).toBe(true)
   })
 
+  // #2675 — the checkout access cookie used to embed the link's bcrypt
+  // passwordHash verbatim as `sessionVersion`. The payload segment is only
+  // signed, not encrypted, so anyone with the cookie could base64url-decode
+  // it and run an offline crack against the hash. The fix derives a
+  // non-reversible HMAC of the input before embedding it.
+  describe('access cookie payload does not expose the raw sessionVersion (#2675)', () => {
+    const bcryptHash = '$2b$10$abcdefghijklmnopqrstuv1234567890ABCDEFGHIJKLMNOPQRSTUVwxyz12'
+    const BCRYPT_PREFIX_RE = /^\$2[abxy]\$/
+
+    function decodePayloadSegment(token: string): { sessionVersion?: string | null } {
+      const [encoded] = token.split('.')
+      const json = Buffer.from(encoded, 'base64url').toString('utf-8')
+      return JSON.parse(json) as { sessionVersion?: string | null }
+    }
+
+    it('never embeds a bcrypt-shaped sessionVersion in the payload', () => {
+      const token = signCheckoutAccessToken('launch-offer', {
+        linkId: 'link_1',
+        sessionVersion: bcryptHash,
+      })
+
+      const payload = decodePayloadSegment(token)
+      expect(payload.sessionVersion).toBeTruthy()
+      expect(payload.sessionVersion).not.toBe(bcryptHash)
+      expect(payload.sessionVersion ?? '').not.toMatch(BCRYPT_PREFIX_RE)
+    })
+
+    it('verifies a cookie signed with the same passwordHash', () => {
+      const token = signCheckoutAccessToken('launch-offer', {
+        linkId: 'link_1',
+        sessionVersion: bcryptHash,
+      })
+
+      expect(verifyCheckoutAccessToken(token, 'launch-offer', {
+        linkId: 'link_1',
+        sessionVersion: bcryptHash,
+      })).toBe(true)
+    })
+
+    it('rotates the cookie when the passwordHash changes (old token rejected against new hash)', () => {
+      const token = signCheckoutAccessToken('launch-offer', {
+        linkId: 'link_1',
+        sessionVersion: bcryptHash,
+      })
+
+      const rotatedHash = '$2b$10$ZZZZZZZZZZZZZZZZZZZZZuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuQ'
+      expect(verifyCheckoutAccessToken(token, 'launch-offer', {
+        linkId: 'link_1',
+        sessionVersion: rotatedHash,
+      })).toBe(false)
+    })
+
+    it('handles a null sessionVersion defensively without revealing input', () => {
+      const token = signCheckoutAccessToken('launch-offer', {
+        linkId: 'link_1',
+        sessionVersion: null,
+      })
+
+      const payload = decodePayloadSegment(token)
+      expect(payload.sessionVersion).toBeNull()
+      // A caller that does not enforce a sessionVersion still accepts the cookie
+      // (the signature + slug + linkId + exp are the floor of authenticity).
+      expect(verifyCheckoutAccessToken(token, 'launch-offer', {
+        linkId: 'link_1',
+      })).toBe(true)
+    })
+
+    it('produces a different cookie payload for two different bcrypt hashes (rotation semantics intact)', () => {
+      const tokenA = signCheckoutAccessToken('launch-offer', {
+        linkId: 'link_1',
+        sessionVersion: bcryptHash,
+      })
+      const tokenB = signCheckoutAccessToken('launch-offer', {
+        linkId: 'link_1',
+        sessionVersion: '$2b$10$differentdifferentdifferentdifferentdifferentdifferent',
+      })
+
+      const decodedA = decodePayloadSegment(tokenA).sessionVersion
+      const decodedB = decodePayloadSegment(tokenB).sessionVersion
+      expect(decodedA).toBeTruthy()
+      expect(decodedB).toBeTruthy()
+      expect(decodedA).not.toBe(decodedB)
+    })
+  })
+
   it('releases the link lock when a reserved transaction reaches a terminal status', () => {
     const link = createLink({
       activeReservationCount: 1,

package/src/modules/checkout/lib/utils.ts

@@ -121,6 +121,20 @@ export function toMoneyString(value: string | number | null | undefined): string
 
 export { normalizeOptionalString, buildCheckoutAttachmentPreviewUrl } from './client-utils'
 
