✨ server: add wallet provisioning endpoint by aguxez · Pull Request #949 · exactly/exa

aguxez · 2026-04-10T09:27:29Z

Summary by CodeRabbit

New Features
- Added a wallet provisioning endpoint so authenticated users can retrieve wallet and card provisioning details.
Tests
- Added comprehensive tests for the wallet endpoint covering success, processor errors, missing card/panda, and missing credential scenarios.
Chores
- Added a changeset declaring a patch release with a release note about the new wallet provisioning endpoint.

changeset-bot · 2026-04-10T09:27:39Z

🦋 Changeset detected

Latest commit: 0975d4d

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@exactly/server	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

coderabbitai · 2026-04-10T09:27:52Z

Walkthrough

Adds a new authenticated GET /wallet endpoint that looks up a user's credential and active/frozen card, calls Panda API for processor-level card details, and returns a processor card ID and time-based secret; includes tests and a changeset declaring a patch release.

Changes

Cohort / File(s)	Summary
Wallet Endpoint `server/api/card.ts`	New authenticated `GET /wallet` route: reads `credentialId` from cookie, selects credential (pandaId + first ACTIVE
Panda Utility `server/utils/panda.ts`	Added exported `getProcessorDetails(cardId: string)` which GETs `/issuing/cards/${cardId}/processorDetails` and validates/returns `{ processorCardId, timeBasedSecret }`.
Tests `server/test/api/card.test.ts`	Added tests for wallet endpoint covering success (active/frozen cards), mocking `panda.getProcessorDetails`, and error mappings: Panda 404→404, Panda 5xx→500, no card→404, no panda→403, no credential→500.
Release Metadata `.changeset/chilly-suns-dress.md`	New changeset declaring a patch release for `@exactly/server` describing the wallet provisioning endpoint.

Sequence Diagram(s)

sequenceDiagram
    participant Client
    participant API as GET /wallet
    participant DB as Database
    participant Panda as Panda API

    Client->>API: GET /wallet (credentialId cookie)
    API->>DB: Load credential (pandaId, first ACTIVE|FROZEN card)
    alt no credential
        DB-->>API: not found
        API-->>Client: 500 { code: "no credential" }
    else credential missing pandaId
        DB-->>API: credential (no pandaId)
        API-->>Client: 403 { code: "no panda" }
    else no eligible card
        DB-->>API: credential (no card)
        API-->>Client: 404 { code: "no card" }
    else credential + card found
        DB-->>API: credential + cardId
        API->>Panda: GET /issuing/cards/{cardId}/processorDetails
        alt processor details found
            Panda-->>API: { processorCardId, timeBasedSecret }
            API-->>Client: 200 { cardId, cardSecret }
        else processor 404
            Panda-->>API: 404
            API-->>Client: 404 { code: "no card" }
        else other error
            Panda-->>API: 5xx
            API-->>Client: 500 (error)
        end
    end

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

🔖 release: server@0.2.68 #793 — Overlaps with card endpoint behavior and wallet/provisioning logic changes.
🥅 server: handle no panda user on card create #791 — Modifies server/api/card.ts handling for panda/card/credential error cases.

Suggested reviewers

cruzdanilo
nfmelendez

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'server: add wallet provisioning endpoint' accurately summarizes the main change, which introduces a new GET /wallet endpoint for wallet provisioning.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch server-provisioning

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

sentry · 2026-04-10T09:39:34Z

✅ All tests passed.

coderabbitai

Actionable comments posted: 2

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 88412791-ba8b-402b-8896-65830bb065b6

📥 Commits

Reviewing files that changed from the base of the PR and between e6efb1b and 9495bf1.

📒 Files selected for processing (4)

.changeset/chilly-suns-dress.md
server/api/card.ts
server/test/api/card.test.ts
server/utils/panda.ts

coderabbitai · 2026-04-10T13:39:59Z

server/api/card.ts

+  .get(
+    "/wallet",
+    auth(),
+    describeRoute({
+      summary: "Get wallet provisioning credentials",
+      tags: ["Card"],
+      security: [{ credentialAuth: [] }],
+      validateResponse: true,
+      responses: {
+        200: {
+          description: "Wallet provisioning credentials",
+          content: {
+            "application/json": {
+              schema: resolver(WalletResponse, { errorMode: "ignore" }),
+            },
+          },
+        },
+        403: {
+          description: "Forbidden",
+          content: {
+            "application/json": { schema: resolver(object({ code: literal("no panda") }), { errorMode: "ignore" }) },
+          },
+        },
+        404: {
+          description: "Not found",
+          content: {
+            "application/json": { schema: resolver(object({ code: literal("no card") }), { errorMode: "ignore" }) },
+          },
+        },
+      },
+    }),
+    async (c) => {
+      const { credentialId } = c.req.valid("cookie");
+      const credential = await database.query.credentials.findFirst({
+        where: eq(credentials.id, credentialId),
+        columns: { pandaId: true },
+        with: { cards: { columns: { id: true }, where: inArray(cards.status, ["ACTIVE", "FROZEN"]) } },
+      });
+      if (!credential) return c.json({ code: "no credential" }, 500);
+      if (!credential.pandaId) return c.json({ code: "no panda" }, 403);
+      if (!credential.cards[0]) return c.json({ code: "no card" }, 404);
+      try {
+        const provisioning = await getProcessorDetails(credential.cards[0].id);
+        return c.json({ cardId: provisioning.processorCardId, cardSecret: provisioning.timeBasedSecret } satisfies InferOutput<typeof WalletResponse>, 200);


⚠️ Potential issue | 🔴 Critical

Protect cardSecret the same way card PAN/CVC are protected.

timeBasedSecret is wallet-provisioning material, but this route returns it in clear text behind only the signed auth cookie. The existing GET / flow requires a caller-provided sessionid and encrypts the returned card secrets; /wallet drops that extra protection for an equally sensitive credential. Please reuse the same session-bound envelope here, or another equivalent proof-of-possession mechanism, before returning cardSecret.

coderabbitai · 2026-04-10T13:39:59Z

server/api/card.ts

+      const credential = await database.query.credentials.findFirst({
+        where: eq(credentials.id, credentialId),
+        columns: { pandaId: true },
+        with: { cards: { columns: { id: true }, where: inArray(cards.status, ["ACTIVE", "FROZEN"]) } },
+      });
+      if (!credential) return c.json({ code: "no credential" }, 500);
+      if (!credential.pandaId) return c.json({ code: "no panda" }, 403);
+      if (!credential.cards[0]) return c.json({ code: "no card" }, 404);
+      try {
+        const provisioning = await getProcessorDetails(credential.cards[0].id);
+        return c.json({ cardId: provisioning.processorCardId, cardSecret: provisioning.timeBasedSecret } satisfies InferOutput<typeof WalletResponse>, 200);


⚠️ Potential issue | 🟠 Major

Choose the wallet card deterministically.

The relation query can return multiple ACTIVE/FROZEN rows, and credential.cards[0] then depends on database order. The schema shown for cards does not enforce a single non-deleted card per credential, so this endpoint can provision the wrong card if stale eligible rows coexist. Add an explicit ordering or otherwise constrain the query to the intended current card before calling Panda.

coderabbitai

Actionable comments posted: 1

♻️ Duplicate comments (2)

server/api/card.ts (2)

613-626: ⚠️ Potential issue | 🔴 Critical

Protect wallet provisioning secrets with proof-of-possession.

timeBasedSecret is returned in clear text behind only the auth cookie, while the existing GET / flow requires a caller-provided sessionid and returns encrypted card secrets. /wallet is exposing equivalent provisioning material with weaker protection.

615-625: ⚠️ Potential issue | 🟠 Major

Choose the wallet card deterministically.

This query can return multiple ACTIVE/FROZEN rows, and credential.cards[0] then depends on database order. server/database/schema.ts:24-54 only indexes credential_id, so stale eligible rows can make /wallet provision the wrong card.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 45ecefb7-8b50-4ff9-b2a0-080f60291d69

📥 Commits

Reviewing files that changed from the base of the PR and between 9495bf1 and 0975d4d.

📒 Files selected for processing (4)

.changeset/chilly-suns-dress.md
server/api/card.ts
server/test/api/card.test.ts
server/utils/panda.ts

coderabbitai · 2026-04-10T14:04:42Z

server/api/card.ts

+      responses: {
+        200: {
+          description: "Wallet provisioning credentials",
+          content: {
+            "application/json": {
+              schema: resolver(WalletResponse, { errorMode: "ignore" }),
+            },
+          },
+        },
+        403: {
+          description: "Forbidden",
+          content: {
+            "application/json": { schema: resolver(object({ code: literal("no panda") }), { errorMode: "ignore" }) },
+          },
+        },
+        404: {
+          description: "Not found",
+          content: {
+            "application/json": { schema: resolver(object({ code: literal("no card") }), { errorMode: "ignore" }) },
+          },
+        },
+      },


⚠️ Potential issue | 🟡 Minor

Document the 500 responses this route already emits.

validateResponse is enabled, but the handler returns 500 { code: "no credential" } on Line 620 and can propagate other 5xx failures on Lines 627-629. The OpenAPI block omits 500 entirely, so the contract does not match runtime behavior.

🩹 Proposed contract update

responses: { description: "Wallet provisioning credentials", content: { "application/json": { schema: resolver(WalletResponse, { errorMode: "ignore" }), }, }, }, description: "Forbidden", content: { "application/json": { schema: resolver(object({ code: literal("no panda") }), { errorMode: "ignore" }) }, }, }, description: "Not found", content: { "application/json": { schema: resolver(object({ code: literal("no card") }), { errorMode: "ignore" }) }, }, }, + 500: { + description: "Internal server error", + content: { + "application/json": { schema: resolver(object({ code: literal("no credential") }), { errorMode: "ignore" }) }, + }, + }, },

Also applies to: 620-629

aguxez requested review from cruzdanilo and nfmelendez as code owners April 10, 2026 09:27

aguxez force-pushed the server-provisioning branch from 7de9bc2 to 1d0aa0f Compare April 10, 2026 09:27

aguxez marked this pull request as draft April 10, 2026 09:27

This comment was marked as resolved.

Sign in to view

aguxez force-pushed the server-provisioning branch 3 times, most recently from af7c987 to 9495bf1 Compare April 10, 2026 13:10

coderabbitai bot reviewed Apr 10, 2026

View reviewed changes

✨ server: add wallet provisioning endpoint

0975d4d

aguxez force-pushed the server-provisioning branch from 9495bf1 to 0975d4d Compare April 10, 2026 13:46

coderabbitai bot reviewed Apr 10, 2026

View reviewed changes

aguxez marked this pull request as ready for review April 10, 2026 16:12

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

✨ server: add wallet provisioning endpoint#949

✨ server: add wallet provisioning endpoint#949
aguxez wants to merge 1 commit intomainfrom
server-provisioning

aguxez commented Apr 10, 2026 •

edited by coderabbitai bot

Loading

Uh oh!

changeset-bot bot commented Apr 10, 2026 •

edited

Loading

Uh oh!

coderabbitai bot commented Apr 10, 2026 •

edited

Loading

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

sentry bot commented Apr 10, 2026 •

edited

Loading

Uh oh!

coderabbitai bot left a comment

Uh oh!

coderabbitai bot Apr 10, 2026

Uh oh!

coderabbitai bot Apr 10, 2026

Uh oh!

coderabbitai bot left a comment

Uh oh!

coderabbitai bot Apr 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

aguxez commented Apr 10, 2026 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

changeset-bot bot commented Apr 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

coderabbitai bot commented Apr 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Possibly related PRs

Suggested reviewers

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

sentry bot commented Apr 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

aguxez commented Apr 10, 2026 •

edited by coderabbitai bot

Loading

changeset-bot bot commented Apr 10, 2026 •

edited

Loading

coderabbitai bot commented Apr 10, 2026 •

edited

Loading

sentry bot commented Apr 10, 2026 •

edited

Loading