`verification/tk11114-remediation/BLOCK-A-PASTE.md`

42 lines
# TK-11114 — BLOCK A: the ONE deploy paste (Steve runs; gated prod change)

**Supersedes** `verification/tk11114/FIX-PASTE.md` (that one chased a webhook-token theory that
functional tests DISPROVED — the live webhook token already matches `…e9c9`; do not run it).

## What this paste does (all reversible, self-verifying)
1. On prod, timestamped-backs-up `lib/email.js` + `lib/verify.js` **before** any overwrite.
2. `scp`s the two verified-clean files from Mac2 (byte-identical to committed HEAD).
   - email.js sha256 `e442f36f8e676096d29bc85cd20ddce6f0b59dc8e24606ede00bd4ef86a62c12`
   - verify.js sha256 `14498fdd4a50207e727059cce65b1ed414922550c5d05986669db2ea837011e4`
   - Restores `message_class:'transactional'` + credential-safe un-swallow logging.
3. Reports whether `GEORGE_BASIC_AUTH` is baked into `ecosystem.config.js` (it should NOT be —
   the bug is a stale shell-inherited process.env override), then restarts ONLY
   `dw-signup-fulfillment` with `--update-env` from a clean remote shell (`env -u GEORGE_BASIC_AUTH`)
   so config falls through to the correct on-host George creds.
4. Verifies: healthz `dry_run:false`, bad webhook token → 401, live token → 200.

Even if the credential theory is wrong, the un-swallow logging now deployed makes the NEXT
signup (or the R4 test) print George's real response — proving the send or revealing the exact
next fix.

## The paste
```
! cd ~/Projects/dw-signup-fulfillment && ssh root@45.61.58.125 'cd /root/Projects/dw-signup-fulfillment && ts=$(date +%s) && cp lib/email.js lib/email.js.tk11114.bak.$ts && cp lib/verify.js lib/verify.js.tk11114.bak.$ts && echo "backed up .bak.$ts"' && scp lib/email.js lib/verify.js root@45.61.58.125:/root/Projects/dw-signup-fulfillment/lib/ && ssh root@45.61.58.125 'cd /root/Projects/dw-signup-fulfillment && echo "email sha:$(shasum -a 256 lib/email.js | cut -d" " -f1)" && echo "verify sha:$(shasum -a 256 lib/verify.js | cut -d" " -f1)" && echo "GEORGE_BASIC_AUTH in ecosystem? $(grep -c GEORGE_BASIC_AUTH ecosystem.config.js) (want 0)" && env -u GEORGE_BASIC_AUTH pm2 restart dw-signup-fulfillment --update-env && sleep 2 && echo "== healthz ==" && curl -s http://127.0.0.1:9862/healthz && echo && WT=$(grep -E "^WEBHOOK_URL_TOKEN=" /root/Projects/secrets-manager/.env | head -1 | cut -d= -f2- | tr -d "\"") && curl -s -o /dev/null -w "badtoken http=%{http_code} (want 401)\n" -X POST http://127.0.0.1:9862/webhooks/customers/create/bogus -H "Content-Type: application/json" -d "{}" && curl -s -o /dev/null -w "livetoken http=%{http_code} (want 200)\n" -X POST "http://127.0.0.1:9862/webhooks/customers/create/$WT" -H "Content-Type: application/json" -d "{}"'
```

**Expected:** both sha lines match the values above · `GEORGE_BASIC_AUTH in ecosystem? 0` ·
`dry_run:false` · `badtoken http=401` · `livetoken http=200`.

**If `GEORGE_BASIC_AUTH in ecosystem? 1`** — stop and tell me; the override is baked into the
ecosystem file (not a shell var) and needs a config edit before restart.

## Rollback
```
! ssh root@45.61.58.125 'cd /root/Projects/dw-signup-fulfillment && b=$(ls -t lib/email.js.tk11114.bak.* | head -1 | sed "s/.*\.bak\.//") && cp lib/email.js.tk11114.bak.$b lib/email.js && cp lib/verify.js.tk11114.bak.$b lib/verify.js && pm2 restart dw-signup-fulfillment && curl -s http://127.0.0.1:9862/healthz'
```

## After it's green
Tell me, and I hand you BLOCK B (R4): one controlled `steve+dwgolive-…@` test customer to fire
the live webhook, George-inbox verify-click, prove `verified-sample` tag + metafields persist,
idempotency replay, negative 401, then delete the test customer.