+function normalizeJsonRecord(value: unknown): Record<string, unknown> {
+  if (!value) return {}
+  if (typeof value === 'object' && !Array.isArray(value)) return value as Record<string, unknown>
+  if (typeof value !== 'string') return {}
+  try {
+    const parsed = JSON.parse(value)
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+      ? parsed as Record<string, unknown>
+      : {}
+  } catch {
+    return {}
+  }
+}
+
 export function deriveConfiguredCurrencies(input: TemplateOrLinkInput): string[] {
   const currencies = new Set<string>()
   if (input.pricingMode === 'fixed' && input.fixedPriceCurrencyCode) currencies.add(input.fixedPriceCurrencyCode)
@@ -156,7 +170,7 @@ export function toTemplateOrLinkMutationInput(
     customAmountCurrencyCode: record.customAmountCurrencyCode ?? null,
     priceListItems: record.priceListItems ?? null,
     gatewayProviderKey: record.gatewayProviderKey ?? '',
-    gatewaySettings: record.gatewaySettings ?? {},
+    gatewaySettings: normalizeJsonRecord(record.gatewaySettings),
     customFieldsetCode: record.customFieldsetCode ?? null,
     collectCustomerDetails: record.collectCustomerDetails,
     customerFieldsSchema: (record.customerFieldsSchema ?? []) as CreateTemplateInput['customerFieldsSchema'],
@@ -250,6 +264,17 @@ function normalizeCheckoutAccessSessionVersion(value: Date | string | null | und
   return value instanceof Date ? value.toISOString() : value
 }
 
+// Derive a non-reversible cookie-safe representation of `sessionVersion`
+// so the embedded payload never exposes the raw input (typically the
+// checkout link's bcrypt passwordHash — see #2675). The HMAC keeps
+// rotation semantics intact: any change to the input produces a fresh
+// digest, invalidating outstanding cookies.
+function deriveCheckoutAccessSessionVersion(value: Date | string | null | undefined): string | null {
+  const normalized = normalizeCheckoutAccessSessionVersion(value)
+  if (normalized == null) return null
+  return createHmac('sha256', getCheckoutAccessTokenSecret()).update(normalized).digest('base64url')
+}
+
 export function signCheckoutAccessToken(
   slug: string,
   options?: { linkId?: string | null; sessionVersion?: Date | string | null },
@@ -257,7 +282,7 @@ export function signCheckoutAccessToken(
   const payload = Buffer.from(JSON.stringify({
     slug,
     linkId: options?.linkId ?? null,
-    sessionVersion: normalizeCheckoutAccessSessionVersion(options?.sessionVersion),
+    sessionVersion: deriveCheckoutAccessSessionVersion(options?.sessionVersion),
     exp: Date.now() + (60 * 60 * 1000),
   }), 'utf-8').toString('base64url')
   const signature = createHmac('sha256', getCheckoutAccessTokenSecret()).update(payload).digest('base64url')
@@ -285,7 +310,7 @@ export function verifyCheckoutAccessToken(
     if (parsed.slug !== slug || typeof parsed.exp !== 'number' || parsed.exp <= Date.now()) return false
     if (options?.linkId && parsed.linkId !== options.linkId) return false
     if (options?.sessionVersion) {
-      return parsed.sessionVersion === normalizeCheckoutAccessSessionVersion(options.sessionVersion)
+      return parsed.sessionVersion === deriveCheckoutAccessSessionVersion(options.sessionVersion)
     }
     return true
   } catch {
@@ -325,6 +350,17 @@ export function applyTerminalTransactionState(
   }
 }
 
+// Security model: the consent proof is a GDPR/consent audit trail, so `markdownHash`
+// must be tamper-evident. It is an HMAC keyed with the server-side checkout secret
+// (never a public constant), which an attacker who can edit a stored consent row
+// cannot recompute without the secret. The document key is folded into the HMAC
+// message to namespace each document while keeping a single server-held key.
+export function computeConsentMarkdownHash(documentKey: string, markdown: string): string {
+  return createHmac('sha256', getCheckoutAccessTokenSecret())
+    .update(`${documentKey}\n${markdown}`)
+    .digest('hex')
+}
+
 export function buildConsentProof(link: CheckoutLink, acceptedLegalConsents: PublicSubmitInput['acceptedLegalConsents']) {
   const proof: Record<string, unknown> = {}
   const legalDocuments = link.legalDocuments && typeof link.legalDocuments === 'object'
@@ -339,7 +375,7 @@ export function buildConsentProof(link: CheckoutLink, acceptedLegalConsents: Pub
       title: document.title ?? key,
       required: document.required === true,
       acceptedAt: new Date().toISOString(),
-      markdownHash: createHmac('sha256', key).update(document.markdown).digest('hex'),
+      markdownHash: computeConsentMarkdownHash(key, document.markdown),
     }
   }
   return proof
@@ -416,7 +452,7 @@ export function serializeTemplateOrLink(record: CheckoutLinkTemplate | CheckoutL
     customAmountCurrencyCode: record.customAmountCurrencyCode ?? null,
     priceListItems: record.priceListItems ?? [],
     gatewayProviderKey: record.gatewayProviderKey ?? null,
-    gatewaySettings: record.gatewaySettings ?? {},
+    gatewaySettings: normalizeJsonRecord(record.gatewaySettings),
     customFieldsetCode: record.customFieldsetCode ?? null,
     collectCustomerDetails: record.collectCustomerDetails,
     customerFieldsSchema: record.customerFieldsSchema ?? [